Automating DNS in Azure Private DNS with External-DNS ☁️🔐

Setting Up Azure Private DNS

If you haven’t created your Private DNS zone yet, you can do so quickly:

az network private-dns zone create \

  --resource-group <RESOURCE_GROUP> \

  --name example.internal

Then, link it to your Virtual Network so internal DNS can be resolved:

az network private-dns link vnet create \

  --resource-group <RESOURCE_GROUP> \

  --zone-name example.internal \

  --name myVnetLink \

  --virtual-network <VNET_ID> \

  --registration-enabled false

Replace <RESOURCE_GROUP> and <VNET_ID> with values for your environment.

Create a User-Assigned Managed Identity (UAMI) 🔑

1. 
   Create the UAMI
   

   az identity create \

     --name external-dns-identity \

     --resource-group <RESOURCE_GROUP> \

     --location <LOCATION>

This command returns JSON that includes an id and a clientId (important for later steps).

1. 
   Assign the Role
   Give the identity DNS Zone Contributor on your DNS zone resource group or at the subscription level:
   

   az role assignment create \

     --assignee <CLIENT_ID_OF_UAMI> \

     --role "DNS Zone Contributor" \

     --scope /subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP>

Note: The clientId is also referred to as the “Application ID” of the managed identity.

Enable Azure Workload Identity on Your Cluster

Azure Workload Identity is GA (generally available), so you don’t need to enable any preview features. However, you do need to install the necessary components in your cluster. Follow the or manually configure a federated identity in your managed identity.

The values.yaml Snippet Explained

Below is an example of a values.yaml you could use with the

Happy Automating and may your internal DNS always resolve! 🎉

Happy Clustering ! 🌟