kubernetes-sigs/external-dns
External Dns
ExternalDNS is a controller that automatically synchronizes Kubernetes resource states with external DNS providers. It monitors cluster resources such as services, ingresses, and gateway APIs to dynamically create and update DNS records, enabling automated service discovery and external traffic management.
The project features a provider-agnostic interface that supports a wide array of cloud-managed vendors and on-premises providers, as well as an extension system for custom providers via webhooks and sidecars. It implements a reconciliation loop that uses resource annotations and custom resource definitions for declarative DNS management, ensuring that records are synchronized based on the desired state of the cluster.
To maintain stability and security, the controller utilizes leader election for high availability and tracks record ownership through TXT records or external databases like DynamoDB. It optimizes provider API usage through in-memory caching and batching of record changes. The system also supports advanced traffic management, including split-horizon DNS and routing policies, while exposing operational metrics via Prometheus.
Features
- Automated DNS Record Synchronization - ExternalDNS tracks native services, ingresses, and gateway routes to automatically update external DNS providers.
- Automated DNS Managers - Provides automated synchronization of DNS records across external providers based on Kubernetes service and ingress resources.
- DNS Record Updaters - Synchronizes DNS records with external providers automatically based on service and ingress definitions.
- Behavioral Overrides - Allows overriding global controller settings on a per-resource basis using Kubernetes resource metadata.
- Control Loops - Implements a continuous reconciliation loop to synchronize cluster state with external DNS providers.
- Hostname Configurations - Assigns additional or overriding domain names to resources via annotations to support multi-host configurations.
- Annotation-Driven Configurations - Uses resource annotations to pass provider-specific configuration options directly to the external DNS API.
- Ingress-Based DNS Generation - Generates DNS entries based on the host keys specified within ingress resources.
- Resource-Based DNS Generation - Generates DNS entries from any cluster resource using templates to map object fields to hostnames.
- External Traffic Routing - Directs external users to Kubernetes load balancers and gateways by synchronizing A and CNAME records.
- Cloud DNS Services - Synchronizes internal cluster endpoints with managed cloud DNS services like Route53, Google Cloud DNS, and Azure DNS.
- Decoupled Record Management - Manages DNS records declaratively using Kubernetes custom resources to decouple definitions from application logic.
- Ingress Record Management - Creates and manages DNS entries automatically based on the hostnames defined in Ingress resources.
- Metadata Record Storage - Saves DNS record ownership and metadata in TXT records to track managing resources.
- Ownership Tracking - Uses TXT entries to tag managed records, ensuring only automatically created records are modified.
- Record Ownership Persistence - Stores ownership and tracking information for DNS records in a registry to prevent modification conflicts.
- Declarative Record Management - Creates and updates DNS records using custom resource definitions to specify desired record types and targets.
- DNS-Based Service Discovery - Implements DNS-based service discovery by creating records from Kubernetes Service resources.
- Dynamic DNS Synchronization - Automatically updates DNS records for pods, services, and ingresses to maintain consistent external access.
- Dynamic Service Discovery - Maps changing Kubernetes pod and service IP addresses to stable hostnames in external DNS systems.
- Record Ownership Tracking - Tracks record ownership through TXT records to ensure only the managing controller modifies specific entries.
- Record Ownership Isolation - ExternalDNS prevents overlapping records in a shared store by restricting operations to a specific owner identifier.
- DNS Provider Interfaces - Provides a provider-agnostic interface to support a wide array of cloud and on-premises DNS vendors.
- Endpoint Reconciliation - Updates DNS records automatically when the endpoints matched by a Service selector change.
- Metadata Storage - Uses an AWS DynamoDB table to persist DNS record ownership and tracking metadata.
- In-Memory Caches - Caches DNS provider data and zone lists in memory to reduce outgoing API request volume.
- Provider API Caches - ExternalDNS stores DNS records read from the provider to reduce API calls and avoid rate limits.
- Node DNS Synchronization - Creates A and AAAA records for cluster nodes based on their internal or external IP addresses.
- CRD-Based Synchronization - Synchronizes DNS records based on targets defined within Kubernetes Custom Resource Definitions.
- Endpoint Extraction from CRDs - Watches user-defined Custom Resource Definitions to extract endpoints and synchronize them as DNS records.
- Resource Mapping Logic - Translates custom resource definitions into standard DNS record types for declarative management.
- High Availability Deployments - Coordinates high availability to ensure only one instance actively manages DNS records.
- Leader Election - Utilizes leader election to ensure high availability and prevent conflicting DNS record updates.
- Sidecar - Connects to external DNS services via custom sidecar programs using HTTP APIs.
- Resource Label Filtering - Limits which cluster resources are synchronized using label selectors or annotation filters.
- Reconciliation Workload Distribution - Deploys multiple instances scoped to specific zones or namespaces to reduce reconciliation cycle times.
- API Pressure Mitigation - Uses in-memory caching and update batching to minimize API requests and avoid rate limits.
- Split-Horizon Views - Serves different DNS responses based on client location by running multiple instances with unique prefixes.
- DNS Record Management - Manages A, AAAA, and CNAME records within Pi-hole via its internal API.
- Alias Record Support - Converts standard CNAME records into ALIAS records for supported providers to optimize resolution.
- Custom Record Definitions - Creates specific DNS records by mapping hostnames to IP addresses using dedicated resources.
- DNS Transaction Authentication - ExternalDNS authenticates DNS updates using TSIG, GSS-TSIG, or mutual TLS certificate verification.
- Domain-Based Synchronization Filtering - Controls which DNS records are synchronized using suffix matches or regular expressions.
- Dualstack Synchronization - Creates both A and AAAA alias DNS records to support IPv4 and IPv6 traffic.
- Individual Pod Record Management - Generates unique DNS entries for individual pods in a headless service.
- IPv6 Record Generation - Generates AAAA records for clusters configured with IPv6 support.
- PTR Record Mapping - Generates PTR records for IPv4 and IPv6 endpoints when the provider has authority over reverse zones.
- Record Adoption - Allows the controller to take ownership of existing DNS records by identifying matching markers in TXT records.
- Record Type Control - Controls the creation of specific record types, such as opting in or out of PTR records.
- Route53 Alias Management - Creates Route53 ALIAS records for IPv4 and IPv6 targets to point to AWS load balancers.
- TTL Configuration - Sets the time-to-live duration for a resource's DNS records to control cache expiration.
- TTL Control - Sets the time-to-live duration for DNS records to control how long resolvers cache information.
- TTL Definition - Defines how long DNS records are cached via global configuration or per-resource annotations.
- TTL Management - Controls the Time-To-Live for DNS records via annotations or global flags.
- TTL Overrides - Overrides the default time-to-live for DNS records via resource annotations to minimize propagation delay.
- Batch Request Optimizations - Groups multiple record changes into single API calls to prevent provider rate limit exhaustion.
- Transactional Batching - Groups multiple record changes into transactional batch calls to reduce the volume of API requests to DNS providers.
- Internal DNS Resolvers - Creates DNS records specifically for internal network use, such as mapping services to their internal IP.
- Annotation-Driven Discovery - Generates DNS entries based on hostnames defined in Kubernetes service annotations.
- Service-Specific Sync Filtering - Restricts which Service resources trigger DNS updates based on specific labels or types.
- Zone Management - Manages DNS records across both public and private zones for the same domain to route traffic.
- Pattern-Based Zone Filtering - Restricts synchronization to specific zones using suffixes, regex patterns, or tags.
- Zone-Based Synchronization Filtering - Restricts the synchronization process to specific zones based on domain names or contract identifiers.
- Gateway API Integrations - Creates and updates DNS records based on hostnames defined in Gateway API Route specifications.
- Headless Service DNS Publication - Publishes DNS records for pods backing a headless service using pod, host, or node IPs.
- DNS-Based Load Balancing - Distributes updates across multiple DNS hosts using round-robin or failover strategies to balance traffic.
- Load Balancer Alias Records - Creates and maintains A and AAAA alias records specifically for cloud load balancers.
- Pod-Level DNS Discovery - Generates unique DNS entries for individual pods to make them discoverable within the network.
- DNS-Based Routing - Implements weighted, latency-based, or geolocation routing using resource annotations for traffic steering.
- Source Resource Filtering - Restricts which services, pods, or nodes are watched using type, label, or annotation filters.
- DNS Provider API Integrations - Extends DNS vendor support through a webhook-based integration system.
- Webhook Provider Extensions - Enables integration with non-core DNS providers using a flexible webhook system.
- Pod-Level IAM Roles - ExternalDNS grants access to DNS providers using IAM Roles for Service Accounts or Pod Identity.
- Workload Identity Authentication - ExternalDNS connects to DNS providers using Workload Identity, static credentials, or node-level service accounts.
- API Request Optimizers - ExternalDNS caches managed zones and applies retry policies to reduce the volume of API calls.
- API Request - Implements polling intervals and event-based synchronization to throttle requests to DNS providers.
- API Rate-Limit Chunkers - Groups multiple record changes into single API calls to respect provider rate limits.
- Traefik Integrations - Integrates with Traefik IngressRoute resources to automate the creation of corresponding DNS records.
