Fix dnssec keys lookup (#1728)

* Fix dnssec keys lookup

* Fix DNS examples

* Fix FAST and blueprints resource counts

blueprints/cloud-operations/dns-fine-grained-iam/README.md

@@ -128,5 +128,5 @@ module "test1" {
   project_create = true
   project_id     = "test"
 }
-# tftest modules=9 resources=28
+# tftest modules=9 resources=27
 ```

blueprints/cloud-operations/dns-shared-vpc/README.md

@@ -51,5 +51,5 @@ module "test" {
   shared_vpc_link    = "https://www.googleapis.com/compute/v1/projects/test-dns/global/networks/default"
   teams              = ["team1", "team2"]
 }
-# tftest modules=9 resources=20
+# tftest modules=9 resources=16
 ```

blueprints/networking/decentralized-firewall/README.md

@@ -51,5 +51,5 @@ module "test" {
   root_node          = "organizations/0123456789"
 }
 
-# tftest modules=9 resources=56
+# tftest modules=9 resources=54
 ```

blueprints/networking/filtering-proxy-psc/README.md

@@ -40,5 +40,5 @@ module "test" {
   }
   project_id = "test-project"
 }
-# tftest modules=13 resources=42
+# tftest modules=13 resources=41
 ```

blueprints/networking/filtering-proxy/README.md

@@ -47,7 +47,7 @@ module "test1" {
   prefix          = "fabric"
   root_node       = "folders/123456789"
 }
-# tftest modules=14 resources=39
+# tftest modules=14 resources=38
 ```
 
 ```hcl
@@ -58,5 +58,5 @@ module "test2" {
   prefix          = "fabric"
   root_node       = "folders/123456789"
 }
-# tftest modules=12 resources=33
+# tftest modules=12 resources=32
 ```

blueprints/networking/hub-and-spoke-vpn/README.md

@@ -114,5 +114,5 @@ module "test" {
   project_id = "project-1"
 }
 
-# tftest modules=20 resources=84
+# tftest modules=20 resources=79
 ```

blueprints/networking/private-cloud-function-from-onprem/README.md

@@ -45,5 +45,5 @@ module "test" {
   }
   project_id = "test-project"
 }
-# tftest modules=11 resources=45
+# tftest modules=11 resources=44
 ```

blueprints/networking/shared-vpc-gke/README.md

@@ -80,5 +80,5 @@ module "test" {
   prefix             = "test"
   root_node          = "organizations/0123456789"
 }
-# tftest modules=11 resources=46
+# tftest modules=11 resources=45
 ```

blueprints/serverless/cloud-run-corporate/README.md

@@ -252,7 +252,7 @@ module "test" {
   prj_onprem_id = "onprem-project-id"
 }
 
-# tftest modules=15 resources=52
+# tftest modules=15 resources=50
 ```
 
 ```hcl
@@ -276,7 +276,7 @@ module "test" {
   tf_identity = "user@example.org"
 }
 
-# tftest modules=15 resources=38
+# tftest modules=15 resources=36
 ```
 
 ```hcl
@@ -295,5 +295,5 @@ module "test" {
   custom_domain = "cloud-run-corporate.example.org"
 }
 
-# tftest modules=14 resources=47
+# tftest modules=14 resources=45
 ```

modules/dns/README.md

@@ -27,7 +27,7 @@ module "private-dns" {
     "roles/dns.admin" = ["group:dns-administrators@myorg.com"]
   }
 }
-# tftest modules=1 resources=5 inventory=private-zone.yaml
+# tftest modules=1 resources=4 inventory=private-zone.yaml
 ```
 
 ### Forwarding Zone
@@ -45,7 +45,7 @@ module "private-dns" {
     }
   }
 }
-# tftest modules=1 resources=2 inventory=forwarding-zone.yaml
+# tftest modules=1 resources=1 inventory=forwarding-zone.yaml
 ```
 
 ### Peering Zone
@@ -63,7 +63,7 @@ module "private-dns" {
     }
   }
 }
-# tftest modules=1 resources=2 inventory=peering-zone.yaml
+# tftest modules=1 resources=1 inventory=peering-zone.yaml
 ```
 
 ### Routing Policies
@@ -99,7 +99,7 @@ module "private-dns" {
     }
   }
 }
-# tftest modules=1 resources=5 inventory=routing-policies.yaml
+# tftest modules=1 resources=4 inventory=routing-policies.yaml
 ```
 
 ### Reverse Lookup Zone
@@ -116,7 +116,7 @@ module "private-dns" {
     }
   }
 }
-# tftest modules=1 resources=2 inventory=reverse-zone.yaml
+# tftest modules=1 resources=1 inventory=reverse-zone.yaml
 ```
 
 ### Public Zone
@@ -137,7 +137,7 @@ module "public-dns" {
     "roles/dns.admin" = ["group:dns-administrators@myorg.com"]
   }
 }
-# tftest modules=1 resources=4 inventory=public-zone.yaml
+# tftest modules=1 resources=3 inventory=public-zone.yaml
 ```
 <!-- BEGIN TFDOC -->
 ## Variables

modules/dns/main.tf

@@ -158,7 +158,9 @@ resource "google_dns_managed_zone_iam_binding" "iam_bindings" {
 }
 
 data "google_dns_keys" "dns_keys" {
+  count        = try(var.zone_config.public.dnssec_config, null) != null ? 1 : 0
   managed_zone = local.managed_zone.id
+  project      = var.project_id
 }
 
 resource "google_dns_record_set" "dns_record_set" {
@@ -193,4 +195,4 @@ resource "google_dns_record_set" "dns_record_set" {
   depends_on = [
     google_dns_managed_zone.dns_managed_zone
   ]
-}
+}

modules/dns/outputs.tf

@@ -1,5 +1,5 @@
 /**
- * Copyright 2022 Google LLC
+ * Copyright 2023 Google LLC
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@
 
 output "dns_keys" {
   description = "DNSKEY and DS records of DNSSEC-signed managed zones."
-  value       = data.google_dns_keys.dns_keys
+  value       = try(data.google_dns_keys.dns_keys, null)
 }
 
 output "domain" {

modules/service-directory/README.md

@@ -88,7 +88,7 @@ module "dns-sd" {
     }
   }
 }
-# tftest modules=2 resources=6 inventory=dns.yaml
+# tftest modules=2 resources=5 inventory=dns.yaml
 ```
 <!-- BEGIN TFDOC -->
 

tests/fast/stages/s2_networking_a_peering/stage.yaml

@@ -1,4 +1,4 @@
-# Copyright 2022 Google LLC
+# Copyright 2023 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -14,4 +14,4 @@
 
 counts:
   modules: 28
-  resources: 154
+  resources: 145

tests/fast/stages/s2_networking_b_vpn/stage.yaml

@@ -14,4 +14,4 @@
 
 counts:
   modules: 30
-  resources: 191
+  resources: 182

tests/fast/stages/s2_networking_c_nva/stage.yaml

@@ -14,4 +14,4 @@
 
 counts:
   modules: 42
-  resources: 201
+  resources: 192

tests/fast/stages/s2_networking_d_separate_envs/stage.yaml

@@ -14,4 +14,4 @@
 
 counts:
   modules: 21
-  resources: 171
+  resources: 165

tests/fast/stages/s2_networking_e_nva_bgp/stage.yaml

@@ -14,4 +14,4 @@
 
 counts:
   modules: 36
-  resources: 212
+  resources: 203

tests/modules/dns/examples/peering-zone.yaml

@@ -30,5 +30,3 @@ values:
 
 counts:
   google_dns_managed_zone: 1
-
-outputs: {}

tests/modules/dns/examples/public-zone.yaml

@@ -29,11 +29,6 @@ values:
     type: A
 
 counts:
-  google_dns_keys: 1
   google_dns_managed_zone: 1
   google_dns_record_set: 1
   google_dns_managed_zone_iam_binding: 1
-  modules: 1
-  resources: 4
-
-outputs: {}

tests/modules/dns/examples/reverse-zone.yaml

@@ -23,5 +23,3 @@ values:
 
 counts:
   google_dns_managed_zone: 1
-
-outputs: {}