Repository navigation
Conversation
This was referenced Oct 8, 2026
scotwells
added this pull request to stack #240
October 9, 2026 02:17
scotwells
marked this pull request as ready for review
October 12, 2026 16:56
ecv
approved these changes
Oct 12, 2026
scotwells
force-pushed
the
feat/private-dns-zone-isolation
branch
from
October 12, 2026 17:21
f30b2ad to
dbc0578
Compare
Keep the private-zone isolation change compatible with the current DNS agent and metrics configuration.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Keep private zones and their records out of public DNS discovery, replication, and serving.
User experience
Set
DNSZone.spec.visibilitytoPrivatewhen creating a private zone. Existing zones default toPublic. Visibility is immutable; changing it requires a new zone.This PR establishes the publication boundary. Private resolver access and query serving follow in the stack.
Related: datum-cloud/enhancements#921 and architecture #229.
Validation
Local Kubernetes tests cover visibility defaults, validation, and immutability. Controller tests cover all six public controllers, record ordering, and deletion. Builds, lint, and PowerDNS integration tests passed. The repository-wide race run also reproduced existing webhook fixture races on unchanged
main.