ExternalDNS 0.1: Kubernetes Services Publish Themselves

Introduction

On March 27, 2017, the Kubernetes SIG-Network team released ExternalDNS 0.1, a controller that synchronizes Kubernetes Services and Ingresses directly into managed DNS providers. Instead of scripting kubectl plus provider-specific CLIs, platform teams can now declaratively publish hostnames alongside their manifests.

Core Capabilities

Sources and Endpoints

• Watches Service, Endpoints, and Ingress resources via the Kubernetes API.
• Derives fully qualified names from annotations such as external-dns.alpha.kubernetes.io/hostname.
• Handles multiple records (A, AAAA, TXT) per object and keeps them consistent with cluster state.

Provider Integrations

• Ships adapters for Amazon Route53, Google Cloud DNS, Azure DNS, and DNSimple.
• Abstracts provider credentials via flags, keeping secrets out of manifests.
• Implements idempotent “plan/apply” logic to guard against record drift or rate limits.

Safety Controls

• Supports dry-run mode to preview DNS changes before execution.
• Restricts zone management with the --domain-filter flag, preventing accidental edits outside approved suffixes.
• Uses leader election and RBAC-ready manifests for production clusters.

Getting Started

1. Grant ExternalDNS service account access to list/watch Services and Ingresses.

2. Deploy the controller with your chosen provider credentials, for example:

   kubectl apply -f kubernetes-sigs/external-dns/v0.1.0/docs/tutorials/aws.yaml
   

3. Annotate a Service with:

   metadata:
     annotations:
       external-dns.alpha.kubernetes.io/hostname: api.example.com.
   

4. Watch ExternalDNS plan and apply the matching Route53 record set.

Practical Gotchas (DNS Is a Shared Surface)

• In shared DNS zones, make record ownership explicit (e.g., using TXT records/ownership markers) so multiple controllers don’t “fight” over the same hostname.
• Start with a narrow --domain-filter and expand gradually; most early mishaps are accidental writes to the wrong zone.
• If you publish both Service and Ingress hostnames, standardize annotations so you don’t accidentally create duplicate records.
• Treat low TTLs as an operational trade-off: faster failover, but higher query volume and provider rate-limit exposure.

Ecosystem Fit

• Complements Traefik 1.4 and other ingress controllers by keeping DNS in sync with load-balancer endpoints.
• Works alongside Kubernetes 1.6 RBAC to scope permissions tightly.
• Simplifies multi-cluster routing strategies when paired with Istio 0.1 gateways.

Summary

ExternalDNS 0.1 established the pattern for treating DNS like any other Kubernetes resource—driven by manifest annotations, reconciled by controllers, and auditable through Git history.