4 Commits

Include renames

Author	SHA1	Message	Date
matsandClaude Sonnet 5.5	1a536e7d0e	Split the console from the resolver: fancy-dns-console writes the cluster ... fancy-dns-console is a second binary holding the web UI, authentication and every edit. It writes ClientGroup, BlockList and DNSZone objects through the new kubeedit package and forwards all other /api routes to a running resolver with its own key, dropping the browser's credentials, so it can run in the cluster or on a workstation with a kubeconfig and nothing about the resolver's placement matters. The resolver never imports kubeedit and the console is not on the DNS path. kubeedit validates every spec with the runtime's own converters (kubesource.CheckGroup/CheckList/CheckZone) before writing, so the console cannot store an object the resolver would reject. Zone edits keep the file-based writer's behaviour: duplicate and below-a-delegation records are refused, a delegation in a new zone also gives the zone its servers, and a zone with no apex NS is never stored. Each object records the editing user in an annotation; updates retry on conflict. The resolver reports groups from ClientGroup objects as source "kubernetes" and counter-only rows (the "(default)" bucket, or a group removed since) as "history", and lists DNSZone zones as the editable ones. The console uses that to leave the YAML's groups alone and to drop history rows, which the UI would otherwise send back on save. Its GET /api/clients overlays the cluster's current objects on the resolver's list, because the resolver only sees an edit after its watch fires and a save made just after another would delete the first. An end-to-end test runs both halves against one fake apiserver: a group saved through the console refuses queries, a zone built record by record answers authoritatively, and a request with the resolver's own key is rejected by the console. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-16 08:43:41 +02:00
developer	e8c5b414d9	half broken	2026-09-27 17:17:53 +00:00
developer	4c00bb4144	Fix $TTL in the zone parser; add make check-go ... The zone parser ignored an explicit $TTL and stamped every record with the SOA minimum instead, so a 60s zone served 3600s and DefaultTTL was wrong too. RFC 1035 §5.2: an explicit $TTL wins. qualifyRdata was also added to apply RFC 1035 §5.1 relative-name expansion to RDATA, which is correct but has one outstanding defect noted below. make check-go is the tight inner loop: gofmt check, go vet, compile. It uses go-build rather than build, because build depends on web and shells out to npm to rebuild a console bundle that rarely changes. check now depends on it, so the fast path and the CI path cannot drift apart. Outstanding, not fixed here: a relative CNAME target is still emitted as "host." instead of "host.example.com.". qualifyRdata is called with the right origin, and relative() is correct in isolation, so the target is almost certainly being dot-terminated in Zone.assemble before dns.NewRR ever sees it, which makes relative() treat it as already absolute. Narrowed to that, not confirmed — see the localzone test failures.	2026-09-27 13:59:31 +00:00
developer	ee72257c64	more code	2026-09-27 11:34:26 +00:00