mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 05:26:49 +00:00
Services behind the Envoy gateway cannot reach Istio ambient mesh backends due to STRICT mTLS. Reverting DNS to point back to the Istio gateway until the migration path is resolved. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
68 lines
1.7 KiB
YAML
68 lines
1.7 KiB
YAML
fullnameOverride: external-dns-unifi
|
|
logLevel: &logLevel debug
|
|
provider:
|
|
name: webhook
|
|
webhook:
|
|
image:
|
|
repository: ghcr.io/kashalls/external-dns-unifi-webhook
|
|
tag: main # replace with a versioned release tag
|
|
env:
|
|
- name: UNIFI_HOST
|
|
value: https://172.28.110.1 # replace with the address to your UniFi router/controller
|
|
- name: UNIFI_EXTERNAL_CONTROLLER
|
|
value: "false"
|
|
- name: UNIFI_API_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: external-dns-unifi-secret
|
|
key: api-key
|
|
- name: LOG_LEVEL
|
|
value: *logLevel
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /healthz
|
|
port: http-webhook
|
|
initialDelaySeconds: 10
|
|
timeoutSeconds: 5
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /readyz
|
|
port: http-webhook
|
|
initialDelaySeconds: 10
|
|
timeoutSeconds: 5
|
|
extraArgs:
|
|
# The UniFi webhook listens on localhost:8888 inside the pod. Use IPv4
|
|
# explicitly to avoid external-dns attempting ::1.
|
|
- --webhook-provider-url=http://127.0.0.1:8888
|
|
policy: upsert-only
|
|
sources: ["service"]
|
|
|
|
# UniFi DNS doesn't support TXT records; use noop registry.
|
|
registry: noop
|
|
domainFilters: ["kube.huskypup.net"] # replace with your domain
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
runAsNonRoot: true
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
|
|
resources:
|
|
requests:
|
|
cpu: 25m
|
|
memory: 64Mi
|
|
limits:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
|
|
serviceAccount:
|
|
create: true
|
|
name: "external-dns"
|
|
|
|
# Enable Prometheus metrics
|
|
serviceMonitor:
|
|
enabled: true
|
|
additionalLabels:
|
|
release: prometheus
|
|
interval: 30s
|