unkinben
7c9a697452
Part of the bind rollout split. **Merge #219 (bind-operator) first** — stacked on it; diff reduces to the binddns-externaldns files once #219 merges. ## Why The external-dns tier (replaces 3x Puppet external-dns servers): an authoritative cluster whose zones accept RFC2136 TSIG updates from external-dns. ## Changes - `apps/base/binddns-externaldns`: authoritative `BindCluster` (3 replicas, LoadBalancer/PureLB), `BindTSIGKey` for RFC2136, namespace - au-syd1 `binddns-externaldns` overlay ## Deploy impact Creates the `binddns-externaldns` StatefulSet + LoadBalancer once merged. Reviewed-on: #222 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>
35 lines
905 B
YAML
35 lines
905 B
YAML
# k8s external-dns zones migrated from puppet-prod
|
|
# (externaldns::k8s_zones in hieradata/roles/infra/dns/externaldns.yaml).
|
|
# Primary + dynamicUpdate: the Kubernetes external-dns controller writes
|
|
# records here via RFC2136 authenticated with externaldns-key.
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindZone
|
|
metadata:
|
|
name: k8s-syd1-au-unkin-net
|
|
namespace: ns-externaldns
|
|
spec:
|
|
clusterRef: externaldns
|
|
zoneName: k8s.syd1.au.unkin.net
|
|
type: primary
|
|
defaultTTL: 600
|
|
dynamicUpdate: true
|
|
updateKeyRef: externaldns-key
|
|
allowTransfer:
|
|
- key externaldns-key
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindZone
|
|
metadata:
|
|
name: 200-18-198-in-addr-arpa
|
|
namespace: ns-externaldns
|
|
spec:
|
|
clusterRef: externaldns
|
|
zoneName: 200.18.198.in-addr.arpa
|
|
type: primary
|
|
defaultTTL: 600
|
|
dynamicUpdate: true
|
|
updateKeyRef: externaldns-key
|
|
allowTransfer:
|
|
- key externaldns-key
|