Migrate ExternalDNS to Azure Workload Identity and v0.23.0

azure/terraform/stacks/acm-general/external-dns.tf

@@ -19,16 +19,33 @@ resource "azuread_service_principal_password" "externaldns" {
   service_principal_id = azuread_service_principal.externaldns.id
 }
 
+resource "azuread_application_federated_identity_credential" "externaldns" {
+  application_id = azuread_application.externaldns.id
+  display_name   = "acmapp-externaldns"
+  description    = "ExternalDNS on the ACM application Kubernetes cluster"
+  audiences      = ["api://AzureADTokenExchange"]
+  issuer         = var.external_dns_oidc_issuer_url
+  subject        = "system:serviceaccount:${var.external_dns_namespace}:externaldns"
+}
+
 resource "azurerm_role_assignment" "externaldns_reader" {
-  scope                = "/subscriptions/${data.azurerm_subscription.current.subscription_id}/resourceGroups/${var.resource_group_name}/providers/Microsoft.Network/dnszones/${var.public_domain_suffixes[0]}"
+  scope                = "/subscriptions/${data.azurerm_subscription.current.subscription_id}/resourceGroups/${var.resource_group_name}"
   role_definition_name = "Reader"
   principal_id         = azuread_service_principal.externaldns.object_id
+
+  lifecycle {
+    create_before_destroy = true
+  }
 }
 
 resource "azurerm_role_assignment" "externaldns_contributor" {
   scope                = "/subscriptions/${data.azurerm_subscription.current.subscription_id}/resourceGroups/${var.resource_group_name}/providers/Microsoft.Network/dnszones/${var.public_domain_suffixes[0]}"
-  role_definition_name = "Contributor"
+  role_definition_name = "DNS Zone Contributor"
   principal_id         = azuread_service_principal.externaldns.object_id
+
+  lifecycle {
+    create_before_destroy = true
+  }
 }
 
 output "tenant_id" {

azure/terraform/stacks/acm-general/variables.tf

@@ -21,6 +21,12 @@ variable "external_dns_namespace" {
   default     = "externaldns"
 }
 
+variable "external_dns_oidc_issuer_url" {
+  type        = string
+  description = "Public Kubernetes service account OIDC issuer used by ExternalDNS"
+  default     = "https://k8s-oidc.acmuic.org"
+}
+
 variable "resource_group_name" {
   type        = string
   description = "Specifies the name of the resource group that resources should be deployed into"

azure/terraform/stacks/vault-injector/external_dns.tf

@@ -3,7 +3,7 @@ resource "vault_kv_secret_v2" "externaldns_keyid" {
   name  = "externaldns/service_account"
   data_json = jsonencode(
     {
-      aadClientId     = data.terraform_remote_state.acm_general.outputs.externaldns_sp_appid,
+      aadClientId     = data.terraform_remote_state.acm_general.outputs.externaldns_sp_clientid,
       aadClientSecret = data.terraform_remote_state.acm_general.outputs.externaldns_sp_password
       resourceGroup   = data.terraform_remote_state.acm_general.outputs.default_resource_group
       subscriptionId  = data.terraform_remote_state.acm_general.outputs.subscription_id

kubernetes/argocd/stacks/common/externaldns.yml

@@ -11,7 +11,7 @@ spec:
     server: 'https://kubernetes.default.svc'
   sources:
     - repoURL: 'https://kubernetes-sigs.github.io/external-dns/'
-      targetRevision: 1.13.1
+      targetRevision: 1.23.0
       chart: external-dns
       helm:
         valueFiles:

kubernetes/argocd/stacks/externaldns/externaldns.yml

@@ -4,22 +4,16 @@ kind: Namespace
 metadata:
   name: externaldns
 ---
-apiVersion: cert-manager.io/v1
-kind: Certificate
+apiVersion: v1
+kind: ConfigMap
 metadata:
-  name: externaldns-vault-cert
+  name: externaldns-azure-config
   namespace: externaldns
-spec:
-  dnsNames:
-    - "externaldns.acmuic.org"
-    - "*.externaldns.svc"
-  ipAddresses:
-    - 127.0.0.1
-  usages:
-    - server auth
-    - digital signature
-    - key encipherment
-  secretName: externaldns-vault-cert
-  issuerRef:
-    kind: ClusterIssuer
-    name: acmuic-self-ca
+data:
+  azure.json: |
+    {
+      "tenantId": "cad5e02f-bae4-42d6-a06e-4377dd3e386f",
+      "subscriptionId": "2f98793b-7e2f-4f03-ac5b-7b2ec934dcd7",
+      "resourceGroup": "acm-general",
+      "useWorkloadIdentityExtension": true
+    }

kubernetes/argocd/stacks/externaldns/values.yml

@@ -1,24 +1,33 @@
 ---
-provider: azure
+provider:
+  name: azure
 serviceAccount:
   name: externaldns
-podAnnotations:
-  vault.hashicorp.com/agent-inject: 'true'
-  vault.hashicorp.com/role: 'externaldns'
-  vault.hashicorp.com/agent-inject-secret-azure.json: 'kv/externaldns/service_account'
-  vault.hashicorp.com/tls-secret: 'externaldns-vault-cert'
-  vault.hashicorp.com/ca-cert: '/vault/tls/ca.crt'
-  vault.hashicorp.com/agent-inject-template-azure.json: |
-    {{- with secret "kv/externaldns/service_account" -}}
-    {
-      "tenantId" : "{{ .Data.data.tenantId }}",
-      "subscriptionId" : "{{ .Data.data.subscriptionId }}",
-      "resourceGroup" : "{{ .Data.data.resourceGroup }}",
-      "aadClientId" : "{{ .Data.data.aadClientId }}",
-      "aadClientSecret" : "{{ .Data.data.aadClientSecret }}"
-    }
-    {{- end }}
-extraArgs: ["--azure-config-file=/vault/secrets/azure.json"]
+  annotations:
+    azure.workload.identity/client-id: f995b4bc-00a0-4912-9a1a-da9f74407cb8
+    azure.workload.identity/tenant-id: cad5e02f-bae4-42d6-a06e-4377dd3e386f
+podLabels:
+  azure.workload.identity/use: "true"
+extraVolumes:
+  - name: azure-config
+    configMap:
+      name: externaldns-azure-config
+extraVolumeMounts:
+  - name: azure-config
+    mountPath: /etc/kubernetes
+    readOnly: true
+extraArgs:
+  azure-config-file: /etc/kubernetes/azure.json
+policy: upsert-only
+registry: txt
+# Preserve ownership of records created by the existing controller.
+txtOwnerId: default
+domainFilters:
+  - acmuic.org
+# ACME solver Ingresses must not publish the internal load balancer address.
+labelFilter: acme.cert-manager.io/http01-solver!=true
+# Keep the target annotations used by the existing IngressRoutes.
+annotationPrefix: external-dns.alpha.kubernetes.io/
 sources:
   - service
   - ingress