From 72de87c8c45a1dfec03aaff800ebee269b51138b Mon Sep 17 00:00:00 2001 From: Hermes Agent service account Date: Sun, 7 Jun 2026 18:41:35 -0500 Subject: [PATCH] platform: add external-dns-cloudflare for public mk-labs.cloud zone MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Deploy a second ExternalDNS instance targeting Cloudflare to manage public DNS records in the mk-labs.cloud zone. The existing Technitium (rfc2136) instance handling local.mk-labs.cloud is unchanged. Components: - application.yaml: ArgoCD Application, wave 6, namespace external-dns-cloudflare - values.yaml: Cloudflare provider, domainFilters: mk-labs.cloud, txtOwnerId: fastpass - externalsecret.yaml: ExternalSecret pulling CF_API_TOKEN from 1Password PREREQUISITE (manual): Ryan must create the following in 1Password before the ExternalSecret will sync: Item name: cloudflare-external-dns Field name: api-token Value: Cloudflare API token with DNS Edit on mk-labs.cloud Until then, the ExternalSecret will show SecretSyncedError — expected. --- .../external-dns-cloudflare/application.yaml | 42 +++++++++++++++++ .../externalsecret.yaml | 32 +++++++++++++ .../external-dns-cloudflare/values.yaml | 46 +++++++++++++++++++ 3 files changed, 120 insertions(+) create mode 100644 cluster/platform/external-dns-cloudflare/application.yaml create mode 100644 cluster/platform/external-dns-cloudflare/externalsecret.yaml create mode 100644 cluster/platform/external-dns-cloudflare/values.yaml diff --git a/cluster/platform/external-dns-cloudflare/application.yaml b/cluster/platform/external-dns-cloudflare/application.yaml new file mode 100644 index 0000000..7c02154 --- /dev/null +++ b/cluster/platform/external-dns-cloudflare/application.yaml @@ -0,0 +1,42 @@ +# ------------------------------------------------------------------------------ +# Platform: external-dns-cloudflare +# Wave 6 — same wave as existing external-dns (Technitium) +# Multi-source: Helm chart from upstream + ExternalSecret from repo +# +# PREREQUISITE: 1Password item "cloudflare-external-dns" with field "api-token" +# must exist before the ExternalSecret can sync and ExternalDNS can start. +# ------------------------------------------------------------------------------ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: external-dns-cloudflare + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: "6" +spec: + project: default + sources: + # Source 1: Helm chart from upstream + - repoURL: https://kubernetes-sigs.github.io/external-dns + chart: external-dns + targetRevision: 1.15.1 + helm: + valueFiles: + - $values/cluster/platform/external-dns-cloudflare/values.yaml + # Source 2: Repo — values ref + ExternalSecret manifest + - repoURL: https://gitea.mk-labs.cloud/rblundon/homelab.git + targetRevision: main + path: cluster/platform/external-dns-cloudflare + ref: values + directory: + exclude: "application.yaml" + destination: + server: https://kubernetes.default.svc + namespace: external-dns-cloudflare + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - ServerSideApply=true diff --git a/cluster/platform/external-dns-cloudflare/externalsecret.yaml b/cluster/platform/external-dns-cloudflare/externalsecret.yaml new file mode 100644 index 0000000..1359bfb --- /dev/null +++ b/cluster/platform/external-dns-cloudflare/externalsecret.yaml @@ -0,0 +1,32 @@ +# ------------------------------------------------------------------------------ +# ExternalSecret — Cloudflare API Token +# Pulled from 1Password, materialized in the external-dns-cloudflare namespace. +# +# PREREQUISITE: Ryan must create the following 1Password item before ArgoCD +# can sync this secret successfully: +# - Item name: cloudflare-external-dns +# - Field name: api-token +# - Value: A Cloudflare API token scoped to DNS Edit on mk-labs.cloud +# +# Until that item exists, the ExternalSecret will report SecretSyncedError — +# this is expected and acceptable. The ExternalDNS pod will fail to start +# until the secret is available. +# ------------------------------------------------------------------------------ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: cloudflare-api-token + namespace: external-dns-cloudflare +spec: + refreshInterval: 1h + secretStoreRef: + kind: ClusterSecretStore + name: onepassword-connect + target: + name: cloudflare-api-token + creationPolicy: Owner + data: + - secretKey: cloudflare_api_token + remoteRef: + key: cloudflare-external-dns # 1Password item name + property: api-token # 1Password field name diff --git a/cluster/platform/external-dns-cloudflare/values.yaml b/cluster/platform/external-dns-cloudflare/values.yaml new file mode 100644 index 0000000..d3cc339 --- /dev/null +++ b/cluster/platform/external-dns-cloudflare/values.yaml @@ -0,0 +1,46 @@ +# ------------------------------------------------------------------------------ +# external-dns-cloudflare — Helm Values +# Chart: https://kubernetes-sigs.github.io/external-dns +# +# Provider: Cloudflare +# Zone: mk-labs.cloud (public) +# +# This is a second ExternalDNS instance running alongside the existing +# Technitium (rfc2136) instance which handles local.mk-labs.cloud. +# ------------------------------------------------------------------------------ + +provider: + name: cloudflare + +env: + - name: CF_API_TOKEN + valueFrom: + secretKeyRef: + name: cloudflare-api-token + key: cloudflare_api_token + +# Only manage records in the public zone +domainFilters: + - mk-labs.cloud + +# Sources: ingress and services +sources: + - ingress + - service + +# Annotation to opt resources into public DNS management. +# Use: external-dns.alpha.kubernetes.io/hostname: myservice.mk-labs.cloud +annotationFilter: "external-dns.alpha.kubernetes.io/hostname" + +# Log level +logLevel: info + +# Interval between sync runs +interval: "1m" + +# Policy: sync = create AND delete records. Use upsert-only to be conservative. +policy: sync + +# Registry to track which records external-dns owns +registry: txt +txtOwnerId: fastpass