Add support of secret based AuthN/Z for Route53

chart/k8gb/templates/external-dns/external-dns.yaml

@@ -32,7 +32,7 @@ spec:
         - --txt-owner-id={{ include "k8gb.extdnsOwnerID" . }}
         - --txt-prefix=k8gb-{{ .Values.k8gb.clusterGeoTag }}- # add custom prefix to TXT records, critical for Cloudflare NS record creation
         - --provider={{ include "k8gb.extdnsProvider" . }}
-        {{- if .Values.route53.assumeRoleArn }}
+        {{- if and .Values.route53.assumeRoleArn (not .Values.route53.secret) }}
         - --aws-assume-role={{ .Values.route53.assumeRoleArn }}
         {{- end }}
         {{ include "k8gb.extdnsProviderOpts" . }}
@@ -45,6 +45,19 @@ spec:
             cpu: "500m"
         securityContext:
           readOnlyRootFilesystem: true
+      {{- if .Values.route53.secret }}
+        env:
+          - name: AWS_SHARED_CREDENTIALS_FILE
+            value: /.aws/credentials
+        volumeMounts:
+          - name: aws-credentials
+            mountPath: /.aws
+            readOnly: true
+      volumes:
+        - name: aws-credentials
+          secret:
+            secretName: {{ .Values.route53.secret }}
+      {{- end }}
       {{- if .Values.rfc2136.rfc2136auth.gssTsig.enabled }}
         volumeMounts:
           - mountPath: /etc/krb5.conf

chart/k8gb/values.schema.json

@@ -566,6 +566,17 @@
                         }
                     ]
                 },
+                "secret": {
+                    "oneOf": [
+                        {
+                            "type": "string",
+                            "minLength": 1
+                        },
+                        {
+                            "type": "null"
+                        }
+                    ]
+                },
                 "assumeRoleArn": {
                     "oneOf": [
                         {

chart/k8gb/values.yaml

@@ -110,6 +110,10 @@ route53:
   irsaRole: arn:aws:iam::111111:role/external-dns
   # -- specify IRSA Role in AWS ARN format for assume role permissions or disable it by setting to `null`
   assumeRoleArn: null
+  # -- alternatively specify the secret name with static credentials for IAM user (make sure this user has limited privileges)
+  # this can be useful when IRSA is not present or when using say Azure cluster and Route53
+  # docs: https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/aws.md#create-iam-user-and-attach-the-policy
+  secret: null
 
 ns1:
   # -- Enable NS1 provider