Skip to content

test: Validate internal DNS on the shared Kubernetes environment - #239

Merged
scotwells merged 68 commits into
feat/internal-dns-service-runtimefrom
test/internal-dns-distributed-qualification
Oct 22, 2026
Merged

test: Validate internal DNS on the shared Kubernetes environment#239
scotwells merged 68 commits into
feat/internal-dns-service-runtimefrom
test/internal-dns-distributed-qualification

Conversation

@scotwells

@scotwells scotwells commented Oct 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

Validate private DNS on the shared Kubernetes end-to-end foundation.

Independent project APIs and distributed controllers publish into one shared CoreDNS serving fleet. Qualification covers overlapping names, public recursion, publisher RBAC, explicit withdrawal, replay protection, and serving during control plane outages. Galactic access and guest resolver delivery remain separate release qualification requirements.

Test plan

  • Local Kubernetes: All 61 checks pass for two tenants, distributed publication, withdrawal, outage recovery, and native dnsdist process continuity.
  • CI: Tests, lint, and generated manifests.
  • CI: Container and runtime packaging.
  • CI: Kubernetes tenant isolation and recovery.

Stacked on #238. Architecture: #229.

Related: datum-cloud/enhancements#921

@scotwells
scotwells force-pushed the test/internal-dns-distributed-qualification branch from b487553 to a1f5154 Compare October 9, 2026 00:23
scotwells added a commit that referenced this pull request Oct 9, 2026
@scotwells
fixup #239: Validate publication with separate product and grant issu…
d835960 
…er credentials
@scotwells
scotwells force-pushed the test/internal-dns-distributed-qualification branch from a1f5154 to d835960 Compare October 9, 2026 01:33
scotwells added a commit that referenced this pull request Oct 9, 2026
@scotwells
fixup #239: Freeze VM-local qualification evidence before copying sna…
c905eae 
…pshots
scotwells added a commit that referenced this pull request Oct 9, 2026
@scotwells
fixup #239: Establish a fresh known lease owner before takeover quali…
d49153a 
…fication
scotwells added a commit that referenced this pull request Oct 9, 2026
@scotwells
fixup #239: Preserve takeover precondition evidence even on failure
1c27e16
@scotwells
scotwells added this pull request to stack #240 October 9, 2026 02:17
@scotwells scotwells mentioned this pull request Oct 9, 2026
Merged
3 of 4 tasks
@scotwells scotwells changed the title test: Validate distributed private DNS end to end test: Validate internal DNS on the shared Kubernetes environment Oct 9, 2026
@scotwells scotwells mentioned this pull request Oct 10, 2026
Merged
4 tasks
@scotwells
scotwells force-pushed the test/internal-dns-distributed-qualification branch from ed5cb75 to 72b9277 Compare October 12, 2026 17:09
@scotwells
scotwells force-pushed the test/internal-dns-distributed-qualification branch 2 times, most recently from 5881153 to fca9c6a Compare October 12, 2026 21:17
@scotwells
scotwells force-pushed the test/internal-dns-distributed-qualification branch 3 times, most recently from 7da69df to 4b2a716 Compare October 12, 2026 22:07
@scotwells
scotwells force-pushed the test/internal-dns-distributed-qualification branch from 4b2a716 to fb6a544 Compare October 12, 2026 22:16
@scotwells
scotwells requested review from ecv and privateip October 21, 2026 22:03
@scotwells
scotwells marked this pull request as ready for review October 22, 2026 00:38
@scotwells
scotwells requested a review from a team as a code owner October 22, 2026 00:38
@ecv ecv mentioned this pull request Oct 22, 2026
Open
ecv
ecv previously approved these changes Oct 22, 2026
View reviewed changes

@ecv ecv left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approving. The tests run on kind on a GitHub-hosted runner with no secrets and no shared environment, and the e2e run is green. Follow-ups are in #261: the live cloudflare.com DNSSEC dependency, the unbound-destination case that passes on any transport error, and NXDOMAIN isolation checks that can pass before the owning tenant resolves.

@scotwells
scotwells dismissed ecv’s stale review October 22, 2026 02:02

The merge-base changed after approval.

scotwells and others added 4 commits October 22, 2026 09:37
@scotwells
Merge branch 'feat/internal-dns-service-runtime' into test/internal-d…
dd290af 
…ns-distributed-qualification

# Conflicts:
#	.gitignore
@scotwells
Merge branch 'feat/internal-dns-service-runtime' into test/internal-d…
cd5e711 
…ns-distributed-qualification
@scotwells @claude
Merge branch 'feat/internal-dns-service-runtime' into test/internal-d…
1046322 
…ns-distributed-qualification

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@scotwells @claude
Merge branch 'feat/internal-dns-service-runtime' into test/internal-d…
118e56b 
…ns-distributed-qualification

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
kevwilliams
kevwilliams reviewed Oct 22, 2026
View reviewed changes

@kevwilliams kevwilliams left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hold: Chainsaw E2E fails bringing up private DNS.

  • env:internal-dns:up times out waiting for the internal-dns-node pod to become ready, so no qualification scenario runs.

@scotwells
Merge branch 'feat/internal-dns-service-runtime' into test/internal-d…
29c3c76 
…ns-distributed-qualification

# Conflicts:
#	internal/internaldns/model/model_test.go
@scotwells scotwells mentioned this pull request Oct 22, 2026
Merged
1 of 5 tasks
@scotwells

scotwells commented Oct 22, 2026

Copy link
Copy Markdown
Contributor Author

@kevwilliams Root cause of the env:internal-dns:up timeout: the internal-dns-node pod was not crash-looping. It ran 2/3 with 0 restarts and failed readiness with local CoreDNS health 127.0.0.1:5300: read udp ...: connection refused. probeLocalDaemons (from #237) queried CoreDNS over UDP and TCP, but CoreDNS has listened only on TCP since #236, with dnsdist taking UDP in front of it. #244 passed only because a merge there had already switched the probe to TCP, and that change never reached the lower branches.

Fixed on #237 in 50d1585: the CoreDNS check now runs over TCP only, and the dnsdist check still covers UDP and TCP. The fix is merged up into this branch in 29c3c76. CI is rerunning.

@scotwells
scotwells requested a review from ecv October 22, 2026 19:57
ecv
ecv previously approved these changes Oct 22, 2026
View reviewed changes

@ecv ecv left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Re-approving. Only parent merges changed this PR, and its own commits are unchanged since my approval.

@scotwells
scotwells dismissed ecv’s stale review October 22, 2026 20:37

The merge-base changed after approval.

@scotwells
scotwells requested a review from ecv October 22, 2026 20:37
ecv
ecv approved these changes Oct 22, 2026
View reviewed changes

@ecv ecv left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Re-approving. The head is unchanged; only the base moved after the parent merged.

@scotwells
scotwells merged commit 9b4e245 into main Oct 22, 2026
29 checks passed
@scotwells
scotwells deleted the test/internal-dns-distributed-qualification branch October 22, 2026 20:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kevwilliams kevwilliams kevwilliams left review comments
@ecv ecv ecv approved these changes
@privateip privateip Awaiting requested review from privateip

Assignees

@ecv ecv

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@scotwells @ecv @kevwilliams