Keep private DNS available through incomplete updates

api/v1alpha1/internaldns_project_types.go

@@ -35,10 +35,9 @@ type DNSZoneAssociationSpec struct {
 }
 
 type DNSZoneAssociationStatus struct {
-	ResolvedDNSZoneRef         DNSObjectReference  `json:"resolvedDNSZoneRef,omitempty"`
-	ResolvedResolverContextRef DNSObjectReference  `json:"resolvedResolverContextRef,omitempty"`
-	BindingRef                 *DNSObjectReference `json:"bindingRef,omitempty"`
-	Conditions                 []metav1.Condition  `json:"conditions,omitempty"`
+	ResolvedDNSZoneRef         DNSNameReference   `json:"resolvedDNSZoneRef,omitempty"`
+	ResolvedResolverContextRef DNSNameReference   `json:"resolvedResolverContextRef,omitempty"`
+	Conditions                 []metav1.Condition `json:"conditions,omitempty"`
 }
 
 // DNSResolverContext is the DNS-owned serving and namespace boundary created by
@@ -63,8 +62,8 @@ type DNSResolverContextManagedNamespace struct {
 }
 
 type DNSResolverContextManagedNamespaceStatus struct {
-	DNSZoneRef DNSObjectReference `json:"dnsZoneRef,omitempty"`
-	Suffix     string             `json:"suffix,omitempty"`
+	DNSZoneRef DNSNameReference `json:"dnsZoneRef,omitempty"`
+	Suffix     string           `json:"suffix,omitempty"`
 }
 
 type DNSResolverContextStatus struct {
@@ -137,9 +136,8 @@ type DNSResolverAccessBindingSpec struct {
 }
 
 type DNSResolverAccessBindingStatus struct {
-	ObservedSequence int64               `json:"observedSequence,omitempty"`
-	BindingRef       *DNSObjectReference `json:"bindingRef,omitempty"`
-	Conditions       []metav1.Condition  `json:"conditions,omitempty"`
+	ObservedSequence int64              `json:"observedSequence,omitempty"`
+	Conditions       []metav1.Condition `json:"conditions,omitempty"`
 }
 
 // +kubebuilder:object:root=true
@@ -186,9 +184,9 @@ const (
 
 const DNSRegistrationMaxTTLSeconds int32 = 30
 
-// +kubebuilder:validation:XValidation:rule="has(self.dnsZoneRef.uid) && self.dnsZoneRef.uid.size() > 0",message="dnsZoneRef must pin the zone UID"
+// +kubebuilder:validation:XValidation:rule="self.dnsZoneRef.name.size() > 0",message="dnsZoneRef requires a name"
 type DNSRegistrationSpec struct {
-	DNSZoneRef        DNSObjectReference   `json:"dnsZoneRef"`
+	DNSZoneRef        DNSNameReference     `json:"dnsZoneRef"`
 	Name              string               `json:"name"`
 	RecordTypes       []RRType             `json:"recordTypes"`
 	PublicationPolicy DNSPublicationPolicy `json:"publicationPolicy"`
@@ -358,15 +356,14 @@ func (s *DNSRegistrationSelector) AsLabelSelector() *metav1.LabelSelector {
 }
 
 type DNSNamingPolicyStatus struct {
-	ResolvedResolverContextRef DNSObjectReference              `json:"resolvedResolverContextRef,omitempty"`
-	ResolvedDNSZoneRef         DNSObjectReference              `json:"resolvedDNSZoneRef,omitempty"`
+	ResolvedResolverContextRef DNSNameReference                `json:"resolvedResolverContextRef,omitempty"`
 	ResolvedAdditionalNames    []DNSResolvedAdditionalNameRule `json:"resolvedAdditionalNames,omitempty"`
 	Conditions                 []metav1.Condition              `json:"conditions,omitempty"`
 }
 
 type DNSResolvedAdditionalNameRule struct {
 	Selector   *metav1.LabelSelector `json:"selector,omitempty"`
-	DNSZoneRef DNSObjectReference    `json:"dnsZoneRef"`
+	DNSZoneRef DNSNameReference      `json:"dnsZoneRef"`
 	NamePrefix string                `json:"namePrefix"`
 }
 
@@ -388,15 +385,13 @@ type DNSNamingPolicyList struct {
 
 // DNSManagedNamespace tracks a resolver context's canonical private namespace.
 type DNSManagedNamespaceSpec struct {
-	ProjectUID         types.UID          `json:"projectUID"`
-	ResolverContextRef DNSObjectReference `json:"resolverContextRef"`
-	DomainSuffix       string             `json:"domainSuffix"`
-	DNSZoneClassName   string             `json:"dnsZoneClassName"`
+	ResolverContextRef DNSNameReference `json:"resolverContextRef"`
+	DomainSuffix       string           `json:"domainSuffix"`
+	DNSZoneClassName   string           `json:"dnsZoneClassName"`
 }
 
 type DNSManagedNamespaceStatus struct {
-	DNSZoneRef      DNSObjectReference `json:"dnsZoneRef,omitempty"`
-	AssociationRef  DNSObjectReference `json:"associationRef,omitempty"`
+	DNSZoneRef      DNSNameReference   `json:"dnsZoneRef,omitempty"`
 	CanonicalSuffix string             `json:"canonicalSuffix,omitempty"`
 	Conditions      []metav1.Condition `json:"conditions,omitempty"`
 }

api/v1alpha1/internaldns_service_types.go

@@ -50,6 +50,9 @@ type DNSResolverBindingConfiguration struct {
 	Listeners DNSResolverBindingListeners `json:"listeners"`
 	// +kubebuilder:validation:MaxItems=256
 	ZoneRefs []DNSObjectReference `json:"zoneRefs"`
+	// ZoneApices reserves each private namespace before publication is available.
+	// +kubebuilder:validation:MaxProperties=256
+	ZoneApices map[string]string `json:"zoneApices,omitempty"`
 }
 
 // +kubebuilder:validation:XValidation:rule="oldSelf == self",message="listener identity is immutable for an access binding"

api/v1alpha1/internaldns_validation_envtest_test.go

@@ -127,7 +127,7 @@ func TestPrivateDNSValidationAtAPIServer(t *testing.T) {
 	})
 	for _, ttl := range []int32{0, 31, 2147483647} {
 		t.Run("ttl", func(t *testing.T) {
-			a := &DNSRegistration{ObjectMeta: metav1.ObjectMeta{GenerateName: "registration-", Namespace: "validation"}, Spec: DNSRegistrationSpec{DNSZoneRef: DNSObjectReference{Name: "zone", UID: "zone-uid"}, Name: "web", RecordTypes: []RRType{RRTypeAAAA}, PublicationPolicy: DNSPublicationPolicyEligibleContributions, TTLSeconds: ttl}}
+			a := &DNSRegistration{ObjectMeta: metav1.ObjectMeta{GenerateName: "registration-", Namespace: "validation"}, Spec: DNSRegistrationSpec{DNSZoneRef: DNSNameReference{Name: "zone"}, Name: "web", RecordTypes: []RRType{RRTypeAAAA}, PublicationPolicy: DNSPublicationPolicyEligibleContributions, TTLSeconds: ttl}}
 			requireInvalid(t, cl.Create(ctx, a))
 		})
 	}

config/crd/bases/dns.networking.miloapis.com_dnsmanagednamespaces.yaml

@@ -43,64 +43,24 @@ spec:
                 type: string
               domainSuffix:
                 type: string
-              projectUID:
-                description: |-
-                  UID is a type that holds unique ID values, including UUIDs.  Because we
-                  don't ONLY use UUIDs, this is an alias to string.  Being a type captures
-                  intent and helps make sure that UIDs and names do not get conflated.
-                type: string
               resolverContextRef:
                 description: |-
-                  DNSObjectReference pins a namespaced object by API-assigned UID. Generation
-                  is used where a writer must also be fenced against policy changes.
+                  DNSNameReference selects a resource in the same project namespace.
+                  DNS records its resolved lifetime in controller-owned status.
                 properties:
-                  generation:
-                    format: int64
-                    minimum: 0
-                    type: integer
                   name:
                     maxLength: 253
                     type: string
-                  uid:
-                    description: |-
-                      UID is a type that holds unique ID values, including UUIDs.  Because we
-                      don't ONLY use UUIDs, this is an alias to string.  Being a type captures
-                      intent and helps make sure that UIDs and names do not get conflated.
-                    maxLength: 128
-                    type: string
                 required:
                 - name
                 type: object
             required:
             - dnsZoneClassName
             - domainSuffix
-            - projectUID
             - resolverContextRef
             type: object
           status:
             properties:
-              associationRef:
-                description: |-
-                  DNSObjectReference pins a namespaced object by API-assigned UID. Generation
-                  is used where a writer must also be fenced against policy changes.
-                properties:
-                  generation:
-                    format: int64
-                    minimum: 0
-                    type: integer
-                  name:
-                    maxLength: 253
-                    type: string
-                  uid:
-                    description: |-
-                      UID is a type that holds unique ID values, including UUIDs.  Because we
-                      don't ONLY use UUIDs, this is an alias to string.  Being a type captures
-                      intent and helps make sure that UIDs and names do not get conflated.
-                    maxLength: 128
-                    type: string
-                required:
-                - name
-                type: object
               canonicalSuffix:
                 type: string
               conditions:
@@ -161,23 +121,12 @@ spec:
                 type: array
               dnsZoneRef:
                 description: |-
-                  DNSObjectReference pins a namespaced object by API-assigned UID. Generation
-                  is used where a writer must also be fenced against policy changes.
+                  DNSNameReference selects a resource in the same project namespace.
+                  DNS records its resolved lifetime in controller-owned status.
                 properties:
-                  generation:
-                    format: int64
-                    minimum: 0
-                    type: integer
                   name:
                     maxLength: 253
                     type: string
-                  uid:
-                    description: |-
-                      UID is a type that holds unique ID values, including UUIDs.  Because we
-                      don't ONLY use UUIDs, this is an alias to string.  Being a type captures
-                      intent and helps make sure that UIDs and names do not get conflated.
-                    maxLength: 128
-                    type: string
                 required:
                 - name
                 type: object

config/crd/bases/dns.networking.miloapis.com_dnsnamingpolicies.yaml

@@ -204,23 +204,12 @@ spec:
                   properties:
                     dnsZoneRef:
                       description: |-
-                        DNSObjectReference pins a namespaced object by API-assigned UID. Generation
-                        is used where a writer must also be fenced against policy changes.
+                        DNSNameReference selects a resource in the same project namespace.
+                        DNS records its resolved lifetime in controller-owned status.
                       properties:
-                        generation:
-                          format: int64
-                          minimum: 0
-                          type: integer
                         name:
                           maxLength: 253
                           type: string
-                        uid:
-                          description: |-
-                            UID is a type that holds unique ID values, including UUIDs.  Because we
-                            don't ONLY use UUIDs, this is an alias to string.  Being a type captures
-                            intent and helps make sure that UIDs and names do not get conflated.
-                          maxLength: 128
-                          type: string
                       required:
                       - name
                       type: object
@@ -280,47 +269,14 @@ spec:
                   - namePrefix
                   type: object
                 type: array
-              resolvedDNSZoneRef:
-                description: |-
-                  DNSObjectReference pins a namespaced object by API-assigned UID. Generation
-                  is used where a writer must also be fenced against policy changes.
-                properties:
-                  generation:
-                    format: int64
-                    minimum: 0
-                    type: integer
-                  name:
-                    maxLength: 253
-                    type: string
-                  uid:
-                    description: |-
-                      UID is a type that holds unique ID values, including UUIDs.  Because we
-                      don't ONLY use UUIDs, this is an alias to string.  Being a type captures
-                      intent and helps make sure that UIDs and names do not get conflated.
-                    maxLength: 128
-                    type: string
-                required:
-                - name
-                type: object
               resolvedResolverContextRef:
                 description: |-
-                  DNSObjectReference pins a namespaced object by API-assigned UID. Generation
-                  is used where a writer must also be fenced against policy changes.
+                  DNSNameReference selects a resource in the same project namespace.
+                  DNS records its resolved lifetime in controller-owned status.
                 properties:
-                  generation:
-                    format: int64
-                    minimum: 0
-                    type: integer
                   name:
                     maxLength: 253
                     type: string
-                  uid:
-                    description: |-
-                      UID is a type that holds unique ID values, including UUIDs.  Because we
-                      don't ONLY use UUIDs, this is an alias to string.  Being a type captures
-                      intent and helps make sure that UIDs and names do not get conflated.
-                    maxLength: 128
-                    type: string
                 required:
                 - name
                 type: object

config/crd/bases/dns.networking.miloapis.com_dnsregistrations.yaml

@@ -40,23 +40,12 @@ spec:
             properties:
               dnsZoneRef:
                 description: |-
-                  DNSObjectReference pins a namespaced object by API-assigned UID. Generation
-                  is used where a writer must also be fenced against policy changes.
+                  DNSNameReference selects a resource in the same project namespace.
+                  DNS records its resolved lifetime in controller-owned status.
                 properties:
-                  generation:
-                    format: int64
-                    minimum: 0
-                    type: integer
                   name:
                     maxLength: 253
                     type: string
-                  uid:
-                    description: |-
-                      UID is a type that holds unique ID values, including UUIDs.  Because we
-                      don't ONLY use UUIDs, this is an alias to string.  Being a type captures
-                      intent and helps make sure that UIDs and names do not get conflated.
-                    maxLength: 128
-                    type: string
                 required:
                 - name
                 type: object
@@ -105,8 +94,8 @@ spec:
             - ttlSeconds
             type: object
             x-kubernetes-validations:
-            - message: dnsZoneRef must pin the zone UID
-              rule: has(self.dnsZoneRef.uid) && self.dnsZoneRef.uid.size() > 0
+            - message: dnsZoneRef requires a name
+              rule: self.dnsZoneRef.name.size() > 0
           status:
             properties:
               canonicalFQDN:

config/crd/bases/dns.networking.miloapis.com_dnsresolveraccessbindings.yaml

@@ -131,28 +131,6 @@ spec:
                 > oldSelf.authorization.sequence
           status:
             properties:
-              bindingRef:
-                description: |-
-                  DNSObjectReference pins a namespaced object by API-assigned UID. Generation
-                  is used where a writer must also be fenced against policy changes.
-                properties:
-                  generation:
-                    format: int64
-                    minimum: 0
-                    type: integer
-                  name:
-                    maxLength: 253
-                    type: string
-                  uid:
-                    description: |-
-                      UID is a type that holds unique ID values, including UUIDs.  Because we
-                      don't ONLY use UUIDs, this is an alias to string.  Being a type captures
-                      intent and helps make sure that UIDs and names do not get conflated.
-                    maxLength: 128
-                    type: string
-                required:
-                - name
-                type: object
               conditions:
                 items:
                   description: Condition contains details for one aspect of the current