---
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: &app external-dns-unifi
spec:
  interval: 30m
  chart:
    spec:
      chart: external-dns
      version: 1.15.0
      sourceRef:
        kind: HelmRepository
        name: external-dns
        namespace: flux-system
  install:
    remediation:
      retries: 3
  upgrade:
    cleanupOnFail: true
    remediation:
      strategy: rollback
      retries: 3
  values:
    fullnameOverride: *app
    # logLevel: debug
    provider:
      name: webhook
      webhook:
        image:
          repository: ghcr.io/kashalls/external-dns-unifi-webhook
          tag: v0.3.2@sha256:f8cf534970560bc8d1a61cc13f7c9580d91be60f5c6c7a86c3be0ca362208500
        env:
          - name: UNIFI_HOST
            value: https://192.168.10.1
          - name: UNIFI_USER
            valueFrom:
              secretKeyRef:
                name: &secret external-dns-secret-unifi
                key: EXTERNAL_DNS_UNIFI_USER
          - name: UNIFI_PASS
            valueFrom:
              secretKeyRef:
                name: *secret
                key: EXTERNAL_DNS_UNIFI_PASS
          # - name: LOG_LEVEL
          #   value: "debug"
        # livenessProbe:
        #   httpGet:
        #     path: /healthz
        #     port: http-webhook
        #   initialDelaySeconds: 10
        #   timeoutSeconds: 5
        # readinessProbe:
        #   httpGet:
        #     path: /readyz
        #     port: http-webhook
        #   initialDelaySeconds: 10
        #   timeoutSeconds: 5
    extraArgs:
      - --ingress-class=internal
      - --ignore-ingress-tls-spec
      - --crd-source-apiversion=externaldns.k8s.io/v1alpha1
      - --crd-source-kind=DNSEndpoint
    sources: ["crd", "ingress"]
    txtPrefix: k8s.
    txtOwnerId: default
    domainFilters: ["${SECRET_INTERNAL_DOMAIN}", "${SECRET_DOMAIN}"]
    serviceMonitor:
      enabled: true
    podAnnotations:
      secret.reloader.stakater.com/reload: external-dns-secret-unifi