unkinben
421df740ea
## Why `identity.unkin.net` is configured as the Authentik OIDC issuer but has **no DNS record anywhere**, so in-cluster OIDC discovery fails (e.g. `argocd-server` → `lookup identity.unkin.net ... no such host`). Add an authoritative A record served by the internal bind system (bind-operator) so it resolves. ## Change - New `DNSRecord/identity-dns-internal` → `198.18.200.4` (the traefik-internal gateway VIP, where the Authentik Gateway serves the `identity.unkin.net` hostname), in the `unkin-net` zone. - Lives in the **`bind-internal` namespace** alongside the `BindZone`: the operator resolves `zoneRef`/`clusterRef`/`updateKeyRef` within the record's own namespace, so it can't live in the app (authentik) namespace. - Wired into `apps/base/bind-internal/authoritative/kustomization.yaml`. - `identity-dns-internal` name distinguishes this from the external DNS that Authentik will manage its own records from later. ## Validation `kustomize build apps/base/bind-internal` + kubeconform (validates against the `dnsrecord_v1alpha1` schema): 57 valid, 0 invalid. pre-commit clean. Reviewed-on: #256 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>
22 lines
753 B
YAML
22 lines
753 B
YAML
# Individually-managed authoritative records for the unkin.net zone.
|
|
# DNSRecords must live in the same namespace as their BindZone (the operator
|
|
# resolves zoneRef/clusterRef/updateKeyRef within the record's namespace), so
|
|
# these sit alongside the zone in bind-internal, not in the app namespace.
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: DNSRecord
|
|
metadata:
|
|
# "internal" in the name distinguishes this from the external DNS that
|
|
# Authentik will manage its own records from later.
|
|
name: identity-dns-internal
|
|
namespace: bind-internal
|
|
spec:
|
|
zoneRef: unkin-net
|
|
name: identity
|
|
type: A
|
|
ttl: 600
|
|
values:
|
|
# traefik-internal gateway VIP; the authentik Gateway serves the
|
|
# identity.unkin.net hostname there.
|
|
- 198.18.200.4
|