Add AddressOverride and DomainRule objects for what lived in a ConfigMap and the config file

The address redirects page rewrote an RPZ ConfigMap through the resolver's own
service account, and the domains page rewrote allow_entries/block_entries in the
config file. Both become cluster objects like the rest.

AddressOverride is one name answered with fixed addresses (the name and
everything under it), exactly what an RPZ "name A address" line did. DomainRule
is a block or allow list of inline names. The resolver reads both with the
existing watch: overrides are rendered into the managed RPZ source the blocklist
manager already has, and rule names join the config's inline entries in the
merged overlay, so the file's config is never written to.

Names are checked to be DNS names or wildcard patterns before they are used,
because they are joined into line-oriented parser input and a newline or a
comment character in one would otherwise add a rule of its own.

The console edits both: the address-overrides and domains endpoints now write
objects. The console keeps its added rules in one DomainRule per action
(inline-block, inline-allow) instead of an object per name, and removes a name
from whichever DomainRule holds it, wildcard or not. An end-to-end test drives
the pages' endpoints and checks the resolver's answers.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

internal/kubesource/convert.go

@@ -3,6 +3,7 @@ package kubesource
 import (
 	"fmt"
 	"net"
+	"net/netip"
 	"strings"
 	"time"
 
@@ -220,3 +221,128 @@ func zoneFromSpec(s DNSZoneSpec, generation int64) (zone, error) {
 	}
 	return zone{apex: apex, text: text}, nil
 }
+
+// Override is a converted AddressOverride.
+type Override struct {
+	Domain    string   `json:"domain"`
+	Addresses []string `json:"addresses"`
+}
+
+// Rules is a converted DomainRule.
+type Rules struct {
+	Action string   `json:"action"`
+	Names  []string `json:"names"`
+}
+
+func convertOverride(u *unstructured.Unstructured) (Override, error) {
+	var s AddressOverrideSpec
+	if err := spec(u, &s); err != nil {
+		return Override{}, err
+	}
+	return CheckOverride(s)
+}
+
+// CheckOverride validates an AddressOverride spec and returns it in canonical
+// form (lower-case name without the trailing dot, addresses as printed by
+// netip).
+func CheckOverride(s AddressOverrideSpec) (Override, error) {
+	domain := strings.TrimSuffix(strings.ToLower(strings.TrimSpace(s.Domain)), ".")
+	if err := checkRuleName(domain, false); err != nil {
+		return Override{}, fmt.Errorf("domain: %w", err)
+	}
+	if len(s.Addresses) == 0 {
+		return Override{}, fmt.Errorf("at least one address is required")
+	}
+	out := Override{Domain: domain}
+	seen := map[string]bool{}
+	for _, raw := range s.Addresses {
+		ip, err := netip.ParseAddr(strings.TrimSpace(raw))
+		if err != nil {
+			return Override{}, fmt.Errorf("%q is not an IPv4 or IPv6 address", raw)
+		}
+		ip = ip.Unmap()
+		if !seen[ip.String()] {
+			seen[ip.String()] = true
+			out.Addresses = append(out.Addresses, ip.String())
+		}
+	}
+	return out, nil
+}
+
+func convertRules(u *unstructured.Unstructured) (Rules, error) {
+	var s DomainRuleSpec
+	if err := spec(u, &s); err != nil {
+		return Rules{}, err
+	}
+	return CheckRules(s)
+}
+
+// CheckRules validates a DomainRule spec.
+func CheckRules(s DomainRuleSpec) (Rules, error) {
+	if s.Action != "block" && s.Action != "allow" {
+		return Rules{}, fmt.Errorf("action must be block or allow (got %q)", s.Action)
+	}
+	if len(s.Names) > maxRuleNames {
+		return Rules{}, fmt.Errorf("%d names exceeds the limit of %d; use a BlockList for large sets", len(s.Names), maxRuleNames)
+	}
+	out := Rules{Action: s.Action}
+	for _, n := range s.Names {
+		n = strings.ToLower(strings.TrimSpace(n))
+		if err := checkRuleName(n, true); err != nil {
+			return Rules{}, fmt.Errorf("name %q: %w", n, err)
+		}
+		out.Names = append(out.Names, n)
+	}
+	return out, nil
+}
+
+// maxRuleNames bounds one DomainRule; an object is capped near 1.5 MiB by etcd
+// anyway, and a bigger set belongs in a BlockList that is fetched.
+const maxRuleNames = 5000
+
+// checkRuleName accepts only what a DNS name or a wildcard pattern can contain.
+// This is a security check, not tidiness: names are joined into the blocklist
+// parser's line-oriented input, so a newline or a comment character in a name
+// could smuggle in a rule of its own.
+func checkRuleName(n string, wildcard bool) error {
+	if n == "" {
+		return fmt.Errorf("a name is required")
+	}
+	if wildcard {
+		n = strings.TrimPrefix(strings.TrimPrefix(n, "**."), "*.")
+	}
+	n = strings.TrimSuffix(n, ".")
+	if n == "" || len(n) > 253 {
+		return fmt.Errorf("not a valid DNS name")
+	}
+	for _, label := range strings.Split(n, ".") {
+		if label == "" || len(label) > 63 {
+			return fmt.Errorf("not a valid DNS name")
+		}
+		for _, c := range label {
+			ok := c >= 'a' && c <= 'z' || c >= '0' && c <= '9' || c == '-' || c == '_'
+			if !ok {
+				return fmt.Errorf("not a valid DNS name (only letters, digits, '-' and '_' are allowed)")
+			}
+		}
+	}
+	return nil
+}
+
+// RenderRPZ renders the overrides as the RPZ text the blocklist manager reads:
+// one "name A address" line per address, applying to the name and everything
+// under it.
+func RenderRPZ(in []Override) string {
+	var b strings.Builder
+	b.WriteString("$TTL 60\n")
+	for _, o := range in {
+		for _, a := range o.Addresses {
+			typ := "A"
+			if strings.Contains(a, ":") {
+				typ = "AAAA"
+			}
+			fmt.Fprintf(&b, "%s %s %s\n", o.Domain, typ, a)
+		}
+	}
+	return b.String()
+}