Automatically Manage DNS Records for Your Microservices in Amazon EKS with ExternalDNS
Configure Amazon Route53 as a DNS provider for external access to microservices.
Kamal Joshi
Amazon Employee
Published Oct 3, 2023
Last Modified Mar 20, 2024
In modern cloud-native environments, microservices are often distributed across clusters, scaled dynamically, and frequently moved due to orchestration. Manually updating DNS records for each microservice instance becomes impractical, time consuming and is error-prone. Misconfigured DNS records can lead to service disruptions, which have a direct impact on the user experience and can incur financial losses. Resolving these errors demands both time and resources, consequently driving up operational costs and exposing potential security vulnerabilities.
It is crucial to automate DNS record management for microservices hosted on Kubernetes clusters. This automation streamlines application accessibility and maintains operational efficiency. By deploying ExternalDNS, the need for manual intervention is eliminated. It ensures that domain names are always up-to-date and accurately reflect the addresses of the running Kubernetes services. This not only simplifies the user experience by allowing clients to access Kubernetes services using readable URLs, but also improves fault tolerance and resilience. With automated DNS management, microservices can be deployed, scaled, and relocated quickly without affecting accessibility. The ExternalDNS add-on automatically creates and manages DNS records for services exposed externally, using supported DNS providers. It enables external clients to access services running inside the cluster by resolving the service's hostname to the external IP address of the Kubernetes cluster.
Building on the Amazon EKS cluster from part 1 of our series, this tutorial dives into setting up the ExternalDNS add-on. Included in the cluster configuration for the previous tutorial is the IAM Role for Service Account (IRSA) for the ExternalDNS add-on and the OpenID Connect (OIDC) endpoint. For part one of this series, see Building an Amazon EKS Cluster Preconfigured to Run High Traffic Microservices. Alternatively, to set up an existing cluster with the components required for this tutorial, use the instructions in Create an IAM OpenID Connect (OIDC) endpoint in EKS official documentation and Create an IAM Role for Service Account (IRSA) in Re:Post.
In this tutorial, you will configure the ExternalDNS add-on on your Amazon EKS cluster. This will involve creating a private hosted zone, installation of the ExternalDNS add-on that utilizes the IAM Role for Service Account (IRSA) for the management of AWS Route53 DNS records. Additionally, we will illustrate the validation of user-friendly URLs to access these Kubernetes services. This methodology enhances fault tolerance and guarantees robust accessibility to these Kubernetes services.
| About | |
|---|---|
| ✅ AWS experience | 200 - Intermediate |
| ⏱ Time to complete | 30 minutes |
| 🧩 Prerequisites | - AWS Account |
| 📢 Feedback | Any feedback, issues, or just a 👍 / 👎 ? |
| ⏰ Last Updated | 2023-10-03 |
- Install the latest version of kubectl. To check your version, run:
kubectl version --short. - Install the latest version of eksctl. To check your version, run:
eksctl info. - Install the latest version of Helm. To check your version, run:
helm version. - Install the latest version of AWS CLI. To check your version, run:
aws --version.
This tutorial is the second part of a series on managing high traffic microservices platforms using Amazon EKS, and it's dedicated to the setup and configuration of ExternalDNS add-on. It also outlines the process of creating a private hosted zone and introduces the implementation of authentication and authorization using IAM Roles for Service Accounts (IRSA) to manage the AWS Route53 DNS records.
- Authentication: Utilize the IAM Role for Service Account (IRSA) for the ExternalDNS add-on with the OpenID Connect (OIDC) endpoint to ensure secure communication between Kubernetes pods and AWS services.
- Route53 Hosted Zone Creation: Create a private hosted zone that will hold the DNS records of the Kubernetes service. This hosted zone will serve as a container for all the DNS records related to your Kubernetes service.
- ExternalDNS Add-on Setup: Deploy the ExternalDNS add-on on your Amazon EKS cluster and configure it to synchronize Kubernetes service DNS records with your Route53 domain.
- Sample Application Deployment: As a practical example, we'll walk you through the steps to build and expose the "2048 Game Sample Application" on port 80. To facilitate this, we'll utilize custom annotations for ExternalDNS, particularly the 'hostname' annotation, which instructs the ExternalDNS controller on how to access the Kubernetes service via the specified HTTP path. For more annotations, see Setting up ExternalDNS for Services on AWS.
Note that even if you're still within your initial 12-month AWS Free Tier period, the Route 53 hosted zone falls outside the AWS free tier. Hence, usage could result in additional charges.
The ExternalDNS add-on is self-managed, and customers are responsible for overseeing its lifecycle and maintenance.
Before interacting with your Amazon EKS cluster using Helm or other command-line tools, it's essential to define specific environment variables that encapsulate your cluster's details. These variables will be used in subsequent commands, ensuring that they target the correct cluster and resources.
- First, confirm that you are operating within the correct cluster context. This ensures that any subsequent commands are sent to the intended Kubernetes cluster. You can verify the current context by executing the following command:
- Define the
CLUSTER_ACCOUNTenvironment variable to store your AWS account ID.
- Define the
CLUSTER_NAMEenvironment variable for your EKS cluster.
- Define the
CLUSTER_REGIONenvironment variable for your EKS cluster.
- Define the
CLUSTER_VPCenvironment variable for your EKS cluster.
In this section, we will create a private Route53 hosted zone called "my-externaldns-demo.com". If you already own a public domain, feel free to use that instead.
- Define the
AWS_ROUTE53_DOMAINenvironment variable to store your Route 53 domain name.
- Create a new hosted zone in AWS Route 53.
The expected output should look like this:
- Retrieve the ID of the hosted zone you created in AWS Route 53.
- Verify that the Route53 hosted zone was created successfully.
The expected output should look like this:
Make sure the "external-dns" service account is correctly set up in the "kube-system" namespace in your cluster.
The expected output should look like this:
Optionally, if you do not already have an IAM role set up, or you receive an error, the following command will create the IAM Role along with the service account names "external-dns". Note that you must have an OpenID Connect (OIDC) endpoint associated with your cluster before you run these commands.
- Configure IAM permissions to allow ExternalDNS pods to manage Route 53 records in your AWS account.
- Create the policy to grant the necessary permissions for ExternalDNS to interact with Route 53.
- Use the policy to create an IAM role for the service account. This service account will be used by ExternalDNS pods to manage records in the Route53 hosted zone.
In this section, you will deploy the ExternalDNS add-on within your EKS cluster, specifically in the "kube-system" namespace. You will further configure the add-on to synchronize DNS records for the
my-externaldns-demo.com hosted zone. This configuration enables the ExternalDNS add-on to automate the management of DNS records for services running in your Kubernetes cluster, ensuring that these services can be accessed using domain names. To learn more, see ExternalDNS parameters.- Update the kubeconfig file to set the context to the current EKS cluster.
- Run the following Helm command to install the ExternalDNS add-on on your EKS cluster. This command will configure the ExternalDNS add-on to manage DNS records for your specified domain.
The expected output should look like this:
Now that we have set up the ExternalDNS, we can allow users outside the cluster to access containerized applications using human-readable URLs. In this section, we will deploy the popular "2048 game" as a sample application within the cluster. The manifest we provide includes custom annotations for the ExternalDNS, specifically for the hostname. These annotations work together with the ExternalDNS controller to access the Kubernetes service through an HTTP path. For more annotations, refer to the ExternalDNS documentation.
- Define the
SUB_DOMAINenvironment variable.
- Create the Namespace, Deployment and Service with an ExternalDNS annotation. To learn more about these components, refer to the following resources: Deployments, Services, Load Balancing, and Networking, and ExternalDNS .
- Create the Kubernetes resources by applying the configuration file to the Kubernetes API server.
You should see the following response output:
- You can verify the logs using the following command. Please note that it may take a few seconds to update the entries.
The expected output should look like this:
- You can verify the newly created DNS records, which point to the
game-2048service within the private hosted zone, by running the following command:
The expected output should look like this:
- Since the hosted domain is private, you can access the service
game-2048using the user-friendly URLgame-2048.my-externaldns-demo.comfrom within the pods. We will be creating a test pod and running a curl command to verify the setup.
- Double click the
test.htmlfile that was created by the previous command. You should see the following contents.
Please note for public domains, you can access the URL directly from browser.
After finishing with this tutorial, for better resource management, you may want to delete the specific resources you created.
With the completion of this tutorial, you’ve effectively deployed the ExternalDNS add-on on your Amazon EKS cluster, enabling automatic DNS management for your Kubernetes services. By integrating with DNS providers like AWS Route 53, you have set the stage for effortless domain name resolution, fully in line with industry standards. This tutorial has walked you through the initial setup of the ExternalDNS add-on, the configuration of environment variables like
HOSTED_ZONE_ID and AWS_ROUTE53_DOMAIN, and the steps for domain registration. You've also delved into the specifics of URL navigation for external clients.To continue your journey with a real domain, you'll need to Register a Domain Name with Amazon Route 53. After you've registered a domain name with Amazon Route 53, set the
HOSTED_ZONE_ID & AWS_ROUTE53_DOMAIN variable with your registered domain, then revisit the steps in this guide. By doing so, you'll be able to access the service directly from a browser by navigating to <SUB_DOMAIN>.<AWS_ROUTE53_DOMAIN>. This final setup ensures a comprehensive, fully operational environment, poised for both internal and external service accessibility.Any opinions in this post are those of the individual author and may not reflect the opinions of AWS.