unkinben
e60080efa2
The dynamic mode produced a byte-identical cluster to authoritative:
RFC2136 update capability is a per-zone property (BindZone.dynamicUpdate
+ updateKeyRef render allow-update { key ... }), not a cluster role. The
external-dns tier is just an authoritative cluster whose zones allow
dynamic updates.
- remove BindMode dynamic from the enum and constants
- switch the external-dns sample to mode authoritative
- update README migration mapping
45 lines
1.1 KiB
YAML
45 lines
1.1 KiB
YAML
---
|
|
# external-dns role (replaces 3x Puppet external-dns servers). This is an
|
|
# ordinary authoritative cluster; external-dns writes to the zone below via
|
|
# RFC2136 because the zone sets dynamicUpdate (allow-update { key ... }).
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindCluster
|
|
metadata:
|
|
name: externaldns
|
|
namespace: bind-externaldns
|
|
spec:
|
|
mode: authoritative
|
|
replicas: 3
|
|
service:
|
|
type: LoadBalancer
|
|
---
|
|
# Public zone that external-dns writes into via nsupdate/TSIG.
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindZone
|
|
metadata:
|
|
name: example-com
|
|
namespace: bind-externaldns
|
|
spec:
|
|
clusterRef: externaldns
|
|
zoneName: example.com
|
|
type: primary
|
|
dynamicUpdate: true
|
|
updateKeyRef: externaldns-key
|
|
allowTransfer:
|
|
- key externaldns-key
|
|
---
|
|
# A record managed as a CRD (external-dns-style) instead of via the RFC2136
|
|
# controller — same write path (TSIG nsupdate to the primary).
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: DNSRecord
|
|
metadata:
|
|
name: www-example-com
|
|
namespace: bind-externaldns
|
|
spec:
|
|
zoneRef: example-com
|
|
name: www
|
|
type: A
|
|
ttl: 300
|
|
values:
|
|
- 203.0.113.10
|