matsandClaude Sonnet 5.5
1a536e7d0e
fancy-dns-console is a second binary holding the web UI, authentication and every edit. It writes ClientGroup, BlockList and DNSZone objects through the new kubeedit package and forwards all other /api routes to a running resolver with its own key, dropping the browser's credentials, so it can run in the cluster or on a workstation with a kubeconfig and nothing about the resolver's placement matters. The resolver never imports kubeedit and the console is not on the DNS path. kubeedit validates every spec with the runtime's own converters (kubesource.CheckGroup/CheckList/CheckZone) before writing, so the console cannot store an object the resolver would reject. Zone edits keep the file-based writer's behaviour: duplicate and below-a-delegation records are refused, a delegation in a new zone also gives the zone its servers, and a zone with no apex NS is never stored. Each object records the editing user in an annotation; updates retry on conflict. The resolver reports groups from ClientGroup objects as source "kubernetes" and counter-only rows (the "(default)" bucket, or a group removed since) as "history", and lists DNSZone zones as the editable ones. The console uses that to leave the YAML's groups alone and to drop history rows, which the UI would otherwise send back on save. Its GET /api/clients overlays the cluster's current objects on the resolver's list, because the resolver only sees an edit after its watch fires and a save made just after another would delete the first. An end-to-end test runs both halves against one fake apiserver: a group saved through the console refuses queries, a zone built record by record answers authoritatively, and a request with the resolver's own key is rejected by the console. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
79 lines
2.7 KiB
Go
79 lines
2.7 KiB
Go
package localzone
|
|
|
|
import (
|
|
"fmt"
|
|
"strings"
|
|
)
|
|
|
|
// RenderZone renders a complete zone from declared records, for sources that
|
|
// own a zone outright (a Kubernetes DNSZone) rather than editing a file in
|
|
// place. It runs the same checks the console writer does: every record goes
|
|
// through newRecord, a delegation may not shadow data, and the rendering is
|
|
// re-parsed and compared with the records before it is returned, so a renderer
|
|
// bug surfaces as an error here and not as a zone that silently stopped
|
|
// answering.
|
|
//
|
|
// serial is the SOA serial; 0 means the writer's default. A declarative source
|
|
// should pass something that changes exactly when the spec does, so two
|
|
// replicas rendering the same object produce the same bytes.
|
|
func RenderZone(origin string, def ZoneDefaults, recs []Record, serial uint32) (string, error) {
|
|
origin, err := NormalizeOrigin(origin)
|
|
if err != nil {
|
|
return "", fmt.Errorf("zone name: %w", err)
|
|
}
|
|
f, err := newFileState(origin, def)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
for _, in := range recs {
|
|
rec, err := newRecord(origin, in.Name, in.Type, ttlOr(in.TTL, f.ttl), in.Value)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
for _, have := range f.recs {
|
|
if have.Key() == rec.Key() && have.Value == rec.Value {
|
|
return "", fmt.Errorf("%s %s is declared twice", rec.Name, rec.Type)
|
|
}
|
|
}
|
|
f.recs = append(f.recs, rec)
|
|
}
|
|
if err := f.finish(); err != nil {
|
|
return "", err
|
|
}
|
|
if serial != 0 {
|
|
f.soa.Serial = serial
|
|
}
|
|
text := f.render()
|
|
check, err := parseFileState(origin, text)
|
|
if err != nil {
|
|
return "", fmt.Errorf("the zone file for %s did not render correctly: %w", origin, err)
|
|
}
|
|
if err := sameRecords(check.recs, f.recs); err != nil {
|
|
return "", fmt.Errorf("the zone file for %s did not render correctly: %w", origin, err)
|
|
}
|
|
return strings.Replace(text, FileHeader, ZoneSourceHeader, 1), nil
|
|
}
|
|
|
|
// ZoneSourceHeader tops a rendered zone that an external object owns.
|
|
const ZoneSourceHeader = `; fancy-dns zone rendered from a Kubernetes DNSZone object.
|
|
;
|
|
; Regenerated whenever the object changes; edit the DNSZone, not this file.
|
|
`
|
|
|
|
// CanonicalRecord returns a record in the form the zone store holds it: the
|
|
// owner fully qualified, the type uppercased, the RDATA as the master-file
|
|
// parser reads it. An editor compares records in this form, so "www" and
|
|
// "www.example.com." are the same record.
|
|
func CanonicalRecord(origin string, in Record) (Record, error) {
|
|
origin, err := NormalizeOrigin(origin)
|
|
if err != nil {
|
|
return Record{}, fmt.Errorf("zone name: %w", err)
|
|
}
|
|
rec, err := newRecord(origin, in.Name, in.Type, ttlOr(in.TTL, DefaultZoneTTL), in.Value)
|
|
if err != nil {
|
|
return Record{}, err
|
|
}
|
|
rec.TTL = in.TTL // 0 still means "the zone's default"
|
|
return rec, nil
|
|
}
|