Accept intra-cluster NOTIFY on secondaries via allow-notify

Secondaries transfer catalog member and plain secondary zones from the
primary Service ClusterIP (stable across primary pod restarts), and BIND
derives a zone's implicit allow-notify from its primaries list. But the
primary pod's NOTIFYs egress with its *pod* IP as source — k8s Services
NAT only the inbound direction — so BIND refuses them as "refused notify
from non-primary" and replication falls back to the SOA refresh timer, a
1-hour propagation delay on every dynamic zone (external-dns RFC2136 and
dns-updater nsupdates alike).

Render an options-scope allow-notify on secondaries covering the primary
pod IP (and the transfer address, since an explicit allow-notify replaces
the primaries-derived default). The cluster controller resolves the
primary pod IP the same way it already does for seeding/also-notify, and
the existing Pod watch re-renders the ConfigMap when the pod IP changes.

internal/bind/render_test.go

@@ -98,6 +98,34 @@ func TestRenderCatalogPrimariesCarryTransferKey(t *testing.T) {
 	}
 }
 
+func TestRenderSecondaryAllowNotifyPrimaryPodIP(t *testing.T) {
+	// Secondaries transfer from the primary Service ClusterIP but the primary's
+	// NOTIFYs arrive from its pod IP, so an options allow-notify must cover the
+	// pod IP (and keep the transfer address) or BIND refuses them as non-primary.
+	in := RenderInput{
+		Cluster:             newCluster(bindv1alpha1.ModeAuthoritative),
+		PrimaryAddress:      "10.43.5.5",
+		PrimaryPodAddresses: []string{"10.42.3.197"},
+	}
+	primary, secondary := RenderNamedConf(in)
+	if !strings.Contains(secondary, "allow-notify { 10.42.3.197; 10.43.5.5; };") {
+		t.Fatalf("secondary allow-notify must cover the primary pod IP and transfer address:\n%s", secondary)
+	}
+	if strings.Contains(primary, "allow-notify") {
+		t.Fatalf("primary must not render allow-notify (it is the notifier, not a secondary):\n%s", primary)
+	}
+}
+
+func TestRenderSecondaryAllowNotifyOmittedWhenPodIPUnknown(t *testing.T) {
+	// With no primary pod IP known there is nothing to add beyond BIND's implicit
+	// primaries-derived default; emit nothing rather than a bare/duplicate clause.
+	in := RenderInput{Cluster: newCluster(bindv1alpha1.ModeAuthoritative)}
+	_, secondary := RenderNamedConf(in)
+	if strings.Contains(secondary, "allow-notify") {
+		t.Fatalf("no allow-notify should be emitted when no primary addresses are known:\n%s", secondary)
+	}
+}
+
 func TestRenderForwardZoneInView(t *testing.T) {
 	rec := true
 	in := RenderInput{