Enable private DNS resolution for networks

NOTICE

@@ -9355,10 +9355,10 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ```
 
-## go.datum.net/galactic/api/cloud/v1alpha1
+## go.datum.net/galactic/api
 
-* Name: go.datum.net/galactic/api/cloud/v1alpha1
-* Version: v0.5.8-0.20261016143526-45d3c3514bec
+* Name: go.datum.net/galactic/api
+* Version: v0.6.3-0.20261021151056-bb0b4c057338
 * License: AGPL-3.0
 
 ```
@@ -10038,7 +10038,7 @@ For more information on this, and how to apply and follow the GNU AGPL, see
 ## go.miloapis.com/ipam/pkg/apis/ipam
 
 * Name: go.miloapis.com/ipam/pkg/apis/ipam
-* Version: v0.4.0
+* Version: v0.5.1
 * License: Unknown
 
 ```
@@ -10048,7 +10048,7 @@ For more information on this, and how to apply and follow the GNU AGPL, see
 ## go.miloapis.com/ipam/pkg/apis/ipam/v1alpha1
 
 * Name: go.miloapis.com/ipam/pkg/apis/ipam/v1alpha1
-* Version: v0.4.0
+* Version: v0.5.1
 * License: Unknown
 
 ```
@@ -10058,7 +10058,7 @@ For more information on this, and how to apply and follow the GNU AGPL, see
 ## go.miloapis.com/ipam/pkg/ipamerrors
 
 * Name: go.miloapis.com/ipam/pkg/ipamerrors
-* Version: v0.4.0
+* Version: v0.5.1
 * License: Unknown
 
 ```
@@ -15151,7 +15151,7 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 ## google.golang.org/genproto/googleapis/rpc
 
 * Name: google.golang.org/genproto/googleapis/rpc
-* Version: v0.0.0-20261005182115-fad411399dd8
+* Version: v0.0.0-20261019180522-ce908d29299b
 * License: Apache-2.0
 
 ```
@@ -19626,7 +19626,7 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 ## sigs.k8s.io/json
 
 * Name: sigs.k8s.io/json
-* Version: v0.0.0-20250730193827-2d320260d730
+* Version: v0.0.0-20260909141634-11ed52e25bc5
 * License: Apache-2.0
 
 ```

api/v1alpha/internaldns_types.go

@@ -0,0 +1,91 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+
+package v1alpha
+
+// +kubebuilder:validation:Enum=Managed;Disabled
+type NetworkDNSMode string
+
+const (
+	NetworkDNSModeManaged  NetworkDNSMode = "Managed"
+	NetworkDNSModeDisabled NetworkDNSMode = "Disabled"
+)
+
+// NetworkDNSPolicy selects managed resolver access for a network.
+type NetworkDNSPolicy struct {
+	// Mode controls whether network services maintain private resolver access.
+	// An empty value uses Managed when the Internal DNS feature is enabled.
+	//
+	// +kubebuilder:validation:Optional
+	Mode NetworkDNSMode `json:"mode,omitempty"`
+}
+
+// NetworkDNSObjectReference identifies a DNS resource by name.
+type NetworkDNSObjectReference struct {
+	// Name is the resource name in the network's namespace.
+	//
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MinLength=1
+	Name string `json:"name"`
+}
+
+type NetworkDNSResolverSettings struct {
+	// +kubebuilder:validation:MinItems=1
+	// +kubebuilder:validation:MaxItems=3
+	// +kubebuilder:validation:XValidation:rule="self.all(n, isIP(n))",message="nameservers must contain IP addresses"
+	Nameservers []string `json:"nameservers"`
+	// +kubebuilder:validation:MaxItems=6
+	Searches []string `json:"searches,omitempty"`
+}
+
+// NetworkDNSSettings are verified resolver settings inherited by interfaces.
+type NetworkDNSSettings struct {
+	// ContextRef identifies the DNS serving and namespace lifetime.
+	//
+	// +kubebuilder:validation:Required
+	ContextRef NetworkDNSObjectReference `json:"contextRef"`
+
+	// AccessBindingRef identifies the regional DNS configuration.
+	//
+	// +kubebuilder:validation:Required
+	AccessBindingRef NetworkDNSObjectReference `json:"accessBindingRef"`
+
+	// Nameservers are resolver addresses reachable from this network.
+	//
+	// +kubebuilder:validation:MinItems=1
+	// +kubebuilder:validation:MaxItems=3
+	// +kubebuilder:validation:XValidation:rule="self.all(n, isIP(n))",message="nameservers must contain IP addresses"
+	Nameservers []string `json:"nameservers"`
+
+	// Searches contains DNS search suffixes allocated to this network.
+	//
+	// +kubebuilder:validation:MaxItems=6
+	Searches []string `json:"searches,omitempty"`
+}
+
+// NetworkDNSAccessStatus reports the private path verified for one context.
+type NetworkDNSAccessStatus struct {
+	// ContextRef identifies the DNS context used for the proof.
+	ContextRef NetworkDNSObjectReference `json:"contextRef"`
+
+	// AccessBindingRef identifies the DNS configuration used for the proof.
+	AccessBindingRef NetworkDNSObjectReference `json:"accessBindingRef"`
+
+	// ServiceDestination identifies this DNS context inside the shared service.
+	//
+	// +kubebuilder:validation:XValidation:rule="isIP(self)",message="serviceDestination must be an IP address"
+	ServiceDestination string `json:"serviceDestination"`
+}
+
+const (
+	NetworkContextDNSReady = "DNSReady"
+
+	NetworkContextDNSReadyReasonReady                 = "Ready"
+	NetworkContextDNSReadyReasonDisabled              = "Disabled"
+	NetworkContextDNSReadyReasonPending               = "Pending"
+	NetworkContextDNSReadyReasonAccessAbsent          = "AccessAbsent"
+	NetworkContextDNSReadyReasonNetworkPathNotReady   = "NetworkPathNotReady"
+	NetworkContextDNSReadyReasonNetworkIdentityAbsent = "NetworkIdentityAbsent"
+
+	NetworkInterfaceDNSConfiguredReasonApplied                     = "Applied"
+	NetworkInterfaceDNSConfiguredReasonUnsupportedMultipleContexts = "UnsupportedMultipleContexts"
+)

api/v1alpha/network_types.go

@@ -16,6 +16,10 @@ const (
 
 // NetworkSpec defines the desired state of a Network
 type NetworkSpec struct {
+	// DNS configures private resolver access for the network.
+	//
+	// +kubebuilder:validation:Optional
+	DNS NetworkDNSPolicy `json:"dns,omitempty"`
 
 	// IPAM settings for the network.
 	//

api/v1alpha/networkcontext_types.go

@@ -43,6 +43,12 @@ type NetworkContextSpec struct {
 	//
 	// +kubebuilder:validation:Optional
 	NetworkGeneration int64 `json:"networkGeneration,omitempty"`
+
+	// DNS contains resolver settings whose DNS authorization and private path
+	// have both been verified for this location.
+	//
+	// +kubebuilder:validation:Optional
+	DNS *NetworkDNSSettings `json:"dns,omitempty"`
 }
 
 // NetworkContextStatus defines the observed state of NetworkContext
@@ -55,6 +61,12 @@ type NetworkContextStatus struct {
 	//
 	// +kubebuilder:validation:Optional
 	IPAM *NetworkContextIPAMStatus `json:"ipam,omitempty"`
+
+	// DNSAccess identifies the current private path proof. DNSReady=True applies
+	// only to this exact context, binding revision, and deadline.
+	//
+	// +kubebuilder:validation:Optional
+	DNSAccess *NetworkDNSAccessStatus `json:"dnsAccess,omitempty"`
 }
 
 // NetworkContextIPAMStatus reports what IPAM holds for a network in one

api/v1alpha/networkinterface_types.go

@@ -113,6 +113,10 @@ const (
 	// interface at all. A phase of Available means no claim holds it, which is
 	// the opposite of anything being available to serve.
 	NetworkInterfaceHolderAvailable = "HolderAvailable"
+
+	// NetworkInterfaceDNSConfigured is reported by the provider after applying
+	// the current settings in spec.dns to the workload.
+	NetworkInterfaceDNSConfigured = "DNSConfigured"
 )
 
 const (
@@ -342,6 +346,9 @@ type NetworkInterfaceSpec struct {
 // claim holds it, what realizes it on the data plane, and whether programming
 // has succeeded.
 type NetworkInterfaceStatus struct {
+	// DNS contains effective resolver settings inherited from the network.
+	// +kubebuilder:validation:Optional
+	DNS *NetworkDNSResolverSettings `json:"dns,omitempty"`
 	// phase reports whether a claim holds the interface. Bound means the claim in
 	// spec.claimRef holds it. Available means it is retained and holding its
 	// addresses with no claim bound.

config/components/cell-controllers/config.yaml

@@ -1,5 +1,17 @@
 apiVersion: apiserver.config.datumapis.com/v1alpha1
 kind: CellControllerManager
+# Internal DNS is an alpha network integration and remains off until the
+# shared resolver attachments are configured for this cell.
+internalDNS:
+  # Enables private resolver route programming and readiness reporting.
+  enabled: false
+  # Presents the same resolver address inside each consumer VPC.
+  # frontend: fd53::53
+  # Allocates one stable service destination from this prefix per DNS context.
+  # servicePrefix: fd70:100::/64
+  # Selects the shared resolver attachments that serve authorized VPCs.
+  # producerAttachmentSelector:
+  #   service.datum.net/internal-dns: "true"
 metricsServer:
   bindAddress: ":8443"
 ipam: