Deploy ExternalDNS

In this section you will configure and deploy ExternalDNS using an IAM role to provide it with permissions to manage DNS records on Route 53.

Fast Forward

If you have already deployed ExternalDNS, expand this box to fast-forward.

1. Proceed to the Verify section.

See also

• Official docs for deploying ExternalDNS on AWS.
• Official IAM Roles for Service Accounts guide.

Choose one of the following options to deploy ExternalDNS:

• Option 1: Deploy ExternalDNS Automatically (preferred).
• Option 2: Deploy ExternalDNS Manually.

Air Gapped

ExternalDNS will not be able to access Amazon Route 53 because there is no VPC endpoint. You may proceed to the What's Next section.

What You'll Need

• A configured management environment.
• Your clone of the Arrikto GitOps repository.
• An existing EKS cluster.
• An existing Amazon Route 53 hosted zone.
• An existing IAM role for ExternalDNS.

Option 1: Deploy ExternalDNS Automatically (preferred)

Deploy ExternalDNS by following the on-screen instructions on the rok-deploy user interface.

If rok-deploy is not already running, start it with:

root@rok-tools:~# rok-deploy --run-from eks-alb-edns

Proceed to the Summary section.

Option 2: Deploy ExternalDNS Manually

If you want to deploy ExternalDns manually, follow the instructions below.

Procedure

1. Go to your GitOps repository, inside your rok-tools management environment:

   root@rok-tools:~# cd ~/ops/deployments
   

2. Restore the required context from previous sections:

   root@rok-tools:~/ops/deployments# source <(cat deploy/env.{eks-alb-zone,eks-alb-iam-edns})
   

   root@rok-tools:~/ops/deployments# export EKS_ALB_ZONE_DOMAIN EKS_ALB_IAM_EDNS_ROLE
   

3. Verify that the IAM role exists, obtain its ARN and copy it to your clipboard, as you are going to use this value in later steps:

   root@rok-tools:~/ops/deployments# aws iam get-role \
   > --role-name ${EKS_ALB_IAM_EDNS_ROLE?} \
   > --query Role.Arn \
   > --output text
   arn:aws:iam::123456789012:role/rok-us-west-2-arrikto-cluster-edns
   

4. Edit rok/external-dns/overlays/deploy/kustomization.yaml and use eks as base:

   bases:
   - ../eks
   #- ../gke
   

5. Edit rok/external-dns/overlays/deploy/kustomization.yaml and enable only the sa and deploy patches:

   patches:
   - path: patches/sa.yaml
   #- path: patches/sa-gcp.yaml
   - target:
       kind: Deployment
       name: external-dns
     path: patches/deploy.yaml
   #- target:
   #    kind: Deployment
   #    name: external-dns
   #  path: patches/deploy-gcp.yaml
   

6. Edit rok/external-dns/overlays/deploy/patches/deploy.yaml and set --domain-filter to your domain:

   - --domain-filter=apps.example.com  # <-- Update this line with your EKS_ALB_ZONE_DOMAIN
   

7. Edit rok/external-dns/overlays/deploy/patches/sa.yaml and set the IAM role related annotation to the ARN of your IAM role for ExternalDNS:

   annotations:
     eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/rok-us-west-2-arrikto-cluster-edns  # <-- Update this line with your IAM role ARN
   

8. Commit your changes:

   root@rok-tools:~/ops/deployments# git commit -am "Deploy ExternalDNS"
   

9. Deploy ExternalDNS:

   root@rok-tools:~/ops/deployments# rok-deploy --apply rok/external-dns/overlays/deploy
   

Verify

1. Verify that the ExternalDNS deployment is up-and-running. Verify field READY is 1/1:

   root@rok-tools:~# kubectl get deploy/external-dns
   NAME           READY   UP-TO-DATE   AVAILABLE   AGE
   external-dns   1/1     1            1           1m
   

Summary

You have successfully deployed ExternalDNS and allowed it to access your Amazon Route 53 hosted zone.

What's Next

The next step is to create an ACM certificate for your domain.

• Create ACM Certificate