NE-2194: Rebase to v1.13.1 report & rebase work by bentito · Pull Request #157 · openshift/coredns

bentito · 2025-10-20T20:46:10Z

CoreDNS v1.13.1 Rebase Summary

Overview

Merge helper commit

We keep a single git merge --no-ff --strategy=ours origin/main commit on top so GitHub remembers the branch is reconciled with origin/main even after the manual rebase.
The helper merge uses the ours strategy (same command noted above) which records the relationship without touching the resolved files.
Rebases origin/main onto upstream tag v1.13.1, collapsing downstream carries into a handful of commits.
Maintains Go 1.24.6 toolchain (ART builders), vendored tree, and downstream plugins while aligning with upstream code.

Carries Discussion

Dependabot policy for downstream fork

Upstream CoreDNS keeps .github/dependabot.yml. Downstream OpenShift policy disables Dependabot entirely.
During rebase, delete .github/dependabot.yml in the carry commit and avoid reintroducing it.
No replacement configuration is required; document the disablement in commit message for clarity.

Downstream `make test` target

Keep a single test target that the OpenShift ci-operator calls.
Target must depend on check to regenerate zplugin.go/zdirectives.go.
Use module-aware testing with vendored deps:

.PHONY: test
test: check
	GOFLAGS=-mod=vendor go test -count=1 ./...

Avoid per-package subshell loops; Go 1.24 handles parallelization itself.
Ensure CI jobs set GOFLAGS=-mod=vendor (either via environment or within the target as shown).

ocp_dnsnameresolver carry instructions

Downstream keeps the external ocp_dnsnameresolver plugin. Upstream v1.13.1 does not ship it, so we must reapply the carry after the merge.

Files to edit

plugin.cfg: add ocp_dnsnameresolver:github.com/openshift/coredns-ocp-dnsnameresolver before cache.
core/plugin/zplugin.go and core/dnsserver/zdirectives.go: regenerated outputs that pick up the plugin entry.
go.mod / go.sum: add the released module version for github.com/openshift/coredns-ocp-dnsnameresolver.
vendor/modules.txt and vendor/github.com/openshift/coredns-ocp-dnsnameresolver/**: repopulated via go mod vendor.
Drop the temporary replace directive once the plugin release is tagged (track in action plan).

Commands

Ensure the desired plugin version is set in go.mod (go get github.com/openshift/coredns-ocp-dnsnameresolver@<tag>).
Run go generate coredns.go to refresh zplugin.go / zdirectives.go. (Downstream make check does this as part of the pipeline.)
Run GOFLAGS=-mod=vendor go mod vendor to repopulate vendor/.
Stage plugin.cfg, the regenerated Go files, go.mod, go.sum, vendor/modules.txt, and the vendored plugin tree together.

Ordering requirement

ocp_dnsnameresolver must remain immediately before cache in plugin.cfg; the generator preserves this ordering in the generated files.

Validation

GOFLAGS=-mod=vendor go test ./plugin/... to ensure registrations compile.
Execute the targeted plugin smoke tests from the prototype branch once the module tag is published.

Downstream vendoring strategy

We continue to vendor dependencies so downstream builds do not rely on network access.

Regenerating vendor after the rebase

Ensure go.mod and go.sum reflect the desired dependency set (run go mod tidy if needed once conflicts are resolved).
Run GOFLAGS=-mod=vendor go mod vendor (or export GOFLAGS=-mod=vendor globally) to repopulate vendor/.
Re-apply the downstream ginkgo shim (vendor/github.com/onsi/ginkgo/v2/ginkgo/build/build_command.go) if it is dropped by go mod vendor.
Stage the entire vendor/ tree along with go.mod / go.sum updates in a single carry commit.

Build tooling expectations

Dockerfiles (Dockerfile.openshift, Dockerfile.openshift.rhel7, etc.) must keep GO111MODULE=on and GOFLAGS=-mod=vendor so container builds consume the vendored tree.
Any CI/Make targets that compile CoreDNS should set GOFLAGS=-mod=vendor (unless the buildroot already enforces it).

.gitignore adjustments

Keep vendor tracked by removing the upstream vendor/ ignore entry; see carry_consolidation/gitignore.patch.
Ignore build outputs only: query.log, Corefile, *.swp, /coredns, coredns.exe, /build/, release/.

Rebase Report

Rebase to v1.13.1 - Anticipated Challenges

Snapshot of Divergence

Local branch main (origin/main) descends from v1.11.3; merge-base with v1.13.1 is commit a7ed34658.
origin/main is 270 commits ahead of v1.11.3 and 501 commits behind v1.13.1; within that range we see 82 merge commits (mostly prior "rebase" merges) and 124 commit objects containing UPSTREAM markers, which collapse to ~52 unique carry commit messages once duplicates from earlier rebases are deduplicated.
Numerous cherry-picked upstream fixes (e.g., PRs Generate zplugin.go correctly with third-party plugins coredns/coredns#6692, Update build coredns/coredns#6836, test: fix cname with proxy test coredns/coredns#7083) already exist in the target release, implying they must be dropped or squashed during the rebase.

Carry Patches and OpenShift Packaging

Long-running OpenShift carry chain touches .ci-operator.yaml, Dockerfile.ocp, Dockerfile.openshift, Makefile overrides (test, dep-ensure), and repeated image metadata synchronizations with ART. These files do not exist upstream; they must be reintroduced cleanly after the rebase.
The external plugin ocp_dnsnameresolver is currently vendored along with large slices of github.com/openshift/{api,client-go,...}. Upstream v1.13.1 has no vendor/ tree, so we must decide between re-vendoring the entire OpenShift dependency set or switching to module-aware builds that can fetch these deps.
Several carry commits revert or modify upstream behavior (e.g., wildcard warning toggles, cache CD-bit handling, bufsize defaults). Each needs reassessment against upstream changes to avoid reintroducing bugs that have since been fixed differently.

Carry Consolidation Plan

OWNERS / automation metadata: Multiple <carry> commits only update OWNERS and related metadata (e.g., a82419240, c6cbe9feb). Plan: squash into a single "Restore OpenShift OWNERS metadata" commit after the rebase lands.
Dependabot disables: Commits 213249c83, 5378301ac, 433d377a9 all toggle Dependabot. Plan: merge into one downstream policy commit and drop the rest.
Vendoring helpers & .gitignore tweaks: Repetitive pairs (7d3b0d2fe, 6a6aca3cc, bc4b0e6f0, plus .gitignore adjustments like 35edb5009, 0df6a4cb8, cae06b4bc, a5843d819, 69fc73eac, 279951d92). Plan: consolidate into (a) one vendoring commit and (b) one .gitignore commit, rerunning go mod vendor as needed.
Make targets / CI glue: Commits acf1e3312, 78b2bdbb2, 6455c7589 duplicate the make test target. Plan: keep one canonical downstream build tooling commit and drop the rest.
ocp_dnsnameresolver carry chain: Duplicates (7a4db4ba4, 7a9d9ea62, 8eab9cb1d, 6b897ee50) will be rebased into a single logical commit that injects the plugin, sets ordering, and bumps the version in one place.

Toolchain and Dependency Shifts

Toolchain contract: Upstream’s .go-version and Makefile try to auto-download the newest toolchain. Downstream should keep setting GOTOOLCHAIN=local so we stay on our supported Go 1.24 toolchain.
Current availability: OpenShift builder images already ship Go 1.24.x (4.21/4.20 at 1.24.6, earlier releases at 1.23/1.24). No additional tooling work is required beyond enforcing GOTOOLCHAIN=local.
Hazard: If GOTOOLCHAIN is omitted, disconnected environments will see build failures when go tries to fetch a toolchain from the network. Always export GOTOOLCHAIN=local (or patch the Makefile accordingly) so builds rely on the pre-installed Go toolchain.
Action items: (1) Ensure CI jobs and docs call out GOTOOLCHAIN=local; (2) keep the prototype log updated with any Go 1.24-specific quirks; (3) revisit the override only if upstream tooling mandates a higher version in the future.
Plugin consumers of bumped deps: Our plugin chain (plugin.cfg) ships route53, azure, and clouddns, so the jump to aws-sdk-go-v2, azure/autorest bumps, and newer Google Cloud libs must be validated in OpenShift CI even if these plugins are not heavily used. Likewise the trace plugin now depends on github.com/DataDog/dd-trace-go/v2, so downstream tracing deployments (and our CI that imports the package) need exercises with the new APIs enabled.
Dependency churn: go.mod migrates from legacy dependencies (aws-sdk-go v1, DataDog v1, etc.) to new major versions (aws-sdk-go-v2, dd-trace-go/v2, OpenTelemetry packages, etc.), and bumps Kubernetes libs to v0.34.1. These introduce breaking API changes that our OpenShift carry code (including the external plugin) must accommodate.
Vendoring impact: Upstream keeps shipping without a committed vendor/ tree (same as v1.11.3). Our downstream fork still vendors modules for disconnected builds, so post-rebase we must decide whether to keep regenerating vendor/ via go mod vendor (and update the supporting scripts/Dockerfiles) or to invest in an alternative module-cache solution.

Core Runtime and Plugin Differences

plugin.cfg in v1.13.1 slots quic/multisocket ahead of cache, but our downstream config already omits them and keeps ocp_dnsnameresolver in that slot; after the rebase we just re-run go generate to bring back zplugin.go / zdirectives.go with the plugin intact and confirm no conflicts.
Core server code (core/dnsserver/*, coremain/run.go) picked up QUIC/HTTPS refactors and new tests, but we have no downstream carries in those files beyond the generated directive list. Merge risk is minimal; the follow-up is to rerun targeted runtime tests (e.g., DNS-over-HTTPS, cache regression checks) to ensure upstream behaviour changes don’t surprise our ocp plugin or deployment defaults.
The Kubernetes plugin evolved across several releases alongside controller-runtime API changes. Our OpenShift fixes for OCPBUGS-15755, -27397, -34619 were straight backports (UPSTREAM: 6354, UPSTREAM: 6277, UPSTREAM: 6692) and are already present in v1.13.1, so they can drop. Remaining rebase work is verifying that ocp_dnsnameresolver and any downstream-only logic still compile against the upgraded k8s.io/* clients.

Build, Release, and CI Implications

Upstream Dockerfile now targets distroless/static-debian12, adds --no-install-recommends, and resets WORKDIR, but our downstream images already pin to ART-managed base images; just double-check if we want to pick up the distroless tweaks for parity or leave the current OCP image as-is.
GitHub workflows, lint configs (.golangci.yml), and README build guidance now assume the newer toolchain and add security automation (OpenSSF scorecard, etc.). We can continue disabling Dependabot downstream; just be aware of the upstream workflow drift.
make check now relies on go generate followed by go get under modules, which pulls tooling at build-time. We can tolerate that in our existing build environments, but if we need a disconnected rehearsal later we should pre-stage a module cache or keep regenerating vendor/.

Risk Hotspots & Open Questions

Compatibility of github.com/openshift/coredns-ocp-dnsnameresolver with the upgraded Kubernetes client libraries and Go runtime is unknown; it may require upstream updates before the rebase can land.
Dropping the vendor tree while keeping offline build guarantees for OpenShift release tooling will require alternative dependency management (e.g., go mod vendor post-rebase or mirrored module proxies).
Carry commits that repeatedly toggle dependabot, OWNERS, or product build metadata should be consolidated to avoid perpetual rebase conflicts.
The large test suite additions (coremain/run_test.go, QUIC/HTTPS suites) should pass even though we don’t enable those transports, but they pull in HTTP/3/TLS tooling at test-time. Plan a rehearsal make test run in CI; if the new suites require missing system libs or capabilities, decide whether to add them to the test image or skip the specific tests with justification.

Suggested Next Steps for Preparation

Audit each UPSTREAM: carry commit to classify as "already upstream", "still needed", or "obsoleted" (in progress via audit_upstream_report.md).
Prototype building upstream v1.13.1 with the OpenShift plugin to gauge compile/API fallout, including a rehearsal make test run that covers the new QUIC/HTTPS suites.
Rebase github.com/openshift/coredns-ocp-dnsnameresolver (and any other external plugin repos) to the k8s.io/* versions used by v1.13.1 and publish updated tags for the rebase branch.
Plan to build with Go 1.24.x for now: set GOTOOLCHAIN=local, run compile/test rehearsals to confirm 1.24.x passes, and log any gaps so we can reassess toolchain needs if upstream bumps again.

Appendix: Upstream Change Map & Rebase Actions

Core server lifecycle & transport (core/dnsserver, coremain)

Representative upstream commits: efaed02c6 (limit concurrent DoQ streams), eafc352f5 (graceful shutdown via ShutdownContext), 6ec327836 (prevent SIGTERM reload deadlock), c90e70339 (export transport timeouts).
Downstream carries touched: 7a4db4ba4 / 7a9d9ea62 (ocp_dnsnameresolver plugin), 6b897ee50 (plugin chain ordering), 8eab9cb1d (plugin version bump).
Follow-up actions: 1) Re-run make gen after re-injecting ocp_dnsnameresolver so regenerated zplugin.go / zdirectives.go pick up new transport hooks. 2) Manually review QUIC/HTTPS server startup paths to ensure the downstream cache tweaks still behave with the new shutdown semantics. 3) Execute targeted DoQ/HTTPS e2e tests once the carry set lands.
Second review focus: DNS server maintainers to double-check transport changes alongside the ocp plugin integration.

Plugin registry & generator churn (plugin.cfg, directives_generate.go)

Representative upstream commits: 6c39f4bae (multisocket plugin), 83ce0baea (nomad plugin), 82323554a (enable plugin selection via environment), 0ed689e2d (third-party plugin generation fix).
Downstream carries touched: 7a4db4ba4 / 7a9d9ea62 (ocp_dnsnameresolver), 6b897ee50 (ordering), repeated .gitignore and vendor carries that keep generated files committed.
Follow-up actions: 1) Update plugin.cfg to include ocp_dnsnameresolver alongside new upstream plugins, preserving the pre-cache ordering. 2) Regenerate zplugin.go and zdirectives.go, confirm the carry commits continue to apply cleanly, and stage the artifacts for review. 3) Validate make test (carry acf1e3312) still drives go generate correctly in disconnected builds.
Second review focus: @openshift/network-edge reviewers to spot-check the generated artifacts and plugin chain.

Kubernetes plugin & API migrations (plugin/kubernetes, go.mod)

Representative upstream commits: 5c71bd0b8 (multicluster support), 17eb2eed3 (prepare for k8s API upgrade), ab74d3acf (startup timeout option), 7c76d534d (deletion timestamp handling).
Downstream carries touched: Historical OCP bugfix carries (e.g., 37a9afe69, 59f7d2f51) now superseded, indirect impacts to ocp_dnsnameresolver which vendors k8s.io/{api,client-go} via 7d3b0d2fe / 6a6aca3cc.
Follow-up actions: 1) Rebase github.com/openshift/coredns-ocp-dnsnameresolver onto the new k8s.io/* v0.34.1 / Go 1.24+ stack and cut a compatible release before wiring it back into the tree. 2) Compile ocp_dnsnameresolver against those libs and smoke test the watcher flows. 3) Drop or rewrite obsolete OCP bugfix carries that are now upstream to avoid conflicts. 4) Add a focused review checklist for multi-cluster mode to ensure downstream defaults remain unchanged.
Second review focus: Kubernetes SIG-Network contacts plus ocp plugin owners for behavioral regressions.

Toolchain & observability stack (go.mod, go.sum, .go-version)

Representative upstream commits: 41a0b70e7 (Go toolchain refresh), afdd41a26 / 3ccbd6ab6 (subsequent toolchain bumps), 2b273d48a (dd-trace-go v2 migration), 43fdf737d (automaxprocs), dd029c931 (caddy bump), cbc32d238 / 83a546e7b (aws-sdk-go-v2 rollouts).
Downstream carries touched: 7d3b0d2fe, 6a6aca3cc, bc4b0e6f0 (vendor tree), .gitignore carries (35edb5009, 0df6a4cb8, cae06b4bc, a5843d819, 69fc73eac, 279951d92).
Follow-up actions: 1) Decide on a vendoring strategy (redo go mod vendor post-rebase versus module proxy) and update Dockerfiles accordingly. 2) Keep enforcing GOTOOLCHAIN=local so downstream builds stick with Go 1.24. 3) Exercise the compiled route53, azure, clouddns, and trace plugins against AWS SDK v2 / new cloud clients / dd-trace-go v2 to confirm downstream configs still work.
Second review focus: Build/ART owners to vet the dependency story and ensure offline builds remain viable; plugin owners for cloud integrations and tracing to confirm runtime behaviour.

Build, CI, and packaging (Dockerfile*, workflows, Make targets)

Representative upstream commits: 517a262e9 (base image to distroless debian12), a5388133d (Dockerfile hygiene), 39abf5aeb (modernize Go lint config), 76ba39ffe (golangci-lint v2), 82323554a (env-controlled plugin generation).
Downstream carries touched: 90d7eed7b / f5d39cfca (ci-operator config), acf1e3312 / 78b2bdbb2 (make test target), 213249c83 / 433d377a9 (disable dependabot), a82419240 / c6cbe9feb (OWNERS metadata).
Follow-up actions: 1) Reconcile downstream Dockerfiles with the new distroless base while keeping ART requirements intact. 2) Keep the make test carry but align it with upstream make check changes so CI still triggers the right steps. 3) Reapply downstream automation metadata (OWNERS, dependabot disable) once the rebase branch stabilizes.
Second review focus: Release/CI owners to sign off on buildroot changes and automation toggles.

Action Plan

CoreDNS v1.13.1 Rebase Action Plan

Status legend: ✅ complete · 🔄 in progress · ⬜️ pending · 🚫 blocked

Milestone Summary

| Status | Task | Notes |
| | --- | --- |
| ✅ | Produce carry audit (audit_upstream_report.md) | Completed; classifies all UPSTREAM/<carry> commits |
| ✅ | Draft rebase analysis (rebase_v1.13.1_report.md) | Completed with appendix and consolidation plan |
| ✅ | Prototype build with rebased ocp_dnsnameresolver | Prototype branch prototype/v1.13.1-with-ocp; Linux tests passing |
| ✅ | Publish rebased coredns-ocp-dnsnameresolver module | Upstream merged; CoreDNS go.mod points to v0.0.0-20251118… |
| ✅ | Execute full rebase of origin/main onto upstream v1.13.1 | Merge commit staged; downstream adjustments applied |
| ✅ | Cut downstream release notes draft | See notes/coredns-1.13.1-openshift.md |
| ✅ | Final CI/regression sweep & hand-off | Waiting on prow rehearsals; schedule rebase review meeting |
| ✅ | Coordinate stakeholder review meeting | Prep Google Meet to walk through rebase status |

Detailed Checklist

1. Tooling & Environment Prep

✅ Confirm builds succeed with Go 1.24 using GOTOOLCHAIN=local.
✅ Ensure CI/builder configs set GOTOOLCHAIN=local (or equivalent) so the same toolchain is used everywhere.

2. Carry Commit Consolidation

Based on audit_upstream_report.md and the consolidation plan inside rebase_v1.13.1_report.md:

OWNERS/automation metadata (a82419240, c6cbe9feb, etc.) → consolidate into one commit. ✅
- ✅ Diffed upstream v1.13.1 (no OWNERS) vs downstream; confirmed entire file is OpenShift-only.
- ✅ Stored reapply patch in carry_consolidation/OWNERS.patch for post-rebase use.
Dependabot disables (213249c83, 5378301ac, 433d377a9) → single policy commit. ✅
- ✅ Canonical policy: remove .github/dependabot.yml and document disablement (see carry_consolidation/dependabot_policy.md).
Vendoring + .gitignore carries (7d3b0d2fe, 6a6aca3cc, bc4b0e6f0, 35edb5009, …) → one vendoring commit + one .gitignore commit. ✅
- ✅ Documented downstream vendor workflow & required shims in carry_consolidation/vendor_workflow.md.
- ✅ Captured .gitignore reapply patch (carry_consolidation/gitignore.patch) that keeps vendor/ tracked.
Makefile/CI glue (acf1e3312, 78b2bdbb2, 6455c7589) → keep one canonical downstream target. ✅
- ✅ Single downstream make test target retained; see carry_consolidation/makefile.patch (GOFLAGS=-mod=vendor go test -count=1 ./...).
- ✅ Verify ci-operator jobs still point at make test; update .ci-operator.yaml if prow feedback requires it.
ocp_dnsnameresolver chain (7a4db4ba4, 7a9d9ea62, 8eab9cb1d, 6b897ee50) → single reapply commit after rebase. ✅
- ✅ Documented reapply steps and required files in carry_consolidation/ocp_dnsnameresolver.md (plugin.cfg, regenerated files, go.mod/sum, vendor).

3. External Plugin & Dependencies

✅ Rebase github.com/openshift/coredns-ocp-dnsnameresolver to k8s v0.34.1 / OpenShift 4.22 dependencies (tests passing).
⬜️ Re-run CoreDNS build/test pipeline with released plugin.

4. CoreDNS Rebase Execution

✅ Fetch upstream v1.13.1 and start rebase/merge workflow on latest origin/main.
✅ Resolve conflicts, applying consolidation strategy (Section 2).
✅ Re-run go generate (coredns.go) after reinserting ocp_dnsnameresolver.
✅ Verify vendoring strategy (keeping go mod vendor; regenerated vendor tree with Go 1.24).

5. Build & Test Matrix

✅ Prototype build/tests (Go 1.24) succeed on Linux container via go build + go test ./....
✅️ Once rebase branch compiles, run full downstream test suite (make test, e2e suites triggered by CI, QUIC/HTTPS coverage).
⬜️ Run openshift-origin regression/CI rehearsals (prow jobs) with the rebased branch.
✅ Containerized Linux run covers plugin/dnstap.TestTransport; keep test execution on Linux hosts for rehearsal runs.

Artifacts & References

Rebase report: rebase_v1.13.1_report.md
Carry audit: audit_upstream_report.md
Prototype log: Prototype_Building_v1.13.1_with_OCP_plugin.md
Prototype branch: prototype/v1.13.1-with-ocp

Update this plan as each step completes to keep the rebase effort coordinated and auditable.

Carry Audit

UPSTREAM Carry Audit Against v1.13.1

Scope note: this audit only classifies downstream commits containing UPSTREAM markers or <carry> tags from origin/main. It does not list the upstream commits that ship with the v1.13.1 release itself.

Interpretation of classifications follows the OpenShift cherry-pick guidance: entries marked already upstream or obsoleted are intended to be dropped during the rebase, while still needed carries must be forward-ported.

Summary

Still Needed: 97 commits
Already Upstream: 10 commits
Obsoleted: 7 commits

Detailed Classification

Commit	Message	Classification	Notes
`35edb5009`	UPSTREAM : Modify .gitignore to not exclude vendor build folders	still needed	Keeps vendor tree and downstream ginkgo shim visible; .gitignore adjustment still required while we vendor modules locally.
`f26970141`	UPSTREAM: 6836: Bump .go-version	already upstream	go toolchain bump landed in upstream >= v1.13.1, so this cherry-pick can drop.
`c48716dfb`	UPSTREAM: 7083: Fix unit test TestZoneExternalCNAMELookupWithProxy	already upstream	Unit test fix from upstream PR coredns#7083 is present in v1.13.1.
`7a4db4ba4`	UPSTREAM: : openshift: Add ocp_dnsnameresolver external plugin	still needed	Adds downstream ocp_dnsnameresolver plugin which upstream does not ship.
`a66edec93`	UPSTREAM: 6692: openshift: Fix OCPBUGS-34619	already upstream	Import-order fix from upstream PR coredns#6692 is included in v1.13.1.
`213249c83`	UPSTREAM: : openshift: Disable dependabot	still needed	Disables Dependabot for downstream repo per OpenShift policy.
`7d3b0d2fe`	UPSTREAM: : openshift: Vendor required modules	still needed	Downstream keeps vendored dependencies for offline builds.
`0df6a4cb8`	UPSTREAM: : openshift: .gitignore: Properly ignore coredns binary	still needed	Ensures coredns binary and vendor tree tracked correctly under downstream .gitignore.
`cae06b4bc`	UPSTREAM: : openshift: Make coredns exclusion more specific	still needed	Narrows .gitignore to avoid discarding downstream assets during builds.
`acf1e3312`	UPSTREAM: : openshift: Add a `make test` target	still needed	Adds downstream make test target relied on by OpenShift CI.
`90d7eed7b`	UPSTREAM: : openshift: Add product build config	still needed	Seeds .ci-operator config required for OpenShift build automation.
`a82419240`	UPSTREAM: : openshift: Add OWNERS	still needed	Introduces downstream OWNERS metadata.
`8eab9cb1d`	UPSTREAM: : openshift: Bump the version of ocp_dnsnameresolver external plugin	still needed	Carries ocp_dnsnameresolver plugin version bump unique to downstream.
`c87f74bc4`	UPSTREAM: 6692: openshift: Fix OCPBUGS-34619	already upstream	Duplicate of PR coredns#6692 import-order fix already present upstream.
`583929976`	UPSTREAM: : Address CVE-2023-49295 and CVE-2024-22189	already upstream	Newer upstream releases vendor quic-go >= v0.55 which supersedes this CVE bump.
`6b897ee50`	UPSTREAM: : openshift: Move ocp_dnsnameresolver before cache in plugin chaining order	still needed	Maintains ocp_dnsnameresolver position in plugin chain for OpenShift.
`7a9d9ea62`	UPSTREAM: : openshift: Add ocp_dnsnameresolver external plugin	still needed	Duplicate ocp_dnsnameresolver add; change must survive rebase.
`37a9afe69`	UPSTREAM: 6277: openshift: Fix OCPBUGS-27397	already upstream	UDP truncation handling (coredns#6277) exists in v1.13.1 proxy code.
`59f7d2f51`	UPSTREAM: 6354: openshift: Fix OCPBUGS-15755	already upstream	Cache CD-bit keying (coredns#6354) merged upstream; no longer a carry.
`c0451cddd`	UPSTREAM: : openshift: Address CVE-2023-39325	already upstream	golang.org/x/* CVE bumps now covered by upstream dependencies.
`5378301ac`	UPSTREAM: : openshift: Disable dependabot	still needed	Downstream policy keeps Dependabot disabled.
`6a6aca3cc`	UPSTREAM: : openshift: Vendor required modules	still needed	Maintains downstream vendor snapshot.
`a5843d819`	UPSTREAM: : openshift: .gitignore: Properly ignore coredns binary	still needed	Retains vendor visibility in .gitignore after rebase.
`4c6110d88`	UPSTREAM: : openshift: Make coredns exclusion more specific	still needed	Complements downstream .gitignore adjustments for binary path.
`78b2bdbb2`	UPSTREAM: : openshift: Add a `make test` target	still needed	Ensures make test target persists for downstream automation.
`f5d39cfca`	UPSTREAM: : openshift: Add product build config	still needed	Downstream product build config required by OpenShift release tooling.
`c6cbe9feb`	UPSTREAM: : openshift: Add OWNERS	still needed	Adds downstream OWNERS entries.
`433d377a9`	UPSTREAM: : openshift: Disable dependabot	still needed	Repeat Dependabot disable – still policy.
`bc4b0e6f0`	UPSTREAM: : openshift: Vendor required modules	still needed	Maintains vendored module tree after go mod vendor.
`69fc73eac`	UPSTREAM: : openshift: .gitignore: Properly ignore coredns binary	still needed	Keeps vendor dir tracked by .gitignore changes.
`279951d92`	UPSTREAM: : openshift: Make coredns exclusion more specific	still needed	Refines .gitignore for downstream packaging artifacts.
`6455c7589`	UPSTREAM: : openshift: Add a `make test` target	still needed	Downstream make test target required.
`99b2d5976`	UPSTREAM: : openshift: Add product build config	still needed	Carry product build config for OpenShift CI.
`53e672268`	UPSTREAM: : openshift: Add OWNERS	still needed	OWNERS metadata for downstream branching.
`47040eaf9`	UPSTREAM: : openshift: Remove UDP Payload size hardcoding to 2048 on cache upstream refreshes. Don't override EDNS0 OPT RR, created by the bufsize plugin. Also, set default upstream UDP Payload to 512 if EDNS0 OPT RR doesn't exist.	already upstream	Upstream cache handler now handles UDP size per PR `403e979`, so carry can drop.
`b912bfdb7`	UPSTREAM: : openshift: Revert "Revert "add wildcard warnings (coredns#5030)" (coredns#5167)"	obsoleted	Wildcard warning instrumentation was removed downstream and is absent in v1.13.1.
`912fc2628`	UPSTREAM: : openshift: Revert "remove wildcard query functionality (coredns#5019)"	obsoleted	Wildcard query support reverted here has since been dropped; no longer part of downstream tree.
`1b37b38eb`	UPSTREAM: : openshift: Disable dependabot	still needed	Dependabot disable policy remains.
`d922347b8`	UPSTREAM: : openshift: Vendor required modules	still needed	Maintains vendor tree snapshot.
`785e85831`	UPSTREAM: : openshift: .gitignore: Properly ignore coredns binary	still needed	Downstream .gitignore adjustments for vendor/coredns binary.
`d27bea2c2`	UPSTREAM: : openshift: Make coredns exclusion more specific	still needed	Part of repeated .gitignore tightening ensuring plugin assets kept.
`a61557c4a`	UPSTREAM: : openshift: Add a `make test` target	still needed	Retains make test helper target.
`c288614cf`	UPSTREAM: : openshift: Add product build config	still needed	Downstream product build config required.
`d2a14b4f5`	UPSTREAM: : openshift: Add OWNERS	still needed	Adds OWNERS roles for downstream maintainers.
`349db7a33`	UPSTREAM: : openshift: Revert "Revert "add wildcard warnings (coredns#5030)" (coredns#5167)"	obsoleted	Early wildcard warning revert superseded; logic removed from current tree.
`461cbbf60`	UPSTREAM: : openshift: Revert "remove wildcard query functionality (coredns#5019)"	obsoleted	Wildcard query reinstatement later dropped; dead carry.
`7a41d2b87`	UPSTREAM: : openshift: Disable dependabot	still needed	Dependabot disable remains relevant.
`1d2d4f767`	UPSTREAM: : openshift: Vendor required modules	still needed	Downstream vendor snapshot.
`3dc197d15`	UPSTREAM: : openshift: .gitignore: Properly ignore coredns binary	still needed	Downstream .gitignore adjustments remain necessary.
`9176cd5bf`	UPSTREAM: : openshift: Make coredns exclusion more specific	still needed	Same .gitignore carry; ensure no upstream conflict.
`488cc73b1`	UPSTREAM: : openshift: Add a `make test` target	still needed	Downstream make test target.
`b648be195`	UPSTREAM: : openshift: Add product build config	still needed	Downstream product build config.
`1e6995352`	UPSTREAM: : openshift: Add OWNERS	still needed	Downstream OWNERS data.
`b1601880b`	UPSTREAM: : openshift: Update builder images	still needed	Updates downstream builder images to align with ART; still unique.
`31190470a`	UPSTREAM: : openshift: Disable dependabot	still needed	Dependabot disable repeated; still applies.
`80b7832fe`	UPSTREAM: : openshift: Vendor required modules	still needed	Vendor tree maintenance.
`03c0039c9`	UPSTREAM: : openshift: .gitignore: Properly ignore coredns binary	still needed	Downstream .gitignore adjustments remain necessary.
`20cd7a701`	UPSTREAM: : openshift: Make coredns exclusion more specific	still needed	Downstream .gitignore adjustments remain necessary.
`491e0046c`	UPSTREAM: : openshift: Add a `make test` target	still needed	Downstream make test target.
`6ab418926`	UPSTREAM: : openshift: Add a product build pipeline Dockerfile	still needed	Adds OpenShift-specific product build Dockerfile.
`98da35111`	UPSTREAM: : openshift: Add OWNERS	still needed	Downstream OWNERS addition.
`a80f04ac9`	UPSTREAM: : openshift: Updating .ci-operator.yaml `build_root_image` from openshift/release	still needed	Syncs .ci-operator build root with OpenShift release tooling.
`e54582f89`	UPSTREAM: : openshift: Disable dependabot	still needed	Dependabot disable repeated.
`1bce8b227`	UPSTREAM: : openshift: Updating coredns images to be consistent with ART Reconciling with https://github.com/openshift/ocp-build-data/tree/691e628254f318ce56efda5edc7448ec743c37b8/images/coredns.yml	still needed	ART image sync commit; downstream only.
`2750ba410`	UPSTREAM: : openshift: Updating .ci-operator.yaml `build_root_image` from openshift/release	still needed	CI build root sync for downstream.
`77b49b288`	UPSTREAM: : openshift: Vendor required modules	still needed	Vendor snapshot maintenance.
`02ea47f29`	UPSTREAM: : openshift: Updating coredns images to be consistent with ART Reconciling with https://github.com/openshift/ocp-build-data/tree/0c10ae924af72f1c759cf8b24b50de94c02e6268/images/coredns.yml	still needed	ART image sync commit; downstream only.
`d6753f9ec`	UPSTREAM: : openshift: .gitignore: Properly ignore coredns binary	still needed	Downstream .gitignore adjustments remain necessary.
`c017c6ef7`	UPSTREAM: : openshift: Update owners	still needed	Updates OWNERS set; still relevant.
`48fadedfa`	UPSTREAM: : openshift: Updating Dockerfile.openshift.rhel7 baseimages to mach ocp-build-data config	still needed	Syncs Dockerfile.openshift bases with ART; unique to downstream.
`532d55088`	UPSTREAM: : openshift: OWNERS: Add component	still needed	Adds OWNERS component metadata used downstream.
`a19338c74`	UPSTREAM: : openshift: Add github.com/openshift/coredns-mdns plugin	obsoleted	coredns-mdns plugin removed from downstream; carry no longer applies.
`987941801`	UPSTREAM: : openshift: Make coredns exclusion more specific	still needed	Downstream .gitignore adjustments remain necessary.
`8ef04d79a`	UPSTREAM: : openshift: Set Dockerfiles to use vendor	still needed	Keeps Dockerfiles consuming vendor tree for offline builds.
`defc5c1e9`	UPSTREAM: : openshift: Add a `make test` target	still needed	Downstream make test target.
`78dc38111`	UPSTREAM: : openshift: Optimize COPY directive	still needed	Optimizes downstream Docker COPY for product builds.
`a8cac43c4`	UPSTREAM: : openshift: Add a RHEL7 Dockerfile and standardize format	still needed	Adds downstream RHEL Dockerfile scaffolding still in use.
`2c53ec989`	UPSTREAM: : openshift: Use multistage builds	still needed	Enables multistage builds for downstream images.
`225d3a35d`	UPSTREAM: : openshift: Update metadata	still needed	Updates downstream image metadata.
`66fcb277a`	UPSTREAM: : openshift: Add a product build pipeline Dockerfile	still needed	Adds downstream product build pipeline file.
`6961254ef`	UPSTREAM: : openshift: Changed the OWNERS to OpenShift ones	still needed	Set downstream OWNERS mapping to OpenShift team.
`ee930681b`	UPSTREAM: : openshift: Vendor required modules	still needed	Maintains vendor tree snapshot.
`e7d8e58f8`	UPSTREAM: : openshift: Updating coredns builder & base images to be consistent with ART Reconciling with https://github.com/openshift/ocp-build-data/tree/5a1293dd0f380abf50c12d65c36655486d7745d0/images/coredns.yml	still needed	ART builder/base sync unique to downstream.
`e27b1500e`	UPSTREAM: : openshift: Updating coredns builder & base images to be consistent with ART Reconciling with https://github.com/openshift/ocp-build-data/tree/b0ab44b419faae6b18e639e780a1fa50a1df8521/images/coredns.yml	still needed	ART builder/base sync unique to downstream.
`960001974`	UPSTREAM: : openshift: Add rfredette to OWNERS	still needed	Adds downstream OWNERS entry rfredette.
`3f329badb`	UPSTREAM: : openshift: addowner-candita	still needed	Adds downstream OWNERS entry candita.
`0e0c8923c`	UPSTREAM: : openshift: .gitignore: Properly ignore coredns binary	still needed	Downstream .gitignore adjustments remain necessary.
`a4a0530cd`	UPSTREAM: : openshift: Updating coredns builder & base images to be consistent with ART Reconciling with https://github.com/openshift/ocp-build-data/tree/ac81dd4ff0bd57c4e75058d25b40615b92948259/images/coredns.yml	still needed	ART builder/base sync unique to downstream.
`c6c6dabf7`	UPSTREAM: : openshift: Update owners	still needed	Updates OWNERS list; still relevant.
`b61f77bd5`	UPSTREAM: : openshift: Updating Dockerfile.openshift.rhel7 baseimages to mach ocp-build-data config	still needed	ART Dockerfile base sync unique to downstream.
`8ded69559`	UPSTREAM: : openshift: Updating Dockerfile.openshift.rhel7 baseimages to mach ocp-build-data config	still needed	ART Dockerfile base sync unique to downstream.
`dc34ad903`	UPSTREAM: : openshift: OWNERS: Add component	still needed	Adds OWNERS component metadata; used downstream.
`9a3831e3e`	UPSTREAM: : openshift: Add github.com/openshift/coredns-mdns plugin	obsoleted	coredns-mdns plugin carry superseded by later OpenShift plugin choices.
`0d68e78f3`	UPSTREAM: : openshift: Make coredns exclusion more specific	still needed	Downstream .gitignore adjustments remain necessary.
`2afc55a9d`	UPSTREAM: : openshift: Set Dockerfiles to use vendor	still needed	Ensures Dockerfiles rely on vendored deps for offline builds.
`17e5f477a`	UPSTREAM: : openshift: Add a `make test` target	still needed	Downstream make test target.
`3c8c3dc28`	UPSTREAM: : openshift: Optimize COPY directive	still needed	Optimizes downstream Docker COPY for product builds.
`88b0398af`	UPSTREAM: : openshift: Add a RHEL7 Dockerfile and standardize format	still needed	Adds downstream RHEL Dockerfile scaffolding.
`df9d2d5d5`	UPSTREAM: : openshift: Use multistage builds	still needed	Switches downstream images to multistage builds.
`ec74fe7f2`	UPSTREAM: : openshift: Update metadata	still needed	Updates downstream metadata.
`145d21f19`	UPSTREAM: : openshift: Add a product build pipeline Dockerfile	still needed	Adds product build pipeline file.
`e60e5dbd0`	UPSTREAM: : openshift: Changed the OWNERS to OpenShift ones	still needed	Maps OWNERS to OpenShift team.
`358bd8f4e`	UPSTREAM: : openshift: Vendor required modules	still needed	Maintains vendor tree snapshot.
`5e1e5be0e`	UPSTREAM: : openshift: Fix HostPortOrFile to support IPv6 addresses with zone (coredns#3527)	already upstream	HostPortOrFile IPv6 zone fix now in upstream v1.13.1.
`c2d922636`	UPSTREAM: : openshift: Add github.com/openshift/coredns-mdns plugin	obsoleted	coredns-mdns plugin no longer part of downstream tree.
`07acbeb99`	UPSTREAM: : openshift: Make coredns exclusion more specific	still needed	Downstream .gitignore adjustments remain necessary.
`973ad6860`	UPSTREAM: : openshift: Set Dockerfiles to use vendor	still needed	Ensures Dockerfiles consume vendored deps.
`a6e80500e`	UPSTREAM: : openshift: Add a `make test` target	still needed	Downstream make test target.
`73e0eb379`	UPSTREAM: : openshift: Optimize COPY directive	still needed	Optimizes downstream Docker COPY for product builds.
`40c11e7a7`	UPSTREAM: : openshift: Add a RHEL7 Dockerfile and standardize format	still needed	Adds downstream RHEL Dockerfile scaffolding.
`f77295fe6`	UPSTREAM: : openshift: Use multistage builds	still needed	Switches downstream images to multistage builds.
`394b61745`	UPSTREAM: : openshift: Update metadata	still needed	Updates downstream metadata.
`b65c0ca72`	UPSTREAM: : openshift: Add a product build pipeline Dockerfile	still needed	Adds product build pipeline Dockerfile for downstream releases.
`ce59f0f55`	UPSTREAM: : openshift: Changed the OWNERS to OpenShift ones	still needed	Maps OWNERS to OpenShift team.

coredns#7301) Bumps [actions/dependency-review-action](https://github.com/actions/dependency-review-action) from 4.7.0 to 4.7.1. - [Release notes](https://github.com/actions/dependency-review-action/releases) - [Commits](actions/dependency-review-action@38ecb5b...da24556) --- updated-dependencies: - dependency-name: actions/dependency-review-action dependency-version: 4.7.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…#7299) Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 5.4.2 to 5.4.3. - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@ad3126e...18283e0) --- updated-dependencies: - dependency-name: codecov/codecov-action dependency-version: 5.4.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…ns#7304) Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.72.0 to 1.72.1. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.72.0...v1.72.1) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.72.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Add environment variable setup step for Go version in the e2e tests job of the GitHub workflow. This ensures consistent Go version usage across all test jobs and fixes the warning about missing go-version input. Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>

Add comprehensive test coverage for the coremain package, focusing on configuration loading, version information, and output formatting. Test coverage improves from 0% to 59.7%. Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>

Add tests for previously untested functions: - edns0.go: test supportedOptions function - request.go: test address methods, protocol handling, and EDNS0 options - writer.go: test ScrubWriter implementation Improves overall package test coverage from 39.5% to 77.8%. Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>

Bumps the go-etcd-io group with 2 updates: [go.etcd.io/etcd/api/v3](https://github.com/etcd-io/etcd) and [go.etcd.io/etcd/client/v3](https://github.com/etcd-io/etcd). Updates `go.etcd.io/etcd/api/v3` from 3.5.21 to 3.6.0 - [Release notes](https://github.com/etcd-io/etcd/releases) - [Commits](etcd-io/etcd@v3.5.21...v3.6.0) Updates `go.etcd.io/etcd/client/v3` from 3.5.21 to 3.6.0 - [Release notes](https://github.com/etcd-io/etcd/releases) - [Commits](etcd-io/etcd@v3.5.21...v3.6.0) --- updated-dependencies: - dependency-name: go.etcd.io/etcd/api/v3 dependency-version: 3.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-etcd-io - dependency-name: go.etcd.io/etcd/client/v3 dependency-version: 3.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-etcd-io ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

This fixes a bug introduced in coredns#6547 which resulted in the zone being added to IPv4 addresses. This bug results in a failure to start when binding to an interface with a link-local IPv4 address assigned to it, with the following error: $ ./coredns -conf=/etc/coredns/Corefile maxprocs: Leaving GOMAXPROCS=4: CPU quota undefined lookup 169.254.1.1%dummy0: no such host Signed-off-by: Mark Mickan <mark.mickan@openlms.net> Co-authored-by: Mark Mickan <mark.mickan@openlms.net>

* feat: enable plugins via environment during build Signed-off-by: Colden Cullen <colden@coldencullen.com> * doc: add note about COREDNS_PLUGINS Signed-off-by: Colden Cullen <colden@coldencullen.com> --------- Signed-off-by: Colden Cullen <colden@coldencullen.com>

Signed-off-by: hansedong <skipiper1314@gmail.com> Co-authored-by: hansedong <skipiper1314@gmail.com>

The rewrite plugin modifies DNS messages, affecting the request size observed in the coredns_dns_request_size_bytes metric. This change captures the original request size before any plugins can modify it. It adds a functional options pattern to Report() to pass this information while maintaining API compatibility. Tests have been added to verify the fix prevents rewrite from affecting the request size metrics. Docs included. Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>

Add comprehensive tests for multiple components including server blocks inspection, configuration handling, DoH/DoQ writers, and server startup functions. Increases overall test coverage from 27% to 38.4% with particular focus on register.go, https.go, quic.go, and config.go. Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>

Add conditional test skipping for bind and readme tests that rely on Linux-specific loopback interface behavior. These tests reference network configurations that may not exist on for e.g. macOS or other platforms, causing spurious test failures. Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>

…ns#7326) Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.72.1 to 1.72.2. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.72.1...v1.72.2) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.72.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…oredns#7324) Bumps [github.com/quic-go/quic-go](https://github.com/quic-go/quic-go) from 0.51.0 to 0.52.0. - [Release notes](https://github.com/quic-go/quic-go/releases) - [Commits](quic-go/quic-go@v0.51.0...v0.52.0) --- updated-dependencies: - dependency-name: github.com/quic-go/quic-go dependency-version: 0.52.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Enable the usetesting linter in golangci.yml configuration to enforce proper testing practices. Replace manual temporary directory and file creation with t.TempDir() in test files. This improves test reliability by ensuring proper cleanup and follows Go testing best practices. Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>

…dns#7325) Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.233.0 to 0.234.0. - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](googleapis/google-api-go-client@v0.233.0...v0.234.0) --- updated-dependencies: - dependency-name: google.golang.org/api dependency-version: 0.234.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Enable copyloopvar linter and remove redundant variable shadowing in Kubernetes plugin metadata handling. This pattern is no longer needed in Go 1.22+ where loop variables are automatically captured correctly in closures. Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>

Add comprehensive unit test coverage for DNS-over-gRPC and DNS-over-QUIC server implementations: - server_grpc_test.go: Tests gRPC server creation, TLS config, lifecycle methods, Query handling, and response writer - server_quic_test.go: Tests QUIC server creation, custom limits, message validation, DOQ message parsing, and writer interface Tests focus on component-level validation with mocks, complementing existing integration tests without overlap. Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>

Add test suite covering thread-safe random number generator with tests for: - Constructor with various seed values (positive, zero, negative) - Deterministic behavior verification with same seeds - Permutation generation and validation - Concurrent access safety with multiple goroutines - Mixed operations under concurrent load Also clarify package documentation to explicitly state this is for load balancing and server selection, not cryptographic use. The math/rand usage is intentional for performance in non-security contexts like upstream server selection and DNS record shuffling. Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>

This PR updates golang version to 1.24.3, to carry the latest security fixes. Signed-off-by: Yong Tang <yong.tang.github@outlook.com>

Ensure Dial exits early or returns error when Transport has been stopped, instead of blocking on the dial or ret channels. This removes a potential goroutine leak where callers could pile up waiting forever under heavy load. Add select guards before send and receive, and propagate clear error values so callers can handle shutdown gracefully. Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>

Enable canonicalheader linter to enforce proper HTTP header casing. This ensures headers use Go's canonical format (e.g., "Content-Type" instead of "content-type") for consistency. Fixes header casing in DoH implementation. Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>

* feat(plugin/file): fallthrough implement and test fallthrough for the file plugin Signed-off-by: vdbe <vdbewout@gmail.com> * docs(plugin/file): fallthrough Signed-off-by: vdbe <vdbewout@gmail.com> * docs(plugin/file): regenerate man page `make -f Makefile.doc man/coredns-file.7` Signed-off-by: vdbe <vdbewout@gmail.com> --------- Signed-off-by: vdbe <vdbewout@gmail.com>

Enable intrange linter to enforce modern Go range syntax over traditional for loops, by converting: for i := 0; i < n; i++ to: for i := range n Adding type conversions where needed for compatibility with existing uint64 parameters. Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>

Pre-allocate slice capacity in AutoPath to eliminate unnecessary memory reallocations. This avoids slice growth when appending search domains and sentinel value. Benchmark shows significant performance improvement: - Before: 538.6 ns/op, 560 B/op, 13 allocs/op - After: 436.8 ns/op, 336 B/op, 11 allocs/op - Result: 19% faster, 40% less memory, 15% fewer allocations The optimization benefits Kubernetes clusters using autopath for server-side search path completion. Adds benchmark test to measure AutoPath performance. Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>

Missed in coredns#7323 Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>

This PR updates version to 1.12.2 for preparation of a release Signed-off-by: Yong Tang <yong.tang.github@outlook.com>

Enable protogetter in golangci config and update all protobuf field access to use getter methods instead of direct field access. Getter methods provide safer nil pointer handling and return appropriate default values, following protobuf best practices. Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>

Downstream policy (carried since 213249c/1b37b38eb) disables Dependabot in the OpenShift forks because ART curates dependencies centrally and the automated PRs get closed immediately. This commit removes `.github/dependabot.yml` and documents the policy in `carry_consolidation/dependabot_policy.md` so future rebases know why we do not re-enable it even though upstream keeps the workflow enabled. Co-authored-by: Ryan Fredette <rfredette@redhat.com> Co-authored-by: Grant Spence <gspence@redhat.com>

Carry the external `ocp_dnsnameresolver` plugin again after the rebase, folding in the previous carry commits (7a4db4b, 6b897ee, 8eab9cb) into one logical change: - register the plugin ahead of `cache` inside `plugin.cfg` and regenerate `core/plugin/zplugin.go` + `core/dnsserver/zdirectives.go` so directives stay ordered the way OpenShift expects. - pull in the released module version via `go.mod`/`go.sum`; this matches the rebased plugin tag that now builds against k8s v0.34.1. - document the reapply steps in `carry_consolidation/ocp_dnsnameresolver.md` (files to touch, commands to run, and validation steps) so reviewers do not need the deleted report to understand the carry. Co-authored-by: Arkadeep Sen <arsen@redhat.com> Co-authored-by: Ryan Fredette <rfredette@redhat.com> Co-authored-by: Grant Spence <gspence@redhat.com>

bentito · 2025-11-24T22:47:51Z

Latest rebase moved the ART sync (10e3a1c48) into UPSTREAM: <carry>: openshift: restore automation metadata so that commit now carries the .ci-operator.yaml/Dockerfile bump. The OWNERS commit no longer includes those files.

bentito · 2025-11-24T22:53:24Z

/retest

openshift-ci · 2025-11-25T01:54:49Z

@bentito: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

alebedev87 · 2025-11-25T08:23:32Z

Thank you!

/lgtm
/approve

openshift-ci-robot · 2025-11-25T08:25:57Z

@bentito: This pull request references NE-2194 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.21.0" version, but no target version was set.

Details

In response to this:

CoreDNS v1.13.1 Rebase Summary

Table of Contents

Overview

Carries Discussion

Rebase Report

Action Plan

Carry Audit

Overview

Merge helper commit

We keep a single git merge --no-ff --strategy=ours origin/main commit on top so GitHub remembers the branch is reconciled with origin/main even after the manual rebase.

The helper merge uses the ours strategy (same command noted above) which records the relationship without touching the resolved files.

Rebases origin/main onto upstream tag v1.13.1, collapsing downstream carries into a handful of commits.

Maintains Go 1.24.6 toolchain (ART builders), vendored tree, and downstream plugins while aligning with upstream code.

Carries Discussion

Dependabot policy for downstream fork

Upstream CoreDNS keeps .github/dependabot.yml. Downstream OpenShift policy disables Dependabot entirely.

During rebase, delete .github/dependabot.yml in the carry commit and avoid reintroducing it.

No replacement configuration is required; document the disablement in commit message for clarity.

Downstream make test target

Keep a single test target that the OpenShift ci-operator calls.

Target must depend on check to regenerate zplugin.go/zdirectives.go.

Use module-aware testing with vendored deps:
.PHONY: test
test: check
  GOFLAGS=-mod=vendor go test -count=1 ./...
Avoid per-package subshell loops; Go 1.24 handles parallelization itself.

Ensure CI jobs set GOFLAGS=-mod=vendor (either via environment or within the target as shown).

ocp_dnsnameresolver carry instructions

Downstream keeps the external ocp_dnsnameresolver plugin. Upstream v1.13.1 does not ship it, so we must reapply the carry after the merge.

Files to edit

plugin.cfg: add ocp_dnsnameresolver:github.com/openshift/coredns-ocp-dnsnameresolver before cache.

core/plugin/zplugin.go and core/dnsserver/zdirectives.go: regenerated outputs that pick up the plugin entry.

go.mod / go.sum: add the released module version for github.com/openshift/coredns-ocp-dnsnameresolver.

vendor/modules.txt and vendor/github.com/openshift/coredns-ocp-dnsnameresolver/**: repopulated via go mod vendor.

Drop the temporary replace directive once the plugin release is tagged (track in action plan).

Commands

Ensure the desired plugin version is set in go.mod (go get github.com/openshift/coredns-ocp-dnsnameresolver@<tag>).

Run go generate coredns.go to refresh zplugin.go / zdirectives.go. (Downstream make check does this as part of the pipeline.)

Run GOFLAGS=-mod=vendor go mod vendor to repopulate vendor/.

Stage plugin.cfg, the regenerated Go files, go.mod, go.sum, vendor/modules.txt, and the vendored plugin tree together.

Ordering requirement

ocp_dnsnameresolver must remain immediately before cache in plugin.cfg; the generator preserves this ordering in the generated files.

Validation

GOFLAGS=-mod=vendor go test ./plugin/... to ensure registrations compile.

Execute the targeted plugin smoke tests from the prototype branch once the module tag is published.

Downstream vendoring strategy

We continue to vendor dependencies so downstream builds do not rely on network access.

Regenerating vendor after the rebase

Ensure go.mod and go.sum reflect the desired dependency set (run go mod tidy if needed once conflicts are resolved).

Run GOFLAGS=-mod=vendor go mod vendor (or export GOFLAGS=-mod=vendor globally) to repopulate vendor/.

Re-apply the downstream ginkgo shim (vendor/github.com/onsi/ginkgo/v2/ginkgo/build/build_command.go) if it is dropped by go mod vendor.

Stage the entire vendor/ tree along with go.mod / go.sum updates in a single carry commit.

Build tooling expectations

Dockerfiles (Dockerfile.openshift, Dockerfile.openshift.rhel7, etc.) must keep GO111MODULE=on and GOFLAGS=-mod=vendor so container builds consume the vendored tree.

Any CI/Make targets that compile CoreDNS should set GOFLAGS=-mod=vendor (unless the buildroot already enforces it).

.gitignore adjustments

Keep vendor tracked by removing the upstream vendor/ ignore entry; see carry_consolidation/gitignore.patch.

Ignore build outputs only: query.log, Corefile, *.swp, /coredns, coredns.exe, /build/, release/.

Rebase Report

Rebase to v1.13.1 - Anticipated Challenges

Snapshot of Divergence

Local branch main (origin/main) descends from v1.11.3; merge-base with v1.13.1 is commit a7ed34658.

origin/main is 270 commits ahead of v1.11.3 and 501 commits behind v1.13.1; within that range we see 82 merge commits (mostly prior "rebase" merges) and 124 commit objects containing UPSTREAM markers, which collapse to ~52 unique carry commit messages once duplicates from earlier rebases are deduplicated.

Numerous cherry-picked upstream fixes (e.g., PRs Generate zplugin.go correctly with third-party plugins coredns/coredns#6692, Update build coredns/coredns#6836, test: fix cname with proxy test coredns/coredns#7083) already exist in the target release, implying they must be dropped or squashed during the rebase.

Carry Patches and OpenShift Packaging

Long-running OpenShift carry chain touches .ci-operator.yaml, Dockerfile.ocp, Dockerfile.openshift, Makefile overrides (test, dep-ensure), and repeated image metadata synchronizations with ART. These files do not exist upstream; they must be reintroduced cleanly after the rebase.

The external plugin ocp_dnsnameresolver is currently vendored along with large slices of github.com/openshift/{api,client-go,...}. Upstream v1.13.1 has no vendor/ tree, so we must decide between re-vendoring the entire OpenShift dependency set or switching to module-aware builds that can fetch these deps.

Several carry commits revert or modify upstream behavior (e.g., wildcard warning toggles, cache CD-bit handling, bufsize defaults). Each needs reassessment against upstream changes to avoid reintroducing bugs that have since been fixed differently.

Carry Consolidation Plan

OWNERS / automation metadata: Multiple <carry> commits only update OWNERS and related metadata (e.g., a82419240, c6cbe9feb). Plan: squash into a single "Restore OpenShift OWNERS metadata" commit after the rebase lands.

Dependabot disables: Commits 213249c83, 5378301ac, 433d377a9 all toggle Dependabot. Plan: merge into one downstream policy commit and drop the rest.

Vendoring helpers & .gitignore tweaks: Repetitive pairs (7d3b0d2fe, 6a6aca3cc, bc4b0e6f0, plus .gitignore adjustments like 35edb5009, 0df6a4cb8, cae06b4bc, a5843d819, 69fc73eac, 279951d92). Plan: consolidate into (a) one vendoring commit and (b) one .gitignore commit, rerunning go mod vendor as needed.

Make targets / CI glue: Commits acf1e3312, 78b2bdbb2, 6455c7589 duplicate the make test target. Plan: keep one canonical downstream build tooling commit and drop the rest.

ocp_dnsnameresolver carry chain: Duplicates (7a4db4ba4, 7a9d9ea62, 8eab9cb1d, 6b897ee50) will be rebased into a single logical commit that injects the plugin, sets ordering, and bumps the version in one place.

Toolchain and Dependency Shifts

Toolchain contract: Upstream’s .go-version and Makefile try to auto-download the newest toolchain. Downstream should keep setting GOTOOLCHAIN=local so we stay on our supported Go 1.24 toolchain.

Current availability: OpenShift builder images already ship Go 1.24.x (4.21/4.20 at 1.24.6, earlier releases at 1.23/1.24). No additional tooling work is required beyond enforcing GOTOOLCHAIN=local.

Hazard: If GOTOOLCHAIN is omitted, disconnected environments will see build failures when go tries to fetch a toolchain from the network. Always export GOTOOLCHAIN=local (or patch the Makefile accordingly) so builds rely on the pre-installed Go toolchain.

Action items: (1) Ensure CI jobs and docs call out GOTOOLCHAIN=local; (2) keep the prototype log updated with any Go 1.24-specific quirks; (3) revisit the override only if upstream tooling mandates a higher version in the future.

Plugin consumers of bumped deps: Our plugin chain (plugin.cfg) ships route53, azure, and clouddns, so the jump to aws-sdk-go-v2, azure/autorest bumps, and newer Google Cloud libs must be validated in OpenShift CI even if these plugins are not heavily used. Likewise the trace plugin now depends on github.com/DataDog/dd-trace-go/v2, so downstream tracing deployments (and our CI that imports the package) need exercises with the new APIs enabled.

Dependency churn: go.mod migrates from legacy dependencies (aws-sdk-go v1, DataDog v1, etc.) to new major versions (aws-sdk-go-v2, dd-trace-go/v2, OpenTelemetry packages, etc.), and bumps Kubernetes libs to v0.34.1. These introduce breaking API changes that our OpenShift carry code (including the external plugin) must accommodate.

Vendoring impact: Upstream keeps shipping without a committed vendor/ tree (same as v1.11.3). Our downstream fork still vendors modules for disconnected builds, so post-rebase we must decide whether to keep regenerating vendor/ via go mod vendor (and update the supporting scripts/Dockerfiles) or to invest in an alternative module-cache solution.

Core Runtime and Plugin Differences

plugin.cfg in v1.13.1 slots quic/multisocket ahead of cache, but our downstream config already omits them and keeps ocp_dnsnameresolver in that slot; after the rebase we just re-run go generate to bring back zplugin.go / zdirectives.go with the plugin intact and confirm no conflicts.

Core server code (core/dnsserver/*, coremain/run.go) picked up QUIC/HTTPS refactors and new tests, but we have no downstream carries in those files beyond the generated directive list. Merge risk is minimal; the follow-up is to rerun targeted runtime tests (e.g., DNS-over-HTTPS, cache regression checks) to ensure upstream behaviour changes don’t surprise our ocp plugin or deployment defaults.

The Kubernetes plugin evolved across several releases alongside controller-runtime API changes. Our OpenShift fixes for OCPBUGS-15755, -27397, -34619 were straight backports (UPSTREAM: 6354, UPSTREAM: 6277, UPSTREAM: 6692) and are already present in v1.13.1, so they can drop. Remaining rebase work is verifying that ocp_dnsnameresolver and any downstream-only logic still compile against the upgraded k8s.io/* clients.

Build, Release, and CI Implications

Upstream Dockerfile now targets distroless/static-debian12, adds --no-install-recommends, and resets WORKDIR, but our downstream images already pin to ART-managed base images; just double-check if we want to pick up the distroless tweaks for parity or leave the current OCP image as-is.

GitHub workflows, lint configs (.golangci.yml), and README build guidance now assume the newer toolchain and add security automation (OpenSSF scorecard, etc.). We can continue disabling Dependabot downstream; just be aware of the upstream workflow drift.

make check now relies on go generate followed by go get under modules, which pulls tooling at build-time. We can tolerate that in our existing build environments, but if we need a disconnected rehearsal later we should pre-stage a module cache or keep regenerating vendor/.

Risk Hotspots & Open Questions

Compatibility of github.com/openshift/coredns-ocp-dnsnameresolver with the upgraded Kubernetes client libraries and Go runtime is unknown; it may require upstream updates before the rebase can land.

Dropping the vendor tree while keeping offline build guarantees for OpenShift release tooling will require alternative dependency management (e.g., go mod vendor post-rebase or mirrored module proxies).

Carry commits that repeatedly toggle dependabot, OWNERS, or product build metadata should be consolidated to avoid perpetual rebase conflicts.

The large test suite additions (coremain/run_test.go, QUIC/HTTPS suites) should pass even though we don’t enable those transports, but they pull in HTTP/3/TLS tooling at test-time. Plan a rehearsal make test run in CI; if the new suites require missing system libs or capabilities, decide whether to add them to the test image or skip the specific tests with justification.

Suggested Next Steps for Preparation

Audit each UPSTREAM: carry commit to classify as "already upstream", "still needed", or "obsoleted" (in progress via audit_upstream_report.md).

Prototype building upstream v1.13.1 with the OpenShift plugin to gauge compile/API fallout, including a rehearsal make test run that covers the new QUIC/HTTPS suites.

Rebase github.com/openshift/coredns-ocp-dnsnameresolver (and any other external plugin repos) to the k8s.io/* versions used by v1.13.1 and publish updated tags for the rebase branch.

Plan to build with Go 1.24.x for now: set GOTOOLCHAIN=local, run compile/test rehearsals to confirm 1.24.x passes, and log any gaps so we can reassess toolchain needs if upstream bumps again.

Appendix: Upstream Change Map & Rebase Actions

Core server lifecycle & transport (core/dnsserver, coremain)

Representative upstream commits: efaed02c6 (limit concurrent DoQ streams), eafc352f5 (graceful shutdown via ShutdownContext), 6ec327836 (prevent SIGTERM reload deadlock), c90e70339 (export transport timeouts).
Downstream carries touched: 7a4db4ba4 / 7a9d9ea62 (ocp_dnsnameresolver plugin), 6b897ee50 (plugin chain ordering), 8eab9cb1d (plugin version bump).
Follow-up actions: 1) Re-run make gen after re-injecting ocp_dnsnameresolver so regenerated zplugin.go / zdirectives.go pick up new transport hooks. 2) Manually review QUIC/HTTPS server startup paths to ensure the downstream cache tweaks still behave with the new shutdown semantics. 3) Execute targeted DoQ/HTTPS e2e tests once the carry set lands.
Second review focus: DNS server maintainers to double-check transport changes alongside the ocp plugin integration.

Plugin registry & generator churn (plugin.cfg, directives_generate.go)

Representative upstream commits: 6c39f4bae (multisocket plugin), 83ce0baea (nomad plugin), 82323554a (enable plugin selection via environment), 0ed689e2d (third-party plugin generation fix).
Downstream carries touched: 7a4db4ba4 / 7a9d9ea62 (ocp_dnsnameresolver), 6b897ee50 (ordering), repeated .gitignore and vendor carries that keep generated files committed.
Follow-up actions: 1) Update plugin.cfg to include ocp_dnsnameresolver alongside new upstream plugins, preserving the pre-cache ordering. 2) Regenerate zplugin.go and zdirectives.go, confirm the carry commits continue to apply cleanly, and stage the artifacts for review. 3) Validate make test (carry acf1e3312) still drives go generate correctly in disconnected builds.
Second review focus: @openshift/network-edge reviewers to spot-check the generated artifacts and plugin chain.

Kubernetes plugin & API migrations (plugin/kubernetes, go.mod)

Representative upstream commits: 5c71bd0b8 (multicluster support), 17eb2eed3 (prepare for k8s API upgrade), ab74d3acf (startup timeout option), 7c76d534d (deletion timestamp handling).
Downstream carries touched: Historical OCP bugfix carries (e.g., 37a9afe69, 59f7d2f51) now superseded, indirect impacts to ocp_dnsnameresolver which vendors k8s.io/{api,client-go} via 7d3b0d2fe / 6a6aca3cc.
Follow-up actions: 1) Rebase github.com/openshift/coredns-ocp-dnsnameresolver onto the new k8s.io/* v0.34.1 / Go 1.24+ stack and cut a compatible release before wiring it back into the tree. 2) Compile ocp_dnsnameresolver against those libs and smoke test the watcher flows. 3) Drop or rewrite obsolete OCP bugfix carries that are now upstream to avoid conflicts. 4) Add a focused review checklist for multi-cluster mode to ensure downstream defaults remain unchanged.
Second review focus: Kubernetes SIG-Network contacts plus ocp plugin owners for behavioral regressions.

Toolchain & observability stack (go.mod, go.sum, .go-version)

Representative upstream commits: 41a0b70e7 (Go toolchain refresh), afdd41a26 / 3ccbd6ab6 (subsequent toolchain bumps), 2b273d48a (dd-trace-go v2 migration), 43fdf737d (automaxprocs), dd029c931 (caddy bump), cbc32d238 / 83a546e7b (aws-sdk-go-v2 rollouts).
Downstream carries touched: 7d3b0d2fe, 6a6aca3cc, bc4b0e6f0 (vendor tree), .gitignore carries (35edb5009, 0df6a4cb8, cae06b4bc, a5843d819, 69fc73eac, 279951d92).
Follow-up actions: 1) Decide on a vendoring strategy (redo go mod vendor post-rebase versus module proxy) and update Dockerfiles accordingly. 2) Keep enforcing GOTOOLCHAIN=local so downstream builds stick with Go 1.24. 3) Exercise the compiled route53, azure, clouddns, and trace plugins against AWS SDK v2 / new cloud clients / dd-trace-go v2 to confirm downstream configs still work.
Second review focus: Build/ART owners to vet the dependency story and ensure offline builds remain viable; plugin owners for cloud integrations and tracing to confirm runtime behaviour.

Build, CI, and packaging (Dockerfile*, workflows, Make targets)

Representative upstream commits: 517a262e9 (base image to distroless debian12), a5388133d (Dockerfile hygiene), 39abf5aeb (modernize Go lint config), 76ba39ffe (golangci-lint v2), 82323554a (env-controlled plugin generation).
Downstream carries touched: 90d7eed7b / f5d39cfca (ci-operator config), acf1e3312 / 78b2bdbb2 (make test target), 213249c83 / 433d377a9 (disable dependabot), a82419240 / c6cbe9feb (OWNERS metadata).
Follow-up actions: 1) Reconcile downstream Dockerfiles with the new distroless base while keeping ART requirements intact. 2) Keep the make test carry but align it with upstream make check changes so CI still triggers the right steps. 3) Reapply downstream automation metadata (OWNERS, dependabot disable) once the rebase branch stabilizes.
Second review focus: Release/CI owners to sign off on buildroot changes and automation toggles.

Action Plan

CoreDNS v1.13.1 Rebase Action Plan

Status legend: ✅ complete · 🔄 in progress · ⬜️ pending · 🚫 blocked

Milestone Summary

| Status | Task | Notes |
| | --- | --- |
| ✅ | Produce carry audit (audit_upstream_report.md) | Completed; classifies all UPSTREAM/<carry> commits |
| ✅ | Draft rebase analysis (rebase_v1.13.1_report.md) | Completed with appendix and consolidation plan |
| ✅ | Prototype build with rebased ocp_dnsnameresolver | Prototype branch prototype/v1.13.1-with-ocp; Linux tests passing |
| ✅ | Publish rebased coredns-ocp-dnsnameresolver module | Upstream merged; CoreDNS go.mod points to v0.0.0-20251118… |
| ✅ | Execute full rebase of origin/main onto upstream v1.13.1 | Merge commit staged; downstream adjustments applied |
| ✅ | Cut downstream release notes draft | See notes/coredns-1.13.1-openshift.md |
| ✅ | Final CI/regression sweep & hand-off | Waiting on prow rehearsals; schedule rebase review meeting |
| ✅ | Coordinate stakeholder review meeting | Prep Google Meet to walk through rebase status |

Detailed Checklist

1. Tooling & Environment Prep

✅ Confirm builds succeed with Go 1.24 using GOTOOLCHAIN=local.

✅ Ensure CI/builder configs set GOTOOLCHAIN=local (or equivalent) so the same toolchain is used everywhere.

2. Carry Commit Consolidation

Based on audit_upstream_report.md and the consolidation plan inside rebase_v1.13.1_report.md:

OWNERS/automation metadata (a82419240, c6cbe9feb, etc.) → consolidate into one commit. ✅

✅ Diffed upstream v1.13.1 (no OWNERS) vs downstream; confirmed entire file is OpenShift-only.

✅ Stored reapply patch in carry_consolidation/OWNERS.patch for post-rebase use.

Dependabot disables (213249c83, 5378301ac, 433d377a9) → single policy commit. ✅

✅ Canonical policy: remove .github/dependabot.yml and document disablement (see carry_consolidation/dependabot_policy.md).

Vendoring + .gitignore carries (7d3b0d2fe, 6a6aca3cc, bc4b0e6f0, 35edb5009, …) → one vendoring commit + one .gitignore commit. ✅

✅ Documented downstream vendor workflow & required shims in carry_consolidation/vendor_workflow.md.

✅ Captured .gitignore reapply patch (carry_consolidation/gitignore.patch) that keeps vendor/ tracked.

Makefile/CI glue (acf1e3312, 78b2bdbb2, 6455c7589) → keep one canonical downstream target. ✅

✅ Single downstream make test target retained; see carry_consolidation/makefile.patch (GOFLAGS=-mod=vendor go test -count=1 ./...).

✅ Verify ci-operator jobs still point at make test; update .ci-operator.yaml if prow feedback requires it.

ocp_dnsnameresolver chain (7a4db4ba4, 7a9d9ea62, 8eab9cb1d, 6b897ee50) → single reapply commit after rebase. ✅

✅ Documented reapply steps and required files in carry_consolidation/ocp_dnsnameresolver.md (plugin.cfg, regenerated files, go.mod/sum, vendor).

3. External Plugin & Dependencies

✅ Rebase github.com/openshift/coredns-ocp-dnsnameresolver to k8s v0.34.1 / OpenShift 4.22 dependencies (tests passing).

⬜️ Re-run CoreDNS build/test pipeline with released plugin.

4. CoreDNS Rebase Execution

✅ Fetch upstream v1.13.1 and start rebase/merge workflow on latest origin/main.

✅ Resolve conflicts, applying consolidation strategy (Section 2).

✅ Re-run go generate (coredns.go) after reinserting ocp_dnsnameresolver.

✅ Verify vendoring strategy (keeping go mod vendor; regenerated vendor tree with Go 1.24).

5. Build & Test Matrix

✅ Prototype build/tests (Go 1.24) succeed on Linux container via go build + go test ./....

✅️ Once rebase branch compiles, run full downstream test suite (make test, e2e suites triggered by CI, QUIC/HTTPS coverage).

⬜️ Run openshift-origin regression/CI rehearsals (prow jobs) with the rebased branch.

✅ Containerized Linux run covers plugin/dnstap.TestTransport; keep test execution on Linux hosts for rehearsal runs.

Artifacts & References

Rebase report: rebase_v1.13.1_report.md

Carry audit: audit_upstream_report.md

Prototype log: Prototype_Building_v1.13.1_with_OCP_plugin.md

Prototype branch: prototype/v1.13.1-with-ocp

Update this plan as each step completes to keep the rebase effort coordinated and auditable.

Carry Audit

UPSTREAM Carry Audit Against v1.13.1

Scope note: this audit only classifies downstream commits containing UPSTREAM markers or <carry> tags from origin/main. It does not list the upstream commits that ship with the v1.13.1 release itself.

Interpretation of classifications follows the OpenShift cherry-pick guidance: entries marked already upstream or obsoleted are intended to be dropped during the rebase, while still needed carries must be forward-ported.

Summary

Still Needed: 97 commits

Already Upstream: 10 commits

Obsoleted: 7 commits

Detailed Classification

Commit Message Classification Notes

35edb5009 UPSTREAM : Modify .gitignore to not exclude vendor build folders still needed Keeps vendor tree and downstream ginkgo shim visible; .gitignore adjustment still required while we vendor modules locally.

f26970141 UPSTREAM: 6836: Bump .go-version already upstream go toolchain bump landed in upstream >= v1.13.1, so this cherry-pick can drop.

c48716dfb UPSTREAM: 7083: Fix unit test TestZoneExternalCNAMELookupWithProxy already upstream Unit test fix from upstream PR coredns#7083 is present in v1.13.1.

7a4db4ba4 UPSTREAM: : openshift: Add ocp_dnsnameresolver external plugin still needed Adds downstream ocp_dnsnameresolver plugin which upstream does not ship.

a66edec93 UPSTREAM: 6692: openshift: Fix OCPBUGS-34619 already upstream Import-order fix from upstream PR coredns#6692 is included in v1.13.1.

213249c83 UPSTREAM: : openshift: Disable dependabot still needed Disables Dependabot for downstream repo per OpenShift policy.

7d3b0d2fe UPSTREAM: : openshift: Vendor required modules still needed Downstream keeps vendored dependencies for offline builds.

0df6a4cb8 UPSTREAM: : openshift: .gitignore: Properly ignore coredns binary still needed Ensures coredns binary and vendor tree tracked correctly under downstream .gitignore.

cae06b4bc UPSTREAM: : openshift: Make coredns exclusion more specific still needed Narrows .gitignore to avoid discarding downstream assets during builds.

acf1e3312 UPSTREAM: : openshift: Add a make test target still needed Adds downstream make test target relied on by OpenShift CI.

90d7eed7b UPSTREAM: : openshift: Add product build config still needed Seeds .ci-operator config required for OpenShift build automation.

a82419240 UPSTREAM: : openshift: Add OWNERS still needed Introduces downstream OWNERS metadata.

8eab9cb1d UPSTREAM: : openshift: Bump the version of ocp_dnsnameresolver external plugin still needed Carries ocp_dnsnameresolver plugin version bump unique to downstream.

c87f74bc4 UPSTREAM: 6692: openshift: Fix OCPBUGS-34619 already upstream Duplicate of PR coredns#6692 import-order fix already present upstream.

583929976 UPSTREAM: : Address CVE-2023-49295 and CVE-2024-22189 already upstream Newer upstream releases vendor quic-go >= v0.55 which supersedes this CVE bump.

6b897ee50 UPSTREAM: : openshift: Move ocp_dnsnameresolver before cache in plugin chaining order still needed Maintains ocp_dnsnameresolver position in plugin chain for OpenShift.

7a9d9ea62 UPSTREAM: : openshift: Add ocp_dnsnameresolver external plugin still needed Duplicate ocp_dnsnameresolver add; change must survive rebase.

37a9afe69 UPSTREAM: 6277: openshift: Fix OCPBUGS-27397 already upstream UDP truncation handling (coredns#6277) exists in v1.13.1 proxy code.

59f7d2f51 UPSTREAM: 6354: openshift: Fix OCPBUGS-15755 already upstream Cache CD-bit keying (coredns#6354) merged upstream; no longer a carry.

c0451cddd UPSTREAM: : openshift: Address CVE-2023-39325 already upstream golang.org/x/* CVE bumps now covered by upstream dependencies.

5378301ac UPSTREAM: : openshift: Disable dependabot still needed Downstream policy keeps Dependabot disabled.

6a6aca3cc UPSTREAM: : openshift: Vendor required modules still needed Maintains downstream vendor snapshot.

a5843d819 UPSTREAM: : openshift: .gitignore: Properly ignore coredns binary still needed Retains vendor visibility in .gitignore after rebase.

4c6110d88 UPSTREAM: : openshift: Make coredns exclusion more specific still needed Complements downstream .gitignore adjustments for binary path.

78b2bdbb2 UPSTREAM: : openshift: Add a make test target still needed Ensures make test target persists for downstream automation.

f5d39cfca UPSTREAM: : openshift: Add product build config still needed Downstream product build config required by OpenShift release tooling.

c6cbe9feb UPSTREAM: : openshift: Add OWNERS still needed Adds downstream OWNERS entries.

433d377a9 UPSTREAM: : openshift: Disable dependabot still needed Repeat Dependabot disable – still policy.

bc4b0e6f0 UPSTREAM: : openshift: Vendor required modules still needed Maintains vendored module tree after go mod vendor.

69fc73eac UPSTREAM: : openshift: .gitignore: Properly ignore coredns binary still needed Keeps vendor dir tracked by .gitignore changes.

279951d92 UPSTREAM: : openshift: Make coredns exclusion more specific still needed Refines .gitignore for downstream packaging artifacts.

6455c7589 UPSTREAM: : openshift: Add a make test target still needed Downstream make test target required.

99b2d5976 UPSTREAM: : openshift: Add product build config still needed Carry product build config for OpenShift CI.

53e672268 UPSTREAM: : openshift: Add OWNERS still needed OWNERS metadata for downstream branching.

47040eaf9 UPSTREAM: : openshift: Remove UDP Payload size hardcoding to 2048 on cache upstream refreshes. Don't override EDNS0 OPT RR, created by the bufsize plugin. Also, set default upstream UDP Payload to 512 if EDNS0 OPT RR doesn't exist. already upstream Upstream cache handler now handles UDP size per PR 403e979, so carry can drop.

b912bfdb7 UPSTREAM: : openshift: Revert "Revert "add wildcard warnings (coredns#5030)" (coredns#5167)" obsoleted Wildcard warning instrumentation was removed downstream and is absent in v1.13.1.

912fc2628 UPSTREAM: : openshift: Revert "remove wildcard query functionality (coredns#5019)" obsoleted Wildcard query support reverted here has since been dropped; no longer part of downstream tree.

1b37b38eb UPSTREAM: : openshift: Disable dependabot still needed Dependabot disable policy remains.

d922347b8 UPSTREAM: : openshift: Vendor required modules still needed Maintains vendor tree snapshot.

785e85831 UPSTREAM: : openshift: .gitignore: Properly ignore coredns binary still needed Downstream .gitignore adjustments for vendor/coredns binary.

d27bea2c2 UPSTREAM: : openshift: Make coredns exclusion more specific still needed Part of repeated .gitignore tightening ensuring plugin assets kept.

a61557c4a UPSTREAM: : openshift: Add a make test target still needed Retains make test helper target.

c288614cf UPSTREAM: : openshift: Add product build config still needed Downstream product build config required.

d2a14b4f5 UPSTREAM: : openshift: Add OWNERS still needed Adds OWNERS roles for downstream maintainers.

349db7a33 UPSTREAM: : openshift: Revert "Revert "add wildcard warnings (coredns#5030)" (coredns#5167)" obsoleted Early wildcard warning revert superseded; logic removed from current tree.

461cbbf60 UPSTREAM: : openshift: Revert "remove wildcard query functionality (coredns#5019)" obsoleted Wildcard query reinstatement later dropped; dead carry.

7a41d2b87 UPSTREAM: : openshift: Disable dependabot still needed Dependabot disable remains relevant.

1d2d4f767 UPSTREAM: : openshift: Vendor required modules still needed Downstream vendor snapshot.

3dc197d15 UPSTREAM: : openshift: .gitignore: Properly ignore coredns binary still needed Downstream .gitignore adjustments remain necessary.

9176cd5bf UPSTREAM: : openshift: Make coredns exclusion more specific still needed Same .gitignore carry; ensure no upstream conflict.

488cc73b1 UPSTREAM: : openshift: Add a make test target still needed Downstream make test target.

b648be195 UPSTREAM: : openshift: Add product build config still needed Downstream product build config.

1e6995352 UPSTREAM: : openshift: Add OWNERS still needed Downstream OWNERS data.

b1601880b UPSTREAM: : openshift: Update builder images still needed Updates downstream builder images to align with ART; still unique.

31190470a UPSTREAM: : openshift: Disable dependabot still needed Dependabot disable repeated; still applies.

80b7832fe UPSTREAM: : openshift: Vendor required modules still needed Vendor tree maintenance.

03c0039c9 UPSTREAM: : openshift: .gitignore: Properly ignore coredns binary still needed Downstream .gitignore adjustments remain necessary.

20cd7a701 UPSTREAM: : openshift: Make coredns exclusion more specific still needed Downstream .gitignore adjustments remain necessary.

491e0046c UPSTREAM: : openshift: Add a make test target still needed Downstream make test target.

6ab418926 UPSTREAM: : openshift: Add a product build pipeline Dockerfile still needed Adds OpenShift-specific product build Dockerfile.

98da35111 UPSTREAM: : openshift: Add OWNERS still needed Downstream OWNERS addition.

a80f04ac9 UPSTREAM: : openshift: Updating .ci-operator.yaml build_root_image from openshift/release still needed Syncs .ci-operator build root with OpenShift release tooling.

e54582f89 UPSTREAM: : openshift: Disable dependabot still needed Dependabot disable repeated.

1bce8b227 UPSTREAM: : openshift: Updating coredns images to be consistent with ART Reconciling with https://github.com/openshift/ocp-build-data/tree/691e628254f318ce56efda5edc7448ec743c37b8/images/coredns.yml still needed ART image sync commit; downstream only.

2750ba410 UPSTREAM: : openshift: Updating .ci-operator.yaml build_root_image from openshift/release still needed CI build root sync for downstream.

77b49b288 UPSTREAM: : openshift: Vendor required modules still needed Vendor snapshot maintenance.

02ea47f29 UPSTREAM: : openshift: Updating coredns images to be consistent with ART Reconciling with https://github.com/openshift/ocp-build-data/tree/0c10ae924af72f1c759cf8b24b50de94c02e6268/images/coredns.yml still needed ART image sync commit; downstream only.

d6753f9ec UPSTREAM: : openshift: .gitignore: Properly ignore coredns binary still needed Downstream .gitignore adjustments remain necessary.

c017c6ef7 UPSTREAM: : openshift: Update owners still needed Updates OWNERS set; still relevant.

48fadedfa UPSTREAM: : openshift: Updating Dockerfile.openshift.rhel7 baseimages to mach ocp-build-data config still needed Syncs Dockerfile.openshift bases with ART; unique to downstream.

532d55088 UPSTREAM: : openshift: OWNERS: Add component still needed Adds OWNERS component metadata used downstream.

a19338c74 UPSTREAM: : openshift: Add github.com/openshift/coredns-mdns plugin obsoleted coredns-mdns plugin removed from downstream; carry no longer applies.

987941801 UPSTREAM: : openshift: Make coredns exclusion more specific still needed Downstream .gitignore adjustments remain necessary.

8ef04d79a UPSTREAM: : openshift: Set Dockerfiles to use vendor still needed Keeps Dockerfiles consuming vendor tree for offline builds.

defc5c1e9 UPSTREAM: : openshift: Add a make test target still needed Downstream make test target.

78dc38111 UPSTREAM: : openshift: Optimize COPY directive still needed Optimizes downstream Docker COPY for product builds.

a8cac43c4 UPSTREAM: : openshift: Add a RHEL7 Dockerfile and standardize format still needed Adds downstream RHEL Dockerfile scaffolding still in use.

2c53ec989 UPSTREAM: : openshift: Use multistage builds still needed Enables multistage builds for downstream images.

225d3a35d UPSTREAM: : openshift: Update metadata still needed Updates downstream image metadata.

66fcb277a UPSTREAM: : openshift: Add a product build pipeline Dockerfile still needed Adds downstream product build pipeline file.

6961254ef UPSTREAM: : openshift: Changed the OWNERS to OpenShift ones still needed Set downstream OWNERS mapping to OpenShift team.

ee930681b UPSTREAM: : openshift: Vendor required modules still needed Maintains vendor tree snapshot.

e7d8e58f8 UPSTREAM: : openshift: Updating coredns builder & base images to be consistent with ART Reconciling with https://github.com/openshift/ocp-build-data/tree/5a1293dd0f380abf50c12d65c36655486d7745d0/images/coredns.yml still needed ART builder/base sync unique to downstream.

e27b1500e UPSTREAM: : openshift: Updating coredns builder & base images to be consistent with ART Reconciling with https://github.com/openshift/ocp-build-data/tree/b0ab44b419faae6b18e639e780a1fa50a1df8521/images/coredns.yml still needed ART builder/base sync unique to downstream.

960001974 UPSTREAM: : openshift: Add rfredette to OWNERS still needed Adds downstream OWNERS entry rfredette.

3f329badb UPSTREAM: : openshift: addowner-candita still needed Adds downstream OWNERS entry candita.

0e0c8923c UPSTREAM: : openshift: .gitignore: Properly ignore coredns binary still needed Downstream .gitignore adjustments remain necessary.

a4a0530cd UPSTREAM: : openshift: Updating coredns builder & base images to be consistent with ART Reconciling with https://github.com/openshift/ocp-build-data/tree/ac81dd4ff0bd57c4e75058d25b40615b92948259/images/coredns.yml still needed ART builder/base sync unique to downstream.

c6c6dabf7 UPSTREAM: : openshift: Update owners still needed Updates OWNERS list; still relevant.

b61f77bd5 UPSTREAM: : openshift: Updating Dockerfile.openshift.rhel7 baseimages to mach ocp-build-data config still needed ART Dockerfile base sync unique to downstream.

8ded69559 UPSTREAM: : openshift: Updating Dockerfile.openshift.rhel7 baseimages to mach ocp-build-data config still needed ART Dockerfile base sync unique to downstream.

dc34ad903 UPSTREAM: : openshift: OWNERS: Add component still needed Adds OWNERS component metadata; used downstream.

9a3831e3e UPSTREAM: : openshift: Add github.com/openshift/coredns-mdns plugin obsoleted coredns-mdns plugin carry superseded by later OpenShift plugin choices.

0d68e78f3 UPSTREAM: : openshift: Make coredns exclusion more specific still needed Downstream .gitignore adjustments remain necessary.

2afc55a9d UPSTREAM: : openshift: Set Dockerfiles to use vendor still needed Ensures Dockerfiles rely on vendored deps for offline builds.

17e5f477a UPSTREAM: : openshift: Add a make test target still needed Downstream make test target.

3c8c3dc28 UPSTREAM: : openshift: Optimize COPY directive still needed Optimizes downstream Docker COPY for product builds.

88b0398af UPSTREAM: : openshift: Add a RHEL7 Dockerfile and standardize format still needed Adds downstream RHEL Dockerfile scaffolding.

df9d2d5d5 UPSTREAM: : openshift: Use multistage builds still needed Switches downstream images to multistage builds.

ec74fe7f2 UPSTREAM: : openshift: Update metadata still needed Updates downstream metadata.

145d21f19 UPSTREAM: : openshift: Add a product build pipeline Dockerfile still needed Adds product build pipeline file.

e60e5dbd0 UPSTREAM: : openshift: Changed the OWNERS to OpenShift ones still needed Maps OWNERS to OpenShift team.

358bd8f4e UPSTREAM: : openshift: Vendor required modules still needed Maintains vendor tree snapshot.

5e1e5be0e UPSTREAM: : openshift: Fix HostPortOrFile to support IPv6 addresses with zone (coredns#3527) already upstream HostPortOrFile IPv6 zone fix now in upstream v1.13.1.

c2d922636 UPSTREAM: : openshift: Add github.com/openshift/coredns-mdns plugin obsoleted coredns-mdns plugin no longer part of downstream tree.

07acbeb99 UPSTREAM: : openshift: Make coredns exclusion more specific still needed Downstream .gitignore adjustments remain necessary.

973ad6860 UPSTREAM: : openshift: Set Dockerfiles to use vendor still needed Ensures Dockerfiles consume vendored deps.

a6e80500e UPSTREAM: : openshift: Add a make test target still needed Downstream make test target.

73e0eb379 UPSTREAM: : openshift: Optimize COPY directive still needed Optimizes downstream Docker COPY for product builds.

40c11e7a7 UPSTREAM: : openshift: Add a RHEL7 Dockerfile and standardize format still needed Adds downstream RHEL Dockerfile scaffolding.

f77295fe6 UPSTREAM: : openshift: Use multistage builds still needed Switches downstream images to multistage builds.

394b61745 UPSTREAM: : openshift: Update metadata still needed Updates downstream metadata.

b65c0ca72 UPSTREAM: : openshift: Add a product build pipeline Dockerfile still needed Adds product build pipeline Dockerfile for downstream releases.

ce59f0f55 UPSTREAM: : openshift: Changed the OWNERS to OpenShift ones still needed Maps OWNERS to OpenShift team.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

alebedev87 · 2025-11-25T08:26:28Z

/hold

Holding for @rfredette and @Miciah to have a final look.

openshift-ci · 2025-11-25T08:33:31Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: alebedev87

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [alebedev87]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

bentito · 2025-11-25T13:40:03Z

/jira-refresh

melvinjoseph86 · 2025-11-25T17:58:14Z

Ran the regression successfully on AWS normal cluster, GCP FIPS cluster and Openstack cluster except for the CoreDNS version test case which will need a automation change accordance with this PR. Hence marking as verified

/verified by @mjoseph

openshift-ci-robot · 2025-11-25T17:58:26Z

@melvinjoseph86: This PR has been marked as verified by @mjoseph.

Details

In response to this:

Ran the regression successfully on AWS normal cluster, GCP FIPS cluster and Openstack cluster except for the CoreDNS version test case which will need a automation change accordance with this PR. Hence marking as verified

/verified by @mjoseph

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

alebedev87 · 2025-11-26T15:44:49Z

/unhold

Unholding this PR as agreed with the team.

dependabot Bot and others added 30 commits May 19, 2025 07:43

test(coremain): Add unit tests (coredns#7308)

93ec38a

Add comprehensive test coverage for the coremain package, focusing on configuration loading, version information, and output formatting. Test coverage improves from 0% to 59.7%. Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>

fix: ensure DNS query name reset in plugin.NS error path (coredns#7142)

528cc26

Signed-off-by: hansedong <skipiper1314@gmail.com> Co-authored-by: hansedong <skipiper1314@gmail.com>

Update golang version to 1.24.3 (coredns#7329)

5857ad1

This PR updates golang version to 1.24.3, to carry the latest security fixes. Signed-off-by: Yong Tang <yong.tang.github@outlook.com>

fix: missing intrange lint fix (coredns#7333)

384fa32

Missed in coredns#7323 Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>

lint: enable nolintlint linter (coredns#7332)

a61d8b3

Update version to 1.12.2 (coredns#7334)

7ecb501

This PR updates version to 1.12.2 for preparation of a release Signed-off-by: Yong Tang <yong.tang.github@outlook.com>

bentito and others added 8 commits November 24, 2025 17:40

UPSTREAM: <carry>: openshift: document downstream OWNERS metadata

9908fdc

UPSTREAM: <drop>: openshift: pin Go toolchain to 1.24.6

1457b2e

UPSTREAM: <carry>: openshift: keep make test target for ci-operator

a38f2c9

UPSTREAM: <carry>: openshift: document vendor tree ignore rules

8f57c4f

UPSTREAM: <carry>: openshift: vendor deps + track vendor tree

0fa99d9

Merge remote-tracking branch 'origin/main' into rebase-to-v1.13.1

1a7984d

bentito force-pushed the rebase-to-v1.13.1 branch from 17c6465 to 1a7984d Compare November 24, 2025 22:45

alebedev87 changed the title ~~Rebase to v1.13.1 report & rebase work~~ NE-2194: Rebase to v1.13.1 report & rebase work Nov 25, 2025

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Nov 25, 2025

openshift-ci Bot added do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. lgtm Indicates that a PR is ready to be merged. labels Nov 25, 2025

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Nov 25, 2025

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Nov 25, 2025

openshift-ci Bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Nov 26, 2025

openshift-merge-bot Bot merged commit 7486e9e into openshift:main Nov 26, 2025
9 checks passed

This was referenced Dec 19, 2025

Rebase to CoreDNS v1.13.2 #160

Draft

WIP: Add /rebase slash command for version rebases #161

Draft

Conversation

bentito commented Oct 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CoreDNS v1.13.1 Rebase Summary

Table of Contents

Overview

Merge helper commit

Carries Discussion

Dependabot policy for downstream fork

Downstream make test target

ocp_dnsnameresolver carry instructions

Files to edit

Commands

Ordering requirement

Validation

Downstream vendoring strategy

Regenerating vendor after the rebase

Build tooling expectations

.gitignore adjustments

Rebase Report

Rebase to v1.13.1 - Anticipated Challenges

Snapshot of Divergence

Carry Patches and OpenShift Packaging

Carry Consolidation Plan

Toolchain and Dependency Shifts

Core Runtime and Plugin Differences

Build, Release, and CI Implications

Risk Hotspots & Open Questions

Suggested Next Steps for Preparation

Appendix: Upstream Change Map & Rebase Actions

Core server lifecycle & transport (core/dnsserver, coremain)

Plugin registry & generator churn (plugin.cfg, directives_generate.go)

Kubernetes plugin & API migrations (plugin/kubernetes, go.mod)

Toolchain & observability stack (go.mod, go.sum, .go-version)

Build, CI, and packaging (Dockerfile*, workflows, Make targets)

Action Plan

CoreDNS v1.13.1 Rebase Action Plan

Milestone Summary

Detailed Checklist

1. Tooling & Environment Prep

2. Carry Commit Consolidation

3. External Plugin & Dependencies

4. CoreDNS Rebase Execution

5. Build & Test Matrix

Artifacts & References

Carry Audit

UPSTREAM Carry Audit Against v1.13.1

Summary

Detailed Classification

Uh oh!

bentito commented Nov 24, 2025

Uh oh!

bentito commented Nov 24, 2025

Uh oh!

openshift-ci Bot commented Nov 25, 2025

Uh oh!

alebedev87 commented Nov 25, 2025

Uh oh!

openshift-ci-robot commented Nov 25, 2025 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CoreDNS v1.13.1 Rebase Summary

Table of Contents

Overview

Merge helper commit

Carries Discussion

Dependabot policy for downstream fork

Downstream make test target

ocp_dnsnameresolver carry instructions

Files to edit

Commands

Ordering requirement

Validation

Downstream vendoring strategy

Regenerating vendor after the rebase

Build tooling expectations

.gitignore adjustments

Rebase Report

Rebase to v1.13.1 - Anticipated Challenges

Snapshot of Divergence

Carry Patches and OpenShift Packaging

bentito commented Oct 20, 2025 •

edited

Loading

Downstream `make test` target

openshift-ci-robot commented Nov 25, 2025 •

edited by openshift-ci Bot

Loading

Downstream `make test` target