node-local-dns: cache polluted by EDNS0 client subnet #650
Description
coredns support EDNS0 client subnet (ECS) to forward dns requests with "real" client ip. But its cache module does not support it: coredns/coredns#1628
In a same node, pod A resolves domain with ECS (for test or cache pollution attack or other reasons) and other pods send DNS requests without ECS (normal scenario). The cache of node-local-dns will be polluted by pod A.
As a node-level "local" dns caching service, EDNS0 client subnet should be disabled, before coredns implements per-CIDR cache or supports caching for ECS.