external-dns creates and deletes constantly the Cloudflare records for kind: HTTPRoute

[zentavr]

What happened: external-dns creates and deletes constantly the Cloudflare records for kind: HTTPRoute

What you expected to happen: external-dns operates only with annotated *Route

How to reproduce it (as minimally and precisely as possible):

1. Create one kind: Gateway with 2 listeners: HTTP and HTTPS. Add external-dns.alpha.kubernetes.io/target to the Gateway.
2. Create first HTTPRoute which is only the redirect to HTTPS, with no annotations, like:

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: etherpad-default
  namespace: etherpad
spec:
  hostnames:
  - pad.example.com
  parentRefs:
  - group: gateway.networking.k8s.io
    kind: Gateway
    name: public-gw
    namespace: sys-envoy-gw-public
    sectionName: http
  rules:
  - filters:
    - requestRedirect:
        scheme: https
        statusCode: 301
      type: RequestRedirect
    matches:
    - path:
        type: PathPrefix
        value: /

3. Create second HTTPRoute which points to the real Service, with annotations, like:

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  annotations:
    external-dns.alpha.kubernetes.io/cloudflare-proxied: "true"
    external-dns.alpha.kubernetes.io/ttl: "300"
  name: etherpad-https
  namespace: etherpad
spec:
  hostnames:
  - pad.example.com
  parentRefs:
  - group: gateway.networking.k8s.io
    kind: Gateway
    name: public-gw
    namespace: sys-envoy-gw-public
    sectionName: https-443
  rules:
  - backendRefs:
    - group: ""
      kind: Service
      name: etherpad
      port: 9001
      weight: 1
    matches:
    - path:
        type: PathPrefix
        value: /
    timeouts:
      backendRequest: 120s
      request: 120s

4. Check external-dns pod logs:

2026-08-17T00:36:43+02:00 time="2026-08-16T22:36:43Z" level=info msg="All records are already up to date"
2026-08-17T00:37:25+02:00 time="2026-08-16T22:37:25Z" level=info msg="Changing record." action=UPDATE record=pad.example.com ttl=1 type=A zone=d68******
2026-08-17T00:37:25+02:00 time="2026-08-16T22:37:25Z" level=info msg="Changing record." action=DELETE record=cf-htz-nbg1-dc3a-pad.example.com ttl=1 type=TXT zone=d68******
2026-08-17T00:37:25+02:00 time="2026-08-16T22:37:25Z" level=info msg="Changing record." action=CREATE record=cf-htz-nbg1-dc3a-pad.example.com ttl=1 type=TXT zone=d68******

If you check Cloudflare audit logs - you can see that the controller fights with itself for the same record because it thinks it comes from 2 HTTPRoutes when only the one route has any annotations.

Anything else we need to know?:

Environment:

• External-DNS version (use external-dns --version): 0.21.0
• DNS provider: Cloudflare
• Others:

Seems like the workaround there is to set up something like --annotation-filter or --label-filter and redo all the single source in the cluster which is a huge pain.

[zentavr]

One more way with a workaround, probably, is to annotate HTTPRoute with:

    annotations:
      external-dns.alpha.kubernetes.io/controller: "ignored"

The official doc says that if this annotation exists and has a value other than dns-controller then the source ignores the resource.