Add clusterRef to BindTSIGKey #4

2026-07-03T23:44:36+10:00

unkinben commented

2026-07-03 23:44:36 +10:00

Lets a TSIG key target a specific BindCluster, so keys don't leak across clusters that share a namespace (needed for the bind-internal consolidation where all three clusters live in one namespace).

Changes

BindTSIGKey.spec.clusterRef (optional; empty = shared with all clusters in the namespace, like BindACL)
reconcileKeysSecret includes only keys whose clusterRef matches the cluster or is empty
regenerated CRDs + config/crd/install.yaml

All other CRDs already support instance targeting via clusterRef (or zoneRef for DNSRecord).

Follow-up

Merge + tag v0.1.3; bump the operator image in argocd-apps.

Lets a TSIG key target a specific BindCluster, so keys don't leak across clusters that share a namespace (needed for the bind-internal consolidation where all three clusters live in one namespace). ## Changes - `BindTSIGKey.spec.clusterRef` (optional; empty = shared with all clusters in the namespace, like BindACL) - `reconcileKeysSecret` includes only keys whose clusterRef matches the cluster or is empty - regenerated CRDs + `config/crd/install.yaml` All other CRDs already support instance targeting via `clusterRef` (or `zoneRef` for DNSRecord). ## Follow-up Merge + tag **v0.1.3**; bump the operator image in argocd-apps.

unkinben added 1 commit 2026-07-03 23:44:36 +10:00

Add clusterRef to BindTSIGKey

ci/woodpecker/pr/build Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/test Pipeline was successful

Details

55e80b467c

TSIG keys were included in every cluster's keys.conf namespace-wide. When
multiple clusters share a namespace, that leaks keys across clusters. Add
spec.clusterRef so a key can target a specific BindCluster; empty keeps
the shared (all-clusters-in-namespace) behaviour.

- api: BindTSIGKey.spec.clusterRef (optional)
- BindCluster keys.conf now includes only keys with matching or empty
  clusterRef
- regenerate CRDs + install.yaml bundle

benvin merged commit f0e851c0bc into main

2026-07-04 00:03:42 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/bind-operator#4