[EKS] [request]: core dns added on to support DNS rebinding prevention
- Dominant language
- Shell
- Stars
- 5.4k
- Forks
- 334
- PR merge metrics
- No merged PRs in 30d
Description
**Tell us about your request**
CoreDNS added on to support DNS rebinding attack prevention. We would like to have a way to deny any unknown domain names being resolved to internal ip address such as ips belongs to the following cidr blocks: 10.0.0.0/8, 192.168.0.0/16...etc.
Currently, CoreDNS doesn't support that by default, however, an off-tree plugin has implemented this feature. Ideally we would like EKS to make this feature available with the official EKS coredns added on by implementing the similar feature or just integrate this plugin.
**Which service(s) is this request for?**
EKS -> CoreDNS Addon
**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
We want to prevent DNS rebinding attack for our production eks cluster, however, we don't have much control on the CoreDNS addon. We would need EKS to provide this feature.
**Are you currently working around this issue?**
We have no way to do this if we are using the coredns addon provided by aws. or we have to disable it, and compile and deploy our own core dns binary with an out of tree core dns plugin named [stopdnsrebind](https://github.com/4390c336/stopdnsrebind/tree/main)
**Additional context**
More context on [DNS rebinding attack](https://en.wikipedia.org/wiki/DNS_rebinding)
**Attachments**
If you think you might have additional information that you'd like to include via an attachment, please do - we'll take a look. (Remember to remove any personally-identifiable information.)
Contributor guide
Research direction
Start with the EKS CoreDNS Addon request and review the referenced stopdnsrebind plugin to understand the proposed DNS rebinding protection. Done means the official EKS CoreDNS addon can deny unknown domains that resolve to internal CIDR ranges, with the supported behavior documented.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, kubernetes
- Domain
- cloud, networking, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100