kuberture

Kubernetes controller that translates EndpointSlice resources into headless Services annotated for external-dns consumption.

Kubernetes maintains an EndpointSlice (default/kubernetes) with control plane node IP addresses, but external-dns cannot use EndpointSlice as a source. kuberture bridges this gap:

EndpointSlice (kubernetes) → kuberture → headless Service(s) with annotations → external-dns → DNS

• Multiple output configurations with independent hostnames, annotation prefixes, and address sources
• Four address resolution strategies (EndpointSlice direct, node internal/external/public IPs)
• Configuration hot-reload via fsnotify (no restart required for output changes)
• Server-side apply for safe, conflict-free Service management
• Prometheus metrics and health/readiness probes
• Helm chart with RBAC, ServiceMonitor, and security hardening

kuberture reads its configuration from a YAML file. The path is resolved in order:

1. --config CLI flag
2. KUBERTURE_CONFIG environment variable
3. /etc/kuberture/config.yaml (default)

source:
  namespace: default         # EndpointSlice namespace (default: "default")
  serviceName: kubernetes    # label filter: kubernetes.io/service-name (default: "kubernetes")

outputs:
  - name: internal
    hostname:
      - api-internal.k8s.example.com
    annotationPrefix: "internal.company.io/"
    serviceName: kuberture-internal
    recordTTL: 60
    addressSource: endpointslice
    addressType: IPv4

  - name: external
    hostname:
      - api.k8s.example.com
    annotationPrefix: "external-dns.alpha.kubernetes.io/"
    serviceName: kuberture-external
    recordTTL: 300
    addressSource: node-external
    addressType: IPv4

metricsBindAddress: ":8080"       # default: ":8080"
healthProbeBindAddress: ":8081"   # default: ":8081"

helm install kuberture oci://ghcr.io/lexfrei/kuberture/charts/kuberture \
  --namespace kuberture --create-namespace \
  --values my-values.yaml

config:
  outputs:
    - name: api
      hostname:
        - api.k8s.example.com
      serviceName: kuberture-api

• Go 1.26+
• golangci-lint v2.9+
• helm-unittest plugin (for chart tests)

make build          Build binary to bin/kuberture
make test           Run tests with race detector and coverage
make lint           Run golangci-lint
make lint-fix       Run golangci-lint with --fix
make fmt            Run gofumpt and goimports
make vet            Run go vet
make tidy           Run go mod tidy
make image          Build container image
make helm-lint      Lint Helm chart
make helm-package   Package Helm chart
make e2e            Run E2E tests with kind
make all            Run fmt, vet, lint, test, build

cmd/kuberture/           Entry point
internal/
  config/                YAML parsing, validation, hot-reload watcher
  controller/            Reconciler, metrics
  resolver/              Address resolution from EndpointSlices and Nodes
e2e/                     E2E tests with kind
chart/                   Helm chart
.github/workflows/       CI/CD (lint, test, PR builds, releases)

The controller uses split RBAC for least-privilege access:

Cluster-level (ClusterRole — read-only):

• discovery.k8s.io/endpointslices: get, list, watch
• core/nodes: get, list, watch

Namespace-level (Role — in the controller's own namespace):

• core/services: get, list, watch, create, update, patch, delete
• coordination.k8s.io/leases: get, list, watch, create, update, patch
• core/events: create, patch

BSD 3-Clause License