Yesterday, I published a post about using Kubernetes External DNS with Synology’s DNS Server. This morning, I realised that putting the TSIG key directly in the deployment manifest was probably a bad idea. Here’s how to put it in a Kubernetes Secret object.

My router is a Synology RT2600ac; by default it runs dnsmasq. I recently replaced it with Synology’s full-fat DNS Service (it’s BIND); this broke DNS for my K3s cluster; here’s how I replaced that with ExternalDNS, making everything work again.