Every bind-operator dynamic update was refused ("denied due to allow-query")
because the operator execs nsupdate against 127.0.0.1 inside the primary pod,
and allow-query listed only the client subnets (auth-acl-main) and the pod net
(10.42.0.0/16) -- not loopback. This blocked ALL DNSRecords (identity, s3,
dashboard, lb1) from ever applying.
- Add localhost to the BindCluster allow-query so in-pod nsupdate passes
query-authorization; the TSIG key (client-update) still gates the update.
benvin
d5b1c88c49