dns reponse policy e2e changes |
||
---|---|---|
.. | ||
README.md | ||
main.tf | ||
outputs.tf | ||
variables.tf | ||
versions.tf |
README.md
Google Cloud DNS Response Policy
This module allows management of a Google Cloud DNS policy and its rules. The policy can already exist and be referenced by name by setting the policy_create
variable to false
.
The module also allows setting rules via a factory. An example is given below.
Examples
Manage policy and override resolution for specific names
This example shows how to create a policy with a single rule, that directs a specific Google API name to the restricted VIP addresses.
module "dns-policy" {
source = "./fabric/modules/dns-response-policy"
project_id = var.project_id
name = "googleapis"
networks = {
landing = var.vpc.self_link
}
rules = {
pubsub = {
dns_name = "pubsub.googleapis.com."
local_data = {
A = {
rrdatas = ["199.36.153.4", "199.36.153.5"]
}
}
}
}
}
# tftest modules=1 resources=2 inventory=simple.yaml e2e
Use existing policy and override resolution via wildcard with exceptions
This example shows how to create a policy with a single rule, that directs all Google API names except specific ones to the restricted VIP addresses.
module "dns-policy" {
source = "./fabric/modules/dns-response-policy"
project_id = var.project_id
name = module.dns-response-policy.name
policy_create = false
networks = {
landing = var.vpc.self_link
}
rules = {
gcr = {
dns_name = "gcr.io."
local_data = {
CNAME = {
rrdatas = ["restricted.googleapis.com."]
}
}
}
googleapis-all = {
dns_name = "*.googleapis.com."
local_data = {
CNAME = {
rrdatas = ["restricted.googleapis.com."]
}
}
}
pubsub = {
dns_name = "pubsub.googleapis.com."
}
restricted = {
dns_name = "restricted.googleapis.com."
local_data = {
A = {
rrdatas = [
"199.36.153.4",
"199.36.153.5",
"199.36.153.6",
"199.36.153.7"
]
}
}
}
}
}
# tftest modules=2 resources=5 fixtures=fixtures/dns-response-policy.tf inventory=complex.yaml e2e
Define policy rules via a factory file
This example shows how to define rules in a factory file, that mirrors the rules defined via variables in the previous example. Rules defined via the variable are merged with factory rules and take precedence over them when using the same rule names. The YAML syntax closely follows the rules
variable type.
module "dns-policy" {
source = "./fabric/modules/dns-response-policy"
project_id = var.project_id
name = module.dns-response-policy.name
policy_create = false
networks = {
landing = var.vpc.self_link
}
rules_file = "config/rules.yaml"
}
# tftest modules=2 resources=5 files=rules-file fixtures=fixtures/dns-response-policy.tf inventory=complex.yaml e2e
---
# Terraform will be unable to decode this file if it does not contain valid YAML
# You can retain `---` (start of the document) to indicate an empty document.
gcr:
dns_name: "gcr.io."
local_data:
CNAME: {rrdatas: ["restricted.googleapis.com."]}
googleapis-all:
dns_name: "*.googleapis.com."
local_data:
CNAME: {rrdatas: ["restricted.googleapis.com."]}
pubsub:
dns_name: "pubsub.googleapis.com."
restricted:
dns_name: "restricted.googleapis.com."
local_data:
A:
rrdatas:
- 199.36.153.4
- 199.36.153.5
- 199.36.153.6
- 199.36.153.7
# tftest-file id=rules-file path=config/rules.yaml
Variables
name | description | type | required | default |
---|---|---|---|---|
name | Policy name. | string |
✓ | |
project_id | Project id for the zone. | string |
✓ | |
clusters | Map of GKE clusters to which this policy is applied in name => id format. | map(string) |
{} |
|
description | Policy description. | string |
"Terraform managed." |
|
networks | Map of VPC self links to which this policy is applied in name => self link format. | map(string) |
{} |
|
policy_create | Set to false to use the existing policy matching name and only manage rules. | bool |
true |
|
rules | Map of policy rules in name => rule format. Local data takes precedence over behavior and is in the form record type => attributes. | map(object({…})) |
{} |
|
rules_file | Optional data file in YAML format listing rules that will be combined with those passed in via the rules variable. |
string |
null |
Outputs
name | description | sensitive |
---|---|---|
id | Fully qualified policy id. | |
name | Policy name. | |
policy | Policy resource. |