Add a read-only Kubernetes source for zones, client groups and blocklists

The runtime can now take ClientGroup, BlockList and DNSZone objects
(fancydns.k6n.net/v1alpha1) from a cluster with -kube, from a pod's service
account or a kubeconfig alike. internal/kubesource watches them with dynamic
informers, converts and validates each object on its own, and publishes an
immutable snapshot. A bad object is skipped and keeps its last good version,
so one broken edit cannot remove a running policy; an invalid merged config is
dropped whole. The last snapshot is saved so a restart without apiserver access
still serves.

config.Store gains an overlay: Base() is what the YAML says, Get() is base plus
cluster objects. Everything that writes the config back (mutateConfig,
SetAdminAddr, the settings editor) now starts from Base(), otherwise cluster
objects would be copied into the file and shadow their own objects. YAML wins
every name collision. putACL and toggleBlocklist refuse to edit cluster-owned
objects. BlockList has no path field and refuses file:// URLs so a namespaced
object cannot pick files the runtime reads or writes. DNSZone is rendered
through the zone writer's own prove-by-reparse step, with the SOA serial taken
from metadata.generation so every replica renders identical bytes.

qlog: Flush reset the pending slice to [:0], so entries logged while it was
still storing the batch were appended over the same backing array. The race
detector found it through the new Kubernetes integration test. pending is now
set to nil, with a regression test that fails without the change.

CRD manifests, RBAC and examples are in deploy/k8s/crds; tests pin the schemas
to the Go spec structs so the two cannot drift.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

internal/config/store.go

@@ -10,7 +10,13 @@ import (
 // in atomically, so a request never observes a half-applied config.
 type Store struct {
 	cur atomic.Pointer[Config]
-	mu  sync.Mutex // serialises writers so LastError/Version stay coherent
+	// base is the configuration as the file (or an API write) defined it. cur
+	// is base with the overlay applied; without an overlay the two are the
+	// same pointer. Writers that persist back to the file must start from
+	// base, or they would write overlay content into the file.
+	base    atomic.Pointer[Config]
+	overlay atomic.Pointer[func(*Config) *Config]
+	mu      sync.Mutex // serialises writers so LastError/Version stay coherent
 	// path is the file the config was loaded from, used by the API to
 	// persist mutations.
 	path string
@@ -28,9 +34,50 @@ type Store struct {
 func NewStore(cfg *Config, path string) *Store {
 	s := &Store{path: path}
 	s.cur.Store(cfg)
+	s.base.Store(cfg)
 	return s
 }
 
+// Base returns the configuration without the overlay: what the file says.
+func (s *Store) Base() *Config {
+	if b := s.base.Load(); b != nil {
+		return b
+	}
+	return s.cur.Load()
+}
+
+// SetOverlay installs fn, which derives the effective configuration from the
+// base (a cluster source adding groups and lists, say). fn must not modify its
+// argument. Call Reapply afterwards, and again whenever fn's inputs change.
+func (s *Store) SetOverlay(fn func(*Config) *Config) {
+	if fn == nil {
+		s.overlay.Store(nil)
+		return
+	}
+	s.overlay.Store(&fn)
+}
+
+func (s *Store) effective(base *Config) *Config {
+	if fn := s.overlay.Load(); fn != nil {
+		if out := (*fn)(base); out != nil {
+			return out
+		}
+	}
+	return base
+}
+
+// Reapply recomputes the effective configuration from the base and swaps it
+// in, running the hooks as for any other swap.
+func (s *Store) Reapply() {
+	s.mu.Lock()
+	next := s.effective(s.Base())
+	s.cur.Store(next)
+	s.generation.Add(1)
+	s.lastErr.Store(nil)
+	s.mu.Unlock()
+	s.runHooks(next)
+}
+
 // Get returns the current configuration snapshot.
 func (s *Store) Get() *Config { return s.cur.Load() }
 
@@ -60,11 +107,13 @@ func (s *Store) Swap(cfg *Config) error {
 		cfg.Cache.Shards = 32
 	}
 	s.mu.Lock()
-	s.cur.Store(cfg)
+	s.base.Store(cfg)
+	eff := s.effective(cfg)
+	s.cur.Store(eff)
 	s.generation.Add(1)
 	s.lastErr.Store(nil)
 	s.mu.Unlock()
-	s.runHooks(cfg)
+	s.runHooks(eff)
 	return nil
 }
 
@@ -84,11 +133,13 @@ func (s *Store) Reload() error {
 	}
 	// Preserve the working dir of the running instance so relative paths keep
 	// resolving the same way even if the file moved.
-	cfg.Server.WorkingDir = s.cur.Load().Server.WorkingDir
-	s.cur.Store(cfg)
+	cfg.Server.WorkingDir = s.Base().Server.WorkingDir
+	s.base.Store(cfg)
+	eff := s.effective(cfg)
+	s.cur.Store(eff)
 	s.generation.Add(1)
 	s.lastErr.Store(nil)
-	s.runHooks(cfg)
+	s.runHooks(eff)
 	return nil
 }
 

internal/config/store_overlay_test.go

@@ -0,0 +1,46 @@
+package config
+
+import "testing"
+
+func TestStoreOverlayKeepsBaseSeparate(t *testing.T) {
+	base := Default()
+	s := NewStore(base, "")
+	if s.Base() != base || s.Get() != base {
+		t.Fatal("without an overlay base and current are the same config")
+	}
+
+	extra := Group{Name: "from-cluster", Policy: "deny"}
+	s.SetOverlay(func(b *Config) *Config {
+		next := *b
+		next.ACL.Groups = append(append([]Group(nil), b.ACL.Groups...), extra)
+		return &next
+	})
+	var seen *Config
+	s.OnSwap(func(c *Config) { seen = c })
+	gen := s.Generation()
+	s.Reapply()
+
+	if got := s.Get().ACL.Groups; len(got) != 1 || got[0].Name != "from-cluster" {
+		t.Fatalf("effective groups = %+v", got)
+	}
+	if len(s.Base().ACL.Groups) != 0 {
+		t.Fatal("the overlay leaked into the base")
+	}
+	if seen != s.Get() || s.Generation() != gen+1 {
+		t.Fatal("Reapply must run the swap hooks and bump the generation")
+	}
+
+	// A write (the API persisting a change) replaces the base; the overlay
+	// is applied on top of it again.
+	written := Default()
+	written.ACL.Groups = []Group{{Name: "yaml", Policy: "allow"}}
+	if err := s.Swap(written); err != nil {
+		t.Fatal(err)
+	}
+	if got := s.Get().ACL.Groups; len(got) != 2 || got[0].Name != "yaml" || got[1].Name != "from-cluster" {
+		t.Fatalf("after Swap = %+v", got)
+	}
+	if got := s.Base().ACL.Groups; len(got) != 1 {
+		t.Fatalf("base after Swap = %+v", got)
+	}
+}