Chapter 19: Kubernetes Services, Ingress and Volumes

19.5 ExternalName — an alias to a name outside

By Ravindra Bagale · Last updated: 25 October 2026

Why: the problem

The Swiggy order service on Kubernetes must talk to a database that is not in the cluster. It is an Amazon RDS MySQL with a long name like orders-db.abc123.ap-south-1.rds.amazonaws.com. If every app writes that long name in its config, moving the database means changing ten apps. Worse, dev, test and prod use different databases. An ExternalName Service fixes this. You make a Service called mysql whose only job is to say "mysql means orders-db.abc123...". Kubernetes DNS answers with a CNAME record. No proxy, no ports, no Pods. Apps always connect to mysql:3306. To move the database, you change one Service. In this lesson you will create an ExternalName Service, see the CNAME in DNS, use it for a public API and a fake RDS name, and learn the limits: no port mapping, and HTTPS hosts must match the certificate.

What we will build

You will make two ExternalName Services: one for a real public name (example.com) and one that stands for an RDS endpoint. You will see the CNAME with nslookup, call it with curl, and switch it to another target with one patch.

What: every term in plain English

• ExternalName — A Service type that is only a DNS alias to an outside name.
• CNAME — A DNS record that says "this name is another name".
• CoreDNS — The DNS server inside the cluster.
• RDS — Amazon Relational Database Service, managed databases on AWS.
• Endpoint name — The long DNS name AWS gives your RDS database.
• Service without selector — A Service with manual Endpoints, used for outside IPs instead of names.
• Host header — The name an HTTP client sends. Some servers reject names they do not know.

How: step by step

1. Start a lab cluster

   kind create cluster --name lab
   kubectl get nodes
   

   What it does: Creates a one-node Kubernetes cluster inside Docker. On minikube use: minikube start.

   Output

   Creating cluster "lab" ...
    ✓ Ensuring node image (kindest/node:v1.30.0)
    ✓ Preparing nodes
   Set kubectl context to "kind-lab"
   NAME                STATUS   ROLES           AGE   VERSION
   lab-control-plane   Ready    control-plane   40s   v1.30.0
   

2. Make a practice namespace

   kubectl create namespace practice
   kubectl config set-context --current --namespace=practice
   

   What it does: Keeps all lab objects in one folder that is easy to delete.

   Output

   namespace/practice created
   Context "kind-lab" modified.
   

3. Create the alias

   kubectl create service externalname web-out --external-name example.com
   

   What it does: Makes web-out mean example.com.

   Output

   service/web-out created
   

4. Look at it

   kubectl get svc web-out
   

   What it does: No ClusterIP; EXTERNAL-IP shows the target name.

   Output

   NAME      TYPE           CLUSTER-IP   EXTERNAL-IP   PORT(S)
   web-out   ExternalName   none         example.com   none
   

5. Ask DNS

   kubectl run d --rm -it --image=busybox:1.36 --restart=Never -- nslookup web-out
   

   What it does: CoreDNS returns a CNAME to example.com.

   Output

   web-out.practice.svc.cluster.local  canonical name = example.com
   Name:   example.com
   Address: 93.184.215.14
   

6. Call it

   kubectl run t --rm -it --image=curlimages/curl:8.8.0 --restart=Never -- curl -s -H "Host: example.com" web-out | grep -o "Example Domain" | head -1
   

   What it does: The Host header must be the real name for many web servers.

   Output

   Example Domain
   

Example 1: An alias for an RDS database, so apps use one short name

Stack. EKS + RDS MySQL 8.0

Goal. An alias for an RDS database, so apps use one short name.

mysql-ext.yaml

apiVersion: v1
kind: Service
metadata:
  name: mysql
spec:
  type: ExternalName
  externalName: orders-db.abc123xyz.ap-south-1.rds.amazonaws.com

app config (env)

env:
- name: DB_HOST
  value: mysql
- name: DB_PORT
  value: "3306"

What each line does

• type: ExternalName — Only an alias, nothing else.
• externalName — The RDS endpoint shown in the RDS console under Connectivity.
• DB_HOST: mysql — The app uses the short name in every environment.
• DB_PORT 3306 — ExternalName cannot change ports, so use the real one.

Green output

$ kubectl apply -f mysql-ext.yaml
service/mysql created
$ kubectl run d --rm -it --image=busybox:1.36 --restart=Never -- nslookup mysql
mysql.practice.svc.cluster.local  canonical name = orders-db.abc123xyz.ap-south-1.rds.amazonaws.com

Expected result. Apps say mysql. Only this Service knows the real endpoint. Dev and prod namespaces can each point mysql to their own database.

Example 2: Move the database with one patch

Stack. kubectl patch

Goal. Move the database with one patch.

terminal

kubectl patch svc mysql -p '{"spec":{"externalName":"orders-db-new.abc123xyz.ap-south-1.rds.amazonaws.com"}}'
kubectl get svc mysql
kubectl run d --rm -it --image=busybox:1.36 --restart=Never -- nslookup mysql | grep canonical

What each line does

• kubectl patch — Changes one field in place.
• externalName new value — The new database endpoint, for example after a restore.
• nslookup mysql — DNS now points to the new name.

Green output

service/mysql patched
NAME    TYPE           EXTERNAL-IP
mysql   ExternalName   orders-db-new.abc123xyz.ap-south-1.rds.amazonaws.com
mysql.practice.svc.cluster.local  canonical name = orders-db-new.abc123xyz.ap-south-1.rds.amazonaws.com

Expected result. No app was changed or redeployed. New connections go to the new database. (Apps with long-lived connection pools should be restarted to reconnect.)

Example 3: An outside service known only by IP: a Service without a selector

Stack. Kubernetes EndpointSlice API

Goal. An outside service known only by IP: a Service without a selector.

legacy-db.yaml

apiVersion: v1
kind: Service
metadata:
  name: legacy-db
spec:
  ports:
  - port: 5432
---
apiVersion: discovery.k8s.io/v1
kind: EndpointSlice
metadata:
  name: legacy-db-1
  labels:
    kubernetes.io/service-name: legacy-db
addressType: IPv4
ports:
- port: 5432
endpoints:
- addresses: ["10.0.12.34"]

What each line does

• Service with no selector — Kubernetes will not look for Pods.
• EndpointSlice — You list the outside IP yourself.
• kubernetes.io/service-name — Links the slice to the Service.
• 10.0.12.34 — For example, an old Postgres VM inside the VPC.

Green output

$ kubectl apply -f legacy-db.yaml
service/legacy-db created
endpointslice.discovery.k8s.io/legacy-db-1 created
$ kubectl get svc legacy-db
NAME        TYPE        CLUSTER-IP     PORT(S)
legacy-db   ClusterIP   10.96.200.17   5432/TCP

Expected result. Use ExternalName when the outside thing has a DNS name, and a selector-less Service with an EndpointSlice when it has only an IP.

Verify: did it work?

1. List the aliases

   kubectl get svc --field-selector spec.type=ExternalName
   

   What it does: Shows only ExternalName Services.

   Output

   NAME      TYPE           EXTERNAL-IP
   mysql     ExternalName   orders-db-new.abc123xyz.ap-south-1.rds.amazonaws.com
   web-out   ExternalName   example.com
   

2. Check the YAML

   kubectl get svc mysql -o yaml | grep -E "type|externalName"
   

   What it does: Confirms the type and target.

   Output

   externalName: orders-db-new.abc123xyz.ap-south-1.rds.amazonaws.com
   type: ExternalName
   

When it is red 1

SSL: no alternative certificate subject name matches target host name 'web-out'

Cause. HTTPS checks the name in the certificate. web-out is not in it.

Fix, step by step

1. Call the real name for HTTPS, or set the Host / SNI to the real name.
2. Use ExternalName mainly for DB and TCP endpoints.

When it is red 2

ERROR 2005 (HY000): Unknown MySQL server host 'mysql'

Cause. The app is in another namespace, or the Service is missing.

Fix, step by step

1. Use mysql.practice or create the Service in the app's namespace.
2. Check kubectl get svc -A | grep mysql.

When it is red 3

404 Not Found from the outside server

Cause. The outside web server saw Host: web-out and did not know it.

Fix, step by step

1. Send the right Host header.
2. Or call the real name directly.

Cleanup

1. Delete the Services

   kubectl delete svc web-out mysql legacy-db
   

   What it does: Removes the aliases.

   Output

   service "web-out" deleted
   service "mysql" deleted
   service "legacy-db" deleted
   

2. Delete the practice namespace

   kubectl delete namespace practice
   

   What it does: Deletes every object you made in this lesson in one go.

   Output

   namespace "practice" deleted
   

Practice tasks

Homework: try at home

Recap

• ExternalName is a DNS alias (CNAME) to an outside name.
• It has no IP, no proxy and no port mapping.
• Great for RDS and other managed services.
• Change the target with one patch, no app changes.
• For outside IPs use a selector-less Service with an EndpointSlice.

FAQ

Does ExternalName load balance?

No. DNS of the outside name does that.

Is it secure?

It is only DNS. Use security groups and TLS for the real protection.

Can I use it for HTTPS sites?

Yes, but the client must use the real host name for the certificate.

Will apps see the change at once?

New DNS lookups will. Apps that cache connections may need a restart.

Can I point it to another Service in another namespace?

Yes, for example svc-name.other-ns.svc.cluster.local.

Interview questions

1. What is an ExternalName Service?

   A Service that returns a CNAME to an external DNS name, with no proxying.

2. When do you use it?

   To give in-cluster apps a stable name for managed services like RDS, or to migrate services.

3. What are its limits?

   No port remapping, no selectors, TLS name mismatches.

4. How do you point a Service to an external IP?

   Create a Service without selector and add an EndpointSlice with the IP.

5. How would you switch from an in-cluster DB to RDS without changing apps?

   Replace the ClusterIP Service with an ExternalName Service of the same name pointing to RDS.

Samajla ka?

Ravi Sir's Cards for this lesson

Revision cardInterview card

मराठी cards