<p>I would like to use Route 53 as the DNS provider of a bare-metal k8s cluster. I've found a few guides on the internet, but they are all for cloud k8s clusters. </p>

<p>Have anyone done this before? </p>

Gaby
<p>I've managed to set this up on my on-prem K8s cluster. I used &quot;external-dns&quot; - running locally (<a href="https://github.com/kubernetes-sigs/external-dns" rel="nofollow noreferrer">https://github.com/kubernetes-sigs/external-dns</a>), and this is what I've done from the AWS side:</p>
<hr />
<h1>On AWS</h1>
<p>Create the following resources:</p>
<pre><code>IAM user k8s-r53-user
IAM policy assume-role-policy (attached to the k8s-r53-user)
IAM policy allow-k8s-r53-connection
IAM role k8s-r53-role (allow-k8s-r53-connection policy attached to this role)
</code></pre>
<h2>1 - Create IAM resource:</h2>
<pre><code>     $ aws iam create-user --user-name k8s-r53-user
</code></pre>
<h2>2 - Create policy (pretty generic):</h2>
<p>policy-document1.json</p>
<pre class="lang-json prettyprint-override"><code>        {
            &quot;Version&quot;: &quot;2012-10-17&quot;,
            &quot;Statement&quot;: [
                {
                    &quot;Effect&quot;: &quot;Allow&quot;,
                    &quot;Action&quot;: [
                        &quot;iam:ListRoles&quot;,
                        &quot;sts:AssumeRole&quot;
                    ],
                    &quot;Resource&quot;: &quot;*&quot;
                }
            ]
        }
</code></pre>
<p>run:</p>
<pre class="lang-sh prettyprint-override"><code>$ aws iam create-policy --policy-name assume-role-policy --policy-document policy-document1.json
</code></pre>
<h2>3 - attach the policy to k8s-r53-user:</h2>
<pre class="lang-sh prettyprint-override"><code>$ aws iam attach-user-policy --user-name k8s-r53-user --policy-arn &quot;arn:aws:iam::${account_id}:policy/assume-role-policy&quot;
</code></pre>
<p>check:</p>
<pre class="lang-sh prettyprint-override"><code>$ aws iam list-attached-user-policies --user-name k8s-r53-user
</code></pre>
<h2>4 - create an IAM policy which will be attached to the role.</h2>
<p>policy-document2.json:</p>
<pre class="lang-json prettyprint-override"><code>        {
            &quot;Version&quot;: &quot;2012-10-17&quot;,
            &quot;Statement&quot;: [
                {
                    &quot;Effect&quot;: &quot;Allow&quot;,
                    &quot;Action&quot;: [
                        &quot;route53:ChangeResourceRecordSets&quot;
                    ],
                    &quot;Resource&quot;: &quot;arn:aws:route53:::hostedzone/*&quot;
                },
            {
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Action&quot;: [
                &quot;route53:ListHostedZones&quot;,
                &quot;route53:ListResourceRecordSets&quot;
              ],
              &quot;Resource&quot;: [
                &quot;*&quot;
              ]
            }
        
            ]
        }
</code></pre>
<p>run:</p>
<pre class="lang-sh prettyprint-override"><code>$ aws iam create-policy --policy-name allow-k8s-r53-connection --policy-document policy-document2.json
</code></pre>
<h2>5 - Create IAM role:</h2>
<p>application-role-trust-policy.json:</p>
<pre class="lang-json prettyprint-override"><code>        {
            &quot;Version&quot;: &quot;2012-10-17&quot;,
            &quot;Statement&quot;: {
                &quot;Effect&quot;: &quot;Allow&quot;,
                &quot;Principal&quot;: { &quot;AWS&quot;: &quot;arn:aws:iam::&lt;account_id&gt;:root&quot; },
                &quot;Action&quot;: &quot;sts:AssumeRole&quot;
            }
        }
</code></pre>
<p>run:</p>
<pre class="lang-sh prettyprint-override"><code>$ aws iam create-role --role-name k8s-r53-role --assume-role-policy-document application-role-trust-policy.json
</code></pre>
<h2>6 - Configure k8s-r53-user on on-premise server</h2>
<p>Create access keys for the k8s-r53-user:</p>
<pre class="lang-sh prettyprint-override"><code>$ aws iam create-access-key --user-name k8s-r53-user
</code></pre>
<ul>
<li>Use the values from the last command output and run:</li>
</ul>
<pre class="lang-sh prettyprint-override"><code>$ aws configure
    AWS Access Key ID []: xxx
    AWS Secret Access Key []: xxx
    Default region name []:
    Default output format [None]:
</code></pre>
<hr />
<h1>K8s side</h1>
<p>Follow the guide on the External-Dns page, section &quot;Running locally&quot;, the only part that changes is the end:</p>
<p>run:</p>
<pre class="lang-sh prettyprint-override"><code>$ builds/external-dns --registry txt --provider=aws --aws-assume-'role=arn:aws:iam::${account_id}:role/k8s-r53-role --source service --once --dry-run'
</code></pre>
<p><strong>instead of:</strong></p>
<pre class="lang-sh prettyprint-override"><code>$ external-dns --registry txt --txt-owner-id my-cluster-id --provider google --google-project example-project --source service --once --dry-run
</code></pre>
<hr />
<h1>References</h1>
<p><a href="https://medium.com/@lvthillo/connect-on-premise-python-application-with-aws-services-using-roles-8b24ab4872e6" rel="nofollow noreferrer">https://medium.com/@lvthillo/connect-on-premise-python-application-with-aws-services-using-roles-8b24ab4872e6</a></p>
<p><a href="https://github.com/kubernetes-sigs/external-dns" rel="nofollow noreferrer">External DNS official repo</a></p>
