NE-2790: Update CoreDNS to v1.14.7 - #197
Open
aswinsuryan wants to merge 641 commits into
Open
aswinsuryan wants to merge 641 commits into
aswinsuryan wants to merge 641 commits into
Conversation
Bumps [actions/stale](https://github.com/actions/stale) from 10.2.0 to 10.3.0. - [Release notes](https://github.com/actions/stale/releases) - [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md) - [Commits](actions/stale@b5d41d4...eb5cf3a) --- updated-dependencies: - dependency-name: actions/stale dependency-version: 10.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
DoQWriter previously stored only the QUIC stream, so plugins reading TLS state via dns.ConnectionStater (e.g. for SNI-based routing or auditing) could not see anything for DoQ connections, even though the underlying QUIC connection carries a full tls.ConnectionState. This change adds a *quic.Conn reference to DoQWriter and wires it in serveQUICStream. It implements dns.ConnectionStater on *DoQWriter, returning the TLS state from the underlying QUIC connection (mirrors the DoT behavior that miekg/dns already provides for *tls.Conn) Forwards ConnectionState through request.ScrubWriter, which wraps every response writer before the plugin chain runs; the embedded dns.ResponseWriter interface does not promote ConnectionState (it belongs to a separate interface), so without this plugins would still see nil for both DoQ and DoT Signed-off-by: Nicholas Amorim <nicholas@santos.ee>
…dation (coredns#8131) Signed-off-by: immanuwell <pchpr.00@list.ru>
…edns#5646) (coredns#7923) Signed-off-by: Dmytro Alieksieiev <1865999+dragoangel@users.noreply.github.com>
Signed-off-by: immanuwell <pchpr.00@list.ru>
This PR Set a conservative MaxHeaderBytes value on the DoH3 HTTP/3 server. This reduces memory exposure from large request headers before requests reach the DoH handler. Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
* build: add loong64 arch support to Makefile.docker and Makefile.release Signed-off-by: 徐晓伟 <xuxiaowei@xuxiaowei.com.cn> * build: add loong64 docker build config using loong64 community images Signed-off-by: 徐晓伟 <xuxiaowei@xuxiaowei.com.cn> --------- Signed-off-by: 徐晓伟 <xuxiaowei@xuxiaowei.com.cn>
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.54.0 to 0.55.0. - [Commits](golang/net@v0.54.0...v0.55.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-version: 0.55.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2) from 1.32.17 to 1.32.18. - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@config/v1.32.17...config/v1.32.18) --- updated-dependencies: - dependency-name: github.com/aws/aws-sdk-go-v2/config dependency-version: 1.32.18 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…s#8149) The DoH server resolved the per-connection local address in a custom http.Server.ConnContext callback. ConnContext runs synchronously in the http.Server accept loop, so calling c.LocalAddr() there is a problem when the listener is proxyproto-wrapped: LocalAddr() triggers the PROXY-header read, which blocks the accept loop until the header arrives and head-of-line-blocks acceptance of every other connection. net/http and http2 already populate http.LocalAddrContextKey from the connection in the per-connection serving goroutine (net/http server.go, http2 server_common.go / h2_bundle.go), resolved through the same tls.Conn -> proxyproto.Conn chain. For a proxyproto connection that value is the PROXY header's destination address -- byte-identical to what the custom callback produced -- and it is set off the accept loop on both the HTTP/1.1 and HTTP/2 paths. Drop the custom ConnContext callback and the connKey type, and read http.LocalAddrContextKey in localAddr() instead. The client address is unaffected: it arrives via r.RemoteAddr, which the framework populates natively. Signed-off-by: zongqi-wang <wangzongqi@msn.com>
…the query zone (coredns#8138) Signed-off-by: Björn Kinscher <code@bjoern-kinscher.de> Co-authored-by: Björn Kinscher <code@bjoern-kinscher.de>
* plugin/cache: allow cache TTLs above default 3600s This change allows the cache plugin to honor configured maximum TTL values above the default 3600s limit. Default behavior remains unchanged This PR fixes 7846 Signed-off-by: Yong Tang <yong.tang.github@outlook.com> * Keep MinimalTTL Signed-off-by: Yong Tang <yong.tang.github@outlook.com> --------- Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
In preparing for 8148 Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
This is part of the 8152 Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
…ormed PROXY packets (coredns#8154) Avoid a potential nil pointer dereference in PacketConn.ReadFrom() when malformed PROXY protocol headers cause readFrom() to return a nil address. Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
Bumps the go-etcd-io group with 2 updates: [go.etcd.io/etcd/api/v3](https://github.com/etcd-io/etcd) and [go.etcd.io/etcd/client/v3](https://github.com/etcd-io/etcd). Updates `go.etcd.io/etcd/api/v3` from 3.6.11 to 3.6.12 - [Release notes](https://github.com/etcd-io/etcd/releases) - [Commits](etcd-io/etcd@v3.6.11...v3.6.12) Updates `go.etcd.io/etcd/client/v3` from 3.6.11 to 3.6.12 - [Release notes](https://github.com/etcd-io/etcd/releases) - [Commits](etcd-io/etcd@v3.6.11...v3.6.12) --- updated-dependencies: - dependency-name: go.etcd.io/etcd/api/v3 dependency-version: 3.6.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-etcd-io - dependency-name: go.etcd.io/etcd/client/v3 dependency-version: 3.6.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-etcd-io ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…coredns#8168) Bumps [github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2) from 1.41.7 to 1.41.11. - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@v1.41.7...v1.41.11) --- updated-dependencies: - dependency-name: github.com/aws/aws-sdk-go-v2 dependency-version: 1.41.11 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [golang.org/x/sys](https://github.com/golang/sys) from 0.45.0 to 0.46.0. - [Commits](golang/sys@v0.45.0...v0.46.0) --- updated-dependencies: - dependency-name: golang.org/x/sys dependency-version: 0.46.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…redns#8421) * plugin/rewrite: apply rcode rewrites to record-less responses An rcode rewrite rewrites the message-level RCODE, but the reverter only ran response rules from inside the per-record loops in WriteMsg. When a response carries no answer, authority or additional records - for example a bare SERVFAIL that a downstream plugin returns to a non-EDNS client - none of the loops iterate, so the rcode rewrite was silently skipped and the client received the original RCODE. Apply message-level response rules once when the response has no records, using a small marker interface that mirrors the existing requestExtraRevertRule pattern. This fixes the plugin's documented SERVFAIL-to-NOERROR use case for responses without records. Signed-off-by: Sueun Cho <sueun.dev@gmail.com> * plugin/rewrite: apply fallback rcode rewrites for continue Signed-off-by: Sueun Cho <sueun.dev@gmail.com> --------- Signed-off-by: Sueun Cho <sueun.dev@gmail.com>
This PR adds release note 1.14.7 for 8416 Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
|
@aswinsuryan since 1.14.7 is already out, what do you think about jumping a bit further? All good if you'd rather merge 1.14.4 first, then do another bump. |
…dns-v1.14.4 Signed-off-by: Aswin Suryanarayanan <asuryana@redhat.com>
aswinsuryan
force-pushed
the
NE-2790-rebase-coredns-v1.14.4
branch
from
September 9, 2026 21:09
83cfbcd to
3798450
Compare
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: Repository: openshift/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Advanced Run ID: Comment |
aswinsuryan
changed the title
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
@aswinsuryan: This pull request references NE-2790 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the epic to target the "5.1.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
Author
Updated to 1.14.7, changed the PR message too, but the branch name is still in 1.14.4 as I did not figure out a way to do so without raising a new PR. |
aswinsuryan
added a commit
to aswinsuryan/coredns
that referenced
this pull request
Sep 9, 2026
…images Update go.mod to match Go 1.26.6 builder images (v1.14.7 upstream already pins .go-version to 1.26.6). Also fix %q on integer arguments in dns64/secondary_test/test helpers, which Go 1.26 vet now flags. Also update README.md's stated minimum Go version (1.25.0 -> 1.26.6) to match go.mod, addressing review feedback that the two had drifted apart (github.com/openshift/pull/197#discussion_r_davidesalerno). Signed-off-by: Aswin Suryanarayanan <asuryana@redhat.com>
aswinsuryan
added a commit
to aswinsuryan/coredns
that referenced
this pull request
Sep 9, 2026
Carry the external `ocp_dnsnameresolver` plugin again after the rebase to v1.14.7, based on the previous carry commit (5d15b3d): - register the plugin ahead of `cache` inside `plugin.cfg` and regenerate `core/plugin/zplugin.go` + `core/dnsserver/zdirectives.go` so directives stay ordered the way OpenShift expects. - keep the same module version (01fb3d1) via `go.mod`/`go.sum`; this version builds against k8s v0.36.2 (no v0.35.x release exists for this plugin). Go MVS bumps CoreDNS k8s deps from v0.35.4 to v0.36.2. - carry forward the reapply steps in `carry_consolidation/ocp_dnsnameresolver.md`. - align `.circleci/config.yml`'s K8S_VERSION (v1.34.0 -> v1.36.2) with the bumped client-go v0.36.2, addressing review feedback that the two had drifted apart (github.com/openshift/pull/197#discussion_r_davidesalerno). Co-authored-by: Arkadeep Sen <arsen@redhat.com> Co-authored-by: Ryan Fredette <rfredette@redhat.com> Co-authored-by: Grant Spence <gspence@redhat.com> Co-authored-by: Brett Tofel <btofel@redhat.com> Signed-off-by: Aswin Suryanarayanan <asuryana@redhat.com>
aswinsuryan
force-pushed
the
NE-2790-rebase-coredns-v1.14.4
branch
from
September 9, 2026 21:42
3798450 to
b128aec
Compare
Reapply the ART-managed build-root-image and product-build-pipeline carries after the rebase to v1.14.7. The `-s ours` merge helper keeps the upstream CoreDNS tag's tree, which drops these two OpenShift-only files on every rebase since they don't exist in any upstream CoreDNS tag; they have to be reapplied from upstream/main each time. `.ci-operator.yaml` history: a80f04a, b160188, b648be1 (2021). `Dockerfile.ocp` history: 66a7aad, e711a73, b7ffb21, a262020 and later carries (2021), most recently bumped by the ART automation commits (c3b27d5, ae72998) that this rebase already classified as "already upstream/skip, ART bot will resubmit" — those commits update version tags in both files together but don't establish them, so skipping them without also reapplying the files themselves as carries dropped both files from this rebase. Missing `.ci-operator.yaml` caused ci/prow/verify-deps to fail with "failed to read .ci-operator.yaml file". Missing `Dockerfile.ocp` caused ci/prow/images to fail with "open /tmp/build/inputs/Dockerfile.ocp: no such file or directory", once `.ci-operator.yaml` was reapplied. Both failed on this rebase and on the original v1.14.4 attempt (openshift#197). Pulled both files' current values from upstream/main: .ci-operator.yaml: build_root_image: name: release namespace: openshift tag: rhel-9-release-golang-1.26-openshift-5.0 Dockerfile.ocp: builder: registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.26-openshift-5.0 base: registry.ci.openshift.org/ocp/5.0:base-rhel9 Signed-off-by: Aswin Suryanarayanan <asuryana@redhat.com>
aswinsuryan
added a commit
to aswinsuryan/coredns
that referenced
this pull request
Sep 9, 2026
…images Update go.mod to match Go 1.26.6 builder images (v1.14.7 upstream already pins .go-version to 1.26.6). Also fix %q on integer arguments in dns64/secondary_test/test helpers, which Go 1.26 vet now flags. Also update README.md's stated minimum Go version (1.25.0 -> 1.26.6) to match go.mod, addressing review feedback that the two had drifted apart (github.com/openshift/pull/197#discussion_r_davidesalerno). Signed-off-by: Aswin Suryanarayanan <asuryana@redhat.com>
aswinsuryan
added a commit
to aswinsuryan/coredns
that referenced
this pull request
Sep 9, 2026
Carry the external `ocp_dnsnameresolver` plugin again after the rebase to v1.14.7, based on the previous carry commit (5d15b3d): - register the plugin ahead of `cache` inside `plugin.cfg` and regenerate `core/plugin/zplugin.go` + `core/dnsserver/zdirectives.go` so directives stay ordered the way OpenShift expects. - keep the same module version (01fb3d1) via `go.mod`/`go.sum`; this version builds against k8s v0.36.2 (no v0.35.x release exists for this plugin). Go MVS bumps CoreDNS k8s deps from v0.35.4 to v0.36.2. - carry forward the reapply steps in `carry_consolidation/ocp_dnsnameresolver.md`. - align `.circleci/config.yml`'s K8S_VERSION (v1.34.0 -> v1.36.2) with the bumped client-go v0.36.2, addressing review feedback that the two had drifted apart (github.com/openshift/pull/197#discussion_r_davidesalerno). Co-authored-by: Arkadeep Sen <arsen@redhat.com> Co-authored-by: Ryan Fredette <rfredette@redhat.com> Co-authored-by: Grant Spence <gspence@redhat.com> Co-authored-by: Brett Tofel <btofel@redhat.com> Signed-off-by: Aswin Suryanarayanan <asuryana@redhat.com>
aswinsuryan
force-pushed
the
NE-2790-rebase-coredns-v1.14.4
branch
from
September 9, 2026 22:03
b128aec to
c11b0b4
Compare
|
@aswinsuryan: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
Remove `vendor/` from `.gitignore` so the vendor tree can be committed for ci-operator's `-mod=vendor` builds. Anchor `coredns`, `build/`, and `release/` to the repo root (`/coredns`, `/build/`, `/release/`). Unanchored, `coredns` matches any path segment named `coredns` at any depth — including `vendor/github.com/coredns/caddy`, a required, non-indirect dependency. This silently excluded that entire vendored package from every "update vendor" carry in this fork's history (confirmed missing as far back as the pre-rebase `main`), which is exactly why `go build -mod=vendor` fails with "cannot find module providing package github.com/coredns/caddy/...", `ci/prow/unit` fails (`test [setup failed]`), and `ci/prow/verify-deps` fails (vendor tree doesn't match go.mod/go.sum). `build/`/`release/` don't currently collide with any vendored path, but are anchored defensively for the same reason. Also delete `.dockerignore` (`*` / `!coredns`). Upstream ships this file assuming a two-step build (binary built separately, then packaged via the root `Dockerfile`'s `COPY coredns /coredns`), but `Dockerfile.ocp` builds the binary from source in-container (`COPY . .` then `go build`). With `.dockerignore` in place, the build context excludes everything except a path literally named `coredns`, which doesn't exist yet at that point, so `COPY . .` copies nothing and the build fails with "go.mod file not found". OpenShift's `upstream/main` has deleted this file since `8f57c4ffe`. All three of the above were missing from this rebase (and from the original v1.14.4 attempt, openshift#197 was already broken this way) because, like `.ci-operator.yaml`/`Dockerfile.ocp`, the `-s ours` merge helper keeps whatever the upstream tag ships and there's no carry commit since v1.13.1 to reapply the fixes. Signed-off-by: Aswin Suryanarayanan <asuryana@redhat.com>
…N=local Signed-off-by: Aswin Suryanarayanan <asuryana@redhat.com>
…images Update go.mod to match Go 1.26.6 builder images (v1.14.7 upstream already pins .go-version to 1.26.6). Also fix %q on integer arguments in dns64/secondary_test/test helpers, which Go 1.26 vet now flags. Also update README.md's stated minimum Go version (1.25.0 -> 1.26.6) to match go.mod, addressing review feedback that the two had drifted apart (github.com/openshift/pull/197#discussion_r_davidesalerno). Signed-off-by: Aswin Suryanarayanan <asuryana@redhat.com>
Carry the external `ocp_dnsnameresolver` plugin again after the rebase to v1.14.7, based on the previous carry commit (5d15b3d): - register the plugin ahead of `cache` inside `plugin.cfg` and regenerate `core/plugin/zplugin.go` + `core/dnsserver/zdirectives.go` so directives stay ordered the way OpenShift expects. - keep the same module version (01fb3d1) via `go.mod`/`go.sum`; this version builds against k8s v0.36.2 (no v0.35.x release exists for this plugin). Go MVS bumps CoreDNS k8s deps from v0.35.4 to v0.36.2. - carry forward the reapply steps in `carry_consolidation/ocp_dnsnameresolver.md`. - align `.circleci/config.yml`'s K8S_VERSION (v1.34.0 -> v1.36.2) with the bumped client-go v0.36.2, addressing review feedback that the two had drifted apart (github.com/openshift/pull/197#discussion_r_davidesalerno). Co-authored-by: Arkadeep Sen <arsen@redhat.com> Co-authored-by: Ryan Fredette <rfredette@redhat.com> Co-authored-by: Grant Spence <gspence@redhat.com> Co-authored-by: Brett Tofel <btofel@redhat.com> Signed-off-by: Aswin Suryanarayanan <asuryana@redhat.com>
Regenerate the vendor tree for the v1.14.7 rebase via `GOFLAGS=-mod=vendor go mod vendor`, picking up the ocp_dnsnameresolver plugin and the resulting Go MVS dependency bumps. Also picks up `vendor/github.com/coredns/caddy` (22 files), a required, non-indirect dependency that has been silently excluded from every prior "update vendor" carry by an unanchored `.gitignore` pattern (see the "Track vendor directory in git" carry, which anchors it). Signed-off-by: Aswin Suryanarayanan <asuryana@redhat.com>
…tion Signed-off-by: Aswin Suryanarayanan <asuryana@redhat.com>
aswinsuryan
force-pushed
the
NE-2790-rebase-coredns-v1.14.4
branch
from
September 10, 2026 00:47
c11b0b4 to
13d1325
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Action Plan
Commands Executed
Carries Applied (7)
.go-version)Dropped (1)
bc4343b08/ fix(tls): use Go TLS defaults coredns/coredns#8227)High Priority Review Items
tlsto run just afterdnssec(previously ran nearproxyproto/quic) sodnsseccan sign ACME challenge records first — a real change to plugin execution order.📄 Full Rebase Report | 📋 Stakeholder Review