OCPBUGS-98258: Fix upstreams for CoreDNS pods on Cloud platforms

[sadasu]

On cloud platforms, the CoreDNS Corefile's Upstreams were getting generated using the host's /etc/resolv.conf that is modified by network manager to include the local host.

That resulted in the CoreDNS upstreams to include the IP of the node on which the CoreDNS static pod was running on. Fixed to use the NetworkManager's original upstream resolv.conf instead.

- What I did

- How to verify it

- Description for the changelog

Summary by CodeRabbit

• Bug Fixes
  • Updated DNS resolution to use NetworkManager’s active resolver configuration, improving name resolution in cloud platform environments.
  • Improved CoreDNS security by removing unnecessary privileged access from its monitoring process.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@sadasu: This pull request references Jira Issue OCPBUGS-98258, which is invalid:

• expected the bug to target the "5.0.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

On cloud platforms, the CoreDNS Corefile's Upstreams were getting generated using the host's /etc/resolv.conf that is modified by network manager to include the local host.

That resulted in the CoreDNS upstreams to include the IP of the node on which the CoreDNS static pod was running on. Fixed to use the NetworkManager's original upstream resolv.conf instead.

- What I did

- How to verify it

- Description for the changelog

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: fc51ecbd-8359-4a16-bde4-c6ef788ae90f

📥 Commits

Reviewing files that changed from the base of the PR and between 8f541d0 and da6a698.

📒 Files selected for processing (1)

• templates/common/cloud-platform-alt-dns/files/coredns.yaml

🚧 Files skipped from review as they are similar to previous changes (1)

• templates/common/cloud-platform-alt-dns/files/coredns.yaml

---

Walkthrough

Changes

CoreDNS resolver integration

Layer / File(s)	Summary
Resolver mount and monitor security templates/common/cloud-platform-alt-dns/files/coredns.yaml	CoreDNS now reads /var/run/NetworkManager/resolv.conf. The render init container mounts the host NetworkManager directory read-only. The coredns-monitor container no longer uses privileged mode.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: djoshy, ptalgulk01

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: fixing CoreDNS upstream generation for cloud platforms.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The pull request changes only one YAML template and adds no Ginkgo test declarations or test titles; the patch contains no It, Describe, Context, or When calls.
Test Structure And Quality	✅ Passed	The PR changes only one CoreDNS YAML file; the commit contains no Ginkgo or test code, so the test-structure check is not applicable.
Microshift Test Compatibility	✅ Passed	The parent diff changes only the CoreDNS YAML template; it adds no Ginkgo e2e tests, so MicroShift test compatibility is not applicable.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The commit changes only the CoreDNS YAML template; its diff adds no Ginkgo e2e tests or multi-node test assumptions.
Topology-Aware Scheduling Compatibility	✅ Passed	The commit only changes CoreDNS resolver mounts, the resolver path, and removes a privileged context; it adds no topology, affinity, replica, node selector, spread, or PDB constraint.
Ote Binary Stdout Contract	✅ Passed	The PR changes only a CoreDNS YAML template; no OTE Go entrypoint or stdout-writing code changed, and the template runs runtimecfg/corednsmonitor rather than openshift-tests.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The pull request changes only a CoreDNS YAML template. The diff adds no Ginkgo tests, IPv4 assumptions, or external connectivity requirements.
No-Weak-Crypto	✅ Passed	The patch only changes the resolver path, adds a read-only NetworkManager mount, and removes privilege; it adds no weak crypto or custom cryptographic code.
Container-Privileges	✅ Passed	The PR removes coredns-monitor's privileged: true. No flagged privilege field is added; hostNetwork: true was pre-existing and unchanged.
No-Sensitive-Data-In-Logs	✅ Passed	The direct PR diff changes only CoreDNS YAML mounts, resolver path, and privilege settings; it adds no logging and exposes no sensitive data in logs.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: sadasu
Once this PR has been reviewed and has the lgtm label, please assign cheesesashimi for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[sadasu]

/jira refresh

[openshift-ci-robot]

@sadasu: This pull request references Jira Issue OCPBUGS-98258, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

On cloud platforms, the CoreDNS Corefile's Upstreams were getting generated using the host's /etc/resolv.conf that is modified by network manager to include the local host.

That resulted in the CoreDNS upstreams to include the IP of the node on which the CoreDNS static pod was running on. Fixed to use the NetworkManager's original upstream resolv.conf instead.

- What I did

- How to verify it

- Description for the changelog

Summary by CodeRabbit

• Bug Fixes
• Updated DNS resolution to use NetworkManager’s active resolver configuration, improving name resolution in cloud platform environments.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@sadasu: This pull request references Jira Issue OCPBUGS-98258, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@templates/common/cloud-platform-alt-dns/files/coredns.yaml`:
- Line 50: Add the existing nm-resolv volume mount to the render-config-coredns
init container, matching the mount configuration already used by
coredns-monitor, so /var/run/NetworkManager/resolv.conf resolves to the host
file during runtimecfg render.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 161884e4-64cb-4bd4-bcfa-40ccb1a59feb

📥 Commits

Reviewing files that changed from the base of the PR and between d690173 and c8d3cd1.

📒 Files selected for processing (1)

• templates/common/cloud-platform-alt-dns/files/coredns.yaml

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@templates/common/cloud-platform-alt-dns/files/coredns.yaml`:
- Around line 62-64: Add readOnly: true to the nm-resolv volumeMount alongside
mountPath and mountPropagation, ensuring the NetworkManager resolver path is
mounted read-only while preserving the existing mount configuration.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 2d628202-4f14-480a-82dd-543c043d0343

📥 Commits

Reviewing files that changed from the base of the PR and between c8d3cd1 and 8f541d0.

📒 Files selected for processing (1)

• templates/common/cloud-platform-alt-dns/files/coredns.yaml

[openshift-ci]

@sadasu: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/unit	8f541d0	link	true	/test unit
ci/prow/perfscale-control-plane-6nodes	8f541d0	link	false	/test perfscale-control-plane-6nodes

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[sadasu]

/test

[sadasu]

/payload-job periodic-ci-openshift-release-main-nightly-5.0-e2e-azure-custom-dns-techpreview

[openshift-ci]

@sadasu: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

• periodic-ci-openshift-release-main-nightly-5.0-e2e-azure-custom-dns-techpreview

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/ec161ee0-95e8-11f1-9538-24b97d13d381-0

[sadasu]

/payload-job periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-custom-dns-techpreview

[openshift-ci]

@sadasu: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

• periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-custom-dns-techpreview

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/f598f730-95e8-11f1-9527-e9dd611d1ee2-0

[sadasu]

/pipeline required

[openshift-merge-bot]

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-ovn
/test e2e-aws-ovn-upgrade
/test e2e-gcp-op-ocl-part1
/test e2e-gcp-op-ocl-part2
/test e2e-gcp-op-part1
/test e2e-gcp-op-part2
/test e2e-gcp-op-single-node
/test e2e-hypershift
/test tls-pqc-readiness

[sadasu]

/payload-job periodic-ci-openshift-release-main-nightly-5.0-e2e-azure-custom-dns-techpreview

[openshift-ci]

@sadasu: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

• periodic-ci-openshift-release-main-nightly-5.0-e2e-azure-custom-dns-techpreview

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/cecdfdc0-965c-11f1-9165-a0de0c8b53b5-0

[sadasu]

/test unit