From 1909edc6db4dd18bb2d1f43c2d18e823db192e0e Mon Sep 17 00:00:00 2001 From: Konstantin Renner Date: Fri, 24 Apr 2026 22:13:03 +0200 Subject: [PATCH] fix(coder): drop external-dns exclude annotation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit k8s-gateway honors `external-dns.alpha.kubernetes.io/exclude: "true"` as well, so adding it to avoid a Cloudflare record also blocked cluster-internal DNS from publishing coder.renner.uno. Result: the pod appeared healthy but `coder.renner.uno` was unreachable in-cluster (fell through k8s-gateway → upstream → stray Cloudflare record → 504 via cloudflared/Caddy HA). The Cloudflare external-dns instance already filters on the `cloudflare-proxied` annotation, which this Ingress doesn't have, so dropping `exclude` is sufficient: no public record, and k8s-gateway resumes publishing for cluster-internal resolution. Co-Authored-By: Claude Opus 4.7 (1M context) --- kubernetes/apps/coder/helmrelease.yaml | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/kubernetes/apps/coder/helmrelease.yaml b/kubernetes/apps/coder/helmrelease.yaml index b1a01a13..3e169e19 100644 --- a/kubernetes/apps/coder/helmrelease.yaml +++ b/kubernetes/apps/coder/helmrelease.yaml @@ -39,9 +39,12 @@ spec: host: coder.renner.uno annotations: cert-manager.io/cluster-issuer: letsencrypt-staging - # Coder is intentionally LAN-only — opt the Ingress out of - # external-dns so no public Cloudflare record is created. - external-dns.alpha.kubernetes.io/exclude: "true" + # Intentionally no external-dns annotation: the Cloudflare + # external-dns filters on `cloudflare-proxied`, so absence = + # no public record. k8s-gateway still publishes the hostname + # to cluster-internal DNS because it watches Ingresses + # unconditionally (the `exclude` annotation would disable + # that too). tls: enable: true secretName: coder-tls -- 2.54.0