feat: public_ingress_ip bridge value for DNAT split-DNS (v3.5.1) - #5
Merged
Conversation
Symmetric public counterpart of traefik_internal_lb_ip. Emits two bridge keys: ingress-public-ip (the gateway/FortiGate public VIP) and public-dns-enabled (gate), so workload clusters fronted by a DNAT gateway can route the public external-dns to the VIP and exclude the internal split-horizon domain from the public zone. Empty default preserves NAT-Gateway behavior. Forward-compatible with ADR 0039.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds
var.public_ingress_ip(default"") — the public gateway/FortiGate VIP that DNATs to this cluster's internal Traefik ILB. Symmetric public counterpart ofvar.traefik_internal_lb_ip.Emits two new bridge-Secret keys (consumed downstream by the operator + the public external-dns variant):
ingress-public-ip→ annotationestabilis.io/bridge.ingress-public-ip(the VIP, used as--default-targets).public-dns-enabled(=public_ingress_ip != "") → operator stamps gate labelestabilis.io/addon.public-dns.Empty default → both dropped → cluster stays on the base public external-dns (NAT-Gateway behavior unchanged). Forward-compatible with ADR 0039 (
ingress-public-ip).Why
Workload (spoke) clusters behind a DNAT gateway need the public external-dns to publish the gateway VIP (not the private ILB) and to exclude the internal split-horizon domain from the public (Cloudflare) zone — the per-cluster split-DNS fix. This is the producer side; consumed by estabilis-workload-operator (gate label) + estabilis-platform-gitops (external-dns-public-dnat AppSet).
Release
chore(release): v3.5.1is the HEAD commit. Merge via "Rebase and merge" so the release commit lands as HEAD onmasterand the auto-tag workflow fires. Do not squash (rewrites the subject and breaks auto-tag).