feat: replace external-dns chart with app-template - add rbac

Signed-off-by: Devin Buhl <[email protected]>
onedr0p · Jan 3, 2024 · bcc13c3 · bcc13c3
1 parent 28af2e2
commit bcc13c3
Show file tree

Hide file tree

Showing 9 changed files with 111 additions and 3 deletions.
diff --git a/kubernetes/main/apps/network/external-dns/app/bind/helmrelease.yaml b/kubernetes/main/apps/network/external-dns/app/bind/helmrelease.yaml
@@ -3,7 +3,7 @@
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
-  name: external-dns-bind
+  name: &app external-dns-bind
 spec:
   interval: 30m
   chart:
@@ -87,6 +87,9 @@ spec:
             runAsUser: 568
             runAsGroup: 568
             runAsNonRoot: true
+    serviceAccount:
+      create: true
+      name: *app
     service:
       main:
         ports:

diff --git a/kubernetes/main/apps/network/external-dns/app/bind/kustomization.yaml b/kubernetes/main/apps/network/external-dns/app/bind/kustomization.yaml
@@ -5,3 +5,4 @@ kind: Kustomization
 resources:
   - ./externalsecret.yaml
   - ./helmrelease.yaml
+  - ./rbac.yaml
diff --git a/kubernetes/main/apps/network/external-dns/app/bind/rbac.yaml b/kubernetes/main/apps/network/external-dns/app/bind/rbac.yaml
@@ -0,0 +1,31 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: external-dns-bind
+rules:
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["list", "watch"]
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get", "watch", "list"]
+  - apiGroups: [""]
+    resources: ["services", "endpoints"]
+    verbs: ["get", "watch", "list"]
+  - apiGroups: ["extensions", "networking.k8s.io"]
+    resources: ["ingresses"]
+    verbs: ["get", "watch", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: external-dns-bind
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: external-dns-bind
+subjects:
+  - kind: ServiceAccount
+    name: external-dns-bind
+    namespace: network
diff --git a/kubernetes/main/apps/network/external-dns/app/cloudflare/helmrelease.yaml b/kubernetes/main/apps/network/external-dns/app/cloudflare/helmrelease.yaml
@@ -3,7 +3,7 @@
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
-  name: external-dns-cloudflare
+  name: &app external-dns-cloudflare
 spec:
   interval: 30m
   chart:
@@ -84,6 +84,9 @@ spec:
             runAsUser: 568
             runAsGroup: 568
             runAsNonRoot: true
+    serviceAccount:
+      create: true
+      name: *app
     service:
       main:
         ports:

diff --git a/kubernetes/main/apps/network/external-dns/app/cloudflare/kustomization.yaml b/kubernetes/main/apps/network/external-dns/app/cloudflare/kustomization.yaml
@@ -5,3 +5,4 @@ kind: Kustomization
 resources:
   - ./externalsecret.yaml
   - ./helmrelease.yaml
+  - ./rbac.yaml
diff --git a/kubernetes/main/apps/network/external-dns/app/cloudflare/rbac.yaml b/kubernetes/main/apps/network/external-dns/app/cloudflare/rbac.yaml
@@ -0,0 +1,34 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: external-dns-cloudflare
+rules:
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["list", "watch"]
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get", "watch", "list"]
+  - apiGroups: ["extensions", "networking.k8s.io"]
+    resources: ["ingresses"]
+    verbs: ["get", "watch", "list"]
+  - apiGroups: ["externaldns.k8s.io"]
+    resources: ["dnsendpoints"]
+    verbs: ["get","watch","list"]
+  - apiGroups: ["externaldns.k8s.io"]
+    resources: ["dnsendpoints/status"]
+    verbs: ["*"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: external-dns-cloudflare
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: external-dns-cloudflare
+subjects:
+  - kind: ServiceAccount
+    name: external-dns-cloudflare
+    namespace: network
diff --git a/kubernetes/storage/apps/network/external-dns/app/bind/helmrelease.yaml b/kubernetes/storage/apps/network/external-dns/app/bind/helmrelease.yaml
@@ -3,7 +3,7 @@
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
-  name: external-dns-bind
+  name: &app external-dns-bind
 spec:
   interval: 30m
   chart:
@@ -87,6 +87,9 @@ spec:
             runAsUser: 568
             runAsGroup: 568
             runAsNonRoot: true
+    serviceAccount:
+      create: true
+      name: *app
     service:
       main:
         ports:

diff --git a/kubernetes/storage/apps/network/external-dns/app/bind/kustomization.yaml b/kubernetes/storage/apps/network/external-dns/app/bind/kustomization.yaml
@@ -5,3 +5,4 @@ kind: Kustomization
 resources:
   - ./externalsecret.yaml
   - ./helmrelease.yaml
+  - ./rbac.yaml
diff --git a/kubernetes/storage/apps/network/external-dns/app/bind/rbac.yaml b/kubernetes/storage/apps/network/external-dns/app/bind/rbac.yaml
@@ -0,0 +1,31 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: external-dns-bind
+rules:
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["list", "watch"]
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get", "watch", "list"]
+  - apiGroups: [""]
+    resources: ["services", "endpoints"]
+    verbs: ["get", "watch", "list"]
+  - apiGroups: ["extensions", "networking.k8s.io"]
+    resources: ["ingresses"]
+    verbs: ["get", "watch", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: external-dns-bind
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: external-dns-bind
+subjects:
+  - kind: ServiceAccount
+    name: external-dns-bind
+    namespace: network