# Service account configuration
serviceAccount:
  create: true
  name: externaldns
  annotations: {}

# Provider configuration - using new format
provider:
  name: rfc2136

# Domain filtering
domainFilters:
  - "k8s.syd1.au.unkin.net"
  - "200.18.198.in-addr.arpa"

# TXT registry configuration
txtOwnerId: "k8s"
registry: "txt"

# Enable deletion of records for dedicated DNS server
policy: "sync"

# Keep default sources
sources:
  - service
  - ingress
  - gateway-httproute
  - gateway-grpcroute

# TSIG secret + algorithm. The bind operator generates this key in
# bind-internal (BindTSIGKey externaldns-key) and the emberstack reflector
# mirrors the Secret into this namespace as externaldns-key-tsig.
env:
  - name: EXTERNAL_DNS_RFC2136_TSIG_SECRET
    valueFrom:
      secretKeyRef:
        name: externaldns-key-tsig
        key: secret
  - name: EXTERNAL_DNS_RFC2136_TSIG_ALGORITHM
    valueFrom:
      secretKeyRef:
        name: externaldns-key-tsig
        key: algorithm

# RFC2136 configuration as arguments
extraArgs:
  - --rfc2136-host=bind-externaldns-primary.bind-internal.svc.cluster.local
  - --rfc2136-port=53
  - --rfc2136-zone=k8s.syd1.au.unkin.net
  - --rfc2136-zone=200.18.198.in-addr.arpa
  # Synthesize PTR records into the reverse zone for every A record managed in
  # the forward zone (the reverse zone + resolver forwarder exist since #288;
  # without this flag nothing writes PTRs).
  - --create-ptr
  # --create-ptr requires PTR in the managed record types; setting the flag
  # replaces the default list (A,AAAA,CNAME), so re-state the defaults too.
  - --managed-record-types=A
  - --managed-record-types=AAAA
  - --managed-record-types=CNAME
  - --managed-record-types=PTR
  - --rfc2136-tsig-keyname=externaldns-key
  - --rfc2136-tsig-secret-alg=$(EXTERNAL_DNS_RFC2136_TSIG_ALGORITHM)
  - --rfc2136-tsig-axfr
  - --rfc2136-tsig-secret=$(EXTERNAL_DNS_RFC2136_TSIG_SECRET)
  - --ingress-class=nginx

logLevel: debug
