unkin-agent
812a9a2f2b
The acme.unkin.net zone still serves only the bind-operator seed apex: NS ns1.acme.unkin.net glued to A 10.42.6.38, a pod IP no pod holds. The parent delegates to acme-ns1.unkin.net, but public resolvers have already promoted the child NS RRset, so when the cached address expires DNS-01 fails for every unkin.net wildcard at once. - Add apex NS acme-ns1.unkin.net., matching the parent delegation (out of zone, no glue needed). - Point ns1.acme.unkin.net at 103.216.191.185 so resolvers holding the seeded NS name still reach the zone. - The operator seed placeholder itself is tracked separately in bind-operator. --------- Co-authored-by: unkin-agent <agent@unkin.net> Reviewed-on: #486 Co-authored-by: Unkin Agent <unkin-agent@unkin.net> Co-committed-by: Unkin Agent <unkin-agent@unkin.net>
12 lines
196 B
YAML
12 lines
196 B
YAML
---
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
|
|
resources:
|
|
- namespace.yaml
|
|
- cluster.yaml
|
|
- tsigkey.yaml
|
|
- zones.yaml
|
|
- records.yaml
|
|
- agent-dns-rolebinding.yaml
|