[scotwells]

Requested by Scot Schuchert-Wells

What

Backports #851 to release/v0.34, for a v0.34.3 patch release. The internal DNS controller labels each network's DNSResolverContext with networking.datumapis.com/network and networking.datumapis.com/network-uid. It also sets kubernetes.io/description: Private DNS for the <network> VPC and asks DNS to copy the labels to the managed zone (dns.networking.miloapis.com/managed-object-labels). Existing contexts are updated on the next pass, and failed writes are only logged.

Why

Production runs v0.34.2. Releasing from main would bring about 50 other PRs, including a Network mutating webhook production doesn't route yet. This patch carries only #851. dns-operator v0.13.0, already in production, copies these labels and the description onto each managed datum.internal zone, so the portal shows which VPC a zone is for.

The cherry-pick applies cleanly onto v0.34.2, and it builds and passes go test ./internal/controller/.

Related: datum-cloud/enhancements#921

[scotwells]

Review note: the diff is byte-identical to #851's merge diff on main (git diff 49d16c24^1 49d16c24 -- internal equals this branch's diff against release/v0.34). #851 had an adversarial review and two approvals, and has run in staging since 2026-11-03 ~19:55Z: 33 of 36 resolver contexts labelled and described; the 3 others belong to networks with no NetworkContext. Builds and passes go test ./internal/controller/ on the release branch.

[scotwells]

Closing, #851 will ship in v0.35.1 after v0.35.0 rolls out to production, instead of a v0.34.3 patch.