-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Patch ace options schema to fix dns provider help text
Signed-off-by: Tamal Saha <[email protected]>
- Loading branch information
Showing
3 changed files
with
430 additions
and
297 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,131 @@ | ||
| properties: | ||
| infra: | ||
| properties: | ||
| dns: | ||
| properties: | ||
| auth: | ||
| properties: | ||
| azureDNS: | ||
| description: | | ||
| ## AzureDNS | ||
| To use AzureDNS as your DNS provider, run the following commands | ||
| - Set the following ENVs with the preferred `Service Principal`, `Resource Group` and `DNS Zone` | ||
| ```sh | ||
| NEW_SERVICE_PRINCIPAL_NAME=azuredns-sp | ||
| DNS_ZONE=<your-preferred-domain> # DNS_ZONE=appscode.com | ||
| # Resource Group where you created the zone | ||
| DNS_ZONE_RESOURCE_GROUP=<resource-group-name> | ||
| ``` | ||
| - Create a Service Principal RBAC | ||
| ```sh | ||
| DNS_SP=$(az ad sp create-for-rbac --name $NEW_SERVICE_PRINCIPAL_NAME) | ||
| ``` | ||
| - Assign required roles for the Service Principal | ||
| ```sh | ||
| SERVICE_PRINCIPAL_APP_ID=$(echo $DNS_SP | jq -r '.appId') | ||
| DNS_ID=$(az network dns zone show --name $DNS_ZONE --resource-group $DNS_ZONE_RESOURCE_GROUP --query "id" --output tsv) | ||
| az role assignment create --assignee $SERVICE_PRINCIPAL_APP_ID --role "DNS Zone Contributor" --scope $DNS_ID | ||
| az role assignment create --assignee $SERVICE_PRINCIPAL_APP_ID --role "Reader" --scope $DNS_ID | ||
| ``` | ||
| - Print and provide us the following data | ||
| ```sh | ||
| echo "SERVICE_PRINCIPAL_APP_ID: $(echo $DNS_SP | jq -r '.appId')" | ||
| echo "SERVICE_PRINCIPAL_APP_PASSWORD: $(echo $DNS_SP | jq -r '.password')" | ||
| echo "SUBSCRIPTION_ID: $(az account show | jq -r '.id')" | ||
| echo "TENANT_ID: $(echo $DNS_SP | jq -r '.tenant')" | ||
| echo "DNS_ZONE: $DNS_ZONE" | ||
| echo "DNS_ZONE_RESOURCE_GROUP: $DNS_ZONE_RESOURCE_GROUP" | ||
| ``` | ||
| cloudDNS: | ||
| description: | | ||
| ## Google CloudDNS | ||
| To use Google CloudDNS as your DNS provider, you need to create a GCP service account with the dns.admin role. | ||
| - Set Project id, service account name | ||
| ```sh | ||
| # Set the project ID where you registered your Domain | ||
| PROJECT_ID="myproject-id" | ||
| DNS_SA_NAME="clouddns-sa" | ||
| DNS_SA_EMAIL="$DNS_SA_NAME@${PROJECT_ID}.iam.gserviceaccount.com" | ||
| ``` | ||
| - Create Service account and Assign permission | ||
| ```sh | ||
| gcloud iam service-accounts create $DNS_SA_NAME --display-name $DNS_SA_NAME | ||
| # assign google service account to dns.admin role in cloud-dns project | ||
| gcloud projects add-iam-policy-binding $PROJECT_ID \ | ||
| --member serviceAccount:$DNS_SA_EMAIL --role "roles/dns.admin" | ||
| ``` | ||
| - Create a Service Account Secret | ||
| ```sh | ||
| # download static credentials | ||
| gcloud iam service-accounts keys create $DNS_SA_NAME-credentials.json \ | ||
| --iam-account $DNS_SA_EMAIL | ||
| ``` | ||
| cloudflare: | ||
| description: | | ||
| ## Cloudflare | ||
| To use Cloudflare as your DNS provider, you need to create a API Token some specified permissions. | ||
| Tokens can be created at `User Profile` > `API Tokens` > `API Tokens`. The following settings are recommended: | ||
| - Permissions: | ||
| - `Zone` - `DNS` - `Edit` | ||
| - `Zone` - `Zone` - `Read` | ||
| - Zone Resources: | ||
| - `Include` - `All zones` </br> | ||
| or | ||
| - `Include` - `Specific zone` - `Your desired zone` | ||
| route53: | ||
| description: | | ||
| ## Route53 | ||
| To use Route53 as your DNS provider, you need to run the following commands and provide us the generated `AccessKeyID` and `SecretAccessKey`. | ||
| - Create a policy | ||
| ```sh | ||
| echo '{ | ||
| "Version": "2012-10-17", | ||
| "Statement": [ | ||
| { | ||
| "Effect": "Allow", | ||
| "Action": "route53:GetChange", | ||
| "Resource": "arn:aws:route53:::change/*" | ||
| }, | ||
| { | ||
| "Effect": "Allow", | ||
| "Action": [ | ||
| "route53:ChangeResourceRecordSets", | ||
| "route53:ListResourceRecordSets" | ||
| ], | ||
| "Resource": "arn:aws:route53:::hostedzone/*" | ||
| }, | ||
| { | ||
| "Effect": "Allow", | ||
| "Action": [ | ||
| "route53:ListHostedZones", | ||
| "route53:ListHostedZonesByName", | ||
| "route53:ListResourceRecordSets", | ||
| "route53:ListTagsForResource" | ||
| ], | ||
| "Resource": "*" | ||
| } | ||
| ] | ||
| }' > route53-policy.json | ||
| ``` | ||
| ```sh | ||
| aws iam create-policy --policy-name route53-policy --policy-document file://route53-policy.json | ||
| POLICY_ARN=$(aws iam list-policies --query 'Policies[?PolicyName==`route53-policy`].Arn' --output text) | ||
| ``` | ||
| - Create a user and attach this policy to that user | ||
| ```sh | ||
| aws iam create-user --user-name "route53" | ||
| aws iam attach-user-policy --user-name "route53" --policy-arn $POLICY_ARN | ||
| ``` | ||
| - Create Access Token for the user | ||
| ```sh | ||
| aws iam create-access-key --user-name "route53" | ||
| ``` |
Oops, something went wrong.