matsandClaude Sonnet 5.5
04ebf68c0f
DO NOT SYNC THIS BEFORE MIGRATING. Removing fancy-dns-zones and fancy-dns-rpz from the kustomization lets a pruning GitOps tool delete them, and they hold the only copy of the zones and address redirects until the objects exist. Follow deploy/MIGRATION.md: install the definitions, run `fancy-dns-console migrate` against the live cluster, then roll this out. The StatefulSet starts the resolver with -kube and no longer mounts the two ConfigMaps; its service account loses the ConfigMap role and keeps only the read-only Role on the fancy-dns objects (crds/rbac.yaml). The kustomization now installs the definitions and that Role. The shipped config no longer lists the migrated sources. Config validation no longer refuses an enabled blocklist with no sources in the file, because BlockList, DomainRule and AddressOverride objects can supply every rule and the file cannot know. The existing "no source" warning says so. That removed the only validation message the settings tests used as a fixture; they now use an invalid acl.default_policy, and an empty settings document is refused by the handler instead of by that check. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
11 lines
312 B
YAML
11 lines
312 B
YAML
# The resolver's identity. It reads the fancy-dns objects through the Role in
|
|
# crds/rbac.yaml and writes nothing; the console has its own account.
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: fancy-dns
|
|
namespace: dns
|
|
labels:
|
|
app.kubernetes.io/name: fancy-dns
|
|
automountServiceAccountToken: true
|