search

kubernetes / dns

Kubernetes DNS service
Apache License 2.0
922 stars 462 forks source link

Vuln fixes for CVE-2023-5363 and CVE-2023-5528 #622

Closed irLinja closed 6 months ago

irLinja commented 8 months ago

This fixes the CVE-2023-5363 and CVE-2023-5528 mentioned in the issue #620

k8s-ci-robot commented 8 months ago

Welcome @irLinja!

It looks like this is your first PR to kubernetes/dns 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes/dns has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. :smiley:

k8s-ci-robot commented 8 months ago

Hi @irLinja. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
irLinja commented 7 months ago

/honk

k8s-ci-robot commented 7 months ago

@irLinja: goose image

In response to [this](https://github.com/kubernetes/dns/pull/622#issuecomment-1944455063): >/honk Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
irLinja commented 7 months ago

I'd appreciate your review. /cc kl52752 /cc mrhohn /cc bowei

zengyuxing007 commented 6 months ago

@irLinja Do you have any information on why this modification can fix the mentioned CVE vulnerability? Thank you.

irLinja commented 6 months ago

@zengyuxing007 I ran a vulnerability scanner on the new version and there are no known vulnerabilities as of now.

irLinja commented 6 months ago

Can I get an Okay to test label, at least?

kl52752 commented 6 months ago

/ok-to-test

zhangguanzhang commented 6 months ago

maybe update to 

registry.k8s.io/build-image/distroless-iptables:v0.5.2
irLinja commented 6 months ago

Done 👍🏼

irLinja commented 6 months ago

Can someone review this, please?

kl52752 commented 6 months ago

Can you link info why upgrading iptables will fix those Vuln issues? Latest version for iptables is v0.5.6 https://pkg.go.dev/github.com/docker/libnetwork/iptables

zhangguanzhang commented 6 months ago

Can you link info why upgrading iptables will fix those Vuln issues? Latest version for iptables is v0.5.6 https://pkg.go.dev/github.com/docker/libnetwork/iptables

# skopeo list-tags docker://registry.k8s.io/build-image/distroless-iptables
{
    "Repository": "registry.k8s.io/build-image/distroless-iptables",
    "Tags": [
        "v0.1.0",
        "v0.1.1",
        "v0.1.2",
        "v0.2.0",
        "v0.2.1",
        "v0.2.10",
        "v0.2.2",
        "v0.2.3",
        "v0.2.4",
        "v0.2.5",
        "v0.2.6",
        "v0.2.7",
        "v0.2.8",
        "v0.2.9",
        "v0.3.0",
        "v0.3.1",
        "v0.3.2",
        "v0.3.3",
        "v0.4.0",
        "v0.4.1",
        "v0.4.2",
        "v0.4.3",
        "v0.4.4",
        "v0.4.5",
        "v0.4.6",
        "v0.5.0",
        "v0.5.1",
        "v0.5.2"
    ]
}
zhangguanzhang commented 6 months ago

@kl52752 

[root@guan ~]# trivy image registry.k8s.io/build-image/distroless-iptables:v0.4.1
2024-03-27T19:11:26.860+0800    INFO    Vulnerability scanning is enabled
2024-03-27T19:11:26.860+0800    INFO    Secret scanning is enabled
2024-03-27T19:11:26.860+0800    INFO    If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-03-27T19:11:26.860+0800    INFO    Please see also https://aquasecurity.github.io/trivy/v0.49/docs/scanner/secret/#recommendation for faster secret detection
2024-03-27T19:11:28.494+0800    INFO    Detected OS: debian
2024-03-27T19:11:28.494+0800    INFO    Detecting Debian vulnerabilities...
2024-03-27T19:11:28.498+0800    INFO    Number of language-specific files: 0

registry.k8s.io/build-image/distroless-iptables:v0.4.1 (debian 12.2)

Total: 24 (UNKNOWN: 0, LOW: 16, MEDIUM: 5, HIGH: 3, CRITICAL: 0)

┌──────────────┬──────────────────┬──────────┬──────────────┬───────────────────┬──────────────────┬──────────────────────────────────────────────────────────────┐
│   Library    │  Vulnerability   │ Severity │    Status    │ Installed Version │  Fixed Version   │                            Title                             │
├──────────────┼──────────────────┼──────────┼──────────────┼───────────────────┼──────────────────┼──────────────────────────────────────────────────────────────┤
│ coreutils    │ CVE-2016-2781    │ LOW      │ will_not_fix │ 9.1-1             │                  │ coreutils: Non-privileged session can escape to the parent   │
│              │                  │          │              │                   │                  │ session in chroot                                            │
│              │                  │          │              │                   │                  │ https://avd.aquasec.com/nvd/cve-2016-2781                    │
│              ├──────────────────┤          ├──────────────┤                   ├──────────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2017-18018   │          │ affected     │                   │                  │ coreutils: race condition vulnerability in chown and chgrp   │
│              │                  │          │              │                   │                  │ https://avd.aquasec.com/nvd/cve-2017-18018                   │
├──────────────┼──────────────────┤          │              ├───────────────────┼──────────────────┼──────────────────────────────────────────────────────────────┤
│ iptables     │ CVE-2012-2663    │          │              │ 1.8.9-2           │                  │ iptables: --syn flag bypass                                  │
│              │                  │          │              │                   │                  │ https://avd.aquasec.com/nvd/cve-2012-2663                    │
├──────────────┼──────────────────┼──────────┼──────────────┼───────────────────┼──────────────────┼──────────────────────────────────────────────────────────────┤
│ libc6        │ CVE-2023-6246    │ HIGH     │ fixed        │ 2.36-9+deb12u3    │ 2.36-9+deb12u4   │ glibc: heap-based buffer overflow in __vsyslog_internal()    │
│              │                  │          │              │                   │                  │ https://avd.aquasec.com/nvd/cve-2023-6246                    │
│              ├──────────────────┤          │              │                   │                  ├──────────────────────────────────────────────────────────────┤
│              │ CVE-2023-6779    │          │              │                   │                  │ glibc: off-by-one heap-based buffer overflow in              │
│              │                  │          │              │                   │                  │ __vsyslog_internal()                                         │
│              │                  │          │              │                   │                  │ https://avd.aquasec.com/nvd/cve-2023-6779                    │
│              ├──────────────────┼──────────┤              │                   │                  ├──────────────────────────────────────────────────────────────┤
│              │ CVE-2023-6780    │ MEDIUM   │              │                   │                  │ glibc: integer overflow in __vsyslog_internal()              │
│              │                  │          │              │                   │                  │ https://avd.aquasec.com/nvd/cve-2023-6780                    │
│              ├──────────────────┼──────────┼──────────────┤                   ├──────────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2010-4756    │ LOW      │ affected     │                   │                  │ glibc: glob implementation can cause excessive CPU and       │
│              │                  │          │              │                   │                  │ memory consumption due to...                                 │
│              │                  │          │              │                   │                  │ https://avd.aquasec.com/nvd/cve-2010-4756                    │
│              ├──────────────────┤          │              │                   ├──────────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2018-20796   │          │              │                   │                  │ glibc: uncontrolled recursion in function                    │
│              │                  │          │              │                   │                  │ check_dst_limits_calc_pos_1 in posix/regexec.c               │
│              │                  │          │              │                   │                  │ https://avd.aquasec.com/nvd/cve-2018-20796                   │
│              ├──────────────────┤          │              │                   ├──────────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2019-1010022 │          │              │                   │                  │ glibc: stack guard protection bypass                         │
│              │                  │          │              │                   │                  │ https://avd.aquasec.com/nvd/cve-2019-1010022                 │
│              ├──────────────────┤          │              │                   ├──────────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2019-1010023 │          │              │                   │                  │ glibc: running ldd on malicious ELF leads to code execution  │
│              │                  │          │              │                   │                  │ because of...                                                │
│              │                  │          │              │                   │                  │ https://avd.aquasec.com/nvd/cve-2019-1010023                 │
│              ├──────────────────┤          │              │                   ├──────────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2019-1010024 │          │              │                   │                  │ glibc: ASLR bypass using cache of thread stack and heap      │
│              │                  │          │              │                   │                  │ https://avd.aquasec.com/nvd/cve-2019-1010024                 │
│              ├──────────────────┤          │              │                   ├──────────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2019-1010025 │          │              │                   │                  │ glibc: information disclosure of heap addresses of           │
│              │                  │          │              │                   │                  │ pthread_created thread                                       │
│              │                  │          │              │                   │                  │ https://avd.aquasec.com/nvd/cve-2019-1010025                 │
│              ├──────────────────┤          │              │                   ├──────────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2019-9192    │          │              │                   │                  │ glibc: uncontrolled recursion in function                    │
│              │                  │          │              │                   │                  │ check_dst_limits_calc_pos_1 in posix/regexec.c               │
│              │                  │          │              │                   │                  │ https://avd.aquasec.com/nvd/cve-2019-9192                    │
├──────────────┼──────────────────┤          │              ├───────────────────┼──────────────────┼──────────────────────────────────────────────────────────────┤
│ libip4tc2    │ CVE-2012-2663    │          │              │ 1.8.9-2           │                  │ iptables: --syn flag bypass                                  │
│              │                  │          │              │                   │                  │ https://avd.aquasec.com/nvd/cve-2012-2663                    │
├──────────────┤                  │          │              │                   ├──────────────────┤                                                              │
│ libip6tc2    │                  │          │              │                   │                  │                                                              │
│              │                  │          │              │                   │                  │                                                              │
├──────────────┼──────────────────┤          │              ├───────────────────┼──────────────────┼──────────────────────────────────────────────────────────────┤
│ libjansson4  │ CVE-2020-36325   │          │              │ 2.14-2            │                  │ jansson: out-of-bounds read in json_loads() due to a parsing │
│              │                  │          │              │                   │                  │ error                                                        │
│              │                  │          │              │                   │                  │ https://avd.aquasec.com/nvd/cve-2020-36325                   │
├──────────────┼──────────────────┼──────────┼──────────────┼───────────────────┼──────────────────┼──────────────────────────────────────────────────────────────┤
│ libssl3      │ CVE-2023-5363    │ HIGH     │ fixed        │ 3.0.11-1~deb12u1  │ 3.0.11-1~deb12u2 │ openssl: Incorrect cipher key and IV length processing       │
│              │                  │          │              │                   │                  │ https://avd.aquasec.com/nvd/cve-2023-5363                    │
│              ├──────────────────┼──────────┼──────────────┤                   ├──────────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2023-5678    │ MEDIUM   │ affected     │                   │                  │ openssl: Generating excessively long X9.42 DH keys or        │
│              │                  │          │              │                   │                  │ checking excessively long X9.42...                           │
│              │                  │          │              │                   │                  │ https://avd.aquasec.com/nvd/cve-2023-5678                    │
│              ├──────────────────┤          │              │                   ├──────────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2023-6129    │          │              │                   │                  │ openssl: POLY1305 MAC implementation corrupts vector         │
│              │                  │          │              │                   │                  │ registers on PowerPC                                         │
│              │                  │          │              │                   │                  │ https://avd.aquasec.com/nvd/cve-2023-6129                    │
│              ├──────────────────┤          │              │                   ├──────────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2023-6237    │          │              │                   │                  │ openssl: Excessive time spent checking invalid RSA public    │
│              │                  │          │              │                   │                  │ keys                                                         │
│              │                  │          │              │                   │                  │ https://avd.aquasec.com/nvd/cve-2023-6237                    │
│              ├──────────────────┤          │              │                   ├──────────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2024-0727    │          │              │                   │                  │ openssl: denial of service via null dereference              │
│              │                  │          │              │                   │                  │ https://avd.aquasec.com/nvd/cve-2024-0727                    │
│              ├──────────────────┼──────────┤              │                   ├──────────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2007-6755    │ LOW      │              │                   │                  │ Dual_EC_DRBG: weak pseudo random number generator            │
│              │                  │          │              │                   │                  │ https://avd.aquasec.com/nvd/cve-2007-6755                    │
│              ├──────────────────┤          │              │                   ├──────────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2010-0928    │          │              │                   │                  │ openssl: RSA authentication weakness                         │
│              │                  │          │              │                   │                  │ https://avd.aquasec.com/nvd/cve-2010-0928                    │
├──────────────┼──────────────────┤          │              ├───────────────────┼──────────────────┼──────────────────────────────────────────────────────────────┤
│ libxtables12 │ CVE-2012-2663    │          │              │ 1.8.9-2           │                  │ iptables: --syn flag bypass                                  │
│              │                  │          │              │                   │                  │ https://avd.aquasec.com/nvd/cve-2012-2663                    │
└──────────────┴──────────────────┴──────────┴──────────────┴───────────────────┴──────────────────┴──────────────────────────────────────────────────────────────┘
kl52752 commented 6 months ago

thanks, can you also run trivy image for iptables v0.5.2 image?

zhangguanzhang commented 6 months ago

thanks, can you also run trivy image for iptables v0.5.2 image?

HIGH: 0, CRITICAL: 0

[root@guan ~]# trivy image registry.k8s.io/build-image/distroless-iptables:v0.5.2
2024-03-27T19:58:42.924+0800    INFO    Vulnerability scanning is enabled
2024-03-27T19:58:42.924+0800    INFO    Secret scanning is enabled
2024-03-27T19:58:42.924+0800    INFO    If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-03-27T19:58:42.924+0800    INFO    Please see also https://aquasecurity.github.io/trivy/v0.49/docs/scanner/secret/#recommendation for faster secret detection
2024-03-27T19:58:44.150+0800    INFO    Detected OS: debian
2024-03-27T19:58:44.150+0800    INFO    Detecting Debian vulnerabilities...
2024-03-27T19:58:44.152+0800    INFO    Number of language-specific files: 0

registry.k8s.io/build-image/distroless-iptables:v0.5.2 (debian 12.5)

Total: 20 (UNKNOWN: 0, LOW: 16, MEDIUM: 4, HIGH: 0, CRITICAL: 0)

┌──────────────┬──────────────────┬──────────┬──────────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│   Library    │  Vulnerability   │ Severity │    Status    │ Installed Version │ Fixed Version │                            Title                             │
├──────────────┼──────────────────┼──────────┼──────────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ coreutils    │ CVE-2016-2781    │ LOW      │ will_not_fix │ 9.1-1             │               │ coreutils: Non-privileged session can escape to the parent   │
│              │                  │          │              │                   │               │ session in chroot                                            │
│              │                  │          │              │                   │               │ https://avd.aquasec.com/nvd/cve-2016-2781                    │
│              ├──────────────────┤          ├──────────────┤                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2017-18018   │          │ affected     │                   │               │ coreutils: race condition vulnerability in chown and chgrp   │
│              │                  │          │              │                   │               │ https://avd.aquasec.com/nvd/cve-2017-18018                   │
├──────────────┼──────────────────┤          │              ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ iptables     │ CVE-2012-2663    │          │              │ 1.8.9-2           │               │ iptables: --syn flag bypass                                  │
│              │                  │          │              │                   │               │ https://avd.aquasec.com/nvd/cve-2012-2663                    │
├──────────────┼──────────────────┤          │              ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ libc6        │ CVE-2010-4756    │          │              │ 2.36-9+deb12u4    │               │ glibc: glob implementation can cause excessive CPU and       │
│              │                  │          │              │                   │               │ memory consumption due to...                                 │
│              │                  │          │              │                   │               │ https://avd.aquasec.com/nvd/cve-2010-4756                    │
│              ├──────────────────┤          │              │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2018-20796   │          │              │                   │               │ glibc: uncontrolled recursion in function                    │
│              │                  │          │              │                   │               │ check_dst_limits_calc_pos_1 in posix/regexec.c               │
│              │                  │          │              │                   │               │ https://avd.aquasec.com/nvd/cve-2018-20796                   │
│              ├──────────────────┤          │              │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2019-1010022 │          │              │                   │               │ glibc: stack guard protection bypass                         │
│              │                  │          │              │                   │               │ https://avd.aquasec.com/nvd/cve-2019-1010022                 │
│              ├──────────────────┤          │              │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2019-1010023 │          │              │                   │               │ glibc: running ldd on malicious ELF leads to code execution  │
│              │                  │          │              │                   │               │ because of...                                                │
│              │                  │          │              │                   │               │ https://avd.aquasec.com/nvd/cve-2019-1010023                 │
│              ├──────────────────┤          │              │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2019-1010024 │          │              │                   │               │ glibc: ASLR bypass using cache of thread stack and heap      │
│              │                  │          │              │                   │               │ https://avd.aquasec.com/nvd/cve-2019-1010024                 │
│              ├──────────────────┤          │              │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2019-1010025 │          │              │                   │               │ glibc: information disclosure of heap addresses of           │
│              │                  │          │              │                   │               │ pthread_created thread                                       │
│              │                  │          │              │                   │               │ https://avd.aquasec.com/nvd/cve-2019-1010025                 │
│              ├──────────────────┤          │              │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2019-9192    │          │              │                   │               │ glibc: uncontrolled recursion in function                    │
│              │                  │          │              │                   │               │ check_dst_limits_calc_pos_1 in posix/regexec.c               │
│              │                  │          │              │                   │               │ https://avd.aquasec.com/nvd/cve-2019-9192                    │
├──────────────┼──────────────────┤          │              ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ libip4tc2    │ CVE-2012-2663    │          │              │ 1.8.9-2           │               │ iptables: --syn flag bypass                                  │
│              │                  │          │              │                   │               │ https://avd.aquasec.com/nvd/cve-2012-2663                    │
├──────────────┤                  │          │              │                   ├───────────────┤                                                              │
│ libip6tc2    │                  │          │              │                   │               │                                                              │
│              │                  │          │              │                   │               │                                                              │
├──────────────┼──────────────────┤          │              ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ libjansson4  │ CVE-2020-36325   │          │              │ 2.14-2            │               │ jansson: out-of-bounds read in json_loads() due to a parsing │
│              │                  │          │              │                   │               │ error                                                        │
│              │                  │          │              │                   │               │ https://avd.aquasec.com/nvd/cve-2020-36325                   │
├──────────────┼──────────────────┼──────────┤              ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ libssl3      │ CVE-2023-5678    │ MEDIUM   │              │ 3.0.11-1~deb12u2  │               │ openssl: Generating excessively long X9.42 DH keys or        │
│              │                  │          │              │                   │               │ checking excessively long X9.42...                           │
│              │                  │          │              │                   │               │ https://avd.aquasec.com/nvd/cve-2023-5678                    │
│              ├──────────────────┤          │              │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2023-6129    │          │              │                   │               │ openssl: POLY1305 MAC implementation corrupts vector         │
│              │                  │          │              │                   │               │ registers on PowerPC                                         │
│              │                  │          │              │                   │               │ https://avd.aquasec.com/nvd/cve-2023-6129                    │
│              ├──────────────────┤          │              │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2023-6237    │          │              │                   │               │ openssl: Excessive time spent checking invalid RSA public    │
│              │                  │          │              │                   │               │ keys                                                         │
│              │                  │          │              │                   │               │ https://avd.aquasec.com/nvd/cve-2023-6237                    │
│              ├──────────────────┤          │              │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2024-0727    │          │              │                   │               │ openssl: denial of service via null dereference              │
│              │                  │          │              │                   │               │ https://avd.aquasec.com/nvd/cve-2024-0727                    │
│              ├──────────────────┼──────────┤              │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2007-6755    │ LOW      │              │                   │               │ Dual_EC_DRBG: weak pseudo random number generator            │
│              │                  │          │              │                   │               │ https://avd.aquasec.com/nvd/cve-2007-6755                    │
│              ├──────────────────┤          │              │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2010-0928    │          │              │                   │               │ openssl: RSA authentication weakness                         │
│              │                  │          │              │                   │               │ https://avd.aquasec.com/nvd/cve-2010-0928                    │
├──────────────┼──────────────────┤          │              ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ libxtables12 │ CVE-2012-2663    │          │              │ 1.8.9-2           │               │ iptables: --syn flag bypass                                  │
│              │                  │          │              │                   │               │ https://avd.aquasec.com/nvd/cve-2012-2663                    │
└──────────────┴──────────────────┴──────────┴──────────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘
irLinja commented 6 months ago

@zhangguanzhang, thanks for providing the scan results.

kl52752 commented 6 months ago

/lgtm /approve

k8s-ci-robot commented 6 months ago

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: irLinja, kl52752

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files: - ~~[OWNERS](https://github.com/kubernetes/dns/blob/master/OWNERS)~~ [kl52752] Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment