Rebase to CoreDNS v1.13.2 by gcs278 · Pull Request #160 · openshift/coredns

gcs278 · 2025-12-19T18:35:05Z

NOTE: My goal for this PR is testing /rebase command on claude, not necessarily to bump CoreDNS

Summary

This PR rebases the OpenShift CoreDNS fork from v1.13.1 to v1.13.2, incorporating 113 upstream commits while maintaining all necessary OpenShift-specific carries.

Rebase Details

Target Version: CoreDNS v1.13.2
Base Version: v1.13.1
Upstream Commits: 113 commits
Strategy: Clean rebase from v1.13.2 tag + cherry-pick carries + merge helper commit

Carries Forward-Ported (7 total)

All essential OpenShift carries have been forward-ported:

✅ OWNERS automation metadata - OpenShift CI/build configuration
✅ Downstream OWNERS metadata - Team ownership and review process
✅ Disable dependabot - Per OpenShift policy
✅ Make test target - Required by ci-operator
✅ ocp_dnsnameresolver plugin - OpenShift-specific DNS feature
✅ Vendor tree ignore rules - Track vendor for offline builds
✅ Vendor deps - Regenerated for v1.13.2 dependencies

Carry Dropped

❌ Go toolchain pin (commit 1457b2e) - Explicitly marked as <drop>
- Makefile already has GOTOOLCHAIN=local which provides the same functionality

Key Changes in v1.13.2

Upstream Features

geoip plugin: Upgraded to geoip2-golang v2, added ISO 3166-2 subdivisions support
forward plugin: Added max connect attempts configuration knob
auto plugin: Fixed regex length limit vulnerability

Dependency Updates

Go version: 1.25.5 (we keep 1.24.6 with GOTOOLCHAIN=local)
AWS SDK v2: Multiple patch bumps (route53, secretsmanager, credentials, config)
google.golang.org/api: 0.251.0 → 0.257.0
quic-go: 0.55.0 → 0.57.1
k8s.io/*: Updated to v0.34.2
DataDog trace: v2.2.3 → v2.4.0

Vendor Tree

1,218 files changed: 174,666 insertions, 67,248 deletions
Regenerated via GOFLAGS=-mod=vendor go mod vendor
Major changes:
- geoip2-golang v1 → v2 migration
- DataDog appsec reorganization
- New compression libraries (klauspost/compress, klauspost/cpuid)
- AWS signin service added

Testing

Build Status

✅ Build successful with GOFLAGS=-mod=vendor make

Test Results

✅ Tests pass - make test completed successfully

All plugin tests pass
One known flaky test in proxy package (timing-related, not a blocker)
Verified plugin ordering: ocp_dnsnameresolver correctly placed before cache

Verification Checklist

Risk Assessment

Overall Risk: 🟢 LOW

Mitigated Risks

Go version mismatch (1.25.5 vs 1.24.6)
- ✅ Mitigated via GOTOOLCHAIN=local in Makefile
- Builds successfully with Go 1.24.6
geoip2-golang v2 migration
- ✅ Upstream handled migration
- ✅ Vendor tree includes v2
- Low impact (plugin not heavily used in OpenShift)
Dependency churn
- ✅ Mostly patch/minor bumps on stable APIs
- ✅ Comprehensive vendor regeneration captures all changes
ocp_dnsnameresolver compatibility
- ✅ Plugin version: v0.0.0-20251118200623-f7b15b30153f (recent)
- ✅ Compiles successfully with k8s.io/* v0.34.2
- ✅ Plugin ordering verified

Documentation

Comprehensive rebase documentation has been generated:

audit_upstream_carry_commits.md - Analysis of all 137 historical carries
rebase_to_v1.13.2_report.md - Complete rebase guide with action plans

Commit Structure

e38631c78 Update vendor tree and go.sum for v1.13.2 dependencies
0e434676e Merge remote-tracking branch 'origin/main' into rebase-to-v1.13.2
4c07153bf UPSTREAM: <carry>: openshift: vendor deps + track vendor tree
f593a3381 UPSTREAM: <carry>: openshift: document vendor tree ignore rules
9b480cade UPSTREAM: <carry>: openshift: add ocp_dnsnameresolver plugin
bc8cbf21d UPSTREAM: <carry>: openshift: keep make test target for ci-operator
43e7411fe UPSTREAM: <carry>: openshift: disable dependabot
c4c04a7e0 UPSTREAM: <carry>: openshift: document downstream OWNERS metadata
b3357336a UPSTREAM: <carry>: openshift: restore automation metadata
0233f3e7c Add deprecation notice for geoip plugin's behavior of 0 (#7740) [v1.13.2 tag]

Next Steps

Code review - Assign team members from OWNERS
QE testing - Coordinate with QE team for comprehensive testing
Stakeholder review - Present changes to stakeholders
Merge - After all approvals

References

Upstream v1.13.2 release: https://github.com/coredns/coredns/releases/tag/v1.13.2
Previous rebase PR: NE-2194: Rebase to v1.13.1 report & rebase work #157 (v1.13.1)
ocp_dnsnameresolver plugin: https://github.com/openshift/coredns-ocp-dnsnameresolver

🤖 Generated with Claude Code

Co-Authored-By: Claude Sonnet 4.5 noreply@anthropic.com

Signed-off-by: Rick Fletcher <fletch@pobox.com>

coredns#7611)

…7606)

…redns#7613)

…#7612) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.30.6 to 4.30.8. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@64d10c1...f443b60) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.30.8 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…oredns#7609) Bumps [github.com/prometheus/common](https://github.com/prometheus/common) from 0.66.1 to 0.67.1. - [Release notes](https://github.com/prometheus/common/releases) - [Changelog](https://github.com/prometheus/common/blob/main/CHANGELOG.md) - [Commits](prometheus/common@v0.66.1...v0.67.1) --- updated-dependencies: - dependency-name: github.com/prometheus/common dependency-version: 0.67.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…ns#7608) Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.75.1 to 1.76.0. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.75.1...v1.76.0) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.76.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…dns#7607) Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.251.0 to 0.252.0. - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](googleapis/google-api-go-client@v0.251.0...v0.252.0) --- updated-dependencies: - dependency-name: google.golang.org/api dependency-version: 0.252.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>

Previously the parsing logic in the forward plugin setup failed to recognise when NOERROR was used as a failover RCODE criteria. The check was in the wrong code branch. This PR fixes it and adds validation tests. Also updates the plugin README. Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>

* Update multisocket README.md I was a bit confused why `multisocket` wasn't working for me, but I eventually found https://github.com/coredns/coredns/blob/38c020941b4938cf5642acfbf5ba5e52a71d320b/core/dnsserver/register.go#L308: ``` // create one server by default if no NumSockets specified numSockets := 1 if group[0].NumSockets > 0 { numSockets = group[0].NumSockets } ``` I tried to summarize my understanding in the README Signed-off-by: Ryan Brewster <rpb@anthropic.com> * Update plugin/multisocket/README.md Co-authored-by: Ville Vesilehto <ville@vesilehto.fi> Signed-off-by: Ryan Brewster <rpb@anthropic.com> --------- Signed-off-by: Ryan Brewster <rpb@anthropic.com> Co-authored-by: Ville Vesilehto <ville@vesilehto.fi>

) Bumps [github.com/aws/aws-sdk-go-v2/credentials](https://github.com/aws/aws-sdk-go-v2) from 1.18.16 to 1.18.17. - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/main/changelog-template.json) - [Commits](aws/aws-sdk-go-v2@config/v1.18.16...config/v1.18.17) --- updated-dependencies: - dependency-name: github.com/aws/aws-sdk-go-v2/credentials dependency-version: 1.18.17 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…ns#7629) Bumps [github.com/aws/aws-sdk-go-v2/service/route53](https://github.com/aws/aws-sdk-go-v2) from 1.58.4 to 1.58.5. - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/main/changelog-template.json) - [Commits](aws/aws-sdk-go-v2@service/route53/v1.58.4...service/route53/v1.58.5) --- updated-dependencies: - dependency-name: github.com/aws/aws-sdk-go-v2/service/route53 dependency-version: 1.58.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2) from 1.31.12 to 1.31.13. - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/main/changelog-template.json) - [Commits](aws/aws-sdk-go-v2@config/v1.31.12...config/v1.31.13) --- updated-dependencies: - dependency-name: github.com/aws/aws-sdk-go-v2/config dependency-version: 1.31.13 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Wrap doPrefetch with a fresh metadata context to prevent concurrent writes to the request-scoped metadata map during background prefetch. Add a new integration test configuring a plugin chain, triggering the issue seen here. Hammers concurrent queries while log reads metadata fields repeatedly. Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>

….0 (coredns#7635)

Update to the latest golangci-lint version and use built-in modernize linter, instead of a custom CI step. Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>

A very large regex for the auto plugin in the Corefile could cause CoreDNS to OOM. This change adds an artificial limit of 10k characters for the regex pattern. Fixes OSS-Fuzz finding #466745384. Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>

Signed-off-by: Eric Case <eric.case@gmail.com>

)

…coredns#7752)

This PR add a deprecation noticed for geoip plugin's upcoming behavior change of 0. Please see PR coredns#7732 for details. Signed-off-by: Yong Tang <yong.tang.github@outlook.com>

Downstream policy (carried since 213249c/1b37b38eb) disables Dependabot in the OpenShift forks because ART curates dependencies centrally and the automated PRs get closed immediately. This commit removes `.github/dependabot.yml` and documents the policy in `carry_consolidation/dependabot_policy.md` so future rebases know why we do not re-enable it even though upstream keeps the workflow enabled. Co-authored-by: Ryan Fredette <rfredette@redhat.com> Co-authored-by: Grant Spence <gspence@redhat.com>

Carry the external `ocp_dnsnameresolver` plugin again after the rebase, folding in the previous carry commits (7a4db4b, 6b897ee, 8eab9cb) into one logical change: - register the plugin ahead of `cache` inside `plugin.cfg` and regenerate `core/plugin/zplugin.go` + `core/dnsserver/zdirectives.go` so directives stay ordered the way OpenShift expects. - pull in the released module version via `go.mod`/`go.sum`; this matches the rebased plugin tag that now builds against k8s v0.34.1. - document the reapply steps in `carry_consolidation/ocp_dnsnameresolver.md` (files to touch, commands to run, and validation steps) so reviewers do not need the deleted report to understand the carry. Co-authored-by: Arkadeep Sen <arsen@redhat.com> Co-authored-by: Ryan Fredette <rfredette@redhat.com> Co-authored-by: Grant Spence <gspence@redhat.com>

openshift-ci · 2025-12-19T18:35:09Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

openshift-ci · 2025-12-19T18:35:24Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign candita for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

rfletcher and others added 30 commits October 10, 2025 18:24

fix: update broken link to expr language definition (coredns#7604)

ed05cff

Signed-off-by: Rick Fletcher <fletch@pobox.com>

build(deps): bump actions/dependency-review-action from 4.8.0 to 4.8.1 (

aeb68d2

coredns#7611)

build(deps): bump golang.org/x/crypto from 0.42.0 to 0.43.0 (coredns#…

1cc68b6

…7606)

build(deps): bump softprops/action-gh-release from 2.3.4 to 2.4.1 (co…

2947e13

…redns#7613)

fix(multisocket): cap num sockets to prevent OOM (coredns#7615)

f085ed0

chore: bump Go version to 1.25.3 (coredns#7616)

38c0209

Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>

build(deps): bump github/codeql-action from 4.30.8 to 4.30.9 (coredns…

f19bf73

…#7625)

build(deps): bump github.com/aws/aws-sdk-go-v2/feature/ec2/imds (core…

c34a0a6

…dns#7623)

build(deps): bump github.com/aws/aws-sdk-go-v2 from 1.39.2 to 1.39.3 (c…

9210bd1

…oredns#7627)

build(deps): bump github.com/aws/aws-sdk-go-v2/service/secretsmanager (…

9a528d9

…coredns#7624)

chore(lint): bump to v2.5.0 and enable godoclint (coredns#7632)

b72d267

plugin/forward: added support for per-nameserver TLS SNI (coredns#7633)

d68cbed

build(deps): bump github/codeql-action from 4.30.9 to 4.31.0 (coredns…

4bb6ac1

…#7634)

build(deps): bump github.com/aws/aws-sdk-go-v2/config (coredns#7636)

f108730

build(deps): bump github.com/DataDog/dd-trace-go/v2 from 2.2.3 to 2.3…

9670324

….0 (coredns#7635)

build(deps): bump github.com/aws/aws-sdk-go-v2/service/route53 (cored…

7e65040

…ns#7641)

build(deps): bump google.golang.org/api from 0.252.0 to 0.253.0 (core…

7f93896

…dns#7643)

build(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 (coredn…

82bd276

…s#7642)

build(deps): bump github.com/aws/aws-sdk-go-v2/service/secretsmanager (…

60e2d45

…coredns#7640)

chore(lint): update to golangci-lint v2.6.0 (coredns#7645)

5cf4c80

Update to the latest golangci-lint version and use built-in modernize linter, instead of a custom CI step. Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>

thevilledev and others added 26 commits December 7, 2025 17:04

Update release version to 1.13.2 (coredns#7739)

38937ca

build(deps): bump golangci/golangci-lint-action from 9.1.0 to 9.2.0 (c…

2d869c8

…oredns#7745)

build(deps): bump actions/stale from 10.1.0 to 10.1.1 (coredns#7744)

5e3115e

build(deps): bump github/codeql-action from 4.31.5 to 4.31.7 (coredns…

3864521

…#7743)

build(deps): bump softprops/action-gh-release from 2.4.2 to 2.5.0 (co…

7b752b7

…redns#7742)

build(deps): bump github.com/aws/aws-sdk-go-v2/feature/ec2/imds (core…

381bda5

…dns#7746)

build(deps): bump golang.org/x/sys from 0.38.0 to 0.39.0 (coredns#7747)

9a217cd

build(deps): bump github.com/quic-go/quic-go from 0.57.0 to 0.57.1 (c…

8dad281

…oredns#7748)

build(deps): bump actions/checkout from 6.0.0 to 6.0.1 (coredns#7741)

01c4d36

build(deps): bump google.golang.org/api from 0.256.0 to 0.257.0 (core…

18e5b24

…dns#7751)

build(deps): bump github.com/aws/aws-sdk-go-v2/service/route53 (cored…

2a96ac1

…ns#7750)

plugin/geoip: Upgrade to geoip2-golang v2 (coredns#7732)

8f48704

Signed-off-by: Eric Case <eric.case@gmail.com>

build(deps): bump github.com/aws/aws-sdk-go-v2/config (coredns#7754)

f663db2

build(deps): bump github.com/aws/aws-sdk-go-v2/credentials (coredns#7749

258088c

)

build(deps): bump github.com/aws/aws-sdk-go-v2/service/secretsmanager (…

56aa6dc

…coredns#7752)

Add deprecation notice for geoip plugin's behavior of 0 (coredns#7740)

0233f3e

This PR add a deprecation noticed for geoip plugin's upcoming behavior change of 0. Please see PR coredns#7732 for details. Signed-off-by: Yong Tang <yong.tang.github@outlook.com>

UPSTREAM: <carry>: openshift: restore automation metadata

b335733

UPSTREAM: <carry>: openshift: document downstream OWNERS metadata

c4c04a7

UPSTREAM: <carry>: openshift: keep make test target for ci-operator

bc8cbf2

UPSTREAM: <carry>: openshift: document vendor tree ignore rules

f593a33

UPSTREAM: <carry>: openshift: vendor deps + track vendor tree

4c07153

Merge remote-tracking branch 'origin/main' into rebase-to-v1.13.2

0e43467

Update vendor tree and go.sum for v1.13.2 dependencies

e38631c

openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Dec 19, 2025

gcs278 mentioned this pull request Dec 19, 2025

WIP: Add /rebase slash command for version rebases #161

Draft

5 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Comments

Rebase to CoreDNS v1.13.2#160

Rebase to CoreDNS v1.13.2#160
gcs278 wants to merge 122 commits intoopenshift:mainfrom
gcs278:rebase-to-v1.13.2

gcs278 commented Dec 19, 2025 •

edited

Loading

Uh oh!

openshift-ci bot commented Dec 19, 2025

Uh oh!

openshift-ci bot commented Dec 19, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants

Comments

Conversation

gcs278 commented Dec 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Rebase Details

Carries Forward-Ported (7 total)

Carry Dropped

Key Changes in v1.13.2

Upstream Features

Dependency Updates

Vendor Tree

Testing

Build Status

Test Results

Verification Checklist

Risk Assessment

Mitigated Risks

Documentation

Commit Structure

Next Steps

References

Uh oh!

openshift-ci bot commented Dec 19, 2025

Uh oh!

openshift-ci bot commented Dec 19, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants

gcs278 commented Dec 19, 2025 •

edited

Loading