Mirrors/coredns
1
0
Fork 0
mirror of https://github.com/coredns/coredns.git synced 2026-10-28 21:25:42 -04:00
Code Issues Packages Projects Releases Wiki Activity

Merge commit from fork

Browse Source 
EndpointSlice FQDN addresses were copied into endpoint records as if
they were IP addresses. CoreDNS then treated each value as a CNAME
target. A tenant could build a branching chain of headless Services that
made one query perform exponential work and exhaust CoreDNS memory.

Publish endpoints only from IPv4 and IPv6 slices and validate every
address against its declared family. Deduplicate CNAME targets for the
whole query so repeated or converging paths are chased once.

Protect internal self-lookups with an independent depth limit. This
stops direct and indirect k8s_external CNAME loops without consuming the
loop counter already maintained by the file and rewrite plugins.

Add regression coverage for address types, recursive convergence,
repeated k8s_external targets, and direct and indirect self-reference.

Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>
This commit is contained in:
Ville Vesilehto
2026-10-25 04:45:58 +02:00
committed by GitHub
parent a5fdd11fcf
commit 4ec856f347
10 changed files with 548 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
plugin/kubernetes/README.md
View File

@@ -232,6 +232,15 @@ Kubernetes API.
This plugin creates PTR records for every Pod selected by a Service. If a given Pod is selected by more than
one Service a separate PTR record will exist for each Service selecting it.
## EndpointSlice Address Types
Endpoint records are served from EndpointSlices of address type `IPv4` and `IPv6` only. The
[Kubernetes EndpointSlice API reference](https://kubernetes.io/docs/reference/kubernetes-api/discovery/endpoint-slice-v1/)
documents `FQDN` as deprecated, defines no semantics for it, and states that kube-proxy only processes
`IPv4` and `IPv6` slices. An FQDN slice carries names chosen by whoever wrote it rather than addresses,
and the plugin publishes no records for it. A `CNAME` target for a Service is expressed with a Service
of type `ExternalName`.
## Examples
Handle all queries in the `cluster.local` zone. Connect to Kubernetes in-cluster. Also handle all