The dynamic mode produced a byte-identical cluster to authoritative:
RFC2136 update capability is a per-zone property (BindZone.dynamicUpdate
+ updateKeyRef render allow-update { key ... }), not a cluster role. The
external-dns tier is just an authoritative cluster whose zones allow
dynamic updates.
- remove BindMode dynamic from the enum and constants
- switch the external-dns sample to mode authoritative
- update README migration mapping
Implements a Kubernetes operator that manages fleets of BIND9 servers
declaratively, using controller-runtime (matching forgebot conventions).
- add BindCluster reconciler: StatefulSet (pod-0 primary, secondaries),
headless + client Services, rendered named.conf ConfigMap, TSIG keys
Secret and rndc control Secret; watches dependent CRs to re-render
- add BindTSIGKey reconciler that generates key material into a Secret
- add BindZone/DNSRecord reconcilers using fully-dynamic delivery
(rndc addzone + TSIG nsupdate against the primary pod)
- add BindCatalogZone reconciler so secondaries auto-provision zones
- add BindPolicy (RPZ), BindDNSSECPolicy, BindView, BindACL reconcilers
- render primary/secondary named.conf variants selected by pod ordinal
- generate CRDs, deepcopy and RBAC; add samples mapping the three Puppet
roles (authoritative/resolver/external-dns) to three BindClusters
- add Makefile, Dockerfile.operator, Woodpecker CI and kind manifests
unkinben