Skip to content

🚀 Release: 0.1.0-beta.7

📦 Distribution

Debian (.deb) and RPM (.rpm) packages continue to be supported, and the Helm chart continues to be published as an OCI artifact on Docker Hub (oci://registry-1.docker.io/kweonminsung/bindizr-chart).

The ExternalDNS webhook provider adapter ships inside the same container image as a second binary (bindizr-external-dns); no separate image to pull.

📌 Installation (Debian/Ubuntu)

dpkg -i bindizr_0.1.0-beta.7-1_amd64.deb

📌 Installation (RHEL/CentOS/Fedora)

rpm -i bindizr-0.1.0_beta.7-1.x86_64.rpm

📌 Installation (Helm)

helm install bindizr oci://registry-1.docker.io/kweonminsung/bindizr-chart \
  --version 0.1.0-beta.7 \
  --set bindizr.database.existingSecret=bindizr-db-secret

⚠️ Breaking Changes

  • bindizr zone snapshot … is now bindizr zone version … (list / get / diff / rollback), and the HTTP surface moved to GET /zones/{name}/versions
  • Config keys renamed: dns.apply_mode → dns.notify_mode and dns.apply_batch_ms → dns.notify_batch_ms; the old names are not accepted
  • Schema replaced: zone_changes and zone_soa_history are gone, superseded by zone_journal and zone_versions; dnssec_keys, dnssec_records, and zone_token_policies are new
  • Clean installs only — there is no upgrade path from beta.6

✨ New Features

  • DNSSEC — end-to-end online zone signing with CSK/KSK/ZSK, ECDSAP256SHA256 and Ed25519, NSEC/NSEC3, DS generation, scheduled re-signing, and key rollover
  • ExternalDNS webhook provider — bindizr-external-dns lets Kubernetes Services and Ingresses manage bindizr records, with token zone grants acting as the domain filter
  • Per-zone API token policies — restrict tokens by zone, record-name pattern, and record type
  • New record types — added CAA, SSHFP, TLSA, DS, and delegation NS records

🧹 Fixes & Improvements

  • Safer DNS name handling — label-aware comparisons now correctly handle escaped dots, wildcard policies, zone matching, and apex records
  • Performance — improved database transaction handling, SQLite WAL/pooling, record indexes, SQL-side filtering, and reduced allocations on read/write paths
  • Correctness — tightened record-size and SOA serial validation, improved nsupdate error responses, preserved TXT whitespace, relaxed valid CAA whitespace, and fixed several edge-case rollback/cache issues