---
# TSIG key used to authenticate zone transfers between primary and secondaries
# (and catalog zone transfers). The operator generates the material into a
# Secret named <name>-tsig; the key never appears in the CR.
apiVersion: bind.unkin.net/v1alpha1
kind: BindTSIGKey
metadata:
  name: transfer-key
  namespace: bind-auth
spec:
  algorithm: hmac-sha256
---
# TSIG key permitting external-dns (and DNSRecord objects) to send RFC2136
# dynamic updates to the dynamic cluster's primary.
apiVersion: bind.unkin.net/v1alpha1
kind: BindTSIGKey
metadata:
  name: externaldns-key
  namespace: bind-externaldns
spec:
  algorithm: hmac-sha256