---
# external-dns role (replaces 3x Puppet external-dns servers). This is an
# ordinary authoritative cluster; external-dns writes to the zone below via
# RFC2136 because the zone sets dynamicUpdate (allow-update { key ... }).
apiVersion: bind.unkin.net/v1alpha1
kind: BindCluster
metadata:
  name: externaldns
  namespace: bind-externaldns
spec:
  mode: authoritative
  replicas: 3
  service:
    type: LoadBalancer
---
# Public zone that external-dns writes into via nsupdate/TSIG.
apiVersion: bind.unkin.net/v1alpha1
kind: BindZone
metadata:
  name: example-com
  namespace: bind-externaldns
spec:
  clusterRef: externaldns
  zoneName: example.com
  type: primary
  dynamicUpdate: true
  updateKeyRef: externaldns-key
  allowTransfer:
    - key externaldns-key
---
# A record managed as a CRD (external-dns-style) instead of via the RFC2136
# controller — same write path (TSIG nsupdate to the primary).
apiVersion: bind.unkin.net/v1alpha1
kind: DNSRecord
metadata:
  name: www-example-com
  namespace: bind-externaldns
spec:
  zoneRef: example-com
  name: www
  type: A
  ttl: 300
  values:
    - 203.0.113.10