rblundonandClaude Sonnet 5.5
ebe4681438
- cluster/applications/litellm: multi-source Application (oci litellm-helm 1.106.1), values, ExternalSecrets (1Password wdw-labs), HTTPRoute, ExternalName services for fantasmic/wishes, namespace - gateway: https-skyliner listener + skyliner.wdw-labs.cloud certificate, ReferenceGrant for litellm namespace - cert-manager: add wdw-labs.cloud to ClusterIssuer dnsZones - external-dns: add wdw-labs.cloud zone (Technitium RFC2136) - onepassword-connect: add wdw-labs vault to ClusterSecretStore Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0118eUSMQitZMHN7qaCvynA3
66 lines
2.0 KiB
YAML
66 lines
2.0 KiB
YAML
# ------------------------------------------------------------------------------
|
|
# external-dns — Helm Values
|
|
# Chart: https://kubernetes-sigs.github.io/external-dns
|
|
#
|
|
# Provider: Technitium DNS on monorail (10.1.71.32)
|
|
# Technitium uses the RFC2136 (DNS UPDATE) provider in external-dns.
|
|
# Zone: local.mk-labs.cloud
|
|
# ------------------------------------------------------------------------------
|
|
|
|
provider:
|
|
name: rfc2136
|
|
|
|
env:
|
|
# Technitium API endpoint — RFC2136 compatible
|
|
- name: EXTERNAL_DNS_RFC2136_HOST
|
|
value: "10.1.71.32"
|
|
- name: EXTERNAL_DNS_RFC2136_PORT
|
|
value: "53"
|
|
- name: EXTERNAL_DNS_RFC2136_TSIG_AXFR
|
|
value: "true"
|
|
# TSIG secret key name — must match what's configured in Technitium
|
|
- name: EXTERNAL_DNS_RFC2136_TSIG_SECRET_ALG
|
|
value: "hmac-sha256"
|
|
- name: EXTERNAL_DNS_RFC2136_TSIG_KEYNAME
|
|
value: "external-dns"
|
|
- name: EXTERNAL_DNS_RFC2136_TSIG_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: technitium-tsig-secret
|
|
key: tsig-secret
|
|
|
|
# Only manage records in this zone
|
|
domainFilters:
|
|
- local.mk-labs.cloud
|
|
- wdw-labs.cloud
|
|
|
|
# Multiple Technitium zones (the env var form only supports one zone).
|
|
# wdw-labs.cloud zone must exist in Technitium and the "external-dns" TSIG key
|
|
# must be authorised for dynamic updates + zone transfer on it (added for skyliner).
|
|
extraArgs:
|
|
- --rfc2136-zone=local.mk-labs.cloud
|
|
- --rfc2136-zone=wdw-labs.cloud
|
|
|
|
# Sources: ingress, service, and Gateway API HTTPRoutes
|
|
sources:
|
|
- ingress
|
|
- service
|
|
- gateway-httproute
|
|
|
|
# Annotation to opt services into DNS management:
|
|
# external-dns.alpha.kubernetes.io/hostname: myservice.local.mk-labs.cloud
|
|
annotationFilter: "external-dns.alpha.kubernetes.io/hostname"
|
|
|
|
# Log level — info in normal ops, debug when troubleshooting
|
|
logLevel: info
|
|
|
|
# Interval between sync runs
|
|
interval: "1m"
|
|
|
|
# Policy: sync = create AND delete records. upsert-only = never delete.
|
|
policy: sync
|
|
|
|
# Registry to track which records external-dns owns
|
|
registry: txt
|
|
txtOwnerId: fastpass
|