Allow non-canonical IPv6 addresses in DNSRecord validation.
#12667
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Previously, the validation of `DNSRecord` resources checked the validity of IP addresses using a helper function from kubernetes. However, this function disallows non-canonical IPv6 addresses, e.g. 2001:db8:0:0:0:0:0:1. Unfortunately, there are some infrastructures, e.g. GCP, which use non-canonical IPv6 addresses for resources like load balancers. It also seems reasonable to allow them in `DNSRecord` resources. This change adapts the validation accordingly so that non-canonical IPv6 addresses are allowed.
|
/lgtm |
|
LGTM label has been added. Git tree hash: 07c2cd00c42347e99213be9b5e285ce01eb7cc28
|
plkokanov
reviewed
Aug 5, 2025
There was a problem hiding this comment.
Thanks for taking care of this out and adding the unit test so it's not regressed in the future.
Potentially, I think you could also use
diff --git a/pkg/apis/extensions/validation/dnsrecord.go b/pkg/apis/extensions/validation/dnsrecord.go
index d6a0ba09d3..83aff88b26 100644
--- a/pkg/apis/extensions/validation/dnsrecord.go
+++ b/pkg/apis/extensions/validation/dnsrecord.go
@@ -113,7 +113,7 @@ func validateValue(recordType extensionsv1alpha1.DNSRecordType, value string, fl
switch recordType {
case extensionsv1alpha1.DNSRecordTypeA, extensionsv1alpha1.DNSRecordTypeAAAA:
- allErrs = append(allErrs, isValidIP(fldPath, value)...)
+ allErrs = append(allErrs, validation.IsValidIPForLegacyField(fldPath, value, false, nil)...)
case extensionsv1alpha1.DNSRecordTypeCNAME:
allErrs = append(allErrs, validation.IsFullyQualifiedDomainName(fldPath, value)...)
}
Yes, |
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: plkokanov The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Duciwuci
pushed a commit
to stackitcloud/gardener
that referenced
this pull request
Sep 1, 2025
…er#12667) Previously, the validation of `DNSRecord` resources checked the validity of IP addresses using a helper function from kubernetes. However, this function disallows non-canonical IPv6 addresses, e.g. 2001:db8:0:0:0:0:0:1. Unfortunately, there are some infrastructures, e.g. GCP, which use non-canonical IPv6 addresses for resources like load balancers. It also seems reasonable to allow them in `DNSRecord` resources. This change adapts the validation accordingly so that non-canonical IPv6 addresses are allowed.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
How to categorize this PR?
/area networking
/area robustness
/area control-plane
/kind enhancement
What this PR does / why we need it:
Allow non-canonical IPv6 addresses in
DNSRecordvalidation.Previously, the validation of
DNSRecordresources checked the validity of IP addresses using a helper function from kubernetes. However, this function disallows non-canonical IPv6 addresses, e.g. 2001:db8:0:0:0:0:0:1. Unfortunately, there are some infrastructures, e.g. GCP, which use non-canonical IPv6 addresses for resources like load balancers. It also seems reasonable to allow them inDNSRecordresources.This change adapts the validation accordingly so that non-canonical IPv6 addresses are allowed.
Which issue(s) this PR fixes:
Fixes #
Special notes for your reviewer:
Release note:
/cc @MartinWeindel