Address review findings for managed ingress DNS

[typeid]

Addresses the review of openshift#9348 (managed ingress DNS). One commit per finding.

Finding 1 (P1): CPO IAM policy scoped unless managed DNS is enabled

controlPlaneOperatorPolicy now takes the local zone and the --managed-dns option, mirroring ingressPermPolicy.

• Managed DNS off: same policy as before managed DNS. Record access is scoped to the local zone; shared-VPC clusters get no Route53 access.
• Managed DNS on: hosted-zone create/delete/tag plus record access on all zones, as before.

IAM is written by the CLI when the cluster is created and is not reconciled from the spec. This is the same convention as the KMS key policy; a mismatch fails with AccessDenied, surfaced on the AWSManagedDNSAvailable condition. The delegating client is still generated from the managed-DNS superset, so delegating_client.go is unchanged.

Finding 2 (P1): private zones adopted only if associated with the cluster VPC

CreatePrivateHostedZone used to reuse the first private zone with a matching name. It now lists the same-name private zones, calls GetHostedZone on each, and returns only the one associated with the cluster VPC and region. This applies both before creating and after a create conflict. Route53 does not allow a VPC to be associated with two private zones of the same name, so at most one zone can match, and a concurrent create (ConflictingDomainExists) resolves to the same zone. No new IAM permissions are needed.

This matches the existing ownership model: destroy infra deletes every private zone on the cluster VPC, and the existing by-name lookups in create infra and the CPO have no VPC check. Public ingress zones are still adopted by name. Their name is specific to the cluster ({prefix}.{clusterBaseDomain}), and clusters sharing a base domain are unsupported regardless, since their apps/API names would also collide.

Finding 3 (P1): not addressed

Managed DNS clusters publish the KAS as a Route (LoadBalancer is legacy on AWS), so there is a single private-router AWSEndpointService. Endpoint deletion therefore only happens at teardown or when switching to Public, and in both cases nothing else uses the local zone. Moving zone ownership to the HCP finalizer is left as a follow-up.

Finding 4 (P2): ingress prefix immutable

• ingressDomainPrefix: self == oldSelf.
• AWSPlatformSpec: a rule tied to the AWSManagedDNS gate, has(oldSelf.managedDNS) == has(self.managedDNS), so the prefix cannot be changed by removing and re-adding managedDNS. It follows the existing EtcdSharding shards rule. As a result, managed DNS can only be chosen when the cluster is created.
• The field docs say so. Only the TechPreview/Custom CRDs change; the Default CRDs are untouched.

Testing

• go test for cmd/infra/aws, support/awsutil, support/globalconfig, controllers/awsprivatelink and controllers/hostedcontrolplane.
  • New TestControlPlaneOperatorPolicy (sharedVPC × managedDNS).
  • New TestCreatePrivateHostedZone cases: zone on another VPC, same VPC ID in another region, several same-name zones, a candidate deleted during lookup, a GetHostedZone error, a concurrent create resolved through ConflictingDomainExists, and a conflict with no zone on our VPC.
• Envtest (OCP, K8s 1.36.2): the managed DNS suite passes 38/38, with new update cases for prefix change, managedDNS add/remove, and an allowed delegation change, on both TechPreview and Custom.
• make verify-quick (generate + update): no further diff after regenerating the aggregated docs. make api-lint passes.
• Not run: the rest of make verify (staticcheck, lint, CRD schema check), e2e, or anything against live AWS.

🤖 Generated with Claude Code