如何为多环境（dev/staging/pre-prod）配置Terraform External-DNS

要让External-DNS支持dev.myapp.example.com、staging.myapp.example.com这类多环境域名，需调整Terraform External-DNS模块配置和Ingress资源注解，具体操作如下：

1. 修正Terraform External-DNS模块配置 #

当前配置存在两个核心问题：重复定义source导致参数覆盖，缺少域名范围过滤限制。调整后的配置如下：

module "eks-external-dns" {
  source  = "lablabs/eks-external-dns/aws"
  version = "1.0.0"

  namespace = "kube-system"
  cluster_identity_oidc_issuer = module.eks.cluster_oidc_issuer_url
  cluster_identity_oidc_issuer_arn =  module.eks.oidc_provider_arn

  settings = {
    "policy" = "sync" 
    # 合并service和ingress源，用逗号分隔避免参数覆盖
    "source"= "service,ingress"
    "log-level"= "verbose"
    "log-format"= "text"
    "interval"= "1m"
    "provider" = "aws"
    "aws-zone-type" = "public"
    "registry" = "txt"
    "txt-owner-id" = "XXXXXXXXXXXXXX"
    # 添加域名过滤规则，允许处理指定根域名下的所有子域名
    "domain-filter" = "acme.com"
    # 若需支持多个根域名，用逗号分隔："domain-filter" = "acme.com,example.com"
  }
}

关键调整说明： #

• 合并source参数：将service和ingress用逗号合并，确保External-DNS同时监听两类资源的域名变更
• 添加domain-filter：指定允许处理的根域名，自动覆盖该域名下所有子域名（包括多环境前缀的域名）

2. 修正Ingress资源注解 #

当前Ingress的external-dns.alpha.kubernetes.io/hostname注解值错误，会导致External-DNS无法识别目标域名，推荐两种调整方式：

方式一：移除注解（推荐） #

直接删除错误的hostname注解，External-DNS会自动从Ingress的spec.rules[*].host字段读取域名：

---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    alb.ingress.kubernetes.io/healthcheck-interval-seconds: "15"
    alb.ingress.kubernetes.io/healthcheck-path: /health
    alb.ingress.kubernetes.io/healthcheck-port: traffic-port
    alb.ingress.kubernetes.io/healthcheck-protocol: HTTP
    alb.ingress.kubernetes.io/healthcheck-timeout-seconds: "5"
    alb.ingress.kubernetes.io/healthy-threshold-count: "3"
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS":443}]'
    alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_301"}}'
    alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:eu-west-1:xxx:certificate/aaaa-bbb-ccc-dd-ffff
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/success-codes: "200"
    alb.ingress.kubernetes.io/tags: createdBy=aws-controller
    alb.ingress.kubernetes.io/target-type: ip
    alb.ingress.kubernetes.io/unhealthy-threshold-count: "3"
    # 移除错误的hostname注解
    kubernetes.io/ingress.class: alb
    alb.ingress.kubernetes.io/load-balancer-name: acme-lb
    alb.ingress.kubernetes.io/group.name: acme-group
  name: keycloak-ingress-controller
spec:
  rules:
    - host: dev.keycloak.acme.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: keycloak
                port:
                  number: 8080
    # 新增staging环境域名规则
    - host: staging.keycloak.acme.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: keycloak-staging
                port:
                  number: 8080

方式二：显式指定多域名 #

若需为单个Ingress绑定多个域名，可在注解中用逗号分隔：

external-dns.alpha.kubernetes.io/hostname: dev.keycloak.acme.com,staging.keycloak.acme.com

3. 验证IAM权限 #

确保External-DNS的IAM角色具备访问对应Route53托管区域的权限，需包含route53:ChangeResourceRecordSets、route53:ListHostedZones、route53:GetChange等操作权限。lablabs模块默认会创建基础策略，若新增了托管区域，需确认策略覆盖该区域。

4. 应用配置并验证 #

1. 重新部署External-DNS：

terraform init
terraform plan
terraform apply

2. 应用调整后的Ingress资源：

kubectl apply -f your-ingress.yaml

3. 查看External-DNS日志确认域名处理状态：

kubectl logs -n kube-system deployment/eks-external-dns -f

日志中应出现目标域名的处理记录，同时Route53会自动生成对应的DNS解析记录。

内容的提问来源于stack exchange，提问作者Ben Rhouma Zied