ExternalDNS — Sync Kubernetes Services with DNS Providers

What it is

ExternalDNS is a Kubernetes SIG controller that automatically manages DNS records based on your Kubernetes resources. When you create a Service with a hostname annotation or an Ingress with a host rule, ExternalDNS creates the corresponding DNS records in your provider (Route 53, Cloudflare, Google Cloud DNS, Azure DNS, and 30+ others). When you delete the resource, the DNS record is cleaned up.

ExternalDNS targets platform engineers who want DNS management to be declarative and automatic rather than manual. It closes the gap between deploying a service and making it reachable by name.

How it saves time or tokens

Manually creating DNS records for every Kubernetes service is error-prone and slow. ExternalDNS makes DNS a side effect of deploying your application. You annotate your Service or Ingress with the desired hostname, and the controller handles the rest. This eliminates the need for Terraform DNS modules, manual console clicks, or API scripts for routine DNS operations.

How to use

1. Install ExternalDNS via Helm:

helm repo add external-dns https://kubernetes-sigs.github.io/external-dns/
helm upgrade --install external-dns external-dns/external-dns \
  --set provider=cloudflare \
  --set cloudflare.apiToken=YOUR_TOKEN \
  --set policy=sync

1. Annotate a Service with a hostname:

apiVersion: v1
kind: Service
metadata:
  name: my-app
  annotations:
    external-dns.alpha.kubernetes.io/hostname: app.example.com
spec:
  type: LoadBalancer
  ports:
    - port: 80
  selector:
    app: my-app

1. ExternalDNS detects the annotation and creates an A record pointing app.example.com to the LoadBalancer IP.

Example

Using ExternalDNS with an Ingress resource:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: my-ingress
spec:
  rules:
    - host: api.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: api-service
                port:
                  number: 8080

ExternalDNS reads the host field and creates the DNS record automatically.

Related on TokRepo

• AI Tools for DevOps — Kubernetes infrastructure tools
• Automation Tools — infrastructure automation scripts

Common pitfalls

• The policy=sync mode deletes DNS records not managed by ExternalDNS; use policy=upsert-only if you have existing manual records you want to preserve
• Each DNS provider requires specific credentials and permissions; check the ExternalDNS provider documentation for the minimum required IAM policy
• TXT ownership records are created alongside A/CNAME records; do not delete them or ExternalDNS will lose track of which records it manages