unkinben
9c81320df8
The operator-generated TSIG Secret previously carried only the managed-by
label, so it could not be mirrored to another namespace by emberstack
reflector (which requires reflection-allowed annotations on the source).
Add spec.secretTemplate.{annotations,labels}, applied both when the Secret
is first generated and reconciled onto the existing Secret when the CR
changes (imported secrets are left untouched so we don't fight their
external manager). This lets the external-dns TSIG key be managed in
bind-internal and reflected into the externaldns namespace.
30 lines
1.1 KiB
YAML
30 lines
1.1 KiB
YAML
---
|
|
# TSIG key used to authenticate zone transfers between primary and secondaries
|
|
# (and catalog zone transfers). The operator generates the material into a
|
|
# Secret named <name>-tsig; the key never appears in the CR.
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindTSIGKey
|
|
metadata:
|
|
name: transfer-key
|
|
namespace: bind-auth
|
|
spec:
|
|
algorithm: hmac-sha256
|
|
---
|
|
# TSIG key permitting external-dns (and DNSRecord objects) to send RFC2136
|
|
# dynamic updates to the dynamic cluster's primary. secretTemplate mirrors the
|
|
# generated Secret into the external-dns namespace via emberstack reflector, so
|
|
# external-dns presents exactly the key the primary's allow-update accepts.
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindTSIGKey
|
|
metadata:
|
|
name: externaldns-key
|
|
namespace: bind-externaldns
|
|
spec:
|
|
algorithm: hmac-sha256
|
|
secretTemplate:
|
|
annotations:
|
|
reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
|
|
reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "externaldns"
|
|
reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
|
|
reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "externaldns"
|