ACCESS TO IT INTEL GRANTED

Configure ExternalDNS with AWS Route53 IRSA and TXT Registry

TARGET_ENV: EKS 1.25+, Helm 3.12+, AWS CLI v2
[ TAGS: aws, snippet, route53, irsa, externaldns, helm ]

This configuration runs ExternalDNS against AWS Route53 using IAM Roles for Service Accounts (IRSA), eliminating static credentials, and enables the TXT registry to track ownership of records. Internally, the pod's service account is annotated with an IAM role ARN, the EKS pod identity webhook injects a projected token, STS exchanges it for temporary credentials, and the controller calls the Route53 ChangeResourceRecordSets API. The TXT registry writes a companion TXT record prefixed with the --txt-prefix for every A/CNAME it manages, storing the owning resource identifier.

The registry mechanism is critical in shared zones where multiple clusters or controllers write to the same hosted zone. Without it, a stale controller can delete records it does not own during reconciliation, causing outages. Production teams commonly use --txt-owner-id set to a unique cluster identifier so that different clusters can safely coexist in one zone.

Security implications: IRSA removes long-lived access keys from the cluster, and the IAM policy should be scoped to the specific hosted zone ARN with only ChangeResourceRecordSets and ListResourceRecordSets actions. Pitfalls include exceeding the 10 KB TXT record size limit when many annotations are stored, throttling from Route53 API rate limits (5 requests per second per account by default), and forgetting --aws-zone-type=public or private which leads to records being created in the wrong zone. Always enable --dry-run first in new environments.

> System.Execute()

helm repo add external-dns https://kubernetes-sigs.github.io/external-dns/
helm upgrade --install external-dns external-dns/external-dns \
  --namespace external-dns --create-namespace \
  --set provider.name=aws \
  --set aws.region=us-east-1 \
  --set serviceAccount.annotations."eks\.amazonaws\.com/role-arn"=arn:aws:iam::111122223333:role/external-dns-route53 \
  --set txtOwnerId=prod-cluster-01 \
  --set txtPrefix=edns- \
  --set policy=sync \
  --set registry=txt \
  --set domainFilters[0]=example.com \
  --set aws.zoneType=public \
  --set logLevel=info

> Architecture & Security Context

Verified for Valters IT Hub. When deploying this configuration in a production homelab or enterprise environment, ensure that you monitor system resources and implement strict access controls. Administrator privileges are required.

ID: VALTERSIT-482574B4DA89

← BACK_TO_VAULT → CVE_DATABASE