unkinben
b725bf7dcf
Follow-up to #294: --create-ptr validates that PTR is in --managed-record-types, and setting that flag replaces the default list, so A/AAAA/CNAME are re-stated alongside PTR (verified against the v0.21.0 binary's --help: default A,AAAA,CNAME). Pod is crash-looping on config validation until this merges. - Adds --managed-record-types=A,AAAA,CNAME,PTR to the external-dns args MERGE ASAP. Reviewed-on: #295 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>
68 lines
1.9 KiB
YAML
68 lines
1.9 KiB
YAML
# Service account configuration
|
|
serviceAccount:
|
|
create: true
|
|
name: externaldns
|
|
annotations: {}
|
|
|
|
# Provider configuration - using new format
|
|
provider:
|
|
name: rfc2136
|
|
|
|
# Domain filtering
|
|
domainFilters:
|
|
- "k8s.syd1.au.unkin.net"
|
|
- "200.18.198.in-addr.arpa"
|
|
|
|
# TXT registry configuration
|
|
txtOwnerId: "k8s"
|
|
registry: "txt"
|
|
|
|
# Enable deletion of records for dedicated DNS server
|
|
policy: "sync"
|
|
|
|
# Keep default sources
|
|
sources:
|
|
- service
|
|
- ingress
|
|
- gateway-httproute
|
|
- gateway-grpcroute
|
|
|
|
# TSIG secret + algorithm. The bind operator generates this key in
|
|
# bind-internal (BindTSIGKey externaldns-key) and the emberstack reflector
|
|
# mirrors the Secret into this namespace as externaldns-key-tsig.
|
|
env:
|
|
- name: EXTERNAL_DNS_RFC2136_TSIG_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: externaldns-key-tsig
|
|
key: secret
|
|
- name: EXTERNAL_DNS_RFC2136_TSIG_ALGORITHM
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: externaldns-key-tsig
|
|
key: algorithm
|
|
|
|
# RFC2136 configuration as arguments
|
|
extraArgs:
|
|
- --rfc2136-host=bind-externaldns-primary.bind-internal.svc.cluster.local
|
|
- --rfc2136-port=53
|
|
- --rfc2136-zone=k8s.syd1.au.unkin.net
|
|
- --rfc2136-zone=200.18.198.in-addr.arpa
|
|
# Synthesize PTR records into the reverse zone for every A record managed in
|
|
# the forward zone (the reverse zone + resolver forwarder exist since #288;
|
|
# without this flag nothing writes PTRs).
|
|
- --create-ptr
|
|
# --create-ptr requires PTR in the managed record types; setting the flag
|
|
# replaces the default list (A,AAAA,CNAME), so re-state the defaults too.
|
|
- --managed-record-types=A
|
|
- --managed-record-types=AAAA
|
|
- --managed-record-types=CNAME
|
|
- --managed-record-types=PTR
|
|
- --rfc2136-tsig-keyname=externaldns-key
|
|
- --rfc2136-tsig-secret-alg=$(EXTERNAL_DNS_RFC2136_TSIG_ALGORITHM)
|
|
- --rfc2136-tsig-axfr
|
|
- --rfc2136-tsig-secret=$(EXTERNAL_DNS_RFC2136_TSIG_SECRET)
|
|
- --ingress-class=nginx
|
|
|
|
logLevel: debug
|