aws / aws/containers-roadmap

[EKS] [request]: core dns added on to support DNS rebinding prevention

Open
#1,926 0 comments 2 reactions 0 assignees View on GitHub
EKS EKS Networking Proposed
Dominant language
Shell
Stars
5.4k
Forks
334
PR merge metrics
No merged PRs in 30d

Description

**Tell us about your request**
CoreDNS added on to support DNS rebinding attack prevention. We would like to have a way to deny any unknown domain names being resolved to internal ip address such as ips belongs to the following cidr blocks: 10.0.0.0/8, 192.168.0.0/16...etc.

Currently, CoreDNS doesn't support that by default, however, an off-tree plugin has implemented this feature. Ideally we would like EKS to make this feature available with the official EKS coredns added on by implementing the similar feature or just integrate this plugin.

**Which service(s) is this request for?**
EKS -> CoreDNS Addon

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
We want to prevent DNS rebinding attack for our production eks cluster, however, we don't have much control on the CoreDNS addon. We would need EKS to provide this feature.

**Are you currently working around this issue?**
We have no way to do this if we are using the coredns addon provided by aws. or we have to disable it, and compile and deploy our own core dns binary with an out of tree core dns plugin named [stopdnsrebind](https://github.com/4390c336/stopdnsrebind/tree/main)

**Additional context**
More context on [DNS rebinding attack](https://en.wikipedia.org/wiki/DNS_rebinding)

**Attachments**
If you think you might have additional information that you'd like to include via an attachment, please do - we'll take a look. (Remember to remove any personally-identifiable information.)

Contributor guide

Open the contributing guide

Research direction

Start with the EKS CoreDNS Addon request and review the referenced stopdnsrebind plugin to understand the proposed DNS rebinding protection. Done means the official EKS CoreDNS addon can deny unknown domains that resolve to internal CIDR ranges, with the supported behavior documented.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, kubernetes
Domain
cloud, networking, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.