Step 4: Automate DNS Management with External DNS

External DNS is a Kubernetes add-on that automatically manages DNS records for your services and ingresses. It watches for changes in your cluster and updates the DNS records accordingly, making it easier to manage DNS in dynamic environments.

In the first step, provide an API token for your DNS provider. For DigitalOcean, you can create a new token in the API section of your account. Make sure to give it the necessary permissions (write DNS entries) to manage DNS records.

Add Token to OpenBao

After you created the token, we will add it to OpenBao as a new secret. Therefore, use the following command (replace <your-digitalocean-token> with your actual token). Please make sure that your port-forwarding to OpenBao is still active and execute this command in a new terminal tab or window:

bao kv put secret/external-dns do_token=<your_token>

Create a namespace for external-dns

As for other components, we will create a dedicated namespace for external-dns:

kubectl create namespace external-dns

Furthermore, take the same manifests as before and create the Secret as well as the SecretStore for OpenBao in the external-dns namespace. Please make sure to adjust the namespace in the commands accordingly.

kubectl create secret generic -n external-dns vault-secret --from-literal=token=<your-openbao-token>
kubectl apply -n external-dns -f secret-store.yaml

You can use the same commands as before to verify that everything is working as expected. As we didn't change anything on our setup, the results should be the same as before.

In the next step, we can create a new ExternalSecret resource to fetch the DigitalOcean token from OpenBao. Therefore, create a new manifest file called externalsecret-dns.yaml with the following content:

apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: external-dns-do-token
spec:
  refreshInterval: "15s"
  secretStoreRef:
    name: vault-backend
    kind: SecretStore
  target:
    name: do-token
  data:
  - secretKey: do-token
    remoteRef:
      key: external-dns
      property: do_token

This manifest defines a new ExternalSecret resource named external-dns-do-token. It references the vault-backend SecretStore we created before and specifies that it should create a Kubernetes secret named do-token. The data section defines that the key do-token in the Kubernetes secret should be populated with the value of the key do_token from the OpenBao secret external-dns. To apply this manifest to your cluster, use the following command:

kubectl apply -n external-dns -f externalsecret-dns.yaml

After applying the manifest, you can verify that the ExternalSecret was created successfully using the following command:

kubectl get externalsecret -n external-dns

In the output, you should see that the ExternalSecret is valid and ready to be used. After some time (15 seconds in our case, as defined in the manifest), the secret should be created in your cluster.

In the next step, we will go through the steps to install and configure External DNS.

Install External DNS

To install External DNS, we will use Helm again. In the first step, we will need to create a values file to configure External DNS. Create a new file called external-dns-values.yaml with the following content:

provider:
  name: digitalocean
env:
  - name: DO_TOKEN
    valueFrom:
      secretKeyRef:
        name: do-token
        key: do-token
domainFilters:
  - "learn.cloud-native.academy" # Replace with your domain

txtOwnerId: <your-prefix>

Please replace <your-prefix> with a unique prefix for your TXT records. This is used by External DNS to manage ownership of DNS records. Furthermore, replace learn.cloud-native.academy with your own domain name you want to manage. The values file configures External DNS to use DigitalOcean as the DNS provider and fetches the API token from the Kubernetes secret we created before. Finally, it restricts the DNS management to the specified domain.

Now, we can install External DNS using the following command:

helm repo add external-dns https://kubernetes-sigs.github.io/external-dns/
helm upgrade --install external-dns -f external-dns-values.yaml --wait -n external-dns external-dns/external-dns

This will install External DNS in the external-dns namespace using the configuration from the external-dns-values.yaml file.

To verify that everything is running as expected, you can check the pods in the external-dns namespace:

kubectl get pods -n external-dns

You should see a running pod for External DNS as shown here:

NAME                            READY   STATUS    RESTARTS   AGE
external-dns-748cd684d8-dpk9r   1/1     Running   0          24s

Furthermore, you can check the logs of the External DNS pod to see if it is working correctly:

kubectl logs -n external-dns -l app.kubernetes.io/name=external-dns

If everything went fine, you should see logs indicating that External DNS is running and ready to manage DNS records.

In the next step, we will set up cert-manager to automate TLS certificate management in our cluster.