feat[chart]: Add shareProcessNamespace field to deployment

[wolffberg]

Description

Add a value to configure shareProcessNamespace in the deployment of external-dns.

To use the Vault Sidecar Injector with external-dns and Route53 you need to share the process namespace to restart the external-dns process when credentials are injected as the AWS Go SDK do not allow dynamic reloading of credentials from file.

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: wolffberg / name: David Wolffberg (534916c)

[k8s-ci-robot]

Welcome @wolffberg!

It looks like this is your first PR to kubernetes-sigs/external-dns 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-sigs/external-dns has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

[stevehipwell]

@wolffberg can the Vault agent sidecar mutating webhook not make this change to the pod spec?

Out of interest, how come you're not using IRSA for the Route53 credentials?

[stevehipwell]

@wolffberg in addition to the IRSA question, how come the credentials need to be reloaded in the first place? Aren't you injecting credentials which the SDK can renew itself?

[wolffberg]

@stevehipwell good idea with the mutating webhook, I will make a POC and see if Hashicorp agrees.

We would like to use Vault as the main source of IAM across our different cloud/on-premise deployments to get consistency across our clusters.

We also expected the SDK would reload the credentials if a request fails but this does not seem to be the case for the Go SDK.

[stevehipwell]

@stevehipwell good idea with the mutating webhook, I will make a POC and see if Hashicorp agrees.

I'd be interested in taking a look at the PR when it's up.

We would like to use Vault as the main source of IAM across our different cloud/on-premise deployments to get consistency across our clusters.

I wouldn't advise taking this approach, if you're using EKS then IRSA is going to be significantly more stable with fewer moving parts and fully supported by a single large vendor. It also "just works".

We also expected the SDK would reload the credentials if a request fails but aws/aws-sdk-go#1993 (comment).

AFAIK the Go SDK wont reload new credentials but will refresh them if that is supported.

[wolffberg]

I'd be interested in taking a look at the PR when it's up.

Up and waiting for review hashicorp/vault-k8s#334

I wouldn't advise taking this approach, if you're using EKS then IRSA is going to be significantly more stable with fewer moving parts and fully supported by a single large vendor. It also "just works".

I agree but we have EKS, AKS and on-premise clusters and would like a shared Terraform module that fits all.

AFAIK the Go SDK wont reload new credentials but will refresh them if that is supported.

We are using Vault to assume a role in AWS then inject and rotate the credentials on a regular basis. This way we don't need to expose refreshable credentials to the external-dns container.

[stevehipwell]

@Raffo could you enable the workflow?

[stevehipwell]

/approve

[seanmalloy]

/kind feature
/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: seanmalloy, stevehipwell, wolffberg

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• charts/OWNERS [seanmalloy,stevehipwell]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[seanmalloy]

/lgtm