External-dns: allow to specify public/private Route53 zone as annotation

[kamsz]

Hi,

I've got a public and private Route53 zone for the same domain - x.com.

I'd like to create two Ingress specifications will the following rules:

• create a record y.x.com in a public x.com zone, point it to a public ingress controller ELB
• create a record y.x.com in a private x.com zone, point it to an internal ingress controller ELB

The general use case is that I've got a whitelisted source range on public y.x.com ELB (resolves through public x.com zone), but anyone who's connected through VPN would be allowed to connect to y.x.z through internal ELB (resolves through private x.com zone).

Something like external-dns.alpha.kubernetes.io/aws-zone-type.

[dzoeteman]

As I could make good use of this functionality, I'd like to pick this up.

@ members, what would you suggest here, that this always overrides the --aws-zone-type flag or should it respect this flag and for example give an error or just ignore the annotation?

[szuecs]

@linki can you answer @dzoeteman please?

[linki]

@dzoeteman Thanks for picking this up.

I think the flag should take precedence: when I start ExternalDNS with --aws-zone-type=private it shouldn't modify any public zones even if they would be a good fit or an ingress is annotated with external-dns.alpha.kubernetes.io/aws-zone-type: public.

[krogon-dp]

• without aws-zone-type - accept all ingress rules
• with aws-zone-type=private - accept all ingress rules without annotation and with private annotation external-dns.alpha.kubernetes.io/aws-zone-type: private
• with aws-zone-type=public - accept all ingress rules without annotation and with public annotation external-dns.alpha.kubernetes.io/aws-zone-type: public

@kamsz agree?

[kamsz]

@krogon-dp looks promising and solves my issue.

[dzoeteman]

Thanks @linki, @krogon-dp, @kamsz, I'll get on it :)

[kamsz]

I've managed to achieve what I've wanted in the OP.

Solutions for the future reference if someone has a similar use case to mine:

Deploy two external-dns pods, one with:

        - --annotation-filter=external-dns.alpha.kubernetes.io/aws-zone-type-private
        - --aws-zone-type=private

and second one with:

        - --annotation-filter=external-dns.alpha.kubernetes.io/aws-zone-type-public
        - --aws-zone-type=public

Then in Ingress resource add an annotation to mark it as public/private:

    kubernetes.io/ingress.class: "internal-ingress"
    external-dns.alpha.kubernetes.io/aws-zone-type-private: "true"

    kubernetes.io/ingress.class: "external-ingress"
    external-dns.alpha.kubernetes.io/aws-zone-type-public: "true"

This solution requires to specify one of the annotations on all Ingress resources, but that's a minor issue.

[krogon-dp]

And here is a documentation for that feature: https://github.com/kubernetes-incubator/external-dns/blob/master/docs/faq.md#running-an-internal-and-external-dns-service

[kamsz]

Actually docs contain much better solution than mine. Thanks!

[dzoeteman]

@krogon-dp @kamsz Do you still agree it would be good to add this functionality in a way where you can run only one ExternalDNS instance (as explained before)?

[kamsz]

@dzoeteman ExternalDNS would benefit from this feature for sure.