<p>I'm using EKS, Route53 and External-dns for my DNS records.</p>
<p>Here is the nginx-ingress I'm currently using</p>
<pre class="lang-yaml prettyprint-override"><code>nginx-ingress:
  controller:
    config:
      use-forwarded-headers: &quot;true&quot;
    service:
      annotations:
        external-dns.alpha.kubernetes.io/access: private
        external-dns.alpha.kubernetes.io/hostname: gitlab.${var.gitlab-domain}, registry.${var.gitlab-domain}
        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: ${data.aws_acm_certificate.cert.arn}
        service.beta.kubernetes.io/aws-load-balancer-backend-protocol: https
        service.beta.kubernetes.io/aws-load-balancer-ssl-ports: https
        service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: &quot;3600&quot;
        alb.ingress.kubernetes.io/scheme: internet-facing
        ${var.gitlab-domain}/dns-type: private
</code></pre>
<p>My problem is even though I'm using this line:
<code>external-dns.alpha.kubernetes.io/access: private</code>, external-dns will add records in both public and private route53 hosted zone. How to do to only have the records in my private zone?</p>
<p>For now, the only workaround I found is to not give the right on the public zone to route53, but it's not a long term solution.</p>

<p>I'm now using annotations filter</p>
<p>I have two external-dns one for the private zone one for the public</p>
<p>I add this to my external-dns helm chart:</p>
<pre><code>set {
    name  = &quot;annotationFilter&quot;
    value = &quot;company.com/dns-type in (private)&quot;
}
</code></pre>
<p>And after in my nginx-ingress controller, in the annotations I can use this annotation:</p>
<pre><code>company.com/dns-type: private
</code></pre>
