Inspect the external-dns pod's logs to see what errors are reported:
kubectl logs external-dns-123abcxyz
time="2022-09-20T18:06:29Z" level=error msg="records retrieval failed: failed to list hosted zones:
WebIdentityErr: failed to retrieve credentials\ncaused by: InvalidIdentityToken:
No OpenIDConnect provider found in your account for
https://oidc.eks.us-east-2.amazonaws.com/id/123456789ABCDEFGHIJK\n\tstatus
code: 400, request id: *****-****-****-****-****"
In this case, the error is due to an invalid OIDC provider ID. This means you should inspect the EKS cluster to confirm that an OIDC provider has been created and associated with your cluster.
Ref:
https://aws.amazon.com/premiumsupport/knowledge-center/eks-troubleshoot-oidc-and-irsa/
First, confirm your cluster's OIDC provider URL:
aws eks describe-cluster --name ekscluster --query "cluster.identity.oidc.issuer" --output text
https://oidc.eks.us-east-2.amazonaws.com/id/123456789ABCDEFGHIJK
Here, we can see that an OIDC provider was found. Now attempt to list the IAM OIDC providers for your account:
aws iam list-open-id-connect-providers | grep 123456789ABCDEFGHIJK
In this case, the second command shown above returns nothing. This means that you must create the IAM OIDC provider. Follow Amazon's guidance on that here:
https://docs.aws.amazon.com/eks/latest/userguide/enable-iam-roles-for-service-accounts.html