Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

You would want to add the changes in #101955 in this PR to add permissions for endpointslices

@rajansandeep I cherry-picked it to this PR.

the coredns migration library was just updated in this PR:
#102830

no worries, thanks for updating the PR description, I mostly wanted to avoid automatic issue closure in this case 😅
/hold cancel

/assign @fabriziopandini

/cc neolit123

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: BenTheElder, neolit123, pacoxu

The full list of commands accepted by this bot can be found here.

The pull request process is described here

/retitle kubeadm: update coredns to 1.8.4

/triage accepted

Updated

/hold cancel

/retest
This bot automatically retries jobs that failed/flaked on approved PRs (send feedback to fejta).

Review the full test history for this PR.

Silence the bot with an /lgtm cancel or /hold comment for consistent failures.

/retest

FYI: @neolit123

Last week a regression was reported for 1.8.4 for the rewrite plugin. There is a workaround. FYI AFAIK, AKS has decided to defer rolling out 1.8.4, skipping over the version, since a fix will be in 1.8.5 (already merged).
Describing the regression as succinctly as I can:

If using the rewrite plugin, a rewrite rule that does not also rewrite the response (using the answer option) will cause clients to reject any response rewritten by the rule (due to question section mismatch). A work around is to append answer auto to affected rules. All exact name rewrites are not affected since they automatically perform a response rewrite.

FWIW, this has always been the case for some clients (some clients are extra picky about question mismatch), but the regression caused it to affect most clients (if not all). My attempt to explain in more detail here.

Also, regarding the workaround, answer auto is only valid in 1.8.4, so a user cannot use that option to adjust their corefile before upgrading to avoid potential downtime. If that is desired, any affected rule should be expressed as a regex rule with a response rewrite, which would be valid in 1.84 and prior versions.

@chrisohaver Kubeadm default coredns corefile doesn’t include ‘rewrite’ plug-in.

However, it Will affect user using rewrite plugin.

@chrisohaver Kubeadm default coredns corefile doesn’t include ‘rewrite’ plug-in.

However, it Will affect user using rewrite plugin.

Yes. That's correct. Hard to know how many people use it, and how many people who use it are not already doing a response rewrite (as would be prudent).