From: Nicki Křížek <nicki@isc.org>
Date: Wed, 8 Jul 2026 18:23:47 +0000 (+0000)
Subject: Use controls template in named configs where rndc.key was included
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=6a46eb53147dc0c4fa8c61ad5527fb8beeb801ba;p=thirdparty%2Fbind9.git

Use controls template in named configs where rndc.key was included

Same sweep as the previous commit, for the configs that obtained the
key via a native `include ".../_common/rndc.key";`.

Commit was split up for easier review-ability.

Assisted-by: Claude:claude-fable-5
---

diff --git a/bin/tests/system/additional/ns1/named.conf.j2 b/bin/tests/system/additional/ns1/named.conf.j2
index c2f44488009..54ecef1c393 100644
--- a/bin/tests/system/additional/ns1/named.conf.j2
+++ b/bin/tests/system/additional/ns1/named.conf.j2
@@ -12,11 +12,7 @@ options {
 	minimal-responses yes;
 };
 
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 zone "." {
         type primary;
diff --git a/bin/tests/system/additional/ns1/named2.conf.j2 b/bin/tests/system/additional/ns1/named2.conf.j2
index 742bf7fc77f..aea12f5f5b6 100644
--- a/bin/tests/system/additional/ns1/named2.conf.j2
+++ b/bin/tests/system/additional/ns1/named2.conf.j2
@@ -12,11 +12,7 @@ options {
 	minimal-responses no;
 };
 
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 zone "." {
         type primary;
diff --git a/bin/tests/system/additional/ns1/named3.conf.j2 b/bin/tests/system/additional/ns1/named3.conf.j2
index c34ccc1a08f..5635854b419 100644
--- a/bin/tests/system/additional/ns1/named3.conf.j2
+++ b/bin/tests/system/additional/ns1/named3.conf.j2
@@ -13,11 +13,7 @@ options {
 	minimal-responses no-auth;
 };
 
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 zone "." {
         type primary;
diff --git a/bin/tests/system/additional/ns1/named4.conf.j2 b/bin/tests/system/additional/ns1/named4.conf.j2
index 3194e8a9f12..04819375469 100644
--- a/bin/tests/system/additional/ns1/named4.conf.j2
+++ b/bin/tests/system/additional/ns1/named4.conf.j2
@@ -12,11 +12,7 @@ options {
 	minimal-responses no-auth-recursive;
 };
 
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 zone "." {
         type primary;
diff --git a/bin/tests/system/addzone/ns2/named.conf.j2 b/bin/tests/system/addzone/ns2/named.conf.j2
index 0b39c98dd58..4bca9c7aa0c 100644
--- a/bin/tests/system/addzone/ns2/named.conf.j2
+++ b/bin/tests/system/addzone/ns2/named.conf.j2
@@ -9,11 +9,7 @@ options {
 	dnssec-validation no;
 };
 
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 template primary {
 	type primary;
diff --git a/bin/tests/system/addzone/ns2/named2.conf.j2 b/bin/tests/system/addzone/ns2/named2.conf.j2
index e077e8fb2b6..89417a116f3 100644
--- a/bin/tests/system/addzone/ns2/named2.conf.j2
+++ b/bin/tests/system/addzone/ns2/named2.conf.j2
@@ -1,8 +1,4 @@
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 
 options {
diff --git a/bin/tests/system/addzone/ns2/named3.conf.j2 b/bin/tests/system/addzone/ns2/named3.conf.j2
index 84382576d83..0924d41bfab 100644
--- a/bin/tests/system/addzone/ns2/named3.conf.j2
+++ b/bin/tests/system/addzone/ns2/named3.conf.j2
@@ -1,8 +1,4 @@
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 options {
 	port @PORT@;
diff --git a/bin/tests/system/addzone/ns3/named.conf.j2 b/bin/tests/system/addzone/ns3/named.conf.j2
index 8db614836c0..9a0c32161da 100644
--- a/bin/tests/system/addzone/ns3/named.conf.j2
+++ b/bin/tests/system/addzone/ns3/named.conf.j2
@@ -1,8 +1,4 @@
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 options {
 	port @PORT@;
diff --git a/bin/tests/system/addzone/ns3/named2.conf.j2 b/bin/tests/system/addzone/ns3/named2.conf.j2
index dcb42723003..1821fd46eaf 100644
--- a/bin/tests/system/addzone/ns3/named2.conf.j2
+++ b/bin/tests/system/addzone/ns3/named2.conf.j2
@@ -1,8 +1,4 @@
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 options {
 	port @PORT@;
diff --git a/bin/tests/system/bailiwick/ns4/named.conf.j2 b/bin/tests/system/bailiwick/ns4/named.conf.j2
index 3b9b52207cc..4f4d200d968 100644
--- a/bin/tests/system/bailiwick/ns4/named.conf.j2
+++ b/bin/tests/system/bailiwick/ns4/named.conf.j2
@@ -11,11 +11,7 @@ options {
 	qname-minimization off;
 };
 
-controls {
-	inet 10.53.0.4 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
-
-include "../../_common/rndc.key";
+{% include "_common/controls.conf.j2" %}
 
 zone "." {
 	type hint;
diff --git a/bin/tests/system/builtin/ns1/named.conf.j2 b/bin/tests/system/builtin/ns1/named.conf.j2
index 4f8a1c0fba0..1e8c4c85bf9 100644
--- a/bin/tests/system/builtin/ns1/named.conf.j2
+++ b/bin/tests/system/builtin/ns1/named.conf.j2
@@ -1,8 +1,4 @@
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 options {
 	query-source address 10.53.0.1;
diff --git a/bin/tests/system/builtin/ns2/named.conf.j2 b/bin/tests/system/builtin/ns2/named.conf.j2
index 7b8a6d6fd4b..249358784ec 100644
--- a/bin/tests/system/builtin/ns2/named.conf.j2
+++ b/bin/tests/system/builtin/ns2/named.conf.j2
@@ -1,8 +1,4 @@
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 options {
 	query-source address 10.53.0.2;
diff --git a/bin/tests/system/builtin/ns3/named.conf.j2 b/bin/tests/system/builtin/ns3/named.conf.j2
index ae8982d8547..04bdae9c47f 100644
--- a/bin/tests/system/builtin/ns3/named.conf.j2
+++ b/bin/tests/system/builtin/ns3/named.conf.j2
@@ -1,8 +1,4 @@
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 options {
 	query-source address 10.53.0.3;
diff --git a/bin/tests/system/catz/ns1/named.conf.j2 b/bin/tests/system/catz/ns1/named.conf.j2
index b702e09f4ad..77d14415915 100644
--- a/bin/tests/system/catz/ns1/named.conf.j2
+++ b/bin/tests/system/catz/ns1/named.conf.j2
@@ -1,8 +1,4 @@
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 options {
 	query-source address 10.53.0.1;
diff --git a/bin/tests/system/catz/ns2/named.conf.j2 b/bin/tests/system/catz/ns2/named.conf.j2
index 4f354d2bb93..620bfd6e3b5 100644
--- a/bin/tests/system/catz/ns2/named.conf.j2
+++ b/bin/tests/system/catz/ns2/named.conf.j2
@@ -4,11 +4,7 @@
 {% set catalog5 = catalog5 | default(False) %}
 {% set duplicate_zone = duplicate_zone | default(False) %}
 
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 options {
 	query-source address 10.53.0.2;
diff --git a/bin/tests/system/catz/ns2/named7.conf.j2 b/bin/tests/system/catz/ns2/named7.conf.j2
index c70e5ee6e01..1076e8c8de7 100644
--- a/bin/tests/system/catz/ns2/named7.conf.j2
+++ b/bin/tests/system/catz/ns2/named7.conf.j2
@@ -1,8 +1,4 @@
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 options {
 	query-source address 10.53.0.2;
diff --git a/bin/tests/system/catz/ns3/named.conf.j2 b/bin/tests/system/catz/ns3/named.conf.j2
index 1beb0aff9af..3b491aed939 100644
--- a/bin/tests/system/catz/ns3/named.conf.j2
+++ b/bin/tests/system/catz/ns3/named.conf.j2
@@ -1,8 +1,4 @@
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 options {
 	query-source address 10.53.0.3;
diff --git a/bin/tests/system/catz/ns4/named.conf.j2 b/bin/tests/system/catz/ns4/named.conf.j2
index 366fda67657..6525482b324 100644
--- a/bin/tests/system/catz/ns4/named.conf.j2
+++ b/bin/tests/system/catz/ns4/named.conf.j2
@@ -1,8 +1,4 @@
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.4 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 options {
 	query-source address 10.53.0.4;
diff --git a/bin/tests/system/cipher_suites/ns1/named.conf.j2 b/bin/tests/system/cipher_suites/ns1/named.conf.j2
index 75a635354b1..791ac23430c 100644
--- a/bin/tests/system/cipher_suites/ns1/named.conf.j2
+++ b/bin/tests/system/cipher_suites/ns1/named.conf.j2
@@ -1,8 +1,4 @@
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 tls tls-perfect-forward-secrecy {
 	protocols { TLSv1.3; };
diff --git a/bin/tests/system/cipher_suites/ns2/named.conf.j2 b/bin/tests/system/cipher_suites/ns2/named.conf.j2
index 38d66e0e8dd..b41f5d14261 100644
--- a/bin/tests/system/cipher_suites/ns2/named.conf.j2
+++ b/bin/tests/system/cipher_suites/ns2/named.conf.j2
@@ -1,8 +1,4 @@
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 tls local {
 	key-file "../self-signed-key.pem";
diff --git a/bin/tests/system/cipher_suites/ns3/named.conf.j2 b/bin/tests/system/cipher_suites/ns3/named.conf.j2
index 68e00f44193..5b92a91369f 100644
--- a/bin/tests/system/cipher_suites/ns3/named.conf.j2
+++ b/bin/tests/system/cipher_suites/ns3/named.conf.j2
@@ -1,8 +1,4 @@
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 tls local {
 	key-file "../self-signed-key.pem";
diff --git a/bin/tests/system/cipher_suites/ns4/named.conf.j2 b/bin/tests/system/cipher_suites/ns4/named.conf.j2
index 1d3bed6fb63..a2a4c5deb90 100644
--- a/bin/tests/system/cipher_suites/ns4/named.conf.j2
+++ b/bin/tests/system/cipher_suites/ns4/named.conf.j2
@@ -1,8 +1,4 @@
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.4 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 tls local {
 	key-file "../self-signed-key.pem";
diff --git a/bin/tests/system/cipher_suites/ns5/named.conf.j2 b/bin/tests/system/cipher_suites/ns5/named.conf.j2
index c2b85fa05e8..5c48278e7d2 100644
--- a/bin/tests/system/cipher_suites/ns5/named.conf.j2
+++ b/bin/tests/system/cipher_suites/ns5/named.conf.j2
@@ -1,8 +1,4 @@
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.5 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 tls local {
 	key-file "../self-signed-key.pem";
diff --git a/bin/tests/system/dns64/ns1/named.conf.j2 b/bin/tests/system/dns64/ns1/named.conf.j2
index 6302d774af0..2467b3f686c 100644
--- a/bin/tests/system/dns64/ns1/named.conf.j2
+++ b/bin/tests/system/dns64/ns1/named.conf.j2
@@ -1,10 +1,6 @@
 // NS1
 
-include "../../_common/rndc.key";
-
-controls {
-        inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 acl rfc1918 { 10/8; 192.168/16; 172.16/12; };
 
diff --git a/bin/tests/system/dns64/ns1/named2.conf.j2 b/bin/tests/system/dns64/ns1/named2.conf.j2
index 432a717640e..cccfe349bda 100644
--- a/bin/tests/system/dns64/ns1/named2.conf.j2
+++ b/bin/tests/system/dns64/ns1/named2.conf.j2
@@ -1,10 +1,6 @@
 // NS1
 
-include "../../_common/rndc.key";
-
-controls {
-        inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 acl rfc1918 { 10/8; 192.168/16; 172.16/12; };
 
diff --git a/bin/tests/system/dns64/ns1/named3.conf.j2 b/bin/tests/system/dns64/ns1/named3.conf.j2
index c82b7afee5e..237ff6a7122 100644
--- a/bin/tests/system/dns64/ns1/named3.conf.j2
+++ b/bin/tests/system/dns64/ns1/named3.conf.j2
@@ -1,10 +1,6 @@
 // NS1
 
-include "../../_common/rndc.key";
-
-controls {
-        inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 acl rfc1918 { 10/8; 192.168/16; 172.16/12; };
 
diff --git a/bin/tests/system/dnssec_nsec3/ns2/named.conf.j2 b/bin/tests/system/dnssec_nsec3/ns2/named.conf.j2
index abece97eb2a..91c475783a9 100644
--- a/bin/tests/system/dnssec_nsec3/ns2/named.conf.j2
+++ b/bin/tests/system/dnssec_nsec3/ns2/named.conf.j2
@@ -14,11 +14,7 @@ options {
 	qname-minimization off;
 };
 
-controls {
-	inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
-
-include "../../_common/rndc.key";
+{% include "_common/controls.conf.j2" %}
 
 zone "." {
 	type hint;
diff --git a/bin/tests/system/dnssec_parent_rrsig/ns2/named.conf.j2 b/bin/tests/system/dnssec_parent_rrsig/ns2/named.conf.j2
index ce5b22c3227..69a1864b5e3 100644
--- a/bin/tests/system/dnssec_parent_rrsig/ns2/named.conf.j2
+++ b/bin/tests/system/dnssec_parent_rrsig/ns2/named.conf.j2
@@ -16,11 +16,7 @@ options {
 	minimal-responses no;
 };
 
-controls {
-	inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
-
-include "../../_common/rndc.key";
+{% include "_common/controls.conf.j2" %}
 
 zone "." {
 	type hint;
diff --git a/bin/tests/system/dnssec_wildcard/ns2/named.conf.j2 b/bin/tests/system/dnssec_wildcard/ns2/named.conf.j2
index 890d1529835..f7985c92dca 100644
--- a/bin/tests/system/dnssec_wildcard/ns2/named.conf.j2
+++ b/bin/tests/system/dnssec_wildcard/ns2/named.conf.j2
@@ -13,11 +13,7 @@ options {
 	minimal-responses no;
 };
 
-controls {
-	inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
-
-include "../../_common/rndc.key";
+{% include "_common/controls.conf.j2" %}
 
 zone "." {
 	type hint;
diff --git a/bin/tests/system/doth/ns1/named.conf.j2 b/bin/tests/system/doth/ns1/named.conf.j2
index 22d025049cc..116b075e68e 100644
--- a/bin/tests/system/doth/ns1/named.conf.j2
+++ b/bin/tests/system/doth/ns1/named.conf.j2
@@ -1,8 +1,4 @@
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 http local {
 	endpoints { "/dns-query"; "/alter"; };
diff --git a/bin/tests/system/doth/ns2/named.conf.j2 b/bin/tests/system/doth/ns2/named.conf.j2
index bb9ee1820d0..ae213f63eae 100644
--- a/bin/tests/system/doth/ns2/named.conf.j2
+++ b/bin/tests/system/doth/ns2/named.conf.j2
@@ -1,8 +1,4 @@
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 tls local {
 	key-file "../CA/certs/srv02.crt01.example.com.key";
diff --git a/bin/tests/system/doth/ns3/named.conf.j2 b/bin/tests/system/doth/ns3/named.conf.j2
index 857464601cf..df5a5eabd4a 100644
--- a/bin/tests/system/doth/ns3/named.conf.j2
+++ b/bin/tests/system/doth/ns3/named.conf.j2
@@ -1,8 +1,4 @@
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 tls local {
 	key-file "../CA/certs/srv03.crt01.example.com.key";
diff --git a/bin/tests/system/doth/ns4/named.conf.j2 b/bin/tests/system/doth/ns4/named.conf.j2
index 120cd71948a..ccc282a288b 100644
--- a/bin/tests/system/doth/ns4/named.conf.j2
+++ b/bin/tests/system/doth/ns4/named.conf.j2
@@ -5,11 +5,7 @@
 # startup/reconfiguration was known to cause timeout issues in the CI
 # system, where many tests run in parallel.
 
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.4 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 tls local {
 	key-file "../CA/certs/srv04.crt01.example.com.key";
diff --git a/bin/tests/system/doth/ns5/named.conf.j2 b/bin/tests/system/doth/ns5/named.conf.j2
index bb6ab557aac..b01983f89e8 100644
--- a/bin/tests/system/doth/ns5/named.conf.j2
+++ b/bin/tests/system/doth/ns5/named.conf.j2
@@ -5,11 +5,7 @@
 # startup/reconfiguration was known to cause timeout issues in the CI
 # system, where many tests run in parallel.
 
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.5 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 options {
 	query-source address 10.53.0.5;
diff --git a/bin/tests/system/fwdfirst/ns4/named.conf.j2 b/bin/tests/system/fwdfirst/ns4/named.conf.j2
index 46d5dd8b997..6d5d29f7705 100644
--- a/bin/tests/system/fwdfirst/ns4/named.conf.j2
+++ b/bin/tests/system/fwdfirst/ns4/named.conf.j2
@@ -13,11 +13,7 @@ options {
 	qname-minimization off;
 };
 
-controls {
-	inet 10.53.0.4 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
-
-include "../../_common/rndc.key";
+{% include "_common/controls.conf.j2" %}
 
 zone "." {
 	type hint;
diff --git a/bin/tests/system/fwdfirst/ns5/named.conf.j2 b/bin/tests/system/fwdfirst/ns5/named.conf.j2
index 82068f1a94c..cf3f5e9ec41 100644
--- a/bin/tests/system/fwdfirst/ns5/named.conf.j2
+++ b/bin/tests/system/fwdfirst/ns5/named.conf.j2
@@ -15,11 +15,7 @@ options {
 	forwarders { 10.53.0.2 port @PORT@; };
 };
 
-controls {
-	inet 10.53.0.5 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
-
-include "../../_common/rndc.key";
+{% include "_common/controls.conf.j2" %}
 
 zone "." {
 	type hint;
diff --git a/bin/tests/system/inline/ns2/named.conf.j2 b/bin/tests/system/inline/ns2/named.conf.j2
index b39f69b38ac..03375a12761 100644
--- a/bin/tests/system/inline/ns2/named.conf.j2
+++ b/bin/tests/system/inline/ns2/named.conf.j2
@@ -1,10 +1,6 @@
 // NS2
 
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 options {
 	query-source address 10.53.0.2;
diff --git a/bin/tests/system/inline/ns3/named.conf.j2 b/bin/tests/system/inline/ns3/named.conf.j2
index fd28e9da0b9..279bea76269 100644
--- a/bin/tests/system/inline/ns3/named.conf.j2
+++ b/bin/tests/system/inline/ns3/named.conf.j2
@@ -1,10 +1,6 @@
 // NS3
 
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 options {
 	query-source address 10.53.0.3;
diff --git a/bin/tests/system/inline/ns5/named.conf.j2 b/bin/tests/system/inline/ns5/named.conf.j2
index b3218278172..4f547ecaedc 100644
--- a/bin/tests/system/inline/ns5/named.conf.j2
+++ b/bin/tests/system/inline/ns5/named.conf.j2
@@ -1,10 +1,6 @@
 // NS5
 
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.5 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 options {
 	query-source address 10.53.0.5;
diff --git a/bin/tests/system/inline/ns5/named2.conf.j2 b/bin/tests/system/inline/ns5/named2.conf.j2
index 32df0e97101..6b0578c2a35 100644
--- a/bin/tests/system/inline/ns5/named2.conf.j2
+++ b/bin/tests/system/inline/ns5/named2.conf.j2
@@ -1,10 +1,6 @@
 // NS5
 
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.5 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 options {
 	query-source address 10.53.0.5;
diff --git a/bin/tests/system/inline/ns6/named.conf.j2 b/bin/tests/system/inline/ns6/named.conf.j2
index 11727f90294..a780bdb5f27 100644
--- a/bin/tests/system/inline/ns6/named.conf.j2
+++ b/bin/tests/system/inline/ns6/named.conf.j2
@@ -1,10 +1,6 @@
 // NS6
 
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.6 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 options {
 	query-source address 10.53.0.6;
diff --git a/bin/tests/system/inline/ns7/named.conf.j2 b/bin/tests/system/inline/ns7/named.conf.j2
index 1e89d28fb41..859bf1cf033 100644
--- a/bin/tests/system/inline/ns7/named.conf.j2
+++ b/bin/tests/system/inline/ns7/named.conf.j2
@@ -14,11 +14,7 @@
  * one it was meant for.
  */
 
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.7 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 options {
 	query-source address 10.53.0.7;
diff --git a/bin/tests/system/inline/ns8/named.conf.j2 b/bin/tests/system/inline/ns8/named.conf.j2
index 07f2de803d5..153ec12f1fe 100644
--- a/bin/tests/system/inline/ns8/named.conf.j2
+++ b/bin/tests/system/inline/ns8/named.conf.j2
@@ -1,10 +1,6 @@
 // NS8
 
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.8 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 options {
 	query-source address 10.53.0.8;
diff --git a/bin/tests/system/mismatchtcp/ns1/named.conf.j2 b/bin/tests/system/mismatchtcp/ns1/named.conf.j2
index f83cb2cbc95..cbd76356706 100644
--- a/bin/tests/system/mismatchtcp/ns1/named.conf.j2
+++ b/bin/tests/system/mismatchtcp/ns1/named.conf.j2
@@ -11,11 +11,7 @@
  * information regarding copyright ownership.
  */
 
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 options {
 	port @PORT@;
diff --git a/bin/tests/system/nsec3_impersonation/ns2/named.conf.j2 b/bin/tests/system/nsec3_impersonation/ns2/named.conf.j2
index 2c9b0bba9e7..c2acbe07d9e 100644
--- a/bin/tests/system/nsec3_impersonation/ns2/named.conf.j2
+++ b/bin/tests/system/nsec3_impersonation/ns2/named.conf.j2
@@ -12,11 +12,7 @@ options {
 	dnssec-validation yes;
 };
 
-controls {
-	inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
-
-include "../../_common/rndc.key";
+{% include "_common/controls.conf.j2" %}
 
 zone "." {
 	type hint;
diff --git a/bin/tests/system/nsec_grandparent/ns2/named.conf.j2 b/bin/tests/system/nsec_grandparent/ns2/named.conf.j2
index 41d7f8b5b25..2104ede4ccf 100644
--- a/bin/tests/system/nsec_grandparent/ns2/named.conf.j2
+++ b/bin/tests/system/nsec_grandparent/ns2/named.conf.j2
@@ -13,11 +13,7 @@ options {
 	minimal-responses no;
 };
 
-controls {
-	inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
-
-include "../../_common/rndc.key";
+{% include "_common/controls.conf.j2" %}
 
 zone "." {
 	type hint;
diff --git a/bin/tests/system/nsec_piggyback/ns3/named.conf.j2 b/bin/tests/system/nsec_piggyback/ns3/named.conf.j2
index 7da96590fe8..3eae8ab0ae2 100644
--- a/bin/tests/system/nsec_piggyback/ns3/named.conf.j2
+++ b/bin/tests/system/nsec_piggyback/ns3/named.conf.j2
@@ -13,11 +13,7 @@ options {
 	synth-from-dnssec yes;
 };
 
-controls {
-	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
-
-include "../../_common/rndc.key";
+{% include "_common/controls.conf.j2" %}
 
 zone "." {
 	type hint;
diff --git a/bin/tests/system/nsec_synthesis/ns2/named.conf.j2 b/bin/tests/system/nsec_synthesis/ns2/named.conf.j2
index 073d3aa446b..5a3e2199a6a 100644
--- a/bin/tests/system/nsec_synthesis/ns2/named.conf.j2
+++ b/bin/tests/system/nsec_synthesis/ns2/named.conf.j2
@@ -13,11 +13,7 @@ options {
 	synth-from-dnssec yes;
 };
 
-controls {
-	inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
-
-include "../../_common/rndc.key";
+{% include "_common/controls.conf.j2" %}
 
 zone "." {
 	type hint;
diff --git a/bin/tests/system/nsec_synthesis/ns3/named.conf.j2 b/bin/tests/system/nsec_synthesis/ns3/named.conf.j2
index a82f55a3449..fda5b0a574d 100644
--- a/bin/tests/system/nsec_synthesis/ns3/named.conf.j2
+++ b/bin/tests/system/nsec_synthesis/ns3/named.conf.j2
@@ -11,11 +11,7 @@ options {
 	notify no;
 };
 
-controls {
-	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
-
-include "../../_common/rndc.key";
+{% include "_common/controls.conf.j2" %}
 
 zone "." {
 	type hint;
diff --git a/bin/tests/system/proxy/ns1/named.conf.j2 b/bin/tests/system/proxy/ns1/named.conf.j2
index 671134cf649..e1bcc2cc48e 100644
--- a/bin/tests/system/proxy/ns1/named.conf.j2
+++ b/bin/tests/system/proxy/ns1/named.conf.j2
@@ -1,8 +1,4 @@
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 tls self-signed {
 	cert-file "../self-signed-cert.pem";
diff --git a/bin/tests/system/proxy/ns3/named.conf.j2 b/bin/tests/system/proxy/ns3/named.conf.j2
index 29f8159fa5c..9c026934929 100644
--- a/bin/tests/system/proxy/ns3/named.conf.j2
+++ b/bin/tests/system/proxy/ns3/named.conf.j2
@@ -1,8 +1,4 @@
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 tls self-signed {
 	cert-file "../self-signed-cert.pem";
diff --git a/bin/tests/system/rpzrecurse/ns3/named1.conf.j2 b/bin/tests/system/rpzrecurse/ns3/named1.conf.j2
index de5bc095f7c..63af1656d2b 100644
--- a/bin/tests/system/rpzrecurse/ns3/named1.conf.j2
+++ b/bin/tests/system/rpzrecurse/ns3/named1.conf.j2
@@ -1,8 +1,4 @@
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 options {
 	query-source address 10.53.0.3;
diff --git a/bin/tests/system/rpzrecurse/ns3/named2.conf.j2 b/bin/tests/system/rpzrecurse/ns3/named2.conf.j2
index b0128ae8f02..bda6f5ab3d4 100644
--- a/bin/tests/system/rpzrecurse/ns3/named2.conf.j2
+++ b/bin/tests/system/rpzrecurse/ns3/named2.conf.j2
@@ -1,8 +1,4 @@
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 options {
 	query-source address 10.53.0.3;
diff --git a/bin/tests/system/rpzrecurse/ns3/named3.conf.j2 b/bin/tests/system/rpzrecurse/ns3/named3.conf.j2
index e869f2774fa..cb526293acb 100644
--- a/bin/tests/system/rpzrecurse/ns3/named3.conf.j2
+++ b/bin/tests/system/rpzrecurse/ns3/named3.conf.j2
@@ -1,8 +1,4 @@
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 options {
 	query-source address 10.53.0.3;
diff --git a/bin/tests/system/timeouts/ns1/named.conf.j2 b/bin/tests/system/timeouts/ns1/named.conf.j2
index a1ed1a35076..bca9e0a3804 100644
--- a/bin/tests/system/timeouts/ns1/named.conf.j2
+++ b/bin/tests/system/timeouts/ns1/named.conf.j2
@@ -1,8 +1,4 @@
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 options {
 	query-source address 10.53.0.1;
diff --git a/bin/tests/system/transport_acl/ns1/named.conf.j2 b/bin/tests/system/transport_acl/ns1/named.conf.j2
index c9a4342e48f..16536ab5694 100644
--- a/bin/tests/system/transport_acl/ns1/named.conf.j2
+++ b/bin/tests/system/transport_acl/ns1/named.conf.j2
@@ -1,8 +1,4 @@
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 tls self-signed {
 	cert-file "../self-signed-cert.pem";
diff --git a/bin/tests/system/transport_change/ns1/named-http-plain-proxy.conf.j2 b/bin/tests/system/transport_change/ns1/named-http-plain-proxy.conf.j2
index 16aff0f2c4b..7283bd46bc7 100644
--- a/bin/tests/system/transport_change/ns1/named-http-plain-proxy.conf.j2
+++ b/bin/tests/system/transport_change/ns1/named-http-plain-proxy.conf.j2
@@ -1,8 +1,4 @@
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 tls self-signed {
 	cert-file "../self-signed-cert.pem";
diff --git a/bin/tests/system/transport_change/ns1/named-http-plain.conf.j2 b/bin/tests/system/transport_change/ns1/named-http-plain.conf.j2
index f096943d81e..46cbfaea180 100644
--- a/bin/tests/system/transport_change/ns1/named-http-plain.conf.j2
+++ b/bin/tests/system/transport_change/ns1/named-http-plain.conf.j2
@@ -1,8 +1,4 @@
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 tls self-signed {
 	cert-file "../self-signed-cert.pem";
diff --git a/bin/tests/system/transport_change/ns1/named-https-proxy-encrypted.conf.j2 b/bin/tests/system/transport_change/ns1/named-https-proxy-encrypted.conf.j2
index 97ddd92fa2c..5d66158b57d 100644
--- a/bin/tests/system/transport_change/ns1/named-https-proxy-encrypted.conf.j2
+++ b/bin/tests/system/transport_change/ns1/named-https-proxy-encrypted.conf.j2
@@ -1,8 +1,4 @@
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 tls self-signed {
 	cert-file "../self-signed-cert.pem";
diff --git a/bin/tests/system/transport_change/ns1/named-https-proxy-plain.conf.j2 b/bin/tests/system/transport_change/ns1/named-https-proxy-plain.conf.j2
index 582c6fc30bf..f9811d33b97 100644
--- a/bin/tests/system/transport_change/ns1/named-https-proxy-plain.conf.j2
+++ b/bin/tests/system/transport_change/ns1/named-https-proxy-plain.conf.j2
@@ -1,8 +1,4 @@
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 tls self-signed {
 	cert-file "../self-signed-cert.pem";
diff --git a/bin/tests/system/transport_change/ns1/named-https.conf.j2 b/bin/tests/system/transport_change/ns1/named-https.conf.j2
index 1b88d5feb4b..4b1f74974c4 100644
--- a/bin/tests/system/transport_change/ns1/named-https.conf.j2
+++ b/bin/tests/system/transport_change/ns1/named-https.conf.j2
@@ -1,8 +1,4 @@
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 tls self-signed {
 	cert-file "../self-signed-cert.pem";
diff --git a/bin/tests/system/transport_change/ns1/named-proxy.conf.j2 b/bin/tests/system/transport_change/ns1/named-proxy.conf.j2
index c7d605d1f9f..59d38fc08d4 100644
--- a/bin/tests/system/transport_change/ns1/named-proxy.conf.j2
+++ b/bin/tests/system/transport_change/ns1/named-proxy.conf.j2
@@ -1,8 +1,4 @@
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 tls self-signed {
 	cert-file "../self-signed-cert.pem";
diff --git a/bin/tests/system/transport_change/ns1/named-tls-proxy-encrypted.conf.j2 b/bin/tests/system/transport_change/ns1/named-tls-proxy-encrypted.conf.j2
index 68543271586..e377041c212 100644
--- a/bin/tests/system/transport_change/ns1/named-tls-proxy-encrypted.conf.j2
+++ b/bin/tests/system/transport_change/ns1/named-tls-proxy-encrypted.conf.j2
@@ -1,8 +1,4 @@
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 tls self-signed {
 	cert-file "../self-signed-cert.pem";
diff --git a/bin/tests/system/transport_change/ns1/named-tls-proxy-plain.conf.j2 b/bin/tests/system/transport_change/ns1/named-tls-proxy-plain.conf.j2
index dde4c4947b1..e2165168c31 100644
--- a/bin/tests/system/transport_change/ns1/named-tls-proxy-plain.conf.j2
+++ b/bin/tests/system/transport_change/ns1/named-tls-proxy-plain.conf.j2
@@ -1,8 +1,4 @@
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 tls self-signed {
 	cert-file "../self-signed-cert.pem";
diff --git a/bin/tests/system/transport_change/ns1/named-tls.conf.j2 b/bin/tests/system/transport_change/ns1/named-tls.conf.j2
index e3c5cab2bf9..5289a53f7e6 100644
--- a/bin/tests/system/transport_change/ns1/named-tls.conf.j2
+++ b/bin/tests/system/transport_change/ns1/named-tls.conf.j2
@@ -1,8 +1,4 @@
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 tls self-signed {
 	cert-file "../self-signed-cert.pem";
diff --git a/bin/tests/system/transport_change/ns1/named.conf.j2 b/bin/tests/system/transport_change/ns1/named.conf.j2
index 928faf22d9b..0dfa67ba134 100644
--- a/bin/tests/system/transport_change/ns1/named.conf.j2
+++ b/bin/tests/system/transport_change/ns1/named.conf.j2
@@ -1,8 +1,4 @@
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 tls self-signed {
 	cert-file "../self-signed-cert.pem";
diff --git a/bin/tests/system/xfer/ns1/named.conf.j2 b/bin/tests/system/xfer/ns1/named.conf.j2
index 5a57aa6b14a..8e917454119 100644
--- a/bin/tests/system/xfer/ns1/named.conf.j2
+++ b/bin/tests/system/xfer/ns1/named.conf.j2
@@ -1,8 +1,4 @@
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 options {
 	query-source address 10.53.0.1;
diff --git a/bin/tests/system/xfer/ns1/named2.conf.j2 b/bin/tests/system/xfer/ns1/named2.conf.j2
index 69601c5b465..893155b1001 100644
--- a/bin/tests/system/xfer/ns1/named2.conf.j2
+++ b/bin/tests/system/xfer/ns1/named2.conf.j2
@@ -1,8 +1,4 @@
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 options {
 	query-source address 10.53.0.1;
diff --git a/bin/tests/system/xfer/ns1/named3.conf.j2 b/bin/tests/system/xfer/ns1/named3.conf.j2
index 8716a9449b7..d4c9888eb7f 100644
--- a/bin/tests/system/xfer/ns1/named3.conf.j2
+++ b/bin/tests/system/xfer/ns1/named3.conf.j2
@@ -1,8 +1,4 @@
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 options {
 	query-source address 10.53.0.1;
diff --git a/bin/tests/system/xfer/ns6/named.conf.j2 b/bin/tests/system/xfer/ns6/named.conf.j2
index ba27db1539a..be713388c04 100644
--- a/bin/tests/system/xfer/ns6/named.conf.j2
+++ b/bin/tests/system/xfer/ns6/named.conf.j2
@@ -1,8 +1,4 @@
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.6 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 options {
 	query-source address 10.53.0.6;
diff --git a/bin/tests/system/xfer/ns7/named.conf.j2 b/bin/tests/system/xfer/ns7/named.conf.j2
index ec2f3982be0..d8acedc94b3 100644
--- a/bin/tests/system/xfer/ns7/named.conf.j2
+++ b/bin/tests/system/xfer/ns7/named.conf.j2
@@ -1,8 +1,4 @@
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.7 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 options {
 	query-source address 10.53.0.7;
diff --git a/bin/tests/system/xfer/ns8/named.conf.j2 b/bin/tests/system/xfer/ns8/named.conf.j2
index 9cd83a385a8..3c020ef14a1 100644
--- a/bin/tests/system/xfer/ns8/named.conf.j2
+++ b/bin/tests/system/xfer/ns8/named.conf.j2
@@ -1,8 +1,4 @@
-include "../../_common/rndc.key";
-
-controls {
-	inet 10.53.0.8 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
+{% include "_common/controls.conf.j2" %}
 
 options {
 	query-source address 10.53.0.8;