migrate: read the live address overrides from the zones ConfigMap, not the seed

The old console kept the zone files and the live address-overrides.rpz in the
same fancy-dns-zones ConfigMap; fancy-dns-rpz was only the static seed the
overrides started from. Reading the live cluster showed the two had diverged
(6 entries against 5, the missing one being stackship.k6n.net), so the default
would have silently dropped a redirect. The default is now fancy-dns-zones, and
the test puts a different stale seed in fancy-dns-rpz so reading the wrong one
fails.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

cmd/fancy-dns-console/migrate.go

@@ -41,7 +41,7 @@ func migrateMain(args []string, stdout, stderr io.Writer) error {
 		kubeconfig  = fs.String("kubeconfig", os.Getenv("FANCYDNS_KUBECONFIG"), "kubeconfig (default: in-cluster, then $KUBECONFIG, then ~/.kube/config)")
 		kubeContext = fs.String("kube-context", os.Getenv("FANCYDNS_KUBE_CONTEXT"), "kubeconfig context")
 		zonesCM     = fs.String("zones-configmap", "fancy-dns-zones", "ConfigMap holding the zone--<apex>.zone files (\"\" to skip)")
-		rpzCM       = fs.String("rpz-configmap", "fancy-dns-rpz", "ConfigMap holding the address-overrides RPZ (\"\" to skip)")
+		rpzCM       = fs.String("rpz-configmap", "fancy-dns-zones", "ConfigMap holding the address-overrides RPZ (\"\" to skip). The old console kept it in the same ConfigMap as the zone files; fancy-dns-rpz was only the seed it started from")
 		rpzKey      = fs.String("rpz-key", "address-overrides.rpz", "key of the RPZ in that ConfigMap")
 		zonesDir    = fs.String("zones-dir", "", "read zone files from this directory (<apex>.zone) instead of the ConfigMap")
 		rpzFile     = fs.String("rpz-file", "", "read the address-overrides RPZ from this file instead of the ConfigMap")

cmd/fancy-dns-console/migrate_test.go

@@ -58,8 +58,11 @@ func useClient(t *testing.T, c dynamic.Interface) {
 // wrote, prints manifests without touching anything, and then applies them.
 func TestMigrateFromTheClusterThenApply(t *testing.T) {
 	c := fakeCluster(
-		configMap("dns", "fancy-dns-zones", map[string]any{"zone--home.example.com.zone": zone, "unrelated": "x"}),
-		configMap("dns", "fancy-dns-rpz", map[string]any{"address-overrides.rpz": rpz}),
+		// The old console kept the zone files and the live overrides in one
+		// ConfigMap; fancy-dns-rpz was only the seed it started from, and is
+		// deliberately different here so reading the wrong one fails.
+		configMap("dns", "fancy-dns-zones", map[string]any{"zone--home.example.com.zone": zone, "address-overrides.rpz": rpz, "unrelated": "x"}),
+		configMap("dns", "fancy-dns-rpz", map[string]any{"address-overrides.rpz": "$TTL 60\nstale-seed.example A 10.0.0.1\n"}),
 	)
 	useClient(t, c)
 
@@ -81,9 +84,15 @@ func TestMigrateFromTheClusterThenApply(t *testing.T) {
 	if err := migrateMain([]string{"-kube-namespace", "dns", "-apply"}, &out, &errb); err != nil {
 		t.Fatalf("apply: %v\n%s", err, errb.String())
 	}
-	if l, _ := c.Resource(kubesource.OverrideGVR).Namespace("dns").List(context.Background(), metav1.ListOptions{}); len(l.Items) != 2 {
+	l, _ := c.Resource(kubesource.OverrideGVR).Namespace("dns").List(context.Background(), metav1.ListOptions{})
+	if len(l.Items) != 2 {
 		t.Fatalf("%d overrides applied, want 2", len(l.Items))
 	}
+	for _, it := range l.Items {
+		if strings.Contains(it.GetName(), "stale-seed") {
+			t.Fatal("the stale seed ConfigMap was read instead of the live one")
+		}
+	}
 	if l, _ := c.Resource(kubesource.ZoneGVR).Namespace("dns").List(context.Background(), metav1.ListOptions{}); len(l.Items) != 1 {
 		t.Fatalf("%d zones applied, want 1", len(l.Items))
 	}
@@ -91,7 +100,7 @@ func TestMigrateFromTheClusterThenApply(t *testing.T) {
 		t.Errorf("no reassurance in the report:\n%s", errb.String())
 	}
 	// The ConfigMaps are exactly as they were.
-	cm, err := c.Resource(configMaps).Namespace("dns").Get(context.Background(), "fancy-dns-rpz", metav1.GetOptions{})
+	cm, err := c.Resource(configMaps).Namespace("dns").Get(context.Background(), "fancy-dns-zones", metav1.GetOptions{})
 	if err != nil || cm.Object["data"].(map[string]any)["address-overrides.rpz"] != rpz {
 		t.Fatalf("the source ConfigMap changed: %v %v", cm, err)
 	}