From 64abb69c26d516c485f8e3f9fe2aed139934270c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mats=20T=C3=B6rnberg?= <mats.tornberg@gmail.com>
Date: Fri, 16 Oct 2026 11:45:29 +0200
Subject: [PATCH] Route the DNS admin ingress to the separate console

The ingress still sent the UI and admin API to the resolver after the console split. Route both paths through the console so OIDC callbacks and Kubernetes edits reach their owner, while keeping DoH on the resolver.

Include the console resources in Kustomize so GitOps deploys its configuration, permissions, workload and Service alongside the resolver.
---
 deploy/k8s/30-ingress.yaml    | 10 +++++-----
 deploy/k8s/kustomization.yaml |  1 +
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/deploy/k8s/30-ingress.yaml b/deploy/k8s/30-ingress.yaml
index 11316d3..cf60e09 100644
--- a/deploy/k8s/30-ingress.yaml
+++ b/deploy/k8s/30-ingress.yaml
@@ -32,17 +32,17 @@ spec:
             pathType: Prefix
             backend:
               service:
-                name: fancy-dns-web
+                name: fancy-dns-console
                 port:
-                  name: admin
-          # The embedded console.
+                  name: http
+          # The console owns the UI, OIDC callback and admin API.
           - path: /
             pathType: Prefix
             backend:
               service:
-                name: fancy-dns-web
+                name: fancy-dns-console
                 port:
-                  name: admin
+                  name: http
   tls:
     - hosts: [dns.k6n.net]
       secretName: fancy-dns-tls
diff --git a/deploy/k8s/kustomization.yaml b/deploy/k8s/kustomization.yaml
index bd5c9ad..b980434 100644
--- a/deploy/k8s/kustomization.yaml
+++ b/deploy/k8s/kustomization.yaml
@@ -15,6 +15,7 @@ resources:
   - crds/rbac.yaml
   - 10-deployment.yaml
   - 20-service.yaml
+  - console/console.yaml
   - 30-ingress.yaml
 
 labels: