2 Commits

Include renames

Author	SHA1	Message	Date
matsandClaude Sonnet 5.5	4d38945d94	Add a read-only Kubernetes source for zones, client groups and blocklists ... The runtime can now take ClientGroup, BlockList and DNSZone objects (fancydns.k6n.net/v1alpha1) from a cluster with -kube, from a pod's service account or a kubeconfig alike. internal/kubesource watches them with dynamic informers, converts and validates each object on its own, and publishes an immutable snapshot. A bad object is skipped and keeps its last good version, so one broken edit cannot remove a running policy; an invalid merged config is dropped whole. The last snapshot is saved so a restart without apiserver access still serves. config.Store gains an overlay: Base() is what the YAML says, Get() is base plus cluster objects. Everything that writes the config back (mutateConfig, SetAdminAddr, the settings editor) now starts from Base(), otherwise cluster objects would be copied into the file and shadow their own objects. YAML wins every name collision. putACL and toggleBlocklist refuse to edit cluster-owned objects. BlockList has no path field and refuses file:// URLs so a namespaced object cannot pick files the runtime reads or writes. DNSZone is rendered through the zone writer's own prove-by-reparse step, with the SOA serial taken from metadata.generation so every replica renders identical bytes. qlog: Flush reset the pending slice to [:0], so entries logged while it was still storing the batch were appended over the same backing array. The race detector found it through the new Kubernetes integration test. pending is now set to nil, with a regression test that fails without the change. CRD manifests, RBAC and examples are in deploy/k8s/crds; tests pin the schemas to the Go spec structs so the two cannot drift. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-16 08:35:36 +02:00
developer	4c00bb4144	Fix $TTL in the zone parser; add make check-go ... The zone parser ignored an explicit $TTL and stamped every record with the SOA minimum instead, so a 60s zone served 3600s and DefaultTTL was wrong too. RFC 1035 §5.2: an explicit $TTL wins. qualifyRdata was also added to apply RFC 1035 §5.1 relative-name expansion to RDATA, which is correct but has one outstanding defect noted below. make check-go is the tight inner loop: gofmt check, go vet, compile. It uses go-build rather than build, because build depends on web and shells out to npm to rebuild a console bundle that rarely changes. check now depends on it, so the fast path and the CI path cannot drift apart. Outstanding, not fixed here: a relative CNAME target is still emitted as "host." instead of "host.example.com.". qualifyRdata is called with the right origin, and relative() is correct in isolation, so the target is almost certainly being dot-terminated in Zone.assemble before dns.NewRR ever sees it, which makes relative() treat it as already absolute. Narrowed to that, not confirmed — see the localzone test failures.	2026-09-27 13:59:31 +00:00