Since you're using Kubernetes, have you looked at external-dns? In my home lab, I use external-dns to take Ingress and Service resources and register them into my internal DNS zone. I use the etcd backend. external-dns registers zones in etcd, then CoreDNS queries from etcd. As soon as I create a new Ingress, it's automatically registered and pointing to my Traefik service.
https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/coredns-etcd.md







Yeah it's useful and I've been using it for my home lab, but too many of my containers want outbound connections to the Internet. Like Forgejo needs :443 to be able to mirror or remote push repositories, so either I have to identify and allow list github.com, gitlab.com, etc. or end up allowing 0.0.0.0/0:443 which is not very strong protection.
I'd love for some kind of CNI or network plugin that filtered based on domain name.