From 862f1792515a537108a53ffadb029cc6bb8d08d2 Mon Sep 17 00:00:00 2001
From: Olu Shiyanbade <oshiyanbade@sonatype.com>
Date: Fri, 26 Aug 2022 20:47:16 +0100
Subject: [PATCH] Configure external-dns to create docker sub domain rcords and
 https listener

---
 nexus-repository-manager/.DS_Store            | Bin 6148 -> 0 bytes
 .../templates/external-dns-rbac.yml           |  66 ++++++++++++++++
 nxrm-aws-resiliency/templates/fluent-bit.yaml |   2 +-
 nxrm-aws-resiliency/templates/namespaces.yaml |   5 ++
 .../templates/serviceaccount.yaml             |   9 +++
 nxrm-aws-resiliency/values.yaml               |  74 ++++++++++--------
 6 files changed, 122 insertions(+), 34 deletions(-)
 delete mode 100644 nexus-repository-manager/.DS_Store
 create mode 100644 nxrm-aws-resiliency/templates/external-dns-rbac.yml

diff --git a/nexus-repository-manager/.DS_Store b/nexus-repository-manager/.DS_Store
deleted file mode 100644
index 0823931f60d2d50324a9bd03ba8e9d484c4aadf3..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 6148
zcmeHKF-`+P475p*f@o4w?icvMDhe;)0|Y{MC`f_+D&ED@n6a&d=mH%L8cX)<`aHY3
zDb8mz^VR$I)@*5J3pmj}7^cSO^od<mhUjs|U>ke0XWMW0lj`#ca<78(Vz2g%|1>=A
zb^}S5c_bo^J*Ll}r>qo^0#ZN<NC7GEy8`Ihw8eFzq7;w<QsAHfzYh&g?1f`ud^!+f
z1OU#F4#PTT31DLa*bB!*WMH0DU{bwC3{N`pt?GK=n3#0)xEbfv&0Z6V$L+|sC^zqk
zic&xdoGLKO?UMcf4*tXZe@fC$3P^!}rGU@Z_v;m2se0?=<=AT*`~l9IPdE+hpdds$
k21Yx^hVA$!in6Y8jpw~^Obj~mK?mw*fV#+}z+Wry1xKwLGynhq

diff --git a/nxrm-aws-resiliency/templates/external-dns-rbac.yml b/nxrm-aws-resiliency/templates/external-dns-rbac.yml
new file mode 100644
index 0000000..948c200
--- /dev/null
+++ b/nxrm-aws-resiliency/templates/external-dns-rbac.yml
@@ -0,0 +1,66 @@
+# comment out sa if it was previously created
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: external-dns
+  namespace: {{ .Values.namespaces.externaldnsNs }}
+  labels:
+    app.kubernetes.io/name: external-dns
+rules:
+  - apiGroups: [""]
+    resources: ["services","endpoints","pods","nodes"]
+    verbs: ["get","watch","list"]
+  - apiGroups: ["extensions","networking.k8s.io"]
+    resources: ["ingresses"]
+    verbs: ["get","watch","list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: external-dns-viewer
+  namespace: {{ .Values.namespaces.externaldnsNs }}  
+  labels:
+    app.kubernetes.io/name: external-dns
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: external-dns
+subjects:
+  - kind: ServiceAccount
+    name: {{ .Values.serviceAccount.externaldns.name }}
+    namespace: {{ .Values.namespaces.externaldnsNs }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: external-dns
+  namespace: {{ .Values.namespaces.externaldnsNs }}  
+  labels:
+    app.kubernetes.io/name: external-dns
+spec:
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: external-dns
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: external-dns
+    spec:
+      serviceAccountName: external-dns
+      containers:
+        - name: external-dns
+          image: k8s.gcr.io/external-dns/external-dns:v0.11.0
+          args:
+            - --source=service
+            - --source=ingress
+            - --domain-filter={{ .Values.externaldns.domainFilter }} # will make ExternalDNS see only the hosted zones matching provided domain, omit to process all available hosted zones
+            - --provider=aws
+            - --policy=upsert-only # would prevent ExternalDNS from deleting any records, omit to enable full synchronization
+            - --aws-zone-type=public # only look at public hosted zones (valid values are public, private or no value for both)
+            - --registry=txt
+            - --txt-owner-id=external-dns
+          env:
+            - name: AWS_DEFAULT_REGION
+              value: {{ .Values.deployment.clusterRegion }}
diff --git a/nxrm-aws-resiliency/templates/fluent-bit.yaml b/nxrm-aws-resiliency/templates/fluent-bit.yaml
index 8556edf..8fd98c3 100644
--- a/nxrm-aws-resiliency/templates/fluent-bit.yaml
+++ b/nxrm-aws-resiliency/templates/fluent-bit.yaml
@@ -263,7 +263,7 @@ spec:
     spec:
       containers:
         - name: fluent-bit
-          image: amazon/aws-for-fluent-bit:2.10.0
+          image: amazon/aws-for-fluent-bit:{{ .Values.deployment.fluentBitVersion }}
           imagePullPolicy: Always
           env:
             - name: AWS_REGION
diff --git a/nxrm-aws-resiliency/templates/namespaces.yaml b/nxrm-aws-resiliency/templates/namespaces.yaml
index 5bfb6df..6c72ee7 100644
--- a/nxrm-aws-resiliency/templates/namespaces.yaml
+++ b/nxrm-aws-resiliency/templates/namespaces.yaml
@@ -8,3 +8,8 @@ kind: Namespace
 metadata:
   name: {{ .Values.namespaces.cloudwatchNs }}
 ---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: {{ .Values.namespaces.externaldnsNs }}
+---
diff --git a/nxrm-aws-resiliency/templates/serviceaccount.yaml b/nxrm-aws-resiliency/templates/serviceaccount.yaml
index 9c0e499..bca6cf4 100644
--- a/nxrm-aws-resiliency/templates/serviceaccount.yaml
+++ b/nxrm-aws-resiliency/templates/serviceaccount.yaml
@@ -5,3 +5,12 @@ metadata:
   namespace: {{ .Values.namespaces.nexusNs }}
   annotations:
     eks.amazonaws.com/role-arn: {{ .Values.serviceAccount.role }}
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Values.serviceAccount.externaldns.name }}
+  namespace: {{ .Values.namespaces.externaldnsNs }}
+  annotations:
+    eks.amazonaws.com/role-arn: {{ .Values.serviceAccount.externaldns.role }}
+---
diff --git a/nxrm-aws-resiliency/values.yaml b/nxrm-aws-resiliency/values.yaml
index 55dd3fa..ea8f593 100644
--- a/nxrm-aws-resiliency/values.yaml
+++ b/nxrm-aws-resiliency/values.yaml
@@ -1,41 +1,49 @@
 # Declare variables to be passed into your templates.
 namespaces:
-    nexusNs: nexusrepo
-    cloudwatchNs: amazon-cloudwatch
+  nexusNs: nexusrepo
+  cloudwatchNs: amazon-cloudwatch
+  externaldnsNs: nexus-externaldns
+externaldns:
+  domainFilter: example.com #your root domain e.g example.com
 deployment:
-   name: nxrm.deployment
-   clusterName: nxrm-nexus
-   logsRegion: us-east-1
-   initContainer:
-        image:
-          repository: busybox
-          tag: 1.33.1
-   container:
-        image:
-          repository: sonatype/nexus3
-          tag: 3.41.1
-        containerPort: 8081
-        pullPolicy: IfNotPresent
-        env:
-          nexusDBName: nexus
-          nexusDBPort: 3306
-   requestLogContainer:
-        image:
-          repository: busybox
-          tag: 1.33.1
-   auditLogContainer:
-        image:
-          repository: busybox
-          tag: 1.33.1
-   taskLogContainer:
-        image:
-          repository: busybox
-          tag: 1.33.1
+  clusterRegion: us-east-1
+  name: nxrm.deployment
+  clusterName: nxrm-nexus
+  logsRegion: us-east-1
+  fluentBitVersion: 2.28.0
+  initContainer:
+    image:
+      repository: busybox
+      tag: 1.33.1
+  container:
+    image:
+      repository: sonatype/nexus3
+      tag: 3.41.1
+    containerPort: 8081
+    pullPolicy: IfNotPresent
+    env:
+      nexusDBName: nexus
+      nexusDBPort: 3306
+  requestLogContainer:
+    image:
+      repository: busybox
+      tag: 1.33.1
+  auditLogContainer:
+    image:
+      repository: busybox
+      tag: 1.33.1
+  taskLogContainer:
+    image:
+      repository: busybox
+      tag: 1.33.1
 serviceAccount:
-     name: nexus-repository-deployment-sa #This SA is created as part of steps under "AWS Secrets Manager"
-     role: arn:aws:iam::000000000000:role/nxrm-nexus-role #Role with secretsmanager permissions
+  name: nexus-repository-deployment-sa #This SA is created as part of steps under "AWS Secrets Manager"
+  role: arn:aws:iam::000000000000:role/nxrm-nexus-role #Role with secretsmanager permissions
+  externaldns:
+    name: external-dns
+    role: arn:aws:iam::000000000000:role/nexusrepo-external-dns-irsa-role #Role with route53 permissions needed by external-dns     
 ingress:
-  #host: "nexus.ingress.rule.host" #host to apply this ingress rule to. Uncomment this in your values.yaml and set it as you wish
+  #host: "example.com" #host to apply this ingress rule to. Uncomment this in your values.yaml and set it as you wish
   annotations:
     kubernetes.io/ingress.class: alb
     alb.ingress.kubernetes.io/scheme: internal # scheme