Regex including and excluding same records

[johnwc]

I have the helm chart installed using the following configuration. I have the regex filter added so to never create wildcard records.

provider:
  name: pdns
logLevel: debug
domainFilters:
  - ourdomain.net
  - ourdomain.dev
extraArgs:
  - --txt-wildcard-replacement=wildcard
  - --pdns-server=http://10.100.1.5:8081
  - --pdns-server-id=localhost
  - --annotation-filter=external-dns.alpha.kubernetes.io/exclude notin (true)
  - --regex-domain-filter=^[\w-]+(\.[\w-]+)*\.ourdomain\.(net|dev)$
  - --ignore-ingress-tls-spec
sources:
  - service
  - ingress
txtOwnerId: clst01

I see this in the logs. Shows first ignoring the correct domains, then saying it needs to create the others, then says it will ignore the others.

level=debug msg="Endpoints generated from ingress: ourdomain/ourdomain-web: [www.ourdomain.com 0 IN A  10.100.1.46 []]"
level=debug msg="Endpoints generated from ingress: cache/redis-insight-redisinsight: [prd01.cache.ourdomain.net 0 IN A  10.100.1.46 []]"
level=debug msg="Endpoints generated from ingress: ourdomain/jobs: [jobs.ourdomain.net 0 IN A  10.100.1.46 []]"
level=debug msg="Endpoints generated from ingress: ourdomain/preview-ourdomain-services-web: [preview.ourdomain.com 0 IN A  10.100.1.46 []]"
level=debug msg="Endpoints generated from ingress: ourdomain/ourdomain-api-api: [api.ourdomain.com 0 IN A  10.100.1.46 []]"
level=debug msg="ignoring record www.ourdomain.com that does not match domain filter"
level=debug msg="ignoring record preview.ourdomain.com that does not match domain filter"
level=debug msg="ignoring record api.ourdomain.com that does not match domain filter"
level=info msg="CREATE: prd01.cache.ourdomain.net 0 IN A  10.100.1.46 []"
level=info msg="CREATE: jobs.ourdomain.net 0 IN A  10.100.1.46 []"
level=info msg="CREATE: prd01.cache.ourdomain.net 0 IN TXT  \"heritage=external-dns,external-dns/owner=prd01,external-dns/resource=ingress/cache/redis-insight-redisinsight\" []"
level=info msg="CREATE: a-prd01.cache.ourdomain.net 0 IN TXT  \"heritage=external-dns,external-dns/owner=prd01,external-dns/resource=ingress/cache/redis-insight-redisinsight\" []"
level=info msg="CREATE: jobs.ourdomain.net 0 IN TXT  \"heritage=external-dns,external-dns/owner=prd01,external-dns/resource=ingress/ourdomain/jobs\" []"
level=info msg="CREATE: a-jobs.ourdomain.net 0 IN TXT  \"heritage=external-dns,external-dns/owner=prd01,external-dns/resource=ingress/ourdomain/jobs\" []"
level=debug msg="Ignoring Endpoint because it was matched to a zone that was not specified within Domain Filter(s): a-jobs.ourdomain.net."
level=debug msg="Ignoring Endpoint because it was matched to a zone that was not specified within Domain Filter(s): a-prd01.cache.ourdomain.net."
level=debug msg="Ignoring Endpoint because it was matched to a zone that was not specified within Domain Filter(s): jobs.ourdomain.net."
level=debug msg="Ignoring Endpoint because it was matched to a zone that was not specified within Domain Filter(s): jobs.ourdomain.net."
level=debug msg="Ignoring Endpoint because it was matched to a zone that was not specified within Domain Filter(s): prd01.cache.ourdomain.net."
level=debug msg="Ignoring Endpoint because it was matched to a zone that was not specified within Domain Filter(s): prd01.cache.ourdomain.net."
level=debug msg="Zone List generated from Endpoints: []"
level=info msg="Changes pushed out to PowerDNS in 6.507441ms\n"

[ivankatliarchuk]

Is it just confusing logs or what exactly the expected behaviour is?

[johnwc]

It's not creating the DNS records at all. Based on the regex, it should be creating the records for the two .net records as well as the txt records for them.

BTW, what is the difference between the two TXT records, one with a- and the other without?

[ivankatliarchuk]

In regards 2 TXT records is a long story. You could try latest 0.18 version, where we removed legacy TXT recrods support #5172

[ivankatliarchuk]

What version of external-dns is in use? Could you also share actual arguments, as helm paramaters not useful.

[johnwc]

The image is registry.k8s.io/external-dns/external-dns:v0.17.0. And the arguments are below.

--log-level=debug --log-format=text --interval=1m --source=service --source=ingress --policy=upsert-only --registry=txt --txt-owner-id=prd01 --domain-filter=ourdomain.net --domain-filter=ourdomain.dev --domain-filter=ourdomain2.net --domain-filter=ourdomain2.dev --provider=pdns --txt-wildcard-replacement=wildcard --pdns-server=http://10.100.1.5:8081 --pdns-server-id=localhost '--annotation-filter=external-dns.alpha.kubernetes.io/exclude notin (true)' --regex-domain-filter=^[\w-]+(\.[\w-]+)*\.(ourdomain|ourdomain2)\.(net|dev)$ --ignore-ingress-tls-spec

[johnwc]

If I try bumping it to v0.18.0 image, I get these errors.

E0705 01:09:11.875268       1 reflector.go:200] "Failed to watch" err="failed to list *v1.EndpointSlice: endpointslices.discovery.k8s.io is forbidden: User \"system:serviceaccount:infra:external-dns\" cannot list resource \"endpointslices\" in API group \"discovery.k8s.io\" at the cluster scope" logger="UnhandledError" reflector="k8s.io/client-go@v0.33.2/tools/cache/reflector.go:285" type="*v1.EndpointSlice"
E0705 01:09:13.328441       1 reflector.go:200] "Failed to watch" err="failed to list *v1.EndpointSlice: endpointslices.discovery.k8s.io is forbidden: User \"system:serviceaccount:infra:external-dns\" cannot list resource \"endpointslices\" in API group \"discovery.k8s.io\" at the cluster scope" logger="UnhandledError" reflector="k8s.io/client-go@v0.33.2/tools/cache/reflector.go:285" type="*v1.EndpointSlice"
E0705 01:09:16.098767       1 reflector.go:200] "Failed to watch" err="failed to list *v1.EndpointSlice: endpointslices.discovery.k8s.io is forbidden: User \"system:serviceaccount:infra:external-dns\" cannot list resource \"endpointslices\" in API group \"discovery.k8s.io\" at the cluster scope" logger="UnhandledError" reflector="k8s.io/client-go@v0.33.2/tools/cache/reflector.go:285" type="*v1.EndpointSlice"
E0705 01:09:19.375439       1 reflector.go:200] "Failed to watch" err="failed to list *v1.EndpointSlice: endpointslices.discovery.k8s.io is forbidden: User \"system:serviceaccount:infra:external-dns\" cannot list resource \"endpointslices\" in API group \"discovery.k8s.io\" at the cluster scope" logger="UnhandledError" reflector="k8s.io/client-go@v0.33.2/tools/cache/reflector.go:285" type="*v1.EndpointSlice"
E0705 01:09:30.053123       1 reflector.go:200] "Failed to watch" err="failed to list *v1.EndpointSlice: endpointslices.discovery.k8s.io is forbidden: User \"system:serviceaccount:infra:external-dns\" cannot list resource \"endpointslices\" in API group \"discovery.k8s.io\" at the cluster scope" logger="UnhandledError" reflector="k8s.io/client-go@v0.33.2/tools/cache/reflector.go:285" type="*v1.EndpointSlice"
I0705 01:09:41.878024       1 transport.go:356] "Warning: unable to cancel request" roundTripperType="*instrumented_http.Transport"
I0705 01:09:41.878887       1 transport.go:356] "Warning: unable to cancel request" roundTripperType="*instrumented_http.Transport"
I0705 01:09:41.903246       1 transport.go:356] "Warning: unable to cancel request" roundTripperType="*instrumented_http.Transport"
E0705 01:09:52.777470       1 reflector.go:200] "Failed to watch" err="failed to list *v1.EndpointSlice: endpointslices.discovery.k8s.io is forbidden: User \"system:serviceaccount:infra:external-dns\" cannot list resource \"endpointslices\" in API group \"discovery.k8s.io\" at the cluster scope" logger="UnhandledError" reflector="k8s.io/client-go@v0.33.2/tools/cache/reflector.go:285" type="*v1.EndpointSlice"
time="2025-07-05T01:

[ivankatliarchuk]

You do need to follow the error message. Rbac is missing permissions.

[ivankatliarchuk]

It would be great if you share a link to a local pdns tutorial, may be able to debug as well

[johnwc]

You do need to follow the error message. Rbac is missing permissions.

The helm chart is responsible for creating the rbac if needed, all I did was set the tag to the v0.18.0 image and it gave errors. Changed it back to the v0.17.0 image and the errors went away. Is there something new in the v0.18.0 image that is a breaking change from v0.17.0?

I am not sure what you are referring to with this comment It would be great if you share a link to a local pdns tutorial, may be able to debug as well, as this has nothing to do with the pdns server. The error Ignoring Endpoint because it was matched to a zone... is being written directly from your pdns provider. I think the check for the domain filter is reversed in the pdns provider. It seems to be excluding matched domains instead of including them.

[ivankatliarchuk]

The helm chart is responsible for creating the rbac if needed

This is an open-source project with independent release cycles for the image and Helm chart, driven by different volunteers.

/help

[k8s-ci-robot]

@ivankatliarchuk:
This request has been marked as needing help from a contributor.

Guidelines

Please ensure that the issue body includes answers to the following questions:

• Why are we solving this issue?
• To address this issue, are there any code changes? If there are code changes, what needs to be done in the code and what places can the assignee treat as reference points?
• How can the assignee reach out to you for help?

For more details on the requirements of such an issue, please see here and ensure that they are met.

If this request no longer meets these requirements, the label can be removed
by commenting with the /remove-help command.

In response to this:

The helm chart is responsible for creating the rbac if needed

This is an open-source project with independent release cycles for the image and Helm chart, driven by different volunteers.

/help

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.