Initial commit

template/config/kubernetes/apps/network/cloudflare-dns/app/helmrelease.yaml.j2

@@ -0,0 +1,37 @@
+#% if dns.provider == 'cloudflare' and ingress.mode != 'none' %#
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &app cloudflare-dns
+spec:
+  chartRef:
+    kind: OCIRepository
+    name: cloudflare-dns
+  interval: 1h
+  values:
+    fullnameOverride: *app
+    provider: cloudflare
+    env:
+      - name: CF_API_TOKEN
+        valueFrom:
+          secretKeyRef:
+            name: &secret cloudflare-dns-secret
+            key: api-token
+    extraArgs:
+      - --cloudflare-dns-records-per-page=1000
+      - --cloudflare-proxied
+      - --crd-source-apiversion=externaldns.k8s.io/v1alpha1
+      - --crd-source-kind=DNSEndpoint
+      - --gateway-name=envoy-external
+    triggerLoopOnEvent: true
+    policy: sync
+    sources: ["crd", "gateway-httproute"]
+    txtPrefix: k8s.
+    txtOwnerId: default
+    domainFilters: ["${SECRET_DOMAIN}"]
+    serviceMonitor:
+      enabled: true
+    podAnnotations:
+      secret.reloader.stakater.com/reload: *secret
+#% endif %#

template/config/kubernetes/apps/network/cloudflare-dns/app/kustomization.yaml.j2

@@ -0,0 +1,9 @@
+#% if dns.provider == 'cloudflare' and ingress.mode != 'none' %#
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./secret.sops.yaml
+  - ./helmrelease.yaml
+  - ./ocirepository.yaml
+#% endif %#

template/config/kubernetes/apps/network/cloudflare-dns/app/ocirepository.yaml.j2

@@ -0,0 +1,15 @@
+#% if dns.provider == 'cloudflare' and ingress.mode != 'none' %#
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: cloudflare-dns
+spec:
+  interval: 15m
+  layerSelector:
+    mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
+    operation: copy
+  ref:
+    tag: 1.22.0
+  url: oci://ghcr.io/home-operations/charts-mirror/external-dns
+#% endif %#

template/config/kubernetes/apps/network/cloudflare-dns/app/secret.sops.yaml.j2

@@ -0,0 +1,9 @@
+#% if dns.provider == 'cloudflare' and ingress.mode != 'none' %#
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: cloudflare-dns-secret
+stringData:
+  api-token: "#{ dns.token }#"
+#% endif %#

template/config/kubernetes/apps/network/cloudflare-dns/ks.yaml.j2

@@ -0,0 +1,21 @@
+#% if dns.provider == 'cloudflare' and ingress.mode != 'none' %#
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cloudflare-dns
+spec:
+  interval: 1h
+  path: ./kubernetes/apps/network/cloudflare-dns/app
+  postBuild:
+    substituteFrom:
+      - name: cluster-secrets
+        kind: Secret
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+    namespace: flux-system
+  targetNamespace: network
+  wait: true
+#% endif %#