Kubernetes external-dns deployment with RBAC

external-dns.yml

---
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:     
    app: external-dns
  name: external-dns
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  labels:     
    app: external-dns
  name: external-dns
rules:
- apiGroups: [""]
  resources: ["services"]
  verbs: ["get","watch","list"]
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get","watch","list"]
- apiGroups: ["extensions"] 
  resources: ["ingresses"] 
  verbs: ["get","watch","list"]
- apiGroups: [""]
  resources: ["nodes"]
  verbs: ["list"]
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  labels:     
    app: external-dns
  name: external-dns
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: external-dns
subjects:
  - kind: ServiceAccount
    name: external-dns
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: external-dns
  name: external-dns
spec:
  ports:
    - port: 7979
      protocol: TCP
      targetPort: 7979
  selector:
    app: external-dns
  type: "ClusterIP"
---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  labels:     
    app: external-dns
  name: external-dns
spec:
  selector:
    matchLabels:
      app: external-dns
  revisionHistoryLimit: 3
  strategy:
    type: Recreate
  template:
    metadata:
      labels:         
        app: external-dns
      annotations:
        #iam.amazonaws.com/role: "MyRoute53AccessRole"  # in case of kube2iam
        scheduler.alpha.kubernetes.io/tolerations: '[{"key": "dedicated", "value": "master"}]'
    spec:
      containers:
        - name: external-dns
          image: "registry.opensource.zalan.do/teapot/external-dns:v0.5.6"
          imagePullPolicy: "IfNotPresent"
          args:
            #- --aws-zone-type=public # only look at public hosted zones (valid values are public, private or no value for both)
            #- --domain-filter=external-dns-test.my-org.com # will make ExternalDNS see only the hosted zones matching provided domain
            #- --policy=upsert-only
            - --log-level=info
            - --provider=aws
            - --source=service
            - --source=ingress
            - --registry=txt
            - --txt-owner-id=k8s-logs-external-dns
          volumeMounts:
          env:
          - name: AWS_DEFAULT_REGION
            value: eu-west-1
          livenessProbe:
            httpGet:
              path: /healthz
              port: 7979
          ports:
            - containerPort: 7979
      volumes:
      serviceAccountName: external-dns
      nodeSelector:
        node-role.kubernetes.io/master: ""
      tolerations:
      - effect: NoSchedule
        key: node-role.kubernetes.io/master