Skip to content

Latest commit

 

History

History
149 lines (131 loc) · 5.27 KB

README.md

File metadata and controls

149 lines (131 loc) · 5.27 KB
Raw

Google Cloud DNS Response Policy

This module allows management of a Google Cloud DNS policy and its rules. The policy can already exist and be referenced by name by setting the policy_create variable to false.

The module also allows setting rules via a factory. An example is given below.

Examples

Manage policy and override resolution for specific names

This example shows how to create a policy with a single rule, that directs a specific Google API name to the restricted VIP addresses.

module "dns-policy" {
  source     = "./fabric/modules/dns-response-policy"
  project_id = "myproject"
  name       = "googleapis"
  networks = {
    landing = var.vpc.self_link
  }
  rules = {
    pubsub = {
      dns_name = "pubsub.googleapis.com."
      local_data = {
        A = {
          rrdatas = ["199.36.153.4", "199.36.153.5"]
        }
      }
    }
  }
}
# tftest modules=1 resources=2 inventory=simple.yaml

Use existing policy and override resolution via wildcard with exceptions

This example shows how to create a policy with a single rule, that directs all Google API names except specific ones to the restricted VIP addresses.

module "dns-policy" {
  source        = "./fabric/modules/dns-response-policy"
  project_id    = "myproject"
  name          = "googleapis"
  policy_create = false
  networks = {
    landing = var.vpc.self_link
  }
  rules = {
    gcr = {
      dns_name = "gcr.io."
      local_data = {
        CNAME = {
          rrdatas = ["restricted.googleapis.com."]
        }
      }
    }
    googleapis-all = {
      dns_name = "*.googleapis.com."
      local_data = {
        CNAME = {
          rrdatas = ["restricted.googleapis.com."]
        }
      }
    }
    pubsub = {
      dns_name = "pubsub.googleapis.com."
    }
    restricted = {
      dns_name = "restricted.googleapis.com."
      local_data = {
        A = {
          rrdatas = [
            "199.36.153.4",
            "199.36.153.5",
            "199.36.153.6",
            "199.36.153.7"
          ]
        }
      }
    }
  }
}
# tftest modules=1 resources=4 inventory=complex.yaml

Define policy rules via a factory file

This example shows how to define rules in a factory file, that mirrors the rules defined via variables in the previous example. Rules defined via the variable are merged with factory rules and take precedence over them when using the same rule names. The YAML syntax closely follows the rules variable type.

module "dns-policy" {
  source        = "./fabric/modules/dns-response-policy"
  project_id    = "myproject"
  name          = "googleapis"
  policy_create = false
  networks = {
    landing = var.vpc.self_link
  }
  rules_file = "config/rules.yaml"
}
# tftest modules=1 resources=4 files=rules-file inventory=complex.yaml
gcr:
  dns_name: "gcr.io."
  local_data:
    CNAME: {rrdatas: ["restricted.googleapis.com."]}
googleapis-all:
  dns_name: "*.googleapis.com."
  local_data:
    CNAME: {rrdatas: ["restricted.googleapis.com."]}
pubsub:
  dns_name: "pubsub.googleapis.com."
restricted:
  dns_name: "restricted.googleapis.com."
  local_data:
    A:
      rrdatas:
        - 199.36.153.4
        - 199.36.153.5
        - 199.36.153.6
        - 199.36.153.7
# tftest-file id=rules-file path=config/rules.yaml

Variables

name description type required default
name Policy name. string ✓
project_id Project id for the zone. string ✓
clusters Map of GKE clusters to which this policy is applied in name => id format. map(string) {}
description Policy description. string "Terraform managed."
networks Map of VPC self links to which this policy is applied in name => self link format. map(string) {}
policy_create Set to false to use the existing policy matching name and only manage rules. bool true
rules Map of policy rules in name => rule format. Local data takes precedence over behavior and is in the form record type => attributes. map(object({…})) {}
rules_file Optional data file in YAML format listing rules that will be combined with those passed in via the rules variable. string null

Outputs

name description sensitive
id Fully qualified policy id.
name Policy name.
policy Policy resource.