Helm chart updated for ExternalDNS, rfc2136 provider, in order to support GSS-TSIG authentication configuration. #1064

v-esteves · 2023-02-13T14:17:27Z

Changed helm template for external-dns as well as the values.yaml and values.schema.json to support several authentication types in the provider RFC2136.

The previous version only supported RFC2136 configuration for TSIG, which doesn't work with Windows DNS.

Fixes #1061
Fixes #929

ytsarev

hi @v-esteves , thanks a lot for this contribution!

Could you please extend documentation briefly describing this functionality?

Please follow the steps described in https://github.com/k8gb-io/k8gb/blob/master/CONTRIBUTING.md#documentation

Was this change tested end-to-end? If yes, please describe how in the commit message

Please also comply with DCO by signing your commits with git commit -s

Thanks a ton!

jkremser · 2023-02-17T10:42:09Z

chart/k8gb/templates/external-dns/external-dns.yaml

+            name: kerberos-config-volume
+            subPath: krb5.conf
+        {{- end }}
+      {{- if .Values.rfc2136.rfc2136auth.gssTsig.enabled }}


can't this be simplified to one block? The condition is the same as the previous one, is there an issue with indentation?

Agree. I was leaving room for future updates, that are not only related with the required configuration for GSS-TSIG, but for the moment we can simplify and set everything in one block.
I'll do that right away.

jkremser

these changes are also part of your other pr #1065 right?

Please name the pull request better. 1061 fix is very cryptic :D

…ation for ExternalDNS Signed-off-by: vestevesaws@gmail.com <x191116@MacBook-Pro-de-Vitor.local>

… for kerberos configuration file from config-map Signed-off-by: vestevesaws@gmail.com <x191116@MacBook-Pro-de-Vitor.local>

…he ConfigMap with a krb5.conf configuration for Kerberos authentication (GSS-TSIG). Also updated the values.schema.json and values.yaml for this new input. README.md was updated with the correct description of the values.yaml structure with the new inputs for the rfc2136 provider configuration Signed-off-by: vestevesaws@gmail.com <x191116@MBP-de-Vitor.home> Signed-off-by: vestevesaws@gmail.com <x191116@MacBook-Pro-de-Vitor.local>

Changed to allow the configuration of the provider RFC2136 with GSS-TSIG Fixes k8gb-io#1061 Signed-off-by: vestevesaws@gmail.com <x191116@MacBook-Pro-de-Vitor.local>

netlify · 2023-03-27T13:50:41Z

✅ Deploy Preview for k8gb-preview ready!

Name	Link
🔨 Latest commit	`ff6939e`
🔍 Latest deploy log	https://app.netlify.com/sites/k8gb-preview/deploys/657b05ad02568400084ed41d
😎 Deploy Preview	https://deploy-preview-1064--k8gb-preview.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

github-advanced-security · 2023-03-31T22:11:44Z

You have successfully added a new terrascan configuration .github/workflows/terrascan.yaml:terrascan. As part of the setup process, we have scanned this repository and found no existing alerts. In the future, you will see all code scanning alerts on the repository Security tab.

ytsarev

left minor doc comments, thanks a lot for the contribution

docs/provider_rfc2136.md

ytsarev · 2023-03-31T23:39:09Z

docs/provider_rfc2136.md

+| rfc2136.rfc2136auth.gssTsig.kerberosConfigMap | string | `"kerberos-configmap"` | When using GSS-TSIG, a ConfigMap with a valid krb5.conf configuration should be provided |
+| rfc2136.rfc2136auth.gssTsig.gssTsigCreds[0].kerberos-username | string | `"ad-user-account"` | AD user account with permissions for DNS updates |
+| rfc2136.rfc2136auth.gssTsig.gssTsigCreds[1].kerberos-password | string | `"ad-user-account-password"` | Passowrd of the AD user account |
+| rfc2136.rfc2136auth.gssTsig.gssTsigCreds[2].kerberos-realm | string | `"REALM.DOMAIN"` | Kerberos REALM that should be used for authentication |


Looks like helm values are duplicated with the main README https://github.com/k8gb-io/k8gb/pull/1064/files#diff-a9751a1d587556fed5161a73d263258bfeb7b5c4632430d9ec0d853529539aa9R98. ? Should we avoid duplication to keep it at the same place?

I've removed those duplicated values and added a reference to the readme with the Helm values description. This way there isn't duplicated text and updates are only in one place.

…ed duplicaded Helm Values from RFC2136 provider tutorial. Signed-off-by: vestevesaws@gmail.com <x191116@MacBook-Pro-de-Vitor.local>

ytsarev · 2023-08-10T07:06:24Z

@v-esteves thanks a lot for the consolidation, it really helps! Can you please resolve the conflict in README.md?

…lues. Signed-off-by: vestevesaws@gmail.com <x191116@MBP-de-Vitor.lan>

Signed-off-by: Vitor Esteves <64093608+v-esteves@users.noreply.github.com>

ytsarev

@v-esteves last bit before the merge I believe :)

docs/deploy_windowsdns.md

ytsarev · 2023-08-10T11:30:13Z

Please also check the golic output https://github.com/k8gb-io/k8gb/actions/runs/5819518828/job/15780744306?pr=1064#step:5:84

Signed-off-by: Yury Tsarev <yury@upbound.io>

Signed-off-by: vestevesaws@gmail.com <x191116@MBP-de-Vitor.home>

Signed-off-by: Vitor Esteves <64093608+v-esteves@users.noreply.github.com>

v-esteves · 2023-09-10T13:01:09Z

@ytsarev I've added the link in main Readme.md has requested.

ytsarev

unfortunately all terratest pipelines are still failing :( we need to investigate

v-esteves · 2023-10-04T09:00:38Z

@ytsarev can I help with something regarding those falling tests? Let me know what can I do from our end.

ytsarev · 2023-10-06T18:30:21Z

@v-esteves it looks like terratest is failing for the reason, we need to debug the test pipeline. If you can try to validate the local terratest run it will be great.

Signed-off-by: Vitor Esteves <64093608+v-esteves@users.noreply.github.com>

ytsarev · 2023-12-14T18:22:54Z

https://github.com/k8gb-io/k8gb/actions/runs/7209689707?pr=1064 I believe it is actual valid test failure we are facing here.

panic: test timed out after 15m0s

goroutine 2511 [running]:
testing.(*M).startAlarm.func1()
/opt/hostedtoolcache/go/1.19.1/x64/src/testing/testing.go:2036 +0x8e
created by time.goFunc
/opt/hostedtoolcache/go/1.19.1/x64/src/time/sleep.go:176 +0x32

Something is blocking the test run

chart/k8gb/README.md

…cted. This will ensure that current running workloads using TSIG authentication for BIND will not break due to change on the helm values list for provider 2136. Added validations to _helpers template, in order to ensure that provider2136 options are not added to the external DNS deployment configuration, when provider2136 isn't enabled. Signed-off-by: Vitor Esteves <x191116@MacBook-Pro-de-Vitor.local>

v-esteves · 2023-12-18T11:10:43Z

@ytsarev like we have discussed before, the problem was regarding the new values that should be added to the helm statement, in order to deploy correctly External DNS.
To bypass this issue and ensure that there aren't breaking changes, I've added the default value to true for TSIG authentication when provider2136 is active. This will allow that running workloads don't have any issue when upgrading the version. For new installations, the desired configuration should be added through correct values definition.

ytsarev · 2023-12-18T22:30:35Z

@v-esteves great solution with the backward compatibility 👍 Thank you so much!
Please consider creating the issue to track the old values support removal after a couple of project releases

* Release `v0.12.0` with Cloudflare(k8gb-io#1278) and GSS-TSIG support(k8gb-io#1064) * Inline maintainer list update to be aligned with https://github.com/k8gb-io/k8gb/blob/master/CODEOWNERS Signed-off-by: Yury Tsarev <yury@upbound.io>

* Release `v0.12.0` with Cloudflare(#1278) and GSS-TSIG support(#1064) * Inline maintainer list update to be aligned with https://github.com/k8gb-io/k8gb/blob/master/CODEOWNERS Signed-off-by: Yury Tsarev <yury@upbound.io>

v-esteves requested review from donovanmuller, k0da, kuritka, somaritane, ytsarev and jkremser as code owners February 13, 2023 14:17

ytsarev reviewed Feb 13, 2023

View reviewed changes

jkremser reviewed Feb 17, 2023

View reviewed changes

v-esteves changed the title ~~1061 fix~~ 1061 - Helm chart updated for ExternalDNS, rfc2126 provider, in order to support GSS-TSIG authentication configuration. Mar 23, 2023

Vitor Esteves and others added 3 commits March 27, 2023 12:27

Changed values file and schema, in order to support GSS-TSIG configur…

bf66002

…ation for ExternalDNS Signed-off-by: vestevesaws@gmail.com <x191116@MacBook-Pro-de-Vitor.local>

Changed deployment external-dns template, in order to support volumes…

8e18977

… for kerberos configuration file from config-map Signed-off-by: vestevesaws@gmail.com <x191116@MacBook-Pro-de-Vitor.local>

v-esteves force-pushed the 1061-fix branch from 5dc593c to ba299bc Compare March 27, 2023 11:28

helm: values.yaml, values.schema.json, templates/external-dns

e1f369a

Changed to allow the configuration of the provider RFC2136 with GSS-TSIG Fixes k8gb-io#1061 Signed-off-by: vestevesaws@gmail.com <x191116@MacBook-Pro-de-Vitor.local>

v-esteves requested review from ytsarev and jkremser and removed request for somaritane, k0da, donovanmuller and kuritka March 27, 2023 13:50

ytsarev reviewed Mar 31, 2023

View reviewed changes

ytsarev changed the title ~~1061 - Helm chart updated for ExternalDNS, rfc2126 provider, in order to support GSS-TSIG authentication configuration.~~ 1061 - Helm chart updated for ExternalDNS, rfc2136 provider, in order to support GSS-TSIG authentication configuration. Apr 12, 2023

Added reference in main README.md to provider RFC2136 tutorial. Remov…

67c3a6b

…ed duplicaded Helm Values from RFC2136 provider tutorial. Signed-off-by: vestevesaws@gmail.com <x191116@MacBook-Pro-de-Vitor.local>

v-esteves requested a review from ytsarev August 9, 2023 15:48

ytsarev changed the title ~~1061 - Helm chart updated for ExternalDNS, rfc2136 provider, in order to support GSS-TSIG authentication configuration.~~ Helm chart updated for ExternalDNS, rfc2136 provider, in order to support GSS-TSIG authentication configuration. Aug 10, 2023

vestevesaws@gmail.com and others added 2 commits August 10, 2023 10:41

Pulled and merge README.md from main, in order to resolve conflict va…

563d085

…lues. Signed-off-by: vestevesaws@gmail.com <x191116@MBP-de-Vitor.lan>

Merge branch 'master' into 1061-fix

651fc5d

Signed-off-by: Vitor Esteves <64093608+v-esteves@users.noreply.github.com>

ytsarev requested changes Aug 10, 2023

View reviewed changes

docs/deploy_windowsdns.md Show resolved Hide resolved

make golic happy

2df8be9

Signed-off-by: Yury Tsarev <yury@upbound.io>

ytsarev force-pushed the 1061-fix branch from 6224dcb to 2df8be9 Compare August 15, 2023 14:47

vestevesaws@gmail.com and others added 2 commits September 10, 2023 13:57

Added link to Azure Windows DNS documentation from main Readme.md

33551b4

Signed-off-by: vestevesaws@gmail.com <x191116@MBP-de-Vitor.home>

Merge branch 'master' into 1061-fix

a214fec

Signed-off-by: Vitor Esteves <64093608+v-esteves@users.noreply.github.com>

v-esteves requested a review from ytsarev September 10, 2023 13:01

ytsarev requested changes Sep 11, 2023

View reviewed changes

Merge branch 'master' into 1061-fix

ff6939e

Signed-off-by: Vitor Esteves <64093608+v-esteves@users.noreply.github.com>

v-esteves requested a review from ytsarev December 14, 2023 14:25

ytsarev reviewed Dec 14, 2023

View reviewed changes

chart/k8gb/README.md Show resolved Hide resolved

v-esteves requested a review from ytsarev December 18, 2023 11:07

ytsarev approved these changes Dec 18, 2023

View reviewed changes

ytsarev merged commit 77fd09b into k8gb-io:master Dec 18, 2023
12 checks passed

ytsarev mentioned this pull request Dec 18, 2023

RELEASE: v0.12.0 #1359

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Helm chart updated for ExternalDNS, rfc2136 provider, in order to support GSS-TSIG authentication configuration. #1064

Helm chart updated for ExternalDNS, rfc2136 provider, in order to support GSS-TSIG authentication configuration. #1064

v-esteves commented Feb 13, 2023 •

edited by ytsarev

Loading

ytsarev left a comment

jkremser Feb 17, 2023 •

edited

Loading

v-esteves Feb 28, 2023

jkremser left a comment

netlify bot commented Mar 27, 2023 •

edited

Loading

github-advanced-security bot commented Mar 31, 2023

ytsarev left a comment

ytsarev Mar 31, 2023

v-esteves Apr 20, 2023

ytsarev commented Aug 10, 2023

ytsarev left a comment

ytsarev commented Aug 10, 2023

v-esteves commented Sep 10, 2023

ytsarev left a comment

v-esteves commented Oct 4, 2023

ytsarev commented Oct 6, 2023

ytsarev commented Dec 14, 2023

v-esteves commented Dec 18, 2023

ytsarev commented Dec 18, 2023

Helm chart updated for ExternalDNS, rfc2136 provider, in order to support GSS-TSIG authentication configuration. #1064

Helm chart updated for ExternalDNS, rfc2136 provider, in order to support GSS-TSIG authentication configuration. #1064

Conversation

v-esteves commented Feb 13, 2023 • edited by ytsarev Loading

ytsarev left a comment

Choose a reason for hiding this comment

jkremser Feb 17, 2023 • edited Loading

Choose a reason for hiding this comment

v-esteves Feb 28, 2023

Choose a reason for hiding this comment

jkremser left a comment

Choose a reason for hiding this comment

netlify bot commented Mar 27, 2023 • edited Loading

✅ Deploy Preview for k8gb-preview ready!

github-advanced-security bot commented Mar 31, 2023

ytsarev left a comment

Choose a reason for hiding this comment

ytsarev Mar 31, 2023

Choose a reason for hiding this comment

v-esteves Apr 20, 2023

Choose a reason for hiding this comment

ytsarev commented Aug 10, 2023

ytsarev left a comment

Choose a reason for hiding this comment

ytsarev commented Aug 10, 2023

v-esteves commented Sep 10, 2023

ytsarev left a comment

Choose a reason for hiding this comment

v-esteves commented Oct 4, 2023

ytsarev commented Oct 6, 2023

ytsarev commented Dec 14, 2023

v-esteves commented Dec 18, 2023

ytsarev commented Dec 18, 2023

v-esteves commented Feb 13, 2023 •

edited by ytsarev

Loading

jkremser Feb 17, 2023 •

edited

Loading

netlify bot commented Mar 27, 2023 •

edited

Loading