BindTSIGKey: add secretTemplate for Secret labels/annotations #12

2026-07-20T23:45:56+10:00

unkinben commented

2026-07-20 23:45:56 +10:00

Adds spec.secretTemplate.{annotations,labels} to BindTSIGKey, stamped onto the operator-managed Secret both at generation and reconciled on change.

Why

The generated TSIG Secret only carried the managed-by label, so the emberstack reflector could not mirror it to another namespace (reflection requires reflection-allowed annotations on the source). This blocked "manage the external-dns TSIG key in bind-internal, reflect it into the externaldns namespace" — external-dns must present exactly the key the primary's allow-update accepts.

Changes

API: SecretMetadata{Annotations,Labels} + BindTSIGKeySpec.SecretTemplate
Controller: applySecretTemplate merges the managed-by label + template metadata on create, and reconciles it onto the existing Secret when the CR changes. importExisting secrets are skipped (owned by an external manager).
Regenerated CRDs/deepcopy; unit tests for applySecretTemplate; README + sample updated.

Test

make generate && make build && go test ./... — all green; go vet/gofmt clean.

Adds `spec.secretTemplate.{annotations,labels}` to `BindTSIGKey`, stamped onto the operator-managed Secret both at generation and reconciled on change. ## Why The generated TSIG Secret only carried the managed-by label, so the emberstack reflector could not mirror it to another namespace (reflection requires `reflection-allowed` annotations **on the source**). This blocked "manage the external-dns TSIG key in `bind-internal`, reflect it into the `externaldns` namespace" — external-dns must present exactly the key the primary's `allow-update` accepts. ## Changes - API: `SecretMetadata{Annotations,Labels}` + `BindTSIGKeySpec.SecretTemplate` - Controller: `applySecretTemplate` merges the managed-by label + template metadata on create, and reconciles it onto the existing Secret when the CR changes. `importExisting` secrets are skipped (owned by an external manager). - Regenerated CRDs/deepcopy; unit tests for `applySecretTemplate`; README + sample updated. ## Test `make generate && make build && go test ./...` — all green; `go vet`/`gofmt` clean.

unkinben added 1 commit 2026-07-20 23:45:56 +10:00

BindTSIGKey: add secretTemplate for labels/annotations on the managed Secret 9c81320df8

The operator-generated TSIG Secret previously carried only the managed-by
label, so it could not be mirrored to another namespace by emberstack
reflector (which requires reflection-allowed annotations on the source).

Add spec.secretTemplate.{annotations,labels}, applied both when the Secret
is first generated and reconciled onto the existing Secret when the CR
changes (imported secrets are left untouched so we don't fight their
external manager). This lets the external-dns TSIG key be managed in
bind-internal and reflected into the externaldns namespace.

benvin merged commit e4ed9cfdb2 into main

2026-07-20 23:47:21 +10:00

benvin deleted branch benvin/tsigkey-secret-annotations

2026-07-20 23:47:22 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/bind-operator#12