Adds a Filter (allow/deny CIDRs + allow/deny domain suffixes) applied to the
desired set before reconcile. Range rules match A/AAAA by value and PTR by the
address encoded in the reverse-DNS owner, so both the junk A record and its
reverse PTR are dropped together. Configured via -deny-ranges/-allow-ranges/
-deny-domains/-allow-domains (comma-separated) or DNS_UPDATER_* env.
Purpose: keep k8s pod/service CIDRs, LB VIP ranges and other internal addresses
out of the authoritative zones, and stop NOTAUTH updates for reverse zones the
server does not host (10.42.x, 198.18.200.x, etc.).
RFC2136 dynamic-DNS updater. Watches a records file (inotify) and new
interface addresses and pushes TSIG-signed updates to BIND per zone, sending
only the delta. Native miekg/dns (structured per-zone RCODEs), local status
API + facter fact, systemd unit, nfpm RPM, Woodpecker CI.
Replaces the puppet dns-update shell script; keeps the same records-file and
TSIG-key contract.
unkinben
gitadmin