Swap golang:1.25 and almalinux9-gobuilder:20260606 to the estate
gobuilder image on every step invoking the Go toolchain (build, test,
pre-commit, release test/build). Add GOCACHE_S3_* env and GOCACHEPROG
pointing go-cache-plugin at an absolute /tmp/gocache cache dir, backed
by the shared S3 bucket via org secrets.
Adds a Filter (allow/deny CIDRs + allow/deny domain suffixes) applied to the
desired set before reconcile. Range rules match A/AAAA by value and PTR by the
address encoded in the reverse-DNS owner, so both the junk A record and its
reverse PTR are dropped together. Configured via -deny-ranges/-allow-ranges/
-deny-domains/-allow-domains (comma-separated) or DNS_UPDATER_* env.
Purpose: keep k8s pod/service CIDRs, LB VIP ranges and other internal addresses
out of the authoritative zones, and stop NOTAUTH updates for reverse zones the
server does not host (10.42.x, 198.18.200.x, etc.).
The heredoc-based read broke across make's per-line recipe handling. Parse the
current version with cut in a single backslash-continued shell instead, and
error on an unknown PART.
RFC2136 dynamic-DNS updater. Watches a records file (inotify) and new
interface addresses and pushes TSIG-signed updates to BIND per zone, sending
only the delta. Native miekg/dns (structured per-zone RCODEs), local status
API + facter fact, systemd unit, nfpm RPM, Woodpecker CI.
Replaces the puppet dns-update shell script; keeps the same records-file and
TSIG-key contract.
benvin
unkin-agent
unkinben
gitadmin