---
# Authoritative masters role (replaces 3x Puppet authoritative servers).
# Ordinal-0 is the primary holding zone data; the other two replicate via the
# catalog zone + AXFR/IXFR.
apiVersion: bind.unkin.net/v1alpha1
kind: BindCluster
metadata:
  name: auth
  namespace: bind-auth
spec:
  mode: authoritative
  replicas: 3
  storageSize: 2Gi
  service:
    type: LoadBalancer
  resources:
    requests:
      cpu: 100m
      memory: 128Mi
    limits:
      cpu: "1"
      memory: 512Mi
---
apiVersion: bind.unkin.net/v1alpha1
kind: BindACL
metadata:
  name: internal-nets
  namespace: bind-auth
spec:
  clusterRef: auth
  entries:
    - 10.0.0.0/8
    - 192.168.0.0/16
---
# Catalog zone: new BindZones are auto-provisioned onto the secondaries.
apiVersion: bind.unkin.net/v1alpha1
kind: BindCatalogZone
metadata:
  name: auth-catalog
  namespace: bind-auth
spec:
  clusterRef: auth
  zoneName: catalog.internal
  transferKeyRef: transfer-key
---
apiVersion: bind.unkin.net/v1alpha1
kind: BindDNSSECPolicy
metadata:
  name: standard
  namespace: bind-auth
spec:
  clusterRef: auth
  algorithm: ecdsap256sha256
  nsec3: true
  csk:
    lifetime: unlimited
---
# Forward zone (signed) with a couple of seeded records.
apiVersion: bind.unkin.net/v1alpha1
kind: BindZone
metadata:
  name: example-internal
  namespace: bind-auth
spec:
  clusterRef: auth
  zoneName: internal.example.com
  type: primary
  defaultTTL: 3600
  dnssecPolicyRef: standard
  allowTransfer:
    - key transfer-key
  updateKeyRef: transfer-key
  dynamicUpdate: true
  records:
    - name: "@"
      type: NS
      values: ["ns1.internal.example.com."]
    - name: ns1
      type: A
      values: ["10.0.0.53"]
    - name: www
      type: A
      values: ["10.0.1.10", "10.0.1.11"]
---
# Reverse zone for 10.0.0.0/16.
apiVersion: bind.unkin.net/v1alpha1
kind: BindZone
metadata:
  name: reverse-10-0
  namespace: bind-auth
spec:
  clusterRef: auth
  zoneName: 0.10.in-addr.arpa
  type: primary
  updateKeyRef: transfer-key
  dynamicUpdate: true
  allowTransfer:
    - key transfer-key
  records:
    - name: "53.0"
      type: PTR
      values: ["ns1.internal.example.com."]