Add a primary (write) Service routing to pod-0 #7

2026-07-04T22:29:56+10:00

unkinben commented

2026-07-04 22:29:56 +10:00

Stacked on #6 (reuses the externalTrafficPolicy field) — merge #6 first; the diff collapses to just this change after.

Why

Secondaries reject RFC2136/nsupdate writes, but the read Service round-robins across all pods, so writes land on a secondary ~2/3 of the time. Adds a dedicated write endpoint to the primary pod. AXFR replication (reads) is already handled by the catalog zone.

Changes

BindCluster.spec.primaryService (*ClusterServiceSpec, optional): creates <cluster>-primary selecting only pod-0 (via statefulset.kubernetes.io/pod-name). ClusterIP for in-cluster writers (external-dns), LoadBalancer for external. Deleted when unset.
regenerated CRDs + install.yaml

Follow-up

Merge #6 + this → tag v0.1.5 (single tag covers both); then in argocd set primaryService on externaldns (ClusterIP) + authoritative (LoadBalancer), and point external-dns's rfc2136-host at bind-externaldns-primary.

**Stacked on #6** (reuses the externalTrafficPolicy field) — merge #6 first; the diff collapses to just this change after. ## Why Secondaries reject RFC2136/nsupdate writes, but the read Service round-robins across all pods, so writes land on a secondary ~2/3 of the time. Adds a dedicated write endpoint to the primary pod. AXFR replication (reads) is already handled by the catalog zone. ## Changes - `BindCluster.spec.primaryService` (*ClusterServiceSpec, optional): creates `<cluster>-primary` selecting only pod-0 (via `statefulset.kubernetes.io/pod-name`). ClusterIP for in-cluster writers (external-dns), LoadBalancer for external. Deleted when unset. - regenerated CRDs + install.yaml ## Follow-up Merge #6 + this → tag **v0.1.5** (single tag covers both); then in argocd set primaryService on externaldns (ClusterIP) + authoritative (LoadBalancer), and point external-dns's rfc2136-host at bind-externaldns-primary.

unkinben added 2 commits 2026-07-04 22:29:56 +10:00

Support externalTrafficPolicy on the client Service

ci/woodpecker/pr/build Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/test Pipeline was successful

Details

e0bd3973ed

Adds BindCluster.spec.service.externalTrafficPolicy so DNS LoadBalancers
can preserve client source IPs (Local), which the source-IP ACLs on the
authoritative/resolver need to actually restrict external clients (Cluster
SNATs everything to node IPs).

- api: ClusterServiceSpec.externalTrafficPolicy (enum Cluster;Local)
- set it on the client Service for LoadBalancer/NodePort types
- regenerate CRDs + install.yaml

Add a primary (write) Service routing to pod-0

ci/woodpecker/pr/build Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/test Pipeline was successful

Details

28ae6538cb

Secondaries reject RFC2136/nsupdate writes, but the read Service round-
robins across all pods. Add an optional per-cluster write endpoint that
targets only the primary pod (ordinal 0) via the StatefulSet pod-name
label. Reads keep using the all-pods Service.

- api: BindCluster.spec.primaryService (*ClusterServiceSpec) — ClusterIP
  for in-cluster writers (external-dns) or LoadBalancer for external
- reconcilePrimaryService creates <cluster>-primary selecting pod-0 when
  set, deletes it when unset
- regenerate CRDs + install.yaml

benvin merged commit 49df29a072 into main

2026-07-04 22:37:40 +10:00

benvin deleted branch benvin/primary-write-service

2026-07-04 22:37:40 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/bind-operator#7