Feature: Private DNS resolver support in the Landing Zone Accelerator and Configurator #100

Context

Track private DNS resolver support as a future enhancement, not as part of the current MVP.

The Accelerator currently supports:

• STACKIT regional DNS resolvers as defaults for Network Areas.
• Explicit resolver IP addresses through connectivity.network_area.default_nameservers / connectivity.network_areas[*].default_nameservers.
• Propagation of those addresses into Network Area and firewall external-network DNS configuration.
• DNS zone provisioning via stackit_dns_zone.

Configuring existing resolver IP addresses is not the same as provisioning and managing a private DNS resolver. There is currently no dedicated private resolver provisioning/lifecycle configuration in the Accelerator.

Relevant code:

• src/modules/connectivity/1-network-area.tf
• src/modules/connectivity/3-external-network.tf
• src/modules/connectivity/6-dns-zones.tf
• src/modules/connectivity/variables.tf

Goal

Provide an explicit, supported private DNS resolver path for Platform and Application Landing Zones, independently usable via Terraform/OpenTofu and surfaced consistently in the optional Configurator.

Proposed scope

• Investigate the available STACKIT private DNS/resolver service, API and pinned Terraform provider support; document prerequisites and limitations. Do not assume a specific service/resource exists.
• Distinguish existing external/private resolver IP configuration from managed private resolver provisioning.
• Define resolver placement, ownership and lifecycle per Network Area/region, including reachability and supported availability characteristics.
• Evaluate private-zone resolution and conditional forwarding to enterprise/on-premises DNS, where supported by the selected service.
• Wire resolver references/addresses into the existing Network Area DNS configuration and relevant Platform/Application contracts.
• Add Configurator schema, compiler, editor/assistant capability information and plan preview support for the supported path; clearly identify unsupported options.
• Preserve regional STACKIT resolver defaults and existing custom default_nameservers configurations when the feature is not enabled.

Acceptance criteria

• Supported service/API/provider capabilities and constraints are documented, including any external blockers.
• Private resolver support is reproducible through the standalone Accelerator, not dependent on the Configurator.
• Supported private DNS resolution is verified from an attached Application network; forwarding and isolation behavior are tested where applicable.
• Plan/apply/destroy behavior and resolver dependencies are covered by tests, with no unintended change to existing default/custom resolver behavior.
• Configurator proposals and plan previews accurately expose implemented support without claiming unavailable capabilities.
• Setup, networking prerequisites and operational troubleshooting are documented.

Related issues

• Feature: Private/SNA SKE cluster support with two-stage runner model #37: Private/SNA SKE clusters and runner reachability; related networking concerns, but not private resolver lifecycle support.
• Implement DNS #15: Existing DNS zone implementation; does not cover private resolver provisioning.