Back to Charts

external-dns

stable/external-dns/README.md

latest34.3 KB
Original Source

external-dns

ExternalDNS is a Kubernetes addon that configures public DNS servers with information about exposed Kubernetes services to make them discoverable.

This Helm chart is deprecated

Given the stable deprecation timeline, the Bitnami maintained ExternalDNS Helm chart is now located at bitnami/charts.

The Bitnami repository is already included in the Hubs and we will continue providing the same cadence of updates, support, etc that we've been keeping here these years. Installation instructions are very similar, just adding the bitnami repo and using it during the installation (bitnami/<chart> instead of stable/<chart>)

bash
$ helm repo add bitnami https://charts.bitnami.com/bitnami
$ helm install my-release bitnami/<chart>           # Helm 3
$ helm install --name my-release bitnami/<chart>    # Helm 2

To update an exisiting stable deployment with a chart hosted in the bitnami repository you can execute

bash
$ helm repo add bitnami https://charts.bitnami.com/bitnami
$ helm upgrade my-release bitnami/<chart>

Issues and PRs related to the chart itself will be redirected to bitnami/charts GitHub repository. In the same way, we'll be happy to answer questions related to this migration process in this issue created as a common place for discussion.

TL;DR;

console
$ helm install my-release stable/external-dns

Introduction

This chart bootstraps a ExternalDNS deployment on a Kubernetes cluster using the Helm package manager.

Bitnami charts can be used with Kubeapps for deployment and management of Helm Charts in clusters. This chart has been tested to work with NGINX Ingress, cert-manager, fluentd and Prometheus on top of the BKPR.

Prerequisites

  • Kubernetes 1.12+
  • Helm 2.11+ or Helm 3.0-beta3+

Installing the Chart

To install the chart with the release name my-release:

bash
$ helm install my-release stable/external-dns

The command deploys ExternalDNS on the Kubernetes cluster in the default configuration. The Parameters section lists the parameters that can be configured during installation.

Tip: List all releases using helm list

Uninstalling the Chart

To uninstall/delete the my-release deployment:

console
$ helm delete my-release

The command removes all the Kubernetes components associated with the chart and deletes the release.

Parameters

The following table lists the configurable parameters of the external-dns chart and their default values.

ParameterDescriptionDefault
global.imageRegistryGlobal Docker image registrynil
global.imagePullSecretsGlobal Docker registry secret names as an array[] (does not add image pull secrets to deployed pods)
image.registryExternalDNS image registrydocker.io
image.repositoryExternalDNS Image namebitnami/external-dns
image.tagExternalDNS Image tag{TAG_NAME}
image.pullPolicyExternalDNS image pull policyIfNotPresent
image.pullSecretsSpecify docker-registry secret names as an array[] (does not add image pull secrets to deployed pods)
nameOverrideString to partially override external-dns.fullname template with a string (will prepend the release name)nil
fullnameOverrideString to fully override external-dns.fullname template with a stringnil
sourcesK8s resources type to be observed for new DNS entries by ExternalDNS[service, ingress]
providerDNS provider where the DNS records will be created (mandatory) (options: aws, azure, google, ...)aws
namespaceLimit sources of endpoints to a specific namespace (default: all namespaces)""
fqdnTemplatesTemplated strings that are used to generate DNS names from sources that don't define a hostname themselves[]
combineFQDNAnnotationCombine FQDN template and annotations instead of overwritingfalse
ignoreHostnameAnnotationIgnore hostname annotation when generating DNS names, valid only when fqdn-template is setfalse
publishInternalServicesWhether to publish DNS records for ClusterIP services or notfalse
publishHostIPAllow external-dns to publish host-ip for headless servicesfalse
serviceTypeFilterThe service types to take care about (default: all, options: ClusterIP, NodePort, LoadBalancer, ExternalName)[]
aws.credentials.accessKeyWhen using the AWS provider, set aws_access_key_id in the AWS credentials (optional)""
aws.credentials.secretKeyWhen using the AWS provider, set aws_secret_access_key in the AWS credentials (optional)""
aws.credentials.mountPathWhen using the AWS provider, determine mountPath for credentials secret"/.aws"
aws.regionWhen using the AWS provider, AWS_DEFAULT_REGION to set in the environment (optional)us-east-1
aws.zoneTypeWhen using the AWS provider, filter for zones of this type (optional, options: public, private)""
aws.assumeRoleArnWhen using the AWS provider, assume role by specifying --aws-assume-role to the external-dns daemon""
aws.batchChangeSizeWhen using the AWS provider, set the maximum number of changes that will be applied in each batch1000
aws.zoneTagsWhen using the AWS provider, filter for zones with these tags[]
aws.preferCNAMEWhen using the AWS provider, replaces Alias recors with CNAME (options: true, false)[]
aws.evaluateTargetHealthWhen using the AWS provider, sets the evaluate target health flag (options: true, false)[true, false]
azure.secretNameWhen using the Azure provider, set the secret containing the azure.json file""
azure.cloudWhen using the Azure provider, set the Azure Clound""
azure.resourceGroupWhen using the Azure provider, set the Azure Resource Group""
azure.tenantIdWhen using the Azure provider, set the Azure Tenant ID""
azure.subscriptionIdWhen using the Azure provider, set the Azure Subscription ID""
azure.aadClientIdWhen using the Azure provider, set the Azure AAD Client ID""
azure.aadClientSecretWhen using the Azure provider, set the Azure AAD Client Secret""
azure.useManagedIdentityExtensionWhen using the Azure provider, set if you use Azure MSI""
cloudflare.apiTokenWhen using the Cloudflare provider, CF_API_TOKEN to set (optional)""
cloudflare.apiKeyWhen using the Cloudflare provider, CF_API_KEY to set (optional)""
cloudflare.emailWhen using the Cloudflare provider, CF_API_EMAIL to set (optional)""
cloudflare.proxiedWhen using the Cloudflare provider, enable the proxy feature (DDOS protection, CDN...) (optional)true
coredns.etcdEndpointsWhen using the CoreDNS provider, set etcd backend endpoints (comma-separated list)"http://etcd-extdns:2379"
coredns.etcdTLS.enabledWhen using the CoreDNS provider, enable secure communication with etcdfalse
coredns.etcdTLS.secretNameWhen using the CoreDNS provider, specify a name of existing Secret with etcd certs and keys"etcd-client-certs"
coredns.etcdTLS.mountPathWhen using the CoreDNS provider, set destination dir to mount data from coredns.etcdTLS.secretName to"/etc/coredns/tls/etcd"
coredns.etcdTLS.caFilenameWhen using the CoreDNS provider, specify CA PEM file name from the coredns.etcdTLS.secretName"ca.crt"
coredns.etcdTLS.certFilenameWhen using the CoreDNS provider, specify cert PEM file name from the coredns.etcdTLS.secretName"cert.pem"
coredns.etcdTLS.keyFilenameWhen using the CoreDNS provider, specify private key PEM file name from the coredns.etcdTLS.secretName"key.pem"
designate.authUrlWhen using the Designate provider, specify the OpenStack authentication Url. (optional)none
designate.customCA.enabledWhen using the Designate provider, enable a custom CA (optional)false
designate.customCA.contentWhen using the Designate provider, set the content of the custom CA""
designate.customCA.mountPathWhen using the Designate provider, set the mountPath in which to mount the custom CA configuration"/config/designate"
designate.customCA.filenameWhen using the Designate provider, set the custom CA configuration filename"designate-ca.pem"
designate.customCAHostPathWhen using the Designate provider, use a CA file already on the host to validate Openstack APIs. This conflicts with designate.customCA.enablednone
designate.passwordWhen using the Designate provider, specify the OpenStack authentication password. (optional)none
`designate.projectNameWhen using the Designate provider, specify the OpenStack project name. (optional)none
`designate.regionNameWhen using the Designate provider, specify the OpenStack region name. (optional)none
designate.userDomainNameWhen using the Designate provider, specify the OpenStack user domain name. (optional)none
designate.usernameWhen using the Designate provider, specify the OpenStack authentication username. (optional)none
digitalocean.apiTokenWhen using the DigitalOcean provider, DO_TOKEN to set (optional)""
google.projectWhen using the Google provider, specify the Google project (required when provider=google)""
google.serviceAccountSecretWhen using the Google provider, specify the existing secret which contains credentials.json (optional)""
google.serviceAccountSecretKeyWhen using the Google provider with an existing secret, specify the key name (optional)"credentials.json"
google.serviceAccountKeyWhen using the Google provider, specify the service account key JSON file. (required when google.serviceAccountSecret is not provided. In this case a new secret will be created holding this service account""
infoblox.gridHostWhen using the Infoblox provider, specify the Infoblox Grid host (required when provider=infoblox)""
infoblox.wapiUsernameWhen using the Infoblox provider, specify the Infoblox WAPI username"admin"
infoblox.wapiPasswordWhen using the Infoblox provider, specify the Infoblox WAPI password (required when provider=infoblox)""
infoblox.domainFilterWhen using the Infoblox provider, specify the domain (optional)""
infoblox.noSslVerifyWhen using the Infoblox provider, disable SSL verification (optional)false
infoblox.wapiPortWhen using the Infoblox provider, specify the Infoblox WAPI port (optional)""
infoblox.wapiVersionWhen using the Infoblox provider, specify the Infoblox WAPI version (optional)""
infoblox.wapiConnectionPoolSizeWhen using the Infoblox provider, specify the Infoblox WAPI request connection pool size (optional)""
infoblox.wapiHttpTimeoutWhen using the Infoblox provider, specify the Infoblox WAPI request timeout in seconds (optional)""
rfc2136.hostWhen using the rfc2136 provider, specify the RFC2136 host (required when provider=rfc2136)""
rfc2136.portWhen using the rfc2136 provider, specify the RFC2136 port (optional)53
rfc2136.zoneWhen using the rfc2136 provider, specify the zone (required when provider=rfc2136)""
rfc2136.tsigSecretWhen using the rfc2136 provider, specify the tsig secret to enable security (optional)""
rfc2136.tsigKeynameWhen using the rfc2136 provider, specify the tsig keyname to enable security (optional)"externaldns-key"
rfc2136.tsigSecretAlgWhen using the rfc2136 provider, specify the tsig secret to enable security (optional)"hmac-sha256"
rfc2136.tsigAxfrWhen using the rfc2136 provider, enable AFXR to enable security (optional)true
pdns.apiUrlWhen using the PowerDNS provider, specify the API URL of the server.""
pdns.apiPortWhen using the PowerDNS provider, specify the API port of the server.8081
pdns.apiKeyWhen using the PowerDNS provider, specify the API key of the server.""
transip.accountWhen using the TransIP provider, specify the account name.""
transip.apiKeyWhen using the TransIP provider, specify the API key to use.""
annotationFilterFilter sources managed by external-dns via annotation using label selector (optional)""
domainFiltersLimit possible target zones by domain suffixes (optional)[]
zoneIdFiltersLimit possible target zones by zone id (optional)[]
crd.createInstall and use the integrated DNSEndpoint CRDfalse
crd.apiversionSets the API version for the CRD to watch""
crd.kindSets the kind for the CRD to watch""
dryRunWhen enabled, prints DNS record changes rather than actually performing them (optional)false
logLevelVerbosity of the logs (options: panic, debug, info, warn, error, fatal)info
logFormatWhich format to output logs in (options: text, json)text
intervalInterval update period to use1m
triggerLoopOnEventWhen enabled, triggers run loop on create/update/delete events in addition to regular interval (optional)false
istioIngressGatewaysThe fully-qualified name of the Istio ingress gateway services .""
policyModify how DNS records are sychronized between sources and providers (options: sync, upsert-only )upsert-only
registryRegistry method to use (options: txt, noop)txt
txtOwnerIdWhen using the TXT registry, a name that identifies this instance of ExternalDNS (optional)"default"
txtPrefixWhen using the TXT registry, a prefix for ownership records that avoids collision with CNAME entries (optional)""
extraArgsExtra arguments to be passed to external-dns{}
extraEnvExtra environment variables to be passed to external-dns[]
replicasDesired number of ExternalDNS replicas1
affinityAffinity for pod assignment (this value is evaluated as a template){}
nodeSelectorNode labels for pod assignment (this value is evaluated as a template){}
tolerationsTolerations for pod assignment (this value is evaluated as a template)[]
podAnnotationsAdditional annotations to apply to the pod.{}
podLabelsAdditional labels to be added to pods{}
podSecurityContext.fsGroupGroup ID for the container1001
podSecurityContext.runAsUserUser ID for the container1001
priorityClassNamepriorityClassName""
securityContextSecurity context for the container{}
service.typeKubernetes Service typeClusterIP
service.portExternalDNS client port7979
service.nodePortPort to bind to for NodePort service type (client port)nil
service.clusterIPIP address to assign to service""
service.externalIPsService external IP addresses[]
service.loadBalancerIPIP address to assign to load balancer (if supported)""
service.loadBalancerSourceRangesList of IP CIDRs allowed access to load balancer (if supported)[]
service.annotationsAnnotations to add to service{}
rbac.createWeather to create & use RBAC resources or nottrue
rbac.serviceAccountNameServiceAccount (ignored if rbac.create == true)default
rbac.serviceAccountAnnotationsAdditional Service Account annotations{}
rbac.apiVersionVersion of the RBAC APIv1beta1
rbac.pspEnabledPodSecurityPolicyfalse
resourcesCPU/Memory resource requests/limits.{}
livenessProbeDeployment Liveness ProbeSee values.yaml
readinessProbeDeployment Readiness ProbeSee values.yaml
extraVolumesA list of volumes to be added to the pod[]
extraVolumeMountsA list of volume mounts to be added to the pod[]
metrics.enabledEnable prometheus to access external-dns metrics endpointfalse
metrics.podAnnotationsAnnotations for enabling prometheus to access the metrics endpoint
metrics.serviceMonitor.enabledCreate ServiceMonitor objectfalse
metrics.serviceMonitor.selectorAdditional labels for ServiceMonitor object{}
metrics.serviceMonitor.intervalInterval at which metrics should be scraped30s
metrics.serviceMonitor.scrapeTimeoutTimeout after which the scrape is ended30s

Specify each parameter using the --set key=value[,key=value] argument to helm install. For example,

console
$ helm install my-release \
  --set provider=aws stable/external-dns

Alternatively, a YAML file that specifies the values for the parameters can be provided while installing the chart. For example,

bash
$ helm install my-release -f values.yaml stable/external-dns

Tip: You can use the default values.yaml

Configuration and installation details

Rolling VS Immutable tags

It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image.

Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist.

Production configuration

This chart includes a values-production.yaml file where you can find some parameters oriented to production configuration in comparison to the regular values.yaml. You can use this file instead of the default one.

  • Desired number of ExternalDNS replicas:
diff
- replicas: 1
+ replicas: 3
  • Enable prometheus to access external-dns metrics endpoint:
diff
- metrics.enabled: false
+ metrics.enabled: true

Tutorials

Find information about the requirements for each DNS provider on the link below:

For instance, to install ExternalDNS on AWS, you need to:

  • Provide the K8s worker node which runs the cluster autoscaler with a minimum IAM policy (check IAM permissions docs for more information).
  • Setup a hosted zone on Route53 and annotate the Hosted Zone ID and its associated "nameservers" as described on these docs.
  • Install ExternalDNS chart using the command below:

Note: replace the placeholder HOSTED_ZONE_IDENTIFIER and HOSTED_ZONE_NAME, with your hosted zoned identifier and name, respectively.

bash
$ helm install my-release \
  --set provider=aws \
  --set aws.zoneType=public \
  --set txtOwnerId=HOSTED_ZONE_IDENTIFIER \
  --set domainFilters[0]=HOSTED_ZONE_NAME \
  stable/external-dns

Upgrading

To 2.0.0

Backwards compatibility is not guaranteed unless you modify the labels used on the chart's deployments. Use the workaround below to upgrade from versions previous to 1.0.0. The following example assumes that the release name is my-release:

console
$ kubectl delete deployment my-release-external-dns
$ helm upgrade my-release stable/external-dns

Other mayor changes included in this major version are:

  • Default image changes from registry.opensource.zalan.do/teapot/external-dns to bitnami/external-dns.
  • The parameters below are renamed:
    • aws.secretKey -> aws.credentials.secretKey
    • aws.accessKey -> aws.credentials.accessKey
    • aws.credentialsPath -> aws.credentials.mountPath
    • designate.customCA.directory -> designate.customCA.mountPath
  • Support to Prometheus metrics is added.