Reconcile zone apex NS off the pod IP placeholder #22

Merged

benvin merged 5 commits from benvin/zone-nameservers into main 2026-09-26 23:49:01 +10:00

Conversation 4 Commits 5 Files Changed 17

+629 -53

5 Commits

Author	SHA1	Message	Date
unkin-agent	cc714dc2b4	apply records before the apex NS, so in-zone glue exists first ... named rejects an apex NS pointing at an in-zone name with no address record, so the glue has to land in an earlier transaction.	2026-09-26 19:41:53 +10:00
unkin-agent	08d46ccce0	read the live apex NS with a signed query, retract nothing when unreadable ... An unsigned localhost query is REFUSED for a zone behind a key-matched view and answers empty with exit 0; signing it with the update creds reaches the view.	2026-09-26 19:25:06 +10:00
unkin-agent	dc57ac1b2d	retract apex NS from recorded state, not a live query ... An unsigned localhost query silently returns nothing for a zone behind a BindView, which would strand the placeholder. Record what was published instead.	2026-09-26 19:06:47 +10:00
unkin-agent	e4ed6c8052	converge apex NS per record, not by RRset replace ... BIND ignores an RRset-wide delete of apex NS, so the previous replace only appended to the seed placeholder.	2026-09-26 18:50:55 +10:00
unkin-agent	4a41cbc427	reconcile zone apex NS off the pod IP placeholder ... Add BindZone.spec.nameservers and sync the apex NS RRset on every reconcile.	2026-09-26 18:27:11 +10:00