fullnameOverride: external-dns-unifi
logLevel: &logLevel debug
provider:
  name: webhook
  webhook:
    image:
      repository: ghcr.io/kashalls/external-dns-unifi-webhook
      tag: main # replace with a versioned release tag
    env:
      - name: UNIFI_HOST
        value: https://172.28.110.1 # replace with the address to your UniFi router/controller
      - name: UNIFI_EXTERNAL_CONTROLLER
        value: "false"
      - name: UNIFI_API_KEY
        valueFrom:
          secretKeyRef:
            name: external-dns-unifi-secret
            key: api-key
      - name: LOG_LEVEL
        value: *logLevel
    livenessProbe:
      httpGet:
        path: /healthz
        port: http-webhook
      initialDelaySeconds: 10
      timeoutSeconds: 5
    readinessProbe:
      httpGet:
        path: /readyz
        port: http-webhook
      initialDelaySeconds: 10
      timeoutSeconds: 5
extraArgs:
  # The UniFi webhook listens on localhost:8888 inside the pod. Use IPv4
  # explicitly to avoid external-dns attempting ::1.
  - --webhook-provider-url=http://127.0.0.1:8888
# We are switching ingress to Istio; manage records from the Istio ingress Service.
policy: upsert-only
sources: ["service"]

# UniFi DNS doesn't support TXT records; use noop registry.
registry: noop
domainFilters: ["kube.huskypup.net"] # replace with your domain
securityContext:
  allowPrivilegeEscalation: false
  runAsNonRoot: true
  capabilities:
    drop:
      - ALL

resources:
  requests:
    cpu: 25m
    memory: 64Mi
  limits:
    cpu: 100m
    memory: 256Mi

serviceAccount:
  create: true
  name: "external-dns"
# No Ingress watching (Istio VirtualServices are used).

# Enable Prometheus metrics
serviceMonitor:
  enabled: true
  additionalLabels:
    release: prometheus
  interval: 30s