Skip to content

ExternalDNS

ExternalDNS watches your Service and Ingress objects and publishes their hostnames as DNS records automatically. CAPVCO ships it with a whitesky.cloud DNS webhook provider, so a hostname annotation becomes a resolvable record in your whitesky.cloud-managed zone — no manual DNS.

Turn it on

Add the label to the Cluster:

metadata:
  labels:
    capvco.infrastructure.cluster.x-k8s.io/external-dns: enabled

CAPVCO deploys, into capvco-system, an ExternalDNS Deployment with two containers:

  • the webhook (vco-externaldns-webhook) — translates ExternalDNS's provider calls into whitesky.cloud DNS API calls, using the injected vco-lb-credential; and
  • ExternalDNS itself — upstream external-dns, configured with --provider=webhook, --source=service --source=ingress, --registry=txt and --policy=sync.

The managed zone is auto-discovered from your customer DNS zone (or pin it via DOMAIN_FILTER).

Using it

Annotate a Service (or Ingress) with the hostname you want:

apiVersion: v1
kind: Service
metadata:
  name: web
  annotations:
    external-dns.alpha.kubernetes.io/hostname: web.example.com
spec:
  type: LoadBalancer
  selector: {app: web}
  ports: [{port: 80, targetPort: 8080}]

Once the load balancer has an external IP, ExternalDNS creates an A/AAAA (or CNAME) record for web.example.com pointing at it, plus a companion TXT ownership record so it only ever manages records it created. Remove the Service and the records are cleaned up (sync policy).

It pairs with a LoadBalancer Service

ExternalDNS publishes the address the Service/Ingress reports. So enable a Service load balancer too — the DNS record is only as useful as the IP it points at.

Caveats worth knowing

whitesky.cloud DNS is slow to write, and TTL is fixed at 1 hour

  • Creating a record takes ~30 s on the platform, so a changeset touching several records can take minutes. The webhook and ExternalDNS run with generous (5-minute) timeouts to absorb this — expect DNS to lag reality by a bit, not to be instant.
  • Every record gets a fixed 3600 s TTL (the API has no TTL parameter). Plan for up to an hour of cache staleness on changes. This is the same platform constraint that shapes geo failover.

Ownership id

The TXT registry uses an owner id (EXTERNAL_DNS_OWNER_ID, default capvco). If you run multiple clusters against the same zone, give each a distinct owner id so they don't clobber each other's records.

Next: make your etcd recoverable → etcd backup & restore.