Add AddressOverride and DomainRule objects for what lived in a ConfigMap and the config file

The address redirects page rewrote an RPZ ConfigMap through the resolver's own
service account, and the domains page rewrote allow_entries/block_entries in the
config file. Both become cluster objects like the rest.

AddressOverride is one name answered with fixed addresses (the name and
everything under it), exactly what an RPZ "name A address" line did. DomainRule
is a block or allow list of inline names. The resolver reads both with the
existing watch: overrides are rendered into the managed RPZ source the blocklist
manager already has, and rule names join the config's inline entries in the
merged overlay, so the file's config is never written to.

Names are checked to be DNS names or wildcard patterns before they are used,
because they are joined into line-oriented parser input and a newline or a
comment character in one would otherwise add a rule of its own.

The console edits both: the address-overrides and domains endpoints now write
objects. The console keeps its added rules in one DomainRule per action
(inline-block, inline-allow) instead of an object per name, and removes a name
from whichever DomainRule holds it, wildcard or not. An end-to-end test drives
the pages' endpoints and checks the resolver's answers.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

internal/kubeedit/edit_test.go

@@ -20,6 +20,9 @@ func newEditor() *Editor {
 			kubesource.ZoneGVR:  "DNSZoneList",
 			kubesource.GroupGVR: "ClientGroupList",
 			kubesource.ListGVR:  "BlockListList",
+
+			kubesource.OverrideGVR: "AddressOverrideList",
+			kubesource.RuleGVR:     "DomainRuleList",
 		})
 	return New(c, "dns")
 }
@@ -216,3 +219,99 @@ func TestListEditing(t *testing.T) {
 		t.Fatal(err)
 	}
 }
+
+func TestOverrideEditing(t *testing.T) {
+	e := newEditor()
+	if err := e.SetOverride(ctx, "Tornberg.ME.", "10.10.3.10", "a"); err != nil {
+		t.Fatal(err)
+	}
+	// Setting again replaces rather than adds, as the RPZ file editor did.
+	if err := e.SetOverride(ctx, "tornberg.me", "10.10.3.11", "a"); err != nil {
+		t.Fatal(err)
+	}
+	if err := e.SetOverride(ctx, "slask_x.local", "10.10.3.10", "a"); err != nil {
+		t.Fatalf("a name that is not a legal object name must still work: %v", err)
+	}
+	got, _ := e.Overrides(ctx)
+	if len(got) != 2 {
+		t.Fatalf("overrides = %+v", got)
+	}
+	byDomain := map[string][]string{}
+	for _, o := range got {
+		byDomain[o.Domain] = o.Addresses
+	}
+	if a := byDomain["tornberg.me"]; len(a) != 1 || a[0] != "10.10.3.11" {
+		t.Fatalf("tornberg.me = %v", a)
+	}
+	if err := e.SetOverride(ctx, "x.test", "not-an-ip", "a"); err == nil {
+		t.Fatal("a bad address was accepted")
+	}
+	if err := e.DeleteOverride(ctx, "TORNBERG.me."); err != nil {
+		t.Fatal(err)
+	}
+	if err := e.DeleteOverride(ctx, "tornberg.me"); !errors.Is(err, ErrNotFound) {
+		t.Fatalf("err = %v", err)
+	}
+	if got, _ := e.Overrides(ctx); len(got) != 1 {
+		t.Fatalf("after delete: %+v", got)
+	}
+}
+
+func TestRuleEditing(t *testing.T) {
+	e := newEditor()
+	n, err := e.AddRules(ctx, "block", []string{"Ads.Example.com", "*.tracker.example", "ads.example.com"}, "a")
+	if err != nil || n != 3 {
+		t.Fatalf("add: %d %v", n, err)
+	}
+	if _, err := e.AddRules(ctx, "allow", []string{"good.example"}, "a"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := e.AddRules(ctx, "block", []string{"bad name\nother.test"}, "a"); err == nil {
+		t.Fatal("a name with a newline was accepted")
+	}
+	if _, err := e.AddRules(ctx, "drop", []string{"x.test"}, "a"); err == nil {
+		t.Fatal("an unknown action was accepted")
+	}
+	items, _ := e.list(ctx, kubesource.RuleGVR)
+	if len(items) != 2 {
+		t.Fatalf("%d DomainRule objects, want one per action", len(items))
+	}
+	var spec kubesource.DomainRuleSpec
+	for i := range items {
+		if items[i].GetName() == inlineBlock {
+			_ = decodeSpec(&items[i], &spec)
+		}
+	}
+	if len(spec.Names) != 2 { // ads.example.com once, and the wildcard
+		t.Fatalf("block names = %v", spec.Names)
+	}
+	// A wildcard rule is deleted by its plain name, as the console sends it.
+	if removed, err := e.DeleteRule(ctx, "tracker.example", "a"); err != nil || removed != 1 {
+		t.Fatalf("delete: %d %v", removed, err)
+	}
+	if _, err := e.DeleteRule(ctx, "never.added", "a"); !errors.Is(err, ErrNotFound) {
+		t.Fatalf("err = %v", err)
+	}
+	// Removing the last name of the console's own list removes the object.
+	if _, err := e.DeleteRule(ctx, "good.example", "a"); err != nil {
+		t.Fatal(err)
+	}
+	if items, _ = e.list(ctx, kubesource.RuleGVR); len(items) != 1 {
+		t.Fatalf("%d objects left, want only the block list", len(items))
+	}
+}
+
+func TestObjectNames(t *testing.T) {
+	for in, same := range map[string]bool{"tornberg.me": true, "a-b.example": true, "slask_x.local": false, "UPPER": false} {
+		got := objectName(in)
+		if (got == in) != same {
+			t.Errorf("objectName(%q) = %q", in, got)
+		}
+		if err := checkName("x", got); err != nil {
+			t.Errorf("objectName(%q) = %q is not a legal object name: %v", in, got, err)
+		}
+	}
+	if objectName("a_b.test") == objectName("a-b.test") {
+		t.Error("distinct names collided")
+	}
+}

internal/kubeedit/overrides.go

@@ -0,0 +1,116 @@
+package kubeedit
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+
+	"git.k8s-git-k6n.net/mats/fancy-dns/internal/kubesource"
+)
+
+// objectName turns a DNS name into a Kubernetes object name. Most names are
+// already one; a name that is not (an underscore, say) is cleaned and given a
+// short hash so two different names cannot collide.
+func objectName(domain string) string {
+	var b strings.Builder
+	changed := false
+	for _, c := range domain {
+		if c >= 'a' && c <= 'z' || c >= '0' && c <= '9' || c == '-' || c == '.' {
+			b.WriteRune(c)
+		} else {
+			b.WriteByte('-')
+			changed = true
+		}
+	}
+	name := strings.Trim(b.String(), "-.")
+	if name == "" {
+		name, changed = "root", true
+	}
+	if changed {
+		sum := sha256.Sum256([]byte(domain))
+		name += "-" + hex.EncodeToString(sum[:3])
+	}
+	return name
+}
+
+func (e *Editor) overrideObjects(ctx context.Context) ([]unstructured.Unstructured, error) {
+	return e.list(ctx, kubesource.OverrideGVR)
+}
+
+// Overrides lists the address overrides, one entry per name.
+func (e *Editor) Overrides(ctx context.Context) ([]kubesource.Override, error) {
+	items, err := e.overrideObjects(ctx)
+	if err != nil {
+		return nil, err
+	}
+	var out []kubesource.Override
+	for i := range items {
+		var s kubesource.AddressOverrideSpec
+		if decodeSpec(&items[i], &s) != nil {
+			continue
+		}
+		if o, err := kubesource.CheckOverride(s); err == nil {
+			out = append(out, o)
+		}
+	}
+	return out, nil
+}
+
+// SetOverride makes domain (and everything under it) answer with address,
+// replacing whatever it answered with before.
+func (e *Editor) SetOverride(ctx context.Context, domain, address, actor string) error {
+	o, err := kubesource.CheckOverride(kubesource.AddressOverrideSpec{Domain: domain, Addresses: []string{address}})
+	if err != nil {
+		return err
+	}
+	name := objectName(o.Domain)
+	items, err := e.overrideObjects(ctx)
+	if err != nil {
+		return err
+	}
+	for i := range items {
+		var s kubesource.AddressOverrideSpec
+		if decodeSpec(&items[i], &s) == nil {
+			if have, err := kubesource.CheckOverride(s); err == nil && have.Domain == o.Domain {
+				name = items[i].GetName() // keep the object an operator may have named by hand
+				break
+			}
+		}
+	}
+	if err := checkName("address override", name); err != nil {
+		return err
+	}
+	_, err = e.upsert(ctx, kubesource.OverrideGVR, "AddressOverride", name, actor,
+		kubesource.AddressOverrideSpec{Domain: o.Domain, Addresses: o.Addresses})
+	return err
+}
+
+// DeleteOverride removes the override for domain.
+func (e *Editor) DeleteOverride(ctx context.Context, domain string) error {
+	want := strings.TrimSuffix(strings.ToLower(strings.TrimSpace(domain)), ".")
+	items, err := e.overrideObjects(ctx)
+	if err != nil {
+		return err
+	}
+	removed := false
+	for i := range items {
+		var s kubesource.AddressOverrideSpec
+		if decodeSpec(&items[i], &s) != nil {
+			continue
+		}
+		if have, err := kubesource.CheckOverride(s); err == nil && have.Domain == want {
+			if err := e.remove(ctx, kubesource.OverrideGVR, items[i].GetName()); err != nil {
+				return err
+			}
+			removed = true
+		}
+	}
+	if !removed {
+		return fmt.Errorf("%w: no address override for %s", ErrNotFound, want)
+	}
+	return nil
+}

internal/kubeedit/rules.go

@@ -0,0 +1,112 @@
+package kubeedit
+
+import (
+	"context"
+	"fmt"
+	"slices"
+	"strings"
+
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/util/retry"
+
+	"git.k8s-git-k6n.net/mats/fancy-dns/internal/kubesource"
+)
+
+// The console keeps the rules it adds in one DomainRule per action, so the
+// Domains page does not scatter an object per name. Objects an operator wrote
+// by hand are read, and a rule in them can be removed, but never added to.
+const (
+	inlineBlock = "inline-block"
+	inlineAllow = "inline-allow"
+)
+
+// AddRules adds names to the console's block or allow rule list and reports how
+// many it was given. Names already present are kept once.
+func (e *Editor) AddRules(ctx context.Context, action string, names []string, actor string) (int, error) {
+	if _, err := kubesource.CheckRules(kubesource.DomainRuleSpec{Action: action, Names: names}); err != nil {
+		return 0, err
+	}
+	canonical, _ := kubesource.CheckRules(kubesource.DomainRuleSpec{Action: action, Names: names})
+	obj := inlineBlock
+	if action == "allow" {
+		obj = inlineAllow
+	}
+	err := retry.RetryOnConflict(retry.DefaultRetry, func() error {
+		cur, err := e.res(kubesource.RuleGVR).Get(ctx, obj, metav1.GetOptions{})
+		var spec kubesource.DomainRuleSpec
+		switch {
+		case apierrors.IsNotFound(err):
+			spec = kubesource.DomainRuleSpec{Action: action, Comment: "Added from the console"}
+		case err != nil:
+			return err
+		default:
+			if err := decodeSpec(cur, &spec); err != nil {
+				return err
+			}
+		}
+		for _, n := range canonical.Names {
+			if !slices.Contains(spec.Names, n) {
+				spec.Names = append(spec.Names, n)
+			}
+		}
+		// The whole list must still be one the runtime accepts.
+		if _, err := kubesource.CheckRules(spec); err != nil {
+			return err
+		}
+		_, err = e.upsert(ctx, kubesource.RuleGVR, "DomainRule", obj, actor, spec)
+		return err
+	})
+	return len(canonical.Names), err
+}
+
+// ruleKey is how a rule is compared: the runtime strips wildcards and the
+// trailing dot, so "ads.example.com", "*.ads.example.com." and
+// "**.ads.example.com" all name the same rule to delete.
+func ruleKey(n string) string {
+	n = strings.ToLower(strings.TrimSpace(n))
+	n = strings.TrimPrefix(strings.TrimPrefix(n, "*."), "**.")
+	return strings.TrimSuffix(n, ".")
+}
+
+// DeleteRule removes every inline rule that names target, in any DomainRule.
+func (e *Editor) DeleteRule(ctx context.Context, target, actor string) (int, error) {
+	want := ruleKey(target)
+	items, err := e.list(ctx, kubesource.RuleGVR)
+	if err != nil {
+		return 0, err
+	}
+	removed := 0
+	for i := range items {
+		var spec kubesource.DomainRuleSpec
+		if decodeSpec(&items[i], &spec) != nil {
+			continue
+		}
+		keep := spec.Names[:0:0]
+		for _, n := range spec.Names {
+			if ruleKey(n) == want {
+				removed++
+				continue
+			}
+			keep = append(keep, n)
+		}
+		if len(keep) == len(spec.Names) {
+			continue
+		}
+		name := items[i].GetName()
+		if len(keep) == 0 && (name == inlineBlock || name == inlineAllow) {
+			if err := e.remove(ctx, kubesource.RuleGVR, name); err != nil {
+				return removed, err
+			}
+			continue
+		}
+		spec.Names = keep
+		if _, err := e.upsert(ctx, kubesource.RuleGVR, "DomainRule", name, actor, spec); err != nil {
+			return removed, err
+		}
+	}
+	if removed == 0 {
+		return 0, fmt.Errorf("%w: no inline rule matches %q", ErrNotFound, target)
+	}
+	return removed, nil
+}