/usr/bin/external-dns

usage: external-dns --provider=provider --source=source [<flags>]

ExternalDNS synchronizes exposed Kubernetes Services and Ingresses with DNS providers.

Note that all flags may be replaced with env vars - `--flag` -> `EXTERNAL_DNS_FLAG=1` or `--flag
value` -> `EXTERNAL_DNS_FLAG=value`


Flags:
  --[no-]help                    Show context-sensitive help (also try --help-long and --help-man).
                                 ($EXTERNAL_DNS_HELP)
  --[no-]version                 Show application version. ($EXTERNAL_DNS_VERSION)
  --server=""                    The Kubernetes API server to connect to (default: auto-detect)
                                 ($EXTERNAL_DNS_SERVER)
  --[no-]resolve-service-load-balancer-hostname
                                 Resolve the hostname of LoadBalancer-type Service object to IP
                                 addresses in order to create DNS A/AAAA records instead of CNAMEs
                                 ($EXTERNAL_DNS_RESOLVE_SERVICE_LOAD_BALANCER_HOSTNAME)
  --[no-]listen-endpoint-events  Trigger a reconcile on changes to EndpointSlices, for Service
                                 source (default: false) ($EXTERNAL_DNS_LISTEN_ENDPOINT_EVENTS)
  --gloo-namespace=gloo-system ...
                                 The Gloo Proxy namespace; specify multiple times for multiple
                                 namespaces. (default: gloo-system) ($EXTERNAL_DNS_GLOO_NAMESPACE)
  --[no-]always-publish-not-ready-addresses
                                 Always publish also not ready addresses for headless services
                                 (optional) ($EXTERNAL_DNS_ALWAYS_PUBLISH_NOT_READY_ADDRESSES)
  --annotation-filter=""         Filter resources queried for endpoints by annotation, using label
                                 selector semantics ($EXTERNAL_DNS_ANNOTATION_FILTER)
  --annotation-prefix="external-dns.kubernetes.io/"
                                 Annotation prefix for external-dns annotations (default:
                                 external-dns.kubernetes.io/) ($EXTERNAL_DNS_ANNOTATION_PREFIX)
  --[no-]enable-legacy-annotation-prefix
                                 Also read annotations using the legacy prefix
                                 external-dns.alpha.kubernetes.io/ (default: disabled)
                                 ($EXTERNAL_DNS_ENABLE_LEGACY_ANNOTATION_PREFIX)
  --compatibility=               Process annotation semantics from legacy implementations
                                 (optional, options: mate, molecule, kops-dns-controller)
                                 ($EXTERNAL_DNS_COMPATIBILITY)
  --connector-source-server="localhost:8080"
                                 The server to connect for connector source, valid only when using
                                 connector source ($EXTERNAL_DNS_CONNECTOR_SOURCE_SERVER)
  --crd-source-apiversion="externaldns.k8s.io/v1alpha1"
                                 API version of the CRD for crd source, e.g.
                                 `externaldns.k8s.io/v1alpha1`, valid only when using crd source
                                 ($EXTERNAL_DNS_CRD_SOURCE_APIVERSION)
  --crd-source-kind="DNSEndpoint"
                                 Kind of the CRD for the crd source in API group and version
                                 specified by crd-source-apiversion ($EXTERNAL_DNS_CRD_SOURCE_KIND)
  --default-targets=DEFAULT-TARGETS ...
                                 Set globally default host/IP used as a target for endpoints
                                 whose source provided none (typically crd DNSEndpoint resources);
                                 --force-default-targets also overrides source-provided targets.
                                 Specify multiple times for multiple targets (optional)
                                 ($EXTERNAL_DNS_DEFAULT_TARGETS)
  --[no-]force-default-targets   Force the application of --default-targets, overriding any targets
                                 provided by the source (DEPRECATED: This reverts to (improved)
                                 legacy behavior which allows empty CRD targets for migration to new
                                 state) ($EXTERNAL_DNS_FORCE_DEFAULT_TARGETS)
  --[no-]prefer-alias            When enabled, CNAME records will have the alias annotation set,
                                 signaling providers that support ALIAS records to use them instead
                                 of CNAMEs. Supported by: PowerDNS, AWS (with --aws-prefer-cname
                                 disabled), Scaleway ($EXTERNAL_DNS_PREFER_ALIAS)
  --exclude-record-types=EXCLUDE-RECORD-TYPES ...
                                 Record types to exclude from management; specify multiple times to
                                 exclude many; (optional) ($EXTERNAL_DNS_EXCLUDE_RECORD_TYPES)
  --exclude-target-net=EXCLUDE-TARGET-NET ...
                                 Exclude target nets. Only applies to A/AAAA records. (optional)
                                 ($EXTERNAL_DNS_EXCLUDE_TARGET_NET)
  --[no-]exclude-unschedulable   Exclude nodes that are considered unschedulable (default: true)
                                 ($EXTERNAL_DNS_EXCLUDE_UNSCHEDULABLE)
  --[no-]expose-internal-ipv6    When using the node source, expose internal IPv6 addresses
                                 (optional, default: false) ($EXTERNAL_DNS_EXPOSE_INTERNAL_IPV6)
  --gateway-label-filter=""      Filter Gateways of Route endpoints via label selector (default:
                                 all gateways) ($EXTERNAL_DNS_GATEWAY_LABEL_FILTER)
  --gateway-name=""              Limit Gateways of Route endpoints to a specific name (default:
                                 all names) ($EXTERNAL_DNS_GATEWAY_NAME)
  --gateway-namespace=""         Limit Gateways of Route endpoints to a specific namespace (default:
                                 all namespaces) ($EXTERNAL_DNS_GATEWAY_NAMESPACE)
  --[no-]gateway-listener-sets   Enable ListenerSet support for Gateway API sources
                                 (requires Gateway API v1.5+ CRDs) (default: false)
                                 ($EXTERNAL_DNS_GATEWAY_LISTENER_SETS)
  --[no-]ignore-hostname-annotation
                                 Ignore hostname annotation when generating DNS names,
                                 valid only when --fqdn-template is set (default: false)
                                 ($EXTERNAL_DNS_IGNORE_HOSTNAME_ANNOTATION)
  --[no-]ignore-ingress-rules-spec
                                 Ignore the spec.rules section in Ingress resources (default:
                                 false) ($EXTERNAL_DNS_IGNORE_INGRESS_RULES_SPEC)
  --[no-]ignore-ingress-tls-spec
                                 Ignore the spec.tls section in Ingress resources (default: false)
                                 ($EXTERNAL_DNS_IGNORE_INGRESS_TLS_SPEC)
  --[no-]ignore-non-host-network-pods
                                 Ignore pods not running on host network when using pod source
                                 (default: false) ($EXTERNAL_DNS_IGNORE_NON_HOST_NETWORK_PODS)
  --ingress-class=INGRESS-CLASS ...
                                 Require an Ingress to have this class name; specify multiple times
                                 to allow more than one class (optional; defaults to any class)
                                 ($EXTERNAL_DNS_INGRESS_CLASS)
  --label-filter=""              Filter resources queried for endpoints by label selector (default:
                                 all resources) ($EXTERNAL_DNS_LABEL_FILTER)
  --managed-record-types=A... ...
                                 Record types to manage; specify multiple times to include many;
                                 (default: A,AAAA,CNAME) (supported records: A, AAAA, CNAME, DNAME,
                                 NS, SRV, TLSA, TXT) ($EXTERNAL_DNS_MANAGED_RECORD_TYPES)
  --namespace=NAMESPACE ...      Limit resources queried for endpoints to specific namespaces;
                                 specify multiple times or as a comma-separated list (default:
                                 all namespaces) ($EXTERNAL_DNS_NAMESPACE)
  --nat64-networks=NAT64-NETWORKS ...
                                 Adding an A record for each AAAA record in NAT64-enabled networks;
                                 specify multiple times for multiple possible nets (optional)
                                 ($EXTERNAL_DNS_NAT64_NETWORKS)
  --openshift-router-name=""     if source is openshift-route then you can pass the ingress
                                 controller name. Based on this name external-dns will select
                                 the respective router from the route status and map that
                                 routerCanonicalHostname to the route host while creating a CNAME
                                 record. ($EXTERNAL_DNS_OPENSHIFT_ROUTER_NAME)
  --pod-source-domain=""         Domain to use for pods records (optional)
                                 ($EXTERNAL_DNS_POD_SOURCE_DOMAIN)
  --[no-]publish-host-ip         Allow external-dns to publish host-ip for headless services
                                 (optional) ($EXTERNAL_DNS_PUBLISH_HOST_IP)
  --[no-]publish-internal-services
                                 Allow external-dns to publish DNS records for ClusterIP services
                                 (optional) ($EXTERNAL_DNS_PUBLISH_INTERNAL_SERVICES)
  --service-type-filter=SERVICE-TYPE-FILTER ...
                                 The service types to filter by. Specify multiple times for
                                 multiple filters to be applied. (optional, default: all,
                                 expected: ClusterIP, NodePort, LoadBalancer or ExternalName)
                                 ($EXTERNAL_DNS_SERVICE_TYPE_FILTER)
  --target-net-filter=TARGET-NET-FILTER ...
                                 Limit possible targets by a net filter; specify multiple times for
                                 multiple possible nets. Only applies to A/AAAA records. (optional)
                                 ($EXTERNAL_DNS_TARGET_NET_FILTER)
  --[no-]traefik-enable-legacy   Enable legacy listeners on Resources under the traefik.containo.us
                                 API Group ($EXTERNAL_DNS_TRAEFIK_ENABLE_LEGACY)
  --[no-]traefik-disable-new     Disable listeners on Resources under the traefik.io API Group
                                 ($EXTERNAL_DNS_TRAEFIK_DISABLE_NEW)
  --unstructured-resource=UNSTRUCTURED-RESOURCE ...
                                 When using the unstructured source, specify
                                 resources in resource.version.group format (e.g.,
                                 virtualmachineinstances.v1.kubevirt.io, configmap.v1);
                                 specify multiple times for multiple resources
                                 ($EXTERNAL_DNS_UNSTRUCTURED_RESOURCE)
  --events-emit=EVENTS-EMIT ...  Events that should be emitted. Specify multiple times for multiple
                                 events support (optional, default: none, expected: RecordReady,
                                 RecordDeleted, RecordError) ($EXTERNAL_DNS_EVENTS_EMIT)
  --provider-cache-time=0s       The time to cache the DNS provider record list requests.
                                 ($EXTERNAL_DNS_PROVIDER_CACHE_TIME)
  --[no-]create-ptr              When enabled, automatically create PTR records for A/AAAA
                                 records. Per-resource annotations can override this default.
                                 The provider must have authority over the reverse DNS zones (e.g.
                                 in-addr.arpa). Include reverse zones in --domain-filter.
                                 ($EXTERNAL_DNS_CREATE_PTR)
  --domain-filter= ...           Limit possible target zones by a domain suffix; specify multiple
                                 times for multiple domains (optional) ($EXTERNAL_DNS_DOMAIN_FILTER)
  --exclude-domains= ...         Exclude subdomains (optional) ($EXTERNAL_DNS_EXCLUDE_DOMAINS)
  --regex-domain-filter=         Limit possible domains and target zones by a
                                 Regex filter; Overrides domain-filter (optional)
                                 ($EXTERNAL_DNS_REGEX_DOMAIN_FILTER)
  --regex-domain-exclusion=      Regex filter that excludes domains and target
                                 zones matched by regex-domain-filter (optional)
                                 ($EXTERNAL_DNS_REGEX_DOMAIN_EXCLUSION)
  --zone-name-filter= ...        Filter target zones by zone domain (For now, only AzureDNS provider
                                 is using this flag); specify multiple times for multiple zones
                                 (optional) ($EXTERNAL_DNS_ZONE_NAME_FILTER)
  --zone-id-filter= ...          Filter target zones by hosted zone id; specify multiple times for
                                 multiple zones (optional) ($EXTERNAL_DNS_ZONE_ID_FILTER)
  --google-project=""            When using the Google provider, current project is auto-detected,
                                 when running on GCP. Specify other project with this. Must be
                                 specified when running outside GCP. ($EXTERNAL_DNS_GOOGLE_PROJECT)
  --google-batch-change-size=1000
                                 When using the Google provider, set the maximum
                                 number of changes that will be applied in each batch.
                                 ($EXTERNAL_DNS_GOOGLE_BATCH_CHANGE_SIZE)
  --google-batch-change-interval=1s
                                 When using the Google provider, set the interval between batch
                                 changes. ($EXTERNAL_DNS_GOOGLE_BATCH_CHANGE_INTERVAL)
  --google-zone-visibility=      When using the Google provider, filter for zones with
                                 this visibility (optional, options: public, private)
                                 ($EXTERNAL_DNS_GOOGLE_ZONE_VISIBILITY)
  --alibaba-cloud-config-file="/etc/kubernetes/alibaba-cloud.json"
                                 When using the Alibaba Cloud provider, specify the Alibaba Cloud
                                 configuration file (required when --provider=alibabacloud)
                                 ($EXTERNAL_DNS_ALIBABA_CLOUD_CONFIG_FILE)
  --alibaba-cloud-zone-type=     When using the Alibaba Cloud provider, filter for
                                 zones of this type (optional, options: public, private)
                                 ($EXTERNAL_DNS_ALIBABA_CLOUD_ZONE_TYPE)
  --aws-zone-type=               When using the AWS provider, filter for zones of this
                                 type (optional, default: any, options: public, private)
                                 ($EXTERNAL_DNS_AWS_ZONE_TYPE)
  --aws-zone-tags= ...           When using the AWS provider, filter for zones with these tags
                                 ($EXTERNAL_DNS_AWS_ZONE_TAGS)
  --aws-profile= ...             When using the AWS provider, name of the profile to use
                                 ($EXTERNAL_DNS_AWS_PROFILE)
  --aws-assume-role=""           When using the AWS API, assume this IAM role. Useful for
                                 hosted zones in another AWS account. Specify the full ARN,
                                 e.g. `arn:aws:iam::123455567:role/external-dns` (optional)
                                 ($EXTERNAL_DNS_AWS_ASSUME_ROLE)
  --aws-assume-role-external-id=""
                                 When using the AWS API and assuming a role then specify this
                                 external ID` (optional) ($EXTERNAL_DNS_AWS_ASSUME_ROLE_EXTERNAL_ID)
  --aws-batch-change-size=1000   When using the AWS provider, set the maximum number
                                 of changes that will be applied in each batch.
                                 ($EXTERNAL_DNS_AWS_BATCH_CHANGE_SIZE)
  --aws-batch-change-size-bytes=32000
                                 When using the AWS provider, set the maximum byte size that will be
                                 applied in each batch. ($EXTERNAL_DNS_AWS_BATCH_CHANGE_SIZE_BYTES)
  --aws-batch-change-size-values=1000
                                 When using the AWS provider, set the maximum total
                                 record values that will be applied in each batch.
                                 ($EXTERNAL_DNS_AWS_BATCH_CHANGE_SIZE_VALUES)
  --aws-batch-change-interval=1s
                                 When using the AWS provider, set the interval between batch
                                 changes. ($EXTERNAL_DNS_AWS_BATCH_CHANGE_INTERVAL)
  --[no-]aws-evaluate-target-health
                                 When using the AWS provider, set whether to evaluate
                                 the health of a DNS target (default: enabled,
                                 disable with --no-aws-evaluate-target-health)
                                 ($EXTERNAL_DNS_AWS_EVALUATE_TARGET_HEALTH)
  --aws-api-retries=3            When using the AWS API, set the maximum number of retries before
                                 giving up. ($EXTERNAL_DNS_AWS_API_RETRIES)
  --[no-]aws-prefer-cname        When using the AWS provider, prefer using CNAME instead of ALIAS
                                 (default: disabled) ($EXTERNAL_DNS_AWS_PREFER_CNAME)
  --aws-zones-cache-duration=0s  When using the AWS provider, set the zones list cache TTL (0s to
                                 disable). ($EXTERNAL_DNS_AWS_ZONES_CACHE_DURATION)
  --[no-]aws-zone-match-parent   Expand limit possible target by sub-domains (default: disabled)
                                 ($EXTERNAL_DNS_AWS_ZONE_MATCH_PARENT)
  --[no-]aws-sd-service-cleanup  When using the AWS CloudMap provider, delete empty
                                 Services without endpoints (default: disabled)
                                 ($EXTERNAL_DNS_AWS_SD_SERVICE_CLEANUP)
  --aws-sd-create-tag=AWS-SD-CREATE-TAG ...
                                 When using the AWS CloudMap provider, add tag to
                                 created services. The flag can be used multiple times
                                 ($EXTERNAL_DNS_AWS_SD_CREATE_TAG)
  --azure-config-file="/etc/kubernetes/azure.json"
                                 When using the Azure provider, specify the Azure configuration file
                                 (required when --provider=azure) ($EXTERNAL_DNS_AZURE_CONFIG_FILE)
  --azure-resource-group=""      When using the Azure provider, override the Azure resource group to
                                 use (optional) ($EXTERNAL_DNS_AZURE_RESOURCE_GROUP)
  --azure-subscription-id=""     When using the Azure provider, override the Azure subscription to
                                 use (optional) ($EXTERNAL_DNS_AZURE_SUBSCRIPTION_ID)
  --azure-user-assigned-identity-client-id=""
                                 When using the Azure provider, override the client id
                                 of user assigned identity in config file (optional)
                                 ($EXTERNAL_DNS_AZURE_USER_ASSIGNED_IDENTITY_CLIENT_ID)
  --azure-zones-cache-duration=0s
                                 When using the Azure provider, set the zones list cache TTL (0s to
                                 disable). ($EXTERNAL_DNS_AZURE_ZONES_CACHE_DURATION)
  --azure-maxretries-count=3     When using the Azure provider, set the number of retries for
                                 API calls (When less than 0, it disables retries). (optional)
                                 ($EXTERNAL_DNS_AZURE_MAXRETRIES_COUNT)
  --batch-change-size=200        Set the maximum number of DNS record changes that will
                                 be submitted to the provider in each batch (optional)
                                 ($EXTERNAL_DNS_BATCH_CHANGE_SIZE)
  --batch-change-interval=1s     Set the interval between batch changes (optional, default:
                                 1s) ($EXTERNAL_DNS_BATCH_CHANGE_INTERVAL)
  --[no-]cloudflare-proxied      When using the Cloudflare provider, specify if the proxy mode must
                                 be enabled (default: disabled) ($EXTERNAL_DNS_CLOUDFLARE_PROXIED)
  --[no-]cloudflare-custom-hostnames
                                 When using the Cloudflare provider, specify if the Custom Hostnames
                                 feature will be used. Requires "Cloudflare for SaaS" enabled.
                                 (default: disabled) ($EXTERNAL_DNS_CLOUDFLARE_CUSTOM_HOSTNAMES)
  --cloudflare-custom-hostnames-min-tls-version=1.0
                                 When using the Cloudflare provider with the Custom Hostnames,
                                 specify which Minimum TLS Version will be used by
                                 default. (default: 1.0, options: 1.0, 1.1, 1.2, 1.3)
                                 ($EXTERNAL_DNS_CLOUDFLARE_CUSTOM_HOSTNAMES_MIN_TLS_VERSION)
  --cloudflare-custom-hostnames-certificate-authority=none
                                 When using the Cloudflare provider with the Custom Hostnames,
                                 specify which Certificate Authority will be used. A value of none
                                 indicates no Certificate Authority will be sent to the Cloudflare
                                 API (default: none, options: google, ssl_com, lets_encrypt, none)
                                 ($EXTERNAL_DNS_CLOUDFLARE_CUSTOM_HOSTNAMES_CERTIFICATE_AUTHORITY)
  --cloudflare-dns-records-per-page=100
                                 When using the Cloudflare provider, specify how many DNS
                                 records listed per page, max possible 5,000 (default: 100)
                                 ($EXTERNAL_DNS_CLOUDFLARE_DNS_RECORDS_PER_PAGE)
  --[no-]cloudflare-regional-services
                                 When using the Cloudflare provider, specify if Regional
                                 Services feature will be used (default: disabled)
                                 ($EXTERNAL_DNS_CLOUDFLARE_REGIONAL_SERVICES)
  --cloudflare-region-key=""     When using the Cloudflare provider, specify the default
                                 region for Regional Services. Any value other than an empty
                                 string will enable the Regional Services feature (optional)
                                 ($EXTERNAL_DNS_CLOUDFLARE_REGION_KEY)
  --cloudflare-record-comment=""
                                 When using the Cloudflare provider, specify the comment for the DNS
                                 records (default: ”) ($EXTERNAL_DNS_CLOUDFLARE_RECORD_COMMENT)
  --coredns-prefix="/skydns/"    When using the CoreDNS provider, specify the prefix name
                                 ($EXTERNAL_DNS_COREDNS_PREFIX)
  --[no-]coredns-strictly-owned  When using the CoreDNS provider, store and filter strictly by
                                 txt-owner-id using an extra field inside of the etcd service
                                 (default: false) ($EXTERNAL_DNS_COREDNS_STRICTLY_OWNED)
  --oci-config-file="/etc/kubernetes/oci.yaml"
                                 When using the OCI provider, specify the OCI configuration file
                                 (required when --provider=oci ($EXTERNAL_DNS_OCI_CONFIG_FILE)
  --oci-compartment-ocid=""      When using the OCI provider, specify the OCID of the OCI
                                 compartment containing all managed zones and records.
                                 Required when using OCI IAM instance principal authentication.
                                 ($EXTERNAL_DNS_OCI_COMPARTMENT_OCID)
  --oci-zone-scope=GLOBAL        When using OCI provider, filter for zones with this scope
                                 (optional, options: GLOBAL, PRIVATE). Defaults to GLOBAL, setting
                                 to empty value will target both. ($EXTERNAL_DNS_OCI_ZONE_SCOPE)
  --[no-]oci-auth-instance-principal
                                 When using the OCI provider, specify whether OCI IAM
                                 instance principal authentication should be used
                                 (instead of key-based auth via the OCI config file).
                                 ($EXTERNAL_DNS_OCI_AUTH_INSTANCE_PRINCIPAL)
  --oci-zones-cache-duration=0s  When using the OCI provider, set the zones list cache TTL (0s to
                                 disable). ($EXTERNAL_DNS_OCI_ZONES_CACHE_DURATION)
  --inmemory-zone= ...           Provide a list of pre-configured zones for the inmemory provider;
                                 specify multiple times for multiple zones (optional)
                                 ($EXTERNAL_DNS_INMEMORY_ZONE)
  --ovh-endpoint="ovh-eu"        When using the OVH provider, specify the endpoint (default:
                                 ovh-eu) ($EXTERNAL_DNS_OVH_ENDPOINT)
  --ovh-api-rate-limit=20        When using the OVH provider, specify the API request
                                 rate limit, X operations by seconds (default: 20)
                                 ($EXTERNAL_DNS_OVH_API_RATE_LIMIT)
  --[no-]ovh-enable-cname-relative
                                 When using the OVH provider, specify if CNAME should be treated
                                 as relative on target without final dot (default: false)
                                 ($EXTERNAL_DNS_OVH_ENABLE_CNAME_RELATIVE)
  --pdns-server="http://localhost:8081"
                                 When using the PowerDNS/PDNS provider, specify the URL to the pdns
                                 server (required when --provider=pdns) ($EXTERNAL_DNS_PDNS_SERVER)
  --pdns-server-id="localhost"   When using the PowerDNS/PDNS provider, specify the id of the server
                                 to retrieve. Should be `localhost` except when the server is behind
                                 a proxy (optional when --provider=pdns) (default: localhost)
                                 ($EXTERNAL_DNS_PDNS_SERVER_ID)
  --pdns-api-key=""              When using the PowerDNS/PDNS provider, specify the API key
                                 to use to authorize requests (required when --provider=pdns)
                                 ($EXTERNAL_DNS_PDNS_API_KEY)
  --[no-]pdns-skip-tls-verify    When using the PowerDNS/PDNS provider, disable verification of
                                 any TLS certificates (optional when --provider=pdns) (default:
                                 false) ($EXTERNAL_DNS_PDNS_SKIP_TLS_VERIFY)
  --ns1-endpoint=""              When using the NS1 provider, specify the URL of the API
                                 endpoint to target (default: https://api.nsone.net/v1/)
                                 ($EXTERNAL_DNS_NS1_ENDPOINT)
  --[no-]ns1-ignoressl           When using the NS1 provider, specify whether to verify the SSL
                                 certificate (default: false) ($EXTERNAL_DNS_NS1_IGNORESSL)
  --ns1-min-ttl=0                Minimal TTL (in seconds) for records. This value will be used
                                 if the provided TTL for a service/ingress is lower than this.
                                 ($EXTERNAL_DNS_NS1_MIN_TTL)
  --godaddy-api-key=""           When using the GoDaddy provider, specify the API Key (required when
                                 --provider=godaddy) ($EXTERNAL_DNS_GODADDY_API_KEY)
  --godaddy-api-secret=""        When using the GoDaddy provider, specify the API secret (required
                                 when --provider=godaddy) ($EXTERNAL_DNS_GODADDY_API_SECRET)
  --godaddy-api-ttl=0            TTL (in seconds) for records. This value will be used if
                                 the provided TTL for a service/ingress is not provided.
                                 ($EXTERNAL_DNS_GODADDY_API_TTL)
  --[no-]godaddy-api-ote         When using the GoDaddy provider, use OTE api (optional, default:
                                 false, when --provider=godaddy) ($EXTERNAL_DNS_GODADDY_API_OTE)
  --tls-ca=""                    When using TLS communication, the path to the certificate
                                 authority to verify server communications (optionally specify
                                 --tls-client-cert for two-way TLS) ($EXTERNAL_DNS_TLS_CA)
  --tls-client-cert=""           When using TLS communication, the path to the
                                 certificate to present as a client (not required for TLS)
                                 ($EXTERNAL_DNS_TLS_CLIENT_CERT)
  --tls-client-cert-key=""       When using TLS communication, the path to the certificate
                                 key to use with the client certificate (not required for TLS)
                                 ($EXTERNAL_DNS_TLS_CLIENT_CERT_KEY)
  --exoscale-apienv="api"        When using Exoscale provider, specify the API environment
                                 (optional) ($EXTERNAL_DNS_EXOSCALE_APIENV)
  --exoscale-apizone="ch-gva-2"  When using Exoscale provider, specify the API Zone (optional)
                                 ($EXTERNAL_DNS_EXOSCALE_APIZONE)
  --exoscale-apikey=""           Provide your API Key for the Exoscale provider
                                 ($EXTERNAL_DNS_EXOSCALE_APIKEY)
  --exoscale-apisecret=""        Provide your API Secret for the Exoscale provider
                                 ($EXTERNAL_DNS_EXOSCALE_APISECRET)
  --exoscale-zones-cache-duration=0s
                                 When using Exoscale provider, set the zones list cache TTL (0s to
                                 disable) ($EXTERNAL_DNS_EXOSCALE_ZONES_CACHE_DURATION)
  --scaleway-zones-cache-duration=0s
                                 When using the Scaleway provider, set the zones list cache TTL (0s
                                 to disable). ($EXTERNAL_DNS_SCALEWAY_ZONES_CACHE_DURATION)
  --rfc2136-host= ...            When using the RFC2136 provider, specify the host of the
                                 DNS server (optionally specify multiple times when using
                                 --rfc2136-load-balancing-strategy) ($EXTERNAL_DNS_RFC2136_HOST)
  --rfc2136-port=0               When using the RFC2136 provider, specify the port of the DNS server
                                 ($EXTERNAL_DNS_RFC2136_PORT)
  --rfc2136-zone=RFC2136-ZONE ...
                                 When using the RFC2136 provider, specify zone entry of
                                 the DNS server to use (can be specified multiple times)
                                 ($EXTERNAL_DNS_RFC2136_ZONE)
  --[no-]rfc2136-insecure        When using the RFC2136 provider, specify whether to attach TSIG
                                 or not (default: false, requires --rfc2136-tsig-keyname and
                                 rfc2136-tsig-secret) ($EXTERNAL_DNS_RFC2136_INSECURE)
  --rfc2136-tsig-keyname=""      When using the RFC2136 provider, specify the TSIG key to attached
                                 to DNS messages (required when --rfc2136-insecure=false)
                                 ($EXTERNAL_DNS_RFC2136_TSIG_KEYNAME)
  --rfc2136-tsig-secret=""       When using the RFC2136 provider, specify the TSIG (base64) value to
                                 attached to DNS messages (required when --rfc2136-insecure=false)
                                 ($EXTERNAL_DNS_RFC2136_TSIG_SECRET)
  --rfc2136-tsig-secret-alg=""   When using the RFC2136 provider, specify the TSIG (base64) value to
                                 attached to DNS messages (required when --rfc2136-insecure=false)
                                 ($EXTERNAL_DNS_RFC2136_TSIG_SECRET_ALG)
  --[no-]rfc2136-axfr            When using the RFC2136 provider, enable zone transfers
                                 (AXFR) to list existing records (without it ExternalDNS
                                 cannot read records and behaves as if --policy=create-only)
                                 ($EXTERNAL_DNS_RFC2136_AXFR)
  --[no-]rfc2136-axfr-insecure   When using the RFC2136 provider, do not attach TSIG to
                                 AXFR/zone-transfer requests. Requires --rfc2136-axfr. UPDATE
                                 requests are still signed unless --rfc2136-insecure is set.
                                 Useful for split-role deployments where zone transfers are served
                                 unsigned from a separate endpoint while updates remain TSIG-gated.
                                 ($EXTERNAL_DNS_RFC2136_AXFR_INSECURE)
  --[no-]rfc2136-tsig-axfr       [DEPRECATED: use --rfc2136-axfr] When using the RFC2136 provider,
                                 enable zone transfers (AXFR) to list existing records
                                 ($EXTERNAL_DNS_RFC2136_TSIG_AXFR)
  --rfc2136-min-ttl=0s           When using the RFC2136 provider, specify minimal TTL (in
                                 duration format) for records. This value will be used if
                                 the provided TTL for a service/ingress is lower than this
                                 ($EXTERNAL_DNS_RFC2136_MIN_TTL)
  --[no-]rfc2136-gss-tsig        When using the RFC2136 provider, specify whether to use
                                 secure updates with GSS-TSIG using Kerberos (default: false,
                                 requires --rfc2136-kerberos-realm, --rfc2136-kerberos-username,
                                 and rfc2136-kerberos-password) ($EXTERNAL_DNS_RFC2136_GSS_TSIG)
  --rfc2136-kerberos-username=""
                                 When using the RFC2136 provider with GSS-TSIG, specify the username
                                 of the user with permissions to update DNS records (required when
                                 --rfc2136-gss-tsig=true) ($EXTERNAL_DNS_RFC2136_KERBEROS_USERNAME)
  --rfc2136-kerberos-password=""
                                 When using the RFC2136 provider with GSS-TSIG, specify the password
                                 of the user with permissions to update DNS records (required when
                                 --rfc2136-gss-tsig=true) ($EXTERNAL_DNS_RFC2136_KERBEROS_PASSWORD)
  --rfc2136-kerberos-realm=""    When using the RFC2136 provider with GSS-TSIG, specify the realm
                                 of the user with permissions to update DNS records (required when
                                 --rfc2136-gss-tsig=true) ($EXTERNAL_DNS_RFC2136_KERBEROS_REALM)
  --rfc2136-batch-change-size=50
                                 When using the RFC2136 provider, set the maximum
                                 number of changes that will be applied in each batch.
                                 ($EXTERNAL_DNS_RFC2136_BATCH_CHANGE_SIZE)
  --[no-]rfc2136-use-tls         When using the RFC2136 provider, communicate with name server over
                                 tls ($EXTERNAL_DNS_RFC2136_USE_TLS)
  --[no-]rfc2136-skip-tls-verify
                                 When using TLS with the RFC2136 provider, disable verification of
                                 any TLS certificates ($EXTERNAL_DNS_RFC2136_SKIP_TLS_VERIFY)
  --rfc2136-load-balancing-strategy=disabled
                                 When using the RFC2136 provider, specify the load balancing
                                 strategy (default: disabled, options: random, round-robin,
                                 disabled) ($EXTERNAL_DNS_RFC2136_LOAD_BALANCING_STRATEGY)
  --pihole-server=""             When using the Pihole provider, the base URL of the
                                 Pihole web server (required when --provider=pihole)
                                 ($EXTERNAL_DNS_PIHOLE_SERVER)
  --pihole-password=""           When using the Pihole provider, the password to the server if it is
                                 protected ($EXTERNAL_DNS_PIHOLE_PASSWORD)
  --[no-]pihole-tls-skip-verify  When using the Pihole provider, disable verification of any TLS
                                 certificates ($EXTERNAL_DNS_PIHOLE_TLS_SKIP_VERIFY)
  --policy=                      Modify how DNS records are synchronized between sources and
                                 providers (required, no default; options: sync, upsert-only,
                                 create-only) ($EXTERNAL_DNS_POLICY)
  --registry=txt                 The registry implementation to use to keep track of DNS record
                                 ownership (default: txt, options: aws-sd, crd, dynamodb, noop,
                                 txt) ($EXTERNAL_DNS_REGISTRY)
  --crd-registry-namespace=""    When using the CRD registry, the namespace the DNSRecord objects
                                 are stored in (default: the namespace ExternalDNS runs in)
                                 ($EXTERNAL_DNS_CRD_REGISTRY_NAMESPACE)
  --txt-owner-id="default"       When using the TXT, DynamoDB or CRD registry, a name that
                                 identifies this instance of ExternalDNS (default: default)
                                 ($EXTERNAL_DNS_TXT_OWNER_ID)
  --txt-prefix=""                When using the TXT registry, a custom string that's prefixed to
                                 each ownership DNS record (optional). Could contain record type
                                 template like '%{record_type}-prefix-'. Mutual exclusive with
                                 txt-suffix! ($EXTERNAL_DNS_TXT_PREFIX)
  --txt-suffix=""                When using the TXT registry, a custom string that's suffixed
                                 to the host portion of each ownership DNS record (optional).
                                 Could contain record type template like '-%{record_type}-suffix'.
                                 Mutual exclusive with txt-prefix! ($EXTERNAL_DNS_TXT_SUFFIX)
  --txt-wildcard-replacement=""  When using the TXT registry, a custom string that's used instead of
                                 an asterisk for TXT records corresponding to wildcard DNS records
                                 (optional) ($EXTERNAL_DNS_TXT_WILDCARD_REPLACEMENT)
  --[no-]txt-encrypt-enabled     When using the TXT registry, set if TXT records
                                 should be encrypted before stored (default: disabled)
                                 ($EXTERNAL_DNS_TXT_ENCRYPT_ENABLED)
  --txt-encrypt-aes-key=""       When using the TXT registry, set TXT record decryption and
                                 encryption 32 byte aes key (required when --txt-encrypt=true)
                                 ($EXTERNAL_DNS_TXT_ENCRYPT_AES_KEY)
  --migrate-from-txt-owner=""    Old txt-owner-id that needs to be overwritten (default: default)
                                 ($EXTERNAL_DNS_MIGRATE_FROM_TXT_OWNER)
  --dynamodb-region=""           When using the DynamoDB registry, the AWS region of the DynamoDB
                                 table (optional) ($EXTERNAL_DNS_DYNAMODB_REGION)
  --dynamodb-table="external-dns"
                                 When using the DynamoDB registry, the name of the DynamoDB table
                                 (default: "external-dns") ($EXTERNAL_DNS_DYNAMODB_TABLE)
  --txt-cache-interval=0s        The interval between cache synchronizations in duration format
                                 (default: disabled) ($EXTERNAL_DNS_TXT_CACHE_INTERVAL)
  --interval=1m0s                The interval between two consecutive synchronizations in duration
                                 format (default: 1m) ($EXTERNAL_DNS_INTERVAL)
  --min-event-sync-interval=5s   The minimum interval between two consecutive synchronizations
                                 triggered from kubernetes events in duration format (default:
                                 5s) ($EXTERNAL_DNS_MIN_EVENT_SYNC_INTERVAL)
  --[no-]once                    When enabled, exits the synchronization loop after the first
                                 iteration (default: disabled) ($EXTERNAL_DNS_ONCE)
  --[no-]dry-run                 When enabled, prints DNS record changes rather than actually
                                 performing them (default: disabled) ($EXTERNAL_DNS_DRY_RUN)
  --[no-]events                  When enabled, in addition to running every interval, the
                                 reconciliation loop will get triggered when supported sources
                                 change (default: disabled) ($EXTERNAL_DNS_EVENTS)
  --min-ttl=0s                   Configure global TTL for records in duration format. This value is
                                 used when the TTL for a source is not set or set to 0. (optional;
                                 examples: 1m12s, 72s, 72) ($EXTERNAL_DNS_MIN_TTL)
  --log-format=text              The format in which log messages are printed (default: text,
                                 options: text, json) ($EXTERNAL_DNS_LOG_FORMAT)
  --metrics-address=":7979"      Specify where to serve the metrics and health check endpoint
                                 (default: :7979) ($EXTERNAL_DNS_METRICS_ADDRESS)
  --log-level=info               Set the level of logging. (default: info, options: panic, debug,
                                 info, warning, error, fatal) ($EXTERNAL_DNS_LOG_LEVEL)
  --webhook-provider-url="http://localhost:8888"
                                 The URL of the remote endpoint to call for the
                                 webhook provider (default: http://localhost:8888)
                                 ($EXTERNAL_DNS_WEBHOOK_PROVIDER_URL)
  --webhook-provider-read-timeout=5s
                                 The read timeout for the webhook provider in duration format
                                 (default: 5s) ($EXTERNAL_DNS_WEBHOOK_PROVIDER_READ_TIMEOUT)
  --webhook-provider-write-timeout=10s
                                 The write timeout for the webhook provider in duration format
                                 (default: 10s) ($EXTERNAL_DNS_WEBHOOK_PROVIDER_WRITE_TIMEOUT)
  --webhook-provider-read-header-timeout=5s
                                 The header read timeout for the webhook server in duration format,
                                 bounding slow header sends independently of the read timeout
                                 (default: 5s) ($EXTERNAL_DNS_WEBHOOK_PROVIDER_READ_HEADER_TIMEOUT)
  --webhook-provider-idle-timeout=30s
                                 The idle timeout for the webhook server keep-alive
                                 connections in duration format (default: 30s)
                                 ($EXTERNAL_DNS_WEBHOOK_PROVIDER_IDLE_TIMEOUT)
  --webhook-provider-max-body-size=33554432
                                 Maximum size in bytes of a webhook request or response body;
                                 larger payloads are rejected (default: 33554432, i.e. 32 MiB,
                                 0 disables) ($EXTERNAL_DNS_WEBHOOK_PROVIDER_MAX_BODY_SIZE)
  --[no-]webhook-server          When enabled, runs as a webhook server instead of a controller.
                                 (default: false). ($EXTERNAL_DNS_WEBHOOK_SERVER)
  --[no-]combine-fqdn-annotation
                                 Combine FQDN template and Annotations instead of overwriting
                                 (default: false) ($EXTERNAL_DNS_COMBINE_FQDN_ANNOTATION)
  --fqdn-template=FQDN-TEMPLATE ...
                                 A templated string that's used to generate DNS names
                                 from sources that don't define a hostname themselves,
                                 or to add a hostname suffix when paired with the fake source
                                 (optional). Specify multiple times for multiple templates.
                                 ($EXTERNAL_DNS_FQDN_TEMPLATE)
  --target-template=TARGET-TEMPLATE ...
                                 A templated string used to generate DNS targets (IP or hostname)
                                 from sources that support it (optional). Specify multiple times for
                                 multiple targets. ($EXTERNAL_DNS_TARGET_TEMPLATE)
  --fqdn-target-template=FQDN-TARGET-TEMPLATE ...
                                 A template that returns host:target pairs (e.g., '{{range
                                 .Object.endpoints}}{{.targetRef.name}}.svc.example.com:{{index
                                 .addresses 0}},{{end}}'). Specify multiple times for multiple
                                 pairs. ($EXTERNAL_DNS_FQDN_TARGET_TEMPLATE)
  --kubeconfig=""                Retrieve target cluster configuration from a Kubernetes
                                 configuration file (default: $KUBECONFIG, ~/.kube/config,
                                 in-cluster) ($EXTERNAL_DNS_KUBECONFIG)
  --request-timeout=30s          [DEPRECATED: use --kube-api-request-timeout] Request
                                 timeout when calling Kubernetes APIs. 0s means no timeout
                                 ($EXTERNAL_DNS_REQUEST_TIMEOUT)
  --kube-api-request-timeout=30s
                                 Request timeout when calling Kubernetes APIs. 0s means no timeout
                                 ($EXTERNAL_DNS_KUBE_API_REQUEST_TIMEOUT)
  --kube-api-qps=5               Maximum QPS to the Kubernetes API server from this client.
                                 ($EXTERNAL_DNS_KUBE_API_QPS)
  --kube-api-burst=10            Maximum burst for throttle to the Kubernetes API server from this
                                 client. ($EXTERNAL_DNS_KUBE_API_BURST)
  --provider=provider            The DNS provider where the DNS records will be created (required,
                                 options: alibabacloud, aws, aws-sd, azure, azure-dns,
                                 azure-private-dns, civo, cloudflare, coredns, dnsimple, exoscale,
                                 godaddy, google, inmemory, linode, ns1, oci, ovh, pdns, pihole,
                                 rfc2136, scaleway, skydns, webhook) ($EXTERNAL_DNS_PROVIDER)
  --source=source ...            The resource types that are queried for endpoints; specify multiple
                                 times for multiple sources (required, options: ambassador-host,
                                 connector, contour-httpproxy, crd, empty, f5-transportserver,
                                 f5-virtualserver, fake, gateway-grpcroute, gateway-httproute,
                                 gateway-tcproute, gateway-tlsroute, gateway-udproute, gloo-proxy,
                                 ingress, istio-gateway, istio-virtualservice, kong-tcpingress,
                                 node, openshift-route, pod, service, skipper-routegroup,
                                 traefik-proxy, unstructured) ($EXTERNAL_DNS_SOURCE)