Skip to content

Commit eda62ff

Browse files
mrkhachaturovkvapscoderabbitai[bot]
authored
External-dns and new clusterissuer dns01 Cloudflare (#374)
Overview This pull request introduces the integration of External-DNS into the full bundles and adds support for a dns01 ClusterIssuer using Cloudflare. It enhances the DNS management capabilities for our deployments by allowing dynamic DNS record management directly from Kubernetes resources. Changes Made 1. **External-DNS Integration:** - Added External-DNS to the full deployment bundles. - Configured External-DNS to automatically manage DNS records for services within the Kubernetes cluster ( we must discuss how to configure external-dns via configmap or create an application in tenant `external-dns` where we can define values). We must define some additional annotations for ingresses in order to make external-dns work , so we must discuss this also which is best method to configure it ( from configmap or dashboard ). **2. dns01 ClusterIssuer for Cloudflare:** - Implemented support for a dns01 ClusterIssuer using Cloudflare. - This allows for automated certificate issuance via DNS challenge, leveraging Cloudflare as the DNS provider. - The configuration can be defined in the Cozystack ConfigMap 3. Default Ingress Configuration: - Updated the default Ingress resources to use Cloudflare for DNS challenges. - Ensured that if the Cloudflare issuer is defined in the Cozystack ConfigMap, it will be utilized for all default Ingresses, streamlining the deployment process and improving reliability. **Benefits** - Automated DNS Management: With External-DNS, DNS entries will be created and updated automatically based on the state of Kubernetes resources, reducing manual overhead. - Seamless Certificate Management: The dns01 ClusterIssuer integration allows for automated SSL/TLS certificate issuance, enhancing security for deployed applications. - Flexibility in Configuration: Users can easily switch between different issuers by updating the Cozystack ConfigMap, providing flexibility in the choice of DNS and certificate management solutions. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Release Notes - **New Features** - Introduced a new `external-dns` release with support for managing DNS records in Kubernetes. - Added configuration options for DNS synchronization policies and provider settings. - Implemented a new lookup for issuer types in Ingress configurations. - Expanded configuration with new entries for `external-dns` in multiple deployment files, enhancing deployment flexibility. - **Documentation** - Comprehensive README and configuration schema for the `external-dns` Helm chart added, detailing installation and customization options. - **Improvements** - Enhanced RBAC configuration for flexible permissions management. - Updated annotations and health check configurations for better service monitoring. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Andrei Kvapil <[email protected]> Co-authored-by: Andrei Kvapil <[email protected]> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
1 parent 992d040 commit eda62ff

31 files changed

Lines changed: 1823 additions & 66 deletions

‎packages/core/platform/bundles/distro-full.yaml‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -142,8 +142,14 @@ releases:
142142
namespace: cozy-telepresence
143143
dependsOn: []
144144

145+
- name: external-dns
146+
releaseName: external-dns
147+
chart: cozy-external-dns
148+
namespace: cozy-external-dns
149+
dependsOn: [cilium]
150+
145151
- name: external-secrets-operator
146152
releaseName: external-secrets-operator
147153
chart: cozy-external-secrets-operator
148154
namespace: cozy-external-secrets-operator
149-
dependsOn: [cilium]
155+
dependsOn: [cilium]

‎packages/core/platform/bundles/distro-hosted.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,12 @@ releases:
9393
namespace: cozy-telepresence
9494
dependsOn: []
9595

96+
- name: external-dns
97+
releaseName: external-dns
98+
chart: cozy-external-dns
99+
namespace: cozy-external-dns
100+
dependsOn: []
101+
96102
- name: external-secrets-operator
97103
releaseName: external-secrets-operator
98104
chart: cozy-external-secrets-operator

‎packages/core/platform/bundles/paas-full.yaml‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -217,8 +217,14 @@ releases:
217217
privileged: true
218218
dependsOn: [cilium,kubeovn,capi-operator]
219219

220+
- name: external-dns
221+
releaseName: external-dns
222+
chart: cozy-external-dns
223+
namespace: cozy-external-dns
224+
dependsOn: [cilium,kubeovn]
225+
220226
- name: external-secrets-operator
221227
releaseName: external-secrets-operator
222228
chart: cozy-external-secrets-operator
223229
namespace: cozy-external-secrets-operator
224-
dependsOn: [cilium,kubeovn]
230+
dependsOn: [cilium,kubeovn]

‎packages/core/platform/bundles/paas-hosted.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,12 @@ releases:
9999
namespace: cozy-telepresence
100100
dependsOn: []
101101

102+
- name: external-dns
103+
releaseName: external-dns
104+
chart: cozy-external-dns
105+
namespace: cozy-external-dns
106+
dependsOn: [cilium,kubeovn]
107+
102108
- name: external-secrets-operator
103109
releaseName: external-secrets-operator
104110
chart: cozy-external-secrets-operator

‎packages/extra/ingress/templates/dashboard.yaml‎

Lines changed: 35 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,36 @@
1-
{{- $myNS := lookup "v1" "Namespace" "" .Release.Namespace }}
2-
{{- $host := index $myNS.metadata.annotations "namespace.cozystack.io/host" }}
3-
{{- if .Values.dashboard }}
4-
apiVersion: networking.k8s.io/v1
5-
kind: Ingress
6-
metadata:
7-
annotations:
8-
cert-manager.io/cluster-issuer: letsencrypt-prod
9-
acme.cert-manager.io/http01-ingress-class: tenant-root
10-
name: dashboard-{{ .Release.Namespace }}
11-
namespace: cozy-dashboard
12-
spec:
13-
ingressClassName: {{ .Release.Namespace }}
14-
rules:
15-
- host: dashboard.{{ $host }}
16-
http:
17-
paths:
18-
- backend:
19-
service:
20-
name: dashboard
21-
port:
22-
number: 80
23-
path: /
24-
pathType: Prefix
25-
tls:
26-
- hosts:
27-
- dashboard.{{ $host }}
28-
secretName: dashboard-{{ .Release.Namespace }}-tls
1+
{{- $cozyConfig := lookup "v1" "ConfigMap" "cozy-system" "cozystack" }}
2+
{{- $issuerType := (index $cozyConfig.data "clusterissuer") | default "http01" }}
3+
4+
{{- $myNS := lookup "v1" "Namespace" "" .Release.Namespace }}
5+
{{- $host := index $myNS.metadata.annotations "namespace.cozystack.io/host" }}
6+
7+
{{- if .Values.dashboard }}
8+
apiVersion: networking.k8s.io/v1
9+
kind: Ingress
10+
metadata:
11+
annotations:
12+
cert-manager.io/cluster-issuer: letsencrypt-prod
13+
{{- if eq $issuerType "cloudflare" }}
14+
{{- else }}
15+
acme.cert-manager.io/http01-ingress-class: {{ .Release.Namespace }}
16+
{{- end }}
17+
name: dashboard-{{ .Release.Namespace }}
18+
namespace: cozy-dashboard
19+
spec:
20+
ingressClassName: {{ .Release.Namespace }}
21+
rules:
22+
- host: dashboard.{{ $host }}
23+
http:
24+
paths:
25+
- backend:
26+
service:
27+
name: dashboard
28+
port:
29+
number: 80
30+
path: /
31+
pathType: Prefix
32+
tls:
33+
- hosts:
34+
- dashboard.{{ $host }}
35+
secretName: dashboard-{{ .Release.Namespace }}-tls
2936
{{- end }}

‎packages/extra/monitoring/templates/alerta/alerta.yaml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
{{- $cozyConfig := lookup "v1" "ConfigMap" "cozy-system" "cozystack" }}
2+
{{- $issuerType := (index $cozyConfig.data "clusterissuer") | default "http01" }}
3+
14
{{- $myNS := lookup "v1" "Namespace" "" .Release.Namespace }}
25
{{- $ingress := index $myNS.metadata.annotations "namespace.cozystack.io/ingress" }}
36
{{- $host := index $myNS.metadata.annotations "namespace.cozystack.io/host" }}
@@ -146,7 +149,9 @@ metadata:
146149
app: alerta
147150
annotations:
148151
acme.cert-manager.io/http01-ingress-class: {{ $ingress }}
149-
cert-manager.io/cluster-issuer: letsencrypt-prod
152+
{{- if ne $issuerType "cloudflare" }}
153+
acme.cert-manager.io/http01-ingress-class: {{ $ingress }}
154+
{{- end }}
150155
spec:
151156
ingressClassName: {{ $ingress }}
152157
tls:

‎packages/extra/monitoring/templates/grafana/grafana.yaml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
{{- $cozyConfig := lookup "v1" "ConfigMap" "cozy-system" "cozystack" }}
2+
{{- $issuerType := (index $cozyConfig.data "clusterissuer") | default "http01" }}
3+
14
{{- $myNS := lookup "v1" "Namespace" "" .Release.Namespace }}
25
{{- $ingress := index $myNS.metadata.annotations "namespace.cozystack.io/ingress" }}
36
{{- $host := index $myNS.metadata.annotations "namespace.cozystack.io/host" }}
@@ -90,7 +93,9 @@ spec:
9093
ingress:
9194
metadata:
9295
annotations:
93-
acme.cert-manager.io/http01-ingress-class: "{{ $ingress }}"
96+
{{- if ne $issuerType "cloudflare" }}
97+
acme.cert-manager.io/http01-ingress-class: "{{ $ingress }}"
98+
{{- end }}
9499
cert-manager.io/cluster-issuer: letsencrypt-prod
95100
spec:
96101
ingressClassName: "{{ $ingress }}"

‎packages/system/cert-manager-issuers/templates/cluster-issuers.yaml‎

Lines changed: 55 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -1,35 +1,56 @@
1-
apiVersion: cert-manager.io/v1
2-
kind: ClusterIssuer
3-
metadata:
4-
annotations:
5-
name: letsencrypt-prod
6-
spec:
7-
acme:
8-
privateKeySecretRef:
9-
name: letsencrypt-prod
10-
server: https://acme-v02.api.letsencrypt.org/directory
11-
solvers:
12-
- http01:
13-
ingress:
14-
class: nginx
15-
---
16-
apiVersion: cert-manager.io/v1
17-
kind: ClusterIssuer
18-
metadata:
19-
name: letsencrypt-stage
20-
spec:
21-
acme:
22-
privateKeySecretRef:
1+
{{- $cozyConfig := lookup "v1" "ConfigMap" "cozy-system" "cozystack" }}
2+
{{- $issuerType := (index $cozyConfig.data "clusterissuer") | default "http01" }}
3+
4+
apiVersion: cert-manager.io/v1
5+
kind: ClusterIssuer
6+
metadata:
7+
name: letsencrypt-prod
8+
spec:
9+
acme:
10+
privateKeySecretRef:
11+
name: letsencrypt-prod
12+
server: https://acme-v02.api.letsencrypt.org/directory
13+
solvers:
14+
- {{- if eq $issuerType "cloudflare" }}
15+
dns01:
16+
cloudflare:
17+
apiTokenSecretRef:
18+
name: cloudflare-api-token-secret
19+
key: api-token
20+
{{- else }}
21+
http01:
22+
ingress:
23+
class: nginx
24+
{{- end }}
25+
26+
---
27+
28+
apiVersion: cert-manager.io/v1
29+
kind: ClusterIssuer
30+
metadata:
31+
name: letsencrypt-stage
32+
acme:
33+
privateKeySecretRef:
2334
name: letsencrypt-stage
24-
server: https://acme-staging-v02.api.letsencrypt.org/directory
25-
solvers:
26-
- http01:
27-
ingress:
28-
class: nginx
29-
---
30-
apiVersion: cert-manager.io/v1
31-
kind: ClusterIssuer
32-
metadata:
33-
name: selfsigned-cluster-issuer
34-
spec:
35-
selfSigned: {}
35+
server: https://acme-staging-v02.api.letsencrypt.org/directory
36+
solvers:
37+
- {{- if eq $issuerType "cloudflare" }}
38+
dns01:
39+
cloudflare:
40+
apiTokenSecretRef:
41+
name: cloudflare-api-token-secret
42+
key: api-token
43+
{{- else }}
44+
http01:
45+
ingress:
46+
class: nginx
47+
{{- end }}
48+
49+
---
50+
51+
apiVersion: cert-manager.io/v1
52+
kind: ClusterIssuer
53+
metadata:
54+
name: selfsigned-cluster-issuer
55+
spec:
56+
selfSigned: {}

‎packages/system/external-dns/.helmignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
images
2+
hack
3+
.gitkeep

‎packages/system/external-dns/Chart.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
apiVersion: v2
2+
name: cozy-external-dns
3+
version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process

0 commit comments

Comments
 (0)