The old console kept the zone files and the live address-overrides.rpz in the
same fancy-dns-zones ConfigMap; fancy-dns-rpz was only the static seed the
overrides started from. Reading the live cluster showed the two had diverged
(6 entries against 5, the missing one being stackship.k6n.net), so the default
would have silently dropped a redirect. The default is now fancy-dns-zones, and
the test puts a different stale seed in fancy-dns-rpz so reading the wrong one
fails.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Zones, address redirects, inline rules, lists and groups are cluster objects now
(see the previous commits and deploy/MIGRATION.md), so the mechanisms that held
them are gone:
* internal/kubezones and the resolver's service-account access to a ConfigMap,
the address-overrides read/write path and its poller, the zone-file poller and
the Local zones editor with its /api/local-zones routes.
* localzone.Managed, the directory of console-written master files, and the
blocklist.managed_zones key. The resolver now writes no zone data at all; its
zone hooks only list. The shared half of that file (the record validator, the
renderer and the round-trip check) stays as zonestate.go, because DNSZone
rendering is built on it. Its tests are ported to RenderZone, which keeps the
coverage of every editable record type, wildcards, relative owners, the
SOA/NS rule and the delegation rule.
* Tests of the removed write paths: the contract test now builds its zone from a
DNSZone, and a new test pins that every zone write route on the resolver is
refused and changes nothing.
Standalone installs keep editing master files on disk and SIGHUP, and the
YAML-backed domain, client, upstream and settings editors, which have not moved.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
matsandClaude Sonnet 5.5