Repository navigation
hosted: authoritative Core Provider (hosted.dns.appthrust.io) - #18
Merged
Merged
Conversation
Core Provider hosted.dns.appthrust.io/v1alpha1 declaration (credentialless, seven record types, withdrawal-capable with the external reason contract, apex NS owned by the ZoneClass nameServers parameter), inline ZoneClass parameters, and the namespaced HostedZone serving snapshot CRD with status.servers acknowledgements. Design: docs/design/hosted-provider.md.
…luator, conversion, packaging - controllers: ZoneClass acceptance and ZoneUnit -> HostedZone snapshot rendering (canonical RRsets, controller-owned monotonic serial, content digest), Programmed from fresh server acknowledgements (3m freshness, every fresh replica at the current serial), orphan/shadow snapshot cleanup, parent delegation observation (Cluster|Recursive resolver). - server (app/hosted-server): miekg/dns authoritative responder (SOA/NS/ glue, A/AAAA/CNAME/TXT/MX/CAA/NS, RFC 4592 wildcards, in-zone CNAME chains, RFC 8482 ANY, REFUSED outside owned apexes, EDNS 1232 + TC/TCP, per-source UDP rate limit), informer over ZoneUnit-owned HostedZones with apex-conflict refusal, 30s status heartbeat via SSA, graceful withdrawal. - withdrawal: shared probe moved to internal/go/core/dnsprobe with a provider-neutral Policy; hosted evaluator proves exclusion at the authority (snapshot ∧ served ∧ every view) with soa.minimum negative TTL. - conversion: endpoint.hosted.dns.appthrust.io with flag-driven TTL. - chart/manager/Dockerfile/docs: providers.hosted.* gating, hosted-server Deployment/Service/RBAC, HOSTED_* flags. Design: docs/design/hosted-provider.md.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the hosted Core Provider: dns-api becomes the authority for a zone with no external DNS API. Design:
docs/design/hosted-provider.md.hosted.dns.appthrust.io/v1alpha1Provider (credentialless, 7 record types, withdrawal-capable with the external reason contract, apex NS owned by the class),HostedZonesnapshot CRD, inlineHostedZoneClassParameters(nameServers,soa,defaultTTL,verification.views,verification.delegation.resolver{mode,servers}).ZoneUnit→HostedZone(canonical RRsets, monotonic serial, content digest);Programmedonly when every fresh server (3 m heartbeat window) serves the current serial; delegation observation reported aszone.provider.data.delegation{observedNameServers,matches,...}; orphan/shadow snapshots removed; never writesHostedZone.status.app/hosted-server, same image): miekg/dns authoritative responder, serves onlyZoneUnit-owned snapshots, refuses apex conflicts, SSA heartbeat of its ownstatus.servers[]item, graceful removal.internal/go/core/dnsprobewith a provider-neutralPolicy(external updated); hosted evaluator proves exclusion at the authority (snapshot ∧ served ∧ all views),notBeforefromsoa.minimum.endpoint.hosted.dns.appthrust.io(TTL from--hosted-endpoint-ttl).providers.hosted.*(default disabled,failwithout webhook/cert-manager), hosted-server Deployment/Service/RBAC,HOSTED_*flags, docs.Verification
task generate+ CRD sync clean;go build ./...,go vet ./...,go test ./... -count=1(with envtest assets, 0 skips) PASS; chart contract tests PASS including enabled/disabled parity and packaged-vs-embedded Provider manifest equality.Not exercised here: a real apiserver SSA merge for
status.servers[], and a live VIP; the platform's on-premises delegated DNS proof covers those (appthrust/platformdesign/platform/onprem/delegated-dns.md).