feat: migrate externaldns from Terraform to ArgoCD

- Add externaldns base ArgoCD application with namespace and Vault integration
- Create externaldns overlay for au-syd1 with Helm chart configuration
- Update platform ApplicationSet to include externaldns deployment
- Configure external-dns v1.19.0 with RFC2136 provider for DNS updates
- Maintain one-to-one migration from Terraform configuration including TSIG secrets

.woodpecker/kubeconform.yaml

@@ -3,6 +3,6 @@ when:
 
 steps:
   - name: kubeconform
-    image: git.unkin.net/unkin/almalinux9-kubetest:20260308
+    image: git.unkin.net/unkin/almalinux9-kubetest:20260319
     commands:
       - make kubeconform

apps/base/cattle-system/ingress.yaml

@@ -0,0 +1,29 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: rancher
+  namespace: cattle-system
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: rancher.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: rancher.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: "198.18.200.0"
+spec:
+  ingressClassName: nginx
+  tls:
+    - hosts:
+        - rancher.k8s.syd1.au.unkin.net
+      secretName: rancher-tls
+  rules:
+    - host: rancher.k8s.syd1.au.unkin.net
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: rancher
+                port:
+                  number: 80

apps/base/cattle-system/kustomization.yaml

@@ -0,0 +1,9 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  - vaultauth.yaml
+  - vaultstaticsecret.yaml
+  - ingress.yaml

apps/base/cattle-system/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cattle-system

apps/base/cattle-system/vaultauth.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: rancher
+  namespace: cattle-system
+spec:
+  method: kubernetes
+  mount: k8s/au/syd1
+  vaultConnectionRef: vso-system/default
+  allowedNamespaces:
+    - cattle-system
+  kubernetes:
+    role: rancher
+    serviceAccount: rancher
+    audiences:
+      - vault
+    tokenExpirationSeconds: 600

apps/base/cattle-system/vaultstaticsecret.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: rancher-bootstrap-secret
+  namespace: cattle-system
+spec:
+  vaultAuthRef: rancher
+  mount: kv
+  type: kv-v2
+  path: service/kubernetes/au/syd1/rancher/bootstrap-password
+  refreshAfter: 5m
+  destination:
+    name: rancher-bootstrap-secret
+    create: true

apps/base/cert-manager/clusterrole.yaml

@@ -0,0 +1,12 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: cert-manager-vault-token-creator
+  labels:
+    app.kubernetes.io/name: "cert-manager-config"
+    app.kubernetes.io/instance: "cert-manager-config"
+rules:
+- apiGroups: [""]
+  resources: ["serviceaccounts/token"]
+  verbs: ["create"]

apps/base/cert-manager/clusterrolebinding.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: cert-manager-vault-token-creator
+  labels:
+    app.kubernetes.io/name: "cert-manager-config"
+    app.kubernetes.io/instance: "cert-manager-config"
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cert-manager-vault-token-creator
+subjects:
+- kind: ServiceAccount
+  name: cert-manager
+  namespace: cert-manager

apps/base/cert-manager/kustomization.yaml

@@ -0,0 +1,9 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  - serviceaccount.yaml
+  - clusterrole.yaml
+  - clusterrolebinding.yaml

apps/base/cert-manager/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cert-manager

apps/base/cert-manager/serviceaccount.yaml

@@ -0,0 +1,11 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: vault-issuer
+  namespace: cert-manager
+  labels:
+    app.kubernetes.io/name: "cert-manager-config"
+    app.kubernetes.io/instance: "cert-manager-config"
+    app.kubernetes.io/component: "vault-issuer"
+automountServiceAccountToken: true

apps/base/certificates/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  - vault-ca-cert.yaml

apps/base/certificates/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: certificates

apps/base/certificates/vault-ca-cert.yaml

@@ -0,0 +1,59 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: vault-ca-cert
+  namespace: certificates
+  labels:
+    app.kubernetes.io/name: vault-ca-cert
+    app.kubernetes.io/part-of: vault-secrets-operator
+  annotations:
+    description: "Vault CA certificate replicated to all namespaces"
+    reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
+    reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
+    reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: ""
+type: Opaque
+stringData:
+  ca.crt: |
+    -----BEGIN CERTIFICATE-----
+    MIIDujCCAqKgAwIBAgIULZAR/QcvAnxdi04S6bXhNeazozYwDQYJKoZIhvcNAQEL
+    BQAwFDESMBAGA1UEAxMJdW5raW4ubmV0MB4XDTI0MDQyNzExMzcyMloXDTI5MDQy
+    NjExMzc1MlowKzEpMCcGA1UEAxMgdW5raW4ubmV0IEludGVybWVkaWF0ZSBBdXRo
+    b3JpdHkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDDq0ZU2DnuYW5s
+    E3lPjVe2Ns6cPu64yx1GLVqB5VbOUs71ThRjPjvEwE98YtGMza8ok0CQSqS2qX8z
+    vnMbnVCaWKjCnem/dtQtB+8WCu5uQuNHhwqxgw1tD/klAkVLWGgTPDEgasvjDMkc
+    sW8in/BhtrV9YA/lQGpge+j9/MFXhlnvaLCPybFifPRX9Yc5CcnhSzLSzFPO4PJx
+    VH4Qu9eByyKHMTvgcCy6p9qjjzz+8dtAlxeIsgfTEdvtfCPowsF+v2XooutTsJt0
+    xUDvUDu4xV6tVCEOYRA2cZHkLRBhV289M0hocHrsGqMmA1+j0skwwt/6UkVHqlCT
+    mitItX+RAgMBAAGjgewwgekwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMB
+    Af8wHQYDVR0OBBYEFEp/+grAdVqRSeb9xJjSeZYNW32MMB8GA1UdIwQYMBaAFBqc
+    v6Y+hfHt4EjgKa/uoQGEHTknMEcGCCsGAQUFBwEBBDswOTA3BggrBgEFBQcwAoYr
+    aHR0cHM6Ly92YXVsdC5zZXJ2aWNlLmNvbnN1bC92MS9wa2lfcm9vdC9jYTA9BgNV
+    HR8ENjA0MDKgMKAuhixodHRwczovL3ZhdWx0LnNlcnZpY2UuY29uc3VsL3YxL3Br
+    aV9yb290L2NybDANBgkqhkiG9w0BAQsFAAOCAQEAM0FS8tscZe7yly/gM7jO6lx5
+    muMFusifjUIrcQGnZBkoECeuUVPNTs3e/Th+XaxjCnmSpqSNT3z9Irr6Hhxf7n03
+    4+hpF3G0bf1yh4DRex/0ua3szvgo91RwyKVQM1BHIA1PwdF8csO+LT4FTMILzo4U
+    DdSVvDEIaxYYQCDNfAD81n+8lmFbabupfsKbkSTR+sNTS+TMnLpN8YwSXdB0e+RU
+    eEZRNVu0jKmbE8U/66Sc33YLe6cxbCclHA+G4giGwEP+lYZk+rFjmr6ci9bj5yyN
+    Sznr7xdW0ofOdACAQFFy5KTZqCDjIrvk12vUn4bSsXmWVIQEd+jPx6wuxD/rSw==
+    -----END CERTIFICATE-----
+    -----BEGIN CERTIFICATE-----
+    MIIDLzCCAhegAwIBAgIUIDADwsHIrQ8dfncpechBdIUCQdIwDQYJKoZIhvcNAQEL
+    BQAwFDESMBAGA1UEAxMJdW5raW4ubmV0MB4XDTI0MDQyNzExMjcwMloXDTM0MDQy
+    NTExMjczMlowFDESMBAGA1UEAxMJdW5raW4ubmV0MIIBIjANBgkqhkiG9w0BAQEF
+    AAOCAQ8AMIIBCgKCAQEA3ENPv7R7gCUJAg8Q4hB2LEZSdvbK155YbcrguLDDnu6m
+    2fkJn8jYMMW3Z6/+Y04ouGwi6sKup8ggTb217sY+dC4IUZjotDPAhruxfXVQAh0v
+    Yr3RYoxVDrm4nRSFLo1RA4Qt+1KK299mHGQf9iAiwbsFp5mDrJT9uz15FE2uWmbK
+    8/onMyJC4fnkMihVN6NIgTtjpHYNm5aAJwxoWldTopgF0ucb7X3XVPNbKAmd3Avd
+    lsOo6m751zSZ0HvJOxgRSy7lvPzMuUfCQsOcmI4O4+Z2FL4Y7p+T9DvWkciC7L3i
+    tBiK30fPfGKNpWaof1ONCcPQNjMwWcEFXqSiWUOXkwIDAQABo3kwdzAOBgNVHQ8B
+    Af8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUGpy/pj6F8e3gSOAp
+    r+6hAYQdOScwHwYDVR0jBBgwFoAUGpy/pj6F8e3gSOApr+6hAYQdOScwFAYDVR0R
+    BA0wC4IJdW5raW4ubmV0MA0GCSqGSIb3DQEBCwUAA4IBAQA5xocILzuvD+R2Iub1
+    UnTdcVpgNcxJmESz0eX4UrkcBmddtuFINXvDTv5//XTFs78LsVVSf00xZ+2C62Xe
+    xRdCdluHN8VDCAKulP4XJY1BiZ7im0v+iMgPDKhq4OXb86WFYI/8J6uRm7oIAwj1
+    zhhKxMimkzli+yHB8ipL15W7l68CMUgmOjFA+EG6sbfadFpQTX/h6TVj3FQPkU/p
+    UJEm2XjlGNAKGJrNRU47PM4vRDv5Joyowp9zv/pHFXvUJladaJupMKRJQVWQz1US
+    EXE67rawG79s3vm8dDolnbli/IhPHtjDRIprxAwrMs5tt9cY0xsRkFBZVcAOjrpb
+    4gqd
+    -----END CERTIFICATE-----

apps/base/externaldns/kustomization.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  - vaultauth.yaml
+  - vaultstaticsecret.yaml

apps/base/externaldns/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: externaldns

apps/base/externaldns/vaultauth.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: default
+  namespace: externaldns
+spec:
+  method: kubernetes
+  mount: k8s/au/syd1
+  vaultConnectionRef: vso-system/default
+  allowedNamespaces:
+    - externaldns
+  kubernetes:
+    role: externaldns
+    serviceAccount: externaldns
+    audiences:
+      - vault
+    tokenExpirationSeconds: 600

apps/base/externaldns/vaultstaticsecret.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: externaldns-tsig
+  namespace: externaldns
+spec:
+  vaultAuthRef: default
+  mount: kv
+  type: kv-v2
+  path: service/kubernetes/au/syd1/externaldns/tsig
+  refreshAfter: 5m
+  destination:
+    name: externaldns-tsig
+    create: true
+  rolloutRestartTargets:
+    - kind: Deployment
+      name: externaldns

apps/overlays/au-syd1/cattle-system/kustomization.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../../base/cattle-system
+
+helmCharts:
+  - name: rancher
+    repo: https://releases.rancher.com/server-charts/stable
+    version: "2.13.1"
+    releaseName: rancher
+    namespace: cattle-system
+    valuesFile: values.yaml

apps/overlays/au-syd1/cattle-system/values.yaml

@@ -0,0 +1,40 @@
+hostname: rancher.k8s.syd1.au.unkin.net
+
+bootstrapPassword: ""
+
+extraEnv:
+  - name: CATTLE_BOOTSTRAP_PASSWORD
+    valueFrom:
+      secretKeyRef:
+        name: rancher-bootstrap-secret
+        key: password
+
+ingress:
+  enabled: false
+
+tls: external
+
+replicas: 3
+
+priorityClassName: rancher-critical
+
+# Resource limits for production
+resources:
+  limits:
+    cpu: 2000m
+    memory: 8Gi
+  requests:
+    cpu: 50m
+    memory: 256Mi
+
+# Additional security settings
+antiAffinity: preferred
+
+# Audit logging configuration
+auditLog:
+  enabled: true
+  destination: sidecar
+  level: 1
+  maxAge: 7
+  maxBackup: 3
+  maxSize: 100

apps/overlays/au-syd1/cert-manager/kustomization.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../../base/cert-manager
+
+helmCharts:
+  - name: cert-manager
+    repo: https://charts.jetstack.io
+    version: "v1.19.2"
+    releaseName: cert-manager
+    namespace: cert-manager
+    valuesFile: values.yaml

apps/overlays/au-syd1/cert-manager/values.yaml

@@ -0,0 +1,29 @@
+crds:
+  enabled: true
+
+replicaCount: 2
+
+resources:
+  requests:
+    cpu: 10m
+    memory: 32Mi
+
+strategy:
+  type: RollingUpdate
+  rollingUpdate:
+    maxSurge: 0
+    maxUnavailable: 1
+
+webhook:
+  replicaCount: 2
+  resources:
+    requests:
+      cpu: 10m
+      memory: 32Mi
+
+cainjector:
+  replicaCount: 2
+  resources:
+    requests:
+      cpu: 10m
+      memory: 32Mi

apps/overlays/au-syd1/certificates/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../../base/certificates

apps/overlays/au-syd1/externaldns/kustomization.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../../base/externaldns
+
+helmCharts:
+  - name: external-dns
+    repo: https://kubernetes-sigs.github.io/external-dns/
+    version: "1.19.0"
+    releaseName: externaldns
+    namespace: externaldns
+    valuesFile: values.yaml

apps/overlays/au-syd1/externaldns/values.yaml

@@ -0,0 +1,51 @@
+# Service account configuration
+serviceAccount:
+  create: true
+  name: externaldns
+  annotations: {}
+
+# Provider configuration - using new format
+provider:
+  name: rfc2136
+
+# Domain filtering
+domainFilters:
+  - "k8s.syd1.au.unkin.net"
+  - "200.18.198.in-addr.arpa"
+
+# TXT registry configuration
+txtOwnerId: "k8s"
+registry: "txt"
+
+# Enable deletion of records for dedicated DNS server
+policy: "sync"
+
+# Keep default sources
+sources:
+  - service
+  - ingress
+
+# Environment variables for TSIG secret and algorithm from Vault
+env:
+  - name: EXTERNAL_DNS_RFC2136_TSIG_SECRET
+    valueFrom:
+      secretKeyRef:
+        name: externaldns-tsig
+        key: secret
+  - name: EXTERNAL_DNS_RFC2136_TSIG_ALGORITHM
+    valueFrom:
+      secretKeyRef:
+        name: externaldns-tsig
+        key: algorithm
+
+# RFC2136 configuration as arguments
+extraArgs:
+  - --rfc2136-host=ausyd1nxvm2127.main.unkin.net
+  - --rfc2136-port=53
+  - --rfc2136-zone=k8s.syd1.au.unkin.net
+  - --rfc2136-zone=200.18.198.in-addr.arpa
+  - --rfc2136-tsig-keyname=externaldns-key
+  - --rfc2136-tsig-secret-alg=$(EXTERNAL_DNS_RFC2136_TSIG_ALGORITHM)
+  - --rfc2136-tsig-axfr
+  - --rfc2136-tsig-secret=$(EXTERNAL_DNS_RFC2136_TSIG_SECRET)
+  - --ingress-class=nginx

argocd/applicationsets/platform.yaml

@@ -11,6 +11,10 @@ spec:
       revision: HEAD
       directories:
       - path: apps/overlays/*/artifactapi
+      - path: apps/overlays/*/cattle-system
+      - path: apps/overlays/*/certificates
+      - path: apps/overlays/*/cert-manager
+      - path: apps/overlays/*/externaldns
       - path: apps/overlays/*/reflector-system
       - path: apps/overlays/*/reloader-system
       - path: apps/overlays/*/jfrog

argocd/projects/platform.yaml

@@ -10,11 +10,20 @@ spec:
     - https://git.unkin.net/unkin/argocd-apps
     - oci://ghcr.io/emberstack/helm-charts
     - oci://ghcr.io/woodpecker-ci/helm/woodpecker
+    - https://releases.rancher.com/server-charts/stable
+    - https://charts.jetstack.io
+    - https://kubernetes-sigs.github.io/external-dns/
   destinations:
     - namespace: '*-system'
       server: https://kubernetes.default.svc
     - namespace: 'artifactapi'
       server: https://kubernetes.default.svc
+    - namespace: 'cert-manager'
+      server: https://kubernetes.default.svc
+    - namespace: 'certificates'
+      server: https://kubernetes.default.svc
+    - namespace: 'externaldns'
+      server: https://kubernetes.default.svc
     - namespace: 'jfrog'
       server: https://kubernetes.default.svc
     - namespace: 'puppet'
@@ -30,6 +39,12 @@ spec:
       kind: ClusterRoleBinding
     - group: 'apiextensions.k8s.io'
       kind: CustomResourceDefinition
+    - group: 'admissionregistration.k8s.io'
+      kind: MutatingWebhookConfiguration
+    - group: 'admissionregistration.k8s.io'
+      kind: ValidatingWebhookConfiguration
+    - group: 'scheduling.k8s.io'
+      kind: PriorityClass
   namespaceResourceWhitelist:
     - group: '*'
       kind: '*'