sigs.k8s.io/external-dns@v0.14.1/docs/registry/txt.md (about)

     1  # The TXT registry
     2  
     3  The TXT registry is the default registry.
     4  It stores DNS record metadata in TXT records, using the same provider.
     5  
     6  ## Prefixes and Suffixes
     7  
     8  In order to avoid having the registry TXT records collide with
     9  TXT or CNAME records created from sources, you can configure a fixed prefix or suffix
    10  to be added to the first component of the domain of all registry TXT records.
    11  
    12  The prefix or suffix may not be changed after initial deployment,
    13  lest the registry records be orphaned and the metadata be lost.
    14  
    15  The prefix or suffix may contain the substring `%{record_type}`, which is replaced with
    16  the record type of the DNS record for which it is storing metadata.
    17  
    18  The prefix is specified using the `--txt-prefix` flag and the suffix is specified using
    19  the `--txt-suffix` flag. The two flags are mutually exclusive.
    20  
    21  ## Wildcard Replacement
    22  
    23  The `--txt-wildcard-replacement` flag specifies a string to use to replace the "*" in
    24  registry TXT records for wildcard domains. Without using this, registry TXT records for
    25  wildcard domains will have invalid domain syntax and be rejected by most providers.
    26  
    27  ## Encryption
    28  
    29  Registry TXT records may contain information, such as the internal ingress name or namespace, considered sensitive, , which attackers could exploit to gather information about your infrastructure. 
    30  By encrypting TXT records, you can protect this information from unauthorized access.
    31  
    32  Encryption is enabled by using the `--txt-encrypt-enabled` flag. The 32-byte AES-256-GCM encryption
    33  key must be specified in URL-safe base64 form, using the `--txt-encrypt-aes-key` flag.
    34  
    35  Note that the key used for encryption should be a secure key and properly managed to ensure the security of your TXT records.
    36  
    37  ### Generating the TXT Encryption Key
    38  Python
    39  ```python
    40  python -c 'import os,base64; print(base64.urlsafe_b64encode(os.urandom(32)).decode())'
    41  ```
    42  
    43  Bash
    44  ```shell
    45  dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64 | tr -d -- '\n' | tr -- '+/' '-_'; echo
    46  ```
    47  
    48  OpenSSL
    49  ```shell
    50  openssl rand -base64 32 | tr -- '+/' '-_'
    51  ```
    52  
    53  PowerShell
    54  ```powershell
    55  # Add System.Web assembly to session, just in case
    56  Add-Type -AssemblyName System.Web
    57  [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes([System.Web.Security.Membership]::GeneratePassword(32,4))).Replace("+","-").Replace("/","_")
    58  ```
    59  
    60  Terraform
    61  ```hcl
    62  resource "random_password" "txt_key" {
    63    length           = 32
    64    override_special = "-_"
    65  }
    66  ```
    67  
    68  ### Manually Encrypting/Decrypting TXT Records
    69  
    70  In some cases you might need to edit registry TXT records. The following example Go code encrypts and decrypts such records.
    71  
    72  ```go
    73  package main
    74  
    75  import (
    76  	"fmt"
    77  	"sigs.k8s.io/external-dns/endpoint"
    78  )
    79  
    80  func main() {
    81  	key := []byte("testtesttesttesttesttesttesttest")
    82  	encrypted, _ := endpoint.EncryptText(
    83  		"heritage=external-dns,external-dns/owner=example,external-dns/resource=ingress/default/example",
    84  		key,
    85  		nil,
    86  	)
    87  	decrypted, _, _ := endpoint.DecryptText(encrypted, key)
    88  	fmt.Println(decrypted)
    89  }
    90  ```
    91  
    92  ## Caching
    93  
    94  The TXT registry can optionally cache DNS records read from the provider. This can mitigate
    95  rate limits imposed by the provider.
    96  
    97  Caching is enabled by specifying a cache duration with the `--txt-cache-interval` flag.