diff --git a/kubernetes/apps/network/external-dns/app/helmrelease.yaml b/kubernetes/apps/network/external-dns/app/cloudflared/helmrelease.yaml similarity index 85% rename from kubernetes/apps/network/external-dns/app/helmrelease.yaml rename to kubernetes/apps/network/external-dns/app/cloudflared/helmrelease.yaml index 5ce6867e..e8f79014 100644 --- a/kubernetes/apps/network/external-dns/app/helmrelease.yaml +++ b/kubernetes/apps/network/external-dns/app/cloudflared/helmrelease.yaml @@ -2,7 +2,7 @@ apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: - name: &app external-dns + name: &app external-dns-cloudflared spec: interval: 30m chart: @@ -30,7 +30,7 @@ spec: - name: CF_API_TOKEN valueFrom: secretKeyRef: - name: external-dns-secret + name: external-dns-secret-cloudflared key: api-token extraArgs: - --ingress-class=external @@ -45,4 +45,4 @@ spec: serviceMonitor: enabled: true podAnnotations: - secret.reloader.stakater.com/reload: external-dns-secret + secret.reloader.stakater.com/reload: external-dns-secret-cloudflared diff --git a/kubernetes/apps/network/external-dns/app/kustomization.yaml b/kubernetes/apps/network/external-dns/app/cloudflared/kustomization.yaml similarity index 100% rename from kubernetes/apps/network/external-dns/app/kustomization.yaml rename to kubernetes/apps/network/external-dns/app/cloudflared/kustomization.yaml diff --git a/kubernetes/apps/network/external-dns/app/secret.sops.yaml b/kubernetes/apps/network/external-dns/app/cloudflared/secret.sops.yaml similarity index 71% rename from kubernetes/apps/network/external-dns/app/secret.sops.yaml rename to kubernetes/apps/network/external-dns/app/cloudflared/secret.sops.yaml index 73842866..78b5d8f8 100644 --- a/kubernetes/apps/network/external-dns/app/secret.sops.yaml +++ b/kubernetes/apps/network/external-dns/app/cloudflared/secret.sops.yaml @@ -1,7 +1,7 @@ apiVersion: v1 kind: Secret metadata: - name: external-dns-secret + name: external-dns-secret-cloudflared stringData: api-token: ENC[AES256_GCM,data:ChZtqRA8VGVXyWVzuRJ50WSYBpn2H0+1Bj5Bvwf+En8798ZAKsyRRg==,iv:A6jtZ5EBkXlfLUyQyY6F9g1V8U15HmtrL/EqgoTJYaI=,tag:Yq7PGYPFRZogKwmXAtN9ow==,type:str] sops: @@ -19,8 +19,8 @@ sops: YVhxZ1pnRUVhc2JRSDB4OTJSSWRBa0kKrDawXKhudgzVEohCyWMvxVdSN0x6K0VJ PJwFqLSWb5aheWZ9+ZFJXqpnJIXt9uX73R51GIQe2iugnRma/BrHeg== -----END AGE ENCRYPTED FILE----- - lastmodified: "2024-11-05T23:02:05Z" - mac: ENC[AES256_GCM,data:2236klYqpKXu1k7kz3aoprmFp1/ADVT0d/m2mT3ZCxUMr4g2yrY2lniEyRfyn8hTsW/hnQyJ37n6ubIL87kXRMCQEEU2kgTWheoWd/JrQJVcMzGgoRoz0huuu6xS7TuQz7VPtqfWy6AQCvJZgZtfM5GPpfbkmx7yEyPPCWHOXcs=,iv:kQ+yGcEwPgUskU7TnU11EOkJT5fKMDHm6ciy4RMr+sc=,tag:uE7ozHmMRXCysNm0lIHQzQ==,type:str] + lastmodified: "2024-11-07T05:12:53Z" + mac: ENC[AES256_GCM,data:6x4QhGtYvqHspWFxwNGYGSbyLIpYeEST4WsY/CNZ5cOG0rn38GChqd4uSKehzrFHoj66A9DgOoK3LeUP43ttsSQ4QJNCKEt1+cRjGhGMQiv0QZEKIBlkcIIfUZtYfP7F1ty/eO+bvNH/DxD6sD6SsCoTXCF4zXke3UKehsa9ppc=,iv:5hauKyNe46bHI7yikiVpn5jew6BRrXI5lqCGx12pVwU=,tag:itZ/gjPHw9Fl/LmTPwIHJg==,type:str] pgp: [] encrypted_regex: ^(data|stringData)$ version: 3.9.1 diff --git a/kubernetes/apps/network/external-dns/app/unifi/helmrelease.yaml b/kubernetes/apps/network/external-dns/app/unifi/helmrelease.yaml new file mode 100644 index 00000000..57245506 --- /dev/null +++ b/kubernetes/apps/network/external-dns/app/unifi/helmrelease.yaml @@ -0,0 +1,75 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: &app external-dns-unifi +spec: + interval: 30m + chart: + spec: + chart: external-dns + version: 1.15.0 + sourceRef: + kind: HelmRepository + name: external-dns + namespace: flux-system + install: + remediation: + retries: 3 + upgrade: + cleanupOnFail: true + remediation: + strategy: rollback + retries: 3 + values: + fullnameOverride: *app + # logLevel: debug + provider: + name: webhook + webhook: + image: + repository: ghcr.io/kashalls/external-dns-unifi-webhook + tag: v0.3.1@sha256:593eeb3594a8418084d3235b2a30ca8aa4c58b949fac3433b86df6c725364e32 + env: + - name: UNIFI_HOST + value: https://10.0.10.1 + - name: UNIFI_USER + valueFrom: + secretKeyRef: + name: &secret external-dns-secret-unifi + key: EXTERNAL_DNS_UNIFI_USER + - name: UNIFI_PASS + valueFrom: + secretKeyRef: + name: *secret + key: EXTERNAL_DNS_UNIFI_PASS + # - name: LOG_LEVEL + # value: "debug" + livenessProbe: + httpGet: + path: /healthz + port: http-webhook + initialDelaySeconds: 10 + timeoutSeconds: 5 + readinessProbe: + httpGet: + path: /readyz + port: http-webhook + initialDelaySeconds: 10 + timeoutSeconds: 5 + extraArgs: + - --ignore-ingress-tls-spec + - --crd-source-apiversion=externaldns.k8s.io/v1alpha1 + - --crd-source-kind=DNSEndpoint + policy: sync + sources: ["ingress", "service"] + txtOwnerId: main + txtPrefix: k8s. + domainFilters: ["${SECRET_DOMAIN_INTERNAL}", "${SECRET_DOMAIN}"] + serviceMonitor: + enabled: true + podAnnotations: + secret.reloader.stakater.com/reload: *secret + + diff --git a/kubernetes/apps/network/external-dns/app/unifi/kustomization.yaml b/kubernetes/apps/network/external-dns/app/unifi/kustomization.yaml new file mode 100644 index 00000000..95bf4747 --- /dev/null +++ b/kubernetes/apps/network/external-dns/app/unifi/kustomization.yaml @@ -0,0 +1,6 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ./secret.sops.yaml + - ./helmrelease.yaml diff --git a/kubernetes/apps/network/external-dns/app/unifi/secret.sops.yaml b/kubernetes/apps/network/external-dns/app/unifi/secret.sops.yaml new file mode 100644 index 00000000..7c651d1a --- /dev/null +++ b/kubernetes/apps/network/external-dns/app/unifi/secret.sops.yaml @@ -0,0 +1,27 @@ +apiVersion: v1 +kind: Secret +metadata: + name: external-dns-secret-unifi +stringData: + EXTERNAL_DNS_UNIFI_USER: ENC[AES256_GCM,data:skYvK2I=,iv:CElXO2istWXepbiWd++NzA7rQWqMGyOwqxCFMs4cr+Q=,tag:y1Y11+DM1qmiXRLJpHp/NQ==,type:str] + EXTERNAL_DNS_UNIFI_PASS: ENC[AES256_GCM,data:Y5Ybzo34wKo=,iv:rXvdz/9YTGASfnwhIQIeqceh6QxPhGpcKpCNNIkZi0Q=,tag:tfBHuRaJhHVwuK5ZHaFXBQ==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age1mhnje42sefcfpvgpeppch84g6vgptmd4gukgvr3gueuxy6ph05xqx45jty + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4VEg5Q1ZXYm03RW1PWFdL + eEZOUzY3a2Q4WUU4VGlUNWJMYUFGMXhuQ2pVCldZd1c0R3VvbEZaNnhhVDg2K20z + SHJSYndHQ3pCRmtZWkxyYm8vSkpnMXMKLS0tIFRUdFpveW1zNGpOVXJBWGtCU09x + YVhxZ1pnRUVhc2JRSDB4OTJSSWRBa0kKrDawXKhudgzVEohCyWMvxVdSN0x6K0VJ + PJwFqLSWb5aheWZ9+ZFJXqpnJIXt9uX73R51GIQe2iugnRma/BrHeg== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2024-11-07T05:18:05Z" + mac: ENC[AES256_GCM,data:CvhFqBrPQaoe3tZ3Vg86JK0Il+pawDm2vG5uqgNP3Y7IGJ7uRTz+dj+XUvwFNmxXCjh1/LtoSTfoZzyqmfQnmVy76ax55VlcUWJBSiW0RO965Op6EHgMoPDhq8kvqL3wYtA3vIt755WVzzzoRXahnhw42DIyz/fGiSUkIzdNLtw=,iv:PQ3cIa6Chwcae12G1KNwgXjuQI96XtI+Fg43nCwQN3Y=,tag:dp7k5RuCy6bqC+UGS9LWsg==,type:str] + pgp: [] + encrypted_regex: ^(data|stringData)$ + version: 3.9.1 diff --git a/kubernetes/apps/network/external-dns/ks.yaml b/kubernetes/apps/network/external-dns/ks.yaml index ca5826cc..2881a27b 100644 --- a/kubernetes/apps/network/external-dns/ks.yaml +++ b/kubernetes/apps/network/external-dns/ks.yaml @@ -2,14 +2,33 @@ apiVersion: kustomize.toolkit.fluxcd.io/v1 kind: Kustomization metadata: - name: &app external-dns + name: &app external-dns-cloudflared namespace: flux-system spec: targetNamespace: network commonMetadata: labels: app.kubernetes.io/name: *app - path: ./kubernetes/apps/network/external-dns/app + path: ./kubernetes/apps/network/external-dns/app/cloudflared + prune: true + sourceRef: + kind: GitRepository + name: home-kubernetes + wait: true + interval: 30m + timeout: 5m +--- +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: &app external-dns-unifi + namespace: flux-system +spec: + targetNamespace: network + commonMetadata: + labels: + app.kubernetes.io/name: *app + path: ./kubernetes/apps/network/external-dns/app/unifi prune: true sourceRef: kind: GitRepository diff --git a/kubernetes/flux/vars/cluster-secrets.sops.yaml b/kubernetes/flux/vars/cluster-secrets.sops.yaml index c9793afd..3c99148f 100644 --- a/kubernetes/flux/vars/cluster-secrets.sops.yaml +++ b/kubernetes/flux/vars/cluster-secrets.sops.yaml @@ -5,6 +5,7 @@ metadata: namespace: flux-system stringData: SECRET_DOMAIN: ENC[AES256_GCM,data:WdBJKtPfxOwkn2MlfB8w9A==,iv:g82Nb4P5o+dQL0B5ZWlV9vSqenJ26l/uBTd5Zr12USI=,tag:1MCF4zXrf87zYKmc5pXvWQ==,type:str] + SECRET_INTERNAL_DOMAIN: ENC[AES256_GCM,data:a/ffHhhCyEQ8NU+6wg==,iv:5tzOljj1F/90qcZt2QEvNIQzL8/3eY10RcWp2rbhXFU=,tag:uyvBK4T0y/wMNrY0FKRJ9w==,type:str] SECRET_ACME_EMAIL: ENC[AES256_GCM,data:qRVftYNjhhLueQBQIfbZImphqVo=,iv:7N4pt32QgJ+q1MBGjRo47D+AM209aR/cmCf1L4ibnxQ=,tag:UtPOeqDHQSJaYLS3F+fcTQ==,type:str] SECRET_CLOUDFLARE_TUNNEL_ID: ENC[AES256_GCM,data:CU/Ik0NQNaGGFswubINWHfs+Von5nEC9PghQo6QZ5iOS8j8T,iv:hRPhm1ggQ6CdCU1yT9nvjJ9tZnpFXgTqlVJgWbSgAV4=,tag:RvrnxjoqeNqP8FHWnsoZGg==,type:str] sops: @@ -22,8 +23,8 @@ sops: bmcrR012bzJaZWhpeXlsLzRGbU0zdkkKPwJAbbGhfHSQc5QJpQs7KT1AXvH48djp j3oNjcDD4Jdlc3UE+D1DD1xDUjSuH9YcH5u0P8ATyvnANK+vfAcyTA== -----END AGE ENCRYPTED FILE----- - lastmodified: "2024-11-05T23:02:05Z" - mac: ENC[AES256_GCM,data:ZE6kvazcezilR24u0dIpOqjd19CjZDMhSGXwUjsNTAaWZ0yMQuzQdcfwyYfbdnCizV3u+6GZIky1j1fUI7sAwukPGNjnIuw6k40I6qr0ASyO4hvUFZ90BHHWdb9kcHAKPPHRFvg0m27Xq+OQkUp/vJcJv0j8wp5Z3WwulpAqUAA=,iv:Mn66tTwuYztQpj22dy6MMAs2iproCbhWsgUEmoKhZ6A=,tag:oK6QOJ5K+s825NUZs0mstQ==,type:str] + lastmodified: "2024-11-07T05:19:07Z" + mac: ENC[AES256_GCM,data:tijfTKEpzxK2M3GDpOp9JpeiPBrfdhj5SCAfzWdGqZqgOmTnwwKBmjpbsU1jSTeYgNuANx+ZRW9JzHe2/rz0lRWBn5zCdq+RNb1oyo7bsNlUDofIVs25G8EFt5wE5tLLc7CfVcNSJ/GoOjxzts6TKBOCroWACpHxBB8hRvsq0+0=,iv:+9qkkimoGNVhhWrfbf0rJOu4iWTBfHRG2hfLuLH3m/I=,tag:3EGRL+vFgkUy48PGPbTmZg==,type:str] pgp: [] encrypted_regex: ^(data|stringData)$ version: 3.9.1