mmv1/products/dns/ManagedZone.yaml

# Copyright 2024 Google Inc.
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

---
name: 'ManagedZone'
kind: 'dns#managedZone'
description: |
  A zone is a subtree of the DNS namespace under one administrative
  responsibility. A ManagedZone is a resource that represents a DNS zone
  hosted by the Cloud DNS service.
references:
  guides:
    'Managing Zones': 'https://cloud.google.com/dns/zones/'
  api: 'https://cloud.google.com/dns/api/v1/managedZones'
docs:
id_format: 'projects/{{project}}/managedZones/{{name}}'
base_url: 'projects/{{project}}/managedZones'
timeouts:
  insert_minutes: 20
  update_minutes: 20
  delete_minutes: 20
iam_policy:
  method_name_separator: ':'
  fetch_iam_policy_verb: 'POST'
  parent_resource_attribute: 'managed_zone'
  example_config_body: 'templates/terraform/iam/iam_attributes.go.tmpl'
  import_format:
    - 'projects/{{project}}/managedZones/{{managed_zone}}'
    - '{{project}}/{{managed_zone}}'
custom_code:
  update_encoder: 'templates/terraform/update_encoder/managed_dns_zone.go.tmpl'
  pre_delete: 'templates/terraform/pre_delete/managed_dns_zone.go.tmpl'
examples:
  - name: 'dns_managed_zone_quickstart'
    primary_resource_id: 'default'
    primary_resource_name: 'fmt.Sprintf("tf-test-example-zone-googlecloudexample%s", context["random_suffix"])'
    vars:
      dns_compute_instance: 'dns-compute-instance'
      allow_http_traffic: 'allow-http-traffic'
      example_zone_googlecloudexample: 'example-zone-googlecloudexample'
      dns_name: 'googlecloudexample.net.'
    test_vars_overrides:
      'dns_name': '"m-z.gcp.tfacc.hashicorptest.com."'
    ignore_read_extra:
      - 'force_destroy'
    exclude_docs: true
  - name: 'dns_record_set_basic'
    primary_resource_id: 'parent-zone'
    vars:
      sample_zone: 'sample-zone'
    exclude_docs: true
  - name: 'dns_managed_zone_basic'
    primary_resource_id: 'example-zone'
    external_providers: ["random", "time"]
      # Randomness from random provider
    skip_vcr: true
  - name: 'dns_managed_zone_private'
    primary_resource_id: 'private-zone'
    vars:
      zone_name: 'private-zone'
      network_1_name: 'network-1'
      network_2_name: 'network-2'
  - name: 'dns_managed_zone_private_multiproject'
    primary_resource_id: 'private-zone'
    vars:
      zone_name: 'private-zone'
      network_1_name: 'network-1'
      network_2_name: 'network-2'
      project_1_name: 'project-1'
      project_2_name: 'project-2'
    test_env_vars:
      org_id: 'ORG_ID'
      billing_account: 'BILLING_ACCT'
    exclude_docs: true
  - name: 'dns_managed_zone_private_forwarding'
    primary_resource_id: 'private-zone'
    vars:
      zone_name: 'private-zone'
      network_1_name: 'network-1'
      network_2_name: 'network-2'
    exclude_test: true
  - name: 'dns_managed_zone_private_gke'
    primary_resource_id: 'private-zone-gke'
    vars:
      zone_name: 'private-zone'
      network_1_name: 'network-1'
      cluster_1_name: 'cluster-1'
      deletion_protection: 'true'
    test_vars_overrides:
      'deletion_protection': 'false'
    oics_vars_overrides:
      'deletion_protection': 'false'
  - name: 'dns_managed_zone_private_peering'
    primary_resource_id: 'peering-zone'
    vars:
      zone_name: 'peering-zone'
      network_source_name: 'network-source'
      network_target_name: 'network-target'
  - name: 'dns_managed_zone_service_directory'
    primary_resource_id: 'sd-zone'
    min_version: 'beta'
    vars:
      zone_name: 'peering-zone'
      network_name: 'network'
  - name: 'dns_managed_zone_cloud_logging'
    primary_resource_id: 'cloud-logging-enabled-zone'
    vars:
      zone_name: 'cloud-logging-enabled-zone'
virtual_fields:
  - name: 'force_destroy'
    description: 'Set this true to delete all records in the zone.'
    type: Boolean
    default_value: false
parameters:
properties:
  - name: 'description'
    type: String
    description: |
      A textual description field. Defaults to 'Managed by Terraform'.
    required: false
    validation:
      function: 'validation.StringIsNotEmpty'
    default_value: "Managed by Terraform"
  - name: 'dnsName'
    type: String
    description: |
      The DNS name of this managed zone, for instance "example.com.".
    required: true
    immutable: true
  - name: 'dnssecConfig'
    type: NestedObject
    description: DNSSEC configuration
    default_from_api: true
    properties:
      - name: 'kind'
        type: String
        description: Identifies what kind of resource this is
        at_least_one_of:
          - 'dnssec_config.0.kind'
          - 'dnssec_config.0.non_existence'
          - 'dnssec_config.0.state'
          - 'dnssec_config.0.default_key_specs'
        default_value: "dns#managedZoneDnsSecConfig"
      - name: 'nonExistence'
        type: Enum
        description: |
          Specifies the mechanism used to provide authenticated denial-of-existence responses.
          non_existence can only be updated when the state is `off`.
        default_from_api: true
        at_least_one_of:
          - 'dnssec_config.0.kind'
          - 'dnssec_config.0.non_existence'
          - 'dnssec_config.0.state'
          - 'dnssec_config.0.default_key_specs'
        enum_values:
          - 'nsec'
          - 'nsec3'
      - name: 'state'
        type: Enum
        description: Specifies whether DNSSEC is enabled, and what mode it is in
        at_least_one_of:
          - 'dnssec_config.0.kind'
          - 'dnssec_config.0.non_existence'
          - 'dnssec_config.0.state'
          - 'dnssec_config.0.default_key_specs'
        enum_values:
          - 'off'
          - 'on'
          - 'transfer'
      - name: 'defaultKeySpecs'
        type: Array
        description: |
          Specifies parameters that will be used for generating initial DnsKeys
          for this ManagedZone. If you provide a spec for keySigning or zoneSigning,
          you must also provide one for the other.
          default_key_specs can only be updated when the state is `off`.
        default_from_api: true
        at_least_one_of:
          - 'dnssec_config.0.kind'
          - 'dnssec_config.0.non_existence'
          - 'dnssec_config.0.state'
          - 'dnssec_config.0.default_key_specs'
        item_type:
          type: NestedObject
          properties:
            - name: 'algorithm'
              type: Enum
              description:
                String mnemonic specifying the DNSSEC algorithm of this key
              enum_values:
                - 'ecdsap256sha256'
                - 'ecdsap384sha384'
                - 'rsasha1'
                - 'rsasha256'
                - 'rsasha512'
            - name: 'keyLength'
              type: Integer
              description: Length of the keys in bits
            - name: 'keyType'
              type: Enum
              description: |
                Specifies whether this is a key signing key (KSK) or a zone
                signing key (ZSK). Key signing keys have the Secure Entry
                Point flag set and, when active, will only be used to sign
                resource record sets of type DNSKEY. Zone signing keys do
                not have the Secure Entry Point flag set and will be used
                to sign all other types of resource record sets.
              enum_values:
                - 'keySigning'
                - 'zoneSigning'
            - name: 'kind'
              type: String
              description: 'Identifies what kind of resource this is'
              default_value: "dns#dnsKeySpec"
  - name: 'managedZoneID'
    type: Integer
    description: Unique identifier for the resource; defined by the server.
    api_name: id
    output: true
  - name: 'name'
    type: String
    description: |
      User assigned name for this resource.
      Must be unique within the project.
    required: true
    immutable: true
  - name: 'nameServers'
    type: Array
    description: |
      Delegate your managed_zone to these virtual name servers;
      defined by the server
    output: true
    item_type:
      type: String
  - name: 'creationTime'
    type: Time
    description: |
      The time that this resource was created on the server.
      This is in RFC3339 text format.
    output: true
  - name: 'labels'
    type: KeyValueLabels
    description: |
      A set of key/value label pairs to assign to this ManagedZone.
  - name: 'visibility'
    type: Enum
    description: |
      The zone's visibility: public zones are exposed to the Internet,
      while private zones are visible only to Virtual Private Cloud resources.
    immutable: true
    diff_suppress_func: 'tpgresource.CaseDiffSuppress'
    custom_flatten: 'templates/terraform/custom_flatten/default_if_empty.tmpl'
    default_value: "public"
    enum_values:
      - 'private'
      - 'public'
  - name: 'privateVisibilityConfig'
    type: NestedObject
    description: |
      For privately visible zones, the set of Virtual Private Cloud
      resources that the zone is visible from. At least one of `gke_clusters` or `networks` must be specified.
    send_empty_value: true
    at_least_one_of:
      - 'gke_clusters'
      - 'networks'
    custom_expand: 'templates/terraform/custom_expand/dns_managed_zone_private_visibility_config.go.tmpl'
    properties:
      - name: 'gkeClusters'
        type: Array
        description:
          'The list of Google Kubernetes Engine clusters that can see this zone.'
        item_type:
          type: NestedObject
          properties:
            - name: 'gkeClusterName'
              type: String
              description: |
                The resource name of the cluster to bind this ManagedZone to.
                This should be specified in the format like
                `projects/*/locations/*/clusters/*`
              required: true
      - name: 'networks'
        type: Array
        description: |
          The list of VPC networks that can see this zone. Until the provider updates to use the Terraform 0.12 SDK in a future release, you
          may experience issues with this resource while updating. If you've defined a `networks` block and
          add another `networks` block while keeping the old block, Terraform will see an incorrect diff
          and apply an incorrect update to the resource. If you encounter this issue, remove all `networks`
          blocks in an update and then apply another update adding all of them back simultaneously.
        is_set: true
        set_hash_func: |-
          func(v interface{}) int {
            if v == nil {
              return 0
            }
            raw := v.(map[string]interface{})
            if url, ok := raw["network_url"]; ok {
              return tpgresource.SelfLinkRelativePathHash(url)
            }
            var buf bytes.Buffer
            schema.SerializeResourceForHash(&buf, raw, dnsManagedZonePrivateVisibilityConfigNetworksSchema())
            return tpgresource.Hashcode(buf.String())
          }
        item_type:
          type: NestedObject
          properties:
            # TODO(drebes): Make 'networkUrl' a ResourceRef once cross-module references
            # are possible.
            - name: 'networkUrl'
              type: String
              description: |
                The id or fully qualified URL of the VPC network to bind to.
                This should be formatted like `projects/{project}/global/networks/{network}` or
                `https://www.googleapis.com/compute/v1/projects/{project}/global/networks/{network}`
              required: true
              diff_suppress_func: 'tpgresource.CompareSelfLinkOrResourceName'
  - name: 'forwardingConfig'
    type: NestedObject
    description: |
      The presence for this field indicates that outbound forwarding is enabled
      for this zone. The value of this field contains the set of destinations
      to forward to.
    properties:
      - name: 'targetNameServers'
        type: Array
        description: |
          List of target name servers to forward to. Cloud DNS will
          select the best available name server if more than
          one target is given.
        is_set: true
        required: true
        set_hash_func: |-
          func(v interface{}) int {
            raw := v.(map[string]interface{})
            if address, ok := raw["ipv4_address"]; ok {
              tpgresource.Hashcode(address.(string))
            }
            var buf bytes.Buffer
            schema.SerializeResourceForHash(&buf, raw, dnsManagedZoneForwardingConfigTargetNameServersSchema())
            return tpgresource.Hashcode(buf.String())
          }
        item_type:
          type: NestedObject
          properties:
            - name: 'ipv4Address'
              type: String
              description: 'IPv4 address of a target name server.'
            - name: 'domainName'
              type: String
              description: 'Fully qualified domain name for the forwarding target.'
              min_version: 'beta'
            - name: 'forwardingPath'
              type: Enum
              description: |
                Forwarding path for this TargetNameServer. If unset or `default` Cloud DNS will make forwarding
                decision based on address ranges, i.e. RFC1918 addresses go to the VPC, Non-RFC1918 addresses go
                to the Internet. When set to `private`, Cloud DNS will always send queries through VPC for this target
              enum_values:
                - 'default'
                - 'private'
          exactly_one_of:
            - 'ipv4_address'
            - 'domain_name'
  - name: 'peeringConfig'
    type: NestedObject
    description: |
      The presence of this field indicates that DNS Peering is enabled for this
      zone. The value of this field contains the network to peer with.
    properties:
      - name: 'targetNetwork'
        type: NestedObject
        description: 'The network with which to peer.'
        required: true
        properties:
          # TODO(drebes): Make 'networkUrl' a ResourceRef once cross-module references
          # are possible.
          - name: 'networkUrl'
            type: String
            description: |
              The id or fully qualified URL of the VPC network to forward queries to.
              This should be formatted like `projects/{project}/global/networks/{network}` or
              `https://www.googleapis.com/compute/v1/projects/{project}/global/networks/{network}`
            required: true
            diff_suppress_func: 'tpgresource.CompareSelfLinkOrResourceName'
            custom_expand: 'templates/terraform/custom_expand/network_full_url.tmpl'
  - name: 'reverseLookup'
    type: Boolean
    description: |
      Specifies if this is a managed reverse lookup zone. If true, Cloud DNS will resolve reverse
      lookup queries using automatically configured records for VPC resources. This only applies
      to networks listed under `private_visibility_config`.
    api_name: reverseLookupConfig
    min_version: 'beta'
    immutable: true
    custom_flatten: 'templates/terraform/custom_flatten/object_to_bool.go.tmpl'
    custom_expand: 'templates/terraform/custom_expand/bool_to_object.go.tmpl'
  - name: 'serviceDirectoryConfig'
    type: NestedObject
    description:
      The presence of this field indicates that this zone is backed by Service
      Directory. The value of this field contains information related to the
      namespace associated with the zone.
    min_version: 'beta'
    immutable: true
    properties:
      - name: 'namespace'
        type: NestedObject
        description: 'The namespace associated with the zone.'
        required: true
        properties:
          - name: 'namespaceUrl'
            type: String
            description: |
              The fully qualified or partial URL of the service directory namespace that should be
              associated with the zone. This should be formatted like
              `https://servicedirectory.googleapis.com/v1/projects/{project}/locations/{location}/namespaces/{namespace_id}`
              or simply `projects/{project}/locations/{location}/namespaces/{namespace_id}`
              Ignored for `public` visibility zones.
            required: true
            custom_flatten: 'templates/terraform/custom_flatten/full_to_relative_path.tmpl'
            custom_expand: 'templates/terraform/custom_expand/sd_full_url.tmpl'
  - name: 'cloudLoggingConfig'
    type: NestedObject
    description: 'Cloud logging configuration'
    default_from_api: true
    properties:
      - name: 'enableLogging'
        type: Boolean
        description:
          'If set, enable query logging for this ManagedZone. False by default,
          making logging opt-in.'
        required: true