Anyone could help to create a new release to address security finding https://nvd.nist.gov/vuln/detail/CVE-2025-13281?

[marvin659]

Anyone could help to create a new release to address security finding https://nvd.nist.gov/vuln/detail/CVE-2025-13281?

[Michcioperz]

A half-blind Server Side Request Forgery (SSRF) vulnerability exists in kube-controller-manager

That is a clear false positive, this repository only depends on k8s.io/kubernetes for the tiny iptables library included in there: https://github.com/kubernetes/dns/tree/master/vendor/k8s.io/kubernetes

[marvin659]

Yes it could be. But hard to explain to security auditor as the dependency lives there. The latest master branch has the fix already. The k8s dns hadn't been released for a couple of months. Could anyone go ahead to trigger a release?

@Michcioperz Do you have rights?

[Michcioperz]

I don't, @DamianSawicki?

[DamianSawicki]

I've just cut https://github.com/kubernetes/dns/releases/tag/1.26.8. We need to wait for the automation to pick it up as per https://github.com/kubernetes/dns?tab=readme-ov-file#release-process.

[danwinship]

The kubernetes/dns repo is going to be archived, and the node-local-dns code has been moved to a new repo, https://github.com/kubernetes-sigs/node-local-dns. Unfortunately, it doesn't seem to be possible to move an issue to a repo in another GitHub org.

If this issue is still a problem, please file a new issue at https://github.com/kubernetes-sigs/node-local-dns/issues/new/choose and include a link back to this one in the description.

[DamianSawicki]

The kubernetes/dns repo is going to be archived

It is a very interesting statement. @bowei @Michcioperz @dereknola Have you heard about this proposal?

[Michcioperz]

@DamianSawicki actually yes kubernetes/kubernetes#137556 NLD is being split off to https://github.com/kubernetes-sigs/node-local-dns

[DamianSawicki]

actually yes kubernetes/kubernetes#137556 NLD is being split off to https://github.com/kubernetes-sigs/node-local-dns

Thanks for the reference! It means that you don't need this repo beyond NLD? I'm curious if it's also true for other folks opening issues and contributing here.

[Michcioperz]

I cannot speak for the team I'm no longer on but https://groups.google.com/a/kubernetes.io/g/sig-network/c/RCogf4OeRk0/m/YXnrkDspBQAJ
This is just my hunch but looking at PRs in the period where I contributed, most people were bumping CoreDNS or distroless-iptables image, or offering new features for NLD.

[danwinship]

@DamianSawicki ah, sorry, this got discussed on the SIG Network mailing list (after being discussed in a SIG meeting) and I just assumed everybody relevant would have heard about it already.

But basically, nobody is really developing kube-dns any more (eg, #504, it doesn't support EndpointSlices, which have been GA for 5 years), and everyone switched to CoreDNS ages ago, except certain legacy GKE configs, but Google confirmed they're migrating away from it. So SIG Network decided to drop kube-dns as a subproject. And then we realized kube-dns and node-local-dns were mixed up in the same repo, but since SIG subprojects are supposed to be under kubernetes-sigs rather than kubernetes these days anyway, we decided it would make more sense to create a new repo for Node-Local DNS rather than continuing to develop it here.