Configure Kubernetes External DNS for automatic DNS record management with cloud providers

#!/usr/bin/env bash

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m'

# Global variables
DOMAIN=""
CLOUD_PROVIDER="aws"
CLEANUP_DONE=false

# Print colored output
print_status() {
    echo -e "${GREEN}[INFO]${NC} $1"
}

print_warning() {
    echo -e "${YELLOW}[WARN]${NC} $1"
}

print_error() {
    echo -e "${RED}[ERROR]${NC} $1"
}

# Usage message
usage() {
    cat << EOF
Usage: $0 -d DOMAIN [-p PROVIDER]

Install and configure Kubernetes External DNS for automatic DNS record management

Options:
    -d DOMAIN       Domain name to manage (required, e.g., example.com)
    -p PROVIDER     Cloud provider (default: aws, supports: aws, gcp, azure)
    -h              Show this help message

Examples:
    $0 -d example.com
    $0 -d mysite.com -p aws
EOF
    exit 1
}

# Parse command line arguments
while getopts "d:p:h" opt; do
    case $opt in
        d) DOMAIN="$OPTARG" ;;
        p) CLOUD_PROVIDER="$OPTARG" ;;
        h) usage ;;
        *) usage ;;
    esac
done

# Validate required arguments
if [ -z "$DOMAIN" ]; then
    print_error "Domain name is required"
    usage
fi

# Cleanup function for rollback
cleanup() {
    if [ "$CLEANUP_DONE" = false ]; then
        print_warning "Script failed, cleaning up..."
        kubectl delete namespace external-dns --ignore-not-found=true 2>/dev/null || true
        helm repo remove external-dns 2>/dev/null || true
        rm -f /tmp/external-dns-rbac.yaml /tmp/external-dns-values.yaml
        CLEANUP_DONE=true
    fi
}

# Set trap for cleanup on error
trap cleanup ERR

# Detect Linux distribution
detect_distro() {
    if [ -f /etc/os-release ]; then
        . /etc/os-release
        case "$ID" in
            ubuntu|debian) 
                PKG_MGR="apt"
                PKG_UPDATE="apt update -y"
                PKG_INSTALL="apt install -y"
                ;;
            almalinux|rocky|centos|rhel|ol|fedora) 
                PKG_MGR="dnf"
                PKG_UPDATE="dnf update -y"
                PKG_INSTALL="dnf install -y"
                ;;
            amzn) 
                PKG_MGR="yum"
                PKG_UPDATE="yum update -y"
                PKG_INSTALL="yum install -y"
                ;;
            *) 
                print_error "Unsupported distribution: $ID"
                exit 1 
                ;;
        esac
        export PKG_MGR PKG_UPDATE PKG_INSTALL
    else
        print_error "Cannot detect Linux distribution"
        exit 1
    fi
}

# Check prerequisites
check_prerequisites() {
    print_status "[1/8] Checking prerequisites..."
    
    if [ "$EUID" -eq 0 ]; then
        print_error "Do not run this script as root. Run as a user with sudo privileges."
        exit 1
    fi
    
    if ! command -v sudo >/dev/null 2>&1; then
        print_error "sudo is required but not installed"
        exit 1
    fi
    
    if ! command -v curl >/dev/null 2>&1; then
        print_error "curl is required but not installed"
        exit 1
    fi
}

# Update system packages
update_system() {
    print_status "[2/8] Updating system packages..."
    sudo $PKG_UPDATE
}

# Install kubectl and helm
install_tools() {
    print_status "[3/8] Installing kubectl and Helm..."
    
    # Install kubectl
    if ! command -v kubectl >/dev/null 2>&1; then
        KUBECTL_VERSION=$(curl -L -s https://dl.k8s.io/release/stable.txt)
        curl -LO "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl"
        sudo install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl
        rm -f kubectl
    else
        print_warning "kubectl already installed, skipping..."
    fi
    
    # Install Helm
    if ! command -v helm >/dev/null 2>&1; then
        curl -fsSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
    else
        print_warning "helm already installed, skipping..."
    fi
}

# Create namespace
create_namespace() {
    print_status "[4/8] Creating External DNS namespace..."
    kubectl create namespace external-dns --dry-run=client -o yaml | kubectl apply -f -
}

# Create RBAC configuration
create_rbac() {
    print_status "[5/8] Creating RBAC configuration..."
    
    cat > /tmp/external-dns-rbac.yaml << 'EOF'
apiVersion: v1
kind: ServiceAccount
metadata:
  name: external-dns
  namespace: external-dns
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: external-dns
rules:
- apiGroups: [""]
  resources: ["services","endpoints","pods"]
  verbs: ["get","watch","list"]
- apiGroups: ["extensions","networking.k8s.io"]
  resources: ["ingresses"]
  verbs: ["get","watch","list"]
- apiGroups: [""]
  resources: ["nodes"]
  verbs: ["list","watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: external-dns-viewer
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: external-dns
subjects:
- kind: ServiceAccount
  name: external-dns
  namespace: external-dns
EOF
    
    kubectl apply -f /tmp/external-dns-rbac.yaml
}

# Add Helm repository
add_helm_repo() {
    print_status "[6/8] Adding External DNS Helm repository..."
    helm repo add external-dns https://kubernetes-sigs.github.io/external-dns/
    helm repo update
}

# Create Helm values file
create_values_file() {
    print_status "[7/8] Creating Helm values configuration..."
    
    case "$CLOUD_PROVIDER" in
        aws)
            cat > /tmp/external-dns-values.yaml << EOF
provider: aws
aws:
  zoneType: public
  batchChangeSize: 1000
  evaluateTargetHealth: true

domainFilters:
  - ${DOMAIN}

policy: upsert-only
registry: txt
txtOwnerId: external-dns-${DOMAIN}
txtPrefix: external-dns-

interval: 1m
triggerLoopOnEvent: false

logLevel: info
logFormat: text

metrics:
  enabled: true
  port: 7979

serviceAccount:
  create: false
  name: external-dns

resources:
  limits:
    cpu: 50m
    memory: 50Mi
  requests:
    cpu: 10m
    memory: 50Mi

securityContext:
  fsGroup: 65534
  runAsUser: 65534
  runAsNonRoot: true
EOF
            ;;
        gcp)
            cat > /tmp/external-dns-values.yaml << EOF
provider: google
google:
  project: ""
  
domainFilters:
  - ${DOMAIN}

policy: upsert-only
registry: txt
txtOwnerId: external-dns-${DOMAIN}

serviceAccount:
  create: false
  name: external-dns
EOF
            ;;
        *)
            print_error "Unsupported cloud provider: $CLOUD_PROVIDER"
            exit 1
            ;;
    esac
}

# Deploy External DNS
deploy_external_dns() {
    print_status "[8/8] Deploying External DNS..."
    
    helm upgrade --install external-dns external-dns/external-dns \
        --namespace external-dns \
        --values /tmp/external-dns-values.yaml \
        --wait --timeout=300s
}

# Verify installation
verify_installation() {
    print_status "Verifying External DNS installation..."
    
    # Check if deployment is ready
    kubectl wait --for=condition=available --timeout=300s deployment/external-dns -n external-dns
    
    # Check pod status
    kubectl get pods -n external-dns
    
    # Check logs for any immediate errors
    print_status "Checking External DNS logs..."
    kubectl logs -n external-dns deployment/external-dns --tail=10
    
    print_status "External DNS installation completed successfully!"
    echo ""
    print_warning "Next steps:"
    echo "1. Configure cloud provider credentials (AWS IAM role, GCP service account, etc.)"
    echo "2. Create an ingress or LoadBalancer service with external-dns annotations"
    echo "3. Verify DNS records are created in your cloud provider's DNS service"
    echo ""
    echo "Example ingress annotation:"
    echo "  external-dns.alpha.kubernetes.io/hostname: app.${DOMAIN}"
}

# Cleanup temporary files
cleanup_files() {
    rm -f /tmp/external-dns-rbac.yaml /tmp/external-dns-values.yaml
    CLEANUP_DONE=true
}

# Main execution
main() {
    print_status "Starting External DNS installation for domain: $DOMAIN"
    
    detect_distro
    check_prerequisites
    update_system
    install_tools
    create_namespace
    create_rbac
    add_helm_repo
    create_values_file
    deploy_external_dns
    verify_installation
    cleanup_files
    
    print_status "External DNS installation completed successfully!"
}

main "$@"