Kubernetes DNS

This is the repository for Kubernetes DNS.

Images

• kube-dns
• sidecar
• dnsmasq
• node-cache

Building

make targets:

• Setting VERBOSE=1 will show additional build logging.
• Setting VERSION will override the container version tag.

Vulnerability patching

Vulnerability patches are mainly for debian-base or debian-iptables images. They can be updated to the latest by modifying rules.mk and dnsmasq Makefile. Example PR.

Once the PR has merged, a new release tag should be cut. The rest of the release process is described below.

Release process

Follow these steps to make changes and release a new binary.

1. Make the necessary code changes and create a PR.
2. Build and test locally (make images-clean; make build; make containers; make test).
3. To build just the node-cache container, use make containers CONTAINER_BINARIES=node-cache.
4. The same steps are executed via the presubmit script presubmits.sh which is run by the test-infra prow job.
5. Merge the PR.
6. Cut a new release tag. We use semantic versioning to name releases. Example:

   git tag -a 1.21.4 -m "Build images using golang 1.17."
   git push upstream 1.21.4
   

7. Wait for container images to be pushed via cloudbuild yaml. This will be done automatically by k8s.io/test-infra/.../k8s-staging-dns.yaml. A manual cloud build can be submitted via gcloud builds submit --config cloudbuild.yaml, but this requires owner permissions in k8s-staging-dns project. The automated job pushes images for all architectures and makes them available in gcr.io/k8s-staging-dns. Status for build jobs can be checked at - https://k8s-testgrid.appspot.com/sig-network-dns#dns-push-images
8. Promote the images to gcr.io/k8s-artifacts-prod using the process described in this link. The image SHAs should be added to images/k8s-staging-dns/images.yaml. The SHAs can be obtained by running the command python parse-image-sha.py <TAG> This will return the SHAs for kube-dns as well as node-cache images. Node-cache images are always promoted, kube-dns images are promoted if there is a change to kubedns/vulnerability fix.
9. Images will be available in the repo k8s.gcr.io/dns/. The node-cache image with tag 1.15.14 can be found at k8s.gcr.io/dns/k8s-dns-node-cache:1.15.14. Older versions are at k8s.gcr.io/k8s-dns-node-cache:<TAG>
10. Submit a PR for the kubernetes/kubernetes repository to switch to the new version of the containers. Example - https://github.com/kubernetes/kubernetes/pull/106189