[Action required] external-dns 0.23: new annotation prefix, your existing annotations keep working

We upgraded external-dns, the add-on that creates Route53 records for your Services and Ingresses, to v0.23.0. Upstream renamed its annotations: external-dns.alpha.kubernetes.io/ is now external-dns.kubernetes.io/. Your clusters read both for the moment, so nothing breaks immediately. However we recommend you to migrate to the new annotations when convenient.

What changed

On its own, external-dns 0.22 and later only reads the new external-dns.kubernetes.io/ prefix. A cluster still using the old prefix everywhere would see no DNS records it should manage, and depending on the cluster’s policy it could remove the records it created. We caught this on our own test cluster before it reached you, and held the upgrade back until we could ship it safely.

Your clusters now run external-dns with upstream’s migration setting turned on. It reads both prefixes:

• An annotation with the old prefix, such as external-dns.alpha.kubernetes.io/hostname, works exactly as before.
• The new prefix, such as external-dns.kubernetes.io/hostname, works too.
• If a resource has the same annotation under both prefixes, the new one wins.
• exclude: "true" works under either prefix to keep a resource out of DNS.

The upgrade rolls out through Skyflow as usual: staging clusters first, production after it has proven itself there.

What you need to do

When you next touch your manifests or Helm values, switch external-dns.alpha.kubernetes.io/ to external-dns.kubernetes.io/. It’s a plain find-and-replace:

metadata:
  annotations:
    external-dns.kubernetes.io/hostname: app.example.com

The Services our platform manages for you (Traefik, ingress-nginx, WireGuard, OpenVPN) already carry the new prefix. Upstream plans to remove the old prefix in a future release, so the migration setting won’t stay forever. We’ll give you plenty of notice before we turn the old prefix off.