DNS-managed record overwritten without an ownership check

curl -s -H "Authorization: Bearer $CF_TOKEN" \
  "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records?name=app.example.com" \
  | jq '.result[] | {id, type, content, comment, tags}'

dig +short TXT app.example.com @1.1.1.1

# or, with a registry prefix such as extdns-:
dig +short TXT extdns-app.example.com @1.1.1.1

# a healthy result is exactly one line, like:
# "heritage=external-dns,external-dns/owner=team-a"

# a bad result is two or more lines with different owner= values, for example:
# "heritage=external-dns,external-dns/owner=team-a"
# "heritage=external-dns,external-dns/owner=team-b"

dig +short A app.example.com @1.1.1.1

# compare against your source of truth, e.g.:
terraform state show cloudflare_dns_record.app_example_com

terraform plan -target=cloudflare_dns_record.app_example_com

# an unexpected "~ update in-place" or "- destroy" here,
# on a resource nobody remembers defining, is the same bug

external-dns \
  --registry=txt \
  --txt-owner-id=team-a \
  --txt-prefix=extdns- \
  --policy=upsert-only \
  --provider=cloudflare

extdns-app.example.com.  300  IN  TXT  "heritage=external-dns,external-dns/owner=team-a"

; the stale duplicate below must be removed by hand at the provider:
; extdns-app.example.com.  300  IN  TXT  "heritage=external-dns,external-dns/owner=team-b"

; live record, as returned by GET /zones/{zone}/dns_records
app.example.com.  300  IN  A  203.0.113.10   ; comment: managed-by:pipeline-x

# exactly one TXT ownership string with the expected owner
dig +short TXT extdns-app.example.com @1.1.1.1

# the A record should match your source of truth
dig +short A app.example.com @1.1.1.1

# run it again 60+ seconds later, confirm it has not flip-flopped
dig +short A app.example.com @1.1.1.1

# every record the automation may touch should carry the ownership comment
curl -s -H "Authorization: Bearer $CF_TOKEN" \
  "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records?name=app.example.com" \
  | jq '.result[].comment'

# re-run in dry-run/plan mode and confirm zero unexpected diffs
terraform plan
# or: external-dns --dry-run

"""Detect a DNS record a reconciler is about to write without proof of
ownership, and repair it via Cloudflare only when the ownership marker
matches. Safe to run on a schedule. Stays in dry run until DRY_RUN=false.
"""
import os
import logging

logging.basicConfig(level=logging.INFO, format="%(asctime)s %(levelname)s %(message)s")
log = logging.getLogger("check_record_ownership")


def decide_action(intended: dict, live: dict | None, owner_id: str) -> str:
    """
    intended: {"name": str, "type": str, "content": str, "owner": str}
    live: {"name": str, "type": str, "content": str, "comment": str|None} or None if absent
    owner_id: this reconciler's own owner tag, e.g. "team-a"
    Returns one of: "create", "update", "skip_conflict", "noop"
    Pure decision logic, no I/O: given the intended record, the current live record
    (or None), and this instance's owner id, decide whether it is safe to write.
    """
    if live is None:
        return "create"

    live_comment = live.get("comment") or ""
    live_owner = live_comment.split("managed-by:")[-1].strip() if "managed-by:" in live_comment else None

    if live_owner is None:
        return "skip_conflict"
    if live_owner != owner_id:
        return "skip_conflict"
    if live.get("content") == intended.get("content"):
        return "noop"
    return "update"


def run():
    # Imported lazily so the pure function above can be tested with no
    # network libraries installed at all.
    import requests

    zone_id = os.environ["CLOUDFLARE_ZONE_ID"]
    api_token = os.environ["CLOUDFLARE_API_TOKEN"]
    owner_id = os.environ.get("DNS_OWNER_ID", "team-a")
    dry_run = os.environ.get("DRY_RUN", "true").lower() == "true"

    # In a real run, "desired" would come from Terraform state or a
    # Kubernetes Ingress spec. Here it is one example record.
    desired = [
        {"name": "app.example.com", "type": "A", "content": "203.0.113.10", "owner": owner_id},
    ]

    headers = {"Authorization": f"Bearer {api_token}", "Content-Type": "application/json"}
    base = f"https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records"

    for intended in desired:
        resp = requests.get(base, headers=headers, params={"name": intended["name"], "type": intended["type"]}, timeout=30)
        resp.raise_for_status()
        results = resp.json().get("result", [])
        live = results[0] if results else None

        action = decide_action(intended, live, owner_id)
        log.info("Record %s (%s): action=%s", intended["name"], intended["type"], action)

        if action == "noop":
            log.info("Already correct and owned. Nothing to do.")
            continue

        if action == "skip_conflict":
            log.warning(
                "Skipping %s: live record has no matching owner marker for '%s'. "
                "Refusing to overwrite a record this reconciler does not own.",
                intended["name"], owner_id,
            )
            continue

        comment = f"managed-by:{owner_id}"
        if action == "create":
            log.info("%s create %s -> %s", "Would" if dry_run else "Will", intended["name"], intended["content"])
            if not dry_run:
                requests.post(
                    base, headers=headers,
                    json={"type": intended["type"], "name": intended["name"], "content": intended["content"], "ttl": 300, "comment": comment},
                    timeout=30,
                ).raise_for_status()
        elif action == "update":
            log.info("%s update %s -> %s", "Would" if dry_run else "Will", intended["name"], intended["content"])
            if not dry_run:
                requests.patch(
                    f"{base}/{live['id']}", headers=headers,
                    json={"content": intended["content"], "comment": comment},
                    timeout=30,
                ).raise_for_status()

    log.info("Done.")


if __name__ == "__main__":
    run()

/**
 * Detect a DNS record a reconciler is about to write without proof of
 * ownership, and repair it via Cloudflare only when the ownership marker
 * matches. Safe to run on a schedule. Stays in dry run until DRY_RUN=false.
 */
import { pathToFileURL } from "node:url";

/**
 * intended: { name: string, type: string, content: string, owner: string }
 * live: { name: string, type: string, content: string, comment: string|null } or null if absent
 * ownerId: this reconciler's own owner tag, e.g. "team-a"
 * Returns one of: "create", "update", "skip_conflict", "noop"
 * Pure decision logic, no I/O: given the intended record, the current live record
 * (or null), and this instance's owner id, decide whether it is safe to write.
 */
export function decideAction(intended, live, ownerId) {
  if (live === null || live === undefined) {
    return "create";
  }

  const liveComment = live.comment || "";
  const liveOwner = liveComment.includes("managed-by:")
    ? liveComment.split("managed-by:").pop().trim()
    : null;

  if (liveOwner === null) {
    return "skip_conflict";
  }
  if (liveOwner !== ownerId) {
    return "skip_conflict";
  }
  if (live.content === intended.content) {
    return "noop";
  }
  return "update";
}

export async function run() {
  const zoneId = process.env.CLOUDFLARE_ZONE_ID;
  const apiToken = process.env.CLOUDFLARE_API_TOKEN;
  const ownerId = process.env.DNS_OWNER_ID || "team-a";
  const dryRun = (process.env.DRY_RUN || "true").toLowerCase() === "true";

  // In a real run, "desired" would come from Terraform state or a
  // Kubernetes Ingress spec. Here it is one example record.
  const desired = [
    { name: "app.example.com", type: "A", content: "203.0.113.10", owner: ownerId },
  ];

  const headers = { Authorization: `Bearer ${apiToken}`, "Content-Type": "application/json" };
  const base = `https://api.cloudflare.com/client/v4/zones/${zoneId}/dns_records`;

  for (const intended of desired) {
    const listUrl = `${base}?name=${encodeURIComponent(intended.name)}&type=${intended.type}`;
    const listRes = await fetch(listUrl, { headers });
    if (!listRes.ok) throw new Error(`Cloudflare list failed: ${listRes.status}`);
    const listBody = await listRes.json();
    const results = listBody.result || [];
    const live = results.length > 0 ? results[0] : null;

    const action = decideAction(intended, live, ownerId);
    console.log(`Record ${intended.name} (${intended.type}): action=${action}`);

    if (action === "noop") {
      console.log("Already correct and owned. Nothing to do.");
      continue;
    }

    if (action === "skip_conflict") {
      console.warn(
        `Skipping ${intended.name}: live record has no matching owner marker for '${ownerId}'. ` +
        `Refusing to overwrite a record this reconciler does not own.`
      );
      continue;
    }

    const comment = `managed-by:${ownerId}`;
    if (action === "create") {
      console.log(`${dryRun ? "Would" : "Will"} create ${intended.name} -> ${intended.content}`);
      if (!dryRun) {
        const res = await fetch(base, {
          method: "POST",
          headers,
          body: JSON.stringify({ type: intended.type, name: intended.name, content: intended.content, ttl: 300, comment }),
        });
        if (!res.ok) throw new Error(`Cloudflare create failed: ${res.status}`);
      }
    } else if (action === "update") {
      console.log(`${dryRun ? "Would" : "Will"} update ${intended.name} -> ${intended.content}`);
      if (!dryRun) {
        const res = await fetch(`${base}/${live.id}`, {
          method: "PATCH",
          headers,
          body: JSON.stringify({ content: intended.content, comment }),
        });
        if (!res.ok) throw new Error(`Cloudflare update failed: ${res.status}`);
      }
    }
  }

  console.log("Done.");
}

if (import.meta.url === pathToFileURL(process.argv[1]).href) {
  run().catch((e) => { console.error(e); process.exit(1); });
}

from check_record_ownership import decide_action


def intended(**over):
    base = {"name": "app.example.com", "type": "A", "content": "203.0.113.10", "owner": "team-a"}
    base.update(over)
    return base


def test_create_when_no_live_record():
    assert decide_action(intended(), None, "team-a") == "create"


def test_noop_when_owned_and_matching():
    live = {"name": "app.example.com", "type": "A", "content": "203.0.113.10", "comment": "managed-by:team-a"}
    assert decide_action(intended(), live, "team-a") == "noop"


def test_update_when_owned_and_content_differs():
    live = {"name": "app.example.com", "type": "A", "content": "198.51.100.5", "comment": "managed-by:team-a"}
    assert decide_action(intended(), live, "team-a") == "update"


def test_skip_conflict_when_owner_differs():
    live = {"name": "app.example.com", "type": "A", "content": "198.51.100.5", "comment": "managed-by:team-b"}
    assert decide_action(intended(), live, "team-a") == "skip_conflict"


def test_skip_conflict_when_no_ownership_marker():
    live = {"name": "app.example.com", "type": "A", "content": "198.51.100.5", "comment": None}
    assert decide_action(intended(), live, "team-a") == "skip_conflict"

import { test } from "node:test";
import assert from "node:assert/strict";
import { decideAction } from "./check-record-ownership.js";

const intended = (over = {}) => ({
  name: "app.example.com", type: "A", content: "203.0.113.10", owner: "team-a", ...over,
});

test("create when no live record", () => {
  assert.equal(decideAction(intended(), null, "team-a"), "create");
});

test("noop when owned and matching", () => {
  const live = { name: "app.example.com", type: "A", content: "203.0.113.10", comment: "managed-by:team-a" };
  assert.equal(decideAction(intended(), live, "team-a"), "noop");
});

test("update when owned and content differs", () => {
  const live = { name: "app.example.com", type: "A", content: "198.51.100.5", comment: "managed-by:team-a" };
  assert.equal(decideAction(intended(), live, "team-a"), "update");
});

test("skip_conflict when owner differs", () => {
  const live = { name: "app.example.com", type: "A", content: "198.51.100.5", comment: "managed-by:team-b" };
  assert.equal(decideAction(intended(), live, "team-a"), "skip_conflict");
});

test("skip_conflict when no ownership marker", () => {
  const live = { name: "app.example.com", type: "A", content: "198.51.100.5", comment: null };
  assert.equal(decideAction(intended(), live, "team-a"), "skip_conflict");
});