Notify secondaries immediately on primary zone changes

Dynamically-updated primary zones were only reaching the secondary pods on
the hardcoded 1h SOA refresh: the operator emitted no NOTIFY, and a zone's
only apex NS is the primary itself, so default 'notify yes' reached no one.
Queries load-balanced across the serve VIP hit stale secondaries and
returned NXDOMAIN (negatively cached downstream for the 300s SOA minimum),
so records flapped for up to an hour after every update.

Add 'notify explicit' + 'also-notify' with the secondary pod IPs to primary
zone stanzas so an update NOTIFYs the secondaries for an immediate IXFR.
Applied via modzone, so existing zones pick it up on the next reconcile.
Also shorten the seed SOA refresh/retry/minimum as a fallback for missed
NOTIFYs and to shrink stale-NXDOMAIN negative caching.

internal/bind/render.go

@@ -22,15 +22,6 @@ type RenderInput struct {
 	Forwards []bindv1alpha1.BindZone
 	// PrimaryAddress is the in-cluster address secondaries transfer from.
 	PrimaryAddress string
-	// PrimaryPodAddresses are the primary pod's own IP(s). Secondaries transfer
-	// from PrimaryAddress (the stable primary Service ClusterIP) but the primary
-	// pod's NOTIFYs egress with its *pod* IP as the source — k8s Services only
-	// NAT the inbound direction — so BIND, whose implicit allow-notify is the
-	// zone's primaries list (the ClusterIP), REFUSES them as "non-primary" and
-	// replication falls back to the SOA refresh timer. Secondaries render these
-	// into an options-scope allow-notify so intra-cluster NOTIFYs are accepted
-	// immediately. Empty leaves BIND's default behaviour unchanged.
-	PrimaryPodAddresses []string
 }
 
 // RenderNamedConf returns the primary and secondary named.conf contents for a
@@ -95,12 +86,6 @@ func render(in RenderInput, isPrimary bool) string {
 		b.WriteString("    allow-new-zones yes;\n")
 	}
 	b.WriteString("    dnssec-validation auto;\n")
-	// Secondaries accept NOTIFY from the primary's pod IP(s). Catalog member and
-	// plain secondary zones take their implicit allow-notify from their primaries
-	// (the primary Service ClusterIP), but the primary's NOTIFYs are sourced from
-	// its pod IP, so an options-scope allow-notify covering the pod IP(s) is
-	// needed or every NOTIFY is refused and replication waits for the SOA refresh.
-	b.WriteString(allowNotifyClause(in, isPrimary, "    "))
 	for _, o := range c.Spec.ExtraOptions {
 		b.WriteString("    " + strings.TrimRight(o, ";") + ";\n")
 	}
@@ -292,39 +277,6 @@ func transferPrimaries(in RenderInput) []string {
 	return out
 }
 
-// allowNotifyClause renders an options-scope allow-notify on secondaries that
-// permits the primary pod IP(s). Zones (catalog members and plain secondaries)
-// point their primaries at the primary Service ClusterIP for stable AXFR, which
-// also becomes their implicit allow-notify — but NOTIFYs leave the primary pod
-// with its pod IP as source, so without this they are refused as "non-primary".
-// Emitted only on secondaries and only when the primary pod IP(s) are known.
-func allowNotifyClause(in RenderInput, isPrimary bool, indent string) string {
-	if isPrimary {
-		return ""
-	}
-	addrs := make([]string, 0, len(in.PrimaryPodAddresses)+1)
-	seen := map[string]bool{}
-	for _, a := range in.PrimaryPodAddresses {
-		a = strings.TrimSpace(strings.TrimRight(a, ";"))
-		if a == "" || seen[a] {
-			continue
-		}
-		seen[a] = true
-		addrs = append(addrs, a)
-	}
-	// Keep the transfer address (the Service ClusterIP, or the pod IP when no
-	// primary Service exists) in the set: an explicit allow-notify replaces the
-	// implicit primaries-derived default, so it must still cover that source.
-	if a := strings.TrimSpace(strings.TrimRight(in.PrimaryAddress, ";")); a != "" && !seen[a] {
-		addrs = append(addrs, a)
-	}
-	if len(addrs) == 0 {
-		return ""
-	}
-	sort.Strings(addrs)
-	return fmt.Sprintf("%sallow-notify { %s };\n", indent, terminate(addrs))
-}
-
 func catalogZonesClause(in RenderInput, isPrimary bool, indent string) string {
 	// Only secondaries consume the catalog to auto-provision member zones.
 	if in.Catalog == nil || isPrimary {

internal/bind/render_test.go

@@ -98,34 +98,6 @@ func TestRenderCatalogPrimariesCarryTransferKey(t *testing.T) {
 	}
 }
 
-func TestRenderSecondaryAllowNotifyPrimaryPodIP(t *testing.T) {
-	// Secondaries transfer from the primary Service ClusterIP but the primary's
-	// NOTIFYs arrive from its pod IP, so an options allow-notify must cover the
-	// pod IP (and keep the transfer address) or BIND refuses them as non-primary.
-	in := RenderInput{
-		Cluster:             newCluster(bindv1alpha1.ModeAuthoritative),
-		PrimaryAddress:      "10.43.5.5",
-		PrimaryPodAddresses: []string{"10.42.3.197"},
-	}
-	primary, secondary := RenderNamedConf(in)
-	if !strings.Contains(secondary, "allow-notify { 10.42.3.197; 10.43.5.5; };") {
-		t.Fatalf("secondary allow-notify must cover the primary pod IP and transfer address:\n%s", secondary)
-	}
-	if strings.Contains(primary, "allow-notify") {
-		t.Fatalf("primary must not render allow-notify (it is the notifier, not a secondary):\n%s", primary)
-	}
-}
-
-func TestRenderSecondaryAllowNotifyOmittedWhenPodIPUnknown(t *testing.T) {
-	// With no primary pod IP known there is nothing to add beyond BIND's implicit
-	// primaries-derived default; emit nothing rather than a bare/duplicate clause.
-	in := RenderInput{Cluster: newCluster(bindv1alpha1.ModeAuthoritative)}
-	_, secondary := RenderNamedConf(in)
-	if strings.Contains(secondary, "allow-notify") {
-		t.Fatalf("no allow-notify should be emitted when no primary addresses are known:\n%s", secondary)
-	}
-}
-
 func TestRenderForwardZoneInView(t *testing.T) {
 	rec := true
 	in := RenderInput{

internal/controller/bindcluster_controller.go

@@ -176,14 +176,6 @@ func (r *BindClusterReconciler) reconcileConfigMap(ctx context.Context, c *bindv
 	// across primary pod restarts (falls back to the pod IP when no primary
 	// Service exists; the Pod/Service watches re-render when it changes).
 	in := bind.RenderInput{Cluster: c, PrimaryAddress: primaryTransferAddress(ctx, r.Client, c)}
-	// Secondaries transfer from the stable primary Service ClusterIP, but the
-	// primary pod's NOTIFYs are sourced from its pod IP, which BIND refuses as
-	// "non-primary" unless it appears in allow-notify. Render the primary pod IP
-	// so intra-cluster NOTIFYs are accepted immediately (the Pod watch re-renders
-	// the ConfigMap when the pod IP changes across restarts).
-	if ip := primaryPodIP(ctx, r.Client, c); ip != "" {
-		in.PrimaryPodAddresses = []string{ip}
-	}
 
 	var acls bindv1alpha1.BindACLList
 	if err := r.List(ctx, &acls, client.InNamespace(c.Namespace)); err == nil {