Add UI editing for local DNS zones

Local zones were only editable as mounted files, so operators could not manage DNS entries from the console. Add a Local zones editor backed by a shared Kubernetes ConfigMap, validate master files before saving, scope the pod service account to that ConfigMap, and reload changed zones on every replica while flushing stale cache entries.

deploy/k8s/05-serviceaccount.yaml

@@ -1,7 +1,6 @@
-# A stable identity for the pods. The server never talks to the Kubernetes API
-# (blocklist replication goes through Valkey, not the API server), so the token
-# is not just unused but actively undesirable: automounting it would hand every
-# pod a credential it has no reason to hold.
+# The UI edits the shared `fancy-dns-zones` ConfigMap. Its projected volume is
+# read-only; these narrowly scoped permissions let the API update only that
+# one ConfigMap so both DNS replicas receive the same records.
 apiVersion: v1
 kind: ServiceAccount
 metadata:
@@ -9,4 +8,29 @@ metadata:
   namespace: dns
   labels:
     app.kubernetes.io/name: fancy-dns
-automountServiceAccountToken: false
+automountServiceAccountToken: true
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: fancy-dns-zones
+  namespace: dns
+rules:
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    resourceNames: ["fancy-dns-zones"]
+    verbs: ["get", "patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: fancy-dns-zones
+  namespace: dns
+subjects:
+  - kind: ServiceAccount
+    name: fancy-dns
+    namespace: dns
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: fancy-dns-zones

deploy/k8s/06-zones.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: fancy-dns-zones
+  namespace: dns
+  labels:
+    app.kubernetes.io/name: fancy-dns
+    app.kubernetes.io/component: local-zones
+# Leave data unmanaged by GitOps. The Local zones page writes one
+# zone--<apex>.zone
+# key per zone through the API; server-side apply preserves those user fields.

deploy/k8s/10-deployment.yaml

@@ -27,6 +27,7 @@ spec:
       annotations:
         k8s-helper.io/git-url: "https://git.k6n.net/mats/fancy-dns"
         k8s-helper.io/git-ssh: "git@git.k6n.net:mats/fancy-dns.git"
+        dns.k6n.net/zones-api: "enabled"
         # A config change is a SIGHUP, not a restart: the server re-reads the
         # file and hot-swaps every component. This annotation is for
         # stakater/reloader-class controllers; without one, `kubectl rollout
@@ -152,15 +153,13 @@ spec:
         - name: config
           configMap:
             name: fancy-dns-config
-    # Local zones are ordinary master files; ship them in a ConfigMap or
-    # edit them in the mounted volume. There is no zone API — the admin API
-    # drives blocklists, the cache and the query log, not the zone files.
-        # the data volume. Optional because the glob in the config matches
-        # nothing cleanly.
+        # Local zones are ordinary master files. The API writes them to the
+        # shared ConfigMap, which projects one zone--<apex>.zone file per zone here.
+        # The GitOps manifest creates the ConfigMap empty; the UI owns its data.
         - name: zones
           configMap:
             name: fancy-dns-zones
-            optional: true
+            optional: false
         - name: tls
           secret:
             secretName: fancy-dns-tls

deploy/k8s/kustomization.yaml

@@ -11,6 +11,7 @@ namespace: dns
 resources:
   - 00-config.yaml
   - 05-serviceaccount.yaml
+  - 06-zones.yaml
   - 10-deployment.yaml
   - 20-service.yaml
   - 30-ingress.yaml