From c104360c1a77d87871355b14996bbbda43bd087d Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sat, 25 Jul 2026 00:27:04 +1000 Subject: [PATCH] dns: stop exporting legacy DNS fragments (manage_export false) Clients now resolve via the k8s bind (198.18.200.7) which serves the authoritative zones fed by the nsupdate path, so the legacy exported-resource -> VM-master /var/named/sources files are no longer in the serving path. Turn off the export half of the dual-write; the nsupdate (manage_nsupdate) half stays on. --- hieradata/common.yaml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/hieradata/common.yaml b/hieradata/common.yaml index 0b9a6fe..0524318 100644 --- a/hieradata/common.yaml +++ b/hieradata/common.yaml @@ -219,7 +219,13 @@ profiles::dns::master::basedir: '/var/named/sources' # profiles::dns::updater::key_secret: ENC[...] # (must match the key the bind-authoritative zones allow-update # with; algorithm hmac-sha256) -profiles::dns::updater::manage_export: true +# k8s is now authoritative: clients resolve via the k8s bind-resolvers +# (profiles::dns::base::nameservers 198.18.200.7, since #490), which forward the +# unkin.net/main.unkin.net/*.18.198.in-addr.arpa zones to the k8s +# bind-authoritative cluster fed by the nsupdate path below. The legacy +# exported-resources -> VM-master /var/named/sources files are no longer in any +# client's resolution path, so stop exporting them. Rollback: set back to true. +profiles::dns::updater::manage_export: false profiles::dns::updater::manage_nsupdate: true profiles::dns::updater::server: '198.18.200.9' profiles::dns::updater::key_name: 'client-update'