Wildcard DNS Support for DNSEndpoint Resources

[angelbarrera92]

Problem Description

The CoreDNS CRD plugin currently does not support wildcard DNS entries. When creating a DNSEndpoint with a wildcard pattern like *.example.com, queries for subdomains such as whatever.example.com fail to resolve.

Current Behavior

• DNSEndpoint with dnsName: "*.example.com" is created
• Query for whatever.example.com returns no results (NXDOMAIN or empty response)
• Only exact hostname matches work

Expected Behavior

• DNSEndpoint with dnsName: "*.example.com" should match single-level subdomains
• Query for whatever.example.com should resolve to the targets defined in the wildcard entry
• Follow standard DNS wildcard behavior:
  • *.example.com should match test.example.com ✓
  • *.example.com should NOT match example.com (apex domain) ✗
  • *.example.com should NOT match sub.test.example.com (multi-level) ✗
• Exact matches should take precedence over wildcard matches

Example Use Case

apiVersion: externaldns.k8s.io/v1alpha1
kind: DNSEndpoint
metadata:
  name: wildcard-apps
  labels:
    k8gb.absa.oss/dnstype: local
spec:
  endpoints:
  - dnsName: "*.apps.example.com"
    recordType: A
    targets:
    - 192.168.1.100
    - 192.168.1.101

With this configuration:

• app1.apps.example.com → should resolve to 192.168.1.100, 192.168.1.101
• app2.apps.example.com → should resolve to 192.168.1.100, 192.168.1.101
• apps.example.com → should NOT match the wildcard

Additional Context

This is a standard DNS feature (RFC 4592) and would greatly simplify DNS management for dynamic or multi-tenant environments where many subdomains need to resolve to the same targets.

[abaguas]

Hi @angelbarrera92, thank you for the issue and contribution.
Can you explain us how you are using wildcards in your k8gb/ingress setup? Do you offer multiple subdomains such as "a.apps.example.com" and "b.apps.example.com" from the same Kubernetes Service? And you want to configure a single GSLB and respective DNS record for all these subdomains?

[angelbarrera92]

That's right!

I manage multi-tenant Kubernetes clusters, operating them as a shared platform for our users.

To enable user workloads, we leverage a shared ingress controller configured with a cluster-wide wildcard domain (e.g., *.ingress.my-company.com).

To ensure secure exposure, I provision a wildcard certificate per namespace. This allows users to expose their applications using distinct, namespace-specific hostnames, such as:

• my-app.my-ns.ingress.my-company.com
• your-app.your-ns.ingress.my-company.com

This shared load balancer and ingress setup efficiently handles all user traffic.

TL;DR: Yes, we use a shared wildcard configuration to support multi-tenant exposure.