[scotwells]

Summary

Configure private zones, registrations, and naming policies using resource names and registration labels. Keep reference identities in private service state, and reject observed resources whose identity state is missing instead of attaching them to replacement targets. Reconcile static record changes and process fleet acknowledgements concurrently while preserving newer health observations. Expose optional operation metrics and preserve readiness timestamps when serving health is unchanged. Preserve accepted routing across restarts and support consumer UDP and TCP queries over trusted backend TCP connections.

User experience

Zone associations and naming policies select a resolver context by name; registrations select a zone by name. Naming rules match registration labels, and an empty selector matches all registrations in the context. Registration write access is the RBAC boundary: selectors organize names and do not grant separate publisher authorization. Recover missing identity state from a verified backup or recreate the source resource to select its targets explicitly.

Important

A resource whose identity state is missing is marked Unverified, and that mark is never cleared. Resources resolved before this change have no identity state to restore, because their target identities lived only in the removed uid fields. This includes every association, naming policy, and registration that staging resolved since infra#7473. They stay detached until they are recreated, so the staging rollout must plan to recreate them.

Test plan

• CI: API validation, reference recovery, and concurrent acknowledgement tests
• CI: Lint and generated manifests
• CI: Container packaging
• CI: Repository end-to-end tests

Stacked on #243. Architecture: #229.

[ecv]

Approving at bb43d81. An object with resolved status but no reference ConfigMap is now marked Unverified and stays detached, so it cannot re-attach to a replacement. Ack status patches use an optimistic lock, so concurrent ack workers cannot overwrite a newer observation. Tests fail when either fix is undone. Malformed reference ConfigMaps are skipped, and a scope with no project UID now errors.

One rollout cost for the body: Unverified is never cleared. Every object staging resolved since infra#7473 stays not-current until it is recreated. Say so, so staging's rollout plans the recreate.

[ecv]

Re-approving at 63d53b7. The new commits carry the #236 PROXY change and make prepareDNSDistRouter rewrite the process settings on startup while keeping the accepted tenant rules. A retained file without a complete rules section is an error, not a silent rewrite. My note on recreating staging's Unverified objects still applies.

[ecv]

Re-approving at 6f66e14. restoreActive now refreshes the dnsdist process header on retained files before comparing, so an upgrade keeps the accepted tenant rules without a forced reload. Ack projection retries on conflict against a direct client, and an older ack becomes a no-op rather than an empty patch. My note on recreating staging's Unverified objects still applies.

[ecv]

Approve at 798ca73. My earlier approvals were dismissed when #243 was merged in again. The new #243 webhook merge (7f454ab) keeps references name-only. Zone and context names on associations, registrations and naming policies are immutable through CEL, and no rule compares a UID. go build, go vet and the touched packages' tests pass locally with envtest assets. make manifests generate leaves the tree clean.

Prior findings at this head

Finding	Status	Evidence
Existing objects re-attach by name	Fixed	reference_state.go:69, :87: a source with resolved status but no reference state is held Unverified and gets no new pin. Covered by TestMissingReferenceStateDoesNotReattachObservedResource
4 concurrent consumeAcks workers	Fixed	acks.go:50: retry on conflict, optimistic-lock status patches, and an older ack is now a no-op (acks.go:140, :189). Covered by the concurrent health projection test
One bad references-* ConfigMap fails the reconcile	Fixed	reference_state.go:143: malformed, unknown-kind and identity-mismatch objects are logged and skipped
Scopes without ProjectUID skipped silently	Fixed	acks.go:209 now errors. ProjectNamespaces is gone, and discovery sets ProjectUID (project_discovery.go:52)
Registration labels as an authorization boundary	Documented	README "Reference-state recovery" and the PR body name registration RBAC as the boundary. Selectors and references stay in one namespace (DNSNameReference has no namespace), and reference state lives in the platform namespace, so a tenant cannot select across projects or forge pins
DNSRecordSet watch not mentioned in the body	Fixed	The body now says "Reconcile static record changes"

Blocking

None.

Non-blocking

• Staging rollout cost still stands. Objects staging resolved before this change have no reference state, so they stay Unverified until someone recreates them. The README says "Restore a verified reference-state backup" (config/internal-dns/README.md:260), but no backup exists for pins that only lived in the old uid fields. For those objects, recreating them is the only way back. Say so for staging.
• ResolveNaming (naming.go:46) builds a Reconciler without PlatformNamespace, so it always reads reference state from internal-dns-system. Only tests call it today. If it gets wired to a deployment with another platform namespace, every policy will be skipped without an error. Pass the namespace in.
• Reference-state ConfigMaps are cleaned up only by a reconcile of the same project (collectReferenceStates). If a whole project is removed, its references-* objects stay in the platform namespace. Consider adding them to the project cleanup path.
• The metrics listener (run.go:193) serves /metrics without authentication. The README says to restrict it to the monitoring network, which is fine for now.

[ecv]

Objects that predate reference state (staging since infra#7473) have no backup to restore. For them, recreating the object is the only recovery. Worth saying that here.

[ecv]

This always reads reference state from the default internal-dns-system namespace. With any other PlatformNamespace, every policy is skipped without an error. Only tests call it today, so this is non-blocking. Consider passing the namespace in.

The merge-base changed after approval.