From 0d0182c9ad2ea358d40e3a85148cf98e7c0873a4 Mon Sep 17 00:00:00 2001
From: Ben Vincent <ben@unkin.net>
Date: Wed, 18 Mar 2026 15:41:14 +1100
Subject: [PATCH] fix: allow transfer for external-dns

external-dns required axfr support to remove old records. add the
capability for the externaldns tsig key.
---
 modules/externaldns/manifests/master.pp | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/modules/externaldns/manifests/master.pp b/modules/externaldns/manifests/master.pp
index 538119c..cfb90d1 100644
--- a/modules/externaldns/manifests/master.pp
+++ b/modules/externaldns/manifests/master.pp
@@ -28,8 +28,8 @@ class externaldns::master inherits externaldns {
       dynamic         => true,
       allow_updates   => ['key externaldns-key'],
       allow_transfers => empty($slave_ips) ? {
-        true  => [],
-        false => ['dns-slaves'],
+        true  => ['key externaldns-key'],
+        false => ['key externaldns-key','dns-slaves'],
       },
       ns_notify       => !empty($slave_ips),
       also_notify     => $slave_ips,
@@ -42,4 +42,4 @@ class externaldns::master inherits externaldns {
     recursion => false,
     zones     => $externaldns::k8s_zones,
   }
-}
\ No newline at end of file
+}