Repository navigation
Connect private networks to Private DNS automatically #777
Description
Summary
Make Private DNS available to workloads on a VPC without requiring customers to configure DNS servers themselves.
Goal
Automatically connect an approved private network to the DNS service and give its workloads the settings they need to resolve names.
Scope
Uses Galactic’s Private Service Connect capability. This epic owns the DNS-specific network setup and workload configuration.
Acceptance criteria
- Associating a VPC with Private DNS establishes access to the intended DNS service, and removing that association withdraws access.
- Supported workloads automatically receive DNS server addresses and the settings needed to use short private names.
- Enabling and disabling Private DNS has documented behavior for both new and existing networks.
- Only authorized components can change the settings that determine which network’s DNS answers a workload receives.
- Multiple DNS servers and traffic sharing across healthy servers continue to work during upgrades, access removal, and network recreation.
Activity
scotwells commentedon Oct 29, 2026
Automatic resolver configuration for private networks has merged. It allows workloads to receive the DNS settings for their network automatically. Support for giving instances more than one resolver has also merged, alongside fixes for network readiness and lifecycle handling.
The main follow-ups are to protect the internal settings that select a network’s DNS view and serve one DNS address through several healthy resolvers. The latter uses Galactic’s Private Service Connect capability and should reduce dependence on how individual applications retry failed lookups. These behaviors still need to be verified together before wider rollout.
[-]VPC integration and automatic resolver configuration[/-][+]Connect private networks to Private DNS automatically[/+]scotwells commentedon Nov 4, 2026
Progress update: networks now receive Private DNS resolver settings automatically, and only the operator can change those settings on a network context. Resolver contexts are now labeled and described by their network.
Still needed to close: protecting the internal DNS annotations, the remaining permission and enablement decisions, serving one DNS address from several healthy resolvers, and delivering the resolver settings to workloads.
scotwells commentedon Nov 12, 2026
Closing. Networks now connect to Private DNS automatically in production: they get resolver settings, only the operator can change them, and access follows the network's DNS association. Several healthy DNS servers share one address, and that held through the production failover test on 11 Nov. Zero-gap upgrades in single-host regions are tracked separately.
Generated by Claude Code