Answers: <p>I have found the solution.</p>
  <p>The wildcard record will not create anymore once removed the <code>tls</code> section under <code>spec</code>. I was using the Certificate Discovery feature by <code>tls</code> field. Now I use the <code>Discover vis Ingress host rule</code> method.</p>
  <p>Reference: <a href="https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.2/guide/ingress/cert_discovery/" rel="nofollow noreferrer">https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.2/guide/ingress/cert_discovery/</a></p>
  <p>This is my updated ingress.yaml,</p>
  <pre><code>apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    name: ingress
    annotations:
      alb.ingress.kubernetes.io/scheme: internet-facing
      alb.ingress.kubernetes.io/target-type: ip
      alb.ingress.kubernetes.io/listen-ports: '[{&quot;HTTPS&quot;: 443}]'
      alb.ingress.kubernetes.io/load-balancer-name: ingress-test
  spec:
    ingressClassName: alb
    rules:
    - host: abc.example.com
      http:
        paths:
        - pathType: Prefix
          path: &quot;/&quot;
          backend:
            service:
              name: abc
              port: 
                number: 80
  </code></pre>
  <p>However, I doubt a wildcard record should be created just because of using Discover vis Ingress tls method, as this is just a way of attaching TLS certificate instead of a route. Not sure if this case has been discussed before.</p>
  <p>Created an issue in official repository: <a href="https://github.com/kubernetes-sigs/external-dns/issues/4348" rel="nofollow noreferrer">https://github.com/kubernetes-sigs/external-dns/issues/4348</a></p>
  
Answers: CC BY-SA 4.0
Answers: 2024-04-01T19:30:46.753Z
Answers: 2024-04-01T19:30:46.753Z
Answers: Tony Chan
Body: <p>I am now setting up External DNS to automate the DNS records creation on AWS Route53 for EKS Ingresses. I now have a working setup that can create and delete records depends on ingress existence. However, during the creation, it also created wildcard records for me.</p>
  <p>For example, in my Ingress rules, there is only one record abc.example.com. I expect only A and TXT record for abc.example.com would be created. However, there are 6 records in total, 3 for abc.example.com and 3 for *.example.com.</p>
  <p>Here is my ingress.yaml and the values.yaml of External-DNS deployment,</p>
  <pre><code>apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    name: ingress
    annotations:
      alb.ingress.kubernetes.io/scheme: internet-facing
      alb.ingress.kubernetes.io/target-type: ip
      alb.ingress.kubernetes.io/listen-ports: '[{&quot;HTTPS&quot;: 443}]'
      alb.ingress.kubernetes.io/load-balancer-name: ingress-test
  spec:
    ingressClassName: alb
      tls:
      - hosts:
        - &quot;*.example.com&quot;
    rules:
    - host: abc.example.com
      http:
        paths:
        - pathType: Prefix
          path: &quot;/&quot;
          backend:
            service:
              name: abc
              port: 
                number: 80
  </code></pre>
  <pre><code>sources:
    - ingress
  policy: sync
  registry: txt
  txtOwnerId: external-dns
  domainFilters:
    - example.com
  </code></pre>
  <p>And the logs during creation,</p>
  <pre><code>time=&quot;2024-03-28T17:59:36Z&quot; level=info msg=&quot;Desired change: CREATE *.example.com A [Id: /hostedzone/123]&quot;
  time=&quot;2024-03-28T17:59:36Z&quot; level=info msg=&quot;Desired change: CREATE *.example.com TXT [Id: /hostedzone/123]&quot;
  time=&quot;2024-03-28T17:59:36Z&quot; level=info msg=&quot;Desired change: CREATE abc.example.com A [Id: /hostedzone/123]&quot;
  time=&quot;2024-03-28T17:59:36Z&quot; level=info msg=&quot;Desired change: CREATE abc.example.com TXT [Id: /hostedzone/123]&quot;
  time=&quot;2024-03-28T17:59:36Z&quot; level=info msg=&quot;Desired change: CREATE cname-*.example.com TXT [Id: /hostedzone/123]&quot;
  time=&quot;2024-03-28T17:59:123&quot; level=info msg=&quot;Desired change: CREATE cname-abc.example.com TXT [Id: /hostedzone/123]&quot;
  time=&quot;2024-03-28T17:59:37Z&quot; level=info msg=&quot;6 record(s) in zone example.com. [Id: /hostedzone/123] were successfully updated&quot;
  </code></pre>
  <p>Did I make any misconfiguration or it is a bug? External-DNS version <code>0.14.0</code> and Chart version <code>1.14.3</code>.</p>
  
Tags: <kubernetes><amazon-web-services><dns>
Title: How to not create wildcard records using External-DNS?
UserDisplayName: Tony Chan
ThreadText: # How to not create wildcard records using External-DNS?
  
  (Asked by: username_0 on 2024-04-01)
  
  I am now setting up External DNS to automate the DNS records creation on AWS Route53 for EKS Ingresses. I now have a working setup that can create and delete records depends on ingress existence. However, during the creation, it also created wildcard records for me.
  
  For example, in my Ingress rules, there is only one record abc.example.com. I expect only A and TXT record for abc.example.com would be created. However, there are 6 records in total, 3 for abc.example.com and 3 for \*.example.com.
  
  Here is my ingress.yaml and the values.yaml of External-DNS deployment,
  
  ```
  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    name: ingress
    annotations:
      alb.ingress.kubernetes.io/scheme: internet-facing
      alb.ingress.kubernetes.io/target-type: ip
      alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS": 443}]'
      alb.ingress.kubernetes.io/load-balancer-name: ingress-test
  spec:
    ingressClassName: alb
      tls:
      - hosts:
        - "*.example.com"
    rules:
    - host: abc.example.com
      http:
        paths:
        - pathType: Prefix
          path: "/"
          backend:
            service:
              name: abc
              port: 
                number: 80
  
  ```
  
  ```
  sources:
    - ingress
  policy: sync
  registry: txt
  txtOwnerId: external-dns
  domainFilters:
    - example.com
  
  ```
  
  And the logs during creation,
  
  ```
  time="2024-03-28T17:59:36Z" level=info msg="Desired change: CREATE *.example.com A [Id: /hostedzone/123]"
  time="2024-03-28T17:59:36Z" level=info msg="Desired change: CREATE *.example.com TXT [Id: /hostedzone/123]"
  time="2024-03-28T17:59:36Z" level=info msg="Desired change: CREATE abc.example.com A [Id: /hostedzone/123]"
  time="2024-03-28T17:59:36Z" level=info msg="Desired change: CREATE abc.example.com TXT [Id: /hostedzone/123]"
  time="2024-03-28T17:59:36Z" level=info msg="Desired change: CREATE cname-*.example.com TXT [Id: /hostedzone/123]"
  time="2024-03-28T17:59:123" level=info msg="Desired change: CREATE cname-abc.example.com TXT [Id: /hostedzone/123]"
  time="2024-03-28T17:59:37Z" level=info msg="6 record(s) in zone example.com. [Id: /hostedzone/123] were successfully updated"
  
  ```
  
  Did I make any misconfiguration or it is a bug? External-DNS version `0.14.0` and Chart version `1.14.3`.
  
  **Tags:** kubernetes, amazon-web-services, dns
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2024-04-01. Score: 0 | Accepted answer
  
  I have found the solution.
  
  The wildcard record will not create anymore once removed the `tls` section under `spec`. I was using the Certificate Discovery feature by `tls` field. Now I use the `Discover vis Ingress host rule` method.
  
  Reference: <https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.2/guide/ingress/cert_discovery/>
  
  This is my updated ingress.yaml,
  
  ```
  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    name: ingress
    annotations:
      alb.ingress.kubernetes.io/scheme: internet-facing
      alb.ingress.kubernetes.io/target-type: ip
      alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS": 443}]'
      alb.ingress.kubernetes.io/load-balancer-name: ingress-test
  spec:
    ingressClassName: alb
    rules:
    - host: abc.example.com
      http:
        paths:
        - pathType: Prefix
          path: "/"
          backend:
            service:
              name: abc
              port: 
                number: 80
  
  ```
  
  However, I doubt a wildcard record should be created just because of using Discover vis Ingress tls method, as this is just a way of attaching TLS certificate instead of a route. Not sure if this case has been discussed before.
  
  Created an issue in official repository: <https://github.com/kubernetes-sigs/external-dns/issues/4348>
  
  
  ---
  
  