[scotwells]

Summary

Keep private zones and their records out of public DNS discovery, replication, and serving.

User experience

Set DNSZone.spec.visibility to Private when creating a private zone. Existing zones default to Public. Visibility is immutable; changing it requires a new zone.

This PR establishes the publication boundary. Private resolver access and query serving follow in the stack.

Related: datum-cloud/enhancements#921 and architecture #229.

Validation

Local Kubernetes tests cover visibility defaults, validation, and immutability. Controller tests cover all six public controllers, record ordering, and deletion. Builds, lint, and PowerDNS integration tests passed. The repository-wide race run also reproduced existing webhook fixture races on unchanged main.

[ecv]

Requesting changes for one hole in the boundary. Making visibility immutable, with a default of Public, is right, and existing zones stay Public on read.

A public record re-pointed at a private zone keeps its public copy and cannot be deleted. DNSRecordSet.spec.dnsZoneRef has no immutability rule, and no webhook checks it. Take a record that already carries rsFinalizer and a downstream copy, and change its ref to a Private zone. The new early return in dnsrecordset_replicator_controller.go then fires before deletion handling. The public copy stays, updates stop reaching it, and deleting the record hangs on the finalizer. Add oldSelf == self to dnsZoneRef, or let the private branch run cleanup when the finalizer is present. Add a test for the re-point.

Also worth settling here:

• The zone Get now runs before deletion handling, so a transient zone read error blocks deleting a record. Fetch the zone only when the record is not being deleted.
• Nothing rejects a private zone that shares its apex with a public zone in the same project. The controller skips the Domain claim, so the outcome is undefined. Decide it and test it, or say in the body that the stack handles it.
• internal/agent/reader.go and the CLI zone import still list Private zones and their records. If #231 onward filters them, say so in the body.
• Applying the CRD before the new controller rolls opens a window. An older controller ignores visibility, so a Private zone created then goes to PowerDNS. The edge labs follow main. The release note should say no Private zone may be created until the controller image has rolled.
• The inotify sysctl and hack/collect-kind-diagnostics.sh in e2e.yml have nothing to do with private zones. Explain them in the body or split them out.

[ecv]

Approving at 7e05fc7. A record re-pointed at a private zone now runs deletion cleanup when it still carries the public finalizer, and deletion no longer reads the zone first. Both new tests cover those paths. The remaining points from my earlier review are tracked in #261.