Kubernetes - Setup External DNS

This article is part of a Kubernetes series focusing on setting up External DNS, a crucial tool for automating DNS record management. Our setup involves a local Kubernetes cluster, and we've already established prerequisites for external traffic routing to our internal cluster using a public IP address. We're employing Cloudflare as our DNS provider and implementing the solution using GitOps principles with Flux.

First, we generated a Cloudflare API key by accessing the Manage Account section in the Cloudflare dashboard, specifically under Account API Tokens. From there, we edited the DNS template to create a token for a specific zone.

Next, we configured a Kubernetes secret by creating a file named cluster/default/cloudflare-token.yaml. This file includes the API token and API email, which we encrypted with SOPS before committing the changes to our Git repository. Detailed instructions for secret management can be found in the Kubernetes GitOps with FluxCD - Part 2 - Secret Management using SOPS guide.

Finally, we set up the External DNS deployment by creating a file named cluster/default/external-dns.yaml. This YAML manifest includes four Kubernetes resources: ServiceAccount, ClusterRole, ClusterRoleBinding, and Deployment. The ClusterRole grants permissions for accessing services, endpoints, pods, ingresses, and nodes, while the ClusterRoleBinding links the ClusterRole to the ServiceAccount named 'external-dns' within the kube-system namespace.

The Deployment defines the External DNS application, specifying the image to use (k8s.gcr.io/external-dns/external-dns:v0.14.2), the source for fetching ingress resources, a domain filter, and the DNS provider (Cloudflare). The relevant environment variables, CF_API_TOKEN and CF_API_EMAIL, are sourced from the previously created Kubernetes secret.