From 8154dfdf2c2c25da17656fffe6f39f2e1934da41 Mon Sep 17 00:00:00 2001
From: Edward Viaene <ward.viaene@gmail.com>
Date: Wed, 8 Aug 2018 14:39:48 +0000
Subject: [PATCH] external dns

---
 external-dns/README.md          | 24 +++++++++++++
 external-dns/external-dns.yaml  | 61 +++++++++++++++++++++++++++++++++
 external-dns/ingress.yaml       | 21 ++++++++++++
 external-dns/put-node-policy.sh | 38 ++++++++++++++++++++
 external-dns/service-l4.yaml    | 33 ++++++++++++++++++
 5 files changed, 177 insertions(+)
 create mode 100644 external-dns/README.md
 create mode 100644 external-dns/external-dns.yaml
 create mode 100644 external-dns/ingress.yaml
 create mode 100755 external-dns/put-node-policy.sh
 create mode 100644 external-dns/service-l4.yaml

diff --git a/external-dns/README.md b/external-dns/README.md
new file mode 100644
index 0000000..144abb3
--- /dev/null
+++ b/external-dns/README.md
@@ -0,0 +1,24 @@
+# External DNS
+
+Project page: https://github.com/kubernetes-incubator/external-dns
+
+## Create IAM Policy
+```
+./put-node-policy.sh
+```
+
+## start ingress
+```
+kubectl apply -f ../ingress/
+```
+
+## Create LoadBalancer for Ingress
+```
+kubectl apply -f service-l4.yaml
+```
+
+## Create external DNS and ingress rules
+```
+kubectl apply -f external-dns.yaml
+kubectl apply -f ingress.yaml
+```
diff --git a/external-dns/external-dns.yaml b/external-dns/external-dns.yaml
new file mode 100644
index 0000000..6601bed
--- /dev/null
+++ b/external-dns/external-dns.yaml
@@ -0,0 +1,61 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: external-dns
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRole
+metadata:
+  name: external-dns
+rules:
+- apiGroups: [""]
+  resources: ["services"]
+  verbs: ["get","watch","list"]
+- apiGroups: [""]
+  resources: ["pods"]
+  verbs: ["get","watch","list"]
+- apiGroups: ["extensions"] 
+  resources: ["ingresses"] 
+  verbs: ["get","watch","list"]
+- apiGroups: [""]
+  resources: ["nodes"]
+  verbs: ["list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRoleBinding
+metadata:
+  name: external-dns-viewer
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: external-dns
+subjects:
+- kind: ServiceAccount
+  name: external-dns
+  namespace: default
+---
+apiVersion: extensions/v1beta1
+kind: Deployment
+metadata:
+  name: external-dns
+spec:
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app: external-dns
+    spec:
+      serviceAccountName: external-dns
+      containers:
+      - name: external-dns
+        image: registry.opensource.zalan.do/teapot/external-dns:latest
+        args:
+        - --source=service
+        - --source=ingress
+        - --domain-filter=kubernetes.newtech.academy # will make ExternalDNS see only the hosted zones matching provided domain, omit to process all available hosted zones
+        - --provider=aws
+        - --policy=upsert-only # would prevent ExternalDNS from deleting any records, omit to enable full synchronization
+        - --aws-zone-type=public # only look at public hosted zones (valid values are public, private or no value for both)
+        - --registry=txt
+        - --txt-owner-id=kubernetes.newtech.academy
diff --git a/external-dns/ingress.yaml b/external-dns/ingress.yaml
new file mode 100644
index 0000000..85edf0a
--- /dev/null
+++ b/external-dns/ingress.yaml
@@ -0,0 +1,21 @@
+# An Ingress with 2 hosts and 3 endpoints
+apiVersion: extensions/v1beta1
+kind: Ingress
+metadata:
+  name: helloworld-rules
+spec:
+  rules:
+  - host: helloworld-v1.kubernetes.newtech.academy
+    http:
+      paths:
+      - path: /
+        backend:
+          serviceName: helloworld-v1
+          servicePort: 80
+  - host: helloworld-v2.kubernetes.newtech.academy
+    http:
+      paths:
+      - path: /
+        backend:
+          serviceName: helloworld-v2
+          servicePort: 80
diff --git a/external-dns/put-node-policy.sh b/external-dns/put-node-policy.sh
new file mode 100755
index 0000000..e6351a9
--- /dev/null
+++ b/external-dns/put-node-policy.sh
@@ -0,0 +1,38 @@
+#!/bin/bash
+
+#
+# This script adds permissions to the nodes IAM role, enabling any pod to use these AWS privileges
+# Usage of kube2iam is recommended, but not yet implemented by default in kops
+#
+
+DEFAULT_REGION="eu-west-1"
+AWS_REGION="${AWS_REGION:-${DEFAULT_REGION}}"
+
+NODE_ROLE="nodes.kubernetes.newtech.academy"
+
+export AWS_REGION
+
+aws iam put-role-policy --role-name ${NODE_ROLE} --policy-name external-dns-policy --policy-document '{
+ "Version": "2012-10-17",
+ "Statement": [
+   {
+     "Effect": "Allow",
+     "Action": [
+       "route53:ChangeResourceRecordSets"
+     ],
+     "Resource": [
+       "arn:aws:route53:::hostedzone/*"
+     ]
+   },
+   {
+     "Effect": "Allow",
+     "Action": [
+       "route53:ListHostedZones",
+       "route53:ListResourceRecordSets"
+     ],
+     "Resource": [
+       "*"
+     ]
+   }
+ ]
+}'
diff --git a/external-dns/service-l4.yaml b/external-dns/service-l4.yaml
new file mode 100644
index 0000000..18a3d9d
--- /dev/null
+++ b/external-dns/service-l4.yaml
@@ -0,0 +1,33 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: ingress-nginx
+  labels:
+    app: ingress-nginx
+  annotations:
+    # Enable PROXY protocol
+    service.beta.kubernetes.io/aws-load-balancer-proxy-protocol: '*'
+    # Increase the ELB idle timeout to avoid issues with WebSockets or Server-Sent Events.
+    service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: '3600'
+    # external-dns
+    external-dns.alpha.kubernetes.io/hostname: ingress.kubernetes.newtech.academy
+spec:
+  type: LoadBalancer
+  selector:
+    app: ingress-nginx
+  ports:
+  - name: http
+    port: 80
+    targetPort: http
+  - name: https
+    port: 443
+    targetPort: https
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: nginx-configuration
+  labels:
+    app: ingress-nginx
+data:
+  use-proxy-protocol: "true"