Route the DNS admin ingress to the separate console

The ingress still sent the UI and admin API to the resolver after the console split. Route both paths through the console so OIDC callbacks and Kubernetes edits reach their owner, while keeping DoH on the resolver.

Include the console resources in Kustomize so GitOps deploys its configuration, permissions, workload and Service alongside the resolver.

deploy/k8s/30-ingress.yaml

@@ -32,17 +32,17 @@ spec:
             pathType: Prefix
             backend:
               service:
-                name: fancy-dns-web
+                name: fancy-dns-console
                 port:
-                  name: admin
-          # The embedded console.
+                  name: http
+          # The console owns the UI, OIDC callback and admin API.
           - path: /
             pathType: Prefix
             backend:
               service:
-                name: fancy-dns-web
+                name: fancy-dns-console
                 port:
-                  name: admin
+                  name: http
   tls:
     - hosts: [dns.k6n.net]
       secretName: fancy-dns-tls

deploy/k8s/kustomization.yaml

@@ -15,6 +15,7 @@ resources:
   - crds/rbac.yaml
   - 10-deployment.yaml
   - 20-service.yaml
+  - console/console.yaml
   - 30-ingress.yaml
 
 labels: