Hello there,
I maintain a fork of @pinguino’s external-dns webhook at GitHub - sshine/external-dns-desec-provider: ExternalDNS webhook to manage Desec.io DNS records! · GitHub where I’ve fixed a number of small bugs. I’ve got a case where I’m unsure what the correct way to handle is.
The short story: Switching a LoadBalancer to a ClusterIP caused external-dns to unintentionally switch from A records to CNAME records for a bunch of subdomains (you live and you learn); I found out because external-dns-desec-provider failed to perform the update: A safe way to migrate an A record to a CNAME record would be to add the CNAME, and then remove the A. But deSEC apparently does not allow both an A and a CNAME for the same subdomain, so the webhook gets stuck reconciling.
I think the correct way to do this must be to create a single request that both adds and removes at the same time, since removing and adding as two separate steps does not guarantee availability. Does the deSEC API support and encourage this? And more generally, does anyone know if this is a common corner case in external-dns webhooks, or is deSEC particularly pedantic about overlapping record types? My experience is that whenever deSEC has an atypical preference, it is usually based on educated opinion.
I think that atomic updates across create/update/delete is pretty obviously necessary, and that a simple way to handle failure is to simply concatenate bulk requests upon failure, so that if the requests land asynchronously in the webhook, they will end up in a single bulk request eventually.