cluster

commit bdde915a77bbe28ec6ca4bacc331f32566d4e830
parent d5996527ca3374f1ce9ada08f986de71abad5782
Author: MTRNord <MTRNord@users.noreply.github.com>
Date:   Tue, 18 Nov 2025 19:24:59 +0100

fix pdns certamnager

Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>

Diffstat:
M
infrastructure_talos/configs/cluster-issuers.yaml
 | 
18
+++++++++++++-----
M
infrastructure_talos/configs/kustomization.yaml
 | 
1
+
A
infrastructure_talos/configs/pdns-secret.yaml
 | 
28
++++++++++++++++++++++++++++
M
infrastructure_talos/controllers/cert-manager.yaml
 | 
26
++++++++++++++++++++++++++

4 files changed, 68 insertions(+), 5 deletions(-)
diff --git a/infrastructure_talos/configs/cluster-issuers.yaml b/infrastructure_talos/configs/cluster-issuers.yaml
@@ -11,11 +11,19 @@ spec:
             name: letsencrypt-dns-account-key
         solvers:
             - dns01:
-                cloudflare:
-                    apiTokenSecretRef:
-                        name: cloudflare-api-token-secret
-                        key: api-token
-
+                  cloudflare:
+                      apiTokenSecretRef:
+                          name: cloudflare-api-token-secret
+                          key: api-token
+            - dns01:
+                  webhook:
+                      groupName: acme.zacharyseguin.ca
+                      solverName: pdns
+                      config:
+                          host: http://10.0.64.129:8081
+                          apiKeySecretRef:
+                              name: pdns-api-key
+                              key: key
 # Fix for flux
 ---
 
diff --git a/infrastructure_talos/configs/kustomization.yaml b/infrastructure_talos/configs/kustomization.yaml
@@ -1,6 +1,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+    - pdns-secret.yaml
     - cluster-issuers.yaml
     - pg-secrets.yaml
     - cnpg-cluster-barmancloud-ext.yaml
diff --git a/infrastructure_talos/configs/pdns-secret.yaml b/infrastructure_talos/configs/pdns-secret.yaml
@@ -0,0 +1,28 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: pdns-api-key
+    namespace: cert-manager
+type: Opaque
+stringData:
+    key: ENC[AES256_GCM,data:PIDIjA+BF828FgAzkc8AM4FoG9ffksIWJoBW3BDJBm94uVNVv+uUes9rJhTktpjM0A6GDRQwpS50AH3ZZbixHg==,iv:HifyMS+cNn3kaZABkCLrYd4St3FaLHjSjF0/45jOitA=,tag:CzNWO9sVed4VWyZAqjunpw==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPOVlNOWtZdExXMGdCSFBT
+            eTRzQzV2RElJd3RCdlNGTFhkd05TcHNSYmlNCmg1cG9qeFAxRFUrQTd5R2dxa0xt
+            ZUk0dlJUNWV4czBEUHpLaE9YanJYcUEKLS0tIGRWVGZzRHZ4aHJmS0l5MzNVUnJ1
+            dkRlNnVzTzFGUHh0ZGt2QUZSVW0xMGsKkfqcIB1zQzAIUkbhQHvHh+E/t27LOzwS
+            PjO4fXFkhlYBHI0rZLSlVaBuFcfRAg6XLmkdchJ3h7KruzlpkgqwNQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-11-18T18:23:26Z"
+    mac: ENC[AES256_GCM,data:VQAhbwuQ/c0paU2cxvxDrpMyn4kU1T7eUe2WxwP/4OM9isOgGJtPzy48Z7TV9P0q57LiLbBw+Weh4UbXTNoqm0LWfjrvCAn5nH2AnrjsDzJfVlsJIPZGSbz9Piv4O/JQg01fZcX9mlr2yzGN946CGDQ+x2c9LfQ1Es0dvh2eapc=,iv:IjLVNAeLqXoeOluxXVXHAuIQI2wR9D2yByvBe8x8FyY=,tag:oCmlViJ/KiTvFGV6AtDr2A==,type:str]
+    pgp: []
+    encrypted_regex: ^(harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+    version: 3.9.1
diff --git a/infrastructure_talos/controllers/cert-manager.yaml b/infrastructure_talos/controllers/cert-manager.yaml
@@ -12,6 +12,15 @@ spec:
     interval: 24h
     url: https://charts.jetstack.io
 ---
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: HelmRepository
+metadata:
+    name: cert-manager-pdns
+    namespace: cert-manager
+spec:
+    interval: 24h
+    url: https://zachomedia.github.io/cert-manager-webhook-pdns
+---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
@@ -72,3 +81,20 @@ spec:
                 port: 8089
     policyTypes:
         - Ingress
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
+kind: HelmRelease
+metadata:
+    name: cert-manager-pdns
+    namespace: cert-manager
+spec:
+    interval: 30m
+    chart:
+        spec:
+            chart: cert-manager-webhook-pdns
+            version: "1.x"
+            sourceRef:
+                kind: HelmRepository
+                name: cert-manager-pdns
+                namespace: cert-manager
+            interval: 12h