Split the console from the resolver: fancy-dns-console writes the cluster

fancy-dns-console is a second binary holding the web UI, authentication and
every edit. It writes ClientGroup, BlockList and DNSZone objects through the new
kubeedit package and forwards all other /api routes to a running resolver
with its own key, dropping the browser's credentials, so it can run in the
cluster or on a workstation with a kubeconfig and nothing about the resolver's
placement matters. The resolver never imports kubeedit and the console is not on
the DNS path.

kubeedit validates every spec with the runtime's own converters
(kubesource.CheckGroup/CheckList/CheckZone) before writing, so the console
cannot store an object the resolver would reject. Zone edits keep the
file-based writer's behaviour: duplicate and below-a-delegation records are
refused, a delegation in a new zone also gives the zone its servers, and a
zone with no apex NS is never stored. Each object records the editing user in
an annotation; updates retry on conflict.

The resolver reports groups from ClientGroup objects as source "kubernetes" and
counter-only rows (the "(default)" bucket, or a group removed since) as
"history", and lists DNSZone zones as the editable ones. The console uses that
to leave the YAML's groups alone and to drop history rows, which the UI would
otherwise send back on save. Its GET /api/clients overlays the cluster's
current objects on the resolver's list, because the resolver only sees an edit
after its watch fires and a save made just after another would delete the
first.

An end-to-end test runs both halves against one fake apiserver: a group saved
through the console refuses queries, a zone built record by record answers
authoritatively, and a request with the resolver's own key is rejected by the
console.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

internal/kubeedit/edit.go

@@ -0,0 +1,155 @@
+// Package kubeedit is the write side of the Kubernetes integration: the
+// console's edits become changes to ClientGroup, BlockList and DNSZone objects.
+//
+// It is the only code that writes to the cluster, and the runtime never
+// imports it. Every spec is validated with the runtime's own converters
+// (kubesource.Check*) before it is written, so the console cannot store an
+// object the runtime would reject.
+package kubeedit
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"reflect"
+	"sort"
+
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/validation"
+	"k8s.io/client-go/dynamic"
+	"k8s.io/client-go/util/retry"
+
+	"git.k8s-git-k6n.net/mats/fancy-dns/internal/kubesource"
+)
+
+// ActorAnnotation records who last changed an object through the console.
+const ActorAnnotation = "fancydns.k6n.net/last-edited-by"
+
+// ErrNotFound is returned when the object or record to change does not exist.
+var ErrNotFound = errors.New("not found")
+
+// Editor writes fancy-dns objects into one namespace.
+type Editor struct {
+	c  dynamic.Interface
+	ns string
+}
+
+// New returns an Editor for namespace ns.
+func New(c dynamic.Interface, ns string) *Editor { return &Editor{c: c, ns: ns} }
+
+// Namespace is where objects are written.
+func (e *Editor) Namespace() string { return e.ns }
+
+func (e *Editor) res(gvr schema.GroupVersionResource) dynamic.ResourceInterface {
+	return e.c.Resource(gvr).Namespace(e.ns)
+}
+
+func decodeSpec(u *unstructured.Unstructured, into any) error {
+	raw, _ := u.Object["spec"].(map[string]any)
+	if raw == nil {
+		return nil
+	}
+	return runtime.DefaultUnstructuredConverter.FromUnstructured(raw, into)
+}
+
+func encodeSpec(spec any) (map[string]any, error) {
+	// ToUnstructured wants a pointer; the specs are passed by value.
+	v := reflect.New(reflect.TypeOf(spec))
+	v.Elem().Set(reflect.ValueOf(spec))
+	return runtime.DefaultUnstructuredConverter.ToUnstructured(v.Interface())
+}
+
+func sameSpec(a, b any) bool {
+	x, _ := json.Marshal(a)
+	y, _ := json.Marshal(b)
+	return string(x) == string(y)
+}
+
+func checkName(kind, name string) error {
+	if errs := validation.IsDNS1123Subdomain(name); len(errs) > 0 {
+		return fmt.Errorf("%s name %q cannot be a Kubernetes object name (%s): use lowercase letters, digits, '-' and '.'", kind, name, errs[0])
+	}
+	return nil
+}
+
+func stamp(u *unstructured.Unstructured, actor string) {
+	ann := u.GetAnnotations()
+	if ann == nil {
+		ann = map[string]string{}
+	}
+	if actor != "" {
+		ann[ActorAnnotation] = actor
+	}
+	u.SetAnnotations(ann)
+	labels := u.GetLabels()
+	if labels == nil {
+		labels = map[string]string{}
+	}
+	labels["app.kubernetes.io/managed-by"] = "fancy-dns-console"
+	u.SetLabels(labels)
+}
+
+func newObject(kind, name string, spec any) (*unstructured.Unstructured, error) {
+	raw, err := encodeSpec(spec)
+	if err != nil {
+		return nil, err
+	}
+	return &unstructured.Unstructured{Object: map[string]any{
+		"apiVersion": kubesource.APIGroup + "/" + kubesource.Version,
+		"kind":       kind,
+		"metadata":   map[string]any{"name": name, "namespace": ""},
+		"spec":       raw,
+	}}, nil
+}
+
+// upsert creates the object or replaces its spec, retrying on conflict.
+func (e *Editor) upsert(ctx context.Context, gvr schema.GroupVersionResource, kind, name, actor string, spec any) (*unstructured.Unstructured, error) {
+	var out *unstructured.Unstructured
+	err := retry.RetryOnConflict(retry.DefaultRetry, func() error {
+		cur, err := e.res(gvr).Get(ctx, name, metav1.GetOptions{})
+		if apierrors.IsNotFound(err) {
+			obj, err := newObject(kind, name, spec)
+			if err != nil {
+				return err
+			}
+			obj.SetNamespace(e.ns)
+			stamp(obj, actor)
+			out, err = e.res(gvr).Create(ctx, obj, metav1.CreateOptions{})
+			return err
+		}
+		if err != nil {
+			return err
+		}
+		raw, err := encodeSpec(spec)
+		if err != nil {
+			return err
+		}
+		cur.Object["spec"] = raw
+		stamp(cur, actor)
+		out, err = e.res(gvr).Update(ctx, cur, metav1.UpdateOptions{})
+		return err
+	})
+	return out, err
+}
+
+func (e *Editor) remove(ctx context.Context, gvr schema.GroupVersionResource, name string) error {
+	err := e.res(gvr).Delete(ctx, name, metav1.DeleteOptions{})
+	if apierrors.IsNotFound(err) {
+		return fmt.Errorf("%w: %s", ErrNotFound, name)
+	}
+	return err
+}
+
+func (e *Editor) list(ctx context.Context, gvr schema.GroupVersionResource) ([]unstructured.Unstructured, error) {
+	l, err := e.res(gvr).List(ctx, metav1.ListOptions{})
+	if err != nil {
+		return nil, err
+	}
+	sort.Slice(l.Items, func(i, j int) bool { return l.Items[i].GetName() < l.Items[j].GetName() })
+	return l.Items, nil
+}