128 lines
3.8 KiB
HCL
128 lines
3.8 KiB
HCL
/**
|
|
* Copyright 2022 Google LLC
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
* you may not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*/
|
|
|
|
variable "description" {
|
|
description = "Domain description."
|
|
type = string
|
|
default = "Terraform managed."
|
|
}
|
|
|
|
variable "iam" {
|
|
description = "IAM bindings in {ROLE => [MEMBERS]} format."
|
|
type = map(list(string))
|
|
default = null
|
|
}
|
|
|
|
variable "name" {
|
|
description = "Zone name, must be unique within the project."
|
|
type = string
|
|
}
|
|
|
|
variable "project_id" {
|
|
description = "Project id for the zone."
|
|
type = string
|
|
}
|
|
|
|
variable "recordsets" {
|
|
description = "Map of DNS recordsets in \"type name\" => {ttl, [records]} format."
|
|
type = map(object({
|
|
ttl = optional(number, 300)
|
|
records = optional(list(string))
|
|
geo_routing = optional(list(object({
|
|
location = string
|
|
records = optional(list(string))
|
|
health_checked_targets = optional(list(object({
|
|
load_balancer_type = string
|
|
ip_address = string
|
|
port = string
|
|
ip_protocol = string
|
|
network_url = string
|
|
project = string
|
|
region = optional(string)
|
|
})))
|
|
})))
|
|
wrr_routing = optional(list(object({
|
|
weight = number
|
|
records = list(string)
|
|
})))
|
|
}))
|
|
default = {}
|
|
nullable = false
|
|
validation {
|
|
condition = alltrue([
|
|
for k, v in coalesce(var.recordsets, {}) :
|
|
length(split(" ", k)) == 2
|
|
])
|
|
error_message = "Recordsets must have keys in the format \"type name\"."
|
|
}
|
|
validation {
|
|
condition = alltrue([
|
|
for k, v in coalesce(var.recordsets, {}) : (
|
|
(v.records != null && v.wrr_routing == null && v.geo_routing == null) ||
|
|
(v.records == null && v.wrr_routing != null && v.geo_routing == null) ||
|
|
(v.records == null && v.wrr_routing == null && v.geo_routing != null)
|
|
)
|
|
])
|
|
error_message = "Only one of records, wrr_routing or geo_routing can be defined for each recordset."
|
|
}
|
|
}
|
|
|
|
variable "zone_config" {
|
|
description = "DNS zone configuration."
|
|
type = object({
|
|
domain = string
|
|
forwarding = optional(object({
|
|
forwarders = optional(map(string))
|
|
client_networks = list(string)
|
|
}))
|
|
peering = optional(object({
|
|
client_networks = list(string)
|
|
peer_network = string
|
|
}))
|
|
public = optional(object({
|
|
dnssec_config = optional(object({
|
|
non_existence = optional(string, "nsec3")
|
|
state = string
|
|
key_signing_key = optional(object(
|
|
{ algorithm = string, key_length = number }),
|
|
{ algorithm = "rsasha256", key_length = 2048 }
|
|
)
|
|
zone_signing_key = optional(object(
|
|
{ algorithm = string, key_length = number }),
|
|
{ algorithm = "rsasha256", key_length = 1024 }
|
|
)
|
|
}))
|
|
enable_logging = optional(bool, false)
|
|
}))
|
|
private = optional(object({
|
|
client_networks = list(string)
|
|
service_directory_namespace = optional(string)
|
|
}))
|
|
})
|
|
validation {
|
|
condition = (
|
|
(try(var.zone_config.forwarding, null) == null ? 0 : 1) +
|
|
(try(var.zone_config.peering, null) == null ? 0 : 1) +
|
|
(try(var.zone_config.public, null) == null ? 0 : 1) +
|
|
(try(var.zone_config.private, null) == null ? 0 : 1) <= 1
|
|
)
|
|
error_message = "Only one type of zone can be configured at a time."
|
|
}
|
|
default = null
|
|
}
|
|
|
|
|