# ------------------------------------------------------------------------------
# external-dns-cloudflare — Helm Values
# Chart: https://kubernetes-sigs.github.io/external-dns
#
# Provider: Cloudflare
# Zone: mk-labs.cloud (public)
#
# This is a second ExternalDNS instance running alongside the existing
# Technitium (rfc2136) instance which handles local.mk-labs.cloud.
# ------------------------------------------------------------------------------

provider:
  name: cloudflare

env:
  - name: CF_API_TOKEN
    valueFrom:
      secretKeyRef:
        name: cloudflare-api-token
        key: cloudflare_api_token

# Only manage records in the public zone
domainFilters:
  - mk-labs.cloud

# Explicitly exclude internal subdomain — prevents local.mk-labs.cloud from
# leaking into Cloudflare (domainFilters matches subdomains by default)
excludeDomains:
  - local.mk-labs.cloud

# Sources: ingress and services
sources:
  - ingress
  - service

# Opt-in model: only process resources explicitly annotated for public DNS.
# Add annotation external-dns.alpha.kubernetes.io/public: "true" to any
# ingress/service that should get a public Cloudflare record.
annotationFilter: "external-dns.alpha.kubernetes.io/public=true"

# Log level
logLevel: info

# Interval between sync runs
interval: "1m"

# Policy: sync = create AND delete records. Use upsert-only to be conservative.
policy: sync

# Registry to track which records external-dns owns
registry: txt
txtOwnerId: fastpass