unkinben
b67d873c66
Reshapes the three DNS tiers from separate ns-* namespaces into a single bind-internal namespace and renames the StatefulSets, and scopes the TSIG keys to their cluster (needs the clusterRef field from operator v0.1.3). - move the 3 clusters + zones + keys into apps/base/bind-internal: BindCluster names bind-authoritative / bind-resolvers / bind-externaldns (= StatefulSet names), LBs kept on .6/.7/.8, external-dns hostnames renamed - add clusterRef to the transfer-key (bind-authoritative) and externaldns-key (bind-externaldns) TSIG keys so they no longer leak across clusters - remove the old ns-auth / ns-resolver / ns-externaldns apps - ApplicationSet + AppProject: replace the three ns-* entries with bind-internal - bump bind-system operator to v0.1.3 (CRD install link + image) so the CRDs understand the new clusterRef field - operator stays in bind-system (unchanged)
35 lines
913 B
YAML
35 lines
913 B
YAML
# k8s external-dns zones migrated from puppet-prod
|
|
# (externaldns::k8s_zones in hieradata/roles/infra/dns/externaldns.yaml).
|
|
# Primary + dynamicUpdate: the Kubernetes external-dns controller writes
|
|
# records here via RFC2136 authenticated with externaldns-key.
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindZone
|
|
metadata:
|
|
name: k8s-syd1-au-unkin-net
|
|
namespace: bind-internal
|
|
spec:
|
|
clusterRef: bind-externaldns
|
|
zoneName: k8s.syd1.au.unkin.net
|
|
type: primary
|
|
defaultTTL: 600
|
|
dynamicUpdate: true
|
|
updateKeyRef: externaldns-key
|
|
allowTransfer:
|
|
- key externaldns-key
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindZone
|
|
metadata:
|
|
name: 200-18-198-in-addr-arpa
|
|
namespace: bind-internal
|
|
spec:
|
|
clusterRef: bind-externaldns
|
|
zoneName: 200.18.198.in-addr.arpa
|
|
type: primary
|
|
defaultTTL: 600
|
|
dynamicUpdate: true
|
|
updateKeyRef: externaldns-key
|
|
allowTransfer:
|
|
- key externaldns-key
|