Initial argo deployment

cluster/platform/external-dns/application.yaml

@@ -0,0 +1,30 @@
+# ------------------------------------------------------------------------------
+# Platform: external-dns
+# Wave 6 — depends on ingress-nginx (wave 5) to have an IP to register
+# Configured to sync with Technitium DNS on monorail (10.1.71.32)
+# ------------------------------------------------------------------------------
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-dns
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "6"
+spec:
+  project: default
+  source:
+    repoURL: https://kubernetes-sigs.github.io/external-dns
+    chart: external-dns
+    targetRevision: 1.15.1
+    helm:
+      valuesFile: values.yaml
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external-dns
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true

cluster/platform/external-dns/externalsecret.yaml

@@ -0,0 +1,29 @@
+# ------------------------------------------------------------------------------
+# ExternalSecret — Technitium TSIG Secret
+# Pulled from 1Password, materialized in the external-dns namespace.
+#
+# In 1Password, store as item "technitium-tsig" with field "tsig-secret"
+# in the "mk-labs" vault.
+#
+# To generate a TSIG key for Technitium:
+#   tsig-keygen -a hmac-sha256 external-dns
+# Add the key to Technitium under Settings > DNS Settings > TSIG Keys
+# ------------------------------------------------------------------------------
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: technitium-tsig-secret
+  namespace: external-dns
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: onepassword-connect
+  refreshInterval: "1h"
+  target:
+    name: technitium-tsig-secret
+    creationPolicy: Owner
+  data:
+    - secretKey: tsig-secret
+      remoteRef:
+        key: technitium-tsig       # 1Password item name
+        property: tsig-secret      # 1Password field name

cluster/platform/external-dns/values.yaml

@@ -0,0 +1,58 @@
+# ------------------------------------------------------------------------------
+# external-dns — Helm Values
+# Chart: https://kubernetes-sigs.github.io/external-dns
+#
+# Provider: Technitium DNS on monorail (10.1.71.32)
+# Technitium uses the RFC2136 (DNS UPDATE) provider in external-dns.
+# Zone: local.mk-labs.cloud
+# ------------------------------------------------------------------------------
+
+provider:
+  name: rfc2136
+
+env:
+  # Technitium API endpoint — RFC2136 compatible
+  - name: EXTERNAL_DNS_RFC2136_HOST
+    value: "10.1.71.32"
+  - name: EXTERNAL_DNS_RFC2136_PORT
+    value: "53"
+  - name: EXTERNAL_DNS_RFC2136_ZONE
+    value: "local.mk-labs.cloud"
+  - name: EXTERNAL_DNS_RFC2136_TSIG_AXFR
+    value: "true"
+  # TSIG secret key name — must match what's configured in Technitium
+  - name: EXTERNAL_DNS_RFC2136_TSIG_SECRET_ALG
+    value: "hmac-sha256"
+  - name: EXTERNAL_DNS_RFC2136_TSIG_KEYNAME
+    value: "external-dns"
+  - name: EXTERNAL_DNS_RFC2136_TSIG_SECRET
+    valueFrom:
+      secretKeyRef:
+        name: technitium-tsig-secret
+        key: tsig-secret
+
+# Only manage records in this zone
+domainFilters:
+  - local.mk-labs.cloud
+
+# Only process Ingress resources (and Services with the right annotation)
+sources:
+  - ingress
+  - service
+
+# Annotation to opt services into DNS management:
+# external-dns.alpha.kubernetes.io/hostname: myservice.local.mk-labs.cloud
+annotationFilter: "external-dns.alpha.kubernetes.io/hostname"
+
+# Log level — info in normal ops, debug when troubleshooting
+logLevel: info
+
+# Interval between sync runs
+interval: "1m"
+
+# Policy: sync = create AND delete records. upsert-only = never delete.
+policy: sync
+
+# Registry to track which records external-dns owns
+registry: txt
+txtOwnerId: fastpass