Remove the ConfigMap, RPZ and managed-directory editors the cluster objects replace
Zones, address redirects, inline rules, lists and groups are cluster objects now (see the previous commits and deploy/MIGRATION.md), so the mechanisms that held them are gone: * internal/kubezones and the resolver's service-account access to a ConfigMap, the address-overrides read/write path and its poller, the zone-file poller and the Local zones editor with its /api/local-zones routes. * localzone.Managed, the directory of console-written master files, and the blocklist.managed_zones key. The resolver now writes no zone data at all; its zone hooks only list. The shared half of that file (the record validator, the renderer and the round-trip check) stays as zonestate.go, because DNSZone rendering is built on it. Its tests are ported to RenderZone, which keeps the coverage of every editable record type, wildcards, relative owners, the SOA/NS rule and the delegation rule. * Tests of the removed write paths: the contract test now builds its zone from a DNSZone, and a new test pins that every zone write route on the resolver is refused and changes nothing. Standalone installs keep editing master files on disk and SIGHUP, and the YAML-backed domain, client, upstream and settings editors, which have not moved. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This commit is contained in:
matsandClaude Sonnet 5.5 committed
1 parent
2f25463347
commit
467733a7f9
21 files changed
+505
-2312
No files matched your search
+24
-187
@@ -17,49 +17,36 @@ import (
|
||||
"git.k8s-git-k6n.net/mats/fancy-dns/internal/config"
|
||||
"git.k8s-git-k6n.net/mats/fancy-dns/internal/engine"
|
||||
"git.k8s-git-k6n.net/mats/fancy-dns/internal/resolver"
|
||||
"git.k8s-git-k6n.net/mats/fancy-dns/internal/zonefile"
|
||||
)
|
||||
|
||||
// hooks builds the api.Hooks that connect the admin API to the live
|
||||
// components. Everything the UI can read or change goes through here.
|
||||
func (a *App) hooks() api.Hooks {
|
||||
return api.Hooks{
|
||||
Store: a.cfg,
|
||||
Logger: a.log,
|
||||
Version: a.ver,
|
||||
StartedAt: a.startedAt,
|
||||
Status: a.status,
|
||||
Health: a.health,
|
||||
BlocklistState: a.blocklistState,
|
||||
BlocklistStats: a.blocklistStats,
|
||||
RefreshBlocklists: a.refreshBlocklists,
|
||||
ToggleBlocklist: a.toggleBlocklist,
|
||||
DomainCheck: a.domainCheck,
|
||||
Resolve: a.resolveTest,
|
||||
ResolveUpstream: a.resolveTestUpstream,
|
||||
AddressOverrides: a.listAddressOverrides,
|
||||
SaveAddressOverride: a.saveAddressOverride,
|
||||
DeleteAddressOverride: a.deleteAddressOverride,
|
||||
ListDomains: a.listDomains,
|
||||
AddDomain: a.addDomain,
|
||||
DeleteDomain: a.deleteDomain,
|
||||
ListZones: a.listZones,
|
||||
AddZoneRecord: a.addZoneRecord,
|
||||
PutZoneRecord: a.putZoneRecord,
|
||||
DeleteZoneRecord: a.deleteZoneRecord,
|
||||
DeleteZone: a.deleteZone,
|
||||
AddZoneDelegation: a.addZoneDelegation,
|
||||
DeleteZoneDelegation: a.deleteZoneDelegation,
|
||||
LocalZones: a.listLocalZones,
|
||||
SaveLocalZone: a.saveLocalZone,
|
||||
DeleteLocalZone: a.deleteLocalZone,
|
||||
GetACL: a.getACL,
|
||||
PutACL: a.putACL,
|
||||
GetUpstream: a.getUpstreams,
|
||||
PutUpstream: a.putUpstream,
|
||||
CacheStats: a.cacheStats,
|
||||
FlushCache: a.flushCache,
|
||||
Flush: a.flush,
|
||||
Store: a.cfg,
|
||||
Logger: a.log,
|
||||
Version: a.ver,
|
||||
StartedAt: a.startedAt,
|
||||
Status: a.status,
|
||||
Health: a.health,
|
||||
BlocklistState: a.blocklistState,
|
||||
BlocklistStats: a.blocklistStats,
|
||||
RefreshBlocklists: a.refreshBlocklists,
|
||||
ToggleBlocklist: a.toggleBlocklist,
|
||||
DomainCheck: a.domainCheck,
|
||||
Resolve: a.resolveTest,
|
||||
ResolveUpstream: a.resolveTestUpstream,
|
||||
ListDomains: a.listDomains,
|
||||
AddDomain: a.addDomain,
|
||||
DeleteDomain: a.deleteDomain,
|
||||
ListZones: a.listZones,
|
||||
GetACL: a.getACL,
|
||||
PutACL: a.putACL,
|
||||
GetUpstream: a.getUpstreams,
|
||||
PutUpstream: a.putUpstream,
|
||||
CacheStats: a.cacheStats,
|
||||
FlushCache: a.flushCache,
|
||||
Flush: a.flush,
|
||||
}
|
||||
}
|
||||
|
||||
@@ -99,156 +86,6 @@ func (a *App) resolveTestUpstream(ctx context.Context, name, qtype, upstream str
|
||||
return out, nil
|
||||
}
|
||||
|
||||
type addressOverride struct {
|
||||
Domain string `json:"domain"`
|
||||
Address string `json:"address"`
|
||||
}
|
||||
|
||||
func (a *App) listAddressOverrides(ctx context.Context) (any, error) {
|
||||
if a.zones == nil {
|
||||
return map[string]any{"items": []addressOverride{}, "writable": false}, nil
|
||||
}
|
||||
raw, ok, err := a.zones.Data(ctx, "address-overrides.rpz")
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
items := parseAddressOverrides(raw)
|
||||
return map[string]any{"items": items, "writable": true, "initialized": ok}, nil
|
||||
}
|
||||
func parseAddressOverrides(raw string) []addressOverride {
|
||||
out := []addressOverride{}
|
||||
for _, line := range strings.Split(raw, "\n") {
|
||||
f := strings.Fields(line)
|
||||
if len(f) >= 3 && !strings.HasPrefix(f[0], "$") && (strings.EqualFold(f[1], "A") || strings.EqualFold(f[1], "AAAA")) {
|
||||
out = append(out, addressOverride{Domain: strings.TrimSuffix(f[0], "."), Address: f[2]})
|
||||
}
|
||||
}
|
||||
sort.Slice(out, func(i, j int) bool { return out[i].Domain < out[j].Domain })
|
||||
return out
|
||||
}
|
||||
func (a *App) saveAddressOverride(ctx context.Context, domain, address string) error {
|
||||
return a.mutateAddressOverride(ctx, domain, address, false)
|
||||
}
|
||||
func (a *App) deleteAddressOverride(ctx context.Context, domain string) error {
|
||||
return a.mutateAddressOverride(ctx, domain, "", true)
|
||||
}
|
||||
func (a *App) mutateAddressOverride(ctx context.Context, domain, address string, remove bool) error {
|
||||
a.overrideMu.Lock()
|
||||
defer a.overrideMu.Unlock()
|
||||
if a.zones == nil {
|
||||
return errors.New("address overrides are writable only in Kubernetes")
|
||||
}
|
||||
domain = strings.TrimSuffix(strings.ToLower(strings.TrimSpace(domain)), ".")
|
||||
if _, ok := dns.IsDomainName(dns.Fqdn(domain)); !ok || domain == "" {
|
||||
return errors.New("enter a valid domain name")
|
||||
}
|
||||
ip, err := netip.ParseAddr(strings.TrimSpace(address))
|
||||
if !remove && err != nil {
|
||||
return errors.New("enter a valid IPv4 or IPv6 address")
|
||||
}
|
||||
raw, _, err := a.zones.Data(ctx, "address-overrides.rpz")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
items := parseAddressOverrides(raw)
|
||||
next := make([]addressOverride, 0, len(items)+1)
|
||||
for _, it := range items {
|
||||
if it.Domain != domain {
|
||||
next = append(next, it)
|
||||
}
|
||||
}
|
||||
if !remove {
|
||||
next = append(next, addressOverride{Domain: domain, Address: ip.String()})
|
||||
}
|
||||
sort.Slice(next, func(i, j int) bool { return next[i].Domain < next[j].Domain })
|
||||
var b strings.Builder
|
||||
b.WriteString("$TTL 60\n")
|
||||
for _, it := range next {
|
||||
typ := "A"
|
||||
if strings.Contains(it.Address, ":") {
|
||||
typ = "AAAA"
|
||||
}
|
||||
fmt.Fprintf(&b, "%s %s %s\n", it.Domain, typ, it.Address)
|
||||
}
|
||||
if err := a.zones.SaveData(ctx, "address-overrides.rpz", b.String()); err != nil {
|
||||
return err
|
||||
}
|
||||
if a.blocks != nil {
|
||||
a.blocks.SetManagedRPZ(b.String())
|
||||
if _, err := a.blocks.RefreshAll(ctx); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
if a.cache != nil {
|
||||
a.cache.Flush()
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (a *App) listLocalZones(ctx context.Context) ([]api.ZoneFile, error) {
|
||||
if a.zones == nil {
|
||||
return nil, fmt.Errorf("local zone editor is available only in Kubernetes")
|
||||
}
|
||||
zones, err := a.zones.List(ctx)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
out := make([]api.ZoneFile, 0, len(zones))
|
||||
for _, z := range zones {
|
||||
out = append(out, api.ZoneFile{Name: z.Name, Content: z.Content})
|
||||
}
|
||||
sort.Slice(out, func(i, j int) bool { return out[i].Name < out[j].Name })
|
||||
return out, nil
|
||||
}
|
||||
|
||||
func (a *App) saveLocalZone(ctx context.Context, name, content string) error {
|
||||
if a.zones == nil {
|
||||
return fmt.Errorf("local zone editor is available only in Kubernetes")
|
||||
}
|
||||
apex := strings.ToLower(dns.Fqdn(strings.TrimSuffix(strings.TrimSpace(name), ".")))
|
||||
_, valid := dns.IsDomainName(apex)
|
||||
if !valid || apex == "." || len(apex) > 243 {
|
||||
return fmt.Errorf("invalid zone name %q", name)
|
||||
}
|
||||
if strings.TrimSpace(content) == "" {
|
||||
return fmt.Errorf("zone file cannot be empty")
|
||||
}
|
||||
parsed, err := zonefile.Parse(strings.NewReader(content), zonefile.Options{Origin: apex, File: name + ".zone"})
|
||||
if err != nil {
|
||||
return fmt.Errorf("invalid zone file: %w", err)
|
||||
}
|
||||
if len(parsed.Records) == 0 {
|
||||
return fmt.Errorf("zone file must contain at least one record")
|
||||
}
|
||||
for _, record := range parsed.Records {
|
||||
owner := strings.ToLower(dns.Fqdn(record.Name))
|
||||
if owner != strings.ToLower(apex) && !strings.HasSuffix(owner, "."+strings.ToLower(apex)) {
|
||||
return fmt.Errorf("record %q is outside zone %s", owner, apex)
|
||||
}
|
||||
}
|
||||
if err := a.zones.Save(ctx, strings.TrimSuffix(apex, "."), content); err != nil {
|
||||
return err
|
||||
}
|
||||
if a.cache != nil {
|
||||
a.cache.Flush()
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (a *App) deleteLocalZone(ctx context.Context, name string) error {
|
||||
if a.zones == nil {
|
||||
return fmt.Errorf("local zone editor is available only in Kubernetes")
|
||||
}
|
||||
name = strings.TrimSuffix(strings.TrimSpace(name), ".")
|
||||
if err := a.zones.Delete(ctx, name); err != nil {
|
||||
return err
|
||||
}
|
||||
if a.cache != nil {
|
||||
a.cache.Flush()
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// health is the unauthenticated probe payload.
|
||||
func (a *App) health() any {
|
||||
status := "ok"
|
||||
|
||||
Reference in new issue
Block a user