Summary

The sreportal.io/groups annotation on external-dns source resources was ignored: the groups showed up neither in the auto DNSRecords nor in the UI.

Two compounding causes, both fixed:

(A) adapter.EnrichEndpointLabels was dead code. The bridge that folds sreportal annotations from the resource onto the endpoint labels was never called. The source cycle now calls it on the freshly-resolved (unshared) endpoint, so the annotations reach ep.Labels.

(B) the v1alpha2 spec.entries projection couldn't carry multiple groups. endpointsToEntries only read the singular sreportal.io/group and DNSRecordEntry had no multi-group field. Add DNSRecordEntry.Groups []string; endpointsToEntries parses sreportal.io/groups (CSV) into it, and MaterialiseEntriesHandler re-injects it as the sreportal.io/groups status label so the read-side GroupMappingStrategy.Resolve (priority 1) projects the FQDN into all its groups.

Extract domaindns.SplitGroups, shared by Resolve and endpointsToEntries so the controller-side parse exactly matches the read side. CRD / deepcopy / helm / docs regenerated.

Notes

• The sreportal.io/groups status label is intentionally included in the endpoints hash (a groups change should refresh the projection); the join is deterministic, so no reconcile churn.
• v1alpha1↔v2 conversion needs no change — DNSRecordEntry round-trips whole via the spec annotation, so Groups is preserved automatically.
• ignore/portal/component annotations are folded onto source labels by the shared helper but are inert on the auto DNS path (dropped at spec.entries); only groups is carried through.

Test plan

• SplitGroups (csv/empty/whitespace)
• source cycle folds sreportal.io/groups onto the endpoint (A)
• endpointsToEntries parses multi-group into entry.Groups (B)
• MaterialiseEntriesHandler re-injects the sreportal.io/groups status label (B)
• go test -race, golangci-lint clean; CRD/helm/doc regenerated
• Review panel (exec-trace / silent-failure / code) — RAS

🤖 Generated with Claude Code