external-dns
Helm chart
Request a free trial
Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.
Tag:
Compare:
1
# Default values for external-dns.
2
# This is a YAML-formatted file.
3
# Declare variables to be passed into your templates.
4
5
global:
6
# -- Global image pull secrets.
7
imagePullSecrets: [] # @schema item: object
8
image: # @schema additionalProperties: false
9
# -- Image repository for the `external-dns` container.
10
repository: cgr.dev/chainguard-private/external-dns-fips
11
# -- Image tag for the `external-dns` container, this will default to `.Chart.AppVersion` if not set.
12
tag: 0.22.0@sha256:e0c2fab9f8c02bbc6fb35410daad01986b40878e6ba75523d7423fcf2ac71fd9 # @schema type:[string, null]
13
# -- Image pull policy for the `external-dns` container.
14
pullPolicy: IfNotPresent # @schema enum:[IfNotPresent, Always]
15
# -- Image pull secrets.
16
imagePullSecrets: [] # @schema item: object
17
# -- (string) Override the name of the chart.
18
nameOverride: # @schema type:[string, null]; default: null
19
# -- (string) Override the full name of the chart.
20
fullnameOverride: # @schema type:[string, null]; default: null
21
# -- (string) Override the namespace that chart resources are rendered into.
22
# Defaults to the release namespace. Useful when installing the chart as a
23
# subchart that should live in its own namespace, separate from the umbrella
24
# release namespace.
25
namespaceOverride: # @schema type:[string, null]; default: null
26
# -- Labels to add to all chart resources.
27
commonLabels: {}
28
serviceAccount:
29
# -- If `true`, create a new `ServiceAccount`.
30
create: true
31
# -- Labels to add to the service account.
32
labels: {}
33
# -- Annotations to add to the service account. Templates are allowed in both the key and the value. Example: `example.com/annotation/{{ .Values.nameOverride }}: {{ .Values.nameOverride }}`
34
annotations: {}
35
# -- (string) If this is set and `serviceAccount.create` is `true` this will be used for the created `ServiceAccount` name, if set and `serviceAccount.create` is `false` then this will define an existing `ServiceAccount` to use.
36
name: # @schema type:[string, null]; default: null
37
# -- Set this to `false` to [opt out of API credential automounting](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#opt-out-of-api-credential-automounting) for the `ServiceAccount`.
38
automountServiceAccountToken: true
39
service:
40
# -- Service annotations.
41
annotations: {}
42
# -- Service HTTP port.
43
port: 7979 # @schema minimum:0; default:7979
44
# -- Service IP families (e.g. IPv4 and/or IPv6).
45
ipFamilies: [] # @schema type: [array, null]; item: string; itemEnum: ["IPv4", "IPv6"]; minItems:0; maxItems:2; uniqueItems: true
46
# - IPv4
47
# - IPv6
48
# -- Service IP family policy.
49
ipFamilyPolicy: # @schema type: [string, null]; enum:[SingleStack, PreferDualStack, RequireDualStack, null]
50
# -- If `true`, create a `Service` Kubernetes.
51
enabled: true
52
rbac: # @schema additionalProperties: true
53
# -- If `true`, create a `ClusterRole` & `ClusterRoleBinding` with access to the Kubernetes API.
54
create: true
55
# -- Additional rules to add to the `ClusterRole`.
56
additionalPermissions: []
57
# -- Number of replicas of the `external-dns` `Deployment`. external-dns does not
58
# support leader election, so this must be `0` or `1` to avoid duplicate or
59
# conflicting DNS record updates. Set to `0` to scale the `Deployment` down.
60
replicaCount: 1 # @schema minimum:0; maximum:1
61
# -- Annotations to add to the `Deployment`.
62
deploymentAnnotations: {}
63
# -- Extra containers to add to the `Deployment`.
64
extraContainers: []
65
# -- [Deployment Strategy](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy).
66
deploymentStrategy: # @schema additionalProperties: true
67
type: Recreate # @schema enum:[Recreate, RollingUpdate]; type:string; default: Recreate
68
# -- (int) Specify the number of old `ReplicaSets` to retain to allow rollback of the `Deployment``.
69
revisionHistoryLimit: # @schema type:[integer, null];minimum:0
70
# -- Labels to add to the `Pod`.
71
podLabels: {}
72
# -- Annotations to add to the `Pod`.
73
podAnnotations: {}
74
# -- (bool) Set this to `false` to [opt out of API credential automounting](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#opt-out-of-api-credential-automounting) for the `Pod`.
75
automountServiceAccountToken: true
76
# -- If `true`, the `Pod` will have [process namespace sharing](https://kubernetes.io/docs/tasks/configure-pod-container/share-process-namespace/) enabled.
77
shareProcessNamespace: false
78
# -- [Pod security context](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#podsecuritycontext-v1-core), this supports full customisation.
79
# @default -- See _values.yaml_
80
podSecurityContext:
81
runAsNonRoot: true
82
fsGroup: 65534
83
seccompProfile:
84
type: RuntimeDefault
85
# -- (string) Priority class name for the `Pod`.
86
priorityClassName: # @schema type:[string, null]; default: null
87
# -- (int) Termination grace period for the `Pod` in seconds.
88
terminationGracePeriodSeconds: # @schema type:[integer, null]
89
# -- (string) [DNS policy](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy) for the pod, if not set the default will be used.
90
dnsPolicy: # @schema type:[string, null]; default: null
91
# -- (object) [DNS config](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config) for the pod, if not set the default will be used.
92
dnsConfig: # @schema type:[object, null]; default: null
93
# -- [Host aliases](https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/) to add to the `Pod` definition, injected into the pod's `/etc/hosts`.
94
hostAliases: []
95
# -- [Init containers](https://kubernetes.io/docs/concepts/workloads/pods/init-containers/) to add to the `Pod` definition.
96
initContainers: []
97
# -- [Security context](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) for the `external-dns` container.
98
# @default -- See _values.yaml_
99
securityContext:
100
privileged: false
101
allowPrivilegeEscalation: false
102
readOnlyRootFilesystem: true
103
runAsNonRoot: true
104
runAsUser: 65532
105
runAsGroup: 65532
106
capabilities:
107
drop: ["ALL"]
108
# -- [Environment variables](https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) for the `external-dns` container.
109
env: []
110
# -- [Liveness probe](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/) configuration for the `external-dns` container.
111
# @default -- See _values.yaml_
112
livenessProbe:
113
httpGet:
114
path: /healthz
115
port: http
116
initialDelaySeconds: 10
117
periodSeconds: 10
118
timeoutSeconds: 5
119
failureThreshold: 2
120
successThreshold: 1
121
# -- [Readiness probe](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/) configuration for the `external-dns` container.
122
# @default -- See _values.yaml_
123
readinessProbe:
124
httpGet:
125
path: /healthz
126
port: http
127
initialDelaySeconds: 5
128
periodSeconds: 10
129
timeoutSeconds: 5
130
failureThreshold: 6
131
successThreshold: 1
132
# -- Extra [volumes](https://kubernetes.io/docs/concepts/storage/volumes/) for the `Pod`.
133
extraVolumes: []
134
# -- Extra [volume mounts](https://kubernetes.io/docs/concepts/storage/volumes/) for the `external-dns` container.
135
extraVolumeMounts: []
136
# -- [Resources](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) for the `external-dns` container.
137
resources: {}
138
# -- Node labels to match for `Pod` [scheduling](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/).
139
nodeSelector: {}
140
# -- Affinity settings for `Pod` [scheduling](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/). If an explicit label selector is not provided for pod affinity or pod anti-affinity one will be created from the pod selector labels.
141
affinity: {}
142
# -- Topology spread constraints for `Pod` [scheduling](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/). If an explicit label selector is not provided one will be created from the pod selector labels.
143
topologySpreadConstraints: []
144
# -- Node taints which will be tolerated for `Pod` [scheduling](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/).
145
tolerations: []
146
serviceMonitor:
147
# -- If `true`, create a `ServiceMonitor` resource to support the _Prometheus Operator_.
148
enabled: false
149
# -- Additional labels for the `ServiceMonitor`.
150
additionalLabels: {}
151
# -- Annotations to add to the `ServiceMonitor`.
152
annotations: {}
153
# -- (string) If set create the `ServiceMonitor` in an alternate namespace.
154
namespace: # @schema type:[string, null]; default: null
155
# -- (string) If set override the _Prometheus_ default interval.
156
interval: # @schema type:[string, null]; default: null
157
# -- (string) If set override the _Prometheus_ default scrape timeout.
158
scrapeTimeout: # @schema type:[string, null]; default: null
159
# -- (string) If set overrides the _Prometheus_ default scheme.
160
scheme: # @schema type:[string, null]; default: null
161
# -- Configure the `ServiceMonitor` [TLS config](https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#tlsconfig).
162
tlsConfig: {}
163
# -- (string) Provide a bearer token file for the `ServiceMonitor`.
164
bearerTokenFile: # @schema type:[string, null]; default: null
165
# -- [Relabel configs](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config) to apply to samples before ingestion.
166
relabelings: []
167
# -- [Metric relabel configs](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#metric_relabel_configs) to apply to samples before ingestion.
168
metricRelabelings: []
169
# -- Provide target labels for the `ServiceMonitor`.
170
targetLabels: []
171
# -- Log level.
172
logLevel: info # @schema enum:[panic, debug, info, warning, error, fatal]; type:string; default: "info"
173
# -- Log format.
174
logFormat: text # @schema enum:["text", "json"]; type:string; default: "text"
175
# -- Interval for DNS updates.
176
interval: 1m
177
# -- If `true`, triggers run loop on create/update/delete events in addition of regular interval.
178
triggerLoopOnEvent: false
179
# -- if `true`, _ExternalDNS_ will run in a namespaced scope (`Role`` and `Rolebinding`` will be namespaced too).
180
namespaced: false
181
# -- if `true`, the Gateway API ListenerSet flag will be enabled.
182
enableGatewayListenerSets: false
183
# -- _Gateway API_ gateway namespace to watch.
184
# When `namespaced=true`, setting this value avoids creating any cluster-scoped RBAC
185
# (no ClusterRole/ClusterRoleBinding) for Gateway sources.
186
gatewayNamespace: # @schema type:[string, null]; default: null
187
# -- Source namespace to watch for Kubernetes resources other than Gateway API gateways.
188
# Used only when `namespaced=true`. Defaults to Release.Namespace
189
sourceNamespace: # @schema type:[string, null]; default: null
190
# -- _Kubernetes_ resources to monitor for DNS entries.
191
sources:
192
- service
193
- ingress
194
# -- (REQUIRED) How DNS records are synchronized between sources and providers; must be set explicitly to one of `create-only`, `sync`, or `upsert-only`.
195
policy: # @schema enum:[create-only, sync, upsert-only]; type:string; required:true
196
# -- Specify the registry for storing ownership and labels.
197
# Valid values are `txt`, `aws-sd`, `crd`, `dynamodb` & `noop`.
198
registry: txt # @schema enum:[txt, aws-sd, crd, dynamodb, noop]; default: "txt"
199
# -- (string) Specify an identifier for this instance of _ExternalDNS_ when using a registry other than `noop`.
200
txtOwnerId: # @schema type:[string, null]; default: null
201
# -- (string) Specify a prefix for the domain names of TXT records created for the `txt` registry.
202
# Mutually exclusive with `txtSuffix`.
203
txtPrefix: # @schema type:[string, null]; default: null
204
# -- (string) Specify a suffix for the domain names of TXT records created for the `txt` registry.
205
# Mutually exclusive with `txtPrefix`.
206
txtSuffix: # @schema type:[string, null]; default: null
207
# -- Limit possible target zones by domain suffixes.
208
domainFilters: []
209
# -- Intentionally exclude domains from being managed.
210
excludeDomains: []
211
# -- Filter resources queried for endpoints by label selector.
212
labelFilter: # @schema type: [string,null]; default: null
213
# -- Filter resources queried for endpoints by annotation selector.
214
annotationFilter: # @schema type: [string,null]; default: null
215
# -- Annotation prefix for external-dns annotations (useful for split horizon DNS with multiple instances).
216
annotationPrefix: # @schema type: [string,null]; default: null
217
# -- Record types to manage (default: A, AAAA, CNAME)
218
managedRecordTypes: [] # @schema type: [array, null]; item: string; uniqueItems: true
219
provider: # @schema type: [object, string]
220
# -- _ExternalDNS_ provider name; for the available providers and how to configure them see [README](https://github.com/kubernetes-sigs/external-dns/blob/master/charts/external-dns/README.md#providers).
221
name: aws
222
webhook:
223
image:
224
# -- (string) Image repository for the `webhook` container.
225
repository: cgr.dev/chainguard-private/external-dns-fips # @schema type:[string, null]; default: null
226
# -- (string) Image tag for the `webhook` container.
227
tag: 0.22.0@sha256:e0c2fab9f8c02bbc6fb35410daad01986b40878e6ba75523d7423fcf2ac71fd9 # @schema type:[string, null]; default: null
228
# -- Image pull policy for the `webhook` container.
229
pullPolicy: IfNotPresent
230
# -- [Environment variables](https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) for the `webhook` container.
231
env: []
232
# -- Extra arguments to provide for the `webhook` container.
233
args: []
234
# -- Extra [volume mounts](https://kubernetes.io/docs/concepts/storage/volumes/) for the `webhook` container.
235
extraVolumeMounts: []
236
# -- [Resources](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) for the `webhook` container.
237
resources: {}
238
# -- [Pod security context](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) for the `webhook` container.
239
# @default -- See _values.yaml_
240
securityContext: {}
241
# -- [Liveness probe](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/) configuration for the `external-dns` container.
242
# @default -- See _values.yaml_
243
livenessProbe:
244
httpGet:
245
path: /healthz # @schema type:[string, null]; default: null
246
port: http-webhook # @schema type:[integer,string]; default: string
247
initialDelaySeconds: 10 # @schema type:[integer, null]; default: null
248
periodSeconds: 10 # @schema type:[integer, null]; default: null
249
timeoutSeconds: 5 # @schema type:[integer, null]; default: null
250
failureThreshold: 2 # @schema type:[integer, null]; default: null
251
successThreshold: 1 # @schema type:[integer, null]; default: null
252
# -- [Readiness probe](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/) configuration for the `webhook` container.
253
# @default -- See _values.yaml_
254
readinessProbe:
255
httpGet:
256
path: /healthz # @schema type:[string, null]; default: null
257
port: http-webhook # @schema type:[integer,string]; default: string
258
initialDelaySeconds: 5 # @schema type:[integer, null]; default: null
259
periodSeconds: 10 # @schema type:[integer, null]; default: null
260
timeoutSeconds: 5 # @schema type:[integer, null]; default: null
261
failureThreshold: 6 # @schema type:[integer, null]; default: null
262
successThreshold: 1 # @schema type:[integer, null]; default: null
263
service:
264
# -- Webhook exposed HTTP port for the service.
265
port: 8080
266
# -- Optional [Service Monitor](https://prometheus-operator.dev/docs/operator/design/#servicemonitor) configuration for the `webhook` container.
267
# @default -- See _values.yaml_
268
serviceMonitor:
269
interval: # @schema type:[string, null]; default: null
270
scheme: # @schema type:[string, null]; default: null
271
tlsConfig: {}
272
bearerTokenFile: # @schema type:[string, null]; default: null
273
scrapeTimeout: # @schema type:[string, null]; default: null
274
metricRelabelings: []
275
relabelings: []
276
# -- Extra arguments to provide to _ExternalDNS_.
277
# An array or map can be used, with maps allowing for value overrides; maps also support slice values to use the same arg multiple times.
278
extraArgs: {} # @schema type: [array, null, object]; item: string; uniqueItems: true
279
secretConfiguration:
280
# -- If `true`, create a `Secret` to store sensitive provider configuration (**DEPRECATED**).
281
enabled: false
282
# -- Mount path for the `Secret`, this can be templated.
283
mountPath: # @schema type:[string, null]; default: null
284
# -- Sub-path for mounting the `Secret`, this can be templated.
285
subPath: # @schema type:[string, null]; default: null
286
# -- `Secret` data.
287
data: {}
288
# -- (bool) No effect - reserved for use in sub-charting.
289
enabled: # @schema type: [boolean, null]; description: No effect - reserved for use in sub-charting
290
The trusted source for open source
Talk to an expertProduct
Customers
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.