2621bc9f36
- external-dns-cloudflare: add excludeDomains: [local.mk-labs.cloud] to stop internal subdomain records from leaking to Cloudflare - external-dns-cloudflare: replace hostname annotationFilter with opt-in model (external-dns.alpha.kubernetes.io/public=true) so only explicitly tagged services get public Cloudflare records - external-dns-cloudflare: add extraArgs --target=lb.mk-labs.cloud - external-dns (Technitium/rfc2136): add extraArgs --target=lightning-lane.local.mk-labs.cloud for internal records - couchdb: add external-dns.alpha.kubernetes.io/public: 'true' annotation — first service to opt in to public DNS; will create communicore.mk-labs.cloud pointing to lb.mk-labs.cloud via Cloudflare ExternalDNS URGENT: Cloudflare was creating records for local.mk-labs.cloud hosts. Ryan: manually delete any *.local.mk-labs.cloud records currently in Cloudflare (look for communicore.local.mk-labs.cloud and any other local.* entries).
57 lines
1.6 KiB
YAML
57 lines
1.6 KiB
YAML
# ------------------------------------------------------------------------------
|
|
# external-dns-cloudflare — Helm Values
|
|
# Chart: https://kubernetes-sigs.github.io/external-dns
|
|
#
|
|
# Provider: Cloudflare
|
|
# Zone: mk-labs.cloud (public)
|
|
#
|
|
# This is a second ExternalDNS instance running alongside the existing
|
|
# Technitium (rfc2136) instance which handles local.mk-labs.cloud.
|
|
# ------------------------------------------------------------------------------
|
|
|
|
provider:
|
|
name: cloudflare
|
|
|
|
env:
|
|
- name: CF_API_TOKEN
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: cloudflare-api-token
|
|
key: cloudflare_api_token
|
|
|
|
# Only manage records in the public zone
|
|
domainFilters:
|
|
- mk-labs.cloud
|
|
|
|
# Explicitly exclude internal subdomain — prevents local.mk-labs.cloud from
|
|
# leaking into Cloudflare (domainFilters matches subdomains by default)
|
|
excludeDomains:
|
|
- local.mk-labs.cloud
|
|
|
|
# Sources: ingress and services
|
|
sources:
|
|
- ingress
|
|
- service
|
|
|
|
# Opt-in model: only process resources explicitly annotated for public DNS.
|
|
# Add annotation external-dns.alpha.kubernetes.io/public: "true" to any
|
|
# ingress/service that should get a public Cloudflare record.
|
|
annotationFilter: "external-dns.alpha.kubernetes.io/public=true"
|
|
|
|
# Override the target for all Cloudflare-managed records to the public LB CNAME.
|
|
extraArgs:
|
|
- --target=lb.mk-labs.cloud
|
|
|
|
# Log level
|
|
logLevel: info
|
|
|
|
# Interval between sync runs
|
|
interval: "1m"
|
|
|
|
# Policy: sync = create AND delete records. Use upsert-only to be conservative.
|
|
policy: sync
|
|
|
|
# Registry to track which records external-dns owns
|
|
registry: txt
|
|
txtOwnerId: fastpass
|