plugin/kubernetes: support pods with multiple IPs (#8635)

The Pod object stored only the primary pod IP (status.podIP), causing
PodIndex lookups to fail for IPv6 clients in dual-stack clusters. This
prevented the metadata plugin from populating client-pod-name and
client-namespace.

Replace the PodIP string field with a PodIPs []string slice populated
from status.podIPs, and update podIPIndexFunc to index all IPs.

Signed-off-by: Christian Norbert Menges <christian.norbert.menges@sap.com>

plugin/kubernetes/controller.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"fmt"
 	"maps"
+	"slices"
 	"sync"
 	"sync/atomic"
 	"time"
@@ -271,7 +272,9 @@ func podIPIndexFunc(obj any) ([]string, error) {
 	if !ok {
 		return nil, errObj
 	}
-	return []string{p.PodIP}, nil
+	idx := make([]string, len(p.PodIPs))
+	copy(idx, p.PodIPs)
+	return idx, nil
 }
 
 func svcIPIndexFunc(obj any) ([]string, error) {
@@ -776,7 +779,7 @@ func podModified(oldObj, newObj any) bool {
 	if !okOld || !okNew {
 		return true
 	}
-	return oldPod.PodIP != newPod.PodIP
+	return !slices.Equal(oldPod.PodIPs, newPod.PodIPs)
 }
 
 // endpointsEquivalent checks if the update to an endpoint is something

plugin/kubernetes/controller_test.go

@@ -363,20 +363,25 @@ func TestPodModified(t *testing.T) {
 		changed bool
 	}{
 		{
-			oldPod:  &object.Pod{Version: "1", PodIP: "10.240.0.1", Name: "dns-test", Namespace: "testns"},
+			oldPod:  &object.Pod{Version: "1", PodIPs: []string{"10.240.0.1"}, Name: "dns-test", Namespace: "testns"},
-			newPod:  &object.Pod{Version: "2", PodIP: "10.240.0.1", Name: "dns-test", Namespace: "testns"},
+			newPod:  &object.Pod{Version: "2", PodIPs: []string{"10.240.0.1"}, Name: "dns-test", Namespace: "testns"},
 			changed: false,
 		},
 		{
-			oldPod:  &object.Pod{Version: "1", PodIP: "", Name: "dns-test", Namespace: "testns"},
+			oldPod:  &object.Pod{Version: "1", PodIPs: []string{}, Name: "dns-test", Namespace: "testns"},
-			newPod:  &object.Pod{Version: "2", PodIP: "10.240.0.1", Name: "dns-test", Namespace: "testns"},
+			newPod:  &object.Pod{Version: "2", PodIPs: []string{"10.240.0.1"}, Name: "dns-test", Namespace: "testns"},
 			changed: true,
 		},
 		{
-			oldPod:  &object.Pod{Version: "1", PodIP: "10.240.0.1", Name: "dns-test", Namespace: "testns"},
+			oldPod:  &object.Pod{Version: "1", PodIPs: []string{"10.240.0.1"}, Name: "dns-test", Namespace: "testns"},
-			newPod:  &object.Pod{Version: "2", PodIP: "10.240.0.2", Name: "dns-test", Namespace: "testns"},
+			newPod:  &object.Pod{Version: "2", PodIPs: []string{"10.240.0.2"}, Name: "dns-test", Namespace: "testns"},
 			changed: true,
 		},
+		{
+			oldPod:  &object.Pod{Version: "1", PodIPs: []string{"10.240.0.1", "fd00::1"}, Name: "dns-test", Namespace: "testns"},
+			newPod:  &object.Pod{Version: "2", PodIPs: []string{"10.240.0.1", "fd00::1"}, Name: "dns-test", Namespace: "testns"},
+			changed: false,
+		},
 	}
 
 	for i, test := range tests {
@@ -390,14 +395,14 @@ func TestPodModified(t *testing.T) {
 func TestDetectChangesPodUpdate(t *testing.T) {
 	dns := &dnsControl{}
 
-	p1 := &object.Pod{Version: "1", PodIP: "10.240.0.1", Name: "dns-test", Namespace: "testns"}
+	p1 := &object.Pod{Version: "1", PodIPs: []string{"10.240.0.1"}, Name: "dns-test", Namespace: "testns"}
-	p2 := &object.Pod{Version: "2", PodIP: "10.240.0.1", Name: "dns-test", Namespace: "testns"}
+	p2 := &object.Pod{Version: "2", PodIPs: []string{"10.240.0.1"}, Name: "dns-test", Namespace: "testns"}
 	dns.detectChanges(p1, p2)
 	if dns.Modified(ModifiedInternal) != 0 {
 		t.Fatal("pod update with an unchanged IP should not update the modified timestamp")
 	}
 
-	p3 := &object.Pod{Version: "3", PodIP: "10.240.0.2", Name: "dns-test", Namespace: "testns"}
+	p3 := &object.Pod{Version: "3", PodIPs: []string{"10.240.0.2"}, Name: "dns-test", Namespace: "testns"}
 	dns.detectChanges(p2, p3)
 	if dns.Modified(ModifiedInternal) == 0 {
 		t.Fatal("pod update with a changed IP should update the modified timestamp")

plugin/kubernetes/handler_test.go

@@ -716,7 +716,7 @@ func (APIConnServeTest) PodIndex(ip string) []*object.Pod {
 	}
 	a := []*object.Pod{
 		{
-			Namespace: "podns", Name: "foo", PodIP: "10.240.0.1",
+			Namespace: "podns", Name: "foo", PodIPs: []string{"10.240.0.1"},
 			Labels: map[string]string{
 				"app.kubernetes.io/name": "foo",
 				"bar":                    "baz",

plugin/kubernetes/kubernetes.go

@@ -8,6 +8,7 @@ import (
 	"net"
 	"net/http"
 	"runtime"
+	"slices"
 	"strings"
 	"time"
 
@@ -445,7 +446,7 @@ func (k *Kubernetes) findPods(r recordRequest, zone string) (pods []msg.Service,
 
 	for _, p := range k.APIConn.PodIndex(ip) {
 		// check for matching ip and namespace
-		if ip == p.PodIP && match(namespace, p.Namespace) {
+		if slices.Contains(p.PodIPs, ip) && match(namespace, p.Namespace) {
 			s := msg.Service{Key: strings.Join([]string{zonePath, Pod, namespace, podname}, "/"), Host: ip, TTL: k.ttl}
 			pods = append(pods, s)
 

plugin/kubernetes/object/deepcopy_test.go

@@ -55,7 +55,7 @@ func deepCopyCases() []struct {
 	}{
 		{"Pod", &Pod{
 			Version:   "1",
-			PodIP:     "10.244.0.1",
+			PodIPs:    []string{"10.244.0.1", "fd00::1"},
 			Name:      "pod1",
 			Namespace: "testns",
 			Labels:    map[string]string{"app": "nginx", "tier": "frontend"},
@@ -196,7 +196,7 @@ func TestDeepCopyObjectIsDeep(t *testing.T) {
 // Nil maps and slices must stay nil rather than becoming empty, so a round trip does
 // not change how a value compares.
 func TestDeepCopyObjectPreservesNilLabels(t *testing.T) {
-	pod := &Pod{Version: "1", PodIP: "10.244.0.1", Name: "pod1", Namespace: "testns"}
+	pod := &Pod{Version: "1", PodIPs: []string{"10.244.0.1"}, Name: "pod1", Namespace: "testns"}
 	cp := pod.DeepCopyObject().(*Pod)
 	if cp.Labels != nil {
 		t.Errorf("nil Labels became %#v after a round trip", cp.Labels)

plugin/kubernetes/object/pod.go

@@ -4,6 +4,7 @@ import (
 	"errors"
 	"fmt"
 	"maps"
+	"slices"
 
 	api "k8s.io/api/core/v1"
 	meta "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -14,7 +15,7 @@ import (
 type Pod struct {
 	// Don't add new fields to this struct without talking to the CoreDNS maintainers.
 	Version   string
-	PodIP     string
+	PodIPs    []string
 	Name      string
 	Namespace string
 	Labels    map[string]string
@@ -30,9 +31,13 @@ func ToPod(obj meta.Object) (meta.Object, error) {
 	if !ok {
 		return nil, fmt.Errorf("unexpected object %v", obj)
 	}
+	podIPs := make([]string, len(apiPod.Status.PodIPs))
+	for i, pip := range apiPod.Status.PodIPs {
+		podIPs[i] = pip.IP
+	}
 	pod := &Pod{
 		Version:   apiPod.GetResourceVersion(),
-		PodIP:     apiPod.Status.PodIP,
+		PodIPs:    podIPs,
 		Namespace: apiPod.GetNamespace(),
 		Name:      apiPod.GetName(),
 		Labels:    apiPod.GetLabels(),
@@ -55,7 +60,7 @@ var _ runtime.Object = &Pod{}
 func (p *Pod) DeepCopyObject() runtime.Object {
 	p1 := &Pod{
 		Version:   p.Version,
-		PodIP:     p.PodIP,
+		PodIPs:    slices.Clone(p.PodIPs),
 		Namespace: p.Namespace,
 		Name:      p.Name,
 		// maps.Clone returns nil for a nil map, so an unlabelled pod stays unlabelled.