feat(external-dns): auto-create Cloudflare DNS from Ingresses #49

Merged

kblack0610 merged 1 commit from feat/external-dns-cloudflare into master

2026-06-29 17:42:04 +00:00

kblack0610 commented

2026-06-29 17:42:02 +00:00

Owner

Decouples adding a public site from the rotating CLOUDFLARE_TUNNEL_API_TOKEN. external-dns creates per-host CNAMEs using only a DNS-scoped token (reuses cert-managers valid sops token). upsert-only + txt-owner so it never touches Terraform-managed roots. Phase A of the resilient-exposure plan.

kblack0610 added 1 commit

2026-06-29 17:42:02 +00:00

feat(external-dns): auto-create Cloudflare DNS from Ingresses 68deedc4c8

Decouples adding a public site from the hand-rotated CLOUDFLARE_TUNNEL_API_TOKEN.
external-dns watches Ingress resources and creates proxied per-host CNAMEs to the
public-sites tunnel using ONLY a DNS-scoped token (reuses cert-manager's valid,
sops-managed Cloudflare token — no new/rotating credential).

Safety with the Terraform-managed tunnel/root records: --policy=upsert-only (never
deletes), TXT registry + --txt-owner-id=home-k3s + --txt-prefix=extdns- so it only
manages records it created, scoped to --domain-filter=kennethblack.me.

Paired with a one-time wildcard tunnel route (*.kennethblack.me -> traefik), adding a
public site becomes: add an Ingress + push. An expired tunnel token can no longer block
new public hostnames.