Configure private DNS using resource names and registration labels

api/v1alpha1/internaldns_naming_validation_envtest_test.go

@@ -0,0 +1,78 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+
+package v1alpha1
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+)
+
+func validateNamingAPISchemas(t *testing.T, cl client.Client) {
+	t.Helper()
+	ctx := context.Background()
+	for _, tc := range []struct {
+		name     string
+		selector *DNSRegistrationSelector
+		allowed  bool
+	}{
+		{"omitted-selector", nil, true},
+		{"empty-selector", &DNSRegistrationSelector{}, true},
+		{"in-selector", &DNSRegistrationSelector{MatchExpressions: []DNSRegistrationSelectorRequirement{{Key: "app", Operator: metav1.LabelSelectorOpIn, Values: []string{"web"}}}}, true},
+		{"exists-selector", &DNSRegistrationSelector{MatchExpressions: []DNSRegistrationSelectorRequirement{{Key: "app", Operator: metav1.LabelSelectorOpExists}}}, true},
+		{"invalid-operator", &DNSRegistrationSelector{MatchExpressions: []DNSRegistrationSelectorRequirement{{Key: "app", Operator: "Unsupported"}}}, false},
+		{"missing-values", &DNSRegistrationSelector{MatchExpressions: []DNSRegistrationSelectorRequirement{{Key: "app", Operator: metav1.LabelSelectorOpIn}}}, false},
+		{"unexpected-values", &DNSRegistrationSelector{MatchExpressions: []DNSRegistrationSelectorRequirement{{Key: "app", Operator: metav1.LabelSelectorOpExists, Values: []string{"web"}}}}, false},
+		{"invalid-value", &DNSRegistrationSelector{MatchExpressions: []DNSRegistrationSelectorRequirement{{Key: "app", Operator: metav1.LabelSelectorOpIn, Values: []string{"invalid value"}}}}, false},
+		{"long-value", &DNSRegistrationSelector{MatchExpressions: []DNSRegistrationSelectorRequirement{{Key: "app", Operator: metav1.LabelSelectorOpIn, Values: []string{strings.Repeat("x", 64)}}}}, false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			p := &DNSNamingPolicy{ObjectMeta: metav1.ObjectMeta{Name: tc.name, Namespace: "validation"}, Spec: DNSNamingPolicySpec{ResolverContextRef: DNSNameReference{Name: "context"}, AdditionalNames: []DNSAdditionalNameRule{{DNSZoneRef: DNSNameReference{Name: "zone"}, Selector: tc.selector, NamePrefix: "hosts"}}}}
+			err := cl.Create(ctx, p)
+			if tc.allowed {
+				if err != nil {
+					t.Fatal(err)
+				}
+			} else if !apierrors.IsInvalid(err) {
+				t.Fatalf("expected API validation rejection, got %v", err)
+			}
+		})
+	}
+	t.Run("selector-expression-limit", func(t *testing.T) {
+		p := &DNSNamingPolicy{ObjectMeta: metav1.ObjectMeta{Name: "expression-limit", Namespace: "validation"}, Spec: DNSNamingPolicySpec{ResolverContextRef: DNSNameReference{Name: "context"}, AdditionalNames: []DNSAdditionalNameRule{{DNSZoneRef: DNSNameReference{Name: "zone"}, NamePrefix: "hosts", Selector: &DNSRegistrationSelector{}}}}}
+		for range 64 {
+			p.Spec.AdditionalNames[0].Selector.MatchExpressions = append(p.Spec.AdditionalNames[0].Selector.MatchExpressions, DNSRegistrationSelectorRequirement{Key: "app", Operator: metav1.LabelSelectorOpExists})
+		}
+		if err := cl.Create(ctx, p); err != nil {
+			t.Fatal(err)
+		}
+		p.Spec.AdditionalNames[0].Selector.MatchExpressions = append(p.Spec.AdditionalNames[0].Selector.MatchExpressions, DNSRegistrationSelectorRequirement{Key: "app", Operator: metav1.LabelSelectorOpExists})
+		if err := cl.Update(ctx, p); !apierrors.IsInvalid(err) {
+			t.Fatalf("expected expression limit rejection, got %v", err)
+		}
+	})
+	for _, tc := range []struct {
+		name    string
+		context DNSNameReference
+		allowed bool
+	}{
+		{"one-context", DNSNameReference{Name: "context"}, true},
+		{"no-consumer", DNSNameReference{}, false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			a := &DNSZoneAssociation{ObjectMeta: metav1.ObjectMeta{Name: tc.name, Namespace: "validation"}, Spec: DNSZoneAssociationSpec{DNSZoneRef: DNSNameReference{Name: "zone"}, ResolverContextRef: tc.context}}
+			err := cl.Create(ctx, a)
+			if tc.allowed {
+				if err != nil {
+					t.Fatal(err)
+				}
+			} else if !apierrors.IsInvalid(err) {
+				t.Fatalf("expected API validation rejection, got %v", err)
+			}
+		})
+	}
+}

api/v1alpha1/internaldns_project_types.go

@@ -19,21 +19,26 @@ type DNSObjectReference struct {
 	Generation int64 `json:"generation,omitempty"`
 }
 
-// +kubebuilder:validation:XValidation:rule="!has(self.resolverContextRef) || ((self.resolverContextRef.name.size() == 0 && !has(self.resolverContextRef.uid) && (!has(self.resolverContextRef.generation) || self.resolverContextRef.generation == 0)) || (self.resolverContextRef.name.size() > 0 && has(self.resolverContextRef.uid) && self.resolverContextRef.uid.size() > 0))",message="a nonempty resolverContextRef must pin name and UID"
-// +kubebuilder:validation:XValidation:rule="has(self.dnsZoneRef.uid) && self.dnsZoneRef.uid.size() > 0",message="dnsZoneRef must pin the zone UID"
-// +kubebuilder:validation:XValidation:rule="self.resolverContextRef.name.size() > 0 && has(self.resolverContextRef.uid) && self.resolverContextRef.uid.size() > 0",message="resolverContextRef is required"
-// +kubebuilder:validation:XValidation:rule="self.dnsZoneRef.name == oldSelf.dnsZoneRef.name && self.dnsZoneRef.uid == oldSelf.dnsZoneRef.uid",message="dnsZoneRef identity is immutable"
-// +kubebuilder:validation:XValidation:rule="self.resolverContextRef.name == oldSelf.resolverContextRef.name && self.resolverContextRef.uid == oldSelf.resolverContextRef.uid",message="resolverContextRef identity is immutable"
+// DNSNameReference selects a resource in the same project namespace.
+// DNS records its resolved lifetime in controller-owned status.
+type DNSNameReference struct {
+	// +kubebuilder:validation:MaxLength=253
+	Name string `json:"name"`
+}
+
+// +kubebuilder:validation:XValidation:rule="self.dnsZoneRef.name.size() > 0",message="dnsZoneRef requires a name"
+// +kubebuilder:validation:XValidation:rule="self.resolverContextRef.name.size() > 0",message="resolverContextRef is required"
+// +kubebuilder:validation:XValidation:rule="self.dnsZoneRef.name == oldSelf.dnsZoneRef.name",message="dnsZoneRef is immutable"
+// +kubebuilder:validation:XValidation:rule="self.resolverContextRef.name == oldSelf.resolverContextRef.name",message="resolverContextRef is immutable"
 type DNSZoneAssociationSpec struct {
-	DNSZoneRef         DNSObjectReference `json:"dnsZoneRef"`
-	ResolverContextRef DNSObjectReference `json:"resolverContextRef"`
+	DNSZoneRef         DNSNameReference `json:"dnsZoneRef"`
+	ResolverContextRef DNSNameReference `json:"resolverContextRef"`
 }
 
 type DNSZoneAssociationStatus struct {
-	ResolvedDNSZoneRef         DNSObjectReference  `json:"resolvedDNSZoneRef,omitempty"`
-	ResolvedResolverContextRef DNSObjectReference  `json:"resolvedResolverContextRef,omitempty"`
-	BindingRef                 *DNSObjectReference `json:"bindingRef,omitempty"`
-	Conditions                 []metav1.Condition  `json:"conditions,omitempty"`
+	ResolvedDNSZoneRef         DNSNameReference   `json:"resolvedDNSZoneRef,omitempty"`
+	ResolvedResolverContextRef DNSNameReference   `json:"resolvedResolverContextRef,omitempty"`
+	Conditions                 []metav1.Condition `json:"conditions,omitempty"`
 }
 
 // DNSResolverContext is the DNS-owned serving and namespace boundary created by
@@ -58,8 +63,8 @@ type DNSResolverContextManagedNamespace struct {
 }
 
 type DNSResolverContextManagedNamespaceStatus struct {
-	DNSZoneRef DNSObjectReference `json:"dnsZoneRef,omitempty"`
-	Suffix     string             `json:"suffix,omitempty"`
+	DNSZoneRef DNSNameReference `json:"dnsZoneRef,omitempty"`
+	Suffix     string           `json:"suffix,omitempty"`
 }
 
 type DNSResolverContextStatus struct {
@@ -112,9 +117,8 @@ type DNSResolverAccessBindingSpec struct {
 }
 
 type DNSResolverAccessBindingStatus struct {
-	ObservedGeneration int64               `json:"observedGeneration,omitempty"`
-	BindingRef         *DNSObjectReference `json:"bindingRef,omitempty"`
-	Conditions         []metav1.Condition  `json:"conditions,omitempty"`
+	ObservedGeneration int64              `json:"observedGeneration,omitempty"`
+	Conditions         []metav1.Condition `json:"conditions,omitempty"`
 }
 
 // +kubebuilder:object:root=true
@@ -153,11 +157,11 @@ type DNSZoneAssociationList struct {
 
 const DNSRegistrationMaxTTLSeconds int32 = 30
 
-// +kubebuilder:validation:XValidation:rule="has(self.dnsZoneRef.uid) && self.dnsZoneRef.uid.size() > 0",message="dnsZoneRef must pin the zone UID"
-// +kubebuilder:validation:XValidation:rule="self.dnsZoneRef.name == oldSelf.dnsZoneRef.name && self.dnsZoneRef.uid == oldSelf.dnsZoneRef.uid",message="dnsZoneRef identity is immutable"
+// +kubebuilder:validation:XValidation:rule="self.dnsZoneRef.name.size() > 0",message="dnsZoneRef requires a name"
+// +kubebuilder:validation:XValidation:rule="self.dnsZoneRef.name == oldSelf.dnsZoneRef.name",message="dnsZoneRef is immutable"
 // +kubebuilder:validation:XValidation:rule="self.name == oldSelf.name",message="name is immutable"
 type DNSRegistrationSpec struct {
-	DNSZoneRef DNSObjectReference `json:"dnsZoneRef"`
+	DNSZoneRef DNSNameReference `json:"dnsZoneRef"`
 	// Name is the owner name, relative to the zone or fully qualified.
 	// +kubebuilder:validation:MinLength=1
 	// +kubebuilder:validation:MaxLength=253
@@ -245,25 +249,25 @@ type DNSRecordContributionList struct {
 	Items           []DNSRecordContribution `json:"items"`
 }
 
-// +kubebuilder:validation:XValidation:rule="!has(self.resolverContextRef) || ((self.resolverContextRef.name.size() == 0 && !has(self.resolverContextRef.uid) && (!has(self.resolverContextRef.generation) || self.resolverContextRef.generation == 0)) || (self.resolverContextRef.name.size() > 0 && has(self.resolverContextRef.uid) && self.resolverContextRef.uid.size() > 0))",message="a nonempty resolverContextRef must pin name and UID"
-// +kubebuilder:validation:XValidation:rule="!has(self.dnsZoneRef) || self.dnsZoneRef.name.size() == 0 || (has(self.dnsZoneRef.uid) && self.dnsZoneRef.uid.size() > 0)",message="a selected dnsZoneRef must pin the zone UID"
-// +kubebuilder:validation:XValidation:rule="self.resolverContextRef.name.size() > 0 && has(self.resolverContextRef.uid) && self.resolverContextRef.uid.size() > 0",message="resolverContextRef is required"
-// +kubebuilder:validation:XValidation:rule="self.resolverContextRef.name == oldSelf.resolverContextRef.name && self.resolverContextRef.uid == oldSelf.resolverContextRef.uid",message="resolverContextRef identity is immutable"
-// +kubebuilder:validation:XValidation:rule="(has(self.dnsZoneRef) ? self.dnsZoneRef.name : \"\") == (has(oldSelf.dnsZoneRef) ? oldSelf.dnsZoneRef.name : \"\") && ((has(self.dnsZoneRef) && has(self.dnsZoneRef.uid)) ? self.dnsZoneRef.uid : \"\") == ((has(oldSelf.dnsZoneRef) && has(oldSelf.dnsZoneRef.uid)) ? oldSelf.dnsZoneRef.uid : \"\")",message="dnsZoneRef identity is immutable"
+// +kubebuilder:validation:XValidation:rule="self.resolverContextRef.name.size() > 0",message="resolverContextRef is required"
+// +kubebuilder:validation:XValidation:rule="self.resolverContextRef.name == oldSelf.resolverContextRef.name",message="resolverContextRef is immutable"
+// +kubebuilder:validation:XValidation:rule="(has(self.dnsZoneRef) ? self.dnsZoneRef.name : \"\") == (has(oldSelf.dnsZoneRef) ? oldSelf.dnsZoneRef.name : \"\")",message="dnsZoneRef is immutable"
 type DNSNamingPolicySpec struct {
-	ResolverContextRef DNSObjectReference `json:"resolverContextRef"`
+	ResolverContextRef DNSNameReference `json:"resolverContextRef"`
 	// +kubebuilder:validation:MaxItems=256
 	AdditionalNames []DNSAdditionalNameRule `json:"additionalNames"`
-	DNSZoneRef      DNSObjectReference      `json:"dnsZoneRef,omitempty"`
+	DNSZoneRef      DNSNameReference        `json:"dnsZoneRef,omitempty"`
 	// +kubebuilder:validation:MaxLength=253
 	ScopePrefix string `json:"scopePrefix,omitempty"`
 	Priority    int32  `json:"priority,omitempty"`
 }
 
-// +kubebuilder:validation:XValidation:rule="has(self.dnsZoneRef.uid) && self.dnsZoneRef.uid.size() > 0",message="dnsZoneRef must pin the zone UID"
+// +kubebuilder:validation:XValidation:rule="self.dnsZoneRef.name.size() > 0",message="dnsZoneRef requires a name"
 type DNSAdditionalNameRule struct {
+	// Selector matches DNSRegistration metadata labels within this DNS context.
+	// An omitted or empty selector matches every registration in the context.
 	Selector   *DNSRegistrationSelector `json:"selector,omitempty"`
-	DNSZoneRef DNSObjectReference       `json:"dnsZoneRef"`
+	DNSZoneRef DNSNameReference         `json:"dnsZoneRef"`
 	// +kubebuilder:validation:MaxLength=253
 	NamePrefix string `json:"namePrefix"`
 }
@@ -304,15 +308,14 @@ func (s *DNSRegistrationSelector) AsLabelSelector() *metav1.LabelSelector {
 }
 
 type DNSNamingPolicyStatus struct {
-	ResolvedResolverContextRef DNSObjectReference              `json:"resolvedResolverContextRef,omitempty"`
-	ResolvedDNSZoneRef         DNSObjectReference              `json:"resolvedDNSZoneRef,omitempty"`
+	ResolvedResolverContextRef DNSNameReference                `json:"resolvedResolverContextRef,omitempty"`
 	ResolvedAdditionalNames    []DNSResolvedAdditionalNameRule `json:"resolvedAdditionalNames,omitempty"`
 	Conditions                 []metav1.Condition              `json:"conditions,omitempty"`
 }
 
 type DNSResolvedAdditionalNameRule struct {
 	Selector   *metav1.LabelSelector `json:"selector,omitempty"`
-	DNSZoneRef DNSObjectReference    `json:"dnsZoneRef"`
+	DNSZoneRef DNSNameReference      `json:"dnsZoneRef"`
 	NamePrefix string                `json:"namePrefix"`
 }
 

api/v1alpha1/internaldns_types_test.go

@@ -7,8 +7,8 @@ import (
 
 func TestDNSPoliciesSelectResolverContexts(t *testing.T) {
 	for name, value := range map[string]any{
-		"association context": DNSZoneAssociationSpec{ResolverContextRef: DNSObjectReference{Name: "ctx", UID: "ctx-uid"}},
-		"naming context":      DNSNamingPolicySpec{ResolverContextRef: DNSObjectReference{Name: "ctx", UID: "ctx-uid"}},
+		"association context": DNSZoneAssociationSpec{ResolverContextRef: DNSNameReference{Name: "ctx"}},
+		"naming context":      DNSNamingPolicySpec{ResolverContextRef: DNSNameReference{Name: "ctx"}},
 	} {
 		t.Run(name, func(t *testing.T) {
 			data, err := json.Marshal(value)

api/v1alpha1/internaldns_validation_envtest_test.go

@@ -116,7 +116,7 @@ func TestPrivateDNSValidationAtAPIServer(t *testing.T) {
 	})
 	for _, ttl := range []int32{0, 31, 2147483647} {
 		t.Run("ttl", func(t *testing.T) {
-			a := &DNSRegistration{ObjectMeta: metav1.ObjectMeta{GenerateName: "registration-", Namespace: "validation"}, Spec: DNSRegistrationSpec{DNSZoneRef: DNSObjectReference{Name: "zone", UID: "zone-uid"}, Name: "web", RecordTypes: []RRType{RRTypeAAAA}, TTLSeconds: ttl}}
+			a := &DNSRegistration{ObjectMeta: metav1.ObjectMeta{GenerateName: "registration-", Namespace: "validation"}, Spec: DNSRegistrationSpec{DNSZoneRef: DNSNameReference{Name: "zone"}, Name: "web", RecordTypes: []RRType{RRTypeAAAA}, TTLSeconds: ttl}}
 			requireInvalid(t, cl.Create(ctx, a))
 		})
 	}
@@ -165,29 +165,27 @@ func TestPrivateDNSValidationAtAPIServer(t *testing.T) {
 		}
 	})
 	validateServiceDNSContracts(t, cl)
+	validateNamingAPISchemas(t, cl)
 	validateReferenceIdentity(t, cl, requireInvalid)
 	validateRegistrationBounds(t, cl, requireInvalid)
 }
 
-// References may advance a pinned generation, but never retarget another object.
+// References select objects by name and never retarget another object.
 func validateReferenceIdentity(t *testing.T, cl client.Client, requireInvalid func(*testing.T, error)) {
 	ctx := context.Background()
-	zone := DNSObjectReference{Name: "zone", UID: "zone-uid", Generation: 1}
-	resolverContext := DNSObjectReference{Name: "context", UID: "context-uid"}
+	zone := DNSNameReference{Name: "zone"}
+	resolverContext := DNSNameReference{Name: "context"}
 	t.Run("association-reference-identity", func(t *testing.T) {
 		for name, mutate := range map[string]func(*DNSZoneAssociation){
 			"zone-name":    func(a *DNSZoneAssociation) { a.Spec.DNSZoneRef.Name = "other" },
-			"zone-uid":     func(a *DNSZoneAssociation) { a.Spec.DNSZoneRef.UID = "other-uid" },
 			"context-name": func(a *DNSZoneAssociation) { a.Spec.ResolverContextRef.Name = "other" },
-			"context-uid":  func(a *DNSZoneAssociation) { a.Spec.ResolverContextRef.UID = "other-uid" },
 		} {
 			a := &DNSZoneAssociation{ObjectMeta: metav1.ObjectMeta{GenerateName: "association-", Namespace: "validation"}, Spec: DNSZoneAssociationSpec{DNSZoneRef: zone, ResolverContextRef: resolverContext}}
 			if err := cl.Create(ctx, a); err != nil {
 				t.Fatal(err)
 			}
-			a.Spec.DNSZoneRef.Generation = 2
 			if err := cl.Update(ctx, a); err != nil {
-				t.Fatalf("zone generation cannot advance: %v", err)
+				t.Fatalf("unchanged association update rejected: %v", err)
 			}
 			mutate(a)
 			t.Run(name, func(t *testing.T) { requireInvalid(t, cl.Update(ctx, a)) })
@@ -196,10 +194,8 @@ func validateReferenceIdentity(t *testing.T, cl client.Client, requireInvalid fu
 	t.Run("naming-policy-reference-identity", func(t *testing.T) {
 		for name, mutate := range map[string]func(*DNSNamingPolicy){
 			"zone-name":    func(p *DNSNamingPolicy) { p.Spec.DNSZoneRef.Name = "other" },
-			"zone-uid":     func(p *DNSNamingPolicy) { p.Spec.DNSZoneRef.UID = "other-uid" },
-			"zone-cleared": func(p *DNSNamingPolicy) { p.Spec.DNSZoneRef = DNSObjectReference{} },
+			"zone-cleared": func(p *DNSNamingPolicy) { p.Spec.DNSZoneRef = DNSNameReference{} },
 			"context-name": func(p *DNSNamingPolicy) { p.Spec.ResolverContextRef.Name = "other" },
-			"context-uid":  func(p *DNSNamingPolicy) { p.Spec.ResolverContextRef.UID = "other-uid" },
 		} {
 			p := &DNSNamingPolicy{ObjectMeta: metav1.ObjectMeta{GenerateName: "naming-", Namespace: "validation"}, Spec: DNSNamingPolicySpec{ResolverContextRef: resolverContext, DNSZoneRef: zone, AdditionalNames: []DNSAdditionalNameRule{}}}
 			if err := cl.Create(ctx, p); err != nil {
@@ -223,16 +219,14 @@ func validateReferenceIdentity(t *testing.T, cl client.Client, requireInvalid fu
 		for name, mutate := range map[string]func(*DNSRegistration){
 			"name":      func(r *DNSRegistration) { r.Spec.Name = "api" },
 			"zone-name": func(r *DNSRegistration) { r.Spec.DNSZoneRef.Name = "other" },
-			"zone-uid":  func(r *DNSRegistration) { r.Spec.DNSZoneRef.UID = "other-uid" },
 		} {
 			r := &DNSRegistration{ObjectMeta: metav1.ObjectMeta{GenerateName: "registration-", Namespace: "validation"}, Spec: DNSRegistrationSpec{DNSZoneRef: zone, Name: "web", RecordTypes: []RRType{RRTypeAAAA}, TTLSeconds: 30}}
 			if err := cl.Create(ctx, r); err != nil {
 				t.Fatal(err)
 			}
 			r.Spec.TTLSeconds = 10
-			r.Spec.DNSZoneRef.Generation = 2
 			if err := cl.Update(ctx, r); err != nil {
-				t.Fatalf("registration cannot change TTL or zone generation: %v", err)
+				t.Fatalf("registration cannot change TTL: %v", err)
 			}
 			mutate(r)
 			t.Run(name, func(t *testing.T) { requireInvalid(t, cl.Update(ctx, r)) })
@@ -258,7 +252,7 @@ func validateRegistrationBounds(t *testing.T, cl client.Client, requireInvalid f
 		"many-reserved":         func(s *DNSRegistrationSpec) { s.ReservedDescendants = many(65, "r") },
 	} {
 		t.Run("registration-bounds-"+name, func(t *testing.T) {
-			r := &DNSRegistration{ObjectMeta: metav1.ObjectMeta{GenerateName: "bounded-", Namespace: "validation"}, Spec: DNSRegistrationSpec{DNSZoneRef: DNSObjectReference{Name: "zone", UID: "zone-uid"}, Name: "web", RecordTypes: []RRType{RRTypeA}, TTLSeconds: 30}}
+			r := &DNSRegistration{ObjectMeta: metav1.ObjectMeta{GenerateName: "bounded-", Namespace: "validation"}, Spec: DNSRegistrationSpec{DNSZoneRef: DNSNameReference{Name: "zone"}, Name: "web", RecordTypes: []RRType{RRTypeA}, TTLSeconds: 30}}
 			mutate(&r.Spec)
 			requireInvalid(t, cl.Create(ctx, r))
 		})