v0.13.0

DNS zones keep their apex records when delegations exist, record cleanup finishes in terminating namespaces, and services can own reserved names in private zones. Private DNS managed zones now say what they are for.

What's new

• Services own reserved DNS names. Reserved scopes in managed private zones come from DNS registrations instead of a hard-coded instances rule and publisher list. The Private DNS admission handler checks record sets against them. (#423)
• Managed private zones carry labels and a description. A managed zone and its association get app.kubernetes.io/managed-by: dns.networking.miloapis.com, the context labels named in dns.networking.miloapis.com/managed-object-labels, and the context's kubernetes.io/description. (#456)
• Removed serving members' stream consumers are pruned after six hours unread. (#457)

Fixes

• Default apex NS/SOA records are created even when a delegation already uses the name, and a zone is Programmed only with apex records. (#421)
• DNS record cleanup finishes in terminating namespaces. (#422)
• Private DNS: proven routing is kept during additive updates, resolver binding withdrawals are proven, ACKs are allowed after a no-change handoff, repeated addresses are allowed in completed withdrawals, and registrations keep progressing during concurrent creation. (#411, #427, #428, #431, #349)
• Private DNS performance: the selected zone is reused and zone apexes are indexed. (#409, #410)

Maintenance

• Builds on the Go 1.27 toolchain. (#445, #448)
• Security and dependency updates, and CI changes.

Changelog

• 28f925f Allow reserved record metadata cleanup and verify customer permissions
• 5320599 Check profile capture duration at the handler boundary
• 517b571 Enforce service-owned reservations through DNSRegistration policies
• 9337f99 Experiment with cached shared builds and expanded warm foundation
• 1f5c4a4 Give pinned bootstrap tasks an existing per-cluster kubeconfig
• cf66167 Keep reserved-scope migration notes with deployment configuration
• 7d22082 Merge approved lease metrics into moved Private DNS documentation
• 36ee767 Merge main into phase metrics while retaining reserved association checks
• a533122 Merge pull request #302 from datum-cloud/claude/project-thread-4mpadv
• e725ca5 Merge pull request #318 from datum-cloud/feat/zone-lease-takeover-metrics
• 7bf93d2 Merge pull request #349 from datum-cloud/codex/internal-dns-reference-create-races
• d470693 Merge pull request #359 from datum-cloud/polylane/autofix/0r2u5erei355
• 741cba9 Merge pull request #382 from datum-cloud/codex/private-dns-architecture-docs
• f4d87ac Merge pull request #393 from datum-cloud/renovate/go-golang.org-x-net-vulnerability
• 529134f Merge pull request #399 from datum-cloud/docs/zone-claim-settings
• 0100c2b Merge pull request #400 from datum-cloud/codex/private-dns-status-wording
• a2e0372 Merge pull request #406 from datum-cloud/ci/golangci-lint-tool
• fccee38 Merge pull request #407 from datum-cloud/ci/publish-once
• 0a0472b Merge pull request #408 from datum-cloud/codex/private-dns-project-phase-metrics
• 05d2356 Merge pull request #409 from datum-cloud/codex/private-dns-zone-lookup
• 2d98ebb Merge pull request #410 from datum-cloud/codex/private-dns-canonical-zone-index
• 5028087 Merge pull request #411 from datum-cloud/codex/private-dns-availability-validation
• b487f70 Merge pull request #412 from datum-cloud/codex/private-dns-activation-check
• 033c4f5 Merge pull request #421 from datum-cloud/codex/dns-apex-record-name-collision
• 1568b0e Merge pull request #422 from datum-cloud/codex/dns-record-termination-lifecycle
• 1bf4579 Merge pull request #423 from datum-cloud/codex/generic-reserved-scopes
• c9939eb Merge pull request #425 from datum-cloud/claude/project-thread-yyyk66
• 0b8037c Merge pull request #426 from datum-cloud/ci/task-entry-point
• 798d07c Merge pull request #427 from datum-cloud/codex/private-dns-network-deletion-424
• 6d5f978 Merge pull request #428 from datum-cloud/codex/accept-committed-snapshot-before-handoff
• 98cb15c Merge pull request #431 from datum-cloud/codex/allow-duplicate-binding-tombstones
• a3b3a88 Merge pull request #432 from datum-cloud/codex/dns-ci-foundation-timing
• 7d579be Merge pull request #433 from datum-cloud/codex/dns-warm-foundation-experiment
• a6a7fd9 Merge pull request #436 from datum-cloud/fix/generate-verify
• 3919c9c Merge pull request #437 from datum-cloud/fix/tidy-check
• 07d11c5 Merge pull request #439 from datum-cloud/renovate/actions-checkout-7.x
• 6aac4f6 Merge pull request #440 from datum-cloud/renovate/actions-setup-go-7.x
• 15a16d1 Merge pull request #441 from datum-cloud/renovate/datum-cloud-actions-1.x
• 060bfbb Merge pull request #445 from datum-cloud/chore/go-1.27-toolchain
• b142bf6 Merge pull request #447 from datum-cloud/ci/required-ci-check
• 303b60c Merge pull request #448 from datum-cloud/renovate/golang-1.x
• 5434bd6 Merge pull request #449 from datum-cloud/renovate/github.com-google-pprof-digest
• b456b9c Merge pull request #450 from datum-cloud/renovate/k8s.io-utils-digest
• f2e3e45 Merge pull request #451 from datum-cloud/renovate/fluxcd-flux2-2.x
• 63f7135 Merge pull request #452 from datum-cloud/renovate/actions-setup-python-7.x
• f42d4bb Merge pull request #453 from datum-cloud/renovate/zendesk-setup-jsonnet-17.x
• 59657cb Merge pull request #456 from datum-cloud/feat/managed-zone-context-labels
• 20d5f64 Merge pull request #457 from datum-cloud/feat/prune-retired-member-consumers
• 94f8727 Merge remote-tracking branch 'origin/main' into codex/dns-record-termination-lifecycle
• 03bc6a5 Overlap two isolated cluster and Flux bootstrap tasks
• 376dd5b Overlap warm foundation add-ons with subsequent cluster bootstrap
• 45938df Refactor managed DNS protection into configured reserved scopes
• c427558 Refresh lease metrics for graceful release and epoch takeover
• a0ba51d Repair reservation links after Private DNS document moves
• 7c19d44 Resolve documentation moves against current staging validation guidance
• 0791c91 Share lease metric result labels to satisfy current lint rules
• 49342e9 Use checksum-pinned tool releases in hosted E2E prerequisites
• 0ef045a Use warm foundation and shared image caches in ordinary PR E2E
• 7aa7fda Wait for post-response DNS metrics in integration test
• 5d97fcd chore(deps): update actions/checkout action to v7
• 82b9536 chore(deps): update actions/setup-go action to v7
• b4f5d52 chore(deps): update actions/setup-python action to v7
• 5168f27 chore(deps): update datum-cloud/actions action to v1.26.0
• 3345819 chore(deps): update fluxcd/flux2 action to v2.10.0
• 42e5d24 chore(deps): update golang docker tag to v1.27
• 9c1aa2a chore(deps): update module golang.org/x/net to v0.62.0 [security]
• 833c930 chore(deps): update zendesk/setup-jsonnet action to v17
• a8a2541 chore(private-dns): satisfy lint in managed zone metadata sync
• a45b310 ci: Add the required CI caller
• 36ec4e2 ci: Lint only code changed since main
• dde421e ci: Make Task the single build entry point
• 31fc7d5 ci: Pin golangci-lint as a Go tool
• 0f2aef5 ci: Publish a branch push once, not twice
• 4d6ff83 ci: Tighten generated-drift failure text
• 26d518a ci: build public DNS image once and seed S3 credentials before rollout
• 9d657f3 ci: consume a runner-prepared Kind foundation
• 22544e5 ci: export runner caches without sudo
• 7e6bc58 ci: fail when generated code drifts from source
• f8b7d98 ci: fail when go.mod or go.sum is not tidy
• a99047a ci: prototype single-use warm foundation handoff
• 94f1265 ci: qualify warm foundation handoff on a disposable runner
• 84b4e81 ci: reuse renderer and unchanged build caches
• b246718 ci: reuse the prebuilt qualification binary
• 69c57c6 ci: run isolated private and public DNS lanes concurrently
• 651b56a ci: separate DNS foundation setup and report phase timings
• bd9bb54 ci: skip Go cache transfers on layer hits
• e49db08 feat(private-dns): copy resolver context labels to its managed zone
• e01c17c feat(private-dns): copy the context description to its managed zone
• f6284dd feat(private-dns): mark managed zones with app.kubernetes.io/managed-by
• 0b78a71 feat: Count private zone lease takeovers
• 886c2d5 feat: Prune stream consumers of removed serving members
• 9b0d62a feat: add the datum-dns Claude Code plugin
• 23b234e feat: validate DNS activation before cleanup
• 551e861 fix(ci): simplify withdrawal reconciliation
• 4bd8575 fix(deps): update github.com/google/pprof digest to 0031fcd
• e2731db fix(deps): update k8s.io/utils digest to ca04ba5
• 2bd0dcb fix(internal-dns): accept committed snapshot after handoff
• a5cd1ea fix(internal-dns): allow repeated withdrawal addresses
• 2cee6bf fix(internal-dns): prove resolver binding withdrawals
• eee6029 fix(private-dns): copy only listed context labels, best effort
• 405c3e9 fix: Make consumer pruning safe for live members
• aa46f44 fix: Measure zone lease headroom at write time
• 0b4d69e fix: converge concurrent DNS reference creation
• f466c82 fix: fingerprint foundation tools after bootstrap upgrades
• ef9135b fix: handle downstream namespace termination across DNS replication
• f04c074 fix: let terminating DNS record shadows finish cleanup
• 3cb83b6 fix: preserve delegations when creating default apex records
• 1563b43 fix: recognize FQDN apex owners and exclude delegations from readiness
• 15d1f8c fix: recognize the activation check package role
• 50bc5c4 fix: restore control-plane project and zone phase timings
• bcca6be fix: retain proven routing during DNS updates
• 6cedcb4 perf: index private DNS zone apexes
• 23d2117 perf: reuse selected private DNS zone