# The console: web UI plus the API behind it, as its own Deployment. It writes
# ClientGroup / BlockList / DNSZone objects and forwards everything else to the
# resolver's admin API. It is not on the DNS path; stopping it changes no answer.
#
# Secrets it needs (create them out of band):
#   fancy-dns-console-runtime  key FANCYDNS_RUNTIME_KEY : an API key the resolver accepts
#   fancy-dns-console-apikey   key FANCYDNS_API_KEY     : the console's own machine key
apiVersion: v1
kind: ConfigMap
metadata:
  name: fancy-dns-console
  namespace: dns
data:
  console.yaml: |
    # The console has no blocklists or listeners of its own.
    blocklist: {enabled: false}
    api:
      enabled: true
      listen: ["0.0.0.0:8080"]
      base_path: /api
      ui: true
      auth:
        mode: oidc
        api_keys: ["${FANCYDNS_API_KEY}"]
        oidc_issuer: https://users.k6n.net
        oidc_audience: https://dns.k6n.net
        oidc_redirect_uri: https://dns.k6n.net/auth/oidc/callback
        oidc_client_id: fancy-dns
        oidc_write_roles: [admin]
        trust_loopback: false
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: fancy-dns-console
  namespace: dns
---
# The only component allowed to write the objects.
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: fancy-dns-console
  namespace: dns
rules:
  - apiGroups: [fancydns.k6n.net]
    resources: [dnszones, clientgroups, blocklists]
    verbs: [get, list, create, update, delete]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: fancy-dns-console
  namespace: dns
subjects:
  - {kind: ServiceAccount, name: fancy-dns-console, namespace: dns}
roleRef: {apiGroup: rbac.authorization.k8s.io, kind: Role, name: fancy-dns-console}
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: fancy-dns-console
  namespace: dns
  labels: {app.kubernetes.io/name: fancy-dns-console}
spec:
  # One replica: OIDC login state and sessions are in memory, as in the
  # resolver's console. More than one needs sticky routing.
  replicas: 1
  selector:
    matchLabels: {app.kubernetes.io/name: fancy-dns-console}
  template:
    metadata:
      labels: {app.kubernetes.io/name: fancy-dns-console}
    spec:
      serviceAccountName: fancy-dns-console
      securityContext:
        runAsNonRoot: true
        runAsUser: 65532
        seccompProfile: {type: RuntimeDefault}
      containers:
        - name: console
          image: fancydns/fancy-dns:latest
          command: ["/usr/local/bin/fancy-dns-console"]
          args:
            - -config=/etc/fancy-dns/console.yaml
            # A Service in front of the resolver pods. With several replicas the
            # statistics and query log come from whichever pod answers.
            - -runtime-url=http://fancy-dns-admin.dns.svc:8080
          env:
            - name: FANCYDNS_RUNTIME_KEY
              valueFrom: {secretKeyRef: {name: fancy-dns-console-runtime, key: FANCYDNS_RUNTIME_KEY}}
            - name: FANCYDNS_API_KEY
              valueFrom: {secretKeyRef: {name: fancy-dns-console-apikey, key: FANCYDNS_API_KEY}}
          ports: [{name: http, containerPort: 8080}]
          readinessProbe:
            httpGet: {path: /api/healthz, port: http}
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities: {drop: [ALL]}
          volumeMounts:
            - {name: config, mountPath: /etc/fancy-dns, readOnly: true}
      volumes:
        - name: config
          configMap: {name: fancy-dns-console}
---
apiVersion: v1
kind: Service
metadata:
  name: fancy-dns-console
  namespace: dns
spec:
  selector: {app.kubernetes.io/name: fancy-dns-console}
  ports: [{name: http, port: 80, targetPort: http}]