From 611ca2b78af9caac0e9c92492f83c761414c8384 Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Sat, 18 Jul 2026 22:40:34 +0200 Subject: [PATCH] fix(external-dns): restrict Cloudflare record scope --- k8s/clusters/prod/bootstrap/config-map.yaml | 2 ++ .../hetzner/infrastructure/external-dns/helm-release.yaml | 3 +++ 2 files changed, 5 insertions(+) diff --git a/k8s/clusters/prod/bootstrap/config-map.yaml b/k8s/clusters/prod/bootstrap/config-map.yaml index 0ed018558..6a9fa502c 100644 --- a/k8s/clusters/prod/bootstrap/config-map.yaml +++ b/k8s/clusters/prod/bootstrap/config-map.yaml @@ -7,6 +7,8 @@ metadata: data: cluster_name: prod domain: platform.devantler.tech + # Escaped form of domain for external-dns --regex-domain-filter. + external_dns_domain_regex: 'platform\.devantler\.tech' github_app_client_id: Iv23limfvbk93bAXZI6b issuer_group: cert-manager.io issuer_kind: ClusterIssuer diff --git a/k8s/providers/hetzner/infrastructure/external-dns/helm-release.yaml b/k8s/providers/hetzner/infrastructure/external-dns/helm-release.yaml index 7d31b4e91..f2594feba 100644 --- a/k8s/providers/hetzner/infrastructure/external-dns/helm-release.yaml +++ b/k8s/providers/hetzner/infrastructure/external-dns/helm-release.yaml @@ -36,6 +36,9 @@ spec: - "${cloudflare_zone}" extraArgs: - --exclude-target-net=10.0.0.0/8 + # Restrict Gateway HTTPRoute-derived records to this cluster's delegated + # DNS subtree while domainFilters still selects the Cloudflare zone apex. + - --regex-domain-filter=^([a-z0-9]([-a-z0-9]*[a-z0-9])?\.)*${external_dns_domain_regex}$ - --cloudflare-proxied env: - name: CF_API_TOKEN