reconcile zone apex NS off the pod IP placeholder

Add BindZone.spec.nameservers and sync the apex NS RRset on every reconcile.

api/v1alpha1/bindzone_types.go

@@ -64,6 +64,15 @@ type BindZoneSpec struct {
 	// +optional
 	DefaultTTL int32 `json:"defaultTTL,omitempty"`
 
+	// Nameservers are the names published in the zone's apex NS RRset, kept in
+	// sync on every reconcile. Each entry is a full domain name, never relative
+	// to the zone. Prefer out-of-zone names glued by the parent: an
+	// in-zone name needs an address record in the zone, and the seed can only
+	// supply the primary pod's (unstable) IP for it. When empty the apex NS is
+	// the primary's stable in-cluster DNS name.
+	// +optional
+	Nameservers []string `json:"nameservers,omitempty"`
+
 	// Records are static record sets seeded into a primary zone.
 	// +optional
 	Records []Record `json:"records,omitempty"`

api/v1alpha1/zz_generated.deepcopy.go

@@ -970,6 +970,11 @@ func (in *BindZoneList) DeepCopyObject() runtime.Object {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *BindZoneSpec) DeepCopyInto(out *BindZoneSpec) {
 	*out = *in
+	if in.Nameservers != nil {
+		in, out := &in.Nameservers, &out.Nameservers
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
 	if in.Records != nil {
 		in, out := &in.Records, &out.Records
 		*out = make([]Record, len(*in))