feat(endpoint): reject alias property on unsupported record types by u-kai · Pull Request #6188 · kubernetes-sigs/external-dns

u-kai · 2026-02-11T04:38:42Z

What does it do ?

This PR adds validation logic to CheckEndpoint to ensure that alias=true is only allowed for supported record types.

Endpoints with unsupported combinations (e.g., MX + alias=true) are now rejected during validation instead of being handled silently in providers.

Motivation

Currently, invalid alias configurations can pass through the pipeline and be handled (or silently fixed) inside specific providers, which leads to inconsistent behavior and makes user mistakes harder to detect.

Related issues: #6017

More

Yes, this PR title follows Conventional Commits
Yes, I added unit tests
Yes, I updated end user documentation accordingly

Signed-off-by: u-kai <76635578+u-kai@users.noreply.github.com>

coveralls · 2026-02-11T04:45:42Z

Pull Request Test Coverage Report for Build 22183896879

Warning: This coverage report may be inaccurate.

This pull request's base commit is no longer the HEAD commit of its target branch. This means it includes changes from outside the original pull request, including, potentially, unrelated coverage changes.

For more information on this, see Tracking coverage changes with pull request builds.
To avoid this issue with future PRs, see these Recommended CI Configurations.
For a quick fix, rebase this PR at GitHub. Your next report should be accurate.

Details

0 of 0 changed or added relevant lines in 0 files are covered.
20 unchanged lines in 1 file lost coverage.
Overall coverage increased (+0.01%) to 79.169%

Files with Coverage Reduction	New Missed Lines	%
endpoint.go	20	86.27%

Totals
Change from base Build 21559764040:	0.01%
Covered Lines:	16050
Relevant Lines:	20273

💛 - Coveralls

ivankatliarchuk

Could we add tests here as well

external-dns/source/wrappers/dedupsource.go

Line 56 in d38daef

if ok := ep.CheckEndpoint(); !ok {

So it's clear where the validation applies?

ivankatliarchuk · 2026-02-11T08:52:05Z

 // TODO: rename to Validate
 // CheckEndpoint Check if endpoint is properly formatted according to RFC standards
 func (e *Endpoint) CheckEndpoint() bool {
+	if !e.supportAlias() {


Suggested change

if !e.supportAlias() {

if !e.supportsAlias {

I've fixed it.

ivankatliarchuk · 2026-02-11T08:52:58Z

 // CheckEndpoint Check if endpoint is properly formatted according to RFC standards
 func (e *Endpoint) CheckEndpoint() bool {
+	if !e.supportAlias() {
+		if _, ok := e.GetBoolProviderSpecificProperty("alias"); ok {


Can we have constant with TODO comment to review source/annotations package, as we have annotations defined in location that cause circular dependencies.

ivankatliarchuk · 2026-02-11T08:53:24Z

 func (e *Endpoint) CheckEndpoint() bool {
+	if !e.supportAlias() {
+		if _, ok := e.GetBoolProviderSpecificProperty("alias"); ok {
+			log.Debugf("Endpoint %s of type %s does not support alias records in ExternalDNS", e.DNSName, e.RecordType)


ExternalDNS not required

It's a warning. Basically this is a misconfiguration on client side

Is this log in unit tests?

I've fixed the log message and added unit tests.

ivankatliarchuk · 2026-02-12T08:30:46Z

+				Targets:          Targets{"10 5 5060 sip.example.com."},
+				ProviderSpecific: ProviderSpecific{{Name: "alias", Value: "true"}},
+			},
+			expected: false,


false is default

Could you clarify what you mean by "false is default"?

You do not need explicit false, as its a default value

ivankatliarchuk · 2026-02-12T08:32:13Z

 func (e *Endpoint) CheckEndpoint() bool {
+	if !e.supportAlias() {
+		if _, ok := e.GetBoolProviderSpecificProperty("alias"); ok {
+			log.Debugf("Endpoint %s of type %s does not support alias records in ExternalDNS", e.DNSName, e.RecordType)


Is this log in unit tests?

…alias constant Signed-off-by: u-kai <76635578+u-kai@users.noreply.github.com>

Signed-off-by: u-kai <76635578+u-kai@users.noreply.github.com>

ivankatliarchuk · 2026-02-15T09:16:32Z

/approve

ivankatliarchuk · 2026-02-15T13:09:15Z

/approve cancel

ivankatliarchuk · 2026-02-15T13:09:48Z


+// TODO: review source/annotations package to consolidate alias key definitions;
+// currently duplicated here to avoid circular dependency.
+const providerSpecificAlias = "alias"


most likely too long, but not an issue. You not using this constant in tests

I've fixed it.

ivankatliarchuk · 2026-02-15T13:11:09Z

User documentation is missing. Worth to find out the right location for this

Signed-off-by: u-kai <76635578+u-kai@users.noreply.github.com>

…NAME Signed-off-by: u-kai <76635578+u-kai@users.noreply.github.com>

ivankatliarchuk · 2026-02-19T17:53:55Z

I could not find example of testing this feature end-2-end. Could you share it pls?

ivankatliarchuk · 2026-02-20T14:26:46Z

+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			logger, hook := test.NewNullLogger()


make sure to use shared construct. let's not create for every test a solution

Currently, it’s difficult to use a shared construct due to circular dependencies.
Once this PR is merged, I was planning to refactor the structure and introduce a shared construct in a follow-up PR.

u-kai · 2026-02-22T01:59:06Z

Yes. I verified this behavior end-to-end using the DNSEndpoint CRD.

I was able to successfully create a normal MX record using the following manifest:

apiVersion: externaldns.k8s.io/v1alpha1
kind: DNSEndpoint
metadata:
  name: alias
  namespace: default
spec:
  endpoints:
    - dnsName: test.mail.example.com
      recordType: MX
      recordTTL: 600
      targets:
        - "10 mail.example.com"

However, when I added the alias providerSpecific property as shown below:

apiVersion: externaldns.k8s.io/v1alpha1
kind: DNSEndpoint
metadata:
  name: alias
  namespace: default
spec:
  endpoints:
    - dnsName: test.mail.example.com
      recordType: MX
      recordTTL: 600
      targets:
        - "10 mail.example.com"
      providerSpecific:
        - name: "alias"
          value: "true"

ExternalDNS produced the following warnings and skipped the endpoint:

WARN Endpoint test.mail.example.com of type MX does not support alias records
WARN Skipping endpoint [:test.mail.example.com] due to invalid configuration [MX:10 mail.example.com]

This confirms that MX records with alias=true are rejected and not processed, which is the behavior this PR is addressing.

ivankatliarchuk · 2026-02-22T07:34:59Z

/approve

ivankatliarchuk · 2026-02-23T11:00:57Z

I was testing something. And found this log

DEBU[0000] Modifying endpoint: alias.example.com 600 IN CNAME  multi.example.com [], setting alias=false

We don't have any aliases set

apiVersion: externaldns.k8s.io/v1alpha1
kind: DNSEndpoint
metadata:
  name: multi-record-types
  namespace: default
spec:
  endpoints:
    - dnsName: multi.example.com
      recordTTL: 300
      recordType: A
      targets:
        - 172.16.0.1
    - dnsName: multi.example.com
      recordTTL: 300
      recordType: AAAA
      targets:
        - "2001:db8::2"
    - dnsName: alias.example.com
      recordTTL: 600
      recordType: CNAME
      targets:
        - multi.example.com

ivankatliarchuk · 2026-02-23T11:01:41Z

needs clarification. as was not there before

/remove-approve

u-kai · 2026-02-23T13:57:42Z

This behavior is not introduced by this PR and already exists in the current master branch.

To verify, I switched to the latest master branch and applied the same DNSEndpoint configuration (with domain names adjusted to my domain). The following log was produced:

DEBU[0021] Modifying endpoint: alias.example.com 600 IN CNAME multi.example.com [], setting alias=false

ivankatliarchuk · 2026-02-24T08:28:50Z

The logic most likely had changed in this PR https://github.com/kubernetes-sigs/external-dns/pull/6021/changes

I'll try to understand it better over a weekend.

ivankatliarchuk · 2026-02-26T18:03:26Z

Tested against https://github.com/kubernetes-sigs/external-dns/tree/v0.20.0. The message

DEBU[0021] Modifying endpoint: alias

Is there as well

/approve

k8s-ci-robot · 2026-02-26T18:03:34Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ivankatliarchuk

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [ivankatliarchuk]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

into feat/add-alias-validation

ivankatliarchuk · 2026-02-28T18:10:26Z

/lgtm

…_total * master: (21 commits) refactor(testutils): extract log test helpers into subpackage to fix (kubernetes-sigs#6236) chore(deps): bump mkdocs-material (kubernetes-sigs#6237) feat(endpoint): reject alias property on unsupported record types (kubernetes-sigs#6188) fix(charts): Skip cluster-scope RBAC on namespaced (kubernetes-sigs#5843) chore(deps): bump the dev-dependencies group across 1 directory with 3 updates (kubernetes-sigs#6226) feat(pdns): add --[no-]prefer-alias flag and alias annotation support (kubernetes-sigs#6129) fix(ci): failed to download the coveralls binary from GitHub releases (kubernetes-sigs#6228) docs: add external-dns-pscloud-webhook to New providers list (kubernetes-sigs#6214) fix(crd): allow trailing dot in CNAME targets (kubernetes-sigs#6218) docs: added deep wiki badge (kubernetes-sigs#6215) feat(crd): Support MX record with trailing dot (kubernetes-sigs#6163) chore(source): standardize sources with merge endpionts and deduplicate targets (kubernetes-sigs#6174) chore(store): Added RESTConfig() to ClientGenerator (kubernetes-sigs#6177) chore(ingress): clarify that both IP and Hostname are collected from LoadBalancer status (kubernetes-sigs#6138) chore(endpoint): added empty checks (kubernetes-sigs#6157) chore(linter): enable unparam (kubernetes-sigs#6160) fix(tlsutils): fix nil error wrapping and wrong env var in TLS config (kubernetes-sigs#6198) chore(endpoint): harden crypto (kubernetes-sigs#6197) feat(fqdn): Deduplicate and sort ExecTemplate output. Add functions (kubernetes-sigs#6173) benchmark(endpoint): endpoint benchmarks (kubernetes-sigs#6156) ...

* master: (23 commits) refactor(testutils): extract log test helpers into subpackage to fix (kubernetes-sigs#6236) chore(deps): bump mkdocs-material (kubernetes-sigs#6237) feat(endpoint): reject alias property on unsupported record types (kubernetes-sigs#6188) fix(charts): Skip cluster-scope RBAC on namespaced (kubernetes-sigs#5843) chore(deps): bump the dev-dependencies group across 1 directory with 3 updates (kubernetes-sigs#6226) feat(pdns): add --[no-]prefer-alias flag and alias annotation support (kubernetes-sigs#6129) fix(ci): failed to download the coveralls binary from GitHub releases (kubernetes-sigs#6228) docs: add external-dns-pscloud-webhook to New providers list (kubernetes-sigs#6214) fix(crd): allow trailing dot in CNAME targets (kubernetes-sigs#6218) docs: added deep wiki badge (kubernetes-sigs#6215) feat(crd): Support MX record with trailing dot (kubernetes-sigs#6163) chore(source): standardize sources with merge endpionts and deduplicate targets (kubernetes-sigs#6174) chore(store): Added RESTConfig() to ClientGenerator (kubernetes-sigs#6177) chore(ingress): clarify that both IP and Hostname are collected from LoadBalancer status (kubernetes-sigs#6138) chore(endpoint): added empty checks (kubernetes-sigs#6157) chore(linter): enable unparam (kubernetes-sigs#6160) fix(tlsutils): fix nil error wrapping and wrong env var in TLS config (kubernetes-sigs#6198) chore(endpoint): harden crypto (kubernetes-sigs#6197) feat(fqdn): Deduplicate and sort ExecTemplate output. Add functions (kubernetes-sigs#6173) benchmark(endpoint): endpoint benchmarks (kubernetes-sigs#6156) ...

feat(endpoint): reject alias property on unsupported record types

1d536e5

Signed-off-by: u-kai <76635578+u-kai@users.noreply.github.com>

k8s-ci-robot requested review from ivankatliarchuk and mloiseleur February 11, 2026 04:38

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Feb 11, 2026

ivankatliarchuk suggested changes Feb 11, 2026

View reviewed changes

k8s-ci-robot assigned ivankatliarchuk Feb 11, 2026

ivankatliarchuk suggested changes Feb 12, 2026

View reviewed changes

u-kai added 3 commits February 15, 2026 16:33

refactor(endpoint): rename supportAlias to supportsAlias and extract …

520cf59

…alias constant Signed-off-by: u-kai <76635578+u-kai@users.noreply.github.com>

test(endpoint): add alias warning log assertion cases

c6c1eae

Signed-off-by: u-kai <76635578+u-kai@users.noreply.github.com>

test(wrappers): add alias cases to dedup validation and warn tests

d596421

Signed-off-by: u-kai <76635578+u-kai@users.noreply.github.com>

k8s-ci-robot added the source label Feb 15, 2026

u-kai requested a review from ivankatliarchuk February 15, 2026 07:42

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Feb 15, 2026

k8s-ci-robot removed the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Feb 15, 2026

ivankatliarchuk suggested changes Feb 15, 2026

View reviewed changes

u-kai added 2 commits February 19, 2026 22:29

refactor(endpoint): use providerSpecificAlias constant in tests

c8db779

Signed-off-by: u-kai <76635578+u-kai@users.noreply.github.com>

docs(annotations): note alias annotation is limited to A, AAAA, and C…

825031c

…NAME Signed-off-by: u-kai <76635578+u-kai@users.noreply.github.com>

k8s-ci-robot added the docs label Feb 19, 2026

u-kai requested a review from ivankatliarchuk February 19, 2026 13:34

ivankatliarchuk mentioned this pull request Feb 20, 2026

chore(tests): Add YAML-driven integration test framework for sources #6158

Merged

3 tasks

ivankatliarchuk reviewed Feb 20, 2026

View reviewed changes

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Feb 22, 2026

k8s-ci-robot removed the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Feb 23, 2026

k8s-ci-robot added needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. approved Indicates a PR has been approved by an approver from all required OWNERS files. labels Feb 26, 2026

Merge branch 'master' of https://github.com/kubernetes-sigs/external-dns

0c335bb

into feat/add-alias-validation

k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Feb 28, 2026

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Feb 28, 2026

k8s-ci-robot merged commit a4e1679 into kubernetes-sigs:master Feb 28, 2026
17 checks passed

Conversation

u-kai commented Feb 11, 2026

What does it do ?

Motivation

Related issues: #6017

More

Uh oh!

coveralls commented Feb 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request Test Coverage Report for Build 22183896879

Warning: This coverage report may be inaccurate.

Details

💛 - Coveralls

Uh oh!

ivankatliarchuk left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ivankatliarchuk commented Feb 15, 2026

Uh oh!

ivankatliarchuk commented Feb 15, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ivankatliarchuk commented Feb 15, 2026

Uh oh!

ivankatliarchuk commented Feb 19, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

u-kai commented Feb 22, 2026

Uh oh!

ivankatliarchuk commented Feb 22, 2026

Uh oh!

ivankatliarchuk commented Feb 23, 2026

Uh oh!

ivankatliarchuk commented Feb 23, 2026

Uh oh!

u-kai commented Feb 23, 2026

Uh oh!

ivankatliarchuk commented Feb 24, 2026

Uh oh!

ivankatliarchuk commented Feb 26, 2026

Uh oh!

k8s-ci-robot commented Feb 26, 2026

Uh oh!

ivankatliarchuk commented Feb 28, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

coveralls commented Feb 11, 2026 •

edited

Loading