mirrors/external-dns
1
0
Fork 0
mirror of https://github.com/kubernetes-sigs/external-dns.git synced 2025-08-06 01:26:59 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'master' into cloudflare/region

Browse Source
This commit is contained in:
Andrew Hay 2024-09-06 15:10:04 -04:00 committed by GitHub
commit 2227d22aa7
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
137 changed files with 1879 additions and 40261 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
.github/workflows/ci.yaml vendored
View File

@ -20,15 +20,15 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Check out code into the Go module directory
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
- name: Set up Go 1.x
uses: actions/setup-go@v5
with:
go-version: '1.22.4'
go-version-file: go.mod
id: go
- name: Check out code into the Go module directory
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
- name: Install CI
run: |
go get -v -t -d ./...

2
.github/workflows/codeql-analysis.yaml vendored
View File

@ -30,7 +30,7 @@ jobs:
- name: Install go version
uses: actions/setup-go@v5
with:
go-version: '^1.22.4'
go-version-file: go.mod
# Initializes the CodeQL tools for scanning.
- name: Initialize CodeQL

6
.github/workflows/docs.yaml vendored
View File

@ -19,16 +19,12 @@ jobs:
with:
fetch-depth: 0
- uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v5.1.1
- uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
with:
python-version: "3.12"
cache: "pip"
cache-dependency-path: "./docs/scripts/requirements.txt"
- uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
with:
go-version-file: 'go.mod'
- run: |
pip install -r docs/scripts/requirements.txt

2
.github/workflows/json-yaml-validate.yml vendored
View File

@ -17,7 +17,7 @@ jobs:
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
- name: json-yaml-validate
uses: GrantBirki/json-yaml-validate@v3.0.0
uses: GrantBirki/json-yaml-validate@v3.2.1
with:
comment: "true" # enable comment mode
yaml_exclude_regex: "(charts/external-dns/templates.*|mkdocs.yml)"

2
.github/workflows/lint-test-chart.yaml vendored
View File

@ -59,7 +59,7 @@ jobs:
version: latest
- name: Install Python
uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v5.1.1
uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
with:
token: ${{ github.token }}
python-version: "3.x"

19
.github/workflows/lint.yaml vendored
View File

@ -8,6 +8,7 @@ on:
permissions:
contents: read # to fetch code (actions/checkout)
checks: write
jobs:
@ -20,16 +21,16 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Set up Go 1.x
uses: actions/setup-go@v5
with:
go-version: '1.22.4'
id: go
- name: Check out code into the Go module directory
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
- name: Set up Go 1.x
uses: actions/setup-go@v5
with:
go-version-file: go.mod
- name: Lint
run: |
curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v1.57.2
make lint
uses: golangci/golangci-lint-action@v6
with:
args: --timeout=30m
version: v1.60

8
.github/workflows/staging-image-tester.yaml vendored
View File

@ -20,15 +20,15 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Check out code into the Go module directory
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
- name: Set up Go 1.x
uses: actions/setup-go@v5
with:
go-version: '1.22.4'
go-version-file: go.mod
id: go
- name: Check out code into the Go module directory
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
- name: Install CI
run: |
go get -v -t -d ./...

2
Makefile
View File

@ -41,7 +41,7 @@ CONTROLLER_GEN=$(shell which controller-gen)
endif
golangci-lint:
@command -v golangci-lint > /dev/null || curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v1.57.2
@command -v golangci-lint > /dev/null || curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v1.60.3
# Run the golangci-lint tool
.PHONY: go-lint

3
OWNERS
View File

@ -6,19 +6,18 @@
# https://github.com/kubernetes/k8s.io/blob/master/registry.k8s.io/images/k8s-staging-external-dns/OWNERS
approvers:
- johngmyers
- mloiseleur
- raffo
- szuecs
reviewers:
- johngmyers
- mloiseleur
- raffo
- szuecs
emeritus_approvers:
- hjacobs
- johngmyers
- linki
- njuettner
- seanmalloy

35
README.md
View File

@ -36,13 +36,10 @@ ExternalDNS allows you to keep selected zones (via `--domain-filter`) synchroniz
* [AWS Route 53](https://aws.amazon.com/route53/)
* [AWS Cloud Map](https://docs.aws.amazon.com/cloud-map/)
* [AzureDNS](https://azure.microsoft.com/en-us/services/dns)
* [BlueCat](https://bluecatnetworks.com)
* [Civo](https://www.civo.com)
* [CloudFlare](https://www.cloudflare.com/dns)
* [RcodeZero](https://www.rcodezero.at/)
* [DigitalOcean](https://www.digitalocean.com/products/networking)
* [DNSimple](https://dnsimple.com/)
* [Dyn](https://dyn.com/dns/)
* [OpenStack Designate](https://docs.openstack.org/designate/latest/)
* [PowerDNS](https://www.powerdns.com/)
* [CoreDNS](https://coredns.io/)
@ -52,14 +49,11 @@ ExternalDNS allows you to keep selected zones (via `--domain-filter`) synchroniz
* [RFC2136](https://tools.ietf.org/html/rfc2136)
* [NS1](https://ns1.com/)
* [TransIP](https://www.transip.eu/domain-name/)
* [VinylDNS](https://www.vinyldns.io)
* [Vultr](https://www.vultr.com)
* [OVH](https://www.ovh.com)
* [Scaleway](https://www.scaleway.com)
* [Akamai Edge DNS](https://learn.akamai.com/en-us/products/cloud_security/edge_dns.html)
* [GoDaddy](https://www.godaddy.com)
* [Gandi](https://www.gandi.net)
* [ANS Group SafeDNS](https://portal.ans.co.uk/safedns/)
* [IBM Cloud DNS](https://www.ibm.com/cloud/dns)
* [TencentCloud PrivateDNS](https://cloud.tencent.com/product/privatedns)
* [TencentCloud DNSPod](https://cloud.tencent.com/product/cns)
@ -91,6 +85,7 @@ Known providers using webhooks:
| IONOS | https://github.com/ionos-cloud/external-dns-ionos-webhook |
| Infoblox | https://github.com/AbsaOSS/external-dns-infoblox-webhook |
| Netcup | https://github.com/mrueg/external-dns-netcup-webhook |
| RouterOS | https://github.com/benfiola/external-dns-routeros-provider |
| STACKIT | https://github.com/stackitcloud/external-dns-stackit-webhook |
| Unifi | https://github.com/kashalls/external-dns-unifi-webhook |
@ -115,13 +110,10 @@ The following table clarifies the current status of the providers according to t
| AWS Cloud Map | Beta | |
| Akamai Edge DNS | Beta | |
| AzureDNS | Stable | |
| BlueCat | Alpha | @seanmalloy @vinny-sabatini |
| Civo | Alpha | @alejandrojnm |
| CloudFlare | Beta | |
| RcodeZero | Alpha | |
| DigitalOcean | Alpha | |
| DNSimple | Alpha | |
| Dyn | Alpha | |
| OpenStack Designate | Alpha | |
| PowerDNS | Alpha | |
| CoreDNS | Alpha | |
@ -131,15 +123,12 @@ The following table clarifies the current status of the providers according to t
| RFC2136 | Alpha | |
| NS1 | Alpha | |
| TransIP | Alpha | |
| VinylDNS | Alpha | |
| RancherDNS | Alpha | |
| OVH | Alpha | |
| Scaleway DNS | Alpha | @Sh4d1 |
| Vultr | Alpha | |
| UltraDNS | Alpha | |
| GoDaddy | Alpha | |
| Gandi | Alpha | @packi |
| SafeDNS | Alpha | @assureddt |
| IBMCloud | Alpha | @hughhuangzh |
| TencentCloud | Alpha | @Hyzhou |
| Plural | Alpha | @michaeljguarino |
@ -171,48 +160,40 @@ The following tutorials are provided:
* AWS
* [AWS Load Balancer Controller](docs/tutorials/aws-load-balancer-controller.md)
* [Route53](docs/tutorials/aws.md)
* [Same domain for public and private Route53 zones](docs/tutorials/public-private-route53.md)
* [Same domain for public and private Route53 zones](docs/tutorials/aws-public-private-route53.md)
* [Cloud Map](docs/tutorials/aws-sd.md)
* [Kube Ingress AWS Controller](docs/tutorials/kube-ingress-aws.md)
* [Azure DNS](docs/tutorials/azure.md)
* [Azure Private DNS](docs/tutorials/azure-private-dns.md)
* [Civo](docs/tutorials/civo.md)
* [Cloudflare](docs/tutorials/cloudflare.md)
* [BlueCat](docs/tutorials/bluecat.md)
* [CoreDNS](docs/tutorials/coredns.md)
* [DigitalOcean](docs/tutorials/digitalocean.md)
* [DNSimple](docs/tutorials/dnsimple.md)
* [Dyn](docs/tutorials/dyn.md)
* [Exoscale](docs/tutorials/exoscale.md)
* [ExternalName Services](docs/tutorials/externalname.md)
* Google Kubernetes Engine
* [Using Google's Default Ingress Controller](docs/tutorials/gke.md)
* [Using the Nginx Ingress Controller](docs/tutorials/nginx-ingress.md)
* [Using the Nginx Ingress Controller](docs/tutorials/gke-nginx.md)
* [Headless Services](docs/tutorials/hostport.md)
* [Istio Gateway Source](docs/tutorials/istio.md)
* [Kubernetes Security Context](docs/tutorials/security-context.md)
* [Istio Gateway Source](docs/sources/istio.md)
* [Linode](docs/tutorials/linode.md)
* [Nginx Ingress Controller](docs/tutorials/nginx-ingress.md)
* [NS1](docs/tutorials/ns1.md)
* [NS Record Creation with CRD Source](docs/tutorials/ns-record.md)
* [MX Record Creation with CRD Source](docs/tutorials/mx-record.md)
* [NS Record Creation with CRD Source](docs/sources/ns-record.md)
* [MX Record Creation with CRD Source](docs/sources/mx-record.md)
* [OpenStack Designate](docs/tutorials/designate.md)
* [Oracle Cloud Infrastructure (OCI) DNS](docs/tutorials/oracle.md)
* [PowerDNS](docs/tutorials/pdns.md)
* [RcodeZero](docs/tutorials/rcodezero.md)
* [RancherDNS (RDNS)](docs/tutorials/rdns.md)
* [RFC2136](docs/tutorials/rfc2136.md)
* [TransIP](docs/tutorials/transip.md)
* [VinylDNS](docs/tutorials/vinyldns.md)
* [OVH](docs/tutorials/ovh.md)
* [Scaleway](docs/tutorials/scaleway.md)
* [Vultr](docs/tutorials/vultr.md)
* [UltraDNS](docs/tutorials/ultradns.md)
* [GoDaddy](docs/tutorials/godaddy.md)
* [Gandi](docs/tutorials/gandi.md)
* [SafeDNS](docs/tutorials/ANS_Group_SafeDNS.md)
* [IBM Cloud](docs/tutorials/ibmcloud.md)
* [Nodes as source](docs/tutorials/nodes.md)
* [Nodes as source](docs/sources/nodes.md)
* [TencentCloud](docs/tutorials/tencentcloud.md)
* [Plural](docs/tutorials/plural.md)
* [Pi-hole](docs/tutorials/pihole.md)
@ -304,7 +285,7 @@ show us what you can do!
The external-dns project is currently in need of maintainers for specific DNS providers. Ideally each provider
would have at least two maintainers. It would be nice if the maintainers run the provider in production, but it
is not strictly required. Provider listed [here](https://github.com/kubernetes-sigs/external-dns#status-of-providers)
is not strictly required. Provider listed [here](https://github.com/kubernetes-sigs/external-dns#status-of-in-tree-providers)
that do not have a maintainer listed are in need of assistance.
Read the [contributing guidelines](CONTRIBUTING.md) and have a look at [the contributing docs](docs/contributing/getting-started.md) to learn about building the project, the project structure, and the purpose of each package.

8
charts/external-dns/CHANGELOG.md
View File

@ -18,6 +18,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
## [UNRELEASED]
### Fixed
- Fixed `provider.webhook.resources` behavior to correctly leverage resource limits ([#4560](https://github.com/kubernetes-sigs/external-dns/pull/4560))
- Fixed `provider.webhook.imagePullPolicy` behavior to correctly leverage pull policy ([#4643](https://github.com/kubernetes-sigs/external-dns/pull/4643)) _@kimsondrup_
- Add correct webhook metric port to `Service` and `ServiceMonitor` ([#4643](https://github.com/kubernetes-sigs/external-dns/pull/4643)) _@kimsondrup_
## [v1.14.5] - 2023-06-10
### Added
@ -58,7 +64,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
### Fixed
- Restore template support in `.Values.provider` and `.Values.provider.name`
- Restore template support in `.Values.provider` and `.Values.provider.name`
## [v1.14.1] - 2024-01-11

2
charts/external-dns/README.md
View File

@ -52,7 +52,6 @@ For set up for a specific provider using the Helm chart, see the following links
- [godaddy](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/godaddy.md#using-helm)
- [ns1](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/ns1.md#using-helm)
- [plural](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/plural.md#using-helm)
- [vultr](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/vultr.md#using-helm)
## Namespaced Scoped Installation
@ -134,6 +133,7 @@ If `namespaced` is set to `true`, please ensure that `sources` my only contains
| provider.webhook.readinessProbe | object | See _values.yaml_ | [Readiness probe](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/) configuration for the `webhook` container. |
| provider.webhook.resources | object | `{}` | [Resources](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) for the `webhook` container. |
| provider.webhook.securityContext | object | See _values.yaml_ | [Pod security context](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) for the `webhook` container. |
| provider.webhook.service.metricsPort | int | `8080` | Webhook metrics port for the service. |
| provider.webhook.serviceMonitor | object | See _values.yaml_ | Optional [Service Monitor](https://prometheus-operator.dev/docs/operator/design/#servicemonitor) configuration for the `webhook` container. |
| rbac.additionalPermissions | list | `[]` | Additional rules to add to the `ClusterRole`. |
| rbac.create | bool | `true` | If `true`, create a `ClusterRole` & `ClusterRoleBinding` with access to the Kubernetes API. |

1
charts/external-dns/README.md.gotmpl
View File

@ -47,7 +47,6 @@ For set up for a specific provider using the Helm chart, see the following links
- [godaddy](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/godaddy.md#using-helm)
- [ns1](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/ns1.md#using-helm)
- [plural](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/plural.md#using-helm)
- [vultr](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/vultr.md#using-helm)
## Namespaced Scoped Installation

6
charts/external-dns/templates/deployment.yaml
View File

@ -147,7 +147,7 @@ spec:
{{- with .Values.provider.webhook }}
- name: webhook
image: {{ include "external-dns.webhookImage" . }}
imagePullPolicy: {{ $.Values.image.pullPolicy }}
imagePullPolicy: {{ .image.pullPolicy }}
{{- with .env }}
env:
{{- toYaml . | nindent 12 }}
@ -173,6 +173,10 @@ spec:
{{- toYaml . | nindent 12 }}
{{- end }}
{{- end }}
{{- with .resources }}
resources:
{{- toYaml . | nindent 12 }}
{{- end }}
{{- with .securityContext }}
securityContext:
{{- toYaml . | nindent 12 }}

9
charts/external-dns/templates/service.yaml
View File

@ -1,3 +1,4 @@
{{- $providerName := include "external-dns.providerName" . }}
apiVersion: v1
kind: Service
metadata:
@ -25,3 +26,11 @@ spec:
port: {{ .Values.service.port }}
targetPort: http
protocol: TCP
{{- if eq $providerName "webhook" }}
{{- with .Values.provider.webhook.service }}
- name: http-wh-metrics
port: {{ .metricsPort }}
targetPort: http-wh-metrics
protocol: TCP
{{- end }}
{{- end }}

2
charts/external-dns/templates/servicemonitor.yaml
View File

@ -51,7 +51,7 @@ spec:
{{- end }}
{{- if eq $providerName "webhook" }}
{{- with .Values.provider.webhook.serviceMonitor }}
- port: webhook-metrics
- port: http-wh-metrics
path: /metrics
{{- with .interval }}
interval: {{ . }}

3
charts/external-dns/values.yaml
View File

@ -269,6 +269,9 @@ provider:
timeoutSeconds: 5
failureThreshold: 6
successThreshold: 1
service:
# -- Webhook metrics port for the service.
metricsPort: 8080
# -- Optional [Service Monitor](https://prometheus-operator.dev/docs/operator/design/#servicemonitor) configuration for the `webhook` container.
# @default -- See _values.yaml_
serviceMonitor:

2
cloudbuild.yaml
View File

@ -4,7 +4,7 @@ options:
substitution_option: ALLOW_LOOSE
machineType: 'N1_HIGHCPU_8'
steps:
- name: 'docker.io/library/golang:1.22.4-bookworm'
- name: 'docker.io/library/golang:1.23-bookworm'
entrypoint: make
env:
- VERSION=$_GIT_TAG

52
controller/controller.go
View File

@ -186,11 +186,13 @@ type Controller struct {
// The interval between individual synchronizations
Interval time.Duration
// The DomainFilter defines which DNS records to keep or exclude
DomainFilter endpoint.DomainFilter
DomainFilter endpoint.DomainFilterInterface
// The nextRunAt used for throttling and batching reconciliation
nextRunAt time.Time
// The nextRunAtMux is for atomic updating of nextRunAt
nextRunAtMux sync.Mutex
// The runAtMutex is for atomic updating of nextRunAt and lastRunAt
runAtMutex sync.Mutex
// The lastRunAt used for throttling and batching reconciliation
lastRunAt time.Time
// MangedRecordTypes are DNS record types that will be considered for management.
ManagedRecordTypes []string
// ExcludeRecordTypes are DNS record types that will be excluded from management.
@ -203,6 +205,10 @@ type Controller struct {
func (c *Controller) RunOnce(ctx context.Context) error {
lastReconcileTimestamp.SetToCurrentTime()
c.runAtMutex.Lock()
c.lastRunAt = time.Now()
c.runAtMutex.Unlock()
records, err := c.Registry.Records(ctx)
if err != nil {
registryErrorsTotal.Inc()
@ -239,7 +245,7 @@ func (c *Controller) RunOnce(ctx context.Context) error {
Policies: []plan.Policy{c.Policy},
Current: records,
Desired: endpoints,
DomainFilter: endpoint.MatchAllDomainFilters{&c.DomainFilter, &registryFilter},
DomainFilter: endpoint.MatchAllDomainFilters{c.DomainFilter, registryFilter},
ManagedRecords: c.ManagedRecordTypes,
ExcludeRecords: c.ExcludeRecordTypes,
OwnerID: c.Registry.OwnerID(),
@ -264,6 +270,24 @@ func (c *Controller) RunOnce(ctx context.Context) error {
return nil
}
func earliest(r time.Time, times ...time.Time) time.Time {
for _, t := range times {
if t.Before(r) {
r = t
}
}
return r
}
func latest(r time.Time, times ...time.Time) time.Time {
for _, t := range times {
if t.After(r) {
r = t
}
}
return r
}
// Counts the intersections of A and AAAA records in endpoint and registry.
func countMatchingAddressRecords(endpoints []*endpoint.Endpoint, registryRecords []*endpoint.Endpoint) (int, int) {
recordsMap := make(map[string]map[string]struct{})
@ -306,18 +330,20 @@ func countAddressRecords(endpoints []*endpoint.Endpoint) (int, int) {
// ScheduleRunOnce makes sure execution happens at most once per interval.
func (c *Controller) ScheduleRunOnce(now time.Time) {
c.nextRunAtMux.Lock()
defer c.nextRunAtMux.Unlock()
// schedule only if a reconciliation is not already planned
// to happen in the following c.MinEventSyncInterval
if !c.nextRunAt.Before(now.Add(c.MinEventSyncInterval)) {
c.nextRunAt = now.Add(c.MinEventSyncInterval)
}
c.runAtMutex.Lock()
defer c.runAtMutex.Unlock()
c.nextRunAt = latest(
c.lastRunAt.Add(c.MinEventSyncInterval),
earliest(
now.Add(5*time.Second),
c.nextRunAt,
),
)
}
func (c *Controller) ShouldRunOnce(now time.Time) bool {
c.nextRunAtMux.Lock()
defer c.nextRunAtMux.Unlock()
c.runAtMutex.Lock()
defer c.runAtMutex.Unlock()
if now.Before(c.nextRunAt) {
return false
}

11
controller/controller_test.go
View File

@ -57,7 +57,7 @@ type errorMockProvider struct {
mockProvider
}
func (p *filteredMockProvider) GetDomainFilter() endpoint.DomainFilter {
func (p *filteredMockProvider) GetDomainFilter() endpoint.DomainFilterInterface {
return p.domainFilter
}
@ -278,15 +278,17 @@ func valueFromMetric(metric prometheus.Gauge) uint64 {
}
func TestShouldRunOnce(t *testing.T) {
ctrl := &Controller{Interval: 10 * time.Minute, MinEventSyncInterval: 5 * time.Second}
ctrl := &Controller{Interval: 10 * time.Minute, MinEventSyncInterval: 15 * time.Second}
now := time.Now()
// First run of Run loop should execute RunOnce
assert.True(t, ctrl.ShouldRunOnce(now))
assert.Equal(t, now.Add(10*time.Minute), ctrl.nextRunAt)
// Second run should not
assert.False(t, ctrl.ShouldRunOnce(now))
ctrl.lastRunAt = now
now = now.Add(10 * time.Second)
// Changes happen in ingresses or services
@ -316,12 +318,17 @@ func TestShouldRunOnce(t *testing.T) {
assert.False(t, ctrl.ShouldRunOnce(now))
// Multiple ingresses or services changes, closer than MinInterval from each other
ctrl.lastRunAt = now
firstChangeTime := now
secondChangeTime := firstChangeTime.Add(time.Second)
// First change
ctrl.ScheduleRunOnce(firstChangeTime)
// Second change
ctrl.ScheduleRunOnce(secondChangeTime)
// Executions should be spaced by at least MinEventSyncInterval
assert.False(t, ctrl.ShouldRunOnce(now.Add(5*time.Second)))
// Should not postpone the reconciliation further than firstChangeTime + MinInterval
now = now.Add(ctrl.MinEventSyncInterval)
assert.True(t, ctrl.ShouldRunOnce(now))

2
docs/contributing/getting-started.md
View File

@ -1,7 +1,7 @@
# Quick Start
- [Git](https://git-scm.com/downloads)
- [Go 1.22+](https://golang.org/dl/)
- [Go 1.23+](https://golang.org/dl/)
- [Go modules](https://github.com/golang/go/wiki/Modules)
- [golangci-lint](https://github.com/golangci/golangci-lint)
- [ko](https://ko.build/)

4
docs/faq.md
View File

@ -28,7 +28,7 @@ ExternalDNS can solve this for you as well.
### Which DNS providers are supported?
Please check the [provider status table](https://github.com/kubernetes-sigs/external-dns#status-of-providers) for the list of supported providers and their status.
Please check the [provider status table](https://github.com/kubernetes-sigs/external-dns#status-of-in-tree-providers) for the list of supported providers and their status.
As stated in the README, we are currently looking for stable maintainers for those providers, to ensure that bugfixes and new features will be available for all of those.
@ -221,7 +221,7 @@ $ docker run \
-e EXTERNAL_DNS_SOURCE=$'service\ningress' \
-e EXTERNAL_DNS_PROVIDER=google \
-e EXTERNAL_DNS_DOMAIN_FILTER=$'foo.com\nbar.com' \
registry.k8s.io/external-dns/external-dns:v0.14.2
registry.k8s.io/external-dns/external-dns:v0.15.0
time="2017-08-08T14:10:26Z" level=info msg="config: &{APIServerURL: KubeConfig: Sources:[service ingress] Namespace: ...
```

21
docs/nat64.md Normal file
View File

@ -0,0 +1,21 @@
Configure NAT64 DNS Records
=======================================
Some NAT64 configurations are entirely handled outside the Kubernetes cluster, therefore Kubernetes does not know anything about the associated IPv4 addresses. ExternalDNS should also be able to create A records for those cases.
Therefore, we can configure `nat64-networks`, which **must** be a /96 network. You can also specify multiple `nat64-networks` for more complex setups.
This creates an additional A record with a NAT64-translated IPv4 address for each AAAA record pointing to an IPv6 address within the given `nat64-networks`.
This can be configured with the following flag passed to the operator binary. You can also pass multiple `nat64-networks` by using a comma as seperator.
```sh
--nat64-networks="2001:db8:96::/96"
```
## Setup Example
We use an external NAT64 resolver and SIIT (Stateless IP/ICMP Translation). Therefore, our nodes only have IPv6 IP adresses but can reach IPv4 addresses *and* can be reached via IPv4.
Outgoing connections are a classic NAT64 setup, where all IPv6 addresses gets translated to a small pool of IPv4 addresses.
Incoming connnections are mapped on a different IPv4 pool, e.g. `198.51.100.0/24`, which can get translated one-to-one to IPv6 addresses. We dedicate a `/96` network for this, for example `2001:db8:96::/96`, so `198.51.100.0/24` can translated to `2001:db8:96::c633:6400/120`. Note: `/120` IPv6 network has exactly as many IP addresses as `/24` IPv4 network.
Therefore, the `/96` network can be configured as `nat64-networks`. This means, that `2001:0DB8:96::198.51.100.10` or `2001:db8:96::c633:640a` can be translated to `198.51.100.10`.
Any source can point a record to an IPv6 address within the given `nat64-networks`, for example `2001:db8:96::c633:640a`. This creates by default an AAAA record and - if `nat64-networks` is configured - also an A record with `198.51.100.10` as target.

76
docs/rate-limits.md Normal file
View File

@ -0,0 +1,76 @@
DNS provider API rate limits considerations
===========================================
## Introduction
By design, external-dns refreshes all the records of a zone using API calls.
This refresh may happen peridically and upon any changed object if the flag `--events` is enabled.
Depending on the size of the zone and the infrastructure deployment, this may lead to external-dns
hitting the DNS provider's rate-limits more easily.
In particular, it has been found that with 200k records in an AWS Route53 zone, each refresh triggers around
70 API calls to retrieve all the records, making it more likely to hit the AWS Route53 API rate limits.
To prevent this problem from happening, external-dns has implemented a cache to reduce the pressure on the DNS
provider APIs.
This cache is optional and systematically invalidated when DNS records have been changed in the cluster
(new or deleted domains or changed target).
## Trade-offs
The major trade-off of this setting relies in the ability to recover from a deleted record on the DNS provider side.
As the DNS records are cached in memory, external-dns will not be made aware of the missing records and will hence
take a longer time to restore the deleted or modified record on the provider side.
This option is enabled using the `--provider-cache-time=15m` command line argument, and turned off when `--provider-cache-time=0m`
## Monitoring
You can evaluate the behaviour of the cache thanks to the built-in metrics
* `external_dns_provider_cache_records_calls`
* The number of calls to the provider cache Records list.
* The label `from_cache=true` indicates that the records were retrieved from memory and the DNS provider was not reached
* The label `from_cache=false` indicates that the cache was not used and the records were retrieved from the provider
* `external_dns_provider_cache_apply_changes_calls`
* The number of calls to the provider cache ApplyChanges.
* Each ApplyChange systematically invalidates the cache and makes subsequent Records list to be retrieved from the provider without cache.
## Related options
This global option is available for all providers and can be used in pair with other global
or provider-specific options to fine-tune the behaviour of external-dns
to match the specific needs of your deployments, with the goal to reduce the number of API calls to your DNS provider.
* Google
* `--google-batch-change-interval=1s` When using the Google provider, set the interval between batch changes. ($EXTERNAL_DNS_GOOGLE_BATCH_CHANGE_INTERVAL)
* `--google-batch-change-size=1000` When using the Google provider, set the maximum number of changes that will be applied in each batch.
* AWS
* `--aws-batch-change-interval=1s` When using the AWS provider, set the interval between batch changes.
* `--aws-batch-change-size=1000` When using the AWS provider, set the maximum number of changes that will be applied in each batch.
* `--aws-batch-change-size-bytes=32000` When using the AWS provider, set the maximum byte size that will be applied in each batch.
* `--aws-batch-change-size-values=1000` When using the AWS provider, set the maximum total record values that will be applied in each batch.
* `--aws-zones-cache-duration=0s` When using the AWS provider, set the zones list cache TTL (0s to disable).
* `--[no-]aws-zone-match-parent` Expand limit possible target by sub-domains
* Cloudflare
* `--cloudflare-dns-records-per-page=100` When using the Cloudflare provider, specify how many DNS records listed per page, max possible 5,000 (default: 100)
* OVH
* `--ovh-api-rate-limit=20` When using the OVH provider, specify the API request rate limit, X operations by seconds (default: 20)
* Global
* `--registry=txt` The registry implementation to use to keep track of DNS record ownership. Other registry options such as dynamodb can help mitigate rate limits by storing the registry outside of the DNS hosted zone (default: txt, options: txt, noop, dynamodb, aws-sd)
* `--txt-cache-interval=0s` The interval between cache synchronizations in duration format (default: disabled)
* `--interval=1m0s` The interval between two consecutive synchronizations in duration format (default: 1m)
* `--min-event-sync-interval=5s` The minimum interval between two consecutive synchronizations triggered from kubernetes events in duration format (default: 5s)
* `--[no-]events` When enabled, in addition to running every interval, the reconciliation loop will get triggered when supported sources change (default: disabled)
A general recommendation is to enable `--events` and keep `--min-event-sync-interval` relatively low to have a better responsiveness when records are
created or updated inside the cluster.
This should represent an acceptable propagation time between the creation of your k8s resources and the time they become registered in your DNS server.
On a general manner, the higher the `--provider-cache-time`, the lower the impact on the rate limits, but also, the slower the recovery in case of a deletion.
The `--provider-cache-time` value should hence be set to an acceptable time to automatically recover restore deleted records.
✍️ Note that caching is done within the external-dns controller memory. You can invalidate the cache at any point in time by restarting it (for example doing a rolling update).

150
docs/registry/dynamodb.md
View File

@ -1,19 +1,11 @@
# The DynamoDB registry
The DynamoDB registry stores DNS record metadata in an AWS DynamoDB table.
## The DynamoDB Table
By default, the DynamoDB registry stores data in the table named `external-dns`.
A different table may be specified using the `--dynamodb-table` flag.
A different region may be specified using the `--dynamodb-region` flag.
The table must have a partition (hash) key named `k` and string type.
The table must not have a sort (range) key.
As opposed to the default TXT registry, the DynamoDB registry stores DNS record metadata in an AWS DynamoDB table instead of in TXT records in a hosted zone.
This following tutorial extends [Setting up ExternalDNS for Services on AWS](../tutorials/aws.md) to use the DynamoDB registry instead.
## IAM permissions
The ExternalDNS Role must be granted the following permissions:
The ExternalDNS [IAM Policy](../tutorials/aws.md#iam-policy) must additionally be granted the following permissions:
```json
{
@ -31,12 +23,140 @@ The ExternalDNS Role must be granted the following permissions:
}
```
The region and account ID may be specified explicitly specified instead of using wildcards.
The region and account ID may be specified explicitly specified instead of using wildcards.
## Create a DynamoDB Table
By default, the DynamoDB registry stores data in the table named `external-dns` and it needs to exist before configuring ExternalDNS to use the DynamoDB registry.
If the DynamoDB table has a different name, it may be specified using the `--dynamodb-table` flag.
If the DynamoDB table is in a different region, it may be specified using the `--dynamodb-region` flag.
The following command creates a DynamoDB table with the name: `external-dns`:
> The table must have a partition (HASH) key named `k` of type string (`S`) and the table must NOT have a sort (RANGE) key.
```bash
aws dynamodb create-table \
--table-name external-dns \
--attribute-definitions \
AttributeName=k,AttributeType=S \
--key-schema \
AttributeName=k,KeyType=HASH \
--provisioned-throughput \
ReadCapacityUnits=5,WriteCapacityUnits=5 \
--table-class STANDARD
```
## Set up a hosted zone
Follow [Set up a hosted zone](../tutorials/aws.md#set-up-a-hosted-zone)
## Modify ExternalDNS deployment
The ExternalDNS deployment from [Deploy ExternalDNS](../tutorials/aws.md#deploy-externaldns) needs the following modifications:
* `--registry=txt` should be changed to `--registry=dynamodb`
* Add `--dynamodb-table=external-dns` to specify the name of the DynamoDB table, its value defaults to `external-dns`
* Add `--dynamodb-region=us-east-1` to specify the region of the DynamoDB table
For example:
```yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: external-dns
labels:
app.kubernetes.io/name: external-dns
spec:
strategy:
type: Recreate
selector:
matchLabels:
app.kubernetes.io/name: external-dns
template:
metadata:
labels:
app.kubernetes.io/name: external-dns
spec:
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=service
- --source=ingress
- --domain-filter=example.com # will make ExternalDNS see only the hosted zones matching provided domain, omit to process all available hosted zones
- --provider=aws
- --policy=upsert-only # would prevent ExternalDNS from deleting any records, omit to enable full synchronization
- --aws-zone-type=public # only look at public hosted zones (valid values are public, private or no value for both)
- --registry=dynamodb # previously, --registry=txt
- --dynamodb-table=external-dns # defaults to external-dns
- --dynamodb-region=us-east-1 # set to the region the DynamoDB table in
- --txt-owner-id=my-hostedzone-identifier
env:
- name: AWS_DEFAULT_REGION
value: us-east-1 # change to region where EKS is installed
# # Uncomment below if using static credentials
# - name: AWS_SHARED_CREDENTIALS_FILE
# value: /.aws/credentials
# volumeMounts:
# - name: aws-credentials
# mountPath: /.aws
# readOnly: true
# volumes:
# - name: aws-credentials
# secret:
# secretName: external-dns
```
## Validate ExternalDNS works
Create either a [Service](../tutorials/aws.md#verify-externaldns-works-service-example) or an [Ingress](../tutorials/aws.md#verify-externaldns-works-ingress-example) and
After roughly two minutes, check that the corresponding entry was created in the DynamoDB table:
```bash
aws dynamodb scan --table-name external-dns
```
This will show something like:
```
{
"Items": [
{
"k": {
"S": "nginx.example.com#A#"
},
"o": {
"S": "my-identifier"
},
"l": {
"M": {
"resource": {
"S": "service/default/nginx"
}
}
}
}
],
"Count": 1,
"ScannedCount": 1,
"ConsumedCapacity": null
}
```
## Clean up
In addition to the clean up steps in [Setting up ExternalDNS for Services on AWS](../tutorials/aws.md#clean-up), delete the DynamoDB table that was used as a registry.
```bash
aws dynamodb delete-table \
--table-name external-dns
```
## Caching
The DynamoDB registry can optionally cache DNS records read from the provider. This can mitigate
rate limits imposed by the provider.
The DynamoDB registry can optionally cache DNS records read from the provider. This can mitigate rate limits imposed by the provider.
Caching is enabled by specifying a cache duration with the `--txt-cache-interval` flag.
@ -48,4 +168,4 @@ the metadata therein to the DynamoDB table. If any such TXT records exist, any p
must be supplied.
If TXT records are in the set of managed record types specified by `--managed-record-types`,
it will then delete the ownership TXT records on a subsequent reconciliation.
it will then delete the ownership TXT records on a subsequent reconciliation.

2
docs/release.md
View File

@ -31,7 +31,7 @@ You must be an official maintainer of the project to be able to do a release.
- Branch out from the default branch and run `scripts/kustomize-version-updater.sh` to update the image tag used in the kustomization.yaml.
- Create an issue to release the corresponding Helm chart via the chart release process (below) assigned to a chart maintainer
- Create a PR with the kustomize change.
- Create a PR to replace all versions for docker images in the tutorials. A possible script to use is `sd registry.k8s.io/external-dns/external-dns:.* registry.k8s.io/external-dns/external-dns:v0.14.2 $(fd --type file)` which uses the `fd` and `sd` utilities.
- Create a PR to replace all versions for docker images in the tutorials. A possible script to use is `sd registry.k8s.io/external-dns/external-dns:v0.15.0`
- Once the PR is merged, all is done :-)
## How to release a new chart version

4
docs/sources/sources.md → docs/sources/about.md
View File

@ -1,8 +1,8 @@
# Sources
# About
| Source | Resources | annotation-filter | label-filter |
|---------------------------------|-------------------------------------------------------------------------------|-------------------|--------------|
| ambassador-host | Host.getambassador.io | | |
| ambassador-host | Host.getambassador.io | Yes | Yes |
| connector | | | |
| contour-httpproxy | HttpProxy.projectcontour.io | Yes | |
| cloudfoundry | | | |

4
docs/tutorials/f5-virtualserver.md → docs/sources/f5-virtualserver.md
View File

@ -1,4 +1,4 @@
# Configuring ExternalDNS to use the F5 Networks VirtualServer Source
# F5 Networks VirtualServer Source
This tutorial describes how to configure ExternalDNS to use the F5 Networks VirtualServer Source. It is meant to supplement the other provider-specific setup tutorials.
The F5 Networks VirtualServer CRD is part of [this](https://github.com/F5Networks/k8s-bigip-ctlr) project. See more in-depth info regarding the VirtualServer CRD [here](https://github.com/F5Networks/k8s-bigip-ctlr/blob/master/docs/config_examples/customResource/CustomResource.md#virtualserver).
@ -30,4 +30,4 @@ Note that, in case you're not installing via Helm, you'll need the following in
- get
- list
- watch
```
```

4
docs/tutorials/gateway-api.md → docs/sources/gateway-api.md
View File

@ -1,4 +1,4 @@
# Configuring ExternalDNS to use Gateway API Route Sources
# Gateway API Route Sources
This describes how to configure ExternalDNS to use Gateway API Route sources.
It is meant to supplement the other provider-specific setup tutorials.
@ -87,7 +87,7 @@ spec:
serviceAccountName: external-dns
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
# Add desired Gateway API Route sources.
- --source=gateway-httproute

106
docs/sources/gateway.md
View File

@ -5,7 +5,7 @@ sources create DNS entries based on their respective `gateway.networking.k8s.io`
## Filtering the Routes considered
These sources support the `--label-filter` flag, which filters *Route resources
These sources support the `--label-filter` flag, which filters \*Route resources
by a set of labels.
## Domain names
@ -16,67 +16,103 @@ of [domain names from the *Route](#domain-names-from-route).
It then iterates over each of the `status.parents` with
a [matching Gateway](#matching-gateways) and at least one [matching listener](#matching-listeners).
For each matching listener, if the
listener has a `hostname`, it narrows the set of domain names from the *Route to the portion
listener has a `hostname`, it narrows the set of domain names from the \*Route to the portion
that overlaps the `hostname`. If a matching listener does not have a `hostname`, it uses
the un-narrowed set of domain names.
### Domain names from Route
The set of domain names from a *Route is sourced from the following places:
The set of domain names from a \*Route is sourced from the following places:
* If the *Route is a GRPCRoute, HTTPRoute, or TLSRoute, adds each of the`spec.hostnames`.
- If the \*Route is a GRPCRoute, HTTPRoute, or TLSRoute, adds each of the`spec.hostnames`.
* Adds the hostnames from any `external-dns.alpha.kubernetes.io/hostname` annotation on the *Route.
This behavior is suppressed if the `--ignore-hostname-annotation` flag was specified.
- Adds the hostnames from any `external-dns.alpha.kubernetes.io/hostname` annotation on the \*Route.
This behavior is suppressed if the `--ignore-hostname-annotation` flag was specified.
* If no endpoints were produced by the previous steps
or the `--combine-fqdn-annotation` flag was specified, then adds hostnames
generated from any`--fqdn-template` flag.
- If no endpoints were produced by the previous steps
or the `--combine-fqdn-annotation` flag was specified, then adds hostnames
generated from any`--fqdn-template` flag.
* If no endpoints were produced by the previous steps, each
attached Gateway listener will use its `hostname`, if present.
- If no endpoints were produced by the previous steps, each
attached Gateway listener will use its `hostname`, if present.
### Matching Gateways
Matching Gateways are discovered by iterating over the *Route's `status.parents`:
Matching Gateways are discovered by iterating over the \*Route's `status.parents`:
* Ignores parents with a `parentRef.group` other than
`gateway.networking.k8s.io` or a `parentRef.kind` other than `Gateway`.
- Ignores parents with a `parentRef.group` other than
`gateway.networking.k8s.io` or a `parentRef.kind` other than `Gateway`.
* If the `--gateway-namespace` flag was specified, ignores parents with a `parentRef.namespace` other
than the specified value.
- If the `--gateway-namespace` flag was specified, ignores parents with a `parentRef.namespace` other
than the specified value.
* If the `--gateway-label-filter` flag was specified, ignores parents whose Gateway does not match the
specified label filter.
- If the `--gateway-label-filter` flag was specified, ignores parents whose Gateway does not match the
specified label filter.
* Ignores parents whose Gateway either does not exist or has not accepted the route.
- Ignores parents whose Gateway either does not exist or has not accepted the route.
### Matching listeners
Iterates over all listeners for the parent's `parentRef.sectionName`:
* Ignores listeners whose `protocol` field does not match the kind of the *Route per the following table:
- Ignores listeners whose `protocol` field does not match the kind of the \*Route per the following table:
| kind | protocols |
|------------|-------------|
| GRPCRoute | HTTP, HTTPS |
| HTTPRoute | HTTP, HTTPS |
| TCPRoute | TCP |
| TLSRoute | TLS |
| UDPRoute | UDP |
| kind | protocols |
| --------- | ----------- |
| GRPCRoute | HTTP, HTTPS |
| HTTPRoute | HTTP, HTTPS |
| TCPRoute | TCP |
| TLSRoute | TLS |
| UDPRoute | UDP |
* If the parent's `parentRef.port` port is specified, ignores listeners without a matching `port`.
- If the parent's `parentRef.port` port is specified, ignores listeners without a matching `port`.
* Ignores listeners which specify an `allowedRoutes` which does not allow the route.
- Ignores listeners which specify an `allowedRoutes` which does not allow the route.
## Targets
The targets of the DNS entries created from a *Route are sourced from the following places:
The targets of the DNS entries created from a \*Route are sourced from the following places:
1. If a matching parent Gateway has an `external-dns.alpha.kubernetes.io/target` annotation, uses
the values from that.
1. If a matching parent Gateway has an `external-dns.alpha.kubernetes.io/target` annotation, uses
the values from that.
2. Otherwise, iterates over that parent Gateway's `status.addresses`,
adding each address's `value`.
2. Otherwise, iterates over that parent Gateway's `status.addresses`,
adding each address's `value`.
The targets from each parent Gateway matching the *Route are then combined and de-duplicated.
The targets from each parent Gateway matching the \*Route are then combined and de-duplicated.
## Dualstack Routes
Gateway resources may be served from an external-loadbalancer which may support both IPv4 and "dualstack" (both IPv4 and IPv6) interfaces.
External DNS Controller uses the `external-dns.alpha.kubernetes.io/dualstack` annotation to determine this. If this annotation is
set to `true` then ExternalDNS will create two records (one A record
and one AAAA record) for each hostname associated with the Route resource.
Example:
```yaml
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
annotations:
external-dns.alpha.kubernetes.io/dualstack: "true"
name: echo
spec:
hostnames:
- echoserver.example.org
rules:
- backendRefs:
- group: ""
kind: Service
name: echo
port: 1027
weight: 1
matches:
- path:
type: PathPrefix
value: /echo
```
The above HTTPRoute resource is backed by a dualstack Gateway.
ExternalDNS will create both an A `echoserver.example.org` record and
an AAAA record of the same name, that each are aliases for the same LB.

6
docs/tutorials/gloo-proxy.md → docs/sources/gloo-proxy.md
View File

@ -1,4 +1,4 @@
# Configuring ExternalDNS to use the Gloo Proxy Source
# Gloo Proxy Source
This tutorial describes how to configure ExternalDNS to use the Gloo Proxy source.
It is meant to supplement the other provider-specific setup tutorials.
@ -22,7 +22,7 @@ spec:
containers:
- name: external-dns
# update this to the desired external-dns version
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=gloo-proxy
- --gloo-namespace=custom-gloo-system # gloo system namespace. Specify multiple times for multiple namespaces. Omit to use the default (gloo-system)
@ -90,7 +90,7 @@ spec:
containers:
- name: external-dns
# update this to the desired external-dns version
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=gloo-proxy
- --gloo-namespace=custom-gloo-system # gloo system namespace. Specify multiple times for multiple namespaces. Omit to use the default (gloo-system)

17
docs/tutorials/istio.md → docs/sources/istio.md
View File

@ -1,4 +1,5 @@
# Configuring ExternalDNS to use the Istio Gateway and/or Istio Virtual Service Source
# Istio Gateway / Virtual Service Source
This tutorial describes how to configure ExternalDNS to use the Istio Gateway source.
It is meant to supplement the other provider-specific setup tutorials.
@ -28,7 +29,7 @@ spec:
spec:
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=service
- --source=ingress
@ -43,6 +44,7 @@ spec:
```
### Manifest (for clusters with RBAC enabled)
```yaml
apiVersion: v1
kind: ServiceAccount
@ -58,7 +60,7 @@ rules:
resources: ["services","endpoints","pods"]
verbs: ["get","watch","list"]
- apiGroups: ["extensions","networking.k8s.io"]
resources: ["ingresses"]
resources: ["ingresses"]
verbs: ["get","watch","list"]
- apiGroups: [""]
resources: ["nodes"]
@ -98,7 +100,7 @@ spec:
serviceAccountName: external-dns
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=service
- --source=ingress
@ -134,7 +136,7 @@ kubectl patch clusterrole external-dns --type='json' \
### Verify that Istio Gateway/VirtualService Source works
Follow the [Istio ingress traffic tutorial](https://istio.io/docs/tasks/traffic-management/ingress/)
Follow the [Istio ingress traffic tutorial](https://istio.io/docs/tasks/traffic-management/ingress/)
to deploy a sample service that will be exposed outside of the service mesh.
The following are relevant snippets from that tutorial.
@ -150,7 +152,9 @@ $ kubectl apply -f <(istioctl kube-inject -f https://raw.githubusercontent.com/i
```
#### Using a Gateway as a source
##### Create an Istio Gateway:
```bash
$ cat <<EOF | kubectl apply -f -
apiVersion: networking.istio.io/v1alpha3
@ -172,6 +176,7 @@ EOF
```
##### Configure routes for traffic entering via the Gateway:
```bash
$ cat <<EOF | kubectl apply -f -
apiVersion: networking.istio.io/v1alpha3
@ -200,6 +205,7 @@ EOF
#### Using a VirtualService as a source
##### Create an Istio Gateway:
```bash
$ cat <<EOF | kubectl apply -f -
apiVersion: networking.istio.io/v1alpha3
@ -221,6 +227,7 @@ EOF
```
##### Configure routes for traffic entering via the Gateway:
```bash
$ cat <<EOF | kubectl apply -f -
apiVersion: networking.istio.io/v1alpha3

8
docs/tutorials/kong.md → docs/sources/kong.md
View File

@ -1,8 +1,10 @@
# Configuring ExternalDNS to use the Kong TCPIngress Source
# Kong TCPIngress Source
This tutorial describes how to configure ExternalDNS to use the Kong TCPIngress source.
It is meant to supplement the other provider-specific setup tutorials.
### Manifest (for clusters without RBAC enabled)
```yaml
apiVersion: apps/v1
kind: Deployment
@ -22,7 +24,7 @@ spec:
containers:
- name: external-dns
# update this to the desired external-dns version
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=kong-tcpingress
- --provider=aws
@ -86,7 +88,7 @@ spec:
containers:
- name: external-dns
# update this to the desired external-dns version
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=kong-tcpingress
- --provider=aws

2
docs/tutorials/mx-record.md → docs/sources/mx-record.md
View File

@ -1,4 +1,4 @@
# Creating MX record with CRD source
# MX record with CRD source
You can create and manage MX records with the help of [CRD source](../contributing/crd-source.md)
and `DNSEndpoint` CRD. Currently, this feature is only supported by `aws`, `azure`, and `google` providers.

6
docs/tutorials/nodes.md → docs/sources/nodes.md
View File

@ -1,4 +1,4 @@
# Configuring ExternalDNS to use Cluster Nodes as Source
# Cluster Nodes as Source
This tutorial describes how to configure ExternalDNS to use the cluster nodes as source.
Using nodes (`--source=node`) as source is possible to synchronize a DNS zone with the nodes of a cluster.
@ -29,7 +29,7 @@ spec:
serviceAccountName: external-dns
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=node # will use nodes as source
- --provider=aws
@ -100,7 +100,7 @@ spec:
serviceAccountName: external-dns
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=node # will use nodes as source
- --provider=aws

2
docs/tutorials/ns-record.md → docs/sources/ns-record.md
View File

@ -1,4 +1,4 @@
# Creating NS record with CRD source
# NS record with CRD source
You can create NS records with the help of [CRD source](../contributing/crd-source.md)
and `DNSEndpoint` CRD.

7
docs/tutorials/openshift.md → docs/sources/openshift.md
View File

@ -1,4 +1,5 @@
# Configuring ExternalDNS to use the OpenShift Route Source
# OpenShift Route Source
This tutorial describes how to configure ExternalDNS to use the OpenShift Route source.
It is meant to supplement the other provider-specific setup tutorials.
@ -66,7 +67,7 @@ spec:
spec:
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=openshift-route
- --domain-filter=external-dns-test.my-org.com # will make ExternalDNS see only the hosted zones matching provided domain, omit to process all available hosted zones
@ -133,7 +134,7 @@ spec:
serviceAccountName: external-dns
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=openshift-route
- --domain-filter=external-dns-test.my-org.com # will make ExternalDNS see only the hosted zones matching provided domain, omit to process all available hosted zones

8
docs/tutorials/traefik-proxy.md → docs/sources/traefik-proxy.md
View File

@ -1,4 +1,4 @@
# Configuring ExternalDNS to use the Traefik Proxy Source
# Traefik Proxy Source
This tutorial describes how to configure ExternalDNS to use the Traefik Proxy source.
It is meant to supplement the other provider-specific setup tutorials.
@ -24,7 +24,7 @@ spec:
containers:
- name: external-dns
# update this to the desired external-dns version
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=traefik-proxy
- --provider=aws
@ -87,7 +87,7 @@ spec:
containers:
- name: external-dns
# update this to the desired external-dns version
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=traefik-proxy
- --provider=aws
@ -96,7 +96,9 @@ spec:
```
## Deploying a Traefik IngressRoute
Create a IngressRoute file called 'traefik-ingress.yaml' with the following contents:
```yaml
apiVersion: traefik.io/v1alpha1
kind: IngressRoute

4
docs/ttl.md
View File

@ -45,7 +45,6 @@ Providers
- [x] Linode
- [x] TransIP
- [x] RFC2136
- [x] Vultr
- [x] UltraDNS
PRs welcome!
@ -86,8 +85,5 @@ The Linode Provider default TTL is used when the TTL is 0. The default is 24 hou
### TransIP Provider
The TransIP Provider minimal TTL is used when the TTL is 0. The minimal TTL is 60s.
### Vultr Provider
The Vultr provider minimal TTL is used when the TTL is 0. The default is 1 hour.
### UltraDNS
The UltraDNS provider minimal TTL is used when the TTL is not provided. The default TTL is account level default TTL, if defined, otherwise 24 hours.

210
docs/tutorials/ANS_Group_SafeDNS.md
View File

@ -1,210 +0,0 @@
# Setting up ExternalDNS for Services on ANS Group's SafeDNS
This tutorial describes how to setup ExternalDNS for usage within a Kubernetes cluster using SafeDNS.
Make sure to use **>=0.11.0** version of ExternalDNS for this tutorial.
## Managing DNS with SafeDNS
If you want to learn about how to use the SafeDNS service read the following tutorials:
To learn more about the use of SafeDNS in general, see the following page:
[ANS Group's SafeDNS documentation](https://docs.ukfast.co.uk/domains/safedns/index.html).
## Creating SafeDNS credentials
Generate a fresh API token for use with ExternalDNS, following the instructions
at the ANS Group developer [Getting-Started](https://developers.ukfast.io/getting-started)
page. You will need to grant read/write access to the SafeDNS API. No access to
any other ANS Group service is required.
The environment variable `SAFEDNS_TOKEN` must have a value of this token to run
ExternalDNS with SafeDNS integration.
## Deploy ExternalDNS
Connect your `kubectl` client to the cluster you want to test ExternalDNS with.
Then apply one of the following manifests file to deploy ExternalDNS.
### Manifest (for clusters without RBAC enabled)
```yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: external-dns
spec:
strategy:
type: Recreate
selector:
matchLabels:
app: external-dns
template:
metadata:
labels:
app: external-dns
spec:
containers:
- name: external-dns
# You will need to check what the latest version is yourself:
# https://github.com/kubernetes-sigs/external-dns/releases
image: registry.k8s.io/external-dns/external-dns:v0.14.2
args:
- --source=service # ingress is also possible
# (optional) limit to only example.com domains; change to match the
# zone created above.
- --domain-filter=example.com
- --provider=safedns
env:
- name: SAFEDNS_TOKEN
value: "SAFEDNSTOKENSAFEDNSTOKEN"
```
### Manifest (for clusters with RBAC enabled)
```yaml
apiVersion: v1
kind: ServiceAccount
metadata:
name: external-dns
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: external-dns
rules:
- apiGroups: [""]
resources: ["services","endpoints","pods"]
verbs: ["get","watch","list"]
- apiGroups: ["extensions","networking.k8s.io"]
resources: ["ingresses"]
verbs: ["get","watch","list"]
- apiGroups: [""]
resources: ["nodes"]
verbs: ["list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: external-dns-viewer
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: external-dns
subjects:
- kind: ServiceAccount
name: external-dns
namespace: default
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: external-dns
spec:
strategy:
type: Recreate
selector:
matchLabels:
app: external-dns
template:
metadata:
labels:
app: external-dns
spec:
serviceAccountName: external-dns
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
args:
- --source=service # ingress is also possible
# (optional) limit to only example.com domains; change to match the
# zone created above.
- --domain-filter=example.com
- --provider=safedns
env:
- name: SAFEDNS_TOKEN
value: "SAFEDNSTOKENSAFEDNSTOKEN"
```
## Deploying an Nginx Service
Create a service file called 'nginx.yaml' with the following contents:
```yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: nginx
spec:
selector:
matchLabels:
app: nginx
template:
metadata:
labels:
app: nginx
spec:
containers:
- image: nginx
name: nginx
ports:
- containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
name: nginx
annotations:
external-dns.alpha.kubernetes.io/hostname: my-app.example.com
spec:
selector:
app: nginx
type: LoadBalancer
ports:
- protocol: TCP
port: 80
targetPort: 80
```
Note the annotation on the service; use a hostname that matches the domain
filter specified above.
ExternalDNS uses this annotation to determine what services should be registered
with DNS. Removing the annotation will cause ExternalDNS to remove the
corresponding DNS records.
Create the deployment and service:
```console
$ kubectl create -f nginx.yaml
```
Depending where you run your service it can take a little while for your cloud
provider to create an external IP for the service.
Once the service has an external IP assigned, ExternalDNS will notice the new
service IP address and synchronize the SafeDNS records.
## Verifying SafeDNS records
Check your [SafeDNS UI](https://my.ukfast.co.uk/safedns/index.php) and select
the appropriate domain to view the records for your SafeDNS zone.
This should show the external IP address of the service as the A record for your
domain.
Alternatively, you can perform a DNS lookup for the hostname specified:
```console
$ dig +short my-app.example.com
an.ip.addr.ess
```
## Cleanup
Now that we have verified that ExternalDNS will automatically manage SafeDNS
records, we can delete the tutorial's example:
```
$ kubectl delete service -f nginx.yaml
$ kubectl delete service -f externaldns.yaml
```

6
docs/tutorials/akamai-edgedns.md
View File

@ -1,4 +1,4 @@
# Setting up External-DNS for Services on Akamai Edge DNS
# Akamai Edge DNS
## Prerequisites
@ -104,7 +104,7 @@ spec:
serviceAccountName: external-dns
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=service # or ingress or both
- --provider=akamai
@ -190,7 +190,7 @@ spec:
serviceAccountName: external-dns
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=service # or ingress or both
- --provider=akamai

6
docs/tutorials/alibabacloud.md
View File

@ -1,4 +1,4 @@
# Setting up ExternalDNS for Services on Alibaba Cloud
# Alibaba Cloud
This tutorial describes how to setup ExternalDNS for usage within a Kubernetes cluster on Alibaba Cloud. Make sure to use **>=0.5.6** version of ExternalDNS for this tutorial
@ -113,7 +113,7 @@ spec:
spec:
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=service
- --source=ingress
@ -187,7 +187,7 @@ spec:
serviceAccountName: external-dns
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=service
- --source=ingress

2
docs/tutorials/aws-load-balancer-controller.md
View File

@ -1,4 +1,4 @@
# Using ExternalDNS with aws-load-balancer-controller
# AWS Load Balancer Controller
This tutorial describes how to use ExternalDNS with the [aws-load-balancer-controller][1].

10
docs/tutorials/public-private-route53.md → docs/tutorials/aws-public-private-route53.md
View File

@ -1,10 +1,10 @@
# Setting up ExternalDNS using the same domain for public and private Route53 zones
# AWS Route53 with same domain for public and private zones
This tutorial describes how to setup ExternalDNS using the same domain for public and private Route53 zones and [nginx-ingress-controller](https://github.com/kubernetes/ingress-nginx). It also outlines how to use [cert-manager](https://github.com/jetstack/cert-manager) to automatically issue SSL certificates from [Let's Encrypt](https://letsencrypt.org/) for both public and private records.
## Deploy public nginx-ingress-controller
Consult [External DNS nginx ingress docs](nginx-ingress.md) for installation guidelines.
You may be interested with [GKE with nginx ingress](gke-nginx.md) for installation guidelines.
Specify `ingress-class` in nginx-ingress-controller container args:
@ -107,8 +107,6 @@ spec:
## Deploy private nginx-ingress-controller
Consult [External DNS nginx ingress docs](nginx-ingress.md) for installation guidelines.
Make sure to specify `ingress-class` in nginx-ingress-controller container args:
```yaml
@ -243,7 +241,7 @@ spec:
- --txt-owner-id=external-dns
- --ingress-class=external-ingress
- --aws-zone-type=public
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
name: external-dns-public
```
@ -281,7 +279,7 @@ spec:
- --txt-owner-id=dev.k8s.nexus
- --ingress-class=internal-ingress
- --aws-zone-type=private
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
name: external-dns-private
```

8
docs/tutorials/aws-sd.md
View File

@ -1,4 +1,4 @@
# Setting up ExternalDNS using AWS Cloud Map API
# AWS Cloud Map API
This tutorial describes how to set up ExternalDNS for usage within a Kubernetes cluster with [AWS Cloud Map API](https://docs.aws.amazon.com/cloud-map/).
@ -81,7 +81,7 @@ spec:
spec:
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
env:
- name: AWS_REGION
value: us-east-1 # put your CloudMap NameSpace region
@ -148,7 +148,7 @@ spec:
serviceAccountName: external-dns
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
env:
- name: AWS_REGION
value: us-east-1 # put your CloudMap NameSpace region
@ -221,7 +221,7 @@ metadata:
name: nginx
annotations:
external-dns.alpha.kubernetes.io/hostname: nginx.external-dns-test.my-org.com
external-dns.alpha.kubernetes.io/ttl: 60
external-dns.alpha.kubernetes.io/ttl: "60"
spec:
...
```

134
docs/tutorials/aws.md
View File

@ -1,4 +1,4 @@
# Setting up ExternalDNS for Services on AWS
# AWS
This tutorial describes how to setup ExternalDNS for usage within a Kubernetes cluster on AWS. Make sure to use **>=0.15.0** version of ExternalDNS for this tutorial
@ -418,7 +418,7 @@ Finally, install the ExternalDNS chart with Helm using the configuration specifi
helm upgrade --install external-dns external-dns/external-dns --values values.yaml
```
### Manifest (for clusters without RBAC enabled)
### When using clusters without RBAC enabled
Save the following below as `externaldns-no-rbac.yaml`.
@ -442,7 +442,7 @@ spec:
spec:
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=service
- --source=ingress
@ -475,99 +475,40 @@ kubectl create --filename externaldns-no-rbac.yaml \
--namespace ${EXTERNALDNS_NS:-"default"}
```
### Manifest (for clusters with RBAC enabled)
### When using clusters with RBAC enabled
Save the following below as `externaldns-with-rbac.yaml`.
If you're using EKS, you can update the `values.yaml` file you created earlier to include the annotations to link the Role ARN you created before.
```yaml
# comment out sa if it was previously created
apiVersion: v1
kind: ServiceAccount
metadata:
name: external-dns
labels:
app.kubernetes.io/name: external-dns
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: external-dns
labels:
app.kubernetes.io/name: external-dns
rules:
- apiGroups: [""]
resources: ["services","endpoints","pods","nodes"]
verbs: ["get","watch","list"]
- apiGroups: ["extensions","networking.k8s.io"]
resources: ["ingresses"]
verbs: ["get","watch","list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: external-dns-viewer
labels:
app.kubernetes.io/name: external-dns
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: external-dns
subjects:
- kind: ServiceAccount
name: external-dns
namespace: default # change to desired namespace: externaldns, kube-addons
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: external-dns
labels:
app.kubernetes.io/name: external-dns
spec:
strategy:
type: Recreate
selector:
matchLabels:
app.kubernetes.io/name: external-dns
template:
metadata:
labels:
app.kubernetes.io/name: external-dns
spec:
serviceAccountName: external-dns
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
args:
- --source=service
- --source=ingress
- --domain-filter=example.com # will make ExternalDNS see only the hosted zones matching provided domain, omit to process all available hosted zones
- --provider=aws
- --policy=upsert-only # would prevent ExternalDNS from deleting any records, omit to enable full synchronization
- --aws-zone-type=public # only look at public hosted zones (valid values are public, private or no value for both)
- --registry=txt
- --txt-owner-id=external-dns
env:
- name: AWS_DEFAULT_REGION
value: us-east-1 # change to region where EKS is installed
# # Uncommend below if using static credentials
# - name: AWS_SHARED_CREDENTIALS_FILE
# value: /.aws/credentials
# volumeMounts:
# - name: aws-credentials
# mountPath: /.aws
# readOnly: true
# volumes:
# - name: aws-credentials
# secret:
# secretName: external-dns
provider:
name: aws
serviceAccount:
annotations:
eks.amazonaws.com/role-arn: arn:aws:iam::${ACCOUNT_ID}:role/${EXTERNALDNS_ROLE_NAME:-"external-dns"}
```
When ready deploy:
If you need to provide credentials directly using a secret (ie. You're not using EKS), you can change the `values.yaml` file to include volume and volume mounts.
```bash
kubectl create --filename externaldns-with-rbac.yaml \
--namespace ${EXTERNALDNS_NS:-"default"}
```yaml
provider:
name: aws
env:
- name: AWS_SHARED_CREDENTIALS_FILE
value: /etc/aws/credentials/my_credentials
extraVolumes:
- name: aws-credentials
secret:
secretName: external-dns # In this example, the secret will have the data stored in a key named `my_credentials`
extraVolumeMounts:
- name: aws-credentials
mountPath: /etc/aws/credentials
readOnly: true
```
When ready, update your Helm installation:
```shell
helm upgrade --install external-dns external-dns/external-dns --values values.yaml
```
## Arguments
@ -584,7 +525,7 @@ Annotations which are specific to AWS.
### alias
`external-dns.alpha.kubernetes.io/alias` if set to `true` on an ingress, it will create an ALIAS record when the target is an ALIAS as well. To make the target an alias, the ingress needs to be configured correctly as described in [the docs](./nginx-ingress.md#with-a-separate-tcp-load-balancer). In particular, the argument `--publish-service=default/nginx-ingress-controller` has to be set on the `nginx-ingress-controller` container. If one uses the `nginx-ingress` Helm chart, this flag can be set with the `controller.publishService.enabled` configuration option.
`external-dns.alpha.kubernetes.io/alias` if set to `true` on an ingress, it will create an ALIAS record when the target is an ALIAS as well. To make the target an alias, the ingress needs to be configured correctly as described in [the docs](./gke-nginx.md#with-a-separate-tcp-load-balancer). In particular, the argument `--publish-service=default/nginx-ingress-controller` has to be set on the `nginx-ingress-controller` container. If one uses the `nginx-ingress` Helm chart, this flag can be set with the `controller.publishService.enabled` configuration option.
### target-hosted-zone
@ -915,6 +856,10 @@ env:
key: {{ YOUR_SECRET_KEY }}
```
## DynamoDB Registry
The DynamoDB Registry can be used to store dns records metadata. See the [DynamoDB Registry Tutorial](../registry/dynamodb.md) for more information.
## Clean up
Make sure to delete all Service objects before terminating the cluster so all load balancers get cleaned up correctly.
@ -971,8 +916,11 @@ Route53 has a [5 API requests per second per account hard quota](https://docs.aw
Running several fast polling ExternalDNS instances in a given account can easily hit that limit. Some ways to reduce the request rate include:
* Reduce the polling loop's synchronization interval at the possible cost of slower change propagation (but see `--events` below to reduce the impact).
* `--interval=5m` (default `1m`)
* Trigger the polling loop on changes to K8s objects, rather than only at `interval`, to have responsive updates with long poll intervals
* Enable a Cache to store the zone records list. It comes with a cost: slower propagation when the zone gets modified from other sources such as the AWS console, terraform, cloudformation or anything similar.
* `--provider-cache-time=15m` (default `0m`)
* Trigger the polling loop on changes to K8s objects, rather than only at `interval` and ensure a minimum of time between events, to have responsive updates with long poll intervals
* `--events`
* `--min-event-sync-interval=5m` (default `5s`)
* Limit the [sources watched](https://github.com/kubernetes-sigs/external-dns/blob/master/pkg/apis/externaldns/types.go#L364) when the `--events` flag is specified to specific types, namespaces, labels, or annotations
* `--source=ingress --source=service` - specify multiple times for multiple sources
* `--namespace=my-app`
@ -1003,7 +951,7 @@ A simple way to implement randomised startup is with an init container:
spec:
initContainers:
- name: init-jitter
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
command:
- /bin/sh
- -c

16
docs/tutorials/azure-private-dns.md
View File

@ -1,4 +1,4 @@
# Set up ExternalDNS for Azure Private DNS
# Azure Private DNS
This tutorial describes how to set up ExternalDNS for managing records in Azure Private DNS.
@ -130,7 +130,7 @@ spec:
spec:
containers:
- name: externaldns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=service
- --source=ingress
@ -201,7 +201,7 @@ spec:
serviceAccountName: externaldns
containers:
- name: externaldns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=service
- --source=ingress
@ -272,7 +272,7 @@ spec:
serviceAccountName: externaldns
containers:
- name: externaldns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=service
- --source=ingress
@ -330,12 +330,12 @@ Apply the following manifest to create a service of type `LoadBalancer`. This wi
---
apiVersion: v1
kind: Service
annotations:
service.beta.kubernetes.io/azure-load-balancer-internal: "true"
external-dns.alpha.kubernetes.io/hostname: server.example.com
external-dns.alpha.kubernetes.io/internal-hostname: server-clusterip.example.com
metadata:
name: nginx-svc
annotations:
service.beta.kubernetes.io/azure-load-balancer-internal: "true"
external-dns.alpha.kubernetes.io/hostname: server.example.com
external-dns.alpha.kubernetes.io/internal-hostname: server-clusterip.example.com
spec:
ports:
- port: 80

9
docs/tutorials/azure.md
View File

@ -1,5 +1,4 @@
# Setting up ExternalDNS for Services on Azure
# Azure DNS
This tutorial describes how to setup ExternalDNS for [Azure DNS](https://azure.microsoft.com/services/dns/) with [Azure Kubernetes Service](https://docs.microsoft.com/azure/aks/).
@ -518,7 +517,7 @@ spec:
spec:
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=service
- --source=ingress
@ -586,7 +585,7 @@ spec:
serviceAccountName: external-dns
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=service
- --source=ingress
@ -657,7 +656,7 @@ spec:
serviceAccountName: external-dns
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=service
- --source=ingress

152
docs/tutorials/bluecat.md
View File

@ -1,152 +0,0 @@
# Setting up external-dns for BlueCat
The first external-dns release with with BlueCat provider support is v0.8.0.
## Prerequisites
Install the BlueCat Gateway product and deploy the [community gateway workflows](https://github.com/bluecatlabs/gateway-workflows).
## Configuration Options
There are two ways to pass configuration options to the Bluecat Provider JSON configuration file and command line flags. Currently if a valid configuration file is used all
BlueCat provider configurations will be taken from the configuration file. If a configuraiton file is not provided or cannot be read then all BlueCat provider configurations will
be taken from the command line flags. In the future an enhancement will be made to merge configuration options from the configuration file and command line flags if both are provided.
BlueCat provider supports getting the proxy URL from the environment variables. The format is the one specified by golang's [http.ProxyFromEnvironment](https://pkg.go.dev/net/http#ProxyFromEnvironment).
### Using CLI Flags
When using CLI flags to configure the Bluecat Provider the BlueCat Gateway credentials are passed in using environment variables `BLUECAT_USERNAME` and `BLUECAT_PASSWORD`.
#### Deploy
Setup up namespace, deployment, and service account:
```
kubectl create namespace bluecat-example
kubectl create secret generic bluecat-credentials --from-literal=username=bluecatuser --from-literal=password=bluecatpassword -n bluecat-example
cat << EOF > ~/bluecat.yml
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: external-dns
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: external-dns
spec:
selector:
matchLabels:
app: external-dns
strategy:
type: Recreate
template:
metadata:
labels:
app: external-dns
spec:
serviceAccountName: external-dns
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
args:
- --log-level=debug
- --source=service
- --provider=bluecat
- --txt-owner-id=bluecat-example
- --bluecat-dns-configuration=Example
- --bluecat-dns-view=Internal
- --bluecat-gateway-host=https://bluecatgw.example.com
- --bluecat-root-zone=example.com
env:
- name: BLUECAT_USERNAME
valueFrom:
secretKeyRef:
name: bluecat-credentials
key: username
- name: BLUECAT_PASSWORD
valueFrom:
secretKeyRef:
name: bluecat-credentials
key: password
EOF
kubectl apply -f ~/bluecat.yml -n bluecat-example
```
### Using JSON Configuration File
The options for configuring the Bluecat Provider are available through the JSON file provided to External-DNS via the flag `--bluecat-config-file`.
| Key | Required |
| ----------------- | ------------------ |
| gatewayHost | Yes |
| gatewayUsername | No |
| gatewayPassword | No |
| dnsConfiguration | Yes |
| dnsView | Yes |
| rootZone | Yes |
| dnsServerName | No |
| dnsDeployType | No |
| skipTLSVerify | No (default false) |
#### Deploy
Setup configuration file as k8s `Secret`.
```
cat << EOF > ~/bluecat.json
{
"gatewayHost": "https://bluecatgw.example.com",
"gatewayUsername": "user",
"gatewayPassword": "pass",
"dnsConfiguration": "Example",
"dnsView": "Internal",
"rootZone": "example.com",
"skipTLSVerify": false
}
EOF
kubectl create secret generic bluecatconfig --from-file ~/bluecat.json -n bluecat-example
```
Setup up namespace, deployment, and service account:
```
kubectl create namespace bluecat-example
cat << EOF > ~/bluecat.yml
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: external-dns
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: external-dns
spec:
selector:
matchLabels:
app: external-dns
strategy:
type: Recreate
template:
metadata:
labels:
app: external-dns
spec:
serviceAccountName: external-dns
volumes:
- name: bluecatconfig
secret:
secretName: bluecatconfig
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
volumeMounts:
- name: bluecatconfig
mountPath: "/etc/external-dns/"
readOnly: true
args:
- --log-level=debug
- --source=service
- --provider=bluecat
- --txt-owner-id=bluecat-example
- --bluecat-config-file=/etc/external-dns/bluecat.json
EOF
kubectl apply -f ~/bluecat.yml -n bluecat-example
```

8
docs/tutorials/civo.md
View File

@ -1,4 +1,4 @@
# Setting up ExternalDNS for Services on Civo
# Civo DNS
This tutorial describes how to setup ExternalDNS for usage within a Kubernetes cluster using Civo DNS Manager.
@ -40,7 +40,7 @@ spec:
spec:
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=service # ingress is also possible
- --domain-filter=example.com # (optional) limit to only example.com domains; change to match the zone created above.
@ -104,7 +104,7 @@ spec:
serviceAccountName: external-dns
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=service # ingress is also possible
- --domain-filter=example.com # (optional) limit to only example.com domains; change to match the zone created above.
@ -183,4 +183,4 @@ Now that we have verified that ExternalDNS will automatically manage Civo DNS re
```
$ kubectl delete service -f nginx.yaml
$ kubectl delete service -f externaldns.yaml
```
```

6
docs/tutorials/cloudflare.md
View File

@ -1,4 +1,4 @@
# Setting up ExternalDNS for Services on Cloudflare
# Cloudflare DNS
This tutorial describes how to setup ExternalDNS for usage within a Kubernetes cluster using Cloudflare DNS.
@ -121,7 +121,7 @@ spec:
spec:
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=service # ingress is also possible
- --domain-filter=example.com # (optional) limit to only example.com domains; change to match the zone created above.
@ -196,7 +196,7 @@ spec:
serviceAccountName: external-dns
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=service # ingress is also possible
- --domain-filter=example.com # (optional) limit to only example.com domains; change to match the zone created above.

6
docs/tutorials/contour.md
View File

@ -1,4 +1,4 @@
# Setting up External DNS with Contour
# Contour HTTPProxy
This tutorial describes how to configure External DNS to use the Contour `HTTPProxy` source.
Using the `HTTPProxy` resource with External DNS requires Contour version 1.5 or greater.
@ -24,7 +24,7 @@ spec:
spec:
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=service
- --source=ingress
@ -93,7 +93,7 @@ spec:
serviceAccountName: external-dns
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=service
- --source=ingress

54
docs/tutorials/coredns.md
View File

@ -1,39 +1,56 @@
# Setting up ExternalDNS for CoreDNS with minikube
# CoreDNS with minikube
:warning: This tutorial is out of date.
:information_source: PRs to update it are welcome !
This tutorial describes how to setup ExternalDNS for usage within a [minikube](https://github.com/kubernetes/minikube) cluster that makes use of [CoreDNS](https://github.com/coredns/coredns) and [nginx ingress controller](https://github.com/kubernetes/ingress-nginx).
You need to:
* install CoreDNS with [etcd](https://github.com/etcd-io/etcd) enabled
* install external-dns with coredns as a provider
* enable ingress controller for the minikube cluster
## Creating a cluster
```
```shell
minikube start
```
## Installing CoreDNS with etcd enabled
Helm chart is used to install etcd and CoreDNS.
### Initializing helm chart
```
```shell
helm init
```
### Installing etcd
[etcd operator](https://github.com/coreos/etcd-operator) is used to manage etcd clusters.
```
helm install stable/etcd-operator --name my-etcd-op
```
etcd cluster is installed with example yaml from etcd operator website.
```
```shell
kubectl apply -f https://raw.githubusercontent.com/coreos/etcd-operator/HEAD/example/example-etcd-cluster.yaml
```
### Installing CoreDNS
In order to make CoreDNS work with etcd backend, values.yaml of the chart should be changed with corresponding configurations.
```
wget https://raw.githubusercontent.com/helm/charts/HEAD/stable/coredns/values.yaml
```
You need to edit/patch the file with below diff
```diff
diff --git a/values.yaml b/values.yaml
index 964e72b..e2fa934 100644
@ -68,23 +85,29 @@ index 964e72b..e2fa934 100644
# Complete example with all the options:
# - zones: # the `zones` block can be left out entirely, defaults to "."
```
**Note**:
* IP address of etcd's endpoint should be get from etcd client service. It should be "example-etcd-cluster-client" in this example. This IP address is used through this document for etcd endpoint configuration.
```
```shell
$ kubectl get svc example-etcd-cluster-client
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
example-etcd-cluster-client ClusterIP 10.105.68.165 <none> 2379/TCP 16m
```
* Parameters should configure your own domain. "example.org" is used in this example.
After configuration done in values.yaml, you can install coredns chart.
```
```shell
helm install --name my-coredns --values values.yaml stable/coredns
```
## Installing ExternalDNS
### Install external ExternalDNS
ETCD_URLS is configured to etcd client service address.
Optionally, you can configure ETCD_USERNAME and ETCD_PASSWORD for authenticating to etcd. It is also possible to connect to the etcd cluster via HTTPS using the following environment variables: ETCD_CA_FILE, ETCD_CERT_FILE, ETCD_KEY_FILE, ETCD_TLS_SERVER_NAME, ETCD_TLS_INSECURE.
@ -109,7 +132,7 @@ spec:
spec:
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=ingress
- --provider=coredns
@ -176,7 +199,7 @@ spec:
serviceAccountName: external-dns
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=ingress
- --provider=coredns
@ -187,13 +210,16 @@ spec:
```
## Enable the ingress controller
You can use the ingress controller in minikube cluster. It needs to enable ingress addon in the cluster.
```
```shell
minikube addons enable ingress
```
## Testing ingress example
```
```shell
$ cat ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
@ -213,9 +239,9 @@ $ kubectl apply -f ingress.yaml
ingress.extensions "nginx" created
```
Wait a moment until DNS has the ingress IP. The DNS service IP is from CoreDNS service. It is "my-coredns-coredns" in this example.
```
```shell
$ kubectl get svc my-coredns-coredns
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
my-coredns-coredns ClusterIP 10.100.4.143 <none> 53/UDP 12m

6
docs/tutorials/designate.md
View File

@ -1,4 +1,4 @@
# Setting up ExternalDNS for Services on OpenStack Designate
# Designate DNS from OpenStack
This tutorial describes how to setup ExternalDNS for usage within a Kubernetes cluster using OpenStack Designate DNS.
@ -59,7 +59,7 @@ spec:
spec:
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=service # ingress is also possible
- --domain-filter=example.com # (optional) limit to only example.com domains; change to match the zone created above.
@ -136,7 +136,7 @@ spec:
serviceAccountName: external-dns
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=service # ingress is also possible
- --domain-filter=example.com # (optional) limit to only example.com domains; change to match the zone created above.

6
docs/tutorials/digitalocean.md
View File

@ -1,4 +1,4 @@
# Setting up ExternalDNS for Services on DigitalOcean
# DigitalOcean DNS
This tutorial describes how to setup ExternalDNS for usage within a Kubernetes cluster using DigitalOcean DNS.
@ -68,7 +68,7 @@ spec:
spec:
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=service # ingress is also possible
- --domain-filter=example.com # (optional) limit to only example.com domains; change to match the zone created above.
@ -135,7 +135,7 @@ spec:
serviceAccountName: external-dns
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=service # ingress is also possible
- --domain-filter=example.com # (optional) limit to only example.com domains; change to match the zone created above.

6
docs/tutorials/dnsimple.md
View File

@ -1,4 +1,4 @@
# Setting up ExternalDNS for Services on DNSimple
# DNSimple
This tutorial describes how to setup ExternalDNS for usage with DNSimple.
@ -39,7 +39,7 @@ spec:
spec:
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=service
- --domain-filter=example.com # (optional) limit to only example.com domains; change to match the zone you create in DNSimple.
@ -108,7 +108,7 @@ spec:
serviceAccountName: external-dns
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=service
- --domain-filter=example.com # (optional) limit to only example.com domains; change to match the zone you create in DNSimple.

149
docs/tutorials/dyn.md
View File

@ -1,149 +0,0 @@
# Setting up ExternalDNS for Dyn
## Creating a Dyn Configuration Secret
For ExternalDNS to access the Dyn API, create a Kubernetes secret.
To create the secret:
```
$ kubectl create secret generic external-dns \
--from-literal=EXTERNAL_DNS_DYN_CUSTOMER_NAME=${DYN_CUSTOMER_NAME} \
--from-literal=EXTERNAL_DNS_DYN_USERNAME=${DYN_USERNAME} \
--from-literal=EXTERNAL_DNS_DYN_PASSWORD=${DYN_PASSWORD}
```
The credentials are the same ones created during account registration. As best practise, you are advised to
create an API-only user that is entitled to only the zones intended to be changed by ExternalDNS
## Deploy ExternalDNS
The rest of this tutorial assumes you own `example.com` domain and your DNS provider is Dyn. Change `example.com`
with a domain/zone that you really own.
In case of the dyn provider, the flag `--zone-id-filter` is mandatory as it specifies which zones to scan for records. Without it
Create a deployment file called `externaldns.yaml` with the following contents:
```yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: external-dns
spec:
strategy:
type: Recreate
selector:
matchLabels:
app: external-dns
template:
metadata:
labels:
app: external-dns
spec:
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
args:
- --source=ingress
- --txt-prefix=_d
- --namespace=example
- --zone-id-filter=example.com
- --domain-filter=example.com
- --provider=dyn
env:
- name: EXTERNAL_DNS_DYN_CUSTOMER_NAME
valueFrom:
secretKeyRef:
name: external-dns
key: EXTERNAL_DNS_DYN_CUSTOMER_NAME
- name: EXTERNAL_DNS_DYN_USERNAME
valueFrom:
secretKeyRef:
name: external-dns
key: EXTERNAL_DNS_DYN_USERNAME
- name: EXTERNAL_DNS_DYN_PASSWORD
valueFrom:
secretKeyRef:
name: external-dns
key: EXTERNAL_DNS_DYN_PASSWORD
EOF
```
As we'll be creating an Ingress resource, you need `--txt-prefix=_d` as a CNAME cannot coexist with a TXT record. You can change the prefix to
any valid start of a FQDN.
Create the deployment for ExternalDNS:
```
$ kubectl create -f externaldns.yaml
```
## Running a locally build version
If you just want to test ExternalDNS in dry-run mode locally without doing the above deployment you can also do it.
Make sure your kubectl is configured correctly . Assuming you have the sources, build and run it like so:
```bash
make
# output skipped
./build/external-dns \
--provider=dyn \
--dyn-customer-name=${DYN_CUSTOMER_NAME} \
--dyn-username=${DYN_USERNAME} \
--dyn-password=${DYN_PASSWORD} \
--domain-filter=example.com \
--zone-id-filter=example.com \
--namespace=example \
--log-level=debug \
--txt-prefix=_ \
--dry-run=true
INFO[0000] running in dry-run mode. No changes to DNS records will be made.
INFO[0000] Connected to cluster at https://some-k8s-cluster.example.com
INFO[0001] Zones: [example.com]
# output skipped
```
Having `--dry-run=true` and `--log-level=debug` is a great way to see _exactly_ what DynamicDNS is doing or is about to do.
## Deploying an Ingress Resource
Create a file called 'test-ingress.yaml' with the following contents:
```yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: test-ingress
namespace: example
spec:
rules:
- host: test-ingress.example.com
http:
paths:
- backend:
service:
name: my-awesome-service
port:
number: 8080
pathType: Prefix
```
As the DNS name `test-ingress.example.com` matches the filter, external-dns will create two records:
a CNAME for test-ingress.example.com and TXT for _dtest-ingress.example.com.
Create the Ingress:
```
$ kubectl create -f test-ingress.yaml
```
By default external-dns scans for changes every minute so give it some time to catch up with the
## Verifying Dyn DNS records
Login to the console at https://portal.dynect.net/login/ and verify records are created
## Clean up
Login to the console at https://portal.dynect.net/login/ and delete the records created. Alternatively, just delete the sample
Ingress resources and external-dns will delete the records.

4
docs/tutorials/exoscale.md
View File

@ -1,4 +1,4 @@
# Setting up ExternalDNS for Exoscale
# Exoscale
## Prerequisites
@ -40,7 +40,7 @@ spec:
# serviceAccountName: external-dns
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=ingress # or service or both
- --provider=exoscale

4
docs/tutorials/externalname.md
View File

@ -1,4 +1,4 @@
# Setting up ExternalDNS for ExternalName Services
# ExternalName Services
This tutorial describes how to setup ExternalDNS for usage in conjunction with an ExternalName service.
@ -27,7 +27,7 @@ spec:
spec:
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --log-level=debug
- --source=service

6
docs/tutorials/gandi.md
View File

@ -1,4 +1,4 @@
# Setting up ExternalDNS for Services on Gandi
# Gandi
This tutorial describes how to setup ExternalDNS for usage within a Kubernetes cluster using Gandi.
@ -41,7 +41,7 @@ spec:
spec:
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=service # ingress is also possible
- --domain-filter=example.com # (optional) limit to only example.com domains; change to match the zone created above.
@ -105,7 +105,7 @@ spec:
serviceAccountName: external-dns
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=service # ingress is also possible
- --domain-filter=example.com # (optional) limit to only example.com domains; change to match the zone created above.

6
docs/tutorials/nginx-ingress.md → docs/tutorials/gke-nginx.md
View File

@ -1,4 +1,4 @@
# Setting up ExternalDNS on GKE with nginx-ingress-controller
# GKE with nginx-ingress-controller
This tutorial describes how to setup ExternalDNS for usage within a GKE cluster that doesn't make use of Google's [default ingress controller](https://github.com/kubernetes/ingress-gce) but rather uses [nginx-ingress-controller](https://github.com/kubernetes/ingress-nginx) for that task.
@ -273,7 +273,7 @@ spec:
serviceAccountName: external-dns
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=ingress
- --domain-filter=external-dns-test.gcp.zalan.do
@ -568,7 +568,7 @@ spec:
- --google-project=zalando-external-dns-test
- --registry=txt
- --txt-owner-id=my-identifier
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
name: external-dns
securityContext:
fsGroup: 65534

4
docs/tutorials/gke.md
View File

@ -1,4 +1,4 @@
# Setting up ExternalDNS on Google Kubernetes Engine
# GKE with default controller
This tutorial describes how to setup ExternalDNS for usage within a [GKE](https://cloud.google.com/kubernetes-engine) ([Google Kuberentes Engine](https://cloud.google.com/kubernetes-engine)) cluster. Make sure to use **>=0.11.0** version of ExternalDNS for this tutorial
@ -375,7 +375,7 @@ spec:
serviceAccountName: external-dns
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=service
- --source=ingress

6
docs/tutorials/godaddy.md
View File

@ -1,4 +1,4 @@
# Setting up ExternalDNS for Services on GoDaddy
# GoDaddy
This tutorial describes how to setup ExternalDNS for use within a
Kubernetes cluster using GoDaddy DNS.
@ -64,7 +64,7 @@ spec:
spec:
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=service # ingress is also possible
- --domain-filter=example.com # (optional) limit to only example.com domains; change to match the zone created above.
@ -135,7 +135,7 @@ spec:
serviceAccountName: external-dns
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=service # ingress is also possible
- --domain-filter=example.com # (optional) limit to only example.com domains; change to match the zone created above.

6
docs/tutorials/hostport.md
View File

@ -1,4 +1,4 @@
# Setting up ExternalDNS for Headless Services
# Headless Services
This tutorial describes how to setup ExternalDNS for usage in conjunction with a Headless service.
@ -31,7 +31,7 @@ spec:
spec:
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --log-level=debug
- --source=service
@ -96,7 +96,7 @@ spec:
serviceAccountName: external-dns
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --log-level=debug
- --source=service

8
docs/tutorials/ibmcloud.md
View File

@ -1,4 +1,4 @@
# Setting up ExternalDNS for Services on IBMCloud
# IBMCloud
This tutorial describes how to setup ExternalDNS for usage within a Kubernetes cluster using IBMCloud DNS.
@ -69,7 +69,7 @@ spec:
spec:
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=service # ingress is also possible
- --domain-filter=example.com # (optional) limit to only example.com domains; change to match the zone created above.
@ -142,7 +142,7 @@ spec:
serviceAccountName: external-dns
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=service # ingress is also possible
- --domain-filter=example.com # (optional) limit to only example.com domains; change to match the zone created above.
@ -259,4 +259,4 @@ Using the `external-dns.alpha.kubernetes.io/ibmcloud-proxied: "true"` annotation
By default, IBMCloud DNS Services don't active your private zone with new zone added, with externale DNS, you can use `external-dns.alpha.kubernetes.io/ibmcloud-vpc: "crn:v1:bluemix:public:is:us-south:a/bcf1865e99742d38d2d5fc3fb80a5496::vpc:r006-74353823-a60d-42e4-97c5-5e2551278435"` annotation on your ingress or service, it will active your private zone with in specific VPC for that record created in. this setting won't work if the private zone was active already.
Note: the annotaion value is the VPC CRN, every IBM Cloud service have a valid CRN.
Note: the annotaion value is the VPC CRN, every IBM Cloud service have a valid CRN.

4
docs/tutorials/kops-dns-controller.md
View File

@ -1,4 +1,4 @@
# kOps dns-controller compatibility mode
# kOps dns-controller
kOps includes a dns-controller that is primarily used to bootstrap the cluster, but can also be used for provisioning DNS entries for Services and Ingress.
@ -34,4 +34,4 @@ Annotations added to Pods will always result in an A record being created.
* For a Service of Type=LoadBalancer, ExternalDNS looks at Status.LoadBalancer.Ingress. It will create CNAMEs to hostnames,
and A records for IP addresses. It will do this for both internal and external names
* For a Service of Type=NodePort, ExternalDNS will create A records for the Node's internal/external IP addresses, as appropriate.
* For a Service of Type=NodePort, ExternalDNS will create A records for the Node's internal/external IP addresses, as appropriate.

2
docs/tutorials/kube-ingress-aws.md
View File

@ -1,4 +1,4 @@
# Using ExternalDNS with kube-ingress-aws-controller
# kube-ingress-aws-controller
This tutorial describes how to use ExternalDNS with the [kube-ingress-aws-controller][1].

6
docs/tutorials/linode.md
View File

@ -1,4 +1,4 @@
# Setting up ExternalDNS for Services on Linode
# Linode
This tutorial describes how to setup ExternalDNS for usage within a Kubernetes cluster using Linode DNS Manager.
@ -41,7 +41,7 @@ spec:
spec:
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=service # ingress is also possible
- --domain-filter=example.com # (optional) limit to only example.com domains; change to match the zone created above.
@ -105,7 +105,7 @@ spec:
serviceAccountName: external-dns
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=service # ingress is also possible
- --domain-filter=example.com # (optional) limit to only example.com domains; change to match the zone created above.

6
docs/tutorials/ns1.md
View File

@ -1,4 +1,4 @@
# Setting up ExternalDNS for Services on NS1
# NS1
This tutorial describes how to setup ExternalDNS for use within a
Kubernetes cluster using NS1 DNS.
@ -92,7 +92,7 @@ spec:
spec:
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=service # ingress is also possible
- --domain-filter=example.com # (optional) limit to only example.com domains; change to match the zone created above.
@ -159,7 +159,7 @@ spec:
serviceAccountName: external-dns
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=service # ingress is also possible
- --domain-filter=example.com # (optional) limit to only example.com domains; change to match the zone created above.

4
docs/tutorials/oracle.md
View File

@ -1,4 +1,4 @@
# Setting up ExternalDNS for Oracle Cloud Infrastructure (OCI)
# Oracle Cloud Infrastructure
This tutorial describes how to setup ExternalDNS for usage within a Kubernetes cluster using OCI DNS.
@ -170,7 +170,7 @@ spec:
serviceAccountName: external-dns
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=service
- --source=ingress

6
docs/tutorials/ovh.md
View File

@ -1,4 +1,4 @@
# Setting up ExternalDNS for Services on OVH
# OVHcloud
This tutorial describes how to setup ExternalDNS for use within a
Kubernetes cluster using OVH DNS.
@ -91,7 +91,7 @@ spec:
spec:
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=service # ingress is also possible
- --domain-filter=example.com # (optional) limit to only example.com domains; change to match the zone created above.
@ -165,7 +165,7 @@ spec:
serviceAccountName: external-dns
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=service # ingress is also possible
- --domain-filter=example.com # (optional) limit to only example.com domains; change to match the zone created above.

4
docs/tutorials/pdns.md
View File

@ -1,4 +1,4 @@
# Setting up ExternalDNS for PowerDNS
# PowerDNS
## Prerequisites
@ -42,7 +42,7 @@ spec:
# serviceAccountName: external-dns
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=service # or ingress or both
- --provider=pdns

4
docs/tutorials/pihole.md
View File

@ -1,4 +1,4 @@
# Setting up ExternalDNS for Pi-hole
# Pi-hole
This tutorial describes how to setup ExternalDNS to sync records with Pi-hole's Custom DNS.
Pi-hole has an internal list it checks last when resolving requests. This list can contain any number of arbitrary A, AAAA or CNAME records.
@ -81,7 +81,7 @@ spec:
serviceAccountName: external-dns
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
# If authentication is disabled and/or you didn't create
# a secret, you can remove this block.
envFrom:

6
docs/tutorials/plural.md
View File

@ -1,4 +1,4 @@
# Setting up ExternalDNS for Services on Plural
# Plural
This tutorial describes how to setup ExternalDNS for usage within a Kubernetes cluster using Plural DNS.
@ -61,7 +61,7 @@ spec:
spec:
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=service # ingress is also possible
- --domain-filter=example.com # (optional) limit to only example.com domains; change to match the zone created above.
@ -131,7 +131,7 @@ spec:
spec:
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=service # ingress is also possible
- --domain-filter=example.com # (optional) limit to only example.com domains; change to match the zone created above.

206
docs/tutorials/rcodezero.md
View File

@ -1,206 +0,0 @@
# Setting up ExternalDNS for Services on RcodeZero
This tutorial describes how to setup ExternalDNS for usage within a Kubernetes cluster using [RcodeZero Anycast DNS](https://www.rcodezero.at). Make sure to use **>=0.5.0** version of ExternalDNS for this tutorial.
The following steps are required to use RcodeZero with ExternalDNS:
1. Sign up for an RcodeZero account (or use an existing account).
2. Add your zone to the RcodeZero DNS
3. Enable the RcodeZero API, and generate an API key.
4. Deploy ExternalDNS to use the RcodeZero provider.
5. Verify the setup bey deploying a test services (optional)
## Creating a RcodeZero DNS zone
Before records can be added to your domain name automatically, you need to add your domain name to the set of zones managed by RcodeZero. In order to add the zone, perform the following steps:
1. Log in to the RcodeZero Dashboard, and move to the [Add Zone](https://my.rcodezero.at/domain/create) page.
2. Select "MASTER" as domain type, and add your domain name there. Use this domain name instead of "example.com" throughout the rest of this tutorial.
Note that "SECONDARY" domains cannot be managed by ExternalDNS, because this would not allow modification of records in the zone.
## Enable the API, and create Credentials
> The RcodeZero Anycast-Network is provisioned via web interface or REST-API.
Enable the RcodeZero API to generate an API key on [RcodeZero API](https://my.rcodezero.at/enableapi). The API key will be added to the environment variable 'RC0_API_KEY' via one of the Manifest templates (as described below).
## Deploy ExternalDNS
Connect your `kubectl` client to the cluster you want to test ExternalDNS with. Choose a Manifest from below, depending on whether or not you have RBAC enabled. Before applying it, modify the Manifest as follows:
- Replace "example.com" with the domain name you added to RcodeZero.
- Replace YOUR_RCODEZERO_API_KEY with the API key created above.
- Replace YOUR_ENCRYPTION_KEY_STRING with a string to encrypt the TXT records
### Manifest (for clusters without RBAC enabled)
```yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: external-dns
spec:
strategy:
type: Recreate
selector:
matchLabels:
app: external-dns
template:
metadata:
labels:
app: external-dns
spec:
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
args:
- --source=service # ingress is also possible
- --domain-filter=example.com # (optional) limit to only example.com domains; change to match the zone created above.
- --provider=rcodezero
- --rc0-enc-txt # (optional) encrypt TXT records; encryption key has to be provided with RC0_ENC_KEY env var.
env:
- name: RC0_API_KEY
value: "YOUR_RCODEZERO_API_KEY"
- name: RC0_ENC_VAR
value: "YOUR_ENCRYPTION_KEY_STRING"
```
### Manifest (for clusters with RBAC enabled)
```yaml
apiVersion: v1
kind: ServiceAccount
metadata:
name: external-dns
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: external-dns
rules:
- apiGroups: [""]
resources: ["services","endpoints","pods"]
verbs: ["get","watch","list"]
- apiGroups: ["extensions","networking.k8s.io"]
resources: ["ingresses"]
verbs: ["get","watch","list"]
- apiGroups: [""]
resources: ["nodes"]
verbs: ["list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: external-dns-viewer
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: external-dns
subjects:
- kind: ServiceAccount
name: external-dns
namespace: default
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: external-dns
spec:
strategy:
type: Recreate
selector:
matchLabels:
app: external-dns
template:
metadata:
labels:
app: external-dns
spec:
serviceAccountName: external-dns
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
args:
- --source=service # ingress is also possible
- --domain-filter=example.com # (optional) limit to only example.com domains; change to match the zone created above.
- --provider=rcodezero
- --rc0-enc-txt # (optional) encrypt TXT records; encryption key has to be provided with RC0_ENC_KEY env var.
env:
- name: RC0_API_KEY
value: "YOUR_RCODEZERO_API_KEY"
- name: RC0_ENC_VAR
value: "YOUR_ENCRYPTION_KEY_STRING"
```
## Deploying an Nginx Service
After you have deployed ExternalDNS with RcodeZero, you can deploy a simple service based on Nginx to test the setup. This is optional, though highly recommended before using ExternalDNS in production.
Create a service file called 'nginx.yaml' with the following contents:
```yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: nginx
spec:
selector:
matchLabels:
app: nginx
template:
metadata:
labels:
app: nginx
spec:
containers:
- image: nginx
name: nginx
ports:
- containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
name: nginx
annotations:
external-dns.alpha.kubernetes.io/hostname: example.com
external-dns.alpha.kubernetes.io/ttl: "120" #optional
spec:
selector:
app: nginx
type: LoadBalancer
ports:
- protocol: TCP
port: 80
targetPort: 80
```
Change the file as follows:
- Replace the annotation of the service; use the same hostname as the RcodeZero DNS zone created above. The annotation may also be a subdomain
of the DNS zone (e.g. 'www.example.com').
- Set the TTL annotation of the service. A valid TTL of 120 or above must be given. This annotation is optional, and defaults to "300" if no value is given.
These annotations will be used to determine what services should be registered with DNS. Removing these annotations will cause ExternalDNS to remove the corresponding DNS records.
Create the Deployment and Service:
```bash
$ kubectl create -f nginx.yaml
```
Depending on your cloud provider, it might take a while to create an external IP for the service. Once an external IP address is assigned to the service, ExternalDNS will notice the new address and synchronize the RcodeZero DNS records accordingly.
## Verifying RcodeZero DNS records
Check your [RcodeZero Configured Zones](https://my.rcodezero.at/domain) and select the respective zone name. The zone should now contain the external IP address of the service as an A record.
## Cleanup
Once you have verified that ExternalDNS successfully manages RcodeZero DNS records for external services, you can delete the tutorial example as follows:
```bash
$ kubectl delete -f nginx.yaml
$ kubectl delete -f externaldns.yaml
```

9
docs/tutorials/rdns.md
View File

@ -1,6 +1,9 @@
# Setting up ExternalDNS for RancherDNS(RDNS) with kubernetes
# RancherDNS
This tutorial describes how to setup ExternalDNS for usage within a kubernetes cluster that makes use of [RDNS](https://github.com/rancher/rdns-server) and [nginx ingress controller](https://github.com/kubernetes/ingress-nginx).
You need to:
* install RDNS with [etcd](https://github.com/etcd-io/etcd) enabled
* install external-dns with rdns as a provider
@ -54,7 +57,7 @@ spec:
serviceAccountName: external-dns
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=ingress
- --provider=rdns
@ -123,7 +126,7 @@ spec:
serviceAccountName: external-dns
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=ingress
- --provider=rdns

17
docs/tutorials/rfc2136.md
View File

@ -1,17 +1,21 @@
# Configuring RFC2136 provider
# RFC2136 provider
This tutorial describes how to use the RFC2136 with either BIND or Windows DNS.
## Using with BIND
To use external-dns with BIND: generate/procure a key, configure DNS and add a
deployment of external-dns.
### Server credentials:
- RFC2136 was developed for and tested with [BIND](https://www.isc.org/downloads/bind/) DNS server.
This documentation assumes that you already have a configured and working server. If you don't,
please check BIND documents or tutorials.
- If your DNS is provided for you, ask for a TSIG key authorized to update and
transfer the zone you wish to update. The key will look something like below.
Skip the next steps wrt BIND setup.
```text
key "externaldns-key" {
algorithm hmac-sha256;
@ -25,6 +29,7 @@ a key printed to standard out like above (or in the case of dnssec-keygen in a
file called `Kexternaldns......key`).
### BIND Configuration:
If you do not administer your own DNS, skip to RFC provider configuration
- Edit your named.conf file (or appropriate included file) and add/change the
@ -75,9 +80,11 @@ following.
### Using external-dns
To use external-dns add an ingress or a LoadBalancer service with a host that
is part of the domain-filter. For example both of the following would produce
A records.
```text
apiVersion: v1
kind: Service
@ -133,8 +140,8 @@ tutorial and are covered in the main documentation.
### Generate reverse DNS records
If you want to generate reverse DNS records for your services, you have to enable the functionality using the `--rfc2136-create-ptr`
flag. You have also to add the zone to the list of zones managed by ExternalDNS via the `--rfc2136-zone` and `--domain-filter` flags.
If you want to generate reverse DNS records for your services, you have to enable the functionality using the `--rfc2136-create-ptr`
flag. You have also to add the zone to the list of zones managed by ExternalDNS via the `--rfc2136-zone` and `--domain-filter` flags.
An example of a valid configuration is the following:
```--domain-filter=157.168.192.in-addr.arpa --rfc2136-zone=157.168.192.in-addr.arpa```
@ -231,7 +238,7 @@ spec:
serviceAccountName: external-dns
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --registry=txt
- --txt-prefix=external-dns-
@ -274,7 +281,7 @@ spec:
spec:
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --registry=txt
- --txt-prefix=external-dns-

6
docs/tutorials/scaleway.md
View File

@ -1,4 +1,4 @@
# Setting up ExternalDNS for Services on Scaleway
# Scaleway
This tutorial describes how to setup ExternalDNS for usage within a Kubernetes cluster using Scaleway DNS.
@ -60,7 +60,7 @@ spec:
spec:
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=service # ingress is also possible
- --domain-filter=example.com # (optional) limit to only example.com domains; change to match the zone created above.
@ -140,7 +140,7 @@ spec:
serviceAccountName: external-dns
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=service # ingress is also possible
- --domain-filter=example.com # (optional) limit to only example.com domains; change to match the zone created above.

2
docs/tutorials/security-context.md
View File

@ -20,7 +20,7 @@ spec:
spec:
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- ... # your arguments here
securityContext:

16
docs/tutorials/tencentcloud.md
View File

@ -1,6 +1,7 @@
# Setting up ExternalDNS for Tencent Cloud
# Tencent Cloud
## External Dns Version
* Make sure to use **>=0.13.1** version of ExternalDNS for this tutorial
## Set up PrivateDns or DNSPod
@ -8,17 +9,18 @@
Tencent Cloud DNSPod Service is the domain name resolution and management service for public access.
Tencent Cloud PrivateDNS Service is the domain name resolution and management service for VPC internal access.
* If you want to use internal dns service in Tencent Cloud.
1. Set up the args `--tencent-cloud-zone-type=private`
* If you want to use internal dns service in Tencent Cloud.
1. Set up the args `--tencent-cloud-zone-type=private`
2. Create a DNS domain in PrivateDNS console. DNS domain which will contain the managed DNS records.
* If you want to use public dns service in Tencent Cloud.
1. Set up the args `--tencent-cloud-zone-type=public`
1. Set up the args `--tencent-cloud-zone-type=public`
2. Create a Domain in DnsPod console. DNS domain which will contain the managed DNS records.
## Set up CAM for API Key
In Tencent CAM Console. you may get the secretId and secretKey pair. make sure the key pair has those Policy.
```json
{
"version": "2.0",
@ -72,7 +74,7 @@ rules:
resources: ["services","endpoints","pods"]
verbs: ["get","watch","list"]
- apiGroups: ["extensions","networking.k8s.io"]
resources: ["ingresses"]
resources: ["ingresses"]
verbs: ["get","watch","list"]
- apiGroups: [""]
resources: ["nodes"]
@ -99,7 +101,7 @@ data:
tencent-cloud.json: |
{
"regionId": "ap-shanghai",
"secretId": "******",
"secretId": "******",
"secretKey": "******",
"vpcId": "vpc-******",
"internetEndpoint": false # Default: false. Access the Tencent API through the intranet. If you need to deploy on the public network, you need to change to true
@ -129,7 +131,7 @@ spec:
- --policy=sync # set `upsert-only` would prevent ExternalDNS from deleting any records
- --tencent-cloud-zone-type=private # only look at private hosted zones. set `public` to use the public dns service.
- --tencent-cloud-config-file=/etc/kubernetes/tencent-cloud.json
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
imagePullPolicy: Always
name: external-dns
resources: {}

6
docs/tutorials/transip.md
View File

@ -1,4 +1,4 @@
# Setting up ExternalDNS for Services on TransIP
# TransIP
This tutorial describes how to setup ExternalDNS for usage within a Kubernetes cluster using TransIP.
@ -36,7 +36,7 @@ spec:
spec:
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=service # ingress is also possible
- --domain-filter=example.com # (optional) limit to only example.com domains
@ -107,7 +107,7 @@ spec:
serviceAccountName: external-dns
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=service # ingress is also possible
- --domain-filter=example.com # (optional) limit to only example.com domains

6
docs/tutorials/ultradns.md
View File

@ -1,4 +1,4 @@
# Setting up ExternalDNS for Services on UltraDNS
# UltraDNS
This tutorial describes how to setup ExternalDNS for usage within a Kubernetes cluster using UltraDNS.
@ -44,7 +44,7 @@ spec:
spec:
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=service
- --source=ingress # ingress is also possible
@ -116,7 +116,7 @@ spec:
serviceAccountName: external-dns
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
- --source=service
- --source=ingress

190
docs/tutorials/vinyldns.md
View File

@ -1,190 +0,0 @@
# Setting up ExternalDNS for VinylDNS
This tutorial describes how to setup ExternalDNS for usage within a Kubernetes cluster using VinylDNS.
The environment vars `VINYLDNS_ACCESS_KEY`, `VINYLDNS_SECRET_KEY`, and `VINYLDNS_HOST` will be needed to run ExternalDNS with VinylDNS.
## Create a sample deployment and service for external-dns to use
Run an application and expose it via a Kubernetes Service:
```console
$ kubectl run nginx --image=nginx --replicas=1 --port=80
$ kubectl expose deployment nginx --port=80 --target-port=80 --type=LoadBalancer
```
Annotate the Service with your desired external DNS name. Make sure to change `example.org` to your domain.
```console
$ kubectl annotate service nginx "external-dns.alpha.kubernetes.io/hostname=nginx.example.org."
```
After the service is up and running, it should get an EXTERNAL-IP. At first this may showing as `<pending>`
```console
$ kubectl get svc
NAME CLUSTER-IP EXTERNAL-IP PORT(S) AGE
kubernetes 10.0.0.1 <none> 443/TCP 1h
nginx 10.0.0.115 <pending> 80:30543/TCP 10s
```
Once it's available
```console
% kubectl get svc
NAME CLUSTER-IP EXTERNAL-IP PORT(S) AGE
kubernetes 10.0.0.1 <none> 443/TCP 1h
nginx 10.0.0.115 34.x.x.x 80:30543/TCP 2m
```
## Deploy ExternalDNS to Kubernetes
Connect your `kubectl` client to the cluster you want to test ExternalDNS with.
Then apply one of the following manifests file to deploy ExternalDNS.
**Note for examples below**
When using `registry=txt` option, make sure to also use the `txt-prefix` and `txt-owner-id` options as well. If you try to create a `TXT` record in VinylDNS without a prefix, it will try to create a `TXT` record with the same name as your actual DNS record and fail (creating a stranded record `external-dns` cannot manage).
### Manifest (for clusters without RBAC enabled)
```yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: external-dns
spec:
strategy:
type: Recreate
selector:
matchLabels:
app: external-dns
template:
metadata:
labels:
app: external-dns
spec:
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
args:
- --provider=vinyldns
- --source=service
- --domain-filter=example.com # (optional) limit to only example.com domains; change to match the zone created above.
- --registry=txt
- --txt-owner-id=grizz
- --txt-prefix=txt-
env:
- name: VINYLDNS_HOST
value: "YOUR_VINYLDNS_HOST"
- name: VINYLDNS_ACCESS_KEY
value: "YOUR_VINYLDNS_ACCESS_KEY"
- name: VINYLDNS_SECRET_KEY
value: "YOUR_VINYLDNS_SECRET_KEY"
```
### Manifest (for clusters with RBAC enabled)
```yaml
apiVersion: v1
kind: ServiceAccount
metadata:
name: external-dns
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: external-dns
rules:
- apiGroups: [""]
resources: ["services","endpoints","pods"]
verbs: ["get","watch","list"]
- apiGroups: ["extensions","networking.k8s.io"]
resources: ["ingresses"]
verbs: ["get","watch","list"]
- apiGroups: [""]
resources: ["nodes"]
verbs: ["list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: external-dns-viewer
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: external-dns
subjects:
- kind: ServiceAccount
name: external-dns
namespace: default
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: external-dns
spec:
strategy:
type: Recreate
selector:
matchLabels:
app: external-dns
template:
metadata:
labels:
app: external-dns
spec:
serviceAccountName: external-dns
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
args:
- --provider=vinyldns
- --source=service
- --domain-filter=example.com # (optional) limit to only example.com domains; change to match the zone created above.
- --registry=txt
- --txt-owner-id=grizz
- --txt-prefix=txt-
env:
env:
- name: VINYLDNS_HOST
value: "YOUR_VINYLDNS_HOST"
- name: VINYLDNS_ACCESS_KEY
value: "YOUR_VINYLDNS_ACCESS_KEY"
- name: VINYLDNS_SECRET_KEY
value: "YOUR_VINYLDNS_SECRET_KEYY
```
## Running a locally built version pointed to the above nginx service
Make sure your kubectl is configured correctly. Assuming you have the sources, build and run it like below.
The vinyl access details needs to exported to the environment before running.
```bash
make
# output skipped
export VINYLDNS_HOST=<fqdn of vinyl dns api>
export VINYLDNS_ACCESS_KEY=<access key>
export VINYLDNS_SECRET_KEY=<secret key>
./build/external-dns \
--provider=vinyldns \
--source=service \
--domain-filter=elements.capsps.comcast.net. \
--zone-id-filter=20e8bfd2-3a70-4e1b-8e11-c9c1948528d3 \
--registry=txt \
--txt-owner-id=grizz \
--txt-prefix=txt- \
--namespace=default \
--once \
--dry-run \
--log-level debug
INFO[0000] running in dry-run mode. No changes to DNS records will be made.
INFO[0000] Created Kubernetes client https://some-k8s-cluster.example.com
INFO[0001] Zone: [nginx.example.org.]
# output skipped
```
Having `--dry-run=true` and `--log-level=debug` is a great way to see _exactly_ what VinylDNS is doing or is about to do.

225
docs/tutorials/vultr.md
View File

@ -1,225 +0,0 @@
# Setting up ExternalDNS for Services on Vultr
This tutorial describes how to setup ExternalDNS for usage within a Kubernetes cluster using Vultr DNS.
Make sure to use **>=0.6** version of ExternalDNS for this tutorial.
## Managing DNS with Vultr
If you want to read up on vultr DNS service you can read the following tutorial:
[Introduction to Vultr DNS](https://www.vultr.com/docs/introduction-to-vultr-dns)
Create a new DNS Zone where you want to create your records in. For the examples we will be using `example.com`
## Creating Vultr Credentials
You will need to create a new API Key which can be found on the [Vultr Dashboard](https://my.vultr.com/settings/#settingsapi).
The environment variable `VULTR_API_KEY` will be needed to run ExternalDNS with Vultr.
## Deploy ExternalDNS
Connect your `kubectl` client to the cluster you want to test ExternalDNS with.
Begin by creating a Kubernetes secret to securely store your Akamai Edge DNS Access Tokens. This key will enable ExternalDNS to authenticate with Akamai Edge DNS:
```shell
kubectl create secret generic VULTR_API_KEY --from-literal=VULTR_API_KEY=YOUR_VULTR_API_KEY
```
Ensure to replace YOUR_VULTR_API_KEY, with your actual Vultr API key.
Then apply one of the following manifests file to deploy ExternalDNS.
### Using Helm
reate a values.yaml file to configure ExternalDNS to use Akamai Edge DNS as the DNS provider. This file should include the necessary environment variables:
```shell
provider:
name: akamai
env:
- name: VULTR_API_KEY
valueFrom:
secretKeyRef:
name: VULTR_API_KEY
key: VULTR_API_KEY
```
Finally, install the ExternalDNS chart with Helm using the configuration specified in your values.yaml file:
```shell
helm upgrade --install external-dns external-dns/external-dns --values values.yaml
```
### Manifest (for clusters without RBAC enabled)
```yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: external-dns
spec:
strategy:
type: Recreate
selector:
matchLabels:
app: external-dns
template:
metadata:
labels:
app: external-dns
spec:
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
args:
- --source=service # ingress is also possible
- --domain-filter=example.com # (optional) limit to only example.com domains; change to match the zone created above.
- --provider=vultr
env:
- name: VULTR_API_KEY
valueFrom:
secretKeyRef:
name: VULTR_API_KEY
key: VULTR_API_KEY
```
### Manifest (for clusters with RBAC enabled)
```yaml
apiVersion: v1
kind: ServiceAccount
metadata:
name: external-dns
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: external-dns
rules:
- apiGroups: [""]
resources: ["services","endpoints","pods"]
verbs: ["get","watch","list"]
- apiGroups: ["extensions","networking.k8s.io"]
resources: ["ingresses"]
verbs: ["get","watch","list"]
- apiGroups: [""]
resources: ["nodes"]
verbs: ["list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: external-dns-viewer
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: external-dns
subjects:
- kind: ServiceAccount
name: external-dns
namespace: default
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: external-dns
spec:
strategy:
type: Recreate
selector:
matchLabels:
app: external-dns
template:
metadata:
labels:
app: external-dns
spec:
serviceAccountName: external-dns
containers:
- name: external-dns
image: registry.k8s.io/external-dns/external-dns:v0.14.2
args:
- --source=service # ingress is also possible
- --domain-filter=example.com # (optional) limit to only example.com domains; change to match the zone created above.
- --provider=vultr
env:
- name: VULTR_API_KEY
valueFrom:
secretKeyRef:
name: VULTR_API_KEY
key: VULTR_API_KEY
```
## Deploying a Nginx Service
Create a service file called 'nginx.yaml' with the following contents:
```yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: nginx
spec:
selector:
matchLabels:
app: nginx
template:
metadata:
labels:
app: nginx
spec:
containers:
- image: nginx
name: nginx
ports:
- containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
name: nginx
annotations:
external-dns.alpha.kubernetes.io/hostname: my-app.example.com
spec:
selector:
app: nginx
type: LoadBalancer
ports:
- protocol: TCP
port: 80
targetPort: 80
```
Note the annotation on the service; use the same hostname as the Vultr DNS zone created above.
ExternalDNS uses this annotation to determine what services should be registered with DNS. Removing the annotation will cause ExternalDNS to remove the corresponding DNS records.
Create the deployment and service:
```console
$ kubectl create -f nginx.yaml
```
Depending where you run your service it can take a little while for your cloud provider to create an external IP for the service.
Once the service has an external IP assigned, ExternalDNS will notice the new service IP address and synchronize the Vultr DNS records.
## Verifying Vultr DNS records
Check your [Vultr UI](https://my.vultr.com/dns/) to view the records for your Vultr DNS zone.
Click on the zone for the one created above if a different domain was used.
This should show the external IP address of the service as the A record for your domain.
## Cleanup
Now that we have verified that ExternalDNS will automatically manage Vultr DNS records, we can delete the tutorial's example:
```
$ kubectl delete service -f nginx.yaml
$ kubectl delete service -f externaldns.yaml
```

8
endpoint/domain_filter.go
View File

@ -25,7 +25,7 @@ import (
"strings"
)
type MatchAllDomainFilters []*DomainFilter
type MatchAllDomainFilters []DomainFilterInterface
func (f MatchAllDomainFilters) Match(domain string) bool {
for _, filter := range f {
@ -39,6 +39,10 @@ func (f MatchAllDomainFilters) Match(domain string) bool {
return true
}
type DomainFilterInterface interface {
Match(domain string) bool
}
// DomainFilter holds a lists of valid domain names
type DomainFilter struct {
// Filters define what domains to match
@ -51,6 +55,8 @@ type DomainFilter struct {
regexExclusion *regexp.Regexp
}
var _ DomainFilterInterface = &DomainFilter{}
// domainFilterSerde is a helper type for serializing and deserializing DomainFilter.
type domainFilterSerde struct {
Include []string `json:"include,omitempty"`

145
go.mod
View File

@ -1,30 +1,30 @@
module sigs.k8s.io/external-dns
go 1.22.4
go 1.23
require (
cloud.google.com/go/compute/metadata v0.3.0
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.12.0
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.6.0
cloud.google.com/go/compute/metadata v0.5.0
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.14.0
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.7.0
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/dns/armdns v1.2.0
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/privatedns/armprivatedns v1.2.0
github.com/F5Networks/k8s-bigip-ctlr/v2 v2.17.0
github.com/IBM-Cloud/ibm-cloud-cli-sdk v1.4.0
github.com/IBM/go-sdk-core/v5 v5.17.3
github.com/IBM/networking-go-sdk v0.47.1
github.com/F5Networks/k8s-bigip-ctlr/v2 v2.17.1
github.com/IBM-Cloud/ibm-cloud-cli-sdk v1.5.0
github.com/IBM/go-sdk-core/v5 v5.17.4
github.com/IBM/networking-go-sdk v0.49.0
github.com/Yamashou/gqlgenc v0.24.0
github.com/akamai/AkamaiOPEN-edgegrid-golang v1.2.2
github.com/alecthomas/kingpin/v2 v2.4.0
github.com/aliyun/alibaba-cloud-sdk-go v1.62.771
github.com/ans-group/sdk-go v1.17.0
github.com/aws/aws-sdk-go v1.54.4
github.com/aliyun/alibaba-cloud-sdk-go v1.63.0
github.com/aws/aws-sdk-go v1.55.5
github.com/bodgit/tsig v1.2.2
github.com/cenkalti/backoff/v4 v4.3.0
github.com/civo/civogo v0.3.70
github.com/cloudflare/cloudflare-go v0.98.0
github.com/civo/civogo v0.3.73
github.com/cloudflare/cloudflare-go v0.102.0
github.com/cloudfoundry-community/go-cfclient v0.0.0-20190201205600-f136f9222381
github.com/datawire/ambassador v1.12.4
github.com/denverdino/aliyungo v0.0.0-20230411124812-ab98a9173ace
github.com/digitalocean/godo v1.118.0
github.com/digitalocean/godo v1.120.0
github.com/dnsimple/dnsimple-go v1.7.0
github.com/exoscale/egoscale v0.102.3
github.com/ffledgling/pdns-go v0.0.0-20180219074714-524e7daccd99
@ -32,77 +32,71 @@ require (
github.com/go-logr/logr v1.4.2
github.com/google/go-cmp v0.6.0
github.com/google/uuid v1.6.0
github.com/gophercloud/gophercloud v1.12.0
github.com/hooklift/gowsdl v0.5.0
github.com/gophercloud/gophercloud v1.14.0
github.com/linki/instrumented_http v0.3.0
github.com/linode/linodego v1.35.0
github.com/linode/linodego v1.39.0
github.com/maxatome/go-testdeep v1.14.0
github.com/miekg/dns v1.1.61
github.com/nesv/go-dynect v0.6.0
github.com/nic-at/rc0go v1.1.1
github.com/miekg/dns v1.1.62
github.com/onsi/ginkgo v1.16.5
github.com/openshift/api v0.0.0-20230607130528-611114dca681
github.com/openshift/client-go v0.0.0-20230607134213-3cd0021bbee3
github.com/oracle/oci-go-sdk/v65 v65.67.2
github.com/oracle/oci-go-sdk/v65 v65.71.1
github.com/ovh/go-ovh v1.6.0
github.com/patrickmn/go-cache v2.1.0+incompatible
github.com/pkg/errors v0.9.1
github.com/pluralsh/gqlclient v1.11.0
github.com/projectcontour/contour v1.29.1
github.com/prometheus/client_golang v1.19.1
github.com/scaleway/scaleway-sdk-go v1.0.0-beta.28
github.com/pluralsh/gqlclient v1.12.2
github.com/projectcontour/contour v1.30.0
github.com/prometheus/client_golang v1.20.0
github.com/scaleway/scaleway-sdk-go v1.0.0-beta.29
github.com/sirupsen/logrus v1.9.3
github.com/stretchr/testify v1.9.0
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.0.945
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/dnspod v1.0.945
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/privatedns v1.0.945
github.com/transip/gotransip/v6 v6.24.0
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.0.984
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/dnspod v1.0.984
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/privatedns v1.0.984
github.com/transip/gotransip/v6 v6.25.0
github.com/ultradns/ultradns-sdk-go v1.3.7
github.com/vinyldns/go-vinyldns v0.9.16
github.com/vultr/govultr/v2 v2.17.2
go.etcd.io/etcd/api/v3 v3.5.14
go.etcd.io/etcd/client/v3 v3.5.14
go.etcd.io/etcd/api/v3 v3.5.15
go.etcd.io/etcd/client/v3 v3.5.15
go.uber.org/ratelimit v0.3.1
golang.org/x/net v0.26.0
golang.org/x/oauth2 v0.21.0
golang.org/x/sync v0.7.0
golang.org/x/time v0.5.0
google.golang.org/api v0.185.0
gopkg.in/ns1/ns1-go.v2 v2.11.0
golang.org/x/net v0.28.0
golang.org/x/oauth2 v0.22.0
golang.org/x/sync v0.8.0
golang.org/x/time v0.6.0
google.golang.org/api v0.192.0
gopkg.in/ns1/ns1-go.v2 v2.12.0
gopkg.in/yaml.v2 v2.4.0
istio.io/api v1.22.1
istio.io/client-go v1.22.1
k8s.io/api v0.30.2
k8s.io/apimachinery v0.30.2
k8s.io/client-go v0.30.2
k8s.io/klog/v2 v2.130.0
istio.io/api v1.23.0
istio.io/client-go v1.23.0
k8s.io/api v0.31.0
k8s.io/apimachinery v0.31.0
k8s.io/client-go v0.31.0
k8s.io/klog/v2 v2.130.1
sigs.k8s.io/gateway-api v1.1.0
)
require (
cloud.google.com/go/auth v0.5.1 // indirect
cloud.google.com/go/auth/oauth2adapt v0.2.2 // indirect
cloud.google.com/go/auth v0.8.1 // indirect
cloud.google.com/go/auth/oauth2adapt v0.2.3 // indirect
code.cloudfoundry.org/gofileutils v0.0.0-20170111115228-4d0c80011a0f // indirect
github.com/Azure/azure-sdk-for-go/sdk/internal v1.9.0 // indirect
github.com/99designs/gqlgen v0.17.44 // indirect
github.com/Azure/azure-sdk-for-go/sdk/internal v1.10.0 // indirect
github.com/AzureAD/microsoft-authentication-library-for-go v1.2.2 // indirect
github.com/Masterminds/semver v1.4.2 // indirect
github.com/Yamashou/gqlgenc v0.14.0 // indirect
github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137 // indirect
github.com/alexbrainman/sspi v0.0.0-20180613141037-e580b900e9f5 // indirect
github.com/ans-group/go-durationstring v1.2.0 // indirect
github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
github.com/benbjohnson/clock v1.3.0 // indirect
github.com/beorn7/perks v1.0.1 // indirect
github.com/cespare/xxhash/v2 v2.2.0 // indirect
github.com/cespare/xxhash/v2 v2.3.0 // indirect
github.com/coreos/go-semver v0.3.1 // indirect
github.com/coreos/go-systemd/v22 v22.5.0 // indirect
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
github.com/deepmap/oapi-codegen v1.9.1 // indirect
github.com/emicklei/go-restful/v3 v3.12.0 // indirect
github.com/evanphx/json-patch v5.7.0+incompatible // indirect
github.com/fatih/structs v1.1.0 // indirect
github.com/felixge/httpsnoop v1.0.4 // indirect
github.com/fsnotify/fsnotify v1.7.0 // indirect
github.com/fxamacker/cbor/v2 v2.7.0 // indirect
github.com/gabriel-vasile/mimetype v1.4.3 // indirect
github.com/go-logr/stdr v1.2.2 // indirect
github.com/go-openapi/errors v0.21.0 // indirect
@ -124,16 +118,15 @@ require (
github.com/google/gnostic-models v0.6.8 // indirect
github.com/google/go-querystring v1.1.0 // indirect
github.com/google/gofuzz v1.2.0 // indirect
github.com/google/s2a-go v0.1.7 // indirect
github.com/google/s2a-go v0.1.8 // indirect
github.com/googleapis/enterprise-certificate-proxy v0.3.2 // indirect
github.com/googleapis/gax-go/v2 v2.12.4 // indirect
github.com/googleapis/gax-go/v2 v2.13.0 // indirect
github.com/gopherjs/gopherjs v1.17.2 // indirect
github.com/hashicorp/errwrap v1.1.0 // indirect
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
github.com/hashicorp/go-multierror v1.1.1 // indirect
github.com/hashicorp/go-retryablehttp v0.7.7 // indirect
github.com/hashicorp/go-uuid v1.0.3 // indirect
github.com/hashicorp/hcl v1.0.1-vault-5 // indirect
github.com/imdario/mergo v0.3.16 // indirect
github.com/jcmturner/aescts/v2 v2.0.0 // indirect
github.com/jcmturner/dnsutils/v2 v2.0.0 // indirect
@ -145,9 +138,9 @@ require (
github.com/jmespath/go-jmespath v0.4.0 // indirect
github.com/josharian/intern v1.0.0 // indirect
github.com/json-iterator/go v1.1.12 // indirect
github.com/klauspost/compress v1.17.9 // indirect
github.com/kylelemons/godebug v1.1.0 // indirect
github.com/leodido/go-urn v1.4.0 // indirect
github.com/magiconair/properties v1.8.7 // indirect
github.com/mailru/easyjson v0.7.7 // indirect
github.com/mattn/go-runewidth v0.0.13 // indirect
github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db // indirect
@ -160,32 +153,24 @@ require (
github.com/oklog/ulid v1.3.1 // indirect
github.com/openshift/gssapi v0.0.0-20161010215902-5fb4217df13b // indirect
github.com/opentracing/opentracing-go v1.2.1-0.20220228012449-10b1cf09e00b // indirect
github.com/pelletier/go-toml/v2 v2.1.0 // indirect
github.com/peterhellberg/link v1.1.0 // indirect
github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
github.com/prometheus/client_model v0.6.1 // indirect
github.com/prometheus/common v0.53.0 // indirect
github.com/prometheus/procfs v0.12.0 // indirect
github.com/prometheus/common v0.55.0 // indirect
github.com/prometheus/procfs v0.15.1 // indirect
github.com/rivo/uniseg v0.2.0 // indirect
github.com/sagikazarmark/locafero v0.3.0 // indirect
github.com/sagikazarmark/slog-shim v0.1.0 // indirect
github.com/schollz/progressbar/v3 v3.8.6 // indirect
github.com/shopspring/decimal v1.3.1 // indirect
github.com/smartystreets/go-aws-auth v0.0.0-20180515143844-0c1422d1fdb9 // indirect
github.com/smartystreets/gunit v1.3.4 // indirect
github.com/sony/gobreaker v0.5.0 // indirect
github.com/sourcegraph/conc v0.3.0 // indirect
github.com/spf13/afero v1.10.0 // indirect
github.com/spf13/cast v1.5.1 // indirect
github.com/sosodev/duration v1.2.0 // indirect
github.com/spf13/pflag v1.0.5 // indirect
github.com/spf13/viper v1.17.0 // indirect
github.com/stretchr/objx v0.5.2 // indirect
github.com/subosito/gotenv v1.6.0 // indirect
github.com/terra-farm/udnssdk v1.3.5 // indirect
github.com/vektah/gqlparser/v2 v2.5.14 // indirect
github.com/x448/float16 v0.8.4 // indirect
github.com/xhit/go-str2duration/v2 v2.1.0 // indirect
go.etcd.io/etcd/client/pkg/v3 v3.5.14 // indirect
go.etcd.io/etcd/client/pkg/v3 v3.5.15 // indirect
go.mongodb.org/mongo-driver v1.14.0 // indirect
go.opencensus.io v0.24.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0 // indirect
@ -195,25 +180,23 @@ require (
go.uber.org/atomic v1.10.0 // indirect
go.uber.org/multierr v1.11.0 // indirect
go.uber.org/zap v1.26.0 // indirect
golang.org/x/crypto v0.24.0 // indirect
golang.org/x/exp v0.0.0-20240416160154-fe59bbe5cc7f // indirect
golang.org/x/crypto v0.26.0 // indirect
golang.org/x/mod v0.18.0 // indirect
golang.org/x/sys v0.21.0 // indirect
golang.org/x/term v0.21.0 // indirect
golang.org/x/text v0.16.0 // indirect
golang.org/x/sys v0.23.0 // indirect
golang.org/x/term v0.23.0 // indirect
golang.org/x/text v0.17.0 // indirect
golang.org/x/tools v0.22.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20240610135401-a8a62080eff3 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20240617180043-68d350f18fd4 // indirect
google.golang.org/grpc v1.64.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20240725223205-93522f1f2a9f // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20240730163845-b1a4ccb954bf // indirect
google.golang.org/grpc v1.65.0 // indirect
google.golang.org/protobuf v1.34.2 // indirect
gopkg.in/go-playground/validator.v9 v9.31.0 // indirect
gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/ini.v1 v1.67.0 // indirect
gopkg.in/resty.v1 v1.12.0 // indirect
gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
k8s.io/kube-openapi v0.0.0-20240423202451-8948a665c108 // indirect
k8s.io/utils v0.0.0-20240423183400-0849a56e8f22 // indirect
k8s.io/kube-openapi v0.0.0-20240430033511-f0e62f92d13f // indirect
k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 // indirect
moul.io/http2curl v1.0.0 // indirect
sigs.k8s.io/controller-runtime v0.18.4 // indirect
sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect

555
go.sum
View File

File diff suppressed because it is too large Load Diff

2
kustomize/kustomization.yaml
View File

@ -3,7 +3,7 @@ kind: Kustomization
images:
- name: registry.k8s.io/external-dns/external-dns
newTag: v0.14.2
newTag: v0.15.0
resources:
- ./external-dns-deployment.yaml

39
main.go
View File

@ -47,14 +47,12 @@ import (
"sigs.k8s.io/external-dns/provider/aws"
"sigs.k8s.io/external-dns/provider/awssd"
"sigs.k8s.io/external-dns/provider/azure"
"sigs.k8s.io/external-dns/provider/bluecat"
"sigs.k8s.io/external-dns/provider/civo"
"sigs.k8s.io/external-dns/provider/cloudflare"
"sigs.k8s.io/external-dns/provider/coredns"
"sigs.k8s.io/external-dns/provider/designate"
"sigs.k8s.io/external-dns/provider/digitalocean"
"sigs.k8s.io/external-dns/provider/dnsimple"
"sigs.k8s.io/external-dns/provider/dyn"
"sigs.k8s.io/external-dns/provider/exoscale"
"sigs.k8s.io/external-dns/provider/gandi"
"sigs.k8s.io/external-dns/provider/godaddy"
@ -68,16 +66,12 @@ import (
"sigs.k8s.io/external-dns/provider/pdns"
"sigs.k8s.io/external-dns/provider/pihole"
"sigs.k8s.io/external-dns/provider/plural"
"sigs.k8s.io/external-dns/provider/rcode0"
"sigs.k8s.io/external-dns/provider/rdns"
"sigs.k8s.io/external-dns/provider/rfc2136"
"sigs.k8s.io/external-dns/provider/safedns"
"sigs.k8s.io/external-dns/provider/scaleway"
"sigs.k8s.io/external-dns/provider/tencentcloud"
"sigs.k8s.io/external-dns/provider/transip"
"sigs.k8s.io/external-dns/provider/ultradns"
"sigs.k8s.io/external-dns/provider/vinyldns"
"sigs.k8s.io/external-dns/provider/vultr"
"sigs.k8s.io/external-dns/provider/webhook"
webhookapi "sigs.k8s.io/external-dns/provider/webhook/api"
"sigs.k8s.io/external-dns/registry"
@ -179,6 +173,7 @@ func main() {
// Combine multiple sources into a single, deduplicated source.
endpointsSource := source.NewDedupSource(source.NewMultiSource(sources, sourceCfg.DefaultTargets))
endpointsSource = source.NewNAT64Source(endpointsSource, cfg.NAT64Networks)
endpointsSource = source.NewTargetFilterSource(endpointsSource, targetFilter)
// RegexDomainFilter overrides DomainFilter
@ -246,20 +241,12 @@ func main() {
p, err = azure.NewAzureProvider(cfg.AzureConfigFile, domainFilter, zoneNameFilter, zoneIDFilter, cfg.AzureSubscriptionID, cfg.AzureResourceGroup, cfg.AzureUserAssignedIdentityClientID, cfg.AzureActiveDirectoryAuthorityHost, cfg.DryRun)
case "azure-private-dns":
p, err = azure.NewAzurePrivateDNSProvider(cfg.AzureConfigFile, domainFilter, zoneNameFilter, zoneIDFilter, cfg.AzureSubscriptionID, cfg.AzureResourceGroup, cfg.AzureUserAssignedIdentityClientID, cfg.AzureActiveDirectoryAuthorityHost, cfg.DryRun)
case "bluecat":
p, err = bluecat.NewBluecatProvider(cfg.BluecatConfigFile, cfg.BluecatDNSConfiguration, cfg.BluecatDNSServerName, cfg.BluecatDNSDeployType, cfg.BluecatDNSView, cfg.BluecatGatewayHost, cfg.BluecatRootZone, cfg.TXTPrefix, cfg.TXTSuffix, domainFilter, zoneIDFilter, cfg.DryRun, cfg.BluecatSkipTLSVerify)
case "vinyldns":
p, err = vinyldns.NewVinylDNSProvider(domainFilter, zoneIDFilter, cfg.DryRun)
case "vultr":
p, err = vultr.NewVultrProvider(ctx, domainFilter, cfg.DryRun)
case "ultradns":
p, err = ultradns.NewUltraDNSProvider(domainFilter, cfg.DryRun)
case "civo":
p, err = civo.NewCivoProvider(domainFilter, cfg.DryRun)
case "cloudflare":
p, err = cloudflare.NewCloudFlareProvider(domainFilter, zoneIDFilter, cfg.CloudflareProxied, cfg.DryRun, cfg.CloudflareDNSRecordsPerPage, cfg.CloudflareRegionKey)
case "rcodezero":
p, err = rcode0.NewRcodeZeroProvider(domainFilter, cfg.DryRun, cfg.RcodezeroTXTEncrypt)
case "google":
p, err = google.NewGoogleProvider(ctx, cfg.GoogleProject, domainFilter, zoneIDFilter, cfg.GoogleBatchChangeSize, cfg.GoogleBatchChangeInterval, cfg.GoogleZoneVisibility, cfg.DryRun)
case "digitalocean":
@ -270,19 +257,6 @@ func main() {
p, err = linode.NewLinodeProvider(domainFilter, cfg.DryRun, externaldns.Version)
case "dnsimple":
p, err = dnsimple.NewDnsimpleProvider(domainFilter, zoneIDFilter, cfg.DryRun)
case "dyn":
p, err = dyn.NewDynProvider(
dyn.DynConfig{
DomainFilter: domainFilter,
ZoneIDFilter: zoneIDFilter,
DryRun: cfg.DryRun,
CustomerName: cfg.DynCustomerName,
Username: cfg.DynUsername,
Password: cfg.DynPassword,
MinTTLSeconds: cfg.DynMinTTLSeconds,
AppVersion: externaldns.Version,
},
)
case "coredns", "skydns":
p, err = coredns.NewCoreDNSProvider(domainFilter, cfg.CoreDNSPrefix, cfg.DryRun)
case "rdns":
@ -381,8 +355,6 @@ func main() {
)
case "ibmcloud":
p, err = ibmcloud.NewIBMCloudProvider(cfg.IBMCloudConfigFile, domainFilter, zoneIDFilter, endpointsSource, cfg.IBMCloudProxied, cfg.DryRun)
case "safedns":
p, err = safedns.NewSafeDNSProvider(domainFilter, cfg.DryRun)
case "plural":
p, err = plural.NewPluralProvider(cfg.PluralCluster, cfg.PluralProvider)
case "tencentcloud":
@ -401,6 +373,13 @@ func main() {
os.Exit(0)
}
if cfg.ProviderCacheTime > 0 {
p = provider.NewCachedProvider(
p,
cfg.ProviderCacheTime,
)
}
var r registry.Registry
switch cfg.Registry {
case "dynamodb":
@ -414,7 +393,7 @@ func main() {
case "txt":
r, err = registry.NewTXTRegistry(p, cfg.TXTPrefix, cfg.TXTSuffix, cfg.TXTOwnerID, cfg.TXTCacheInterval, cfg.TXTWildcardReplacement, cfg.ManagedDNSRecordTypes, cfg.ExcludeDNSRecordTypes, cfg.TXTEncryptEnabled, []byte(cfg.TXTEncryptAESKey))
case "aws-sd":
r, err = registry.NewAWSSDRegistry(p.(*awssd.AWSSDProvider), cfg.TXTOwnerID)
r, err = registry.NewAWSSDRegistry(p, cfg.TXTOwnerID)
default:
log.Fatalf("unknown registry: %s", cfg.Registry)
}

9
mkdocs.yml
View File

@ -2,7 +2,6 @@ site_name: external-dns
site_author: external-dns maintainers
repo_name: kubernetes-sigs/external-dns
repo_url: https://github.com/kubernetes-sigs/external-dns/
trademark: https://www.linuxfoundation.org/legal/trademark-usage
docs_dir: .
@ -19,11 +18,7 @@ nav:
- Tutorials: docs/tutorials/*
- Annotations:
- About: docs/annotations/annotations.md
- Sources:
- About: docs/sources/sources.md
- Gateway: docs/sources/gateway.md
- Ingress: docs/sources/ingress.md
- Service: docs/sources/service.md
- Sources: docs/sources/*
- Registries:
- About: docs/registry/registry.md
- TXT: docs/registry/txt.md
@ -31,7 +26,9 @@ nav:
- Advanced Topics:
- Initial Design: docs/initial-design.md
- TTL: docs/ttl.md
- NAT64: docs/nat64.md
- MultiTarget: docs/proposal/multi-target.md
- Rate Limits: docs/rate-limits.md
- Contributing:
- Kubernetes Contributions: CONTRIBUTING.md
- Release: docs/release.md

41
pkg/apis/externaldns/types.go
View File

@ -67,6 +67,7 @@ type Config struct {
AlwaysPublishNotReadyAddresses bool
ConnectorSourceServer string
Provider string
ProviderCacheTime time.Duration
GoogleProject string
GoogleBatchChangeSize int
GoogleBatchChangeInterval time.Duration
@ -103,29 +104,16 @@ type Config struct {
AzureSubscriptionID string
AzureUserAssignedIdentityClientID string
AzureActiveDirectoryAuthorityHost string
BluecatDNSConfiguration string
BluecatConfigFile string
BluecatDNSView string
BluecatGatewayHost string
BluecatRootZone string
BluecatDNSServerName string
BluecatDNSDeployType string
BluecatSkipTLSVerify bool
CloudflareProxied bool
CloudflareDNSRecordsPerPage int
CloudflareRegionKey string
CoreDNSPrefix string
RcodezeroTXTEncrypt bool
AkamaiServiceConsumerDomain string
AkamaiClientToken string
AkamaiClientSecret string
AkamaiAccessToken string
AkamaiEdgercPath string
AkamaiEdgercSection string
DynCustomerName string
DynUsername string
DynPassword string `secure:"yes"`
DynMinTTLSeconds int
OCIConfigFile string
OCICompartmentOCID string
OCIAuthInstancePrincipal bool
@ -214,6 +202,7 @@ type Config struct {
WebhookServer bool
TraefikDisableLegacy bool
TraefikDisableNew bool
NAT64Networks []string
}
var defaultConfig = &Config{
@ -240,6 +229,7 @@ var defaultConfig = &Config{
PublishHostIP: false,
ConnectorSourceServer: "localhost:8080",
Provider: "",
ProviderCacheTime: 0,
GoogleProject: "",
GoogleBatchChangeSize: 1000,
GoogleBatchChangeInterval: time.Second,
@ -271,13 +261,10 @@ var defaultConfig = &Config{
AzureConfigFile: "/etc/kubernetes/azure.json",
AzureResourceGroup: "",
AzureSubscriptionID: "",
BluecatConfigFile: "/etc/kubernetes/bluecat.json",
BluecatDNSDeployType: "no-deploy",
CloudflareProxied: false,
CloudflareDNSRecordsPerPage: 100,
CloudflareRegionKey: "earth",
CoreDNSPrefix: "/skydns/",
RcodezeroTXTEncrypt: false,
AkamaiServiceConsumerDomain: "",
AkamaiClientToken: "",
AkamaiClientSecret: "",
@ -365,6 +352,7 @@ var defaultConfig = &Config{
WebhookServer: false,
TraefikDisableLegacy: false,
TraefikDisableNew: false,
NAT64Networks: []string{},
}
// NewConfig returns new Config object
@ -430,7 +418,7 @@ func (cfg *Config) ParseFlags(args []string) error {
app.Flag("openshift-router-name", "if source is openshift-route then you can pass the ingress controller name. Based on this name external-dns will select the respective router from the route status and map that routerCanonicalHostname to the route host while creating a CNAME record.").StringVar(&cfg.OCPRouterName)
app.Flag("namespace", "Limit resources queried for endpoints to a specific namespace (default: all namespaces)").Default(defaultConfig.Namespace).StringVar(&cfg.Namespace)
app.Flag("annotation-filter", "Filter resources queried for endpoints by annotation, using label selector semantics").Default(defaultConfig.AnnotationFilter).StringVar(&cfg.AnnotationFilter)
app.Flag("label-filter", "Filter resources queried for endpoints by label selector; currently supported by source types crd, gateway-httproute, gateway-grpcroute, gateway-tlsroute, gateway-tcproute, gateway-udproute, ingress, node, openshift-route, and service").Default(defaultConfig.LabelFilter).StringVar(&cfg.LabelFilter)
app.Flag("label-filter", "Filter resources queried for endpoints by label selector; currently supported by source types crd, gateway-httproute, gateway-grpcroute, gateway-tlsroute, gateway-tcproute, gateway-udproute, ingress, node, openshift-route, service and ambassador-host").Default(defaultConfig.LabelFilter).StringVar(&cfg.LabelFilter)
app.Flag("ingress-class", "Require an Ingress to have this class name (defaults to any class; specify multiple times to allow more than one class)").StringsVar(&cfg.IngressClassNames)
app.Flag("fqdn-template", "A templated string that's used to generate DNS names from sources that don't define a hostname themselves, or to add a hostname suffix when paired with the fake source (optional). Accepts comma separated list for multiple global FQDN.").Default(defaultConfig.FQDNTemplate).StringVar(&cfg.FQDNTemplate)
app.Flag("combine-fqdn-annotation", "Combine FQDN template and Annotations instead of overwriting").BoolVar(&cfg.CombineFQDNAndAnnotation)
@ -454,10 +442,12 @@ func (cfg *Config) ParseFlags(args []string) error {
app.Flag("exclude-target-net", "Exclude target nets (optional)").StringsVar(&cfg.ExcludeTargetNets)
app.Flag("traefik-disable-legacy", "Disable listeners on Resources under the traefik.containo.us API Group").Default(strconv.FormatBool(defaultConfig.TraefikDisableLegacy)).BoolVar(&cfg.TraefikDisableLegacy)
app.Flag("traefik-disable-new", "Disable listeners on Resources under the traefik.io API Group").Default(strconv.FormatBool(defaultConfig.TraefikDisableNew)).BoolVar(&cfg.TraefikDisableNew)
app.Flag("nat64-networks", "Adding an A record for each AAAA record in NAT64-enabled networks; specify multiple times for multiple possible nets (optional)").StringsVar(&cfg.NAT64Networks)
// Flags related to providers
providers := []string{"akamai", "alibabacloud", "aws", "aws-sd", "azure", "azure-dns", "azure-private-dns", "bluecat", "civo", "cloudflare", "coredns", "designate", "digitalocean", "dnsimple", "dyn", "exoscale", "gandi", "godaddy", "google", "ibmcloud", "inmemory", "linode", "ns1", "oci", "ovh", "pdns", "pihole", "plural", "rcodezero", "rdns", "rfc2136", "safedns", "scaleway", "skydns", "tencentcloud", "transip", "ultradns", "vinyldns", "vultr", "webhook"}
providers := []string{"akamai", "alibabacloud", "aws", "aws-sd", "azure", "azure-dns", "azure-private-dns", "civo", "cloudflare", "coredns", "designate", "digitalocean", "dnsimple", "exoscale", "gandi", "godaddy", "google", "ibmcloud", "inmemory", "linode", "ns1", "oci", "ovh", "pdns", "pihole", "plural", "rdns", "rfc2136", "scaleway", "skydns", "tencentcloud", "transip", "ultradns", "webhook"}
app.Flag("provider", "The DNS provider where the DNS records will be created (required, options: "+strings.Join(providers, ", ")+")").Required().PlaceHolder("provider").EnumVar(&cfg.Provider, providers...)
app.Flag("provider-cache-time", "The time to cache the DNS provider record list requests.").Default(defaultConfig.ProviderCacheTime.String()).DurationVar(&cfg.ProviderCacheTime)
app.Flag("domain-filter", "Limit possible target zones by a domain suffix; specify multiple times for multiple domains (optional)").Default("").StringsVar(&cfg.DomainFilter)
app.Flag("exclude-domains", "Exclude subdomains (optional)").Default("").StringsVar(&cfg.ExcludeDomains)
app.Flag("regex-domain-filter", "Limit possible domains and target zones by a Regex filter; Overrides domain-filter (optional)").Default(defaultConfig.RegexDomainFilter.String()).RegexpVar(&cfg.RegexDomainFilter)
@ -492,16 +482,6 @@ func (cfg *Config) ParseFlags(args []string) error {
app.Flag("tencent-cloud-config-file", "When using the Tencent Cloud provider, specify the Tencent Cloud configuration file (required when --provider=tencentcloud)").Default(defaultConfig.TencentCloudConfigFile).StringVar(&cfg.TencentCloudConfigFile)
app.Flag("tencent-cloud-zone-type", "When using the Tencent Cloud provider, filter for zones with visibility (optional, options: public, private)").Default(defaultConfig.TencentCloudZoneType).EnumVar(&cfg.TencentCloudZoneType, "", "public", "private")
// Flags related to BlueCat provider
app.Flag("bluecat-dns-configuration", "When using the Bluecat provider, specify the Bluecat DNS configuration string (optional when --provider=bluecat)").Default("").StringVar(&cfg.BluecatDNSConfiguration)
app.Flag("bluecat-config-file", "When using the Bluecat provider, specify the Bluecat configuration file (optional when --provider=bluecat)").Default(defaultConfig.BluecatConfigFile).StringVar(&cfg.BluecatConfigFile)
app.Flag("bluecat-dns-view", "When using the Bluecat provider, specify the Bluecat DNS view string (optional when --provider=bluecat)").Default("").StringVar(&cfg.BluecatDNSView)
app.Flag("bluecat-gateway-host", "When using the Bluecat provider, specify the Bluecat Gateway Host (optional when --provider=bluecat)").Default("").StringVar(&cfg.BluecatGatewayHost)
app.Flag("bluecat-root-zone", "When using the Bluecat provider, specify the Bluecat root zone (optional when --provider=bluecat)").Default("").StringVar(&cfg.BluecatRootZone)
app.Flag("bluecat-skip-tls-verify", "When using the Bluecat provider, specify to skip TLS verification (optional when --provider=bluecat) (default: false)").BoolVar(&cfg.BluecatSkipTLSVerify)
app.Flag("bluecat-dns-server-name", "When using the Bluecat provider, specify the Bluecat DNS Server to initiate deploys against. This is only used if --bluecat-dns-deploy-type is not 'no-deploy' (optional when --provider=bluecat)").Default("").StringVar(&cfg.BluecatDNSServerName)
app.Flag("bluecat-dns-deploy-type", "When using the Bluecat provider, specify the type of DNS deployment to initiate after records are updated. Valid options are 'full-deploy' and 'no-deploy'. Deploy will only execute if --bluecat-dns-server-name is set (optional when --provider=bluecat)").Default(defaultConfig.BluecatDNSDeployType).StringVar(&cfg.BluecatDNSDeployType)
app.Flag("cloudflare-proxied", "When using the Cloudflare provider, specify if the proxy mode must be enabled (default: disabled)").BoolVar(&cfg.CloudflareProxied)
app.Flag("cloudflare-dns-records-per-page", "When using the Cloudflare provider, specify how many DNS records listed per page, max possible 5,000 (default: 100)").Default(strconv.Itoa(defaultConfig.CloudflareDNSRecordsPerPage)).IntVar(&cfg.CloudflareDNSRecordsPerPage)
app.Flag("cloudflare-region-key", "When using the Cloudflare provider, specify the region (default: earth)").StringVar(&cfg.CloudflareRegionKey)
@ -512,16 +492,11 @@ func (cfg *Config) ParseFlags(args []string) error {
app.Flag("akamai-access-token", "When using the Akamai provider, specify the access token (required when --provider=akamai and edgerc-path not specified)").Default(defaultConfig.AkamaiAccessToken).StringVar(&cfg.AkamaiAccessToken)
app.Flag("akamai-edgerc-path", "When using the Akamai provider, specify the .edgerc file path. Path must be reachable form invocation environment. (required when --provider=akamai and *-token, secret serviceconsumerdomain not specified)").Default(defaultConfig.AkamaiEdgercPath).StringVar(&cfg.AkamaiEdgercPath)
app.Flag("akamai-edgerc-section", "When using the Akamai provider, specify the .edgerc file path (Optional when edgerc-path is specified)").Default(defaultConfig.AkamaiEdgercSection).StringVar(&cfg.AkamaiEdgercSection)
app.Flag("dyn-customer-name", "When using the Dyn provider, specify the Customer Name").Default("").StringVar(&cfg.DynCustomerName)
app.Flag("dyn-username", "When using the Dyn provider, specify the Username").Default("").StringVar(&cfg.DynUsername)
app.Flag("dyn-password", "When using the Dyn provider, specify the password").Default("").StringVar(&cfg.DynPassword)
app.Flag("dyn-min-ttl", "Minimal TTL (in seconds) for records. This value will be used if the provided TTL for a service/ingress is lower than this.").IntVar(&cfg.DynMinTTLSeconds)
app.Flag("oci-config-file", "When using the OCI provider, specify the OCI configuration file (required when --provider=oci").Default(defaultConfig.OCIConfigFile).StringVar(&cfg.OCIConfigFile)
app.Flag("oci-compartment-ocid", "When using the OCI provider, specify the OCID of the OCI compartment containing all managed zones and records. Required when using OCI IAM instance principal authentication.").StringVar(&cfg.OCICompartmentOCID)
app.Flag("oci-zone-scope", "When using OCI provider, filter for zones with this scope (optional, options: GLOBAL, PRIVATE). Defaults to GLOBAL, setting to empty value will target both.").Default(defaultConfig.OCIZoneScope).EnumVar(&cfg.OCIZoneScope, "", "GLOBAL", "PRIVATE")
app.Flag("oci-auth-instance-principal", "When using the OCI provider, specify whether OCI IAM instance principal authentication should be used (instead of key-based auth via the OCI config file).").Default(strconv.FormatBool(defaultConfig.OCIAuthInstancePrincipal)).BoolVar(&cfg.OCIAuthInstancePrincipal)
app.Flag("oci-zones-cache-duration", "When using the OCI provider, set the zones list cache TTL (0s to disable).").Default(defaultConfig.OCIZoneCacheDuration.String()).DurationVar(&cfg.OCIZoneCacheDuration)
app.Flag("rcodezero-txt-encrypt", "When using the Rcodezero provider with txt registry option, set if TXT rrs are encrypted (default: false)").Default(strconv.FormatBool(defaultConfig.RcodezeroTXTEncrypt)).BoolVar(&cfg.RcodezeroTXTEncrypt)
app.Flag("inmemory-zone", "Provide a list of pre-configured zones for the inmemory provider; specify multiple times for multiple zones (optional)").Default("").StringsVar(&cfg.InMemoryZones)
app.Flag("ovh-endpoint", "When using the OVH provider, specify the endpoint (default: ovh-eu)").Default(defaultConfig.OVHEndpoint).StringVar(&cfg.OVHEndpoint)
app.Flag("ovh-api-rate-limit", "When using the OVH provider, specify the API request rate limit, X operations by seconds (default: 20)").Default(strconv.Itoa(defaultConfig.OVHApiRateLimit)).IntVar(&cfg.OVHApiRateLimit)

38
pkg/apis/externaldns/types_test.go
View File

@ -72,14 +72,6 @@ var (
AzureConfigFile: "/etc/kubernetes/azure.json",
AzureResourceGroup: "",
AzureSubscriptionID: "",
BluecatDNSConfiguration: "",
BluecatDNSServerName: "",
BluecatConfigFile: "/etc/kubernetes/bluecat.json",
BluecatDNSView: "",
BluecatGatewayHost: "",
BluecatRootZone: "",
BluecatDNSDeployType: defaultConfig.BluecatDNSDeployType,
BluecatSkipTLSVerify: false,
CloudflareProxied: false,
CloudflareDNSRecordsPerPage: 100,
CloudflareRegionKey: "earth",
@ -118,7 +110,6 @@ var (
ExoscaleAPISecret: "",
CRDSourceAPIVersion: "externaldns.k8s.io/v1alpha1",
CRDSourceKind: "DNSEndpoint",
RcodezeroTXTEncrypt: false,
TransIPAccountName: "",
TransIPPrivateKeyFile: "",
DigitalOceanAPIPageSize: 50,
@ -180,14 +171,6 @@ var (
AzureConfigFile: "azure.json",
AzureResourceGroup: "arg",
AzureSubscriptionID: "arg",
BluecatDNSConfiguration: "arg",
BluecatDNSServerName: "arg",
BluecatConfigFile: "bluecat.json",
BluecatDNSView: "arg",
BluecatGatewayHost: "arg",
BluecatRootZone: "arg",
BluecatDNSDeployType: "full-deploy",
BluecatSkipTLSVerify: true,
CloudflareProxied: true,
CloudflareDNSRecordsPerPage: 5000,
CloudflareRegionKey: "us",
@ -230,7 +213,6 @@ var (
ExoscaleAPISecret: "2",
CRDSourceAPIVersion: "test.k8s.io/v1alpha1",
CRDSourceKind: "Endpoint",
RcodezeroTXTEncrypt: true,
NS1Endpoint: "https://api.example.com/v1",
NS1IgnoreSSL: true,
TransIPAccountName: "transip",
@ -291,14 +273,6 @@ func TestParseFlags(t *testing.T) {
"--azure-config-file=azure.json",
"--azure-resource-group=arg",
"--azure-subscription-id=arg",
"--bluecat-dns-configuration=arg",
"--bluecat-config-file=bluecat.json",
"--bluecat-dns-view=arg",
"--bluecat-dns-server-name=arg",
"--bluecat-gateway-host=arg",
"--bluecat-root-zone=arg",
"--bluecat-dns-deploy-type=full-deploy",
"--bluecat-skip-tls-verify",
"--cloudflare-proxied",
"--cloudflare-dns-records-per-page=5000",
"--cloudflare-region-key=us",
@ -373,7 +347,6 @@ func TestParseFlags(t *testing.T) {
"--exoscale-apisecret=2",
"--crd-source-apiversion=test.k8s.io/v1alpha1",
"--crd-source-kind=Endpoint",
"--rcodezero-txt-encrypt",
"--ns1-endpoint=https://api.example.com/v1",
"--ns1-ignoressl",
"--transip-account=transip",
@ -417,14 +390,6 @@ func TestParseFlags(t *testing.T) {
"EXTERNAL_DNS_AZURE_CONFIG_FILE": "azure.json",
"EXTERNAL_DNS_AZURE_RESOURCE_GROUP": "arg",
"EXTERNAL_DNS_AZURE_SUBSCRIPTION_ID": "arg",
"EXTERNAL_DNS_BLUECAT_DNS_CONFIGURATION": "arg",
"EXTERNAL_DNS_BLUECAT_DNS_SERVER_NAME": "arg",
"EXTERNAL_DNS_BLUECAT_DNS_DEPLOY_TYPE": "full-deploy",
"EXTERNAL_DNS_BLUECAT_CONFIG_FILE": "bluecat.json",
"EXTERNAL_DNS_BLUECAT_DNS_VIEW": "arg",
"EXTERNAL_DNS_BLUECAT_GATEWAY_HOST": "arg",
"EXTERNAL_DNS_BLUECAT_ROOT_ZONE": "arg",
"EXTERNAL_DNS_BLUECAT_SKIP_TLS_VERIFY": "1",
"EXTERNAL_DNS_CLOUDFLARE_PROXIED": "1",
"EXTERNAL_DNS_CLOUDFLARE_DNS_RECORDS_PER_PAGE": "5000",
"EXTERNAL_DNS_CLOUDFLARE_REGION_KEY": "us",
@ -492,7 +457,6 @@ func TestParseFlags(t *testing.T) {
"EXTERNAL_DNS_EXOSCALE_APISECRET": "2",
"EXTERNAL_DNS_CRD_SOURCE_APIVERSION": "test.k8s.io/v1alpha1",
"EXTERNAL_DNS_CRD_SOURCE_KIND": "Endpoint",
"EXTERNAL_DNS_RCODEZERO_TXT_ENCRYPT": "1",
"EXTERNAL_DNS_NS1_ENDPOINT": "https://api.example.com/v1",
"EXTERNAL_DNS_NS1_IGNORESSL": "1",
"EXTERNAL_DNS_TRANSIP_ACCOUNT": "transip",
@ -540,14 +504,12 @@ func restoreEnv(t *testing.T, originalEnv map[string]string) {
func TestPasswordsNotLogged(t *testing.T) {
cfg := Config{
DynPassword: "dyn-pass",
PDNSAPIKey: "pdns-api-key",
RFC2136TSIGSecret: "tsig-secret",
}
s := cfg.String()
assert.False(t, strings.Contains(s, "dyn-pass"))
assert.False(t, strings.Contains(s, "pdns-api-key"))
assert.False(t, strings.Contains(s, "tsig-secret"))
}

13
pkg/apis/externaldns/validation/validation.go
View File

@ -61,19 +61,6 @@ func ValidateConfig(cfg *externaldns.Config) error {
}
}
if cfg.Provider == "dyn" {
if cfg.DynUsername == "" {
return errors.New("no Dyn username specified")
}
if cfg.DynCustomerName == "" {
return errors.New("no Dyn customer name specified")
}
if cfg.DynMinTTLSeconds < 0 {
return errors.New("TTL specified for Dyn is negative")
}
}
if cfg.Provider == "rfc2136" {
if cfg.RFC2136MinTTL < 0 {
return errors.New("TTL specified for rfc2136 is negative")

53
pkg/apis/externaldns/validation/validation_test.go
View File

@ -64,59 +64,6 @@ func newValidConfig(t *testing.T) *externaldns.Config {
return cfg
}
func addRequiredFieldsForDyn(cfg *externaldns.Config) {
cfg.LogFormat = "json"
cfg.Sources = []string{"ingress"}
cfg.Provider = "dyn"
}
func TestValidateBadDynConfig(t *testing.T) {
badConfigs := []*externaldns.Config{
{},
{
// only username
DynUsername: "test",
},
{
// only customer name
DynCustomerName: "test",
},
{
// negative timeout
DynUsername: "test",
DynCustomerName: "test",
DynMinTTLSeconds: -1,
},
}
for _, cfg := range badConfigs {
addRequiredFieldsForDyn(cfg)
err := ValidateConfig(cfg)
assert.NotNil(t, err, "Configuration %+v should NOT have passed validation", cfg)
}
}
func TestValidateGoodDynConfig(t *testing.T) {
goodConfigs := []*externaldns.Config{
{
DynUsername: "test",
DynCustomerName: "test",
DynMinTTLSeconds: 600,
},
{
DynUsername: "test",
DynCustomerName: "test",
DynMinTTLSeconds: 0,
},
}
for _, cfg := range goodConfigs {
addRequiredFieldsForDyn(cfg)
err := ValidateConfig(cfg)
assert.Nil(t, err, "Configuration should be valid, got this error instead", err)
}
}
func TestValidateBadIgnoreHostnameAnnotationsConfig(t *testing.T) {
cfg := externaldns.NewConfig()
cfg.IgnoreHostnameAnnotation = true

2
provider/aws/aws.go
View File

@ -567,7 +567,7 @@ func (p *AWSProvider) createUpdateChanges(newEndpoints, oldEndpoints []*endpoint
}
// GetDomainFilter generates a filter to exclude any domain that is not controlled by the provider
func (p *AWSProvider) GetDomainFilter() endpoint.DomainFilter {
func (p *AWSProvider) GetDomainFilter() endpoint.DomainFilterInterface {
zones, err := p.Zones(context.Background())
if err != nil {
log.Errorf("failed to list zones: %v", err)

4
provider/aws/aws_test.go
View File

@ -319,10 +319,10 @@ func TestAWSZones(t *testing.T) {
func TestAWSRecordsFilter(t *testing.T) {
provider, _ := newAWSProvider(t, endpoint.DomainFilter{}, provider.ZoneIDFilter{}, provider.ZoneTypeFilter{}, false, false, nil)
domainFilter := provider.GetDomainFilter()
assert.NotNil(t, domainFilter)
require.NotNil(t, domainFilter)
require.IsType(t, endpoint.DomainFilter{}, domainFilter)
count := 0
filters := domainFilter.Filters
filters := domainFilter.(endpoint.DomainFilter).Filters
for _, tld := range []string{
"zone-4.ext-dns-test-3.teapot.zalan.do",
".zone-4.ext-dns-test-3.teapot.zalan.do",

6
provider/bluecat/OWNERS
View File

@ -1,6 +0,0 @@
approvers:
- seanmalloy
- vinny-sabatini
reviewers:
- seanmalloy
- vinny-sabatini

511
provider/bluecat/bluecat.go
View File

@ -1,511 +0,0 @@
/*
Copyright 2020 The Kubernetes Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
// TODO: Ensure we have proper error handling/logging for API calls to Bluecat. getBluecatGatewayToken has a good example of this
// TODO: Remove studdering
// TODO: Make API calls more consistent (eg error handling on HTTP response codes)
// TODO: zone-id-filter does not seem to work with our provider
package bluecat
import (
"context"
"encoding/json"
"os"
"regexp"
"strconv"
"strings"
"github.com/pkg/errors"
log "github.com/sirupsen/logrus"
"sigs.k8s.io/external-dns/endpoint"
"sigs.k8s.io/external-dns/plan"
"sigs.k8s.io/external-dns/provider"
api "sigs.k8s.io/external-dns/provider/bluecat/gateway"
)
// BluecatProvider implements the DNS provider for Bluecat DNS
type BluecatProvider struct {
provider.BaseProvider
domainFilter endpoint.DomainFilter
zoneIDFilter provider.ZoneIDFilter
dryRun bool
RootZone string
DNSConfiguration string
DNSServerName string
DNSDeployType string
View string
gatewayClient api.GatewayClient
TxtPrefix string
TxtSuffix string
}
type bluecatRecordSet struct {
obj interface{}
res interface{}
}
// NewBluecatProvider creates a new Bluecat provider.
//
// Returns a pointer to the provider or an error if a provider could not be created.
func NewBluecatProvider(configFile, dnsConfiguration, dnsServerName, dnsDeployType, dnsView, gatewayHost, rootZone, txtPrefix, txtSuffix string, domainFilter endpoint.DomainFilter, zoneIDFilter provider.ZoneIDFilter, dryRun, skipTLSVerify bool) (*BluecatProvider, error) {
cfg := api.BluecatConfig{}
contents, err := os.ReadFile(configFile)
if err != nil {
if errors.Is(err, os.ErrNotExist) {
cfg = api.BluecatConfig{
GatewayHost: gatewayHost,
DNSConfiguration: dnsConfiguration,
DNSServerName: dnsServerName,
DNSDeployType: dnsDeployType,
View: dnsView,
RootZone: rootZone,
SkipTLSVerify: skipTLSVerify,
GatewayUsername: "",
GatewayPassword: "",
}
} else {
return nil, errors.Wrapf(err, "failed to read Bluecat config file %v", configFile)
}
} else {
err = json.Unmarshal(contents, &cfg)
if err != nil {
return nil, errors.Wrapf(err, "failed to parse Bluecat JSON config file %v", configFile)
}
}
if !api.IsValidDNSDeployType(cfg.DNSDeployType) {
return nil, errors.Errorf("%v is not a valid deployment type", cfg.DNSDeployType)
}
token, cookie, err := api.GetBluecatGatewayToken(cfg)
if err != nil {
return nil, errors.Wrap(err, "failed to get API token from Bluecat Gateway")
}
gatewayClient := api.NewGatewayClientConfig(cookie, token, cfg.GatewayHost, cfg.DNSConfiguration, cfg.View, cfg.RootZone, cfg.DNSServerName, cfg.SkipTLSVerify)
provider := &BluecatProvider{
domainFilter: domainFilter,
zoneIDFilter: zoneIDFilter,
dryRun: dryRun,
gatewayClient: gatewayClient,
DNSConfiguration: cfg.DNSConfiguration,
DNSServerName: cfg.DNSServerName,
DNSDeployType: cfg.DNSDeployType,
View: cfg.View,
RootZone: cfg.RootZone,
TxtPrefix: txtPrefix,
TxtSuffix: txtSuffix,
}
return provider, nil
}
// Records fetches Host, CNAME, and TXT records from bluecat gateway
func (p *BluecatProvider) Records(ctx context.Context) (endpoints []*endpoint.Endpoint, err error) {
zones, err := p.zones()
if err != nil {
return nil, errors.Wrap(err, "could not fetch zones")
}
// Parsing Text records first, so we can get the owner from them.
for _, zone := range zones {
log.Debugf("fetching records from zone '%s'", zone)
var resT []api.BluecatTXTRecord
err = p.gatewayClient.GetTXTRecords(zone, &resT)
if err != nil {
return nil, errors.Wrapf(err, "could not fetch TXT records for zone: %v", zone)
}
for _, rec := range resT {
tempEndpoint := endpoint.NewEndpoint(rec.Name, endpoint.RecordTypeTXT, rec.Properties)
tempEndpoint.Labels[endpoint.OwnerLabelKey], err = extractOwnerfromTXTRecord(rec.Properties)
if err != nil {
log.Debugf("External DNS Owner %s", err)
}
endpoints = append(endpoints, tempEndpoint)
}
var resH []api.BluecatHostRecord
err = p.gatewayClient.GetHostRecords(zone, &resH)
if err != nil {
return nil, errors.Wrapf(err, "could not fetch host records for zone: %v", zone)
}
var ep *endpoint.Endpoint
for _, rec := range resH {
propMap := api.SplitProperties(rec.Properties)
ips := strings.Split(propMap["addresses"], ",")
for _, ip := range ips {
if _, ok := propMap["ttl"]; ok {
ttl, err := strconv.Atoi(propMap["ttl"])
if err != nil {
return nil, errors.Wrapf(err, "could not parse ttl '%d' as int for host record %v", ttl, rec.Name)
}
ep = endpoint.NewEndpointWithTTL(propMap["absoluteName"], endpoint.RecordTypeA, endpoint.TTL(ttl), ip)
} else {
ep = endpoint.NewEndpoint(propMap["absoluteName"], endpoint.RecordTypeA, ip)
}
for _, txtRec := range resT {
if strings.Compare(p.TxtPrefix+rec.Name+p.TxtSuffix, txtRec.Name) == 0 {
ep.Labels[endpoint.OwnerLabelKey], err = extractOwnerfromTXTRecord(txtRec.Properties)
if err != nil {
log.Debugf("External DNS Owner %s", err)
}
}
}
endpoints = append(endpoints, ep)
}
}
var resC []api.BluecatCNAMERecord
err = p.gatewayClient.GetCNAMERecords(zone, &resC)
if err != nil {
return nil, errors.Wrapf(err, "could not fetch CNAME records for zone: %v", zone)
}
for _, rec := range resC {
propMap := api.SplitProperties(rec.Properties)
if _, ok := propMap["ttl"]; ok {
ttl, err := strconv.Atoi(propMap["ttl"])
if err != nil {
return nil, errors.Wrapf(err, "could not parse ttl '%d' as int for CNAME record %v", ttl, rec.Name)
}
ep = endpoint.NewEndpointWithTTL(propMap["absoluteName"], endpoint.RecordTypeCNAME, endpoint.TTL(ttl), propMap["linkedRecordName"])
} else {
ep = endpoint.NewEndpoint(propMap["absoluteName"], endpoint.RecordTypeCNAME, propMap["linkedRecordName"])
}
for _, txtRec := range resT {
if strings.Compare(p.TxtPrefix+rec.Name+p.TxtSuffix, txtRec.Name) == 0 {
ep.Labels[endpoint.OwnerLabelKey], err = extractOwnerfromTXTRecord(txtRec.Properties)
if err != nil {
log.Debugf("External DNS Owner %s", err)
}
}
}
endpoints = append(endpoints, ep)
}
}
log.Debugf("fetched %d records from Bluecat", len(endpoints))
return endpoints, nil
}
// ApplyChanges updates necessary zones and replaces old records with new ones
//
// Returns nil upon success and err is there is an error
func (p *BluecatProvider) ApplyChanges(ctx context.Context, changes *plan.Changes) error {
zones, err := p.zones()
if err != nil {
return err
}
log.Infof("zones is: %+v\n", zones)
log.Infof("changes: %+v\n", changes)
created, deleted := p.mapChanges(zones, changes)
log.Infof("created: %+v\n", created)
log.Infof("deleted: %+v\n", deleted)
p.deleteRecords(deleted)
p.createRecords(created)
if p.DNSServerName != "" {
if p.dryRun {
log.Debug("Not executing deploy because this is running in dry-run mode")
} else {
switch p.DNSDeployType {
case "full-deploy":
err := p.gatewayClient.ServerFullDeploy()
if err != nil {
return err
}
case "no-deploy":
log.Debug("Not executing deploy because DNSDeployType is set to 'no-deploy'")
}
}
} else {
log.Debug("Not executing deploy because server name was not provided")
}
return nil
}
type bluecatChangeMap map[string][]*endpoint.Endpoint
func (p *BluecatProvider) mapChanges(zones []string, changes *plan.Changes) (bluecatChangeMap, bluecatChangeMap) {
created := bluecatChangeMap{}
deleted := bluecatChangeMap{}
mapChange := func(changeMap bluecatChangeMap, change *endpoint.Endpoint) {
zone := p.findZone(zones, change.DNSName)
if zone == "" {
log.Debugf("ignoring changes to '%s' because a suitable Bluecat DNS zone was not found", change.DNSName)
return
}
changeMap[zone] = append(changeMap[zone], change)
}
for _, change := range changes.Delete {
mapChange(deleted, change)
}
for _, change := range changes.UpdateOld {
mapChange(deleted, change)
}
for _, change := range changes.Create {
mapChange(created, change)
}
for _, change := range changes.UpdateNew {
mapChange(created, change)
}
return created, deleted
}
// findZone finds the most specific matching zone for a given record 'name' from a list of all zones
func (p *BluecatProvider) findZone(zones []string, name string) string {
var result string
for _, zone := range zones {
if strings.HasSuffix(name, "."+zone) {
if result == "" || len(zone) > len(result) {
result = zone
}
} else if strings.EqualFold(name, zone) {
if result == "" || len(zone) > len(result) {
result = zone
}
}
}
return result
}
func (p *BluecatProvider) zones() ([]string, error) {
log.Debugf("retrieving Bluecat zones for configuration: %s, view: %s", p.DNSConfiguration, p.View)
var zones []string
zonelist, err := p.gatewayClient.GetBluecatZones(p.RootZone)
if err != nil {
return nil, err
}
for _, zone := range zonelist {
if !p.domainFilter.Match(zone.Name) {
continue
}
// TODO: match to absoluteName(string) not Id(int)
if !p.zoneIDFilter.Match(strconv.Itoa(zone.ID)) {
continue
}
zoneProps := api.SplitProperties(zone.Properties)
zones = append(zones, zoneProps["absoluteName"])
}
log.Debugf("found %d zones", len(zones))
return zones, nil
}
func (p *BluecatProvider) createRecords(created bluecatChangeMap) {
for zone, endpoints := range created {
for _, ep := range endpoints {
if p.dryRun {
log.Infof("would create %s record named '%s' to '%s' for Bluecat DNS zone '%s'.",
ep.RecordType,
ep.DNSName,
ep.Targets,
zone,
)
continue
}
log.Infof("creating %s record named '%s' to '%s' for Bluecat DNS zone '%s'.",
ep.RecordType,
ep.DNSName,
ep.Targets,
zone,
)
recordSet, err := p.recordSet(ep, false)
if err != nil {
log.Errorf(
"Failed to retrieve %s record named '%s' to '%s' for Bluecat DNS zone '%s': %v",
ep.RecordType,
ep.DNSName,
ep.Targets,
zone,
err,
)
continue
}
var response interface{}
switch ep.RecordType {
case endpoint.RecordTypeA:
err = p.gatewayClient.CreateHostRecord(zone, recordSet.obj.(*api.BluecatCreateHostRecordRequest))
case endpoint.RecordTypeCNAME:
err = p.gatewayClient.CreateCNAMERecord(zone, recordSet.obj.(*api.BluecatCreateCNAMERecordRequest))
case endpoint.RecordTypeTXT:
err = p.gatewayClient.CreateTXTRecord(zone, recordSet.obj.(*api.BluecatCreateTXTRecordRequest))
}
log.Debugf("Response from create: %v", response)
if err != nil {
log.Errorf(
"Failed to create %s record named '%s' to '%s' for Bluecat DNS zone '%s': %v",
ep.RecordType,
ep.DNSName,
ep.Targets,
zone,
err,
)
}
}
}
}
func (p *BluecatProvider) deleteRecords(deleted bluecatChangeMap) {
// run deletions first
for zone, endpoints := range deleted {
for _, ep := range endpoints {
if p.dryRun {
log.Infof("would delete %s record named '%s' for Bluecat DNS zone '%s'.",
ep.RecordType,
ep.DNSName,
zone,
)
continue
} else {
log.Infof("deleting %s record named '%s' for Bluecat DNS zone '%s'.",
ep.RecordType,
ep.DNSName,
zone,
)
recordSet, err := p.recordSet(ep, true)
if err != nil {
log.Errorf(
"Failed to retrieve %s record named '%s' to '%s' for Bluecat DNS zone '%s': %v",
ep.RecordType,
ep.DNSName,
ep.Targets,
zone,
err,
)
continue
}
switch ep.RecordType {
case endpoint.RecordTypeA:
for _, record := range *recordSet.res.(*[]api.BluecatHostRecord) {
err = p.gatewayClient.DeleteHostRecord(record.Name, zone)
}
case endpoint.RecordTypeCNAME:
for _, record := range *recordSet.res.(*[]api.BluecatCNAMERecord) {
err = p.gatewayClient.DeleteCNAMERecord(record.Name, zone)
}
case endpoint.RecordTypeTXT:
for _, record := range *recordSet.res.(*[]api.BluecatTXTRecord) {
err = p.gatewayClient.DeleteTXTRecord(record.Name, zone)
}
}
if err != nil {
log.Errorf("Failed to delete %s record named '%s' for Bluecat DNS zone '%s': %v",
ep.RecordType,
ep.DNSName,
zone,
err)
}
}
}
}
}
func (p *BluecatProvider) recordSet(ep *endpoint.Endpoint, getObject bool) (bluecatRecordSet, error) {
recordSet := bluecatRecordSet{}
switch ep.RecordType {
case endpoint.RecordTypeA:
var res []api.BluecatHostRecord
obj := api.BluecatCreateHostRecordRequest{
AbsoluteName: ep.DNSName,
IP4Address: ep.Targets[0],
TTL: int(ep.RecordTTL),
Properties: "",
}
if getObject {
var record api.BluecatHostRecord
err := p.gatewayClient.GetHostRecord(ep.DNSName, &record)
if err != nil {
return bluecatRecordSet{}, err
}
res = append(res, record)
}
recordSet = bluecatRecordSet{
obj: &obj,
res: &res,
}
case endpoint.RecordTypeCNAME:
var res []api.BluecatCNAMERecord
obj := api.BluecatCreateCNAMERecordRequest{
AbsoluteName: ep.DNSName,
LinkedRecord: ep.Targets[0],
TTL: int(ep.RecordTTL),
Properties: "",
}
if getObject {
var record api.BluecatCNAMERecord
err := p.gatewayClient.GetCNAMERecord(ep.DNSName, &record)
if err != nil {
return bluecatRecordSet{}, err
}
res = append(res, record)
}
recordSet = bluecatRecordSet{
obj: &obj,
res: &res,
}
case endpoint.RecordTypeTXT:
var res []api.BluecatTXTRecord
// TODO: Allow setting TTL
// This is not implemented in the Bluecat Gateway
obj := api.BluecatCreateTXTRecordRequest{
AbsoluteName: ep.DNSName,
Text: ep.Targets[0],
}
if getObject {
var record api.BluecatTXTRecord
err := p.gatewayClient.GetTXTRecord(ep.DNSName, &record)
if err != nil {
return bluecatRecordSet{}, err
}
res = append(res, record)
}
recordSet = bluecatRecordSet{
obj: &obj,
res: &res,
}
}
return recordSet, nil
}
// extractOwnerFromTXTRecord takes a single text property string and returns the owner after parsing the owner string.
func extractOwnerfromTXTRecord(propString string) (string, error) {
if len(propString) == 0 {
return "", errors.Errorf("External-DNS Owner not found")
}
re := regexp.MustCompile(`external-dns/owner=[^,]+`)
match := re.FindStringSubmatch(propString)
if len(match) == 0 {
return "", errors.Errorf("External-DNS Owner not found, %s", propString)
}
return strings.Split(match[0], "=")[1], nil
}

465
provider/bluecat/bluecat_test.go
View File

@ -1,465 +0,0 @@
/*
Copyright 2020 The Kubernetes Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package bluecat
import (
"context"
"fmt"
"strings"
"testing"
"github.com/stretchr/testify/assert"
"sigs.k8s.io/external-dns/endpoint"
"sigs.k8s.io/external-dns/internal/testutils"
"sigs.k8s.io/external-dns/plan"
"sigs.k8s.io/external-dns/provider"
api "sigs.k8s.io/external-dns/provider/bluecat/gateway"
)
type mockGatewayClient struct {
mockBluecatZones *[]api.BluecatZone
mockBluecatHosts *[]api.BluecatHostRecord
mockBluecatCNAMEs *[]api.BluecatCNAMERecord
mockBluecatTXTs *[]api.BluecatTXTRecord
}
type Changes struct {
// Records that need to be created
Create []*endpoint.Endpoint
// Records that need to be updated (current data)
UpdateOld []*endpoint.Endpoint
// Records that need to be updated (desired data)
UpdateNew []*endpoint.Endpoint
// Records that need to be deleted
Delete []*endpoint.Endpoint
}
func (g mockGatewayClient) GetBluecatZones(zoneName string) ([]api.BluecatZone, error) {
return *g.mockBluecatZones, nil
}
func (g mockGatewayClient) GetHostRecords(zone string, records *[]api.BluecatHostRecord) error {
*records = *g.mockBluecatHosts
return nil
}
func (g mockGatewayClient) GetCNAMERecords(zone string, records *[]api.BluecatCNAMERecord) error {
*records = *g.mockBluecatCNAMEs
return nil
}
func (g mockGatewayClient) GetHostRecord(name string, record *api.BluecatHostRecord) error {
for _, currentRecord := range *g.mockBluecatHosts {
if currentRecord.Name == strings.Split(name, ".")[0] {
*record = currentRecord
return nil
}
}
return nil
}
func (g mockGatewayClient) GetCNAMERecord(name string, record *api.BluecatCNAMERecord) error {
for _, currentRecord := range *g.mockBluecatCNAMEs {
if currentRecord.Name == strings.Split(name, ".")[0] {
*record = currentRecord
return nil
}
}
return nil
}
func (g mockGatewayClient) CreateHostRecord(zone string, req *api.BluecatCreateHostRecordRequest) (err error) {
return nil
}
func (g mockGatewayClient) CreateCNAMERecord(zone string, req *api.BluecatCreateCNAMERecordRequest) (err error) {
return nil
}
func (g mockGatewayClient) DeleteHostRecord(name string, zone string) (err error) {
*g.mockBluecatHosts = nil
return nil
}
func (g mockGatewayClient) DeleteCNAMERecord(name string, zone string) (err error) {
*g.mockBluecatCNAMEs = nil
return nil
}
func (g mockGatewayClient) GetTXTRecords(zone string, records *[]api.BluecatTXTRecord) error {
*records = *g.mockBluecatTXTs
return nil
}
func (g mockGatewayClient) GetTXTRecord(name string, record *api.BluecatTXTRecord) error {
for _, currentRecord := range *g.mockBluecatTXTs {
if currentRecord.Name == name {
*record = currentRecord
return nil
}
}
return nil
}
func (g mockGatewayClient) CreateTXTRecord(zone string, req *api.BluecatCreateTXTRecordRequest) error {
return nil
}
func (g mockGatewayClient) DeleteTXTRecord(name string, zone string) error {
*g.mockBluecatTXTs = nil
return nil
}
func (g mockGatewayClient) ServerFullDeploy() error {
return nil
}
func createMockBluecatZone(fqdn string) api.BluecatZone {
props := "absoluteName=" + fqdn
return api.BluecatZone{
Properties: props,
Name: fqdn,
ID: 3,
}
}
func createMockBluecatHostRecord(fqdn, target string, ttl int) api.BluecatHostRecord {
props := "absoluteName=" + fqdn + "|addresses=" + target + "|ttl=" + fmt.Sprint(ttl) + "|"
nameParts := strings.Split(fqdn, ".")
return api.BluecatHostRecord{
Name: nameParts[0],
Properties: props,
ID: 3,
}
}
func createMockBluecatCNAME(alias, target string, ttl int) api.BluecatCNAMERecord {
props := "absoluteName=" + alias + "|linkedRecordName=" + target + "|ttl=" + fmt.Sprint(ttl) + "|"
nameParts := strings.Split(alias, ".")
return api.BluecatCNAMERecord{
Name: nameParts[0],
Properties: props,
}
}
func createMockBluecatTXT(fqdn, txt string) api.BluecatTXTRecord {
return api.BluecatTXTRecord{
Name: fqdn,
Properties: txt,
}
}
func newBluecatProvider(domainFilter endpoint.DomainFilter, zoneIDFilter provider.ZoneIDFilter, dryRun bool, client mockGatewayClient) *BluecatProvider {
return &BluecatProvider{
domainFilter: domainFilter,
zoneIDFilter: zoneIDFilter,
dryRun: dryRun,
gatewayClient: client,
}
}
type bluecatTestData []struct {
TestDescription string
Endpoints []*endpoint.Endpoint
}
var tests = bluecatTestData{
{
"first test case", // TODO: better test description
[]*endpoint.Endpoint{
{
DNSName: "example.com",
RecordType: endpoint.RecordTypeA,
Targets: endpoint.Targets{"123.123.123.122"},
RecordTTL: endpoint.TTL(30),
},
{
DNSName: "nginx.example.com",
RecordType: endpoint.RecordTypeA,
Targets: endpoint.Targets{"123.123.123.123"},
RecordTTL: endpoint.TTL(30),
},
{
DNSName: "whitespace.example.com",
RecordType: endpoint.RecordTypeA,
Targets: endpoint.Targets{"123.123.123.124"},
RecordTTL: endpoint.TTL(30),
},
{
DNSName: "hack.example.com",
RecordType: endpoint.RecordTypeCNAME,
Targets: endpoint.Targets{"bluecatnetworks.com"},
RecordTTL: endpoint.TTL(30),
},
{
DNSName: "wack.example.com",
RecordType: endpoint.RecordTypeTXT,
Targets: endpoint.Targets{"hello"},
Labels: endpoint.Labels{"owner": ""},
},
{
DNSName: "sack.example.com",
RecordType: endpoint.RecordTypeTXT,
Targets: endpoint.Targets{""},
Labels: endpoint.Labels{"owner": ""},
},
{
DNSName: "kdb.example.com",
RecordType: endpoint.RecordTypeTXT,
Targets: endpoint.Targets{"heritage=external-dns,external-dns/owner=default,external-dns/resource=service/openshift-ingress/router-default"},
Labels: endpoint.Labels{"owner": "default"},
},
},
},
}
func TestBluecatRecords(t *testing.T) {
client := mockGatewayClient{
mockBluecatZones: &[]api.BluecatZone{
createMockBluecatZone("example.com"),
},
mockBluecatTXTs: &[]api.BluecatTXTRecord{
createMockBluecatTXT("kdb.example.com", "heritage=external-dns,external-dns/owner=default,external-dns/resource=service/openshift-ingress/router-default"),
createMockBluecatTXT("wack.example.com", "hello"),
createMockBluecatTXT("sack.example.com", ""),
},
mockBluecatHosts: &[]api.BluecatHostRecord{
createMockBluecatHostRecord("example.com", "123.123.123.122", 30),
createMockBluecatHostRecord("nginx.example.com", "123.123.123.123", 30),
createMockBluecatHostRecord("whitespace.example.com", "123.123.123.124", 30),
},
mockBluecatCNAMEs: &[]api.BluecatCNAMERecord{
createMockBluecatCNAME("hack.example.com", "bluecatnetworks.com", 30),
},
}
provider := newBluecatProvider(
endpoint.NewDomainFilter([]string{"example.com"}),
provider.NewZoneIDFilter([]string{""}), false, client)
for _, ti := range tests {
actual, err := provider.Records(context.Background())
if err != nil {
t.Fatal(err)
}
validateEndpoints(t, actual, ti.Endpoints)
}
}
func TestBluecatApplyChangesCreate(t *testing.T) {
client := mockGatewayClient{
mockBluecatZones: &[]api.BluecatZone{
createMockBluecatZone("example.com"),
},
mockBluecatHosts: &[]api.BluecatHostRecord{},
mockBluecatCNAMEs: &[]api.BluecatCNAMERecord{},
mockBluecatTXTs: &[]api.BluecatTXTRecord{},
}
provider := newBluecatProvider(
endpoint.NewDomainFilter([]string{"example.com"}),
provider.NewZoneIDFilter([]string{""}), false, client)
for _, ti := range tests {
err := provider.ApplyChanges(context.Background(), &plan.Changes{Create: ti.Endpoints})
if err != nil {
t.Fatal(err)
}
actual, err := provider.Records(context.Background())
if err != nil {
t.Fatal(err)
}
validateEndpoints(t, actual, []*endpoint.Endpoint{})
}
}
func TestBluecatApplyChangesDelete(t *testing.T) {
client := mockGatewayClient{
mockBluecatZones: &[]api.BluecatZone{
createMockBluecatZone("example.com"),
},
mockBluecatHosts: &[]api.BluecatHostRecord{
createMockBluecatHostRecord("example.com", "123.123.123.122", 30),
createMockBluecatHostRecord("nginx.example.com", "123.123.123.123", 30),
createMockBluecatHostRecord("whitespace.example.com", "123.123.123.124", 30),
},
mockBluecatCNAMEs: &[]api.BluecatCNAMERecord{
createMockBluecatCNAME("hack.example.com", "bluecatnetworks.com", 30),
},
mockBluecatTXTs: &[]api.BluecatTXTRecord{
createMockBluecatTXT("kdb.example.com", "heritage=external-dns,external-dns/owner=default,external-dns/resource=service/openshift-ingress/router-default"),
createMockBluecatTXT("wack.example.com", "hello"),
createMockBluecatTXT("sack.example.com", ""),
},
}
provider := newBluecatProvider(
endpoint.NewDomainFilter([]string{"example.com"}),
provider.NewZoneIDFilter([]string{""}), false, client)
for _, ti := range tests {
err := provider.ApplyChanges(context.Background(), &plan.Changes{Delete: ti.Endpoints})
if err != nil {
t.Fatal(err)
}
actual, err := provider.Records(context.Background())
if err != nil {
t.Fatal(err)
}
validateEndpoints(t, actual, []*endpoint.Endpoint{})
}
}
func TestBluecatApplyChangesDeleteWithOwner(t *testing.T) {
client := mockGatewayClient{
mockBluecatZones: &[]api.BluecatZone{
createMockBluecatZone("example.com"),
},
mockBluecatHosts: &[]api.BluecatHostRecord{
createMockBluecatHostRecord("example.com", "123.123.123.122", 30),
createMockBluecatHostRecord("nginx.example.com", "123.123.123.123", 30),
createMockBluecatHostRecord("whitespace.example.com", "123.123.123.124", 30),
},
mockBluecatCNAMEs: &[]api.BluecatCNAMERecord{
createMockBluecatCNAME("hack.example.com", "bluecatnetworks.com", 30),
},
mockBluecatTXTs: &[]api.BluecatTXTRecord{
createMockBluecatTXT("kdb.example.com", "heritage=external-dns,external-dns/owner=default,external-dns/resource=service/openshift-ingress/router-default"),
createMockBluecatTXT("wack.example.com", "hello"),
createMockBluecatTXT("sack.example.com", ""),
},
}
provider := newBluecatProvider(
endpoint.NewDomainFilter([]string{"example.com"}),
provider.NewZoneIDFilter([]string{""}), false, client)
for _, ti := range tests {
for _, ep := range ti.Endpoints {
if strings.Contains(ep.Targets.String(), "external-dns") {
owner, err := extractOwnerfromTXTRecord(ep.Targets.String())
if err != nil {
t.Logf("%v", err)
} else {
t.Logf("Owner %s", owner)
}
}
}
err := provider.ApplyChanges(context.Background(), &plan.Changes{Delete: ti.Endpoints})
if err != nil {
t.Fatal(err)
}
actual, err := provider.Records(context.Background())
if err != nil {
t.Fatal(err)
}
validateEndpoints(t, actual, []*endpoint.Endpoint{})
}
}
// TODO: ensure findZone method is tested
// TODO: ensure zones method is tested
// TODO: ensure createRecords method is tested
// TODO: ensure deleteRecords method is tested
// TODO: ensure recordSet method is tested
// TODO: Figure out why recordSet.res is not being set properly
func TestBluecatRecordset(t *testing.T) {
client := mockGatewayClient{
mockBluecatZones: &[]api.BluecatZone{
createMockBluecatZone("example.com"),
},
mockBluecatHosts: &[]api.BluecatHostRecord{
createMockBluecatHostRecord("example.com", "123.123.123.122", 30),
createMockBluecatHostRecord("nginx.example.com", "123.123.123.123", 30),
createMockBluecatHostRecord("whitespace.example.com", "123.123.123.124", 30),
},
mockBluecatCNAMEs: &[]api.BluecatCNAMERecord{
createMockBluecatCNAME("hack.example.com", "bluecatnetworks.com", 30),
},
mockBluecatTXTs: &[]api.BluecatTXTRecord{
createMockBluecatTXT("abc.example.com", "hello"),
},
}
provider := newBluecatProvider(
endpoint.NewDomainFilter([]string{"example.com"}),
provider.NewZoneIDFilter([]string{""}), false, client)
// Test txt records for recordSet function
testTxtEndpoint := endpoint.NewEndpoint("abc.example.com", endpoint.RecordTypeTXT, "hello")
txtObj := api.BluecatCreateTXTRecordRequest{
AbsoluteName: testTxtEndpoint.DNSName,
Text: testTxtEndpoint.Targets[0],
}
txtRecords := []api.BluecatTXTRecord{
createMockBluecatTXT("abc.example.com", "hello"),
}
expected := bluecatRecordSet{
obj: &txtObj,
res: &txtRecords,
}
actual, err := provider.recordSet(testTxtEndpoint, true)
if err != nil {
t.Fatal(err)
}
assert.Equal(t, actual.obj, expected.obj)
assert.Equal(t, actual.res, expected.res)
// Test a records for recordSet function
testHostEndpoint := endpoint.NewEndpoint("whitespace.example.com", endpoint.RecordTypeA, "123.123.123.124")
hostObj := api.BluecatCreateHostRecordRequest{
AbsoluteName: testHostEndpoint.DNSName,
IP4Address: testHostEndpoint.Targets[0],
}
hostRecords := []api.BluecatHostRecord{
createMockBluecatHostRecord("whitespace.example.com", "123.123.123.124", 30),
}
hostExpected := bluecatRecordSet{
obj: &hostObj,
res: &hostRecords,
}
hostActual, err := provider.recordSet(testHostEndpoint, true)
if err != nil {
t.Fatal(err)
}
assert.Equal(t, hostActual.obj, hostExpected.obj)
assert.Equal(t, hostActual.res, hostExpected.res)
// Test CName records for recordSet function
testCnameEndpoint := endpoint.NewEndpoint("hack.example.com", endpoint.RecordTypeCNAME, "bluecatnetworks.com")
cnameObj := api.BluecatCreateCNAMERecordRequest{
AbsoluteName: testCnameEndpoint.DNSName,
LinkedRecord: testCnameEndpoint.Targets[0],
}
cnameRecords := []api.BluecatCNAMERecord{
createMockBluecatCNAME("hack.example.com", "bluecatnetworks.com", 30),
}
cnameExpected := bluecatRecordSet{
obj: &cnameObj,
res: &cnameRecords,
}
cnameActual, err := provider.recordSet(testCnameEndpoint, true)
if err != nil {
t.Fatal(err)
}
assert.Equal(t, cnameActual.obj, cnameExpected.obj)
assert.Equal(t, cnameActual.res, cnameExpected.res)
}
func validateEndpoints(t *testing.T, actual, expected []*endpoint.Endpoint) {
assert.True(t, testutils.SameEndpoints(actual, expected), "actual and expected endpoints don't match. %s:%s", actual, expected)
}

583
provider/bluecat/gateway/api.go
View File

@ -1,583 +0,0 @@
/*
Copyright 2020 The Kubernetes Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
// TODO: add logging
// TODO: add timeouts
package api
import (
"bytes"
"crypto/tls"
"encoding/json"
"io"
"net/http"
"os"
"strings"
"github.com/pkg/errors"
log "github.com/sirupsen/logrus"
)
// TODO: Ensure DNS Deploy Type Defaults to no-deploy instead of ""
type BluecatConfig struct {
GatewayHost string `json:"gatewayHost"`
GatewayUsername string `json:"gatewayUsername,omitempty"`
GatewayPassword string `json:"gatewayPassword,omitempty"`
DNSConfiguration string `json:"dnsConfiguration"`
DNSServerName string `json:"dnsServerName"`
DNSDeployType string `json:"dnsDeployType"`
View string `json:"dnsView"`
RootZone string `json:"rootZone"`
SkipTLSVerify bool `json:"skipTLSVerify"`
}
type GatewayClient interface {
GetBluecatZones(zoneName string) ([]BluecatZone, error)
GetHostRecords(zone string, records *[]BluecatHostRecord) error
GetCNAMERecords(zone string, records *[]BluecatCNAMERecord) error
GetHostRecord(name string, record *BluecatHostRecord) error
GetCNAMERecord(name string, record *BluecatCNAMERecord) error
CreateHostRecord(zone string, req *BluecatCreateHostRecordRequest) error
CreateCNAMERecord(zone string, req *BluecatCreateCNAMERecordRequest) error
DeleteHostRecord(name string, zone string) (err error)
DeleteCNAMERecord(name string, zone string) (err error)
GetTXTRecords(zone string, records *[]BluecatTXTRecord) error
GetTXTRecord(name string, record *BluecatTXTRecord) error
CreateTXTRecord(zone string, req *BluecatCreateTXTRecordRequest) error
DeleteTXTRecord(name string, zone string) error
ServerFullDeploy() error
}
// GatewayClientConfig defines the configuration for a Bluecat Gateway Client
type GatewayClientConfig struct {
Cookie http.Cookie
Token string
Host string
DNSConfiguration string
View string
RootZone string
DNSServerName string
SkipTLSVerify bool
}
// BluecatZone defines a zone to hold records
type BluecatZone struct {
ID int `json:"id"`
Name string `json:"name"`
Properties string `json:"properties"`
Type string `json:"type"`
}
// BluecatHostRecord defines dns Host record
type BluecatHostRecord struct {
ID int `json:"id"`
Name string `json:"name"`
Properties string `json:"properties"`
Type string `json:"type"`
}
// BluecatCNAMERecord defines dns CNAME record
type BluecatCNAMERecord struct {
ID int `json:"id"`
Name string `json:"name"`
Properties string `json:"properties"`
Type string `json:"type"`
}
// BluecatTXTRecord defines dns TXT record
type BluecatTXTRecord struct {
ID int `json:"id"`
Name string `json:"name"`
Properties string `json:"properties"`
}
type BluecatCreateHostRecordRequest struct {
AbsoluteName string `json:"absolute_name"`
IP4Address string `json:"ip4_address"`
TTL int `json:"ttl"`
Properties string `json:"properties"`
}
type BluecatCreateCNAMERecordRequest struct {
AbsoluteName string `json:"absolute_name"`
LinkedRecord string `json:"linked_record"`
TTL int `json:"ttl"`
Properties string `json:"properties"`
}
type BluecatCreateTXTRecordRequest struct {
AbsoluteName string `json:"absolute_name"`
Text string `json:"txt"`
}
type BluecatServerFullDeployRequest struct {
ServerName string `json:"server_name"`
}
// NewGatewayClient creates and returns a new Bluecat gateway client
func NewGatewayClientConfig(cookie http.Cookie, token, gatewayHost, dnsConfiguration, view, rootZone, dnsServerName string, skipTLSVerify bool) GatewayClientConfig {
// TODO: do not handle defaulting here
//
// Right now the Bluecat gateway doesn't seem to have a way to get the root zone from the API. If the user
// doesn't provide one via the config file we'll assume it's 'com'
if rootZone == "" {
rootZone = "com"
}
return GatewayClientConfig{
Cookie: cookie,
Token: token,
Host: gatewayHost,
DNSConfiguration: dnsConfiguration,
DNSServerName: dnsServerName,
View: view,
RootZone: rootZone,
SkipTLSVerify: skipTLSVerify,
}
}
// GetBluecatGatewayToken retrieves a Bluecat Gateway API token.
func GetBluecatGatewayToken(cfg BluecatConfig) (string, http.Cookie, error) {
var username string
if cfg.GatewayUsername != "" {
username = cfg.GatewayUsername
}
if v, ok := os.LookupEnv("BLUECAT_USERNAME"); ok {
username = v
}
var password string
if cfg.GatewayPassword != "" {
password = cfg.GatewayPassword
}
if v, ok := os.LookupEnv("BLUECAT_PASSWORD"); ok {
password = v
}
body, err := json.Marshal(map[string]string{
"username": username,
"password": password,
})
if err != nil {
return "", http.Cookie{}, errors.Wrap(err, "could not unmarshal credentials for bluecat gateway config")
}
url := cfg.GatewayHost + "/rest_login"
response, err := executeHTTPRequest(cfg.SkipTLSVerify, http.MethodPost, url, "", bytes.NewBuffer(body), http.Cookie{})
if err != nil {
return "", http.Cookie{}, errors.Wrap(err, "error obtaining API token from bluecat gateway")
}
defer response.Body.Close()
responseBody, err := io.ReadAll(response.Body)
if err != nil {
return "", http.Cookie{}, errors.Wrap(err, "failed to read login response from bluecat gateway")
}
if response.StatusCode != http.StatusOK {
return "", http.Cookie{}, errors.Errorf("got HTTP response code %v, detailed message: %v", response.StatusCode, string(responseBody))
}
jsonResponse := map[string]string{}
err = json.Unmarshal(responseBody, &jsonResponse)
if err != nil {
return "", http.Cookie{}, errors.Wrap(err, "error unmarshaling json response (auth) from bluecat gateway")
}
// Example response: {"access_token": "BAMAuthToken: abc123"}
// We only care about the actual token string - i.e. abc123
// The gateway also creates a cookie as part of the response. This seems to be the actual auth mechanism, at least
// for now.
return strings.Split(jsonResponse["access_token"], " ")[1], *response.Cookies()[0], nil
}
func (c GatewayClientConfig) GetBluecatZones(zoneName string) ([]BluecatZone, error) {
zonePath := expandZone(zoneName)
url := c.Host + "/api/v1/configurations/" + c.DNSConfiguration + "/views/" + c.View + "/" + zonePath
response, err := executeHTTPRequest(c.SkipTLSVerify, http.MethodGet, url, c.Token, nil, c.Cookie)
if err != nil {
return nil, errors.Wrapf(err, "error requesting zones from gateway: %v, %v", url, zoneName)
}
defer response.Body.Close()
if response.StatusCode != http.StatusOK {
return nil, errors.Errorf("received http %v requesting zones from gateway in zone %v", response.StatusCode, zoneName)
}
zones := []BluecatZone{}
json.NewDecoder(response.Body).Decode(&zones)
// Bluecat Gateway only returns subzones one level deeper than the provided zone
// so this recursion is needed to traverse subzones until none are returned
for _, zone := range zones {
zoneProps := SplitProperties(zone.Properties)
subZones, err := c.GetBluecatZones(zoneProps["absoluteName"])
if err != nil {
return nil, errors.Wrapf(err, "error retrieving subzones from gateway: %v", zoneName)
}
zones = append(zones, subZones...)
}
return zones, nil
}
func (c GatewayClientConfig) GetHostRecords(zone string, records *[]BluecatHostRecord) error {
zonePath := expandZone(zone)
// Remove the trailing 'zones/'
zonePath = strings.TrimSuffix(zonePath, "zones/")
url := c.Host + "/api/v1/configurations/" + c.DNSConfiguration + "/views/" + c.View + "/" + zonePath + "host_records/"
response, err := executeHTTPRequest(c.SkipTLSVerify, http.MethodGet, url, c.Token, nil, c.Cookie)
if err != nil {
return errors.Wrapf(err, "error requesting host records from gateway in zone %v", zone)
}
defer response.Body.Close()
if response.StatusCode != http.StatusOK {
return errors.Errorf("received http %v requesting host records from gateway in zone %v", response.StatusCode, zone)
}
json.NewDecoder(response.Body).Decode(records)
log.Debugf("Get Host Records Response: %v", records)
return nil
}
func (c GatewayClientConfig) GetCNAMERecords(zone string, records *[]BluecatCNAMERecord) error {
zonePath := expandZone(zone)
// Remove the trailing 'zones/'
zonePath = strings.TrimSuffix(zonePath, "zones/")
url := c.Host + "/api/v1/configurations/" + c.DNSConfiguration + "/views/" + c.View + "/" + zonePath + "cname_records/"
response, err := executeHTTPRequest(c.SkipTLSVerify, http.MethodGet, url, c.Token, nil, c.Cookie)
if err != nil {
return errors.Wrapf(err, "error retrieving cname records from gateway in zone %v", zone)
}
defer response.Body.Close()
if response.StatusCode != http.StatusOK {
return errors.Errorf("received http %v requesting cname records from gateway in zone %v", response.StatusCode, zone)
}
json.NewDecoder(response.Body).Decode(records)
log.Debugf("Get CName Records Response: %v", records)
return nil
}
func (c GatewayClientConfig) GetTXTRecords(zone string, records *[]BluecatTXTRecord) error {
zonePath := expandZone(zone)
// Remove the trailing 'zones/'
zonePath = strings.TrimSuffix(zonePath, "zones/")
url := c.Host + "/api/v1/configurations/" + c.DNSConfiguration + "/views/" + c.View + "/" + zonePath + "text_records/"
response, err := executeHTTPRequest(c.SkipTLSVerify, http.MethodGet, url, c.Token, nil, c.Cookie)
if err != nil {
return errors.Wrapf(err, "error retrieving txt records from gateway in zone %v", zone)
}
defer response.Body.Close()
if response.StatusCode != http.StatusOK {
return errors.Errorf("received http %v requesting txt records from gateway in zone %v", response.StatusCode, zone)
}
log.Debugf("Get Txt Records response: %v", response)
json.NewDecoder(response.Body).Decode(records)
log.Debugf("Get TXT Records Body: %v", records)
return nil
}
func (c GatewayClientConfig) GetHostRecord(name string, record *BluecatHostRecord) error {
url := c.Host + "/api/v1/configurations/" + c.DNSConfiguration +
"/views/" + c.View + "/" +
"host_records/" + name + "/"
response, err := executeHTTPRequest(c.SkipTLSVerify, http.MethodGet, url, c.Token, nil, c.Cookie)
if err != nil {
return errors.Wrapf(err, "error retrieving host record %v from gateway", name)
}
defer response.Body.Close()
if response.StatusCode != http.StatusOK {
return errors.Errorf("received http %v while retrieving host record %v from gateway", response.StatusCode, name)
}
json.NewDecoder(response.Body).Decode(record)
log.Debugf("Get Host Record Response: %v", record)
return nil
}
func (c GatewayClientConfig) GetCNAMERecord(name string, record *BluecatCNAMERecord) error {
url := c.Host + "/api/v1/configurations/" + c.DNSConfiguration +
"/views/" + c.View + "/" +
"cname_records/" + name + "/"
response, err := executeHTTPRequest(c.SkipTLSVerify, http.MethodGet, url, c.Token, nil, c.Cookie)
if err != nil {
return errors.Wrapf(err, "error retrieving cname record %v from gateway", name)
}
defer response.Body.Close()
if response.StatusCode != http.StatusOK {
return errors.Errorf("received http %v while retrieving cname record %v from gateway", response.StatusCode, name)
}
json.NewDecoder(response.Body).Decode(record)
log.Debugf("Get CName Record Response: %v", record)
return nil
}
func (c GatewayClientConfig) GetTXTRecord(name string, record *BluecatTXTRecord) error {
url := c.Host + "/api/v1/configurations/" + c.DNSConfiguration +
"/views/" + c.View + "/" +
"text_records/" + name + "/"
response, err := executeHTTPRequest(c.SkipTLSVerify, http.MethodGet, url, c.Token, nil, c.Cookie)
if err != nil {
return errors.Wrapf(err, "error retrieving record %v from gateway", name)
}
defer response.Body.Close()
if response.StatusCode != http.StatusOK {
return errors.Errorf("received http %v while retrieving txt record %v from gateway", response.StatusCode, name)
}
json.NewDecoder(response.Body).Decode(record)
log.Debugf("Get TXT Record Response: %v", record)
return nil
}
func (c GatewayClientConfig) CreateHostRecord(zone string, req *BluecatCreateHostRecordRequest) error {
zonePath := expandZone(zone)
// Remove the trailing 'zones/'
zonePath = strings.TrimSuffix(zonePath, "zones/")
url := c.Host + "/api/v1/configurations/" + c.DNSConfiguration + "/views/" + c.View + "/" + zonePath + "host_records/"
body, err := json.Marshal(req)
if err != nil {
return errors.Wrap(err, "could not marshal body for create host record")
}
response, err := executeHTTPRequest(c.SkipTLSVerify, http.MethodPost, url, c.Token, bytes.NewBuffer(body), c.Cookie)
if err != nil {
return errors.Wrapf(err, "error creating host record %v in gateway", req.AbsoluteName)
}
defer response.Body.Close()
if response.StatusCode != http.StatusCreated {
return errors.Errorf("received http %v while creating host record %v in gateway", response.StatusCode, req.AbsoluteName)
}
return nil
}
func (c GatewayClientConfig) CreateCNAMERecord(zone string, req *BluecatCreateCNAMERecordRequest) error {
zonePath := expandZone(zone)
// Remove the trailing 'zones/'
zonePath = strings.TrimSuffix(zonePath, "zones/")
url := c.Host + "/api/v1/configurations/" + c.DNSConfiguration + "/views/" + c.View + "/" + zonePath + "cname_records/"
body, err := json.Marshal(req)
if err != nil {
return errors.Wrap(err, "could not marshal body for create cname record")
}
response, err := executeHTTPRequest(c.SkipTLSVerify, http.MethodPost, url, c.Token, bytes.NewBuffer(body), c.Cookie)
if err != nil {
return errors.Wrapf(err, "error creating cname record %v in gateway", req.AbsoluteName)
}
defer response.Body.Close()
if response.StatusCode != http.StatusCreated {
return errors.Errorf("received http %v while creating cname record %v to alias %v in gateway", response.StatusCode, req.AbsoluteName, req.LinkedRecord)
}
return nil
}
func (c GatewayClientConfig) CreateTXTRecord(zone string, req *BluecatCreateTXTRecordRequest) error {
zonePath := expandZone(zone)
// Remove the trailing 'zones/'
zonePath = strings.TrimSuffix(zonePath, "zones/")
url := c.Host + "/api/v1/configurations/" + c.DNSConfiguration + "/views/" + c.View + "/" + zonePath + "text_records/"
body, err := json.Marshal(req)
if err != nil {
return errors.Wrap(err, "could not marshal body for create txt record")
}
response, err := executeHTTPRequest(c.SkipTLSVerify, http.MethodPost, url, c.Token, bytes.NewBuffer(body), c.Cookie)
if err != nil {
return errors.Wrapf(err, "error creating txt record %v in gateway", req.AbsoluteName)
}
defer response.Body.Close()
if response.StatusCode != http.StatusCreated {
return errors.Errorf("received http %v while creating txt record %v in gateway", response.StatusCode, req.AbsoluteName)
}
return nil
}
func (c GatewayClientConfig) DeleteHostRecord(name string, zone string) (err error) {
url := c.Host + "/api/v1/configurations/" + c.DNSConfiguration +
"/views/" + c.View + "/" +
"host_records/" + name + "." + zone + "/"
response, err := executeHTTPRequest(c.SkipTLSVerify, http.MethodDelete, url, c.Token, nil, c.Cookie)
if err != nil {
return errors.Wrapf(err, "error deleting host record %v from gateway", name)
}
if response.StatusCode != http.StatusNoContent {
return errors.Errorf("received http %v while deleting host record %v from gateway", response.StatusCode, name)
}
return nil
}
func (c GatewayClientConfig) DeleteCNAMERecord(name string, zone string) (err error) {
url := c.Host + "/api/v1/configurations/" + c.DNSConfiguration +
"/views/" + c.View + "/" +
"cname_records/" + name + "." + zone + "/"
response, err := executeHTTPRequest(c.SkipTLSVerify, http.MethodDelete, url, c.Token, nil, c.Cookie)
if err != nil {
return errors.Wrapf(err, "error deleting cname record %v from gateway", name)
}
if response.StatusCode != http.StatusNoContent {
return errors.Errorf("received http %v while deleting cname record %v from gateway", response.StatusCode, name)
}
return nil
}
func (c GatewayClientConfig) DeleteTXTRecord(name string, zone string) error {
url := c.Host + "/api/v1/configurations/" + c.DNSConfiguration +
"/views/" + c.View + "/" +
"text_records/" + name + "." + zone + "/"
response, err := executeHTTPRequest(c.SkipTLSVerify, http.MethodDelete, url, c.Token, nil, c.Cookie)
if err != nil {
return errors.Wrapf(err, "error deleting txt record %v from gateway", name)
}
if response.StatusCode != http.StatusNoContent {
return errors.Errorf("received http %v while deleting txt record %v from gateway", response.StatusCode, name)
}
return nil
}
func (c GatewayClientConfig) ServerFullDeploy() error {
log.Infof("Executing full deploy on server %s", c.DNSServerName)
url := c.Host + "/api/v1/configurations/" + c.DNSConfiguration + "/server/full_deploy/"
requestBody := BluecatServerFullDeployRequest{
ServerName: c.DNSServerName,
}
body, err := json.Marshal(requestBody)
if err != nil {
return errors.Wrap(err, "could not marshal body for server full deploy")
}
response, err := executeHTTPRequest(c.SkipTLSVerify, http.MethodPost, url, c.Token, bytes.NewBuffer(body), c.Cookie)
if err != nil {
return errors.Wrap(err, "error executing full deploy")
}
if response.StatusCode != http.StatusCreated {
responseBody, err := io.ReadAll(response.Body)
if err != nil {
return errors.Wrap(err, "failed to read full deploy response body")
}
return errors.Errorf("got HTTP response code %v, detailed message: %v", response.StatusCode, string(responseBody))
}
return nil
}
// SplitProperties is a helper function to break a '|' separated string into key/value pairs
// i.e. "foo=bar|baz=mop"
func SplitProperties(props string) map[string]string {
propMap := make(map[string]string)
// remove trailing | character before we split
props = strings.TrimSuffix(props, "|")
splits := strings.Split(props, "|")
for _, pair := range splits {
items := strings.Split(pair, "=")
propMap[items[0]] = items[1]
}
return propMap
}
// IsValidDNSDeployType validates the deployment type provided by a users configuration is supported by the Bluecat Provider.
func IsValidDNSDeployType(deployType string) bool {
validDNSDeployTypes := []string{"no-deploy", "full-deploy"}
for _, t := range validDNSDeployTypes {
if t == deployType {
return true
}
}
return false
}
// expandZone takes an absolute domain name such as 'example.com' and returns a zone hierarchy used by Bluecat Gateway,
// such as '/zones/com/zones/example/zones/'
func expandZone(zone string) string {
ze := "zones/"
parts := strings.Split(zone, ".")
if len(parts) > 1 {
last := len(parts) - 1
for i := range parts {
ze = ze + parts[last-i] + "/zones/"
}
} else {
ze = ze + zone + "/zones/"
}
return ze
}
func executeHTTPRequest(skipTLSVerify bool, method, url, token string, body io.Reader, cookie http.Cookie) (*http.Response, error) {
httpClient := &http.Client{
Transport: &http.Transport{
Proxy: http.ProxyFromEnvironment,
TLSClientConfig: &tls.Config{
InsecureSkipVerify: skipTLSVerify,
},
},
}
request, err := http.NewRequest(method, url, body)
if err != nil {
return nil, err
}
if request.Method == http.MethodPost {
request.Header.Add("Content-Type", "application/json")
}
request.Header.Add("Accept", "application/json")
if token != "" {
request.Header.Add("Authorization", "Basic "+token)
}
request.AddCookie(&cookie)
return httpClient.Do(request)
}

Some files were not shown because too many files have changed in this diff Show More