# ------------------------------------------------------------------------------
# external-dns — Helm Values
# Chart: https://kubernetes-sigs.github.io/external-dns
#
# Provider: Technitium DNS on monorail (10.1.71.32)
# Technitium uses the RFC2136 (DNS UPDATE) provider in external-dns.
# Zone: local.mk-labs.cloud
# ------------------------------------------------------------------------------

provider:
  name: rfc2136

env:
  # Technitium API endpoint — RFC2136 compatible
  - name: EXTERNAL_DNS_RFC2136_HOST
    value: "10.1.71.32"
  - name: EXTERNAL_DNS_RFC2136_PORT
    value: "53"
  - name: EXTERNAL_DNS_RFC2136_ZONE
    value: "local.mk-labs.cloud"
  - name: EXTERNAL_DNS_RFC2136_TSIG_AXFR
    value: "true"
  # TSIG secret key name — must match what's configured in Technitium
  - name: EXTERNAL_DNS_RFC2136_TSIG_SECRET_ALG
    value: "hmac-sha256"
  - name: EXTERNAL_DNS_RFC2136_TSIG_KEYNAME
    value: "external-dns"
  - name: EXTERNAL_DNS_RFC2136_TSIG_SECRET
    valueFrom:
      secretKeyRef:
        name: technitium-tsig-secret
        key: tsig-secret

# Only manage records in this zone
domainFilters:
  - local.mk-labs.cloud

# Only process Ingress resources (and Services with the right annotation)
sources:
  - ingress
  - service

# Annotation to opt services into DNS management:
# external-dns.alpha.kubernetes.io/hostname: myservice.local.mk-labs.cloud
annotationFilter: "external-dns.alpha.kubernetes.io/hostname"

# Log level — info in normal ops, debug when troubleshooting
logLevel: info

# Interval between sync runs
interval: "1m"

# Policy: sync = create AND delete records. upsert-only = never delete.
policy: sync

# Registry to track which records external-dns owns
registry: txt
txtOwnerId: fastpass