feat: Define private DNS access and publication APIs

.github/workflows/e2e.yml

@@ -5,8 +5,6 @@ on:
     branches:
       - main
   pull_request:
-    branches:
-      - main
 
 jobs:
   e2e:

.gitignore

@@ -50,3 +50,6 @@ go.work.sum
 .claude/settings.local.json
 .claude/worktrees/
 .mcp.json
+
+# Local kind output from the internal DNS end-to-end harness (includes kubeconfigs)
+.internal-dns-e2e/

api/v1alpha1/internaldns_access_test.go

@@ -0,0 +1,17 @@
+package v1alpha1
+
+import (
+	"encoding/json"
+	"testing"
+)
+
+func TestResolverAccessHasNoExpiryOrClusterIdentity(t *testing.T) {
+	a := DNSResolverAccessVersion{Epoch: 1, Sequence: 2}
+	b, err := json.Marshal(a)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(b) != `{"epoch":1,"sequence":2}` {
+		t.Fatalf("unexpected access fence: %s", b)
+	}
+}

api/v1alpha1/internaldns_context_boundary_envtest_test.go

@@ -0,0 +1,67 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+
+package v1alpha1
+
+import (
+	"context"
+	"testing"
+
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+)
+
+func validateResolverContextBoundaries(t *testing.T, cl client.Client) {
+	t.Helper()
+	for _, kind := range []string{"DNSZoneAssociation", "DNSNamingPolicy"} {
+		t.Run(kind+"-context-boundary", func(t *testing.T) {
+			newObject := func(name string) *unstructured.Unstructured {
+				return &unstructured.Unstructured{Object: map[string]any{
+					"apiVersion": GroupVersion.String(), "kind": kind,
+					"metadata": map[string]any{"name": name, "namespace": "validation"},
+					"spec": map[string]any{
+						"dnsZoneRef":      map[string]any{"name": "zone", "uid": "zone-uid"},
+						"additionalNames": []any{},
+					},
+				}}
+			}
+			ctx := context.Background()
+			for _, ref := range []map[string]any{nil, {"name": ""}, {"name": "", "uid": "context-uid"}} {
+				o := newObject("context-required")
+				if ref != nil {
+					if err := unstructured.SetNestedMap(o.Object, ref, "spec", "resolverContextRef"); err != nil {
+						t.Fatal(err)
+					}
+				}
+				if err := unstructured.SetNestedMap(o.Object, map[string]any{"name": "network", "uid": "network-uid"}, "spec", "vpcRef"); err != nil {
+					t.Fatal(err)
+				}
+				if err := cl.Create(ctx, o); !apierrors.IsInvalid(err) {
+					t.Fatalf("expected rejection without a named DNS context, got %v", err)
+				}
+			}
+			o := newObject("context-selected")
+			if err := unstructured.SetNestedMap(o.Object, map[string]any{"name": "context", "uid": "context-uid"}, "spec", "resolverContextRef"); err != nil {
+				t.Fatal(err)
+			}
+			if err := unstructured.SetNestedMap(o.Object, map[string]any{"name": "network", "uid": "network-uid"}, "spec", "vpcRef"); err != nil {
+				t.Fatal(err)
+			}
+			if err := cl.Create(ctx, o); err != nil {
+				t.Fatal(err)
+			}
+			if err := cl.Get(ctx, client.ObjectKeyFromObject(o), o); err != nil {
+				t.Fatal(err)
+			}
+			if _, found, err := unstructured.NestedMap(o.Object, "spec", "vpcRef"); err != nil || found {
+				t.Fatalf("network reference was retained in the DNS API: found=%t err=%v", found, err)
+			}
+			if err := unstructured.SetNestedMap(o.Object, map[string]any{"name": "", "uid": "context-uid"}, "spec", "resolverContextRef"); err != nil {
+				t.Fatal(err)
+			}
+			if err := cl.Update(ctx, o); !apierrors.IsInvalid(err) {
+				t.Fatalf("expected rejection when clearing the DNS context, got %v", err)
+			}
+		})
+	}
+}