provide example using external-dns helm chart

Is your feature request related to a problem? Please describe.

at the moment the example is based on plain manifest

Describe the solution you'd like

for me the official external-dns helm chart looks flexible enough
to inject the stackit webhook via values
https://github.com/kubernetes-sigs/external-dns/blob/master/charts/external-dns/templates/deployment.yaml

Describe alternatives you've considered

Search

I did search for other open and closed issues before opening this.

Code of Conduct

I agree to follow this project's Code of Conduct

Additional context

No response

some promising start..

provider:
    name: webhook
    webhook:
      image:
        repository: ghcr.io/stackitcloud/external-dns-stackit-webhook
        tag: v0.3.1
      args:
      - --project-id=xxx
      env:
      - name: AUTH_TOKEN
        valueFrom:
          secretKeyRef:
            name: external-dns-stackit-webhook
            key: auth-token

@not22day

Hello @not22day !

Check the code:

  logLevel: info
  logFormat: text
  interval: 1m
  sources:
    - service
    - ingress
  policy: sync

  provider:
    name: webhook
    webhook:
      image:
        # -- (string) Image repository for the `webhook` container.
        repository: ghcr.io/stackitcloud/external-dns-stackit-webhook
        # -- (string) Image tag for the `webhook` container.
        tag: v0.3.2
        # -- Image pull policy for the `webhook` container.
        pullPolicy: IfNotPresent
      # -- [Environment variables](https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) for the `webhook` container.
      env:
        - name: AUTH_TOKEN
          valueFrom:
            secretKeyRef:
              name: external-dns-stackit-webhook
              key: auth-token
        - name: PROJECT_ID
          valueFrom:
            secretKeyRef:
              name: external-dns-stackit-webhook
              key: project-id
      # -- Extra arguments to provide for the `webhook` container.
      # args: ["--log-level=debug", --api-port=8080, "--project-id=$PROJECT_ID"]
      # -- Extra [volume mounts](https://kubernetes.io/docs/concepts/storage/volumes/) for the `webhook` container.
      extraVolumeMounts: []
      # -- [Resources](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) for the `webhook` container.
      resources: {}
      # -- [Pod security context](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) for the `webhook` container.
      # @default -- See _values.yaml_
      securityContext:
        capabilities:
          drop:
            - ALL
        readOnlyRootFilesystem: true
        runAsNonRoot: true
        runAsUser: 65534
      # -- [Liveness probe](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/) configuration for the `external-dns` container.
      # @default -- See _values.yaml_
      livenessProbe:
        failureThreshold: 2
        httpGet:
          path: /healthz
          port: 8888
        initialDelaySeconds: 10
        periodSeconds: 10
        successThreshold: 1
        timeoutSeconds: 5
      # -- [Readiness probe](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/) configuration for the `webhook` container.
      # @default -- See _values.yaml_
      readinessProbe:
        failureThreshold: 6
        httpGet:
          path: /healthz
          port: 8888
        initialDelaySeconds: 5
        periodSeconds: 10
        successThreshold: 1

@PatrickKoss

Hi all, hi @PatrickKoss,

we're currently spinning up a new environment in Stack-IT. We try to install external-dns via helm-chart. We cannot use the managed dns solutions, as we want to create DNS records based on the new Gateway API.

So, while we're able to add the webhook container to the deployment via the chart and load the service account correctly, the container crashes once the livenessProbe triggers. This is because in the helm chart, since it introduced the option to add webhooks sidecars, hardcodes the containerPort to 8080, which is used for liveness and readiness probes.

I see, other provider follow that pattern and configure their containers to listen on two ports - 8888 for API requests and 8080 for metrics (healthz endpoint).

As far as I can see, this is the only thing missing to be able to install STACKIT webhook with the external-dns helm chart.

Could you have a look? Maybe it's a quick-win.

Thanks

I opened an issue to solve the hardcoded port in the helm deployment and hope they will admit the included patch for the upcoming 1.19.0 helm chart: kubernetes-sigs/external-dns#5801

As long as this is unsolved, we'll continue to use the bitnami helm chart with the image pulled from the bitnamilegacy repository.

Hey I am not sure if I get the problem :)

Can you try out the following?

helmCharts:

name: external-dns
version: v1.19.0
repo: https://kubernetes-sigs.github.io/external-dns
namespace: external-dns
releaseName: external-dns
valuesInline:
env:
- name: PROJECT_ID
valueFrom:
configMapKeyRef:
name: external-dns
key: PROJECT_ID
- name: DOMAIN_FILTER
valueFrom:
configMapKeyRef:
name: external-dns
key: DOMAIN_FILTER
- name: EXTERNAL_DNS_TXT_OWNER_ID
valueFrom:
configMapKeyRef:
name: external-dns
key: EXTERNAL_DNS_TXT_OWNER_ID
resources:
requests:
memory: "50Mi"
cpu: "5m"
limits:
memory: "300Mi"
cpu: "500m"
serviceMonitor:
enabled: true
policy: sync
extraArgs:
webhook-provider-url: http://localhost:8080
extraVolumes:
- name: stackit-sa-authentication
secret:
secretName: stackit-sa-authentication
provider:
name: webhook
webhook:
image:
repository: ghcr.io/stackitcloud/external-dns-stackit-webhook
tag: v0.3.4
env:
- name: PROJECT_ID
valueFrom:
configMapKeyRef:
name: external-dns
key: PROJECT_ID
- name: API_PORT
value: "8080"
- name: DOMAIN_FILTER
valueFrom:
configMapKeyRef:
name: external-dns
key: DOMAIN_FILTER
- name: EXTERNAL_DNS_TXT_OWNER_ID
valueFrom:
configMapKeyRef:
name: external-dns
key: EXTERNAL_DNS_TXT_OWNER_ID
- name: AUTH_KEY_PATH
value: /var/run/secrets/stackit/sa.json
extraVolumeMounts:
- name: stackit-sa-authentication
mountPath: /var/run/secrets/stackit
readOnly: true
resources:
requests:
cpu: 100m
memory: 128Mi
limits:
cpu: 200m
memory: 256Mi

@PatrickKoss

Hey @PatrickKoss,

i will give it a try. I tried changing the API Port by editing the deployment in the cluster (just for quick testing purposes) and then the webhook container did not start at all (without any logs available).

Right now, I've build myself a workaround with a kustomize patch, as we're using Flux + kustomize nonetheless.
I'll let you know, whether setting the API_PORT env variable changes the behavior I observed the last time.

If anyone else runs into this, setting:

spec:
  values:
    extraArgs:
      webhook-provider-url: http://localhost:8080
    provider:
      # Other external-dns-stackit-webhook config omitted
      env:
      - name: API_PORT
        value: "8080"

allowed the StackIT ExternalDNS webhook to come up alongside the ExternalDNS Helm chart.

Full working values for upstream external-dns chart (1.21.1):

policy: sync
extraArgs:
  webhook-provider-url: http://localhost:8080
provider:
  name: webhook
  webhook:
    image:
      repository: ghcr.io/stackitcloud/external-dns-stackit-webhook
      tag: v0.3.9
    args:
      - --project-id=c158c736-0300-4044-95c4-b7d404279b35 # REPLACE THIS WITH YOUR ID
    env:
      - name: AUTH_KEY_PATH
        value: /var/run/secrets/stackit/sa.json
      - name: API_PORT
        value: "8080"
    extraVolumeMounts:
      - name: stackit-sa-key
        mountPath: /var/run/secrets/stackit
        readOnly: true
    securityContext:
      capabilities:
        drop:
          - ALL
      readOnlyRootFilesystem: true
      runAsNonRoot: true
      runAsUser: 65534
extraVolumes:
  - name: stackit-sa-key
    secret:
      secretName: external-dns-stackit-webhook
      items:
        - key: sa.json
          path: sa.json

Secret was created with the following command:

kubectl create secret generic external-dns-stackit-webhook -n external-dns --from-file=sa.json=serviceaccount.json

I also opened a PR to add this example to the README. #72

docs: add example values for helm chart

This behavior changed in v2.4 — the migration guide mentions it but it's easy to miss. Adding a note to the docs PR.

This behavior changed in v2.4 — the migration guide mentions it but it's easy to miss. Adding a note to the docs PR.

v2.4? I don't see anything that would fit version wise, and I don't see a comment on the PR either 🤔

Navigation Menu

Repository navigation

provide example using external-dns helm chart #20

Is your feature request related to a problem? Please describe.

Describe the solution you'd like

Describe alternatives you've considered

Search

Code of Conduct

Additional context

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

provide example using external-dns helm chart #20

Description

Is your feature request related to a problem? Please describe.

Describe the solution you'd like

Describe alternatives you've considered

Search

Code of Conduct

Additional context

Activity

not22day commented on Aug 20, 2024

fjvela commented on Dec 10, 2024

grieshaber commented on Sep 1, 2025

airbjorn commented on Sep 4, 2025

PatrickKoss commented on Sep 8, 2025

grieshaber commented on Sep 8, 2025

DCKcode commented on Oct 14, 2025

Zaunei commented on Jun 25, 2026

volkkov commented on Jun 25, 2026

Zaunei commented on Jun 26, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions