External-DNS

Purpose: Automatic DNS record synchronization

Version: 1.15.0

Namespace: external-dns

Description

Automatically creates and manages DNS records based on Kubernetes ingress resources. Integrates with Cloudflare for DNS management.

Installation

Installed via ArgoCD from Helm chart: external-dns/external-dns

Configuration

Configuration file: cluster/dev/config.yaml

external-dns:
  enabled: true
  version: "1.15.0"
  provider: cloudflare
  domain: ssdk8s.xyz

DNS Provider

• Provider: Cloudflare
• Domain: ssdk8s.xyz
• API Token: Stored in cloudflare-api-token secret

Prerequisites

Cloudflare API token stored as secret (created by bootstrap):

kubectl create secret generic cloudflare-api-token \
  -n external-dns \
  --from-literal=api-token=YOUR_CF_API_TOKEN

tip

The Cloudflare API token must have Zone:DNS:Edit permissions for your domain.

How It Works

1. Create an Ingress resource with a host
2. ExternalDNS watches for ingress changes
3. Automatically creates/updates DNS records in Cloudflare
4. Creates TXT records for ownership tracking

Example

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: my-app
  namespace: default
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  ingressClassName: nginx
  rules:
    - host: myapp.ssdk8s.xyz
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: my-service
                port:
                  number: 80

ExternalDNS will automatically create:

• A record: myapp.ssdk8s.xyz → LoadBalancer IP
• TXT record: For ownership tracking

Annotations

Annotation	Description	Default
external-dns.alpha.kubernetes.io/hostname	Override DNS hostname	Uses ingress host
external-dns.alpha.kubernetes.io/ttl	TTL for DNS record	300

Troubleshooting

Check ExternalDNS Logs

kubectl logs -n external-dns -l app.kubernetes.io/name=external-dns

Verify DNS Records

# Check Cloudflare dashboard or use dig
dig myapp.ssdk8s.xyz

Common Issues

1. Records not created - Check Cloudflare API token permissions
2. Wrong IP - Ensure MetalLB assigned an IP to the ingress
3. TXT record errors - Check external-dns has permission to create TXT records