The worker pod needs a rndc key file to access each bind instance. It is of the form: 

key "rndc-key" { 

   algorithm <insert algorithm here>;

      secret <insert secret here>;

};

This requires that the designate network attachment be attached to pod. 

Note that this differs from 17.1 in that the worker will be accessing across a dedicated network attachment and will also be the only service running in that pod, so will not need to specify a source address. The key alone is sufficient.