Establish a declarative Knot record-management workflow #21

New issue

Open

opened 2026-08-23 17:07:56 +00:00 by stanta · 0 comments

stanta commented

2026-08-23 17:07:56 +00:00

Owner

Outcome

Provide one reviewed source of truth and deployment path for normal Knot DNS record changes.

Current state

Knot is authoritative, but new records still use an operator process without a declarative repository workflow.

Work

Choose zone-file, API, or web-admin ownership.
Preserve DNSSEC signing, serial changes, journal state, and secondary transfer.
Define review, validation, deployment, rollback, and audit behavior.
Test one non-critical record change end to end.

Validation

The record appears on both authorities over UDP and TCP.
DNSSEC validation passes.
Rollback restores the previous answer.
The workflow does not expose TSIG or DNSSEC keys.

References

HOMELAB_INTEGRATION.md
iac/KNOT-DNS-PLAN.md
iac/ansible/roles/knot_authoritative/

## Outcome Provide one reviewed source of truth and deployment path for normal Knot DNS record changes. ## Current state Knot is authoritative, but new records still use an operator process without a declarative repository workflow. ## Work - [ ] Choose zone-file, API, or web-admin ownership. - [ ] Preserve DNSSEC signing, serial changes, journal state, and secondary transfer. - [ ] Define review, validation, deployment, rollback, and audit behavior. - [ ] Test one non-critical record change end to end. ## Validation - [ ] The record appears on both authorities over UDP and TCP. - [ ] DNSSEC validation passes. - [ ] Rollback restores the previous answer. - [ ] The workflow does not expose TSIG or DNSSEC keys. ## References - `HOMELAB_INTEGRATION.md` - `iac/KNOT-DNS-PLAN.md` - `iac/ansible/roles/knot_authoritative/`

stanta added the

labels

2026-08-23 17:07:56 +00:00