Skip to content

Commit bc7da36

Browse files
malpoumalpou
committed
Merge branch 'master' into feat/txt-registry-new-format-only
2 parents 4ea284a + 30e912a commit bc7da36

35 files changed

+1726
-296
lines changed

‎.github/workflows/lint-test-chart.yaml

+4-4
Original file line numberDiff line numberDiff line change
@@ -65,18 +65,18 @@ jobs:
6565
python-version: "3.x"
6666

6767
- name: Set-up chart-testing
68-
uses: helm/chart-testing-action@e6669bcd63d7cb57cb4380c33043eebe5d111992 # v2.6.1
68+
uses: helm/chart-testing-action@0d28d3144d3a25ea2cc349d6e59901c4ff469b3b # v2.7.0
6969

7070
- name: Check for changes
7171
id: changes
7272
run: |
73-
changed=$(ct list-changed)
73+
changed=$(ct list-changed --target-branch=master)
7474
if [[ -n "$changed" ]]; then
7575
echo "changed=true" >> "${GITHUB_OUTPUT}"
7676
fi
7777
7878
- name: Run chart-testing lint
79-
run: ct lint --check-version-increment=false
79+
run: ct lint --target-branch=master --check-version-increment=false
8080

8181
- name: Create Kind cluster
8282
if: steps.changes.outputs.changed == 'true'
@@ -86,4 +86,4 @@ jobs:
8686

8787
- name: Run chart-testing install
8888
if: steps.changes.outputs.changed == 'true'
89-
run: ct install
89+
run: ct install --target-branch=master

‎.github/workflows/release-chart.yaml

+1-2
Original file line numberDiff line numberDiff line change
@@ -53,11 +53,10 @@ jobs:
5353
- name: Install Helm
5454
uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0
5555
with:
56-
token: ${{ secrets.GITHUB_TOKEN }}
5756
version: latest
5857

5958
- name: Run chart-releaser
60-
uses: helm/chart-releaser-action@a917fd15b20e8b64b94d9158ad54cd6345335584 # v1.6.0
59+
uses: helm/chart-releaser-action@cae68fefc6b5f367a0275617c9f83181ba54714f # v1.7.0
6160
env:
6261
CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
6362
CR_RELEASE_NAME_TEMPLATE: "external-dns-helm-chart-{{ .Version }}"

‎README.md

+2-1
Original file line numberDiff line numberDiff line change
@@ -80,11 +80,12 @@ Known providers using webhooks:
8080
| Adguard Home Provider | https://github.com/muhlba91/external-dns-provider-adguard |
8181
| Anexia | https://github.com/ProbstenHias/external-dns-anexia-webhook |
8282
| Bizfly Cloud | https://github.com/bizflycloud/external-dns-bizflycloud-webhook |
83+
| Dreamhost | https://github.com/asymingt/external-dns-dreamhost-webhook |
8384
| Efficient IP | https://github.com/EfficientIP-Labs/external-dns-efficientip-webhook |
8485
| Gcore | https://github.com/G-Core/external-dns-gcore-webhook |
8586
| GleSYS | https://github.com/glesys/external-dns-glesys |
8687
| Hetzner | https://github.com/mconfalonieri/external-dns-hetzner-webhook |
87-
| Huawei Cloud | https://github.com/setoru/external-dns-huaweicloud-webhook |
88+
| Huawei Cloud | https://github.com/setoru/external-dns-huaweicloud-webhook |
8889
| IONOS | https://github.com/ionos-cloud/external-dns-ionos-webhook |
8990
| Infoblox | https://github.com/AbsaOSS/external-dns-infoblox-webhook |
9091
| Mikrotik | https://github.com/mirceanton/external-dns-provider-mikrotik |

‎api/webhook.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ paths:
4444
- example.com
4545
'500':
4646
description: |
47-
Negociation failed.
47+
Negotiation failed.
4848
4949
/records:
5050
get:

‎charts/external-dns/CHANGELOG.md

+18-13
Original file line numberDiff line numberDiff line change
@@ -18,24 +18,28 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
1818

1919
## [UNRELEASED]
2020

21+
## [v1.15.1] - 2023-09-10
22+
2123
### Added
2224

23-
- Ability to configure `imagePullSecrets` via helm `global` value ([#4667](https://github.com/kubernetes-sigs/external-dns/pull/4667)) _@jkroepke_
24-
- Added options to configure `labelFilter` and `managedRecordTypes` via dedicated helm values ([#4849](https://github.com/kubernetes-sigs/external-dns/pull/4849)) _@abaguas_
25+
- Added ability to configure `imagePullSecrets` via helm `global` value. ([#4667](https://github.com/kubernetes-sigs/external-dns/pull/4667)) _@jkroepke_
26+
- Added options to configure `labelFilter` and `managedRecordTypes` via dedicated helm values. ([#4849](https://github.com/kubernetes-sigs/external-dns/pull/4849)) _@abaguas_
2527

26-
### Fixed
28+
### Changed
2729

28-
- Fixed automatic addition of pod selector labels to `affinity` and `topologySpreadConstraints` if not defined. _@pvickery-ParamountCommerce_
30+
- Allow templating `serviceaccount.annotations` keys and values, by rendering them using the `tpl` built-in function. ([#4958](https://github.com/kubernetes-sigs/external-dns/pull/4958)) _@fcrespofastly_
31+
- Updated _ExternalDNS_ OCI image version to [v0.15.1](https://github.com/kubernetes-sigs/external-dns/releases/tag/v0.15.1). ([#5028](https://github.com/kubernetes-sigs/external-dns/pull/5028)) _@stevehipwell_
2932

30-
### Changed
33+
### Fixed
3134

32-
- Allow templating `serviceaccount.annotations` keys and values, by rendering them using the `tpl` built-in function. [#4958](https://github.com/kubernetes-sigs/external-dns/pull/4958) _@fcrespofastly_
35+
- Fixed automatic addition of pod selector labels to `affinity` and `topologySpreadConstraints` if not defined. ([#4666](https://github.com/kubernetes-sigs/external-dns/pull/4666)) _@pvickery-ParamountCommerce_
36+
- Fixed missing Ingress permissions when using Istio sources. ([#4845](https://github.com/kubernetes-sigs/external-dns/pull/4845)) _@joekhoobyar_
3337

34-
## [v1.15.0] - 2023-09-10
38+
## [v1.15.0] - 2024-09-11
3539

3640
### Changed
3741

38-
- Updated _ExternalDNS_ OCI image version to [v0.15.0](https://github.com/kubernetes-sigs/external-dns/releases/tag/v0.15.0). ([#xxxx](https://github.com/kubernetes-sigs/external-dns/pull/xxxx)) _@stevehipwell_
42+
- Updated _ExternalDNS_ OCI image version to [v0.15.0](https://github.com/kubernetes-sigs/external-dns/releases/tag/v0.15.0). ([#4735](https://github.com/kubernetes-sigs/external-dns/pull/4735)) _@stevehipwell_
3943

4044
### Fixed
4145

@@ -44,7 +48,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
4448
- Fixed to add correct webhook metric port to `Service` and `ServiceMonitor`. ([#4643](https://github.com/kubernetes-sigs/external-dns/pull/4643)) _@kimsondrup_
4549
- Fixed to no longer require the unauthenticated webhook provider port to be exposed for health probes. ([#4691](https://github.com/kubernetes-sigs/external-dns/pull/4691)) _@kimsondrup_ & _@hatrx_
4650

47-
## [v1.14.5] - 2023-06-10
51+
## [v1.14.5] - 2024-06-10
4852

4953
### Added
5054

@@ -61,7 +65,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
6165

6266
- Fixed the `ServiceMonitor` job name to correctly use the instance label. ([#4541](https://github.com/kubernetes-sigs/external-dns/pull/4541)) _@stevehipwell_
6367

64-
## [v1.14.4] - 2023-04-03
68+
## [v1.14.4] - 2024-04-05
6569

6670
### Added
6771

@@ -72,7 +76,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
7276

7377
- Updated _ExternalDNS_ OCI image version to [v0.14.1](https://github.com/kubernetes-sigs/external-dns/releases/tag/v0.14.1). ([#4357](https://github.com/kubernetes-sigs/external-dns/pull/4357)) _@stevehipwell_
7478

75-
## [v1.14.3] - 2023-01-26
79+
## [v1.14.3] - 2024-01-26
7680

7781
### Fixed
7882

@@ -86,7 +90,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
8690

8791
- Restore template support in `.Values.provider` and `.Values.provider.name`
8892

89-
## [v1.14.1] - 2024-01-11
93+
## [v1.14.1] - 2024-01-12
9094

9195
### Fixed
9296

@@ -110,7 +114,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
110114

111115
- The `secretConfiguration` value has been deprecated in favour of creating secrets external to the Helm chart and configuring their use via the `extraVolumes` & `extraVolumeMounts` values. ([#4161](https://github.com/kubernetes-sigs/external-dns/pull/4161)) [@stevehipwell](https://github.com/stevehipwell)
112116

113-
## [v1.13.1] - 2023-09-07
117+
## [v1.13.1] - 2023-09-08
114118

115119
### Added
116120

@@ -213,6 +217,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
213217
RELEASE LINKS
214218
-->
215219
[UNRELEASED]: https://github.com/kubernetes-sigs/external-dns/tree/master/charts/external-dns
220+
[v1.15.1]: https://github.com/kubernetes-sigs/external-dns/releases/tag/external-dns-helm-chart-1.15.1
216221
[v1.15.0]: https://github.com/kubernetes-sigs/external-dns/releases/tag/external-dns-helm-chart-1.15.0
217222
[v1.14.5]: https://github.com/kubernetes-sigs/external-dns/releases/tag/external-dns-helm-chart-1.14.5
218223
[v1.14.4]: https://github.com/kubernetes-sigs/external-dns/releases/tag/external-dns-helm-chart-1.14.4

‎charts/external-dns/Chart.yaml

+11-9
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,8 @@ apiVersion: v2
22
name: external-dns
33
description: ExternalDNS synchronizes exposed Kubernetes Services and Ingresses with DNS providers.
44
type: application
5-
version: 1.15.0
6-
appVersion: 0.15.0
5+
version: 1.15.1
6+
appVersion: 0.15.1
77
keywords:
88
- kubernetes
99
- externaldns
@@ -20,13 +20,15 @@ maintainers:
2020
email: [email protected]
2121
annotations:
2222
artifacthub.io/changes: |
23+
- kind: added
24+
description: "Added ability to configure `imagePullSecrets` via helm `global` value."
25+
- kind: added
26+
description: "Added options to configure `labelFilter` and `managedRecordTypes` via dedicated helm values."
2327
- kind: changed
24-
description: "Updated _ExternalDNS_ OCI image version to [v0.15.0](https://github.com/kubernetes-sigs/external-dns/releases/tag/v0.15.0)."
25-
- kind: fixed
26-
description: "Fixed `provider.webhook.resources` behavior to correctly leverage resource limits."
27-
- kind: fixed
28-
description: "Fixed `provider.webhook.imagePullPolicy` behavior to correctly leverage pull policy."
28+
description: "Allow templating `serviceaccount.annotations` keys and values, by rendering them using the `tpl` built-in function."
29+
- kind: changed
30+
description: "Updated _ExternalDNS_ OCI image version to [v0.15.1](https://github.com/kubernetes-sigs/external-dns/releases/tag/v0.15.1)."
2931
- kind: fixed
30-
description: "Fixed to add correct webhook metric port to `Service` and `ServiceMonitor`."
32+
description: "Fixed automatic addition of pod selector labels to `affinity` and `topologySpreadConstraints` if not defined."
3133
- kind: fixed
32-
description: "Fixed to no longer require the unauthenticated webhook provider port to be exposed for health probes."
34+
description: "Fixed missing Ingress permissions when using Istio sources."

‎charts/external-dns/README.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# external-dns
22

3-
![Version: 1.15.0](https://img.shields.io/badge/Version-1.15.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.15.0](https://img.shields.io/badge/AppVersion-0.15.0-informational?style=flat-square)
3+
![Version: 1.15.1](https://img.shields.io/badge/Version-1.15.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.15.1](https://img.shields.io/badge/AppVersion-0.15.1-informational?style=flat-square)
44

55
ExternalDNS synchronizes exposed Kubernetes Services and Ingresses with DNS providers.
66

@@ -27,7 +27,7 @@ helm repo add external-dns https://kubernetes-sigs.github.io/external-dns/
2727
After you've installed the repo you can install the chart.
2828

2929
```shell
30-
helm upgrade --install external-dns external-dns/external-dns --version 1.15.0
30+
helm upgrade --install external-dns external-dns/external-dns --version 1.15.1
3131
```
3232

3333
## Providers

‎charts/external-dns/templates/clusterrole.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ rules:
2121
resources: ["services","endpoints"]
2222
verbs: ["get","watch","list"]
2323
{{- end }}
24-
{{- if or (has "ingress" .Values.sources) (has "contour-httpproxy" .Values.sources) (has "openshift-route" .Values.sources) (has "skipper-routegroup" .Values.sources) }}
24+
{{- if or (has "ingress" .Values.sources) (has "istio-gateway" .Values.sources) (has "istio-virtualservice" .Values.sources) (has "contour-httpproxy" .Values.sources) (has "openshift-route" .Values.sources) (has "skipper-routegroup" .Values.sources) }}
2525
- apiGroups: ["extensions","networking.k8s.io"]
2626
resources: ["ingresses"]
2727
verbs: ["get","watch","list"]

‎docs/flags.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
| `--cf-password=""` | The password to log into the cloud foundry API |
1616
| `--gloo-namespace=gloo-system` | The Gloo Proxy namespace; specify multiple times for multiple namespaces. (default: gloo-system) |
1717
| `--skipper-routegroup-groupversion="zalando.org/v1"` | The resource version for skipper routegroup |
18-
| `--source=source` | The resource types that are queried for endpoints; specify multiple times for multiple sources (required, options: service, ingress, node, pod, fake, connector, gateway-httproute, gateway-grpcroute, gateway-tlsroute, gateway-tcproute, gateway-udproute, istio-gateway, istio-virtualservice, cloudfoundry, contour-httpproxy, gloo-proxy, crd, empty, skipper-routegroup, openshift-route, ambassador-host, kong-tcpingress, f5-virtualserver, traefik-proxy) |
18+
| `--source=source` | The resource types that are queried for endpoints; specify multiple times for multiple sources (required, options: service, ingress, node, pod, fake, connector, gateway-httproute, gateway-grpcroute, gateway-tlsroute, gateway-tcproute, gateway-udproute, istio-gateway, istio-virtualservice, cloudfoundry, contour-httpproxy, gloo-proxy, crd, empty, skipper-routegroup, openshift-route, ambassador-host, kong-tcpingress, f5-virtualserver, f5-transportserver, traefik-proxy) |
1919
| `--openshift-router-name=OPENSHIFT-ROUTER-NAME` | if source is openshift-route then you can pass the ingress controller name. Based on this name external-dns will select the respective router from the route status and map that routerCanonicalHostname to the route host while creating a CNAME record. |
2020
| `--namespace=""` | Limit resources queried for endpoints to a specific namespace (default: all namespaces) |
2121
| `--annotation-filter=""` | Filter resources queried for endpoints by annotation, using label selector semantics |

‎docs/registry/txt.md

+29-11
Original file line numberDiff line numberDiff line change
@@ -55,11 +55,11 @@ wildcard domains will have invalid domain syntax and be rejected by most provide
5555

5656
## Encryption
5757

58-
Registry TXT records may contain information, such as the internal ingress name or namespace, considered sensitive, , which attackers could exploit to gather information about your infrastructure.
58+
Registry TXT records may contain information, such as the internal ingress name or namespace, considered sensitive, , which attackers could exploit to gather information about your infrastructure.
5959
By encrypting TXT records, you can protect this information from unauthorized access.
6060

61-
Encryption is enabled by using the `--txt-encrypt-enabled` flag. The 32-byte AES-256-GCM encryption
62-
key must be specified in URL-safe base64 form, using the `--txt-encrypt-aes-key` flag.
61+
Encryption is enabled by setting the `--txt-encrypt-enabled`. The 32-byte AES-256-GCM encryption
62+
key must be specified in URL-safe base64 form (recommended) or be a plain text, using the `--txt-encrypt-aes-key=<key>` flag.
6363

6464
Note that the key used for encryption should be a secure key and properly managed to ensure the security of your TXT records.
6565

@@ -107,14 +107,32 @@ import (
107107
)
108108

109109
func main() {
110-
key := []byte("testtesttesttesttesttesttesttest")
111-
encrypted, _ := endpoint.EncryptText(
112-
"heritage=external-dns,external-dns/owner=example,external-dns/resource=ingress/default/example",
113-
key,
114-
nil,
115-
)
116-
decrypted, _, _ := endpoint.DecryptText(encrypted, key)
117-
fmt.Println(decrypted)
110+
keys := []string{
111+
"ZPitL0NGVQBZbTD6DwXJzD8RiStSazzYXQsdUowLURY=", // safe base64 url encoded 44 bytes and 32 when decoded
112+
"01234567890123456789012345678901", // plain txt 32 bytes
113+
"passphrasewhichneedstobe32bytes!", // plain txt 32 bytes
114+
}
115+
116+
for _, k := range keys {
117+
key := []byte(k)
118+
if len(key) != 32 {
119+
// if key is not a plain txt let's decode
120+
var err error
121+
if key, err = b64.StdEncoding.DecodeString(string(key)); err != nil || len(key) != 32 {
122+
fmt.Errorf("the AES Encryption key must have a length of 32 byte")
123+
}
124+
}
125+
encrypted, _ := endpoint.EncryptText(
126+
"heritage=external-dns,external-dns/owner=example,external-dns/resource=ingress/default/example",
127+
key,
128+
nil,
129+
)
130+
decrypted, _, err := endpoint.DecryptText(encrypted, key)
131+
if err != nil {
132+
fmt.Println("Error decrypting:", err, "for key:", k)
133+
}
134+
fmt.Println(decrypted)
135+
}
118136
}
119137
```
120138

‎docs/sources/f5-transportserver.md

+106
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
# F5 Networks TransportServer Source
2+
3+
This tutorial describes how to configure ExternalDNS to use the F5 Networks TransportServer Source. It is meant to supplement the other provider-specific setup tutorials.
4+
5+
The F5 Networks TransportServer CRD is part of [this](https://github.com/F5Networks/k8s-bigip-ctlr) project. See more in-depth info regarding the TransportServer CRD [here](https://github.com/F5Networks/k8s-bigip-ctlr/tree/master/docs/cis-20.x/config_examples/customResource/TransportServer).
6+
7+
## Start with ExternalDNS with the F5 Networks TransportServer source
8+
9+
1. Make sure that you have the `k8s-bigip-ctlr` installed in your cluster. The needed CRDs are bundled within the controller.
10+
11+
2. In your Helm `values.yaml` add:
12+
```
13+
sources:
14+
- ...
15+
- f5-transportserver
16+
- ...
17+
```
18+
or add it in your `Deployment` if you aren't installing `external-dns` via Helm:
19+
```
20+
args:
21+
- --source=f5-transportserver
22+
```
23+
24+
Note that, in case you're not installing via Helm, you'll need the following in the `ClusterRole` bound to the service account of `external-dns`:
25+
```
26+
- apiGroups:
27+
- cis.f5.com
28+
resources:
29+
- transportservers
30+
verbs:
31+
- get
32+
- list
33+
- watch
34+
```
35+
36+
### Example TransportServer CR w/ host in spec
37+
38+
```
39+
apiVersion: cis.f5.com/v1
40+
kind: TransportServer
41+
metadata:
42+
labels:
43+
f5cr: 'true'
44+
name: test-ts
45+
namespace: test-ns
46+
spec:
47+
bigipRouteDomain: 0
48+
host: test.example.com
49+
ipamLabel: vips
50+
mode: standard
51+
pool:
52+
service: test-service
53+
servicePort: 4222
54+
virtualServerPort: 4222
55+
```
56+
57+
### Example TransportServer CR w/ target annotation set
58+
59+
If the `external-dns.alpha.kubernetes.io/target` annotation is set, the record created will reflect that and everything else will be ignored.
60+
61+
```
62+
apiVersion: cis.f5.com/v1
63+
kind: TransportServer
64+
metadata:
65+
annotations:
66+
external-dns.alpha.kubernetes.io/target: 10.172.1.12
67+
labels:
68+
f5cr: 'true'
69+
name: test-ts
70+
namespace: test-ns
71+
spec:
72+
bigipRouteDomain: 0
73+
host: test.example.com
74+
ipamLabel: vips
75+
mode: standard
76+
pool:
77+
service: test-service
78+
servicePort: 4222
79+
virtualServerPort: 4222
80+
```
81+
82+
### Example TransportServer CR w/ VirtualServerAddress set
83+
84+
If `virtualServerAddress` is set, the record created will reflect that. `external-dns.alpha.kubernetes.io/target` will take precedence though.
85+
86+
```
87+
apiVersion: cis.f5.com/v1
88+
kind: TransportServer
89+
metadata:
90+
labels:
91+
f5cr: 'true'
92+
name: test-ts
93+
namespace: test-ns
94+
spec:
95+
bigipRouteDomain: 0
96+
host: test.example.com
97+
ipamLabel: vips
98+
mode: standard
99+
pool:
100+
service: test-service
101+
servicePort: 4222
102+
virtualServerPort: 4222
103+
virtualServerAddress: 10.172.1.123
104+
```
105+
106+
If there is no target annotation or `virtualServerAddress` field set, then it'll use the `VSAddress` field from the created TransportServer status to create the record.

0 commit comments

Comments
 (0)