[scotwells]

Summary

Resources inherit private resolver addresses and the datum.internal search domain from their network, with read-only resolver settings on interfaces. The integration is disabled by default; enabling it activates managed DNS for all existing networks unless explicitly disabled on the network. Network services establish private DNS access and retain applied settings during observation outages until explicit withdrawal. Disabled deployments preserve existing network context behavior and certificate controller placement.

Test plan

• Local checks: Disabled integration preserves existing contexts and skips DNS setup
• Local checks: Cleanup preserves foreign resources and checks ownership before deletion
• Local checks: Cross-namespace bindings receive context readiness changes
• CI: Controller, API generation, deployment, and end-to-end suites

Depends on Network #36, Galactic #851, and DNS #244.

[ecv]

Requesting changes. With internalDNS.enabled off, this release still changes runtime behavior for every production deployment. NSO's control plane follows >= 0.x, so the next tag ships it with no infra change.

Every existing NetworkContext gets rewritten. networkbinding_controller.go replaces create-if-absent with an ungated CreateOrUpdate. On first reconcile, every existing context gets ipFamilies, mtu, networkGeneration, new labels and the controller reference written in. The new Network watch means every Network edit rewrites every context, since networkGeneration moves on each edit. If cells treat a spec change as a reprogram trigger, this churns the fleet. Restore create-only when the gate is off, or show that existing contexts and the cells see no change.

A federation manager now always starts. Before, the second manager existed only with --enable-cluster-sharding, and the singleton controllers otherwise ran on the local manager. Now every deployment builds one with its own leader election, and presence, projector, Challenge and the cert solver move onto it. Where federation.kubeconfigPath is set, Challenge and the cert solver start watching the hub instead of the local cluster. That is a broad change with nothing to do with DNS. Split it into its own PR and tag.

Also worth fixing:

• An empty spec.dns.mode means Managed once the flag is on. So turning the flag on enables DNS for every existing Network, not only those that opt in. Default to Disabled, or say in the body that the flag is a global switch.
• NetworkContext.spec.dns carries nameservers that reach guest interfaces. Restrict who can write it with a ValidatingAdmissionPolicy, or move it to status.
• disable() deletes a DNSResolverContext by derived name without checking its owner annotations first.
• The RBAC adds write on dnsresolvercontexts, dnsresolveraccessbindings and galactic serviceendpoints/serviceroutepolicies everywhere, flag or not. Scheme registration and watches are also unconditional, so a missing CRD can stop the cache from starting. Confirm these CRDs exist in production, or register them only when enabled.
• go.datum.net/galactic moves to a v0.6.3 pseudo-version from a branch. Pin a tag once galactic#851 is released.
• Five checks, including the e2e runs, were pending when I looked.

[ecv]

Approving at 2b967ea. With internalDNS.enabled off, the binding controller creates contexts only when absent, as on main, and TestProjectBindingDisabledPreservesContext asserts nothing changes. The federation manager starts only when the flag is on. disable() and the cell side check ownership before deleting. Remaining items are in #691: the unenforced spec.dns write restriction, unconditional RBAC, the galactic pseudo-version, and the flag acting as a global switch. Please restore the deleted comment above TestACopyLosesALabelItsSourceDropped. One check was still pending when I approved.