Add UI editing for local DNS zones

Local zones were only editable as mounted files, so operators could not manage DNS entries from the console. Add a Local zones editor backed by a shared Kubernetes ConfigMap, validate master files before saving, scope the pod service account to that ConfigMap, and reload changed zones on every replica while flushing stale cache entries.

internal/app/hooks.go

@@ -16,6 +16,7 @@ import (
 	"git.k8s-git-k6n.net/mats/fancy-dns/internal/metrics"
 	"git.k8s-git-k6n.net/mats/fancy-dns/internal/qlog"
 	"git.k8s-git-k6n.net/mats/fancy-dns/internal/resolver"
+	"git.k8s-git-k6n.net/mats/fancy-dns/internal/zonefile"
 )
 
 // hooks builds the api.Hooks that connect the admin API to the live
@@ -37,6 +38,9 @@ func (a *App) hooks() api.Hooks {
 		ListDomains:       a.listDomains,
 		AddDomain:         a.addDomain,
 		DeleteDomain:      a.deleteDomain,
+		LocalZones:        a.listLocalZones,
+		SaveLocalZone:     a.saveLocalZone,
+		DeleteLocalZone:   a.deleteLocalZone,
 		GetACL:            a.getACL,
 		PutACL:            a.putACL,
 		GetUpstream:       a.getUpstreams,
@@ -52,6 +56,70 @@ func (a *App) hooks() api.Hooks {
 	}
 }
 
+func (a *App) listLocalZones(ctx context.Context) ([]api.ZoneFile, error) {
+	if a.zones == nil {
+		return nil, fmt.Errorf("local zone editor is available only in Kubernetes")
+	}
+	zones, err := a.zones.List(ctx)
+	if err != nil {
+		return nil, err
+	}
+	out := make([]api.ZoneFile, 0, len(zones))
+	for _, z := range zones {
+		out = append(out, api.ZoneFile{Name: z.Name, Content: z.Content})
+	}
+	sort.Slice(out, func(i, j int) bool { return out[i].Name < out[j].Name })
+	return out, nil
+}
+
+func (a *App) saveLocalZone(ctx context.Context, name, content string) error {
+	if a.zones == nil {
+		return fmt.Errorf("local zone editor is available only in Kubernetes")
+	}
+	apex := strings.ToLower(dns.Fqdn(strings.TrimSuffix(strings.TrimSpace(name), ".")))
+	_, valid := dns.IsDomainName(apex)
+	if !valid || apex == "." || len(apex) > 243 {
+		return fmt.Errorf("invalid zone name %q", name)
+	}
+	if strings.TrimSpace(content) == "" {
+		return fmt.Errorf("zone file cannot be empty")
+	}
+	parsed, err := zonefile.Parse(strings.NewReader(content), zonefile.Options{Origin: apex, File: name + ".zone"})
+	if err != nil {
+		return fmt.Errorf("invalid zone file: %w", err)
+	}
+	if len(parsed.Records) == 0 {
+		return fmt.Errorf("zone file must contain at least one record")
+	}
+	for _, record := range parsed.Records {
+		owner := strings.ToLower(dns.Fqdn(record.Name))
+		if owner != strings.ToLower(apex) && !strings.HasSuffix(owner, "."+strings.ToLower(apex)) {
+			return fmt.Errorf("record %q is outside zone %s", owner, apex)
+		}
+	}
+	if err := a.zones.Save(ctx, strings.TrimSuffix(apex, "."), content); err != nil {
+		return err
+	}
+	if a.cache != nil {
+		a.cache.Flush()
+	}
+	return nil
+}
+
+func (a *App) deleteLocalZone(ctx context.Context, name string) error {
+	if a.zones == nil {
+		return fmt.Errorf("local zone editor is available only in Kubernetes")
+	}
+	name = strings.TrimSuffix(strings.TrimSpace(name), ".")
+	if err := a.zones.Delete(ctx, name); err != nil {
+		return err
+	}
+	if a.cache != nil {
+		a.cache.Flush()
+	}
+	return nil
+}
+
 // health is the unauthenticated probe payload.
 func (a *App) health() any {
 	status := "ok"