Repository navigation
Manage Private DNS through the API #414
Description
Summary
Give customers and Datum services a consistent way to configure Private DNS and see whether their changes are ready to use.
Goal
Make the API predictable enough for customers, the CLI, and the Portal to use without needing to understand how DNS is operated internally.
Scope
Covers private zones, records, network associations, automatic names, permissions, and status. CLI and Portal interactions have their own epics.
Acceptance criteria
- The API supports creating and managing private zones and records, choosing which networks can use them, and allowing approved services to maintain names.
- Naming rules, reserved names, permissions, and responsibility for changing each field are documented and enforced.
- Status clearly distinguishes accepted changes from names that are actually available, and explains failures or delays.
- Tests cover supported operations, invalid requests, permission checks, and status changes.
- Compatibility and upgrade rules explain what customers and service integrations can rely on over time.
Activity
scotwells commentedon Oct 29, 2026
The Private DNS API foundation has merged. It defines the resources used to connect private networks to DNS and control which services can publish names. Work to allocate managed private domains and configure associations using resource names has also merged.
The remaining work is to finalize and document the supported contract, including naming rules, permissions, upgrades, and the meaning of each status. The publication status clarification remains open. This contract will give the CLI and Portal a consistent way to show users whether their names are ready and what needs attention.
[-]Private DNS APIs and resource model[/-][+]Manage Private DNS through the API[/+]scotwells commentedon Nov 4, 2026
Progress update: the publication status clarification has merged, along with reserving the
instancesscope in private zones and copying a resolver context's labels and description to its managed zone, so managed zones now show which network they belong to.Still needed to close: a documented and enforced API contract covering naming rules, reserved names, field ownership, permissions, and compatibility over time, with tests for each.
scotwells commentedon Nov 11, 2026
Done in dns-operator v0.14.0, now in production. The API contract (#476, #487, #493) documents naming rules, reserved names, field ownership, permissions, status and compatibility. The related fixes are in too: optional zone class (#479), service-owned resources kept out of DNS Admin (#480), cross-zone CNAMEs over UDP (#490), managed-zone lifecycle (#491, #496) and the per-network association limit (#492). CLI and Portal work continue under #419 and #420.