Merge branch 'master' into update-release-docs

* master:
  update test certs used for pdns (kubernetes-sigs#5902)
  chore(controller-gen): move tools under go tools (kubernetes-sigs#5878)
  refactor(source/wrappers): move wrappers logic away from execute file (kubernetes-sigs#5888)
  chore(deps): bump the dev-dependencies group with 2 updates (kubernetes-sigs#5895)
  chore(deps): bump renovatebot/github-action (kubernetes-sigs#5890)

Author: ivankatliarchuk

.github/workflows/codeql-analysis.yaml

@@ -34,7 +34,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
+      uses: github/codeql-action/init@v4
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -46,4 +46,4 @@ jobs:
         make build
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
+      uses: github/codeql-action/analyze@v4

.github/workflows/dependency-update.yaml

@@ -17,7 +17,7 @@ jobs:
         uses: actions/[email protected]
       # https://github.com/renovatebot/github-action
       - name: self-hosted renovate
-        uses: renovatebot/[email protected].14
+        uses: renovatebot/[email protected].16
         with:
           # https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication
           token: ${{ secrets.GITHUB_TOKEN }}

Makefile

@@ -16,21 +16,23 @@
 .PHONY: cover cover-html
 .DEFAULT_GOAL := build
 
+CONTROLLER_GEN := go tool -modfile=go.tool.mod  controller-gen
+YQ := go tool -modfile=go.tool.mod yq
+YAMLFMT := go tool -modfile=go.tool.mod yamlfmt
+
 cover:
 	@go test -cover -coverprofile=cover.out -v ./...
 
 #? cover-html: Run tests with coverage and open coverage report in the browser
 cover-html: cover
 	@go tool cover -html=cover.out
 
-#? controller-gen: download controller-gen if necessary
-controller-gen-install:
-	@scripts/install-tools.sh --generator
-ifeq (, $(shell which controller-gen))
-CONTROLLER_GEN=$(GOBIN)/controller-gen
-else
-CONTROLLER_GEN=$(shell which controller-gen)
-endif
+#? go-tools: list installed go tools
+go-tools:
+	@echo ">> go tools installed in go.mod"
+	@go tool  -n
+	@echo ">> go tools installed in go.tool.mod"
+	@go tool -modfile=go.tool.mod
 
 #? golangci-lint-install: Install golangci-lint tool
 golangci-lint-install:
@@ -48,28 +50,32 @@ go-lint: golangci-lint-install
 licensecheck:
 	@echo ">> checking license header"
 	@licRes=$$(for file in $$(find . -type f -iname '*.go' ! -path './vendor/*') ; do \
-            awk 'NR<=5' $$file | grep -Eq "(Copyright|generated|GENERATED)" || echo $$file; \
-        done); \
-        if [ -n "$${licRes}" ]; then \
-            echo "license header checking failed:"; echo "$${licRes}"; \
-            exit 1; \
-        fi
+			awk 'NR<=5' $$file | grep -Eq "(Copyright|generated|GENERATED)" || echo $$file; \
+		done); \
+		if [ -n "$${licRes}" ]; then \
+			echo "license header checking failed:"; echo "$${licRes}"; \
+			exit 1; \
+		fi
 
 #? oas-lint: Execute OpenAPI Specification (OAS) linting https://quobix.com/vacuum/
 .PHONY: go-lint
 oas-lint:
-	go tool vacuum lint -d --fail-severity warn api/*.yaml
+	go tool -modfile=go.tool.mod vacuum lint -d --fail-severity warn api/*.yaml
 
 #? lint: Run all the linters
 .PHONY: lint
 lint: licensecheck go-lint oas-lint
 
 #? crd: Generates CRD using controller-gen and copy it into chart
 .PHONY: crd
-crd: controller-gen-install
-	${CONTROLLER_GEN} object crd:crdVersions=v1 paths="./endpoint/..."
-	${CONTROLLER_GEN} object crd:crdVersions=v1 paths="./apis/..." output:crd:stdout | yamlfmt - | yq eval '.' --no-doc --split-exp '"./config/crd/standard/" + .metadata.name + ".yaml"'
-	yq eval '.metadata.annotations |= with_entries(select(.key | test("kubernetes\.io")))' --no-doc --split-exp '"./charts/external-dns/crds/" + .metadata.name + ".yaml"' ./config/crd/standard/*.yaml
+crd:
+	$(CONTROLLER_GEN) object crd:crdVersions=v1 paths="./endpoint/..."
+	$(CONTROLLER_GEN) object crd:crdVersions=v1 paths="./apis/..." output:crd:stdout | \
+		$(YAMLFMT) - | \
+		$(YQ) eval '.' --no-doc --split-exp '"./config/crd/standard/" + .metadata.name + ".yaml"'
+	$(YQ) eval '.metadata.annotations |= with_entries(select(.key | test("kubernetes\.io")))' \
+		--no-doc --split-exp '"./charts/external-dns/crds/" + .metadata.name + ".yaml"' \
+		./config/crd/standard/*.yaml
 
 #? test: The verify target runs tasks similar to the CI tasks, but without code coverage
 .PHONY: test
@@ -109,11 +115,11 @@ build/$(BINARY): $(SOURCES)
 
 build.push/multiarch: ko
 	KO_DOCKER_REPO=${IMAGE} \
-    VERSION=${VERSION} \
-    ko build --tags ${VERSION} --bare --sbom ${IMG_SBOM} \
-      --image-label org.opencontainers.image.source="https://github.com/kubernetes-sigs/external-dns" \
-      --image-label org.opencontainers.image.revision=$(shell git rev-parse HEAD) \
-      --platform=${IMG_PLATFORM}  --push=${IMG_PUSH} .
+	VERSION=${VERSION} \
+	ko build --tags ${VERSION} --bare --sbom ${IMG_SBOM} \
+		--image-label org.opencontainers.image.source="https://github.com/kubernetes-sigs/external-dns" \
+		--image-label org.opencontainers.image.revision=$(shell git rev-parse HEAD) \
+		--platform=${IMG_PLATFORM}  --push=${IMG_PUSH} .
 
 build.image/multiarch:
 	$(MAKE) IMG_PUSH=false build.push/multiarch

controller/execute.go

@@ -446,24 +446,14 @@ func buildSource(ctx context.Context, cfg *externaldns.Config) (source.Source, e
 	if err != nil {
 		return nil, err
 	}
-	// Combine multiple sources into a single, deduplicated source.
-	combinedSource := wrappers.NewDedupSource(wrappers.NewMultiSource(sources, sourceCfg.DefaultTargets, sourceCfg.ForceDefaultTargets))
-	cfg.AddSourceWrapper("dedup")
-	if len(cfg.NAT64Networks) > 0 {
-		combinedSource, err = wrappers.NewNAT64Source(combinedSource, cfg.NAT64Networks)
-		if err != nil {
-			return nil, fmt.Errorf("failed to create NAT64 source wrapper: %w", err)
-		}
-		cfg.AddSourceWrapper("nat64")
-	}
-	// Filter targets
-	targetFilter := endpoint.NewTargetNetFilterWithExclusions(cfg.TargetNetFilter, cfg.ExcludeTargetNets)
-	if targetFilter.IsEnabled() {
-		combinedSource = wrappers.NewTargetFilterSource(combinedSource, targetFilter)
-		cfg.AddSourceWrapper("target-filter")
-	}
-	combinedSource = wrappers.NewPostProcessor(combinedSource, wrappers.WithTTL(cfg.MinTTL))
-	return combinedSource, nil
+	opts := wrappers.NewConfig(
+		wrappers.WithDefaultTargets(cfg.DefaultTargets),
+		wrappers.WithForceDefaultTargets(cfg.ForceDefaultTargets),
+		wrappers.WithNAT64Networks(cfg.NAT64Networks),
+		wrappers.WithTargetNetFilter(cfg.TargetNetFilter),
+		wrappers.WithExcludeTargetNets(cfg.ExcludeTargetNets),
+		wrappers.WithMinTTL(cfg.MinTTL))
+	return wrappers.WrapSources(sources, opts)
 }
 
 // RegexDomainFilter overrides DomainFilter

controller/execute_test.go

@@ -449,9 +449,6 @@ func TestBuildSourceWithWrappers(t *testing.T) {
 				Sources:         []string{"fake"},
 				TargetNetFilter: []string{"10.0.0.0/8"},
 			},
-			asserts: func(t *testing.T, cfg *externaldns.Config) {
-				assert.True(t, cfg.IsSourceWrapperInstrumented("target-filter"))
-			},
 		},
 		{
 			name: "configuration with nat64 networks",
@@ -460,29 +457,20 @@ func TestBuildSourceWithWrappers(t *testing.T) {
 				Sources:       []string{"fake"},
 				NAT64Networks: []string{"2001:db8::/96"},
 			},
-			asserts: func(t *testing.T, cfg *externaldns.Config) {
-				assert.True(t, cfg.IsSourceWrapperInstrumented("nat64"))
-			},
 		},
 		{
 			name: "default configuration",
 			cfg: &externaldns.Config{
 				APIServerURL: svr.URL,
 				Sources:      []string{"fake"},
 			},
-			asserts: func(t *testing.T, cfg *externaldns.Config) {
-				assert.True(t, cfg.IsSourceWrapperInstrumented("dedup"))
-				assert.False(t, cfg.IsSourceWrapperInstrumented("nat64"))
-				assert.False(t, cfg.IsSourceWrapperInstrumented("target-filter"))
-			},
 		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			_, err := buildSource(t.Context(), tt.cfg)
 			require.NoError(t, err)
-			tt.asserts(t, tt.cfg)
 		})
 	}
 }

endpoint/endpoint.go

@@ -223,6 +223,8 @@ type EndpointKey struct {
 	RecordTTL     TTL
 }
 
+type ObjectRef = events.ObjectReference
+
 // Endpoint is a high-level way of a connection between a service and an IP
 // +kubebuilder:object:generate=true
 type Endpoint struct {
@@ -244,7 +246,7 @@ type Endpoint struct {
 	ProviderSpecific ProviderSpecific `json:"providerSpecific,omitempty"`
 	// refObject stores reference object
 	// +optional
-	refObject *events.ObjectReference
+	refObject *ObjectRef `json:"-"`
 }
 
 // NewEndpoint initialization method to be used to create an endpoint

endpoint/zz_generated.deepcopy.go

@@ -0,0 +1,140 @@
+module sigs.k8s.io/external-dns/tools
+
+go 1.25
+
+tool (
+	github.com/google/yamlfmt/cmd/yamlfmt
+	github.com/mikefarah/yq/v4
+	sigs.k8s.io/controller-tools/cmd/controller-gen
+)
+
+require (
+	github.com/a8m/envsubst v1.4.3 // indirect
+	github.com/alecthomas/chroma/v2 v2.20.0 // indirect
+	github.com/alecthomas/participle/v2 v2.1.4 // indirect
+	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
+	github.com/aymerick/douceur v0.2.0 // indirect
+	github.com/bahlo/generic-list-go v0.2.0 // indirect
+	github.com/bmatcuk/doublestar/v4 v4.7.1 // indirect
+	github.com/buger/jsonparser v1.1.1 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/charmbracelet/bubbles/v2 v2.0.0-beta.1 // indirect
+	github.com/charmbracelet/bubbletea/v2 v2.0.0-beta.4 // indirect
+	github.com/charmbracelet/colorprofile v0.3.2 // indirect
+	github.com/charmbracelet/glamour v0.10.0 // indirect
+	github.com/charmbracelet/harmonica v0.2.0 // indirect
+	github.com/charmbracelet/lipgloss v1.1.1-0.20250404203927-76690c660834 // indirect
+	github.com/charmbracelet/lipgloss/v2 v2.0.0-beta.3 // indirect
+	github.com/charmbracelet/x/ansi v0.10.1 // indirect
+	github.com/charmbracelet/x/cellbuf v0.0.14-0.20250505150409-97991a1f17d1 // indirect
+	github.com/charmbracelet/x/exp/slice v0.0.0-20250327172914-2fdc97757edf // indirect
+	github.com/charmbracelet/x/input v0.3.7 // indirect
+	github.com/charmbracelet/x/term v0.2.1 // indirect
+	github.com/charmbracelet/x/windows v0.2.1 // indirect
+	github.com/dimchansky/utfbom v1.1.1 // indirect
+	github.com/dlclark/regexp2 v1.11.5 // indirect
+	github.com/dop251/goja v0.0.0-20250630131328-58d95d85e994 // indirect
+	github.com/dop251/goja_nodejs v0.0.0-20250409162600-f7acab6894b0 // indirect
+	github.com/dustin/go-humanize v1.0.1 // indirect
+	github.com/elliotchance/orderedmap v1.8.0 // indirect
+	github.com/fatih/color v1.18.0 // indirect
+	github.com/fsnotify/fsnotify v1.9.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
+	github.com/go-ini/ini v1.67.0 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-openapi/jsonpointer v0.21.0 // indirect
+	github.com/go-openapi/jsonreference v0.20.2 // indirect
+	github.com/go-openapi/swag v0.23.0 // indirect
+	github.com/go-sourcemap/sourcemap v2.1.4+incompatible // indirect
+	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
+	github.com/gobuffalo/flect v1.0.3 // indirect
+	github.com/goccy/go-json v0.10.5 // indirect
+	github.com/goccy/go-yaml v1.18.0 // indirect
+	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/google/gnostic-models v0.7.0 // indirect
+	github.com/google/go-cmp v0.7.0 // indirect
+	github.com/google/pprof v0.0.0-20250501235452-c0086092b71a // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/google/yamlfmt v0.17.2 // indirect
+	github.com/gorilla/css v1.0.1 // indirect
+	github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
+	github.com/iancoleman/strcase v0.3.0 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/jinzhu/copier v0.4.0 // indirect
+	github.com/josharian/intern v1.0.0 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
+	github.com/magiconair/properties v1.8.10 // indirect
+	github.com/mailru/easyjson v0.7.7 // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-runewidth v0.0.16 // indirect
+	github.com/microcosm-cc/bluemonday v1.0.27 // indirect
+	github.com/mikefarah/yq/v4 v4.47.2 // indirect
+	github.com/mitchellh/mapstructure v1.5.0 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
+	github.com/muesli/cancelreader v0.2.2 // indirect
+	github.com/muesli/reflow v0.3.0 // indirect
+	github.com/muesli/termenv v0.16.0 // indirect
+	github.com/pb33f/doctor v0.0.39 // indirect
+	github.com/pb33f/jsonpath v0.1.2 // indirect
+	github.com/pb33f/libopenapi v0.28.0 // indirect
+	github.com/pb33f/libopenapi-validator v0.6.3 // indirect
+	github.com/pb33f/ordered-map/v2 v2.3.0 // indirect
+	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
+	github.com/petermattis/goid v0.0.0-20250508124226-395b08cebbdb // indirect
+	github.com/pkg/errors v0.9.1 // indirect
+	github.com/rivo/uniseg v0.4.7 // indirect
+	github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06 // indirect
+	github.com/sagikazarmark/locafero v0.11.0 // indirect
+	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 // indirect
+	github.com/sasha-s/go-deadlock v0.3.5 // indirect
+	github.com/segmentio/ksuid v1.0.4 // indirect
+	github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 // indirect
+	github.com/sourcegraph/jsonrpc2 v0.2.0 // indirect
+	github.com/spf13/afero v1.15.0 // indirect
+	github.com/spf13/cast v1.10.0 // indirect
+	github.com/spf13/cobra v1.10.1 // indirect
+	github.com/spf13/pflag v1.0.10 // indirect
+	github.com/spf13/viper v1.21.0 // indirect
+	github.com/subosito/gotenv v1.6.0 // indirect
+	github.com/tliron/commonlog v0.2.19 // indirect
+	github.com/tliron/glsp v0.2.2 // indirect
+	github.com/tliron/kutil v0.3.26 // indirect
+	github.com/x448/float16 v0.8.4 // indirect
+	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
+	github.com/yuin/goldmark v1.7.8 // indirect
+	github.com/yuin/goldmark-emoji v1.0.5 // indirect
+	github.com/yuin/gopher-lua v1.1.1 // indirect
+	go.yaml.in/yaml/v2 v2.4.2 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	go.yaml.in/yaml/v4 v4.0.0-rc.2 // indirect
+	golang.org/x/crypto v0.42.0 // indirect
+	golang.org/x/exp v0.0.0-20250911091902-df9299821621 // indirect
+	golang.org/x/mod v0.28.0 // indirect
+	golang.org/x/net v0.44.0 // indirect
+	golang.org/x/sync v0.17.0 // indirect
+	golang.org/x/sys v0.36.0 // indirect
+	golang.org/x/term v0.35.0 // indirect
+	golang.org/x/text v0.29.0 // indirect
+	golang.org/x/tools v0.37.0 // indirect
+	google.golang.org/protobuf v1.36.7 // indirect
+	gopkg.in/inf.v0 v0.9.1 // indirect
+	gopkg.in/op/go-logging.v1 v1.0.0-20160211212156-b2cb9fa56473 // indirect
+	gopkg.in/yaml.v2 v2.4.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+	k8s.io/api v0.34.0 // indirect
+	k8s.io/apiextensions-apiserver v0.34.0 // indirect
+	k8s.io/apimachinery v0.34.0 // indirect
+	k8s.io/code-generator v0.34.0 // indirect
+	k8s.io/gengo/v2 v2.0.0-20250604051438-85fd79dbfd9f // indirect
+	k8s.io/klog/v2 v2.130.1 // indirect
+	k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b // indirect
+	k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 // indirect
+	sigs.k8s.io/controller-tools v0.17.2 // indirect
+	sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
+	sigs.k8s.io/randfill v1.0.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
+	sigs.k8s.io/yaml v1.6.0 // indirect
+)