Replaces the profiles::dns::updater shell mechanism (dns-update.sh +
dns-update.path/.service + the in-run exec) with the packaged dns-updater
daemon, which watches the records file (inotify) and network interfaces and
pushes TSIG-signed RFC2136 updates natively.
- install the dns-updater package; manage /etc/dns-updater/env
- run the packaged dns-updater.service, restarting only on env/key change
(records-file edits are picked up by the daemon's own watch, no churn)
- keep the concat records file and TSIG key file unchanged
- ensure the old script + .path/.service units are absent
- drop the now-dead dns-update.{sh,service,path}.epp templates
The daemon reports per-zone RCODEs and a health status API, so failures like
the recent empty-label/NOTZONE ones surface directly instead of as opaque
nsupdate stderr.
Replaces the exported-resources → puppet DNS master zone-file flow with per-host RFC2136 dynamic updates against the k8s **bind-authoritative** write endpoint (198.18.200.9). The master no longer manages zone files.
## Design
Each node assembles its DNS records into a local concat file; a systemd `.path` unit watches it and runs `dns-update` (nsupdate) on change — exactly the watch-a-file model requested.
## Changes
- **profiles::dns::updater** (new): concat records file + TSIG key file + `dns-update` script + `dns-update.service` (oneshot) + `dns-update.path` (watcher). The script sends only the delta since last run and deletes removed records, grouped per zone.
- **profiles::dns::record**: writes a local concat fragment (`zone|name|type|ttl|value`) instead of exporting `@@concat::fragment` to the master.
- **profiles::dns::base**: includes `profiles::dns::updater` (all nodes).
- **hiera**: `profiles::dns::updater` server/key_name/algorithm in common.yaml.
## Inert until keyed
The updater does nothing until `profiles::dns::updater::key_secret` (TSIG) is set in eyaml — records are assembled but not applied, so nodes are safe before the key exists.
## Prerequisites (k8s side, separate)
1. The `bind-authoritative` zones must set `dynamicUpdate: true` + an `updateKeyRef` (a client-update BindTSIGKey) so they accept these updates.
2. The TSIG key must be shared: the operator-generated key value goes into eyaml here (or the planned Vault-sync feature bridges it).
## Validated
puppet parser/epp validate, puppet-lint, and a functional test of the generated per-zone nsupdate message (replace + delete-removed).
Reviewed-on: #475
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>
unkinben