---
# TSIG key used to authenticate zone transfers between primary and secondaries
# (and catalog zone transfers). The operator generates the material into a
# Secret named <name>-tsig; the key never appears in the CR.
apiVersion: bind.unkin.net/v1alpha1
kind: BindTSIGKey
metadata:
  name: transfer-key
  namespace: bind-auth
spec:
  algorithm: hmac-sha256
---
# TSIG key permitting external-dns (and DNSRecord objects) to send RFC2136
# dynamic updates to the dynamic cluster's primary. secretTemplate mirrors the
# generated Secret into the external-dns namespace via emberstack reflector, so
# external-dns presents exactly the key the primary's allow-update accepts.
apiVersion: bind.unkin.net/v1alpha1
kind: BindTSIGKey
metadata:
  name: externaldns-key
  namespace: bind-externaldns
spec:
  algorithm: hmac-sha256
  secretTemplate:
    annotations:
      reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "externaldns"
      reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "externaldns"