deploy nginx ingress to internal cluster

cluster/external-dns/base/externalsecrets.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: cloudflare-api-token # This is the secret name
+  namespace: external-dns
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: doppler-cluster
+  refreshInterval: "1h"
+  data:
+    - secretKey: api-token
+      remoteRef:
+        key: CLOUDFLARE_TOKEN

cluster/external-dns/base/kustomization.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+commonAnnotations:
+  argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+
+resources:
+# Operator deployment
+- namespace.yaml
+- operatorgroup.yaml
+- subscription.yaml
+# Deploy cluster resources
+- externalsecrets.yaml
+- scc.yaml
+- cloudflare.yaml

cluster/external-dns/base/namespace.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+  name: external-dns-operator
+  labels:
+    argocd.argoproj.io/managed-by: openshift-gitops-operator
+    kubernetes.io/metadata.name: external-dns-operator
+    openshift.io/cluster-monitoring: 'true'
+spec:
+  finalizers:
+  - kubernetes

cluster/external-dns/base/operatorgroup.yaml

@@ -0,0 +1,9 @@
+---
+apiVersion: operators.coreos.com/v1
+kind: OperatorGroup
+metadata:
+  name: external-dns-operator
+  namespace: external-dns-operator
+spec:
+  targetNamespaces:
+    - external-dns-operator

cluster/external-dns/base/scc.yaml

@@ -0,0 +1,41 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: external-dns
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: external-dns
+rules:
+  - apiGroups: [""]
+    resources: ["services"]
+    verbs: ["get","watch","list"]
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get","watch","list"]
+  - apiGroups: ["networking","networking.k8s.io"]
+    resources: ["ingresses"]
+    verbs: ["get","watch","list"]
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["get","watch","list"]
+  - apiGroups: [""]
+    resources: ["endpoints"]
+    verbs: ["get","watch","list"]
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: external-dns-viewer
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: external-dns
+subjects:
+- kind: ServiceAccount
+  name: external-dns
+  namespace: default

cluster/external-dns/base/subscription.yaml

@@ -0,0 +1,12 @@
+---
+apiVersion: operators.coreos.com/v1alpha1
+kind: Subscription
+metadata:
+  name: external-dns-operator
+  namespace: external-dns-operator
+spec:
+  channel: stable-v1
+  installPlanApproval: Automatic
+  name: external-dns-operator
+  source: redhat-operators
+  sourceNamespace: openshift-marketplace