Initial commit

infrastructure/external-dns/values.yaml

@@ -0,0 +1,69 @@
+fullnameOverride: external-dns-unifi
+logLevel: &logLevel debug
+provider:
+  name: webhook
+  webhook:
+    image:
+      repository: ghcr.io/kashalls/external-dns-unifi-webhook
+      tag: main # replace with a versioned release tag
+    env:
+      - name: UNIFI_HOST
+        value: https://172.28.110.1 # replace with the address to your UniFi router/controller
+      - name: UNIFI_EXTERNAL_CONTROLLER
+        value: "false"
+      - name: UNIFI_API_KEY
+        valueFrom:
+          secretKeyRef:
+            name: external-dns-unifi-secret
+            key: api-key
+      - name: LOG_LEVEL
+        value: *logLevel
+    livenessProbe:
+      httpGet:
+        path: /healthz
+        port: http-webhook
+      initialDelaySeconds: 10
+      timeoutSeconds: 5
+    readinessProbe:
+      httpGet:
+        path: /readyz
+        port: http-webhook
+      initialDelaySeconds: 10
+      timeoutSeconds: 5
+extraArgs:
+  # The UniFi webhook listens on localhost:8888 inside the pod. Use IPv4
+  # explicitly to avoid external-dns attempting ::1.
+  - --webhook-provider-url=http://127.0.0.1:8888
+# We are switching ingress to Istio; manage records from the Istio ingress Service.
+policy: upsert-only
+sources: ["service"]
+
+# UniFi DNS doesn't support TXT records; use noop registry.
+registry: noop
+domainFilters: ["kube.huskypup.net"] # replace with your domain
+securityContext:
+  allowPrivilegeEscalation: false
+  runAsNonRoot: true
+  capabilities:
+    drop:
+      - ALL
+
+resources:
+  requests:
+    cpu: 25m
+    memory: 64Mi
+  limits:
+    cpu: 100m
+    memory: 256Mi
+
+serviceAccount:
+  create: true
+  name: "external-dns"
+# No Ingress watching (Istio VirtualServices are used).
+
+# Enable Prometheus metrics
+serviceMonitor:
+  enabled: true
+  additionalLabels:
+    release: prometheus
+  interval: 30s