Skip to content

Commit 7f06b3a

Browse files
Saranya3ayushmjain
Saranya3
and
ayushmjain
authored
feat!: Adding blueprint metadata for cloud dns module (#137)
Co-authored-by: Saranya3 <ssranya@google.com> Co-authored-by: Ayush Jain <124978972+ayushmjain@users.noreply.github.com>
1 parent ece48ee commit 7f06b3a

File tree

21 files changed

+776
-18
lines changed

21 files changed

+776
-18
lines changed

‎Makefile‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,7 @@ docker_test_integration:
6868
.PHONY: docker_test_lint
6969
docker_test_lint:
7070
docker run --rm -it \
71+
-e ENABLE_BPMETADATA=1 \
7172
-v $(CURDIR):/workspace \
7273
$(REGISTRY_URL)/${DOCKER_IMAGE_DEVELOPER_TOOLS}:${DOCKER_TAG_VERSION_DEVELOPER_TOOLS} \
7374
/usr/local/bin/test_lint.sh
@@ -76,9 +77,10 @@ docker_test_lint:
7677
.PHONY: docker_generate_docs
7778
docker_generate_docs:
7879
docker run --rm -it \
79-
-v $(CURDIR):/workspace \
80+
-e ENABLE_BPMETADATA=1 \
81+
-v "$(CURDIR)":/workspace \
8082
$(REGISTRY_URL)/${DOCKER_IMAGE_DEVELOPER_TOOLS}:${DOCKER_TAG_VERSION_DEVELOPER_TOOLS} \
81-
/bin/bash -c 'source /usr/local/bin/task_helper_functions.sh && generate_docs'
83+
/bin/bash -c 'source /usr/local/bin/task_helper_functions.sh && generate_docs display'
8284

8385
# Alias for backwards compatibility
8486
.PHONY: generate_docs

‎README.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,11 +67,16 @@ Functional examples are included in the [examples](./examples/) directory.
6767
| domain | Zone domain, must end with a period. | `string` | n/a | yes |
6868
| enable\_logging | Enable query logging for this ManagedZone | `bool` | `false` | no |
6969
| force\_destroy | Set this true to delete all records in the zone. | `bool` | `false` | no |
70+
| gke\_clusters\_list | The list of Google Kubernetes Engine clusters that can see this zone. | `list(string)` | `[]` | no |
71+
| iam\_choice | Choose one of the following 'iam\_binding', 'iam\_member' or 'iam\_policy' for managed zone iam | `string` | `null` | no |
7072
| labels | A set of key/value label pairs to assign to this ManagedZone | `map(any)` | `{}` | no |
73+
| member | Identities the user/service account that will be granted the privilege in role (for case: managed\_zone\_iam\_member) | `string` | `null` | no |
74+
| members | Identities the users/service accounts that will be granted the privilege in role (for case: managed\_zone\_iam\_policy, managed\_zone\_iam\_binding) | `list(string)` | `null` | no |
7175
| name | Zone name, must be unique within the project. | `string` | n/a | yes |
7276
| private\_visibility\_config\_networks | List of VPC self links that can see this zone. | `list(string)` | `[]` | no |
7377
| project\_id | Project id for the zone. | `string` | n/a | yes |
7478
| recordsets | List of DNS record objects to manage, in the standard terraform dns structure. | <pre>list(object({<br> name = string<br> type = string<br> ttl = number<br> records = optional(list(string), null)<br><br> routing_policy = optional(object({<br> wrr = optional(list(object({<br> weight = number<br> records = list(string)<br> })), [])<br> geo = optional(list(object({<br> location = string<br> records = list(string)<br> })), [])<br> }))<br> }))</pre> | `[]` | no |
79+
| role | The role that should be applied | `string` | `null` | no |
7580
| service\_namespace\_url | The fully qualified or partial URL of the service directory namespace that should be associated with the zone. This should be formatted like https://servicedirectory.googleapis.com/v1/projects/{project}/locations/{location}/namespaces/{namespace_id} or simply projects/{project}/locations/{location}/namespaces/{namespace\_id}. | `string` | `""` | no |
7681
| target\_name\_server\_addresses | List of target name servers for forwarding zone. | `list(map(any))` | `[]` | no |
7782
| target\_network | Peering network. | `string` | `""` | no |
@@ -82,6 +87,7 @@ Functional examples are included in the [examples](./examples/) directory.
8287
| Name | Description |
8388
|------|-------------|
8489
| domain | The DNS zone domain. |
90+
| etag | The etag of the IAM policy |
8591
| name | The DNS zone name. |
8692
| name\_servers | The DNS zone name servers. |
8793
| type | The DNS zone type. |

‎examples/peering-zone/main.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,4 +25,9 @@ module "dns-peering-zone" {
2525
private_visibility_config_networks = [var.network_self_link]
2626
target_network = var.target_network_self_link
2727
labels = var.labels
28+
29+
iam_choice = "iam_member"
30+
role = "roles/viewer"
31+
member = "serviceAccount:ci-account@${var.project_id}.gserviceaccount.com"
32+
members = []
2833
}

‎examples/private-zone/main.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,4 +68,9 @@ module "dns-private-zone" {
6868
]
6969
},
7070
]
71+
72+
iam_choice = "iam_policy"
73+
role = "roles/dns.reader"
74+
member = "serviceAccount:ci-account@${var.project_id}.iam.gserviceaccount.com"
75+
members = []
7176
}

‎examples/private-zone/outputs.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,3 +18,9 @@ output "name_servers" {
1818
description = "Zone name servers."
1919
value = module.dns-private-zone.name_servers
2020
}
21+
22+
output "etag" {
23+
description = "The etag of the IAM policy."
24+
value = module.dns-private-zone.etag
25+
}
26+

‎examples/public-zone/main.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,4 +69,9 @@ module "dns-public-zone" {
6969
]
7070
},
7171
]
72+
73+
iam_choice = "iam_policy"
74+
role = "roles/dns.reader"
75+
member = "serviceAccount:ci-account@${var.project_id}.iam.gserviceaccount.com"
76+
members = []
7277
}

‎main.tf‎

Lines changed: 118 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,15 @@
1414
* limitations under the License.
1515
*/
1616

17+
data "google_iam_policy" "admin" {
18+
count = var.iam_choice == "iam_policy" && var.role != null && var.members != null ? 1 : 0
19+
20+
binding {
21+
role = var.role
22+
members = var.members
23+
}
24+
}
25+
1726
resource "google_dns_managed_zone" "peering" {
1827
count = var.type == "peering" ? 1 : 0
1928
project = var.project_id
@@ -25,14 +34,22 @@ resource "google_dns_managed_zone" "peering" {
2534
force_destroy = var.force_destroy
2635

2736
dynamic "private_visibility_config" {
28-
for_each = length(var.private_visibility_config_networks) > 0 ? [1] : []
37+
for_each = length(var.private_visibility_config_networks) > 0 || length(var.gke_clusters_list) > 0 ? [1] : []
38+
2939
content {
3040
dynamic "networks" {
31-
for_each = var.private_visibility_config_networks
41+
for_each = toset(var.private_visibility_config_networks)
3242
content {
3343
network_url = networks.value
3444
}
3545
}
46+
47+
dynamic "gke_clusters" {
48+
for_each = toset(var.gke_clusters_list)
49+
content {
50+
gke_cluster_name = gke_clusters.value
51+
}
52+
}
3653
}
3754
}
3855

@@ -54,14 +71,22 @@ resource "google_dns_managed_zone" "forwarding" {
5471
force_destroy = var.force_destroy
5572

5673
dynamic "private_visibility_config" {
57-
for_each = length(var.private_visibility_config_networks) > 0 ? [1] : []
74+
for_each = length(var.private_visibility_config_networks) > 0 || length(var.gke_clusters_list) > 0 ? [1] : []
75+
5876
content {
5977
dynamic "networks" {
60-
for_each = var.private_visibility_config_networks
78+
for_each = toset(var.private_visibility_config_networks)
6179
content {
6280
network_url = networks.value
6381
}
6482
}
83+
84+
dynamic "gke_clusters" {
85+
for_each = toset(var.gke_clusters_list)
86+
content {
87+
gke_cluster_name = gke_clusters.value
88+
}
89+
}
6590
}
6691
}
6792

@@ -87,14 +112,22 @@ resource "google_dns_managed_zone" "private" {
87112
force_destroy = var.force_destroy
88113

89114
dynamic "private_visibility_config" {
90-
for_each = length(var.private_visibility_config_networks) > 0 ? [1] : []
115+
for_each = length(var.private_visibility_config_networks) > 0 || length(var.gke_clusters_list) > 0 ? [1] : []
116+
91117
content {
92118
dynamic "networks" {
93-
for_each = var.private_visibility_config_networks
119+
for_each = toset(var.private_visibility_config_networks)
94120
content {
95121
network_url = networks.value
96122
}
97123
}
124+
125+
dynamic "gke_clusters" {
126+
for_each = toset(var.gke_clusters_list)
127+
content {
128+
gke_cluster_name = gke_clusters.value
129+
}
130+
}
98131
}
99132
}
100133
}
@@ -151,14 +184,22 @@ resource "google_dns_managed_zone" "reverse_lookup" {
151184
reverse_lookup = true
152185

153186
dynamic "private_visibility_config" {
154-
for_each = length(var.private_visibility_config_networks) > 0 ? [1] : []
187+
for_each = length(var.private_visibility_config_networks) > 0 || length(var.gke_clusters_list) > 0 ? [1] : []
188+
155189
content {
156190
dynamic "networks" {
157-
for_each = var.private_visibility_config_networks
191+
for_each = toset(var.private_visibility_config_networks)
158192
content {
159193
network_url = networks.value
160194
}
161195
}
196+
197+
dynamic "gke_clusters" {
198+
for_each = toset(var.gke_clusters_list)
199+
content {
200+
gke_cluster_name = gke_clusters.value
201+
}
202+
}
162203
}
163204
}
164205
}
@@ -175,11 +216,22 @@ resource "google_dns_managed_zone" "service_directory" {
175216
visibility = "private"
176217
force_destroy = var.force_destroy
177218

178-
private_visibility_config {
179-
dynamic "networks" {
180-
for_each = var.private_visibility_config_networks
181-
content {
182-
network_url = networks.value
219+
dynamic "private_visibility_config" {
220+
for_each = length(var.private_visibility_config_networks) > 0 || length(var.gke_clusters_list) > 0 ? [1] : []
221+
222+
content {
223+
dynamic "networks" {
224+
for_each = toset(var.private_visibility_config_networks)
225+
content {
226+
network_url = networks.value
227+
}
228+
}
229+
230+
dynamic "gke_clusters" {
231+
for_each = toset(var.gke_clusters_list)
232+
content {
233+
gke_cluster_name = gke_clusters.value
234+
}
183235
}
184236
}
185237
}
@@ -234,3 +286,56 @@ resource "google_dns_record_set" "cloud-static-records" {
234286
google_dns_managed_zone.public,
235287
]
236288
}
289+
290+
resource "google_dns_managed_zone_iam_policy" "managed_zone_iam_policy" {
291+
count = var.iam_choice == "iam_policy" && var.role != null && var.members != null ? 1 : 0
292+
293+
managed_zone = var.name
294+
project = var.project_id
295+
policy_data = data.google_iam_policy.admin[0].policy_data
296+
297+
depends_on = [
298+
google_dns_managed_zone.private,
299+
google_dns_managed_zone.public,
300+
google_dns_managed_zone.peering,
301+
google_dns_managed_zone.forwarding,
302+
google_dns_managed_zone.reverse_lookup,
303+
google_dns_managed_zone.service_directory,
304+
]
305+
}
306+
307+
resource "google_dns_managed_zone_iam_binding" "managed_zone_iam_binding" {
308+
count = var.iam_choice == "iam_binding" && var.role != null && var.members != null ? 1 : 0
309+
310+
managed_zone = var.name
311+
members = var.members
312+
role = var.role
313+
project = var.project_id
314+
315+
depends_on = [
316+
google_dns_managed_zone.private,
317+
google_dns_managed_zone.public,
318+
google_dns_managed_zone.peering,
319+
google_dns_managed_zone.forwarding,
320+
google_dns_managed_zone.reverse_lookup,
321+
google_dns_managed_zone.service_directory,
322+
]
323+
}
324+
325+
resource "google_dns_managed_zone_iam_member" "managed_zone_iam_member" {
326+
count = var.iam_choice == "iam_member" && var.role != null && var.member != null ? 1 : 0
327+
328+
managed_zone = var.name
329+
member = var.member
330+
role = var.role
331+
project = var.project_id
332+
333+
depends_on = [
334+
google_dns_managed_zone.private,
335+
google_dns_managed_zone.public,
336+
google_dns_managed_zone.peering,
337+
google_dns_managed_zone.forwarding,
338+
google_dns_managed_zone.reverse_lookup,
339+
google_dns_managed_zone.service_directory,
340+
]
341+
}

‎metadata.display.yaml‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
# Copyright 2026 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
apiVersion: blueprints.cloud.google.com/v1alpha1
16+
kind: BlueprintMetadata
17+
metadata:
18+
name: terraform-google-cloud-dns-display
19+
annotations:
20+
config.kubernetes.io/local-config: "true"
21+
spec:
22+
info:
23+
title: Terraform Google Cloud DNS Module
24+
source:
25+
repo: https://github.com/terraform-google-modules/terraform-google-cloud-dns.git
26+
sourceType: git
27+
ui:
28+
input:
29+
variables:
30+
default_key_specs_key:
31+
name: default_key_specs_key
32+
title: Default Key Specs Key
33+
default_key_specs_zone:
34+
name: default_key_specs_zone
35+
title: Default Key Specs Zone
36+
description:
37+
name: description
38+
title: Description
39+
dnssec_config:
40+
name: dnssec_config
41+
title: Dnssec Config
42+
domain:
43+
name: domain
44+
title: Domain
45+
enable_logging:
46+
name: enable_logging
47+
title: Enable Logging
48+
force_destroy:
49+
name: force_destroy
50+
title: Force Destroy
51+
gke_clusters_list:
52+
name: gke_clusters_list
53+
title: Gke Clusters List
54+
level: 1
55+
iam_choice:
56+
name: iam_choice
57+
title: Iam Choice
58+
level: 1
59+
labels:
60+
name: labels
61+
title: Labels
62+
level: 1
63+
member:
64+
name: member
65+
title: Member
66+
level: 1
67+
members:
68+
name: members
69+
title: Members
70+
level: 1
71+
name:
72+
name: name
73+
title: Name
74+
private_visibility_config_networks:
75+
name: private_visibility_config_networks
76+
title: Private Visibility Config Networks
77+
level: 1
78+
project_id:
79+
name: project_id
80+
title: Project Id
81+
recordsets:
82+
name: recordsets
83+
title: Recordsets
84+
level: 1
85+
role:
86+
name: role
87+
title: Role
88+
level: 1
89+
service_namespace_url:
90+
name: service_namespace_url
91+
title: Service Namespace Url
92+
target_name_server_addresses:
93+
name: target_name_server_addresses
94+
title: Target Name Server Addresses
95+
target_network:
96+
name: target_network
97+
title: Target Network
98+
type:
99+
name: type
100+
title: Type
101+
level: 1
102+
runtime:
103+
outputs:
104+
domain:
105+
visibility: VISIBILITY_ROOT

0 commit comments

Comments
 (0)