From 2621bc9f364909eddfebf10366c22d30c0b9bf3a Mon Sep 17 00:00:00 2001
From: Hermes Agent service account
 <hermes@carousel-of-progress.local.mk-labs.cloud>
Date: Sun, 7 Jun 2026 18:57:59 -0500
Subject: [PATCH] fix(external-dns): exclude internal records from Cloudflare,
 add opt-in filter, set targets
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- external-dns-cloudflare: add excludeDomains: [local.mk-labs.cloud] to stop
  internal subdomain records from leaking to Cloudflare
- external-dns-cloudflare: replace hostname annotationFilter with opt-in model
  (external-dns.alpha.kubernetes.io/public=true) so only explicitly tagged
  services get public Cloudflare records
- external-dns-cloudflare: add extraArgs --target=lb.mk-labs.cloud
- external-dns (Technitium/rfc2136): add extraArgs
  --target=lightning-lane.local.mk-labs.cloud for internal records
- couchdb: add external-dns.alpha.kubernetes.io/public: 'true' annotation —
  first service to opt in to public DNS; will create communicore.mk-labs.cloud
  pointing to lb.mk-labs.cloud via Cloudflare ExternalDNS

URGENT: Cloudflare was creating records for local.mk-labs.cloud hosts.
Ryan: manually delete any *.local.mk-labs.cloud records currently in Cloudflare
(look for communicore.local.mk-labs.cloud and any other local.* entries).
---
 cluster/applications/couchdb/values.yaml         |  2 ++
 .../platform/external-dns-cloudflare/values.yaml | 16 +++++++++++++---
 cluster/platform/external-dns/values.yaml        |  4 ++++
 3 files changed, 19 insertions(+), 3 deletions(-)

diff --git a/cluster/applications/couchdb/values.yaml b/cluster/applications/couchdb/values.yaml
index bbdd6c4..2df0d2f 100644
--- a/cluster/applications/couchdb/values.yaml
+++ b/cluster/applications/couchdb/values.yaml
@@ -61,6 +61,8 @@ ingress:
     cert-manager.io/cluster-issuer: "letsencrypt-prod"
     external-dns.alpha.kubernetes.io/hostname: "communicore.local.mk-labs.cloud"
     external-dns.alpha.kubernetes.io/target: "10.1.71.80"
+    # Opt in to public Cloudflare DNS — creates communicore.mk-labs.cloud -> lb.mk-labs.cloud
+    external-dns.alpha.kubernetes.io/public: "true"
   hosts:
     - communicore.local.mk-labs.cloud
     - communicore.mk-labs.cloud
diff --git a/cluster/platform/external-dns-cloudflare/values.yaml b/cluster/platform/external-dns-cloudflare/values.yaml
index d3cc339..e591063 100644
--- a/cluster/platform/external-dns-cloudflare/values.yaml
+++ b/cluster/platform/external-dns-cloudflare/values.yaml
@@ -23,14 +23,24 @@ env:
 domainFilters:
   - mk-labs.cloud
 
+# Explicitly exclude internal subdomain — prevents local.mk-labs.cloud from
+# leaking into Cloudflare (domainFilters matches subdomains by default)
+excludeDomains:
+  - local.mk-labs.cloud
+
 # Sources: ingress and services
 sources:
   - ingress
   - service
 
-# Annotation to opt resources into public DNS management.
-# Use: external-dns.alpha.kubernetes.io/hostname: myservice.mk-labs.cloud
-annotationFilter: "external-dns.alpha.kubernetes.io/hostname"
+# Opt-in model: only process resources explicitly annotated for public DNS.
+# Add annotation external-dns.alpha.kubernetes.io/public: "true" to any
+# ingress/service that should get a public Cloudflare record.
+annotationFilter: "external-dns.alpha.kubernetes.io/public=true"
+
+# Override the target for all Cloudflare-managed records to the public LB CNAME.
+extraArgs:
+  - --target=lb.mk-labs.cloud
 
 # Log level
 logLevel: info
diff --git a/cluster/platform/external-dns/values.yaml b/cluster/platform/external-dns/values.yaml
index 51c58d0..5cfabf7 100644
--- a/cluster/platform/external-dns/values.yaml
+++ b/cluster/platform/external-dns/values.yaml
@@ -45,6 +45,10 @@ sources:
 # external-dns.alpha.kubernetes.io/hostname: myservice.local.mk-labs.cloud
 annotationFilter: "external-dns.alpha.kubernetes.io/hostname"
 
+# Override the target for all Technitium-managed records to the internal LB hostname.
+extraArgs:
+  - --target=lightning-lane.local.mk-labs.cloud
+
 # Log level — info in normal ops, debug when troubleshooting
 logLevel: info