If you're running bind in a chroot, you need to give the location of the chroot directory in /etc/sysconfig/named:
ROOTDIR=/var/named/chroot
The simplest way to handle the rndc key is to put it in its own file, and include that file in both named.conf and rndc.conf. To avoid confusion between files in /etc and files in /var/named/chroot/etc, make some symlinks:
/etc/named.conf should be a symlink to /var/named/chroot/etc/named.conf.
/etc/rndc.key should be a symlink to /var/named/chroot/etc/rndc.key.
/etc/rndc.conf doesn't involve chroot, so it stays put.
rndc.key should look like this:
key "rndckey" {
algorithm hmac-md5;
secret "q3k3SzpxASgKHCZpG1LeMw==";
};
/etc/rndc.conf should look like this:
options {
default-server localhost;
default-key "rndckey";
};
server localhost {
key "rndckey";
};
// This should be a symlink to the chrooted key file:
include "/etc/rndc.key";
named.conf should look like this:
controls {
inet 127.0.0.1 allow { localhost; } keys { rndckey; };
};
include "/etc/named.custom";
include "/etc/rndc.key";
zone "0.0.127.in-addr.arpa" {
type master;
file "0.0.127.in-addr.arpa.zone";
};
...