├── .github
├── FUNDING.yml
├── renovate.json5
└── workflows
│ └── release.yaml
├── .gitignore
├── .editorconfig
├── Dockerfile
├── cmd
└── webhook
│ ├── init
│ ├── logging
│ │ └── log.go
│ ├── configuration
│ │ └── configuration.go
│ ├── dnsprovider
│ │ └── dnsprovider.go
│ └── server
│ │ └── server.go
│ └── main.go
├── internal
└── opnsense-unbound
│ ├── utils.go
│ ├── types.go
│ ├── provider.go
│ └── client.go
├── pkg
└── webhook
│ ├── mediatype.go
│ └── webhook.go
├── go.mod
├── README.md
├── go.sum
└── LICENSE
/.github/FUNDING.yml:
--------------------------------------------------------------------------------
1 | github: [crutonjohn]
2 |
--------------------------------------------------------------------------------
/.gitignore:
--------------------------------------------------------------------------------
1 | ### IntelliJ IDEA ###
2 | .idea
3 | ###
4 | .private/
5 | webhook
6 |
--------------------------------------------------------------------------------
/.github/renovate.json5:
--------------------------------------------------------------------------------
1 | {
2 | "$schema": "https://docs.renovatebot.com/renovate-schema.json",
3 | "extends": ["config:recommended", ":disableRateLimiting", "regexManagers:biomeVersions"],
4 | "postUpdateOptions": [
5 | "gomodTidy",
6 | "gomodUpdateImportPaths"
7 | ]
8 | }
9 |
--------------------------------------------------------------------------------
/.editorconfig:
--------------------------------------------------------------------------------
1 | ; https://editorconfig.org/
2 |
3 | root = true
4 |
5 | [*]
6 | indent_style = space
7 | indent_size = 2
8 | end_of_line = lf
9 | charset = utf-8
10 | trim_trailing_whitespace = true
11 | insert_final_newline = true
12 |
13 | [{Makefile,go.mod,go.sum,*.go,.gitmodules}]
14 | indent_style = tab
15 | indent_size = 4
16 |
17 | [*.md]
18 | indent_size = 4
19 | eclint_indent_style = unset
20 |
21 | [Dockerfile]
22 | indent_size = 4
23 |
--------------------------------------------------------------------------------
/Dockerfile:
--------------------------------------------------------------------------------
1 | FROM golang:1.22-alpine AS builder
2 | ARG PKG=github.com/crutonjohn/external-dns-opnsense-webhook
3 | ARG VERSION=dev
4 | ARG REVISION=dev
5 | WORKDIR /build
6 | COPY . .
7 | RUN go build -ldflags "-s -w -X main.Version=${VERSION} -X main.Gitsha=${REVISION}" ./cmd/webhook
8 |
9 | FROM gcr.io/distroless/static-debian12:nonroot
10 | USER 8675:8675
11 | COPY --from=builder --chmod=555 /build/webhook /external-dns-opnsense-webhook
12 | EXPOSE 8888/tcp
13 | ENTRYPOINT ["/external-dns-opnsense-webhook"]
14 |
--------------------------------------------------------------------------------
/cmd/webhook/init/logging/log.go:
--------------------------------------------------------------------------------
1 | package logging
2 |
3 | import (
4 | "os"
5 |
6 | log "github.com/sirupsen/logrus"
7 | )
8 |
9 | func Init() {
10 | setLogLevel()
11 | setLogFormat()
12 | }
13 |
14 | func setLogFormat() {
15 | format := os.Getenv("LOG_FORMAT")
16 | if format == "test" {
17 | log.SetFormatter(&log.TextFormatter{})
18 | } else {
19 | log.SetFormatter(&log.JSONFormatter{})
20 | }
21 | }
22 |
23 | func setLogLevel() {
24 | level := os.Getenv("LOG_LEVEL")
25 | switch level {
26 | case "debug":
27 | log.SetLevel(log.DebugLevel)
28 | case "info":
29 | log.SetLevel(log.InfoLevel)
30 | case "warn":
31 | log.SetLevel(log.WarnLevel)
32 | case "error":
33 | log.SetLevel(log.ErrorLevel)
34 | default:
35 | log.SetLevel(log.InfoLevel)
36 | }
37 | }
38 |
--------------------------------------------------------------------------------
/internal/opnsense-unbound/utils.go:
--------------------------------------------------------------------------------
1 | package opnsense
2 |
3 | import "strings"
4 |
5 | // UnboundFQDNSplitter splits a DNSName into two parts,
6 | // [0] Being the top level hostname
7 | // [1] Being the subdomain/domain
8 | //
9 | // TODO: really this should return (hostname, domain string)
10 | func SplitUnboundFQDN(hostname string) []string {
11 | return strings.SplitN(hostname, ".", 2)
12 | }
13 |
14 | func JoinUnboundFQDN(hostname string, domain string) string {
15 | return strings.Join([]string{hostname, domain}, ".")
16 | }
17 |
18 | func PruneUnboundType(unboundType string) string {
19 | if i := strings.IndexByte(unboundType, ' '); i != -1 {
20 | return unboundType[:i]
21 | }
22 | return unboundType
23 | }
24 |
25 | func EmbellishUnboundType(unboundType string) string {
26 | switch unboundType {
27 | case "A":
28 | return unboundType + " (IPv4 address)"
29 | case "AAAA":
30 | return unboundType + " (IPv6 address)"
31 | case "TXT":
32 | return unboundType + " (Text record)"
33 | }
34 | return unboundType
35 | }
36 |
--------------------------------------------------------------------------------
/cmd/webhook/main.go:
--------------------------------------------------------------------------------
1 | package main
2 |
3 | import (
4 | "fmt"
5 |
6 | "github.com/crutonjohn/external-dns-opnsense-webhook/cmd/webhook/init/configuration"
7 | "github.com/crutonjohn/external-dns-opnsense-webhook/cmd/webhook/init/dnsprovider"
8 | "github.com/crutonjohn/external-dns-opnsense-webhook/cmd/webhook/init/logging"
9 | "github.com/crutonjohn/external-dns-opnsense-webhook/cmd/webhook/init/server"
10 | "github.com/crutonjohn/external-dns-opnsense-webhook/pkg/webhook"
11 | log "github.com/sirupsen/logrus"
12 | )
13 |
14 | const banner = `
15 | external-dns-opnsense-webhook
16 | version: %s (%s)
17 |
18 | `
19 |
20 | var (
21 | Version = "local"
22 | Gitsha = "?"
23 | )
24 |
25 | func main() {
26 | fmt.Printf(banner, Version, Gitsha)
27 |
28 | logging.Init()
29 |
30 | config := configuration.Init()
31 | provider, err := dnsprovider.Init(config)
32 | if err != nil {
33 | log.Fatalf("failed to initialize provider: %v", err)
34 | }
35 |
36 | main, health := server.Init(config, webhook.New(provider))
37 | server.ShutdownGracefully(main, health)
38 | }
39 |
--------------------------------------------------------------------------------
/pkg/webhook/mediatype.go:
--------------------------------------------------------------------------------
1 | package webhook
2 |
3 | import (
4 | "fmt"
5 | "strings"
6 | )
7 |
8 | const (
9 | mediaTypeFormat = "application/external.dns.webhook+json;"
10 | supportedMediaVersions = "1"
11 | )
12 |
13 | var mediaTypeVersion1 = mediaTypeVersion("1")
14 |
15 | type mediaType string
16 |
17 | func mediaTypeVersion(v string) mediaType {
18 | return mediaType(mediaTypeFormat + "version=" + v)
19 | }
20 |
21 | func (m mediaType) Is(headerValue string) bool {
22 | return string(m) == headerValue
23 | }
24 |
25 | func checkAndGetMediaTypeHeaderValue(value string) (string, error) {
26 | for _, v := range strings.Split(supportedMediaVersions, ",") {
27 | if mediaTypeVersion(v).Is(value) {
28 | return v, nil
29 | }
30 | }
31 |
32 | supportedMediaTypesString := ""
33 | for i, v := range strings.Split(supportedMediaVersions, ",") {
34 | sep := ""
35 | if i < len(supportedMediaVersions)-1 {
36 | sep = ", "
37 | }
38 | supportedMediaTypesString += string(mediaTypeVersion(v)) + sep
39 | }
40 | return "", fmt.Errorf("unsupported media type version: '%s'. supported media types are: '%s'", value, supportedMediaTypesString)
41 | }
42 |
--------------------------------------------------------------------------------
/cmd/webhook/init/configuration/configuration.go:
--------------------------------------------------------------------------------
1 | package configuration
2 |
3 | import (
4 | "time"
5 |
6 | "github.com/caarlos0/env/v11"
7 | log "github.com/sirupsen/logrus"
8 | )
9 |
10 | // Config struct for configuration environmental variables
11 | type Config struct {
12 | ServerHost string `env:"SERVER_HOST" envDefault:"localhost"`
13 | ServerPort int `env:"SERVER_PORT" envDefault:"8888"`
14 | ServerReadTimeout time.Duration `env:"SERVER_READ_TIMEOUT"`
15 | ServerWriteTimeout time.Duration `env:"SERVER_WRITE_TIMEOUT"`
16 | DomainFilter []string `env:"DOMAIN_FILTER" envDefault:""`
17 | ExcludeDomains []string `env:"EXCLUDE_DOMAIN_FILTER" envDefault:""`
18 | RegexDomainFilter string `env:"REGEXP_DOMAIN_FILTER" envDefault:""`
19 | RegexDomainExclusion string `env:"REGEXP_DOMAIN_FILTER_EXCLUSION" envDefault:""`
20 | }
21 |
22 | // Init sets up configuration by reading set environmental variables
23 | func Init() Config {
24 | cfg := Config{}
25 | if err := env.Parse(&cfg); err != nil {
26 | log.Fatalf("error reading configuration from environment: %v", err)
27 | }
28 | return cfg
29 | }
30 |
--------------------------------------------------------------------------------
/internal/opnsense-unbound/types.go:
--------------------------------------------------------------------------------
1 | package opnsense
2 |
3 | // Config represents the configuration for the UniFi API.
4 | type Config struct {
5 | Host string `env:"OPNSENSE_HOST,notEmpty"`
6 | Key string `env:"OPNSENSE_API_KEY,notEmpty"`
7 | Secret string `env:"OPNSENSE_API_SECRET,notEmpty"`
8 | SkipTLSVerify bool `env:"OPNSENSE_SKIP_TLS_VERIFY" envDefault:"true"`
9 | }
10 |
11 | // DNSRecord represents a DNS record in the Opnsense Unbound API.
12 | type DNSRecord struct {
13 | Uuid string `json:"uuid"`
14 | Enabled string `json:"enabled"`
15 | Hostname string `json:"hostname"`
16 | Domain string `json:"domain"`
17 | Rr string `json:"rr"`
18 | Server string `json:"server,omitempty"`
19 | Description string `json:"description,omitempty"`
20 | Mx string `json:"mx,omitempty"`
21 | MxPrio string `json:"mxprio,omitempty"`
22 | TxtData string `json:"txtdata,omitempty"`
23 | }
24 |
25 | // unboundRecordsList is the main item returned from the Opnsense Unbound API
26 | // since it has some decorators we just throw this struct away
27 | type unboundRecordsList struct {
28 | RowCount int `json:"rowCount"`
29 | Total int `json:"total"`
30 | Current int `json:"current"`
31 | Rows []DNSRecord `json:"Rows"`
32 | }
33 |
34 | // Specific format for POST against the Opnsense Unbound API
35 | type unboundAddHostOverride struct {
36 | Host DNSRecord `json:"host"`
37 | }
38 |
--------------------------------------------------------------------------------
/go.mod:
--------------------------------------------------------------------------------
1 | module github.com/crutonjohn/external-dns-opnsense-webhook
2 |
3 | go 1.22.2
4 |
5 | toolchain go1.22.3
6 |
7 | require (
8 | github.com/caarlos0/env/v11 v11.0.1
9 | github.com/go-chi/chi/v5 v5.0.12
10 | github.com/prometheus/client_golang v1.19.1
11 | github.com/sirupsen/logrus v1.9.3
12 | sigs.k8s.io/external-dns v0.14.2
13 | )
14 |
15 | require (
16 | github.com/aws/aws-sdk-go v1.53.9 // indirect
17 | github.com/beorn7/perks v1.0.1 // indirect
18 | github.com/cespare/xxhash/v2 v2.2.0 // indirect
19 | github.com/go-logr/logr v1.4.2 // indirect
20 | github.com/gogo/protobuf v1.3.2 // indirect
21 | github.com/google/go-cmp v0.6.0 // indirect
22 | github.com/google/gofuzz v1.2.0 // indirect
23 | github.com/jmespath/go-jmespath v0.4.0 // indirect
24 | github.com/json-iterator/go v1.1.12 // indirect
25 | github.com/kr/text v0.2.0 // indirect
26 | github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
27 | github.com/modern-go/reflect2 v1.0.2 // indirect
28 | github.com/prometheus/client_model v0.6.1 // indirect
29 | github.com/prometheus/common v0.53.0 // indirect
30 | github.com/prometheus/procfs v0.12.0 // indirect
31 | golang.org/x/net v0.25.0 // indirect
32 | golang.org/x/sys v0.20.0 // indirect
33 | golang.org/x/text v0.15.0 // indirect
34 | google.golang.org/protobuf v1.34.1 // indirect
35 | gopkg.in/inf.v0 v0.9.1 // indirect
36 | gopkg.in/yaml.v2 v2.4.0 // indirect
37 | k8s.io/apimachinery v0.30.1 // indirect
38 | k8s.io/klog/v2 v2.120.1 // indirect
39 | k8s.io/utils v0.0.0-20240502163921-fe8a2dddb1d0 // indirect
40 | sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
41 | sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
42 | )
43 |
--------------------------------------------------------------------------------
/.github/workflows/release.yaml:
--------------------------------------------------------------------------------
1 | ---
2 | name: Release
3 |
4 | on:
5 | pull_request:
6 | push:
7 | branches: ["main"]
8 | release:
9 | types: ["published"]
10 | workflow_dispatch:
11 |
12 | jobs:
13 | build-image:
14 | if: ${{ github.event.pull_request.head.repo.full_name == github.repository || github.event_name != 'pull_request' }}
15 | runs-on: ubuntu-latest
16 | permissions:
17 | contents: read
18 | packages: write
19 | steps:
20 | - name: Checkout
21 | uses: actions/checkout@v4
22 |
23 | - name: Docker meta
24 | id: meta
25 | uses: docker/metadata-action@v5
26 | with:
27 | images: |
28 | ghcr.io/${{ github.repository }}
29 | tags: |
30 | type=semver,pattern={{version}},prefix=v
31 | type=semver,pattern={{major}}.{{minor}},prefix=v
32 | type=semver,pattern={{major}},prefix=v
33 | type=ref,event=branch
34 | type=ref,event=pr
35 | flavor: |
36 | latest=auto
37 |
38 | - name: Set up QEMU
39 | uses: docker/setup-qemu-action@v3
40 |
41 | - name: Set up Docker Buildx
42 | uses: docker/setup-buildx-action@v3
43 |
44 | - name: Login to GitHub Container Registry
45 | uses: docker/login-action@v3
46 | with:
47 | registry: ghcr.io
48 | username: ${{ github.actor }}
49 | password: ${{ secrets.GITHUB_TOKEN }}
50 |
51 | - name: Build and Push
52 | uses: docker/build-push-action@v5
53 | with:
54 | context: .
55 | file: ./Dockerfile
56 | platforms: linux/amd64,linux/arm64
57 | push: true
58 | tags: ${{ steps.meta.outputs.tags }}
59 | labels: ${{ steps.meta.outputs.labels }}
60 | build-args: |
61 | VERSION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }}
62 | REVISION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}
63 |
--------------------------------------------------------------------------------
/cmd/webhook/init/dnsprovider/dnsprovider.go:
--------------------------------------------------------------------------------
1 | package dnsprovider
2 |
3 | import (
4 | "fmt"
5 | "regexp"
6 | "strings"
7 |
8 | "github.com/caarlos0/env/v11"
9 | "github.com/crutonjohn/external-dns-opnsense-webhook/cmd/webhook/init/configuration"
10 | "github.com/crutonjohn/external-dns-opnsense-webhook/internal/opnsense-unbound"
11 | "sigs.k8s.io/external-dns/endpoint"
12 | "sigs.k8s.io/external-dns/provider"
13 |
14 | log "github.com/sirupsen/logrus"
15 | )
16 |
17 | type OpnsenseProviderFactory func(baseProvider *provider.BaseProvider, opnsenseConfig *opnsense.Config) provider.Provider
18 |
19 | func Init(config configuration.Config) (provider.Provider, error) {
20 | var domainFilter endpoint.DomainFilter
21 | createMsg := "creating opnsense provider with "
22 |
23 | if config.RegexDomainFilter != "" {
24 | createMsg += fmt.Sprintf("regexp domain filter: '%s', ", config.RegexDomainFilter)
25 | if config.RegexDomainExclusion != "" {
26 | createMsg += fmt.Sprintf("with exclusion: '%s', ", config.RegexDomainExclusion)
27 | }
28 | domainFilter = endpoint.NewRegexDomainFilter(
29 | regexp.MustCompile(config.RegexDomainFilter),
30 | regexp.MustCompile(config.RegexDomainExclusion),
31 | )
32 | } else {
33 | if config.DomainFilter != nil && len(config.DomainFilter) > 0 {
34 | createMsg += fmt.Sprintf("domain filter: '%s', ", strings.Join(config.DomainFilter, ","))
35 | }
36 | if config.ExcludeDomains != nil && len(config.ExcludeDomains) > 0 {
37 | createMsg += fmt.Sprintf("exclude domain filter: '%s', ", strings.Join(config.ExcludeDomains, ","))
38 | }
39 | domainFilter = endpoint.NewDomainFilterWithExclusions(config.DomainFilter, config.ExcludeDomains)
40 | }
41 |
42 | createMsg = strings.TrimSuffix(createMsg, ", ")
43 | if strings.HasSuffix(createMsg, "with ") {
44 | createMsg += "no kind of domain filters"
45 | }
46 | log.Info(createMsg)
47 |
48 | opnsenseConfig := opnsense.Config{}
49 | if err := env.Parse(&opnsenseConfig); err != nil {
50 | return nil, fmt.Errorf("reading opnsense configuration failed: %v", err)
51 | }
52 |
53 | return opnsense.NewOpnsenseProvider(domainFilter, &opnsenseConfig)
54 | }
55 |
--------------------------------------------------------------------------------
/internal/opnsense-unbound/provider.go:
--------------------------------------------------------------------------------
1 | package opnsense
2 |
3 | import (
4 | "context"
5 | "fmt"
6 |
7 | log "github.com/sirupsen/logrus"
8 | "sigs.k8s.io/external-dns/endpoint"
9 | "sigs.k8s.io/external-dns/plan"
10 | "sigs.k8s.io/external-dns/provider"
11 | )
12 |
13 | // Provider type for interfacing with Opnsense
14 | type Provider struct {
15 | provider.BaseProvider
16 |
17 | client *httpClient
18 | domainFilter endpoint.DomainFilter
19 | }
20 |
21 | // NewOpnsenseProvider initializes a new DNSProvider.
22 | func NewOpnsenseProvider(domainFilter endpoint.DomainFilter, config *Config) (provider.Provider, error) {
23 | c, err := newOpnsenseClient(config)
24 |
25 | if err != nil {
26 | return nil, fmt.Errorf("provider: failed to create the opnsense client: %w", err)
27 | }
28 |
29 | p := &Provider{
30 | client: c,
31 | domainFilter: domainFilter,
32 | }
33 |
34 | return p, nil
35 | }
36 |
37 | // Records returns the list of HostOverride records in Opnsense Unbound.
38 | func (p *Provider) Records(ctx context.Context) ([]*endpoint.Endpoint, error) {
39 | log.Debugf("records: retrieving records from opnsense")
40 |
41 | records, err := p.client.GetHostOverrides()
42 | if err != nil {
43 | return nil, err
44 | }
45 |
46 | var endpoints []*endpoint.Endpoint
47 | for _, record := range records {
48 | var targets endpoint.Targets
49 | recordType := PruneUnboundType(record.Rr)
50 |
51 | if recordType == "TXT" {
52 | targets = endpoint.NewTargets(record.TxtData)
53 | } else {
54 | targets = endpoint.NewTargets(record.Server)
55 | }
56 |
57 | ep := &endpoint.Endpoint{
58 | DNSName: JoinUnboundFQDN(record.Hostname, record.Domain),
59 | RecordType: recordType,
60 | Targets: targets,
61 | }
62 |
63 | if !p.domainFilter.Match(ep.DNSName) {
64 | continue
65 | }
66 |
67 | endpoints = append(endpoints, ep)
68 | }
69 |
70 | log.Debugf("records: retrieved: %+v", endpoints)
71 |
72 | return endpoints, nil
73 | }
74 |
75 | // ApplyChanges applies a given set of changes in the DNS provider.
76 | func (p *Provider) ApplyChanges(ctx context.Context, changes *plan.Changes) error {
77 | for _, endpoint := range append(changes.UpdateOld, changes.Delete...) {
78 | if err := p.client.DeleteHostOverride(endpoint); err != nil {
79 | return err
80 | }
81 | }
82 |
83 | for _, endpoint := range append(changes.Create, changes.UpdateNew...) {
84 | if _, err := p.client.CreateHostOverride(endpoint); err != nil {
85 | return err
86 | }
87 | }
88 |
89 | p.client.ReconfigureUnbound()
90 |
91 | return nil
92 | }
93 |
94 | // GetDomainFilter returns the domain filter for the provider.
95 | func (p *Provider) GetDomainFilter() endpoint.DomainFilter {
96 | return p.domainFilter
97 | }
98 |
--------------------------------------------------------------------------------
/cmd/webhook/init/server/server.go:
--------------------------------------------------------------------------------
1 | package server
2 |
3 | import (
4 | "context"
5 | "errors"
6 | "fmt"
7 | "net/http"
8 | "os"
9 | "os/signal"
10 | "syscall"
11 | "time"
12 |
13 | "github.com/crutonjohn/external-dns-opnsense-webhook/cmd/webhook/init/configuration"
14 | "github.com/crutonjohn/external-dns-opnsense-webhook/pkg/webhook"
15 | "github.com/go-chi/chi/v5"
16 | "github.com/prometheus/client_golang/prometheus/promhttp"
17 |
18 | log "github.com/sirupsen/logrus"
19 | )
20 |
21 | // HealthCheckHandler returns the status of the service
22 | func HealthCheckHandler(w http.ResponseWriter, r *http.Request) {
23 | w.WriteHeader(http.StatusOK)
24 | w.Write([]byte("OK"))
25 | }
26 |
27 | // ReadinessHandler returns whether the service is ready to accept requests
28 | func ReadinessHandler(w http.ResponseWriter, r *http.Request) {
29 | w.WriteHeader(http.StatusOK)
30 | w.Write([]byte("OK"))
31 | }
32 |
33 | // Init initializes the http server
34 | func Init(config configuration.Config, p *webhook.Webhook) (*http.Server, *http.Server) {
35 | mainRouter := chi.NewRouter()
36 | mainRouter.Get("/", p.Negotiate)
37 | mainRouter.Get("/records", p.Records)
38 | mainRouter.Post("/records", p.ApplyChanges)
39 | mainRouter.Post("/adjustendpoints", p.AdjustEndpoints)
40 |
41 | mainServer := createHTTPServer(fmt.Sprintf("%s:%d", config.ServerHost, config.ServerPort), mainRouter, config.ServerReadTimeout, config.ServerWriteTimeout)
42 | go func() {
43 | log.Infof("starting server on addr: '%s' ", mainServer.Addr)
44 | if err := mainServer.ListenAndServe(); err != nil && !errors.Is(err, http.ErrServerClosed) {
45 | log.Errorf("can't serve on addr: '%s', error: %v", mainServer.Addr, err)
46 | }
47 | }()
48 |
49 | healthRouter := chi.NewRouter()
50 | healthRouter.Get("/metrics", promhttp.Handler().ServeHTTP)
51 | healthRouter.Get("/healthz", HealthCheckHandler)
52 | healthRouter.Get("/readyz", ReadinessHandler)
53 |
54 | healthServer := createHTTPServer("0.0.0.0:8080", healthRouter, config.ServerReadTimeout, config.ServerWriteTimeout)
55 | go func() {
56 | log.Infof("starting health server on addr: '%s' ", healthServer.Addr)
57 | if err := healthServer.ListenAndServe(); err != nil && !errors.Is(err, http.ErrServerClosed) {
58 | log.Errorf("can't serve health on addr: '%s', error: %v", healthServer.Addr, err)
59 | }
60 | }()
61 |
62 | return mainServer, healthServer
63 | }
64 |
65 | func createHTTPServer(addr string, hand http.Handler, readTimeout, writeTimeout time.Duration) *http.Server {
66 | return &http.Server{
67 | ReadTimeout: readTimeout,
68 | WriteTimeout: writeTimeout,
69 | Addr: addr,
70 | Handler: hand,
71 | }
72 | }
73 |
74 | // ShutdownGracefully gracefully shutdown the http server
75 | func ShutdownGracefully(mainServer *http.Server, healthServer *http.Server) {
76 | sigCh := make(chan os.Signal, 1)
77 | signal.Notify(sigCh, syscall.SIGHUP, syscall.SIGINT, syscall.SIGTERM, syscall.SIGQUIT)
78 | sig := <-sigCh
79 |
80 | log.Infof("shutting down servers due to received signal: %v", sig)
81 | ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
82 | defer cancel()
83 |
84 | if err := mainServer.Shutdown(ctx); err != nil {
85 | log.Errorf("error shutting down main server: %v", err)
86 | }
87 |
88 | if err := healthServer.Shutdown(ctx); err != nil {
89 | log.Errorf("error shutting down health server: %v", err)
90 | }
91 | }
92 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # ExternalDNS Webhook Provider for OPNsense
2 |
3 |
4 |
5 | [](https://github.com/opnsense/external-dns-opnsense-webhook/releases)
6 | [](https://discord.gg/home-operations)
7 |
8 |
9 |
10 | This webhook graciously ~~stolen~~ inspired by [Kashall's Unifi Webhook](https://github.com/kashalls/external-dns-unifi-webhook).
11 |
12 | > [!WARNING]
13 | > This software is experimental and **NOT FIT FOR PRODUCTION USE!**
14 |
15 | [ExternalDNS](https://github.com/kubernetes-sigs/external-dns) is a Kubernetes add-on for automatically managing DNS records for Kubernetes ingresses and services by using different DNS providers. This webhook provider allows you to automate DNS records from your Kubernetes clusters into your OPNsense Firewall's Unbound service.
16 |
17 | ## 🗒️ Important Notes
18 |
19 | As of this writing this webhook supports A, AAAA, and TXT records using Unbound's Host Overrides. A/AAAA/TXT records work because they effectively map 1:1 with Host Overrides.
20 |
21 | With significantly more effort, CNAMEs could be supported and mapped to Host Override Aliases, which may be implemented in the future.
22 |
23 | > [!NOTE]
24 | > TXT record support requires OPNsense >= 25.7 or later versions with TXT record support in Unbound.
25 |
26 | ### Structuring Your Unbound Records
27 |
28 | > [!WARNING]
29 | > If you don't follow this **manually entered A/AAAA records can be permanently destroyed**
30 |
31 | If you have records that are managed manually or by some process other than this webhook and you intend for those records to share a domain, then you must structure them in a way that avoids conflict. The webhook examines all records defined in Host Overrides but does **not** evaluate any Aliases. To avoid ownership conflicts you should create a "stub" Host Override pointing to your intended IP address, then create aliases that use your desired domain.
32 |
33 | For example:
34 |
35 | - You run the webhook with the domain filter set for `example.com`
36 | - You have manually created a Host Override for `host1.example.com` in OPNSense's Unbound Web UI pointed to `192.168.10.2`.
37 |
38 | You will need to:
39 | - Create a new Host Override with a different domain such as `host1.fake.com` pointing to `192.168.10.2`
40 | - Create an Alias under `host1.fake.com` that uses the original domain like `host1.example.com`
41 |
42 | This effecively protects your record from ownership conflicts while still allowing you to define custom records for a domain used by this webhook. Another option would be to create `dnsendpoint` CRDs for all the records you need in Unbound and let the webhook manage everything.
43 |
44 | ## 🎯 Requirements
45 |
46 | - ExternalDNS >= v0.14.0
47 | - OPNsense >= 23.7.12_5
48 | - Unbound >= 1.19.0
49 |
50 | ## ⛵ Deployment
51 |
52 | 1. Create a local user with a password in your OPNsense firewall. `System > Access > Users`
53 |
54 | 2. Create an API keypair for the user you created in step 1.
55 |
56 | 3. Create (or use an existing) group to limit your user's permissions. The known required privileges are:
57 | - `Services: Unbound DNS: Edit Host and Domain Override`
58 | - `Services: Unbound (MVC)`
59 | - `Status: DNS Overview`
60 |
61 | 4. Add the ExternalDNS Helm repository to your cluster.
62 |
63 | ```sh
64 | helm repo add external-dns https://kubernetes-sigs.github.io/external-dns/
65 | ```
66 |
67 | 5. Create a Kubernetes secret called `external-dns-opnsense-secret` that holds `api_key` and `api_secret` with their respective values from step 1:
68 |
69 | ```yaml
70 | apiVersion: v1
71 | stringData:
72 | api_secret:
73 | api_key:
74 | kind: Secret
75 | metadata:
76 | name: external-dns-opnsense-secret
77 | type: Opaque
78 | ```
79 |
80 | 6. Create the helm values file, for example `external-dns-webhook-values.yaml`:
81 |
82 | ```yaml
83 | fullnameOverride: external-dns-opnsense
84 | logLevel: debug
85 | provider:
86 | name: webhook
87 | webhook:
88 | image:
89 | repository: ghcr.io/crutonjohn/external-dns-opnsense-webhook
90 | tag: main # replace with a versioned release tag
91 | env:
92 | - name: OPNSENSE_API_SECRET
93 | valueFrom:
94 | secretKeyRef:
95 | name: external-dns-opnsense-secret
96 | key: api_secret
97 | - name: OPNSENSE_API_KEY
98 | valueFrom:
99 | secretKeyRef:
100 | name: external-dns-opnsense-secret
101 | key: api_key
102 | - name: OPNSENSE_HOST
103 | value: https://192.168.1.1 # replace with the address to your OPNsense router
104 | - name: OPNSENSE_SKIP_TLS_VERIFY
105 | value: "true" # optional depending on your environment
106 | - name: LOG_LEVEL
107 | value: debug
108 | livenessProbe:
109 | httpGet:
110 | path: /healthz
111 | port: http-wh-metrics
112 | initialDelaySeconds: 10
113 | timeoutSeconds: 5
114 | readinessProbe:
115 | httpGet:
116 | path: /readyz
117 | port: http-wh-metrics
118 | initialDelaySeconds: 10
119 | timeoutSeconds: 5
120 | extraArgs:
121 | - --ignore-ingress-tls-spec
122 | policy: sync
123 | sources: ["ingress", "service", "crd"]
124 | registry: noop
125 | domainFilters: ["example.com"] # replace with your domain
126 | ```
127 |
128 | 7. Install the Helm chart
129 |
130 | ```sh
131 | helm install external-dns-opnsense external-dns/external-dns -f external-dns-opnsense-values yaml --version 1.14.3 -n external-dns
132 | ```
133 |
134 | ---
135 |
136 | ## 👷 Building & Testing
137 |
138 | Build:
139 |
140 | ```sh
141 | go build -ldflags "-s -w -X main.Version=test -X main.Gitsha=test" ./cmd/webhook
142 | ```
143 |
144 | Run:
145 |
146 | ```sh
147 | OPNSENSE_HOST=https://192.168.0.1 OPNSENSE_API_SECRET= OPNSENSE_API_KEY= ./webhook
148 | ```
149 |
150 | ---
151 |
152 | ## 🤝 Gratitude and Thanks
153 |
154 | Thanks to all the people who donate their time to the [Home Operations](https://discord.gg/home-operations) Discord community.
155 |
156 | I'd like to thank the following people for answering my hare-brained questions:
157 | - @kashalls
158 | - @onedr0p
159 | - @uhthomas
160 | - @tyzbit
161 | - @buroa
162 |
--------------------------------------------------------------------------------
/pkg/webhook/webhook.go:
--------------------------------------------------------------------------------
1 | package webhook
2 |
3 | import (
4 | "encoding/json"
5 | "fmt"
6 | "net/http"
7 |
8 | log "github.com/sirupsen/logrus"
9 |
10 | "sigs.k8s.io/external-dns/endpoint"
11 | "sigs.k8s.io/external-dns/plan"
12 | "sigs.k8s.io/external-dns/provider"
13 | )
14 |
15 | const (
16 | contentTypeHeader = "Content-Type"
17 | contentTypePlaintext = "text/plain"
18 | acceptHeader = "Accept"
19 | varyHeader = "Vary"
20 | logFieldRequestPath = "requestPath"
21 | logFieldRequestMethod = "requestMethod"
22 | logFieldError = "error"
23 | )
24 |
25 | // Webhook for external dns provider
26 | type Webhook struct {
27 | provider provider.Provider
28 | }
29 |
30 | // New creates a new instance of the Webhook
31 | func New(provider provider.Provider) *Webhook {
32 | p := Webhook{provider: provider}
33 | return &p
34 | }
35 |
36 | func (p *Webhook) contentTypeHeaderCheck(w http.ResponseWriter, r *http.Request) error {
37 | return p.headerCheck(true, w, r)
38 | }
39 |
40 | func (p *Webhook) acceptHeaderCheck(w http.ResponseWriter, r *http.Request) error {
41 | return p.headerCheck(false, w, r)
42 | }
43 |
44 | func (p *Webhook) headerCheck(isContentType bool, w http.ResponseWriter, r *http.Request) error {
45 | var header string
46 | if isContentType {
47 | header = r.Header.Get(contentTypeHeader)
48 | } else {
49 | header = r.Header.Get(acceptHeader)
50 | }
51 |
52 | if len(header) == 0 {
53 | w.Header().Set(contentTypeHeader, contentTypePlaintext)
54 | w.WriteHeader(http.StatusNotAcceptable)
55 |
56 | msg := "client must provide "
57 | if isContentType {
58 | msg += "a content type"
59 | } else {
60 | msg += "an accept header"
61 | }
62 | err := fmt.Errorf(msg)
63 |
64 | _, writeErr := fmt.Fprint(w, err.Error())
65 | if writeErr != nil {
66 | requestLog(r).WithField(logFieldError, writeErr).Fatalf("error writing error message to response writer")
67 | }
68 | return err
69 | }
70 |
71 | // as we support only one media type version, we can ignore the returned value
72 | if _, err := checkAndGetMediaTypeHeaderValue(header); err != nil {
73 | w.Header().Set(contentTypeHeader, contentTypePlaintext)
74 | w.WriteHeader(http.StatusUnsupportedMediaType)
75 |
76 | msg := "client must provide a valid versioned media type in the "
77 | if isContentType {
78 | msg += "content type"
79 | } else {
80 | msg += "accept header"
81 | }
82 |
83 | err := fmt.Errorf(msg+": %s", err.Error())
84 | _, writeErr := fmt.Fprint(w, err.Error())
85 | if writeErr != nil {
86 | requestLog(r).WithField(logFieldError, writeErr).Fatalf("error writing error message to response writer")
87 | }
88 | return err
89 | }
90 |
91 | return nil
92 | }
93 |
94 | // Records handles the get request for records
95 | func (p *Webhook) Records(w http.ResponseWriter, r *http.Request) {
96 | if err := p.acceptHeaderCheck(w, r); err != nil {
97 | requestLog(r).WithField(logFieldError, err).Error("accept header check failed")
98 | return
99 | }
100 |
101 | requestLog(r).Debug("requesting records")
102 | ctx := r.Context()
103 | records, err := p.provider.Records(ctx)
104 | if err != nil {
105 | requestLog(r).WithField(logFieldError, err).Error("error getting records")
106 | w.WriteHeader(http.StatusInternalServerError)
107 | return
108 | }
109 |
110 | requestLog(r).Debugf("returning records count: %d", len(records))
111 | w.Header().Set(contentTypeHeader, string(mediaTypeVersion1))
112 | w.Header().Set(varyHeader, contentTypeHeader)
113 | err = json.NewEncoder(w).Encode(records)
114 | if err != nil {
115 | requestLog(r).WithField(logFieldError, err).Error("error encoding records")
116 | w.WriteHeader(http.StatusInternalServerError)
117 | return
118 | }
119 | }
120 |
121 | // ApplyChanges handles the post request for record changes
122 | func (p *Webhook) ApplyChanges(w http.ResponseWriter, r *http.Request) {
123 | if err := p.contentTypeHeaderCheck(w, r); err != nil {
124 | requestLog(r).WithField(logFieldError, err).Error("content type header check failed")
125 | return
126 | }
127 |
128 | var changes plan.Changes
129 | ctx := r.Context()
130 | if err := json.NewDecoder(r.Body).Decode(&changes); err != nil {
131 | w.Header().Set(contentTypeHeader, contentTypePlaintext)
132 | w.WriteHeader(http.StatusBadRequest)
133 |
134 | errMsg := fmt.Sprintf("error decoding changes: %s", err.Error())
135 | if _, writeError := fmt.Fprint(w, errMsg); writeError != nil {
136 | requestLog(r).WithField(logFieldError, writeError).Fatalf("error writing error message to response writer")
137 | }
138 | requestLog(r).WithField(logFieldError, err).Info(errMsg)
139 | return
140 | }
141 |
142 | requestLog(r).Debugf("requesting apply changes, create: %d , updateOld: %d, updateNew: %d, delete: %d",
143 | len(changes.Create), len(changes.UpdateOld), len(changes.UpdateNew), len(changes.Delete))
144 | if err := p.provider.ApplyChanges(ctx, &changes); err != nil {
145 | w.Header().Set(contentTypeHeader, contentTypePlaintext)
146 | w.WriteHeader(http.StatusInternalServerError)
147 | return
148 | }
149 | w.WriteHeader(http.StatusNoContent)
150 | }
151 |
152 | // AdjustEndpoints handles the post request for adjusting endpoints
153 | func (p *Webhook) AdjustEndpoints(w http.ResponseWriter, r *http.Request) {
154 | if err := p.contentTypeHeaderCheck(w, r); err != nil {
155 | log.Errorf("content type header check failed, request method: %s, request path: %s", r.Method, r.URL.Path)
156 | return
157 | }
158 | if err := p.acceptHeaderCheck(w, r); err != nil {
159 | log.Errorf("accept header check failed, request method: %s, request path: %s", r.Method, r.URL.Path)
160 | return
161 | }
162 |
163 | var pve []*endpoint.Endpoint
164 | if err := json.NewDecoder(r.Body).Decode(&pve); err != nil {
165 | w.Header().Set(contentTypeHeader, contentTypePlaintext)
166 | w.WriteHeader(http.StatusBadRequest)
167 |
168 | errMessage := fmt.Sprintf("failed to decode request body: %v", err)
169 | log.Infof(errMessage+" , request method: %s, request path: %s", r.Method, r.URL.Path)
170 | if _, writeError := fmt.Fprint(w, errMessage); writeError != nil {
171 | requestLog(r).WithField(logFieldError, writeError).Fatalf("error writing error message to response writer")
172 | }
173 | return
174 | }
175 |
176 | log.Debugf("requesting adjust endpoints count: %d", len(pve))
177 | pve, err := p.provider.AdjustEndpoints(pve)
178 | if err != nil {
179 | w.Header().Set(contentTypeHeader, contentTypePlaintext)
180 | w.WriteHeader(http.StatusInternalServerError)
181 | return
182 | }
183 | out, _ := json.Marshal(&pve)
184 |
185 | log.Debugf("return adjust endpoints response, resultEndpointCount: %d", len(pve))
186 | w.Header().Set(contentTypeHeader, string(mediaTypeVersion1))
187 | w.Header().Set(varyHeader, contentTypeHeader)
188 | if _, writeError := fmt.Fprint(w, string(out)); writeError != nil {
189 | requestLog(r).WithField(logFieldError, writeError).Fatalf("error writing response")
190 | }
191 | }
192 |
193 | func (p *Webhook) Negotiate(w http.ResponseWriter, r *http.Request) {
194 | if err := p.acceptHeaderCheck(w, r); err != nil {
195 | requestLog(r).WithField(logFieldError, err).Error("accept header check failed")
196 | return
197 | }
198 |
199 | b, err := p.provider.GetDomainFilter().MarshalJSON()
200 | if err != nil {
201 | log.Errorf("failed to marshal domain filter, request method: %s, request path: %s", r.Method, r.URL.Path)
202 | w.WriteHeader(http.StatusInternalServerError)
203 | return
204 | }
205 |
206 | w.Header().Set(contentTypeHeader, string(mediaTypeVersion1))
207 | if _, writeError := w.Write(b); writeError != nil {
208 | requestLog(r).WithField(logFieldError, writeError).Error("error writing response")
209 | w.WriteHeader(http.StatusInternalServerError)
210 | return
211 | }
212 | }
213 |
214 | func requestLog(r *http.Request) *log.Entry {
215 | return log.WithFields(log.Fields{logFieldRequestMethod: r.Method, logFieldRequestPath: r.URL.Path})
216 | }
217 |
--------------------------------------------------------------------------------
/internal/opnsense-unbound/client.go:
--------------------------------------------------------------------------------
1 | package opnsense
2 |
3 | import (
4 | "bytes"
5 | "crypto/tls"
6 | "encoding/base64"
7 | "encoding/json"
8 | "fmt"
9 | "io"
10 | "net/http"
11 | "net/url"
12 | "path"
13 | "strings"
14 |
15 | log "github.com/sirupsen/logrus"
16 | "sigs.k8s.io/external-dns/endpoint"
17 | )
18 |
19 | const emptyJSONObject = "{}"
20 |
21 | // httpClient is the DNS provider client.
22 | type httpClient struct {
23 | *Config
24 | *http.Client
25 | baseURL *url.URL
26 | }
27 |
28 | // newOpnsenseClient creates a new DNS provider client.
29 | func newOpnsenseClient(config *Config) (*httpClient, error) {
30 | u, err := url.Parse(config.Host)
31 | if err != nil {
32 | return nil, fmt.Errorf("parse url: %w", err)
33 | }
34 |
35 | // Ensure the base path is correctly set
36 | basePath, err := url.Parse("api/unbound/")
37 | if err != nil {
38 | return nil, fmt.Errorf("parse base path: %w", err)
39 | }
40 | u = u.ResolveReference(basePath)
41 |
42 | // Create the HTTP client
43 | client := &httpClient{
44 | Config: config,
45 | Client: &http.Client{
46 | Transport: &http.Transport{
47 | TLSClientConfig: &tls.Config{InsecureSkipVerify: config.SkipTLSVerify},
48 | },
49 | },
50 | baseURL: u,
51 | }
52 |
53 | if err := client.login(); err != nil {
54 | return nil, err
55 | }
56 |
57 | return client, nil
58 | }
59 |
60 | // login performs a basic call to validate credentials
61 | func (c *httpClient) login() error {
62 | // Perform the test call by getting service status
63 | resp, err := c.doRequest(
64 | http.MethodGet,
65 | "service/status",
66 | nil,
67 | )
68 | if err != nil {
69 | return err
70 | }
71 |
72 | defer resp.Body.Close()
73 |
74 | // Check if the login was successful
75 | if resp.StatusCode != http.StatusOK {
76 | respBody, _ := io.ReadAll(resp.Body)
77 | log.Errorf("login: failed: %s, response: %s", resp.Status, string(respBody))
78 | return fmt.Errorf("login: failed: %s", resp.Status)
79 | }
80 |
81 | return nil
82 | }
83 |
84 | // doRequest makes an HTTP request to the Opnsense firewall.
85 | func (c *httpClient) doRequest(method, path string, body io.Reader) (*http.Response, error) {
86 | u := c.baseURL.ResolveReference(&url.URL{
87 | Path: path,
88 | })
89 |
90 | log.Debugf("doRequest: making %s request to %s", method, u)
91 |
92 | req, err := http.NewRequest(method, u.String(), body)
93 | if err != nil {
94 | return nil, err
95 | }
96 |
97 | c.setHeaders(req)
98 |
99 | resp, err := c.Client.Do(req)
100 | if err != nil {
101 | return nil, err
102 | }
103 |
104 | log.Debugf("doRequest: response code from %s request to %s: %d", method, u, resp.StatusCode)
105 |
106 | if resp.StatusCode != http.StatusOK {
107 | defer resp.Body.Close()
108 | return nil, fmt.Errorf("doRequest: %s request to %s was not successful: %d", method, u, resp.StatusCode)
109 | }
110 |
111 | return resp, nil
112 | }
113 |
114 | // GetHostOverrides retrieves the list of HostOverrides from the Opnsense Firewall's Unbound API.
115 | // These are equivalent to A, AAAA, or TXT records
116 | func (c *httpClient) GetHostOverrides() ([]DNSRecord, error) {
117 | resp, err := c.doRequest(
118 | http.MethodGet,
119 | "settings/searchHostOverride",
120 | nil,
121 | )
122 | if err != nil {
123 | return nil, err
124 | }
125 | defer resp.Body.Close()
126 |
127 | var records unboundRecordsList
128 | if err = json.NewDecoder(resp.Body).Decode(&records); err != nil {
129 | return nil, err
130 | }
131 |
132 | log.Debugf("gethost: retrieved records: %+v", records.Rows)
133 |
134 | if records.Rows == nil {
135 | return []DNSRecord{}, nil
136 | }
137 | return records.Rows, nil
138 | }
139 |
140 | // CreateHostOverride creates a new DNS A, AAAA, or TXT record in the Opnsense Firewall's Unbound API.
141 | func (c *httpClient) CreateHostOverride(endpoint *endpoint.Endpoint) (*DNSRecord, error) {
142 | log.Debugf("create: Try pulling pre-existing Unbound %s record: %s", endpoint.RecordType, endpoint.DNSName)
143 | lookup, err := c.lookupHostOverrideIdentifier(endpoint.DNSName, endpoint.RecordType)
144 | if err != nil {
145 | return nil, err
146 | }
147 |
148 | if lookup != nil {
149 | log.Debugf("create: Found uuid: %s", lookup.Uuid)
150 | log.Debugf("create: Found existing %s record for %s : %s", endpoint.RecordType, endpoint.DNSName, lookup.Uuid)
151 | return lookup, nil
152 | }
153 |
154 | splitHost := SplitUnboundFQDN(endpoint.DNSName)
155 |
156 | record := DNSRecord{
157 | Enabled: "1",
158 | Rr: endpoint.RecordType,
159 | Hostname: splitHost[0],
160 | Domain: splitHost[1],
161 | }
162 |
163 | if endpoint.RecordType == "TXT" {
164 | record.TxtData = endpoint.Targets[0]
165 | } else {
166 | record.Server = endpoint.Targets[0]
167 | }
168 |
169 | jsonBody, err := json.Marshal(unboundAddHostOverride{
170 | Host: record,
171 | })
172 | if err != nil {
173 | return nil, err
174 | }
175 |
176 | log.Debugf("create: POST: %s", string(jsonBody))
177 | resp, err := c.doRequest(
178 | http.MethodPost,
179 | "settings/addHostOverride",
180 | bytes.NewReader(jsonBody),
181 | )
182 | if err != nil {
183 | return nil, err
184 | }
185 | defer resp.Body.Close()
186 |
187 | // TODO: Better error handling if API returns:
188 | // {"result":"failed"}
189 | //if resp.Body != nil && resp.Body
190 |
191 | var respRecord unboundAddHostOverride
192 | if err = json.NewDecoder(resp.Body).Decode(&respRecord); err != nil {
193 | return nil, err
194 | }
195 | log.Debugf("create: created record: %+v", respRecord)
196 |
197 | return nil, nil
198 | }
199 |
200 | // DeleteHostOverride deletes a DNS record from the Opnsense Firewall's Unbound API.
201 | func (c *httpClient) DeleteHostOverride(endpoint *endpoint.Endpoint) error {
202 | log.Debugf("delete: Deleting record %+v", endpoint)
203 | lookup, err := c.lookupHostOverrideIdentifier(endpoint.DNSName, endpoint.RecordType)
204 | if err != nil {
205 | return err
206 | }
207 |
208 | log.Debugf("delete: Found match %s", lookup.Uuid)
209 |
210 | log.Debugf("delete: Sending POST %s", lookup.Uuid)
211 | resp, err := c.doRequest(
212 | http.MethodPost,
213 | path.Join("settings/delHostOverride", lookup.Uuid),
214 | strings.NewReader(emptyJSONObject),
215 | )
216 | if err != nil {
217 | return err
218 | }
219 | defer resp.Body.Close()
220 |
221 | return nil
222 | }
223 |
224 | // lookupHostOverrideIdentifier finds a HostOverride in the Opnsense Firewall's Unbound API.
225 | func (c *httpClient) lookupHostOverrideIdentifier(key, recordType string) (*DNSRecord, error) {
226 | records, err := c.GetHostOverrides()
227 | if err != nil {
228 | return nil, err
229 | }
230 | log.Debug("lookup: Splitting FQDN")
231 | splitHost := SplitUnboundFQDN(key)
232 |
233 | for _, r := range records {
234 | log.Debugf("lookup: Checking record: Host=%s, Domain=%s, Type=%s, UUID=%s", r.Hostname, r.Domain, EmbellishUnboundType(r.Rr), r.Uuid)
235 | if r.Hostname == splitHost[0] && r.Domain == splitHost[1] && EmbellishUnboundType(r.Rr) == EmbellishUnboundType(recordType) {
236 | log.Debugf("lookup: UUID Match Found: %s", r.Uuid)
237 | return &r, nil
238 | }
239 | }
240 | log.Debugf("lookup: No matching record found for Host=%s, Domain=%s, Type=%s", splitHost[0], splitHost[1], EmbellishUnboundType(recordType))
241 | return nil, nil
242 | }
243 |
244 | // ReconfigureUnbound performs a reconfigure action in Unbound after editing records
245 | func (c *httpClient) ReconfigureUnbound() error {
246 | // Perform the reconfigure
247 | resp, err := c.doRequest(
248 | http.MethodPost,
249 | "service/reconfigure",
250 | strings.NewReader(emptyJSONObject),
251 | )
252 | if err != nil {
253 | return err
254 | }
255 |
256 | defer resp.Body.Close()
257 |
258 | // Check if the login was successful
259 | if resp.StatusCode != http.StatusOK {
260 | respBody, _ := io.ReadAll(resp.Body)
261 | log.Errorf("reconfigure: login failed: %s, response: %s", resp.Status, string(respBody))
262 | return fmt.Errorf("reconfigure: unbound failed: %s", resp.Status)
263 | }
264 |
265 | return nil
266 | }
267 |
268 | // setHeaders sets the headers for the HTTP request.
269 | func (c *httpClient) setHeaders(req *http.Request) {
270 | // Add basic auth header
271 | opnsenseAuth := base64.StdEncoding.EncodeToString([]byte(fmt.Sprintf("%s:%s", c.Config.Key, c.Config.Secret)))
272 | req.Header.Add("Authorization", fmt.Sprintf("Basic %s", opnsenseAuth))
273 | req.Header.Add("Accept", "application/json")
274 | if req.Method != http.MethodGet {
275 | req.Header.Add("Content-Type", "application/json; charset=utf-8")
276 | }
277 | // Log the request URL
278 | log.Debugf("headers: Requesting %s", req.URL)
279 | }
280 |
--------------------------------------------------------------------------------
/go.sum:
--------------------------------------------------------------------------------
1 | github.com/aws/aws-sdk-go v1.53.9 h1:6oipls9+L+l2Me5rklqlX3xGWNWGcMinY3F69q9Q+Cg=
2 | github.com/aws/aws-sdk-go v1.53.9/go.mod h1:LF8svs817+Nz+DmiMQKTO3ubZ/6IaTpq3TjupRn3Eqk=
3 | github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
4 | github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
5 | github.com/caarlos0/env/v11 v11.0.1 h1:A8dDt9Ub9ybqRSUF3fQc/TA/gTam2bKT4Pit+cwrsPs=
6 | github.com/caarlos0/env/v11 v11.0.1/go.mod h1:2RC3HQu8BQqtEK3V4iHPxj0jOdWdbPpWJ6pOueeU1xM=
7 | github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44=
8 | github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
9 | github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
10 | github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
11 | github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
12 | github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
13 | github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
14 | github.com/go-chi/chi/v5 v5.0.12 h1:9euLV5sTrTNTRUU9POmDUvfxyj6LAABLUcEWO+JJb4s=
15 | github.com/go-chi/chi/v5 v5.0.12/go.mod h1:DslCQbL2OYiznFReuXYUmQ2hGd1aDpCnlMNITLSKoi8=
16 | github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
17 | github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
18 | github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
19 | github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
20 | github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
21 | github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
22 | github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
23 | github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
24 | github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
25 | github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
26 | github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
27 | github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
28 | github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
29 | github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
30 | github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
31 | github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
32 | github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
33 | github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
34 | github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
35 | github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
36 | github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
37 | github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
38 | github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
39 | github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
40 | github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
41 | github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
42 | github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
43 | github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
44 | github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
45 | github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
46 | github.com/prometheus/client_golang v1.19.1 h1:wZWJDwK+NameRJuPGDhlnFgx8e8HN3XHQeLaYJFJBOE=
47 | github.com/prometheus/client_golang v1.19.1/go.mod h1:mP78NwGzrVks5S2H6ab8+ZZGJLZUq1hoULYBAYBw1Ho=
48 | github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=
49 | github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=
50 | github.com/prometheus/common v0.53.0 h1:U2pL9w9nmJwJDa4qqLQ3ZaePJ6ZTwt7cMD3AG3+aLCE=
51 | github.com/prometheus/common v0.53.0/go.mod h1:BrxBKv3FWBIGXw89Mg1AeBq7FSyRzXWI3l3e7W3RN5U=
52 | github.com/prometheus/procfs v0.12.0 h1:jluTpSng7V9hY0O2R9DzzJHYb2xULk9VTR1V1R/k6Bo=
53 | github.com/prometheus/procfs v0.12.0/go.mod h1:pcuDEFsWDnvcgNzo4EEweacyhjeA9Zk3cnaOZAZEfOo=
54 | github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
55 | github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog=
56 | github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
57 | github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
58 | github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
59 | github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
60 | github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
61 | github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
62 | github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
63 | github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
64 | github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
65 | github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
66 | github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
67 | github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
68 | github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
69 | golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
70 | golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
71 | golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
72 | golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
73 | golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
74 | golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
75 | golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
76 | golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
77 | golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
78 | golang.org/x/net v0.25.0 h1:d/OCCoBEUq33pjydKrGQhw7IlUPI2Oylr+8qLx49kac=
79 | golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
80 | golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
81 | golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
82 | golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
83 | golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
84 | golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
85 | golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
86 | golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
87 | golang.org/x/sys v0.20.0 h1:Od9JTbYCk261bKm4M/mw7AklTlFYIa0bIp9BgSm1S8Y=
88 | golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
89 | golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
90 | golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
91 | golang.org/x/text v0.15.0 h1:h1V/4gjBv8v9cjcR6+AR5+/cIYK5N/WAgiv4xlsEtAk=
92 | golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
93 | golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
94 | golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
95 | golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
96 | golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
97 | golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
98 | golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
99 | golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
100 | golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
101 | google.golang.org/protobuf v1.34.1 h1:9ddQBjfCyZPOHPUiPxpYESBLc+T8P3E+Vo4IbKZgFWg=
102 | google.golang.org/protobuf v1.34.1/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
103 | gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
104 | gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
105 | gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
106 | gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
107 | gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
108 | gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
109 | gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
110 | gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
111 | gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
112 | gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
113 | gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
114 | k8s.io/apimachinery v0.30.1 h1:ZQStsEfo4n65yAdlGTfP/uSHMQSoYzU/oeEbkmF7P2U=
115 | k8s.io/apimachinery v0.30.1/go.mod h1:iexa2somDaxdnj7bha06bhb43Zpa6eWH8N8dbqVjTUc=
116 | k8s.io/klog/v2 v2.120.1 h1:QXU6cPEOIslTGvZaXvFWiP9VKyeet3sawzTOvdXb4Vw=
117 | k8s.io/klog/v2 v2.120.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
118 | k8s.io/utils v0.0.0-20240502163921-fe8a2dddb1d0 h1:jgGTlFYnhF1PM1Ax/lAlxUPE+KfCIXHaathvJg1C3ak=
119 | k8s.io/utils v0.0.0-20240502163921-fe8a2dddb1d0/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
120 | sigs.k8s.io/external-dns v0.14.2 h1:j7rYtQqDAxYfN9N1/BZcRdzUBRsnZp4tZcuZ75ekTlc=
121 | sigs.k8s.io/external-dns v0.14.2/go.mod h1:GTFER2cqUxkSpYNzzkge8USXp1wJmxqWwpdXr2lYdik=
122 | sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
123 | sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
124 | sigs.k8s.io/structured-merge-diff/v4 v4.4.1 h1:150L+0vs/8DA78h1u02ooW1/fFq/Lwr+sGiqlzvrtq4=
125 | sigs.k8s.io/structured-merge-diff/v4 v4.4.1/go.mod h1:N8hJocpFajUSSeSJ9bOZ77VzejKZaXsTtZo4/u7Io08=
126 | sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
127 | sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
128 |
--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
1 | Apache License
2 | Version 2.0, January 2004
3 | http://www.apache.org/licenses/
4 |
5 | TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
6 |
7 | 1. Definitions.
8 |
9 | "License" shall mean the terms and conditions for use, reproduction,
10 | and distribution as defined by Sections 1 through 9 of this document.
11 |
12 | "Licensor" shall mean the copyright owner or entity authorized by
13 | the copyright owner that is granting the License.
14 |
15 | "Legal Entity" shall mean the union of the acting entity and all
16 | other entities that control, are controlled by, or are under common
17 | control with that entity. For the purposes of this definition,
18 | "control" means (i) the power, direct or indirect, to cause the
19 | direction or management of such entity, whether by contract or
20 | otherwise, or (ii) ownership of fifty percent (50%) or more of the
21 | outstanding shares, or (iii) beneficial ownership of such entity.
22 |
23 | "You" (or "Your") shall mean an individual or Legal Entity
24 | exercising permissions granted by this License.
25 |
26 | "Source" form shall mean the preferred form for making modifications,
27 | including but not limited to software source code, documentation
28 | source, and configuration files.
29 |
30 | "Object" form shall mean any form resulting from mechanical
31 | transformation or translation of a Source form, including but
32 | not limited to compiled object code, generated documentation,
33 | and conversions to other media types.
34 |
35 | "Work" shall mean the work of authorship, whether in Source or
36 | Object form, made available under the License, as indicated by a
37 | copyright notice that is included in or attached to the work
38 | (an example is provided in the Appendix below).
39 |
40 | "Derivative Works" shall mean any work, whether in Source or Object
41 | form, that is based on (or derived from) the Work and for which the
42 | editorial revisions, annotations, elaborations, or other modifications
43 | represent, as a whole, an original work of authorship. For the purposes
44 | of this License, Derivative Works shall not include works that remain
45 | separable from, or merely link (or bind by name) to the interfaces of,
46 | the Work and Derivative Works thereof.
47 |
48 | "Contribution" shall mean any work of authorship, including
49 | the original version of the Work and any modifications or additions
50 | to that Work or Derivative Works thereof, that is intentionally
51 | submitted to Licensor for inclusion in the Work by the copyright owner
52 | or by an individual or Legal Entity authorized to submit on behalf of
53 | the copyright owner. For the purposes of this definition, "submitted"
54 | means any form of electronic, verbal, or written communication sent
55 | to the Licensor or its representatives, including but not limited to
56 | communication on electronic mailing lists, source code control systems,
57 | and issue tracking systems that are managed by, or on behalf of, the
58 | Licensor for the purpose of discussing and improving the Work, but
59 | excluding communication that is conspicuously marked or otherwise
60 | designated in writing by the copyright owner as "Not a Contribution."
61 |
62 | "Contributor" shall mean Licensor and any individual or Legal Entity
63 | on behalf of whom a Contribution has been received by Licensor and
64 | subsequently incorporated within the Work.
65 |
66 | 2. Grant of Copyright License. Subject to the terms and conditions of
67 | this License, each Contributor hereby grants to You a perpetual,
68 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable
69 | copyright license to reproduce, prepare Derivative Works of,
70 | publicly display, publicly perform, sublicense, and distribute the
71 | Work and such Derivative Works in Source or Object form.
72 |
73 | 3. Grant of Patent License. Subject to the terms and conditions of
74 | this License, each Contributor hereby grants to You a perpetual,
75 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable
76 | (except as stated in this section) patent license to make, have made,
77 | use, offer to sell, sell, import, and otherwise transfer the Work,
78 | where such license applies only to those patent claims licensable
79 | by such Contributor that are necessarily infringed by their
80 | Contribution(s) alone or by combination of their Contribution(s)
81 | with the Work to which such Contribution(s) was submitted. If You
82 | institute patent litigation against any entity (including a
83 | cross-claim or counterclaim in a lawsuit) alleging that the Work
84 | or a Contribution incorporated within the Work constitutes direct
85 | or contributory patent infringement, then any patent licenses
86 | granted to You under this License for that Work shall terminate
87 | as of the date such litigation is filed.
88 |
89 | 4. Redistribution. You may reproduce and distribute copies of the
90 | Work or Derivative Works thereof in any medium, with or without
91 | modifications, and in Source or Object form, provided that You
92 | meet the following conditions:
93 |
94 | (a) You must give any other recipients of the Work or
95 | Derivative Works a copy of this License; and
96 |
97 | (b) You must cause any modified files to carry prominent notices
98 | stating that You changed the files; and
99 |
100 | (c) You must retain, in the Source form of any Derivative Works
101 | that You distribute, all copyright, patent, trademark, and
102 | attribution notices from the Source form of the Work,
103 | excluding those notices that do not pertain to any part of
104 | the Derivative Works; and
105 |
106 | (d) If the Work includes a "NOTICE" text file as part of its
107 | distribution, then any Derivative Works that You distribute must
108 | include a readable copy of the attribution notices contained
109 | within such NOTICE file, excluding those notices that do not
110 | pertain to any part of the Derivative Works, in at least one
111 | of the following places: within a NOTICE text file distributed
112 | as part of the Derivative Works; within the Source form or
113 | documentation, if provided along with the Derivative Works; or,
114 | within a display generated by the Derivative Works, if and
115 | wherever such third-party notices normally appear. The contents
116 | of the NOTICE file are for informational purposes only and
117 | do not modify the License. You may add Your own attribution
118 | notices within Derivative Works that You distribute, alongside
119 | or as an addendum to the NOTICE text from the Work, provided
120 | that such additional attribution notices cannot be construed
121 | as modifying the License.
122 |
123 | You may add Your own copyright statement to Your modifications and
124 | may provide additional or different license terms and conditions
125 | for use, reproduction, or distribution of Your modifications, or
126 | for any such Derivative Works as a whole, provided Your use,
127 | reproduction, and distribution of the Work otherwise complies with
128 | the conditions stated in this License.
129 |
130 | 5. Submission of Contributions. Unless You explicitly state otherwise,
131 | any Contribution intentionally submitted for inclusion in the Work
132 | by You to the Licensor shall be under the terms and conditions of
133 | this License, without any additional terms or conditions.
134 | Notwithstanding the above, nothing herein shall supersede or modify
135 | the terms of any separate license agreement you may have executed
136 | with Licensor regarding such Contributions.
137 |
138 | 6. Trademarks. This License does not grant permission to use the trade
139 | names, trademarks, service marks, or product names of the Licensor,
140 | except as required for reasonable and customary use in describing the
141 | origin of the Work and reproducing the content of the NOTICE file.
142 |
143 | 7. Disclaimer of Warranty. Unless required by applicable law or
144 | agreed to in writing, Licensor provides the Work (and each
145 | Contributor provides its Contributions) on an "AS IS" BASIS,
146 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
147 | implied, including, without limitation, any warranties or conditions
148 | of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
149 | PARTICULAR PURPOSE. You are solely responsible for determining the
150 | appropriateness of using or redistributing the Work and assume any
151 | risks associated with Your exercise of permissions under this License.
152 |
153 | 8. Limitation of Liability. In no event and under no legal theory,
154 | whether in tort (including negligence), contract, or otherwise,
155 | unless required by applicable law (such as deliberate and grossly
156 | negligent acts) or agreed to in writing, shall any Contributor be
157 | liable to You for damages, including any direct, indirect, special,
158 | incidental, or consequential damages of any character arising as a
159 | result of this License or out of the use or inability to use the
160 | Work (including but not limited to damages for loss of goodwill,
161 | work stoppage, computer failure or malfunction, or any and all
162 | other commercial damages or losses), even if such Contributor
163 | has been advised of the possibility of such damages.
164 |
165 | 9. Accepting Warranty or Additional Liability. While redistributing
166 | the Work or Derivative Works thereof, You may choose to offer,
167 | and charge a fee for, acceptance of support, warranty, indemnity,
168 | or other liability obligations and/or rights consistent with this
169 | License. However, in accepting such obligations, You may act only
170 | on Your own behalf and on Your sole responsibility, not on behalf
171 | of any other Contributor, and only if You agree to indemnify,
172 | defend, and hold each Contributor harmless for any liability
173 | incurred by, or claims asserted against, such Contributor by reason
174 | of your accepting any such warranty or additional liability.
175 |
176 | END OF TERMS AND CONDITIONS
177 |
178 | APPENDIX: How to apply the Apache License to your work.
179 |
180 | To apply the Apache License to your work, attach the following
181 | boilerplate notice, with the fields enclosed by brackets "{}"
182 | replaced with your own identifying information. (Don't include
183 | the brackets!) The text should be enclosed in the appropriate
184 | comment syntax for the file format. We also recommend that a
185 | file or class name and description of purpose be included on the
186 | same "printed page" as the copyright notice for easier
187 | identification within third-party archives.
188 |
189 | Copyright 2017 DigitalOcean
190 |
191 | Licensed under the Apache License, Version 2.0 (the "License");
192 | you may not use this file except in compliance with the License.
193 | You may obtain a copy of the License at
194 |
195 | http://www.apache.org/licenses/LICENSE-2.0
196 |
197 | Unless required by applicable law or agreed to in writing, software
198 | distributed under the License is distributed on an "AS IS" BASIS,
199 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
200 | See the License for the specific language governing permissions and
201 | limitations under the License.
202 |
--------------------------------------------------------------------------------