feat(route53): adoption-only private hosted zones via ZoneClass zoneType (#13)

ZoneClass parameters gain zoneType (Public default, Private). Private is
adoption-only: creation policy is forced to Deny, deletion policy to Retain,
and dns-api never creates, deletes, or VPC-associates private hosted zones.
Adoption verifies the observed zone type matches the class; status.provider.data
exposes the observed zoneType. Provider schema, chart, sample, docs, UI form
and detail view, and an env-gated kest lifecycle follow the same contract.

Author: reoring

README.md

@@ -6,7 +6,7 @@ It is useful when platform teams want to give application teams a safe DNS workf
 
 dns-api is currently focused on:
 
-- Amazon Route 53 public hosted zones
+- Amazon Route 53 public hosted zones, and adoption of existing private hosted zones
 - Cloudflare full zones
 - `A`, `AAAA`, `TXT`, `CNAME`, `MX`, `CAA`, and delegated `NS` records
 - Route 53 `ALIAS` records

app/operator/config/provider/route53_extensions.yaml

@@ -5,7 +5,7 @@ metadata:
 spec:
   display:
     name: Amazon Route 53
-    description: Public DNS zones and record sets managed through Route 53.
+    description: Public and adopted private DNS zones and record sets managed through Route 53.
     logo:
       url: https://cdn.jsdelivr.net/gh/glincker/thesvg@main/public/icons/aws-amazon-route-53/default.svg
   versions:
@@ -25,15 +25,21 @@ spec:
               type: object
               additionalProperties: false
               properties:
+                zoneType:
+                  type: string
+                  description: Route 53 hosted zone type. Defaults to Public. Private is adoption-only and requires zoneCreationPolicy Deny and zoneDeletionPolicy Retain; dns-api never creates, deletes, or manages VPC associations for private hosted zones.
+                  enum:
+                    - Public
+                    - Private
                 zoneCreationPolicy:
                   type: string
-                  description: Controls whether dns-api may create a Route 53 public hosted zone when a Zone does not adopt an existing hosted zone.
+                  description: Controls whether dns-api may create a Route 53 public hosted zone when a Zone does not adopt an existing hosted zone. Defaults to Create for Public and Deny for Private.
                   enum:
                     - Create
                     - Deny
                 zoneDeletionPolicy:
                   type: string
-                  description: Controls whether dns-api deletes the Route 53 hosted zone when the Kubernetes Zone is deleted.
+                  description: Controls whether dns-api deletes the Route 53 hosted zone when the Kubernetes Zone is deleted. Private requires Retain.
                   enum:
                     - Delete
                     - Retain
@@ -60,7 +66,7 @@ spec:
               properties:
                 hostedZoneId:
                   type: string
-                  description: Route 53 public hosted zone ID of the existing hosted zone to adopt.
+                  description: Route 53 hosted zone ID of the existing hosted zone to adopt. The zone must be public or private as declared by the ZoneClass zoneType.
                   pattern: '^Z[A-Z0-9]+$'
           statusProviderData:
             openAPIV3Schema:
@@ -71,6 +77,12 @@ spec:
                   type: string
                   description: Route 53 hosted zone ID managed for this Zone.
                   pattern: '^Z[A-Z0-9]+$'
+                zoneType:
+                  type: string
+                  description: Observed Route 53 hosted zone type.
+                  enum:
+                    - Public
+                    - Private
       recordSet:
         supportedTypes:
           - A

app/operator/config/samples/route53_private_zoneclass.yaml

@@ -0,0 +1,70 @@
+# Install the Route 53 Provider and create the tenant namespaces first.
+# Label tenant-a-app with appthrust.io/tenant: tenant-a.
+# Use an existing private hosted zone named internal.example.com with its VPC
+# associations already configured, and replace hostedZoneId with that zone's ID.
+apiVersion: route53.dns.appthrust.io/v1alpha1
+kind: Route53Identity
+metadata:
+  namespace: tenant-a-platform
+  name: route53-dev
+spec:
+  accountID: "123456789012"
+  region: ap-northeast-1
+  credentials:
+    runtime: {}
+---
+apiVersion: dns.appthrust.io/v1alpha1
+kind: ZoneClass
+metadata:
+  namespace: tenant-a-platform
+  name: route53-private
+spec:
+  allowedZones:
+    namespaces:
+      from: Selector
+      selector:
+        matchLabels:
+          appthrust.io/tenant: tenant-a
+  provider:
+    name: route53.dns.appthrust.io
+    version: v1alpha1
+  controllerName: route53.dns.appthrust.io/controller
+  identityRef:
+    name: route53-dev
+  parameters:
+    zoneType: Private
+    zoneCreationPolicy: Deny
+    zoneDeletionPolicy: Retain
+---
+apiVersion: dns.appthrust.io/v1alpha1
+kind: Zone
+metadata:
+  namespace: tenant-a-app
+  name: internal-example-com
+spec:
+  domainName: internal.example.com
+  provider:
+    name: route53.dns.appthrust.io
+    version: v1alpha1
+  zoneClassRef:
+    namespace: tenant-a-platform
+    name: route53-private
+  adoption:
+    hostedZoneId: Z10219583PPQMV0U1KGN2
+---
+apiVersion: dns.appthrust.io/v1alpha1
+kind: RecordSet
+metadata:
+  namespace: tenant-a-app
+  name: api
+spec:
+  zoneRef:
+    name: internal-example-com
+  provider:
+    name: route53.dns.appthrust.io
+    version: v1alpha1
+  type: CNAME
+  name: api
+  ttl: 300
+  cname:
+    target: control-plane.internal.example.com