Skip to content

Conversation

@vaheed
Copy link

@vaheed vaheed commented Feb 5, 2026

📌 Summary

Fixes a template bug in external-dns-raw.gotmpl where the Cloudflare provider references
.apiSecret, which is not defined in the Helm values schema. The correct field is .apiToken.

Why this is needed

When External-DNS is enabled with Cloudflare, otomi apply fails during Helm values rendering:
executing "stringTemplate" at <.apiSecret>: map has no entry for key "apiSecret"

Related issue

Fixes #2916

🔍 Reviewer Notes

🧹 Checklist

  • Code is readable, maintainable, and robust.
  • Unit tests added/updated

CF_API_TOKEN: "{{ . | b64enc }}"
{{- end }}
{{- with .apiSecret }}
{{- with .apiToken }}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
{{- with .apiToken }}
{{- with . | get "apiSecret" nil }}

@merll
Copy link
Contributor

merll commented Feb 9, 2026

Thank you for the report @vaheed and for the PR. Both apiSecret and apiToken exist in the schema, for allowing for both authentication methods to CloudFlare supported by external-dns. Using one or the other value is used to determine which variables to set.

Of course the template rendering should not fail if either of the values is missing. My suggestions above should fix this issue.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

fix/external-dns-cloudflare-api-token

2 participants