ExternalDNS: apply controller + migrate the static aws-inventory A records #339

New issue

Closed

opened 2026-06-15 14:35:09 +00:00 by coilysiren · 0 comments

coilysiren commented

2026-06-15 14:35:09 +00:00

Owner

Built (landed)

ExternalDNS as app-agnostic cluster infra - controller manifest deploy/external_dns.yml, the external-dns verb, and docs/external-dns.md. Apps opt in with an Ingress label (external-dns.coilysiren.me/managed=true) + hostname annotation; the controller writes the Route53 record. Scoped safe: --policy=upsert-only (never deletes), --domain-filter=coilysiren.me, --label-filter so only labelled ingresses are touched. Reuses the kai-server-k3s creds (mirrored from external-secrets/aws-credentials), no new IAM. atlas is the first consumer (coilyco-bridge/deploy bd8f63d).

Implementing commit: infrastructure 172b954.

Pending: apply to the cluster (operator step)

ward exec external-dns is a kubectl write, so an agent cannot run it (lockdown deny on kubectl, not cleared by intent). Kai runs it on a box with cluster access:

cd ~/projects/coilyco-flight-deck/infrastructure
ward exec external-dns
kubectl -n external-dns logs deploy/external-dns --tail=50

Watch the logs for route53:ListHostedZones / ListResourceRecordSets AccessDenied - the route53-coilysiren-me IAM policy was scoped for cert-manager's narrower DNS-01 needs and may need those two list actions added. With the label-filter and no labelled ingress yet, the first apply creates zero records (safe).

Pending: migrate the 8 static records (one at a time, non-blocking)

The home_a for_each in terraform/aws-inventory/main.tf still owns: eco, eco-app, eco-jobs-tracker, eco-mcp, factorio, galaxy-gen, grafana (apex/www/flightdeck/bridge are Netlify CNAMEs, not ingress-backed, stay in terraform). Per host: add the label + hostname annotation to that app's Ingress, confirm ExternalDNS adopts it (an extdns-<host> TXT appears), then drop its line from home_a and terraform apply. upsert-only means nothing breaks if done gradually.

## Built (landed) ExternalDNS as app-agnostic cluster infra - controller manifest `deploy/external_dns.yml`, the `external-dns` verb, and `docs/external-dns.md`. Apps opt in with an Ingress label (`external-dns.coilysiren.me/managed=true`) + hostname annotation; the controller writes the Route53 record. Scoped safe: `--policy=upsert-only` (never deletes), `--domain-filter=coilysiren.me`, `--label-filter` so only labelled ingresses are touched. Reuses the kai-server-k3s creds (mirrored from `external-secrets/aws-credentials`), no new IAM. atlas is the first consumer (coilyco-bridge/deploy bd8f63d). Implementing commit: infrastructure 172b954. ## Pending: apply to the cluster (operator step) `ward exec external-dns` is a kubectl write, so an agent cannot run it (lockdown deny on kubectl, not cleared by intent). Kai runs it on a box with cluster access: ``` cd ~/projects/coilyco-flight-deck/infrastructure ward exec external-dns kubectl -n external-dns logs deploy/external-dns --tail=50 ``` Watch the logs for `route53:ListHostedZones` / `ListResourceRecordSets` AccessDenied - the `route53-coilysiren-me` IAM policy was scoped for cert-manager's narrower DNS-01 needs and may need those two list actions added. With the label-filter and no labelled ingress yet, the first apply creates zero records (safe). ## Pending: migrate the 8 static records (one at a time, non-blocking) The `home_a` for_each in `terraform/aws-inventory/main.tf` still owns: eco, eco-app, eco-jobs-tracker, eco-mcp, factorio, galaxy-gen, grafana (apex/www/flightdeck/bridge are Netlify CNAMEs, not ingress-backed, stay in terraform). Per host: add the label + hostname annotation to that app's Ingress, confirm ExternalDNS adopts it (an `extdns-<host>` TXT appears), then drop its line from `home_a` and `terraform apply`. upsert-only means nothing breaks if done gradually.

coilysiren referenced this issue from a commit

2026-06-15 14:36:54 +00:00

docs(external-dns): point at the real tracking issue (#339, not #334)

coilysiren referenced this issue from a commit

2026-06-15 16:04:14 +00:00

docs(external-dns): document the home-IP target requirement for public hosts

coilysiren added the

priority

autonomy

live-collab

labels

2026-06-17 07:07:32 +00:00