unkinben
4163bf80b3
identity.unkin.net was configured as the Authentik OIDC issuer but has no DNS record anywhere, so in-cluster OIDC discovery (e.g. argocd-server) fails to resolve it. Add an authoritative A record via the bind-operator so the internal bind system serves it. - New DNSRecord identity-dns-internal -> 198.18.200.4 (traefik-internal VIP, where the authentik Gateway serves the identity.unkin.net hostname). - Placed in the bind-internal namespace alongside the unkin-net BindZone: the operator resolves zoneRef/clusterRef/updateKeyRef within the record's own namespace, so it cannot live in the app namespace. - "internal" in the name distinguishes it from the external DNS Authentik will manage its own records from later.
22 lines
753 B
YAML
22 lines
753 B
YAML
# Individually-managed authoritative records for the unkin.net zone.
|
|
# DNSRecords must live in the same namespace as their BindZone (the operator
|
|
# resolves zoneRef/clusterRef/updateKeyRef within the record's namespace), so
|
|
# these sit alongside the zone in bind-internal, not in the app namespace.
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: DNSRecord
|
|
metadata:
|
|
# "internal" in the name distinguishes this from the external DNS that
|
|
# Authentik will manage its own records from later.
|
|
name: identity-dns-internal
|
|
namespace: bind-internal
|
|
spec:
|
|
zoneRef: unkin-net
|
|
name: identity
|
|
type: A
|
|
ttl: 600
|
|
values:
|
|
# traefik-internal gateway VIP; the authentik Gateway serves the
|
|
# identity.unkin.net hostname there.
|
|
- 198.18.200.4
|