mirror of
https://github.com/kubernetes-sigs/external-dns.git
synced 2025-08-07 01:56:57 +02:00
c0a9eed521
* feat(source/node): Make exclusion of unschedulable Nodes configurable This fixes a behavioral regression introduced in #4761, where nodes that were previously added to DNS are removed when they are considered unschedulable, for example due to automated maintenance tasks. This change will introduce a new flag called `exclude-unschedulable`, which defaults to `true` in order to keep in line with the current behavior. However, it would also be reasonable to restore the initial behavior before * Allow testing for expected log entries in testNodeSourceEndpoints This commit adds the required logic to be able to test for the existence (and absence) of certain log messages in testNodeSourceEndpoints. As an example, this is implemented for the tests around excludeUnschedulable. A side effect of using LogsToBuffer is that tests can't run in parallel due to the log buffer being shared across all parallel test cases. As such, these specific tests are now executed one after another. * Ensure logging is only hooked for tests that require it * Document new exclude-unschedulable flag for nodes source
148 lines
4.9 KiB
Markdown
148 lines
4.9 KiB
Markdown
# Cluster Nodes as Source
|
|
|
|
This tutorial describes how to configure ExternalDNS to use the cluster nodes as source.
|
|
Using nodes (`--source=node`) as source is possible to synchronize a DNS zone with the nodes of a cluster.
|
|
|
|
The node source adds an `A` record per each node `externalIP` (if not found, any IPv4 `internalIP` is used instead).
|
|
It also adds an `AAAA` record per each node IPv6 `internalIP`. Refer to the [IPv6 Behavior](#ipv6-behavior) section for more details.
|
|
The TTL of the records can be set with the `external-dns.alpha.kubernetes.io/ttl` node annotation.
|
|
|
|
Nodes marked as **Unschedulable** as per [core/v1/NodeSpec](https://pkg.go.dev/k8s.io/api@v0.31.1/core/v1#NodeSpec) are excluded by default.
|
|
As such, no DNS records are created for Unhealthy, NotReady or SchedulingDisabled (cordon) nodes (and existing ones are removed).
|
|
In case you want to override the default, for example if you manage per-host DNS records via ExternalDNS, you can specify `--no-exclude-unschedulable` to always expose nodes no matter their status.
|
|
|
|
## IPv6 Behavior
|
|
|
|
By default, ExternalDNS exposes the IPv6 `InternalIP` of the nodes. To prevent this, you can use the `--no-expose-internal-ipv6` flag.
|
|
**The default behavior will change in the next minor release.** ExternalDNS will no longer expose the IPv6 `InternalIP` addresses by default.
|
|
You can still explicitly expose the internal ipv6 addresses by using the `--expose-internal-ipv6` flag, if needed.
|
|
|
|
### Example spec (without exposing IPv6 `InternalIP` addresses)
|
|
|
|
```yaml
|
|
spec:
|
|
serviceAccountName: external-dns
|
|
containers:
|
|
- name: external-dns
|
|
image: registry.k8s.io/external-dns/external-dns:v0.16.1 # update this to the desired external-dns version
|
|
args:
|
|
- --source=node # will use nodes as source
|
|
- --provider=aws
|
|
- --zone-name-filter=external-dns-test.my-org.com # will make ExternalDNS see only the hosted zones matching provided domain, omit to process all available hosted zones
|
|
- --domain-filter=external-dns-test.my-org.com
|
|
- --aws-zone-type=public
|
|
- --registry=txt
|
|
- --fqdn-template={{.Name}}.external-dns-test.my-org.com
|
|
- --txt-owner-id=my-identifier
|
|
- --policy=sync
|
|
- --log-level=debug
|
|
- --no-expose-internal-ipv6
|
|
```
|
|
|
|
## Manifest (for cluster without RBAC enabled)
|
|
|
|
```yaml
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: external-dns
|
|
spec:
|
|
strategy:
|
|
type: Recreate
|
|
selector:
|
|
matchLabels:
|
|
app: external-dns
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: external-dns
|
|
spec:
|
|
serviceAccountName: external-dns
|
|
containers:
|
|
- name: external-dns
|
|
image: registry.k8s.io/external-dns/external-dns:v0.16.1
|
|
args:
|
|
- --source=node # will use nodes as source
|
|
- --provider=aws
|
|
- --zone-name-filter=external-dns-test.my-org.com # will make ExternalDNS see only the hosted zones matching provided domain, omit to process all available hosted zones
|
|
- --domain-filter=external-dns-test.my-org.com
|
|
- --aws-zone-type=public
|
|
- --registry=txt
|
|
- --fqdn-template={{.Name}}.external-dns-test.my-org.com
|
|
- --txt-owner-id=my-identifier
|
|
- --policy=sync
|
|
- --log-level=debug
|
|
```
|
|
|
|
## Manifest (for cluster with RBAC enabled)
|
|
|
|
```yaml
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: external-dns
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: external-dns
|
|
rules:
|
|
- apiGroups: ["route.openshift.io"]
|
|
resources: ["routes"]
|
|
verbs: ["get", "watch", "list"]
|
|
- apiGroups: [""]
|
|
resources: ["services","endpoints","pods"]
|
|
verbs: ["get","watch","list"]
|
|
- apiGroups: ["extensions","networking.k8s.io"]
|
|
resources: ["ingresses"]
|
|
verbs: ["get","watch","list"]
|
|
- apiGroups: [""]
|
|
resources: ["nodes"]
|
|
verbs: ["get", "watch", "list"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: external-dns-viewer
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: external-dns
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: external-dns
|
|
namespace: external-dns
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: external-dns
|
|
spec:
|
|
strategy:
|
|
type: Recreate
|
|
selector:
|
|
matchLabels:
|
|
app: external-dns
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: external-dns
|
|
spec:
|
|
serviceAccountName: external-dns
|
|
containers:
|
|
- name: external-dns
|
|
image: registry.k8s.io/external-dns/external-dns:v0.16.1
|
|
args:
|
|
- --source=node # will use nodes as source
|
|
- --provider=aws
|
|
- --zone-name-filter=external-dns-test.my-org.com # will make ExternalDNS see only the hosted zones matching provided domain, omit to process all available hosted zones
|
|
- --domain-filter=external-dns-test.my-org.com
|
|
- --aws-zone-type=public
|
|
- --registry=txt
|
|
- --fqdn-template={{.Name}}.external-dns-test.my-org.com
|
|
- --txt-owner-id=my-identifier
|
|
- --policy=sync
|
|
- --log-level=debug
|
|
```
|