Repository navigation
feat(route53): adoption-only private hosted zones via ZoneClass zoneType - #13
Merged
Merged
Conversation
ZoneClass parameters gain zoneType (Public default, Private). Private is adoption-only: creation policy is forced to Deny, deletion policy to Retain, and dns-api never creates, deletes, or VPC-associates private hosted zones. Adoption verifies the observed zone type matches the class; status.provider.data exposes the observed zoneType. Provider schema, chart, sample, docs, UI form and detail view, and an env-gated kest lifecycle follow the same contract.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
AppThrust hosts control-plane endpoint names in a private Route 53 zone. dns-api's Service endpoint source already produces the record; the Route 53 provider rejected private hosted zones (
ExternalResourceMismatch), which blocked replacing external-dns on hosting clusters with dns-api.Contract
ZoneClass.spec.parameters.zoneType:Public(default, unchanged behavior) |Private.Privateis adoption-only:zoneCreationPolicymust be absent/Deny,zoneDeletionPolicyabsent/Retain(elseAccepted=False/InvalidParameters); a Zone withoutspec.adoptiongetsDeniedByPolicy; dns-api never creates, deletes, or VPC-associates private zones.ExternalResourceMismatchwith a type-specific message.status.provider.datagainszoneType. Private zones have emptystatus.nameServers.Changes
Go API + Route 53 zoneunit/zoneclass controllers and tests; Provider schema (chart + operator manifest); sample
route53_private_zoneclass.yaml;docs/design/route53-provider.md, README; UI (form select, detail row, copy); kestroute53-private-zone-adoption-lifecycle.test.tsgated onROUTE53_PRIVATE_ZONE_VPC_ID.Verification
go test ./internal/go/providers/route53/... ./internal/go/core/webhook/...okgo vetok,gofmt -lcleanhelm lint deploy/charts/dns-api --set providers.route53.enabled=true0 failedbun x tsc --noEmit -p pkg/ts/ui/tsconfig.jsonand-p tsconfig.typecheck.jsonclean