Repository navigation
feat(external): verify-only DNS provider for customer-managed zones - #16
Merged
Merged
Conversation
Make ZoneClass identityRef optional with Provider-version admission, preserve projected condition messages, gate cloud registrations and privileges, and support credentialless ZoneClass UI creation. Regenerate deepcopy and both CRD distributions; add deterministic admission, projection, chart and UI regressions. Contract: dns-api PR #15 / 99d0753 docs/design/external-provider.md (ZoneClass Parameters, Conditions and Public Data, Packaging), core-api.md, provider-extension.md, controllers-webhooks.md (Provider Enablement), ui.md (Zone Classes), and test-policy.md. Platform PR #5331 / cd995cf0ed design/platform/onprem/README.md sections 4.3, 4.4 step 4, 4.7, and Phase 4. Codegen: devbox run -- task generate manifests controller-chart:sync-crds completed. Tests, builds, linters and UI typecheck intentionally deferred to the primary integration agent.
Provider external.dns.appthrust.io/v1alpha1 (A/AAAA/CNAME, no identity), ZoneClass resolver policy and expectedNameservers, exact-set A/AAAA verification with bounded CNAME chains and wildcard witnesses, Cluster/Recursive views plus RD=0 authority checks, bounded scheduling (30-300s, jitter, backoff, 32 names/pass, 40 QPS/80 burst), UID/generation/policy-bound receipts, bookkeeping-only deletion, endpoint conversion handler, metrics. Design: docs/design/external-provider.md.
…8/external-integration # Conflicts: # docs/design/controllers-webhooks.md # docs/design/core-api.md # docs/design/ui.md
…ernal-integration # Conflicts: # docs/design/provider-extension.md # docs/design/test-policy.md
…ore admission accepts the manifest The core webhook requires a description on every property and array item; the external Provider was rejected on install. The built-in-manifest validation test now covers external_extensions.yaml.
…ess reuse (Draft)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements the verify-only
externalDNS provider designed in #15 (this branch includes those docs; #15 can be closed in favour of this PR or merged first — the merge is identical).What
ZoneClass.spec.identityRefis optional — required iff the selected Provider version declaresidentity, forbidden otherwise (admission, no network); core projection preserves provider conditionStatus/Reason/Message; provider enable flags (--route53-controller-enabled,--cloudflare-controller-enabled,--route53-endpoint-conversion-enabled,--external-controller-enabled+ env) gate controller registration, identity webhooks, conversion handlers and provider-only RBAC; Helm admission parity incl. ZoneClass status; UI ZoneClass form supports credentialless providers.internal/go/providers/external,pkg/go/api/external): Providerexternal.dns.appthrust.io/v1alpha1(A/AAAA/CNAME, no identity); ZoneClassresolver.{mode,servers}+expectedNameservers; exact-set A/AAAA verification, bounded CNAME chains, wildcard witnesses;Cluster/Recursiveviews plus RD=0 authority checks; bounded scheduler (30–300 s, ±10 % jitter, backoff, 32 names/pass, per-Zone amortized NS work, 40 QPS / 80 burst flags); UID/generation/policy-bound receipts; bookkeeping-only deletion (verified withdrawal is explicitly a laterWithdrawnextension); endpoint conversion handler (endpoint.external.dns.appthrust.io/v1alpha1endpointrecordsetconversions); four metrics with closed labels. QUERY-onlymiekg/dnstransport; no DNS writes anywhere.providers.external.*, Provider/capability/APIService templates (cert-manager CA injection; render fails withoutwebhook.enabled+certManager.enabled), conversion-create RBAC only when enabled, no Secret/identity permissions in external-only installs; opt-in Kustomize overlayapp/operator/config/external; README install example with the M+2 customer-record requirement.Not in this PR
Verified-withdrawal receipt before retired-target reuse (platform Phase 4b); kest scenario against an in-kind authoritative fixture (test-policy entry added, test file follows).
Verification
task test— all packages ok (unit tests use fake resolver/clock; loopback UDP/TCP DNS fixture; no public DNS)task controller-chart:check— lint/template/central-profile/package okgo vet ./...clean; UItsc --noEmit+bun testok;git diff --checkclean