The required feature described as a wish
Currently, a DNS server can only be set up for the calling account/domain, there is no way for a root admin to configure one on behalf of a different account or domain, and no way for a DNS server to belong to a project.
As a root admin, I would like to be able to:
- Set up a DNS server on behalf of a specific user/account
- Set up a DNS server on behalf of a specific domain
- Attach a DNS server to a project
Additional constraint:
- If a DNS server was set up by root admin on behalf of a user/domain, that user/domain should not be able to modify its URL themselves. Only root admin (or whoever provisioned it) should be able to change it.
Motivation:
Asks 1 and 2 are primarily driven by the recent restriction that only root admin can configure a DNS server on a private/internal (RFC1918) address, domain admins and regular users can no longer do so directly (see PR #13821). Without a way for root admin to provision such a server on behalf of another account/domain, that use case is lost entirely for non-root-admin users.
Ask 3 (project support) wasn't part of the initial scope for this feature. It's being tracked here as a follow-up enhancement rather than a gap in the original design.
Ask 4 follows directly from 1 and 2: if the owning user/domain could freely change the URL afterward, they could redirect an admin-provisioned DNS server anywhere they like, defeating the purpose of restricting private-address setup to root admin in the first place.
The required feature described as a wish
Currently, a DNS server can only be set up for the calling account/domain, there is no way for a root admin to configure one on behalf of a different account or domain, and no way for a DNS server to belong to a project.
As a root admin, I would like to be able to:
Additional constraint:
Motivation:
Asks 1 and 2 are primarily driven by the recent restriction that only root admin can configure a DNS server on a private/internal (RFC1918) address, domain admins and regular users can no longer do so directly (see PR #13821). Without a way for root admin to provision such a server on behalf of another account/domain, that use case is lost entirely for non-root-admin users.
Ask 3 (project support) wasn't part of the initial scope for this feature. It's being tracked here as a follow-up enhancement rather than a gap in the original design.
Ask 4 follows directly from 1 and 2: if the owning user/domain could freely change the URL afterward, they could redirect an admin-provisioned DNS server anywhere they like, defeating the purpose of restricting private-address setup to root admin in the first place.