provide example using external-dns helm chart

[not22day]

Is your feature request related to a problem? Please describe.

at the moment the example is based on plain manifest

Describe the solution you'd like

for me the official external-dns helm chart looks flexible enough
to inject the stackit webhook via values
https://github.com/kubernetes-sigs/external-dns/blob/master/charts/external-dns/templates/deployment.yaml

Describe alternatives you've considered

Search

• I did search for other open and closed issues before opening this.

Code of Conduct

• I agree to follow this project's Code of Conduct

Additional context

No response

[not22day]

some promising start..

provider:
    name: webhook
    webhook:
      image:
        repository: ghcr.io/stackitcloud/external-dns-stackit-webhook
        tag: v0.3.1
      args:
      - --project-id=xxx
      env:
      - name: AUTH_TOKEN
        valueFrom:
          secretKeyRef:
            name: external-dns-stackit-webhook
            key: auth-token

[fjvela]

Hello @not22day !

Check the code:

  logLevel: info
  logFormat: text
  interval: 1m
  sources:
    - service
    - ingress
  policy: sync

  provider:
    name: webhook
    webhook:
      image:
        # -- (string) Image repository for the `webhook` container.
        repository: ghcr.io/stackitcloud/external-dns-stackit-webhook
        # -- (string) Image tag for the `webhook` container.
        tag: v0.3.2
        # -- Image pull policy for the `webhook` container.
        pullPolicy: IfNotPresent
      # -- [Environment variables](https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) for the `webhook` container.
      env:
        - name: AUTH_TOKEN
          valueFrom:
            secretKeyRef:
              name: external-dns-stackit-webhook
              key: auth-token
        - name: PROJECT_ID
          valueFrom:
            secretKeyRef:
              name: external-dns-stackit-webhook
              key: project-id
      # -- Extra arguments to provide for the `webhook` container.
      # args: ["--log-level=debug", --api-port=8080, "--project-id=$PROJECT_ID"]
      # -- Extra [volume mounts](https://kubernetes.io/docs/concepts/storage/volumes/) for the `webhook` container.
      extraVolumeMounts: []
      # -- [Resources](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) for the `webhook` container.
      resources: {}
      # -- [Pod security context](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) for the `webhook` container.
      # @default -- See _values.yaml_
      securityContext:
        capabilities:
          drop:
            - ALL
        readOnlyRootFilesystem: true
        runAsNonRoot: true
        runAsUser: 65534
      # -- [Liveness probe](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/) configuration for the `external-dns` container.
      # @default -- See _values.yaml_
      livenessProbe:
        failureThreshold: 2
        httpGet:
          path: /healthz
          port: 8888
        initialDelaySeconds: 10
        periodSeconds: 10
        successThreshold: 1
        timeoutSeconds: 5
      # -- [Readiness probe](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/) configuration for the `webhook` container.
      # @default -- See _values.yaml_
      readinessProbe:
        failureThreshold: 6
        httpGet:
          path: /healthz
          port: 8888
        initialDelaySeconds: 5
        periodSeconds: 10
        successThreshold: 1

[grieshaber]

Hi all, hi @PatrickKoss,

we're currently spinning up a new environment in Stack-IT. We try to install external-dns via helm-chart. We cannot use the managed dns solutions, as we want to create DNS records based on the new Gateway API.

So, while we're able to add the webhook container to the deployment via the chart and load the service account correctly, the container crashes once the livenessProbe triggers. This is because in the helm chart, since it introduced the option to add webhooks sidecars, hardcodes the containerPort to 8080, which is used for liveness and readiness probes.

I see, other provider follow that pattern and configure their containers to listen on two ports - 8888 for API requests and 8080 for metrics (healthz endpoint).

As far as I can see, this is the only thing missing to be able to install STACKIT webhook with the external-dns helm chart.

Could you have a look? Maybe it's a quick-win.

Thanks

[airbjorn]

I opened an issue to solve the hardcoded port in the helm deployment and hope they will admit the included patch for the upcoming 1.19.0 helm chart: kubernetes-sigs/external-dns#5801

As long as this is unsolved, we'll continue to use the bitnami helm chart with the image pulled from the bitnamilegacy repository.

[PatrickKoss]

Hey I am not sure if I get the problem :)

Can you try out the following?

helmCharts:

• name: external-dns
  version: v1.19.0
  repo: https://kubernetes-sigs.github.io/external-dns
  namespace: external-dns
  releaseName: external-dns
  valuesInline:
  env:
  - name: PROJECT_ID
  valueFrom:
  configMapKeyRef:
  name: external-dns
  key: PROJECT_ID
  - name: DOMAIN_FILTER
  valueFrom:
  configMapKeyRef:
  name: external-dns
  key: DOMAIN_FILTER
  - name: EXTERNAL_DNS_TXT_OWNER_ID
  valueFrom:
  configMapKeyRef:
  name: external-dns
  key: EXTERNAL_DNS_TXT_OWNER_ID
  resources:
  requests:
  memory: "50Mi"
  cpu: "5m"
  limits:
  memory: "300Mi"
  cpu: "500m"
  serviceMonitor:
  enabled: true
  policy: sync
  extraArgs:
  webhook-provider-url: http://localhost:8080
  extraVolumes:
  - name: stackit-sa-authentication
  secret:
  secretName: stackit-sa-authentication
  provider:
  name: webhook
  webhook:
  image:
  repository: ghcr.io/stackitcloud/external-dns-stackit-webhook
  tag: v0.3.4
  env:
  - name: PROJECT_ID
  valueFrom:
  configMapKeyRef:
  name: external-dns
  key: PROJECT_ID
  - name: API_PORT
  value: "8080"
  - name: DOMAIN_FILTER
  valueFrom:
  configMapKeyRef:
  name: external-dns
  key: DOMAIN_FILTER
  - name: EXTERNAL_DNS_TXT_OWNER_ID
  valueFrom:
  configMapKeyRef:
  name: external-dns
  key: EXTERNAL_DNS_TXT_OWNER_ID
  - name: AUTH_KEY_PATH
  value: /var/run/secrets/stackit/sa.json
  extraVolumeMounts:
  - name: stackit-sa-authentication
  mountPath: /var/run/secrets/stackit
  readOnly: true
  resources:
  requests:
  cpu: 100m
  memory: 128Mi
  limits:
  cpu: 200m
  memory: 256Mi

[grieshaber]

Hey @PatrickKoss,

i will give it a try. I tried changing the API Port by editing the deployment in the cluster (just for quick testing purposes) and then the webhook container did not start at all (without any logs available).

Right now, I've build myself a workaround with a kustomize patch, as we're using Flux + kustomize nonetheless.
I'll let you know, whether setting the API_PORT env variable changes the behavior I observed the last time.

[DCKcode]

If anyone else runs into this, setting:

spec:
  values:
    extraArgs:
      webhook-provider-url: http://localhost:8080
    provider:
      # Other external-dns-stackit-webhook config omitted
      env:
      - name: API_PORT
        value: "8080"

allowed the StackIT ExternalDNS webhook to come up alongside the ExternalDNS Helm chart.