external-dns.alpha.kubernetes.io/target only works for policy upsert-only

[martinsarrionandia]

What happened:

external-dns.alpha.kubernetes.io/target only works when policy is set to upsert-only.

When the policy is set to sync then the cluster IP is chosen instead and the annotation is ignored, or maybe replaced?. My cluster IP is a private address;

What you expected to happen:

I expected the annotation to in sync mode.

How to reproduce it (as minimally and precisely as possible):

Already described.

Anything else we need to know?:

Environment:

• External-DNS version (use external-dns --version):external-dns:1.15.2
• DNS provider: AWS
• Others: Rancher on K3S Single node.

[ivankatliarchuk]

Share manifests and all arguments (not helm) so we could reproduce

[martinsarrionandia]

Hi, My helm chart is generated dynamically through terraform.
Which manifests do you need? Deployment / Ingress etc?

[martinsarrionandia]

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt
    external-dns.alpha.kubernetes.io/hostname: photobooth.wales
    external-dns.alpha.kubernetes.io/target: 18.130.107.159
    field.cattle.io/publicEndpoints: >-
      [{"addresses":["10.0.1.249"],"port":443,"protocol":"HTTPS","serviceName":"mojobooth-wordpress:mojobooth-wordpress","ingressName":"mojobooth-wordpress:mojobooth","hostname":"photobooth.wales","path":"/","allNodes":false}]
    traefik.ingress.kubernetes.io/router.middlewares: >-
      mojobooth-wordpress-mojobooth-cdn-rewrite@kubernetescrd,
      traefik-bouncer@kubernetescrd
  creationTimestamp: '2025-03-13T20:58:55Z'
  generation: 1
  labels:
    app: wordpress
  managedFields:
    - apiVersion: networking.k8s.io/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:cert-manager.io/cluster-issuer: {}
            f:external-dns.alpha.kubernetes.io/hostname: {}
            f:external-dns.alpha.kubernetes.io/target: {}
            f:traefik.ingress.kubernetes.io/router.middlewares: {}
          f:labels:
            f:app: {}
        f:spec:
          f:rules: {}
          f:tls: {}
      manager: Terraform
      operation: Apply
      time: '2025-03-13T20:58:55Z'
    - apiVersion: networking.k8s.io/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:field.cattle.io/publicEndpoints: {}
      manager: rancher
      operation: Update
      time: '2025-03-13T20:58:55Z'
    - apiVersion: networking.k8s.io/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:loadBalancer:
            f:ingress: {}
      manager: traefik
      operation: Update
      subresource: status
      time: '2025-03-13T20:58:55Z'
  name: mojobooth
  namespace: mojobooth-wordpress
  resourceVersion: '668218'
  uid: 4277bf67-51d3-4601-92a5-04b36fe945fb
spec:
  ingressClassName: traefik
  rules:
    - host: photobooth.wales
      http:
        paths:
          - backend:
              service:
                name: mojobooth-wordpress
                port:
                  number: 80
            path: /
            pathType: Prefix
  tls:
    - hosts:
        - photobooth.wales
      secretName: letsencrypt
status:
  loadBalancer:
    ingress:
      - ip: 10.0.1.249
```YAML

[martinsarrionandia]

apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    deployment.kubernetes.io/revision: '1'
    meta.helm.sh/release-name: external-dns
    meta.helm.sh/release-namespace: extertnal-dns-aws
  creationTimestamp: '2025-03-16T21:16:50Z'
  generation: 1
  labels:
    app.kubernetes.io/instance: external-dns
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: external-dns
    app.kubernetes.io/version: 0.15.1
    helm.sh/chart: external-dns-1.15.2
  managedFields:
    - apiVersion: apps/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:meta.helm.sh/release-name: {}
            f:meta.helm.sh/release-namespace: {}
          f:labels:
            .: {}
            f:app.kubernetes.io/instance: {}
            f:app.kubernetes.io/managed-by: {}
            f:app.kubernetes.io/name: {}
            f:app.kubernetes.io/version: {}
            f:helm.sh/chart: {}
        f:spec:
          f:progressDeadlineSeconds: {}
          f:replicas: {}
          f:revisionHistoryLimit: {}
          f:selector: {}
          f:strategy:
            f:type: {}
          f:template:
            f:metadata:
              f:labels:
                .: {}
                f:app.kubernetes.io/instance: {}
                f:app.kubernetes.io/name: {}
            f:spec:
              f:containers:
                k:{"name":"external-dns"}:
                  .: {}
                  f:args: {}
                  f:env:
                    .: {}
                    k:{"name":"AWS_DEFAULT_REGION"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                  f:image: {}
                  f:imagePullPolicy: {}
                  f:livenessProbe:
                    .: {}
                    f:failureThreshold: {}
                    f:httpGet:
                      .: {}
                      f:path: {}
                      f:port: {}
                      f:scheme: {}
                    f:initialDelaySeconds: {}
                    f:periodSeconds: {}
                    f:successThreshold: {}
                    f:timeoutSeconds: {}
                  f:name: {}
                  f:ports:
                    .: {}
                    k:{"containerPort":7979,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:name: {}
                      f:protocol: {}
                  f:readinessProbe:
                    .: {}
                    f:failureThreshold: {}
                    f:httpGet:
                      .: {}
                      f:path: {}
                      f:port: {}
                      f:scheme: {}
                    f:initialDelaySeconds: {}
                    f:periodSeconds: {}
                    f:successThreshold: {}
                    f:timeoutSeconds: {}
                  f:resources:
                    .: {}
                    f:requests:
                      .: {}
                      f:cpu: {}
                  f:securityContext:
                    .: {}
                    f:allowPrivilegeEscalation: {}
                    f:capabilities:
                      .: {}
                      f:drop: {}
                    f:privileged: {}
                    f:readOnlyRootFilesystem: {}
                    f:runAsGroup: {}
                    f:runAsNonRoot: {}
                    f:runAsUser: {}
                  f:terminationMessagePath: {}
                  f:terminationMessagePolicy: {}
              f:dnsPolicy: {}
              f:restartPolicy: {}
              f:schedulerName: {}
              f:securityContext:
                .: {}
                f:fsGroup: {}
                f:runAsNonRoot: {}
                f:seccompProfile:
                  .: {}
                  f:type: {}
              f:serviceAccount: {}
              f:serviceAccountName: {}
              f:terminationGracePeriodSeconds: {}
      manager: terraform-provider-helm_v2.17.0_x5
      operation: Update
      time: '2025-03-16T21:16:50Z'
    - apiVersion: apps/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:deployment.kubernetes.io/revision: {}
        f:status:
          f:availableReplicas: {}
          f:conditions:
            .: {}
            k:{"type":"Available"}:
              .: {}
              f:lastTransitionTime: {}
              f:lastUpdateTime: {}
              f:message: {}
              f:reason: {}
              f:status: {}
              f:type: {}
            k:{"type":"Progressing"}:
              .: {}
              f:lastTransitionTime: {}
              f:lastUpdateTime: {}
              f:message: {}
              f:reason: {}
              f:status: {}
              f:type: {}
          f:observedGeneration: {}
          f:readyReplicas: {}
          f:replicas: {}
          f:updatedReplicas: {}
      manager: k3s
      operation: Update
      subresource: status
      time: '2025-03-16T21:17:02Z'
  name: external-dns
  namespace: extertnal-dns-aws
  resourceVersion: '1304241'
  uid: ccf89d69-9cbf-44d9-9eca-d68ab8e90bca
spec:
  progressDeadlineSeconds: 600
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app.kubernetes.io/instance: external-dns
      app.kubernetes.io/name: external-dns
  strategy:
    type: Recreate
  template:
    metadata:
      creationTimestamp: null
      labels:
        app.kubernetes.io/instance: external-dns
        app.kubernetes.io/name: external-dns
    spec:
      containers:
        - args:
            - '--log-level=info'
            - '--log-format=text'
            - '--interval=1m'
            - '--source=service'
            - '--source=ingress'
            - '--policy=upsert-only'
            - '--registry=txt'
            - '--provider=aws'
          env:
            - name: AWS_DEFAULT_REGION
              value: eu-west-2
          image: registry.k8s.io/external-dns/external-dns:v0.15.1
          imagePullPolicy: IfNotPresent
          livenessProbe:
            failureThreshold: 2
            httpGet:
              path: /healthz
              port: http
              scheme: HTTP
            initialDelaySeconds: 10
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 5
          name: external-dns
          ports:
            - containerPort: 7979
              name: http
              protocol: TCP
          readinessProbe:
            failureThreshold: 6
            httpGet:
              path: /healthz
              port: http
              scheme: HTTP
            initialDelaySeconds: 5
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 5
          resources:
            requests:
              cpu: 25m
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
            privileged: false
            readOnlyRootFilesystem: true
            runAsGroup: 65532
            runAsNonRoot: true
            runAsUser: 65532
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
      dnsPolicy: ClusterFirst
      restartPolicy: Always
      schedulerName: default-scheduler
      securityContext:
        fsGroup: 65534
        runAsNonRoot: true
        seccompProfile:
          type: RuntimeDefault
      serviceAccount: external-dns
      serviceAccountName: external-dns
      terminationGracePeriodSeconds: 30
status:
  availableReplicas: 1
  conditions:
    - lastTransitionTime: '2025-03-16T21:17:02Z'
      lastUpdateTime: '2025-03-16T21:17:02Z'
      message: Deployment has minimum availability.
      reason: MinimumReplicasAvailable
      status: 'True'
      type: Available
    - lastTransitionTime: '2025-03-16T21:16:50Z'
      lastUpdateTime: '2025-03-16T21:17:02Z'
      message: ReplicaSet "external-dns-7c9d8b6cfd" has successfully progressed.
      reason: NewReplicaSetAvailable
      status: 'True'
      type: Progressing
  observedGeneration: 1
  readyReplicas: 1
  replicas: 1
  updatedReplicas: 1

[martinsarrionandia]

I've changed it back to upsert above, and it start working. But set to 'sync' it doesn't