azure-dns

External-DNS automates DNS synchronization by monitoring Kubernetes Services and Ingress resources, then creating or updating corresponding DNS records in Azure DNS. It eliminates manual DNS management in production AKS deployments by applying configurations for workload identity, RBAC permissions, and domain filtering.

Azure workload identity is the recommended secure authentication method for External-DNS in AKS. It replaces service principals by using pod identity federation, requiring only that you grant the DNS Zone Contributor RBAC role to the External-DNS service account and enable workload identity on the cluster.

External-DNS supports multiple DNS providers—Azure DNS, Cloudflare, AWS Route53, and Google Cloud DNS—within a single deployment. You configure provider authentication (workload identity, IRSA, API tokens, service principals) and domainFilters to route records to the appropriate provider.

External-DNS requires DNS Zone Contributor role on the Azure DNS zone to create, update, and manage DNS records. Fine-grained permissions ensure External-DNS can modify only DNS records within the designated zone without broader subscription access.

Deploy External-DNS using Helm with a values schema that specifies domainFilters, policy (upsert-only or sync), TXT ownership records, resource requests/limits, security context, and provider-specific credentials. GitOps workflows with ArgoCD automate declarative updates and manage configuration drift in production clusters.

External-DNS provides rate-limiting, resource requests/limits, and policy controls (upsert-only prevents accidental deletions, sync enables full reconciliation) to optimize performance and avoid cloud provider API throttling in large-scale Kubernetes deployments.