apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: external-dns namespace: external-dns rules: - apiGroups: - "" resources: - services - endpoints - pods - nodes verbs: - get - watch - list - apiGroups: - extensions - networking.k8s.io resources: - ingresses verbs: - get - list - watch - apiGroups: - externaldns.k8s.io resources: - dnsendpoints verbs: - get - watch - list - apiGroups: - externaldns.k8s.io resources: - dnsendpoints/status verbs: - update --- apiVersion: v1 kind: ServiceAccount metadata: name: external-dns namespace: external-dns --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: external-dns-viewer namespace: external-dns roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: external-dns subjects: - kind: ServiceAccount name: external-dns namespace: external-dns --- apiVersion: apps/v1 kind: Deployment metadata: name: external-dns namespace: external-dns spec: revisionHistoryLimit: 0 selector: matchLabels: app: external-dns template: metadata: labels: app: external-dns spec: serviceAccountName: external-dns containers: - name: external-dns image: k8s.gcr.io/external-dns/external-dns:v0.13.1 envFrom: - secretRef: name: tsig-secret args: - --registry=txt - --txt-prefix=external-dns- - --txt-owner-id=k8s - --provider=rfc2136 - --source=ingress - --source=service - --domain-filter=k-space.ee - --rfc2136-host=193.40.103.2 - --rfc2136-port=53 - --rfc2136-zone=k-space.ee - --rfc2136-tsig-keyname=acme - --rfc2136-tsig-secret-alg=hmac-sha512 - --rfc2136-tsig-secret=$(TSIG_SECRET) # https://github.com/kubernetes-sigs/external-dns/issues/2446