Skip to content

Commit 6ee93bf

Browse files
imprateekshimprateeksh
authored
feat: add support for DNS configuration<br>New inputs added: dns_records, dns_zone_name, dns_zone_description and dns_zone_label (#910)
1 parent 8fdf826 commit 6ee93bf

File tree

12 files changed

+416
-1
lines changed

12 files changed

+416
-1
lines changed

‎README.md‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ This module creates the following IBM Cloud&reg; Virtual Private Cloud (VPC) net
3434
* [Landing Zone example](./examples/landing_zone)
3535
* [No Prefix Example](./examples/no-prefix)
3636
* [Specific Zone Only Example](./examples/specific-zone-only)
37+
* [VPC with DNS example](./examples/vpc-with-dns)
3738
* [Contributing](#contributing)
3839
<!-- END OVERVIEW HOOK -->
3940

@@ -150,6 +151,9 @@ To attach access management tags to resources in this module, you need the follo
150151
| Name | Type |
151152
|------|------|
152153
| [ibm_dns_custom_resolver.custom_resolver_hub](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/dns_custom_resolver) | resource |
154+
| [ibm_dns_permitted_network.dns_permitted_network](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/dns_permitted_network) | resource |
155+
| [ibm_dns_resource_record.dns_record](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/dns_resource_record) | resource |
156+
| [ibm_dns_zone.dns_zone](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/dns_zone) | resource |
153157
| [ibm_iam_authorization_policy.policy](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/iam_authorization_policy) | resource |
154158
| [ibm_iam_authorization_policy.vpc_dns_resolution_auth_policy](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/iam_authorization_policy) | resource |
155159
| [ibm_is_flow_log.flow_logs](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/is_flow_log) | resource |
@@ -191,6 +195,10 @@ To attach access management tags to resources in this module, you need the follo
191195
| <a name="input_dns_instance_name"></a> [dns\_instance\_name](#input\_dns\_instance\_name) | The name to give the provisioned DNS instance. If not set, the module generates a name based on the `prefix` and `name` variables. | `string` | `null` | no |
192196
| <a name="input_dns_location"></a> [dns\_location](#input\_dns\_location) | The target location or environment for the DNS instance created to host the custom resolver in a hub-spoke DNS resolution topology. Only used if enable\_hub is true and skip\_custom\_resolver\_hub\_creation is false (defaults). | `string` | `"global"` | no |
193197
| <a name="input_dns_plan"></a> [dns\_plan](#input\_dns\_plan) | The plan for the DNS resource instance created to host the custom resolver in a hub-spoke DNS resolution topology. Only used if enable\_hub is true and skip\_custom\_resolver\_hub\_creation is false (defaults). | `string` | `"standard-dns"` | no |
198+
| <a name="input_dns_records"></a> [dns\_records](#input\_dns\_records) | List of DNS records to be created. | <pre>list(object({<br/> name = string<br/> type = string<br/> ttl = number<br/> rdata = string<br/> preference = optional(number, null)<br/> service = optional(string, null)<br/> protocol = optional(string, null)<br/> priority = optional(number, null)<br/> weight = optional(number, null)<br/> port = optional(number, null)<br/> }))</pre> | `[]` | no |
199+
| <a name="input_dns_zone_description"></a> [dns\_zone\_description](#input\_dns\_zone\_description) | The description of the DNS zone. | `string` | `"Default DNS Zone"` | no |
200+
| <a name="input_dns_zone_label"></a> [dns\_zone\_label](#input\_dns\_zone\_label) | Label associated with the DNS zone. | `string` | `"dns-zone"` | no |
201+
| <a name="input_dns_zone_name"></a> [dns\_zone\_name](#input\_dns\_zone\_name) | The name of the DNS zone to be created. | `string` | `"slz.com"` | no |
194202
| <a name="input_enable_hub"></a> [enable\_hub](#input\_enable\_hub) | Indicates whether this VPC is enabled as a DNS name resolution hub. | `bool` | `false` | no |
195203
| <a name="input_enable_hub_vpc_crn"></a> [enable\_hub\_vpc\_crn](#input\_enable\_hub\_vpc\_crn) | Indicates whether Hub VPC CRN is passed. | `bool` | `false` | no |
196204
| <a name="input_enable_hub_vpc_id"></a> [enable\_hub\_vpc\_id](#input\_enable\_hub\_vpc\_id) | Indicates whether Hub VPC ID is passed. | `bool` | `false` | no |
@@ -235,6 +243,10 @@ To attach access management tags to resources in this module, you need the follo
235243
| <a name="output_dns_endpoint_gateways_by_crn"></a> [dns\_endpoint\_gateways\_by\_crn](#output\_dns\_endpoint\_gateways\_by\_crn) | The list of VPEs that are made available for DNS resolution in the created VPC. Only set if enable\_hub is false and enable\_hub\_vpc\_id are true. |
236244
| <a name="output_dns_endpoint_gateways_by_id"></a> [dns\_endpoint\_gateways\_by\_id](#output\_dns\_endpoint\_gateways\_by\_id) | The list of VPEs that are made available for DNS resolution in the created VPC. Only set if enable\_hub is false and enable\_hub\_vpc\_id are true. |
237245
| <a name="output_dns_instance_id"></a> [dns\_instance\_id](#output\_dns\_instance\_id) | The ID of the DNS instance. |
246+
| <a name="output_dns_record_ids"></a> [dns\_record\_ids](#output\_dns\_record\_ids) | List of all the domain resource records. |
247+
| <a name="output_dns_zone"></a> [dns\_zone](#output\_dns\_zone) | A map representing DNS zone information. |
248+
| <a name="output_dns_zone_id"></a> [dns\_zone\_id](#output\_dns\_zone\_id) | The ID of the DNS zone. |
249+
| <a name="output_dns_zone_state"></a> [dns\_zone\_state](#output\_dns\_zone\_state) | The state of the DNS zone. |
238250
| <a name="output_network_acls"></a> [network\_acls](#output\_network\_acls) | List of shortnames and IDs of network ACLs |
239251
| <a name="output_public_gateways"></a> [public\_gateways](#output\_public\_gateways) | Map of public gateways by zone |
240252
| <a name="output_subnet_detail_list"></a> [subnet\_detail\_list](#output\_subnet\_detail\_list) | A list of subnets containing names, CIDR blocks, and zones. |

‎examples/no-prefix/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,4 +7,4 @@ The following resources are provisioned by this example:
77
* A new resource group, if an existing one is not passed in.
88
* An IBM Virtual Private Cloud (VPC).
99
* An IBM Cloud Object Storage Instance
10-
* An IBMM Cloud Storage Bucket
10+
* An IBM Cloud Storage Bucket

‎examples/vpc-with-dns/README.md‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
# VPC with DNS example
2+
3+
A simple example demonstrating the provisioning of a `Secure Landing Zone (SLZ) Virtual Private Cloud (VPC)` across two zones (`Zone 1` and `Zone 2`). This setup includes the creation of `Domain Name System (DNS) Zones and Records`, linking the provisioned VPC as a permitted network for DNS operations.
4+
5+
The following resources are provisioned by this example:
6+
7+
* A new `resource group`, if an existing one is not passed in.
8+
9+
* An IBM `Virtual Private Cloud (VPC)` with a publicly exposed subnet.
10+
11+
* Private `DNS zone` which can only be resolved from IBM Cloud's private network.
12+
13+
* `DNS permitted network` - [DNS Service](https://cloud.ibm.com/docs/dns-svcs/getting-started.html) is a global service, hence the permitted networks (for example, a `VPC`) should be added from any IBM Cloud region. This adds the network to the DNS zone, giving the network access to the zone. Maximum of 10 permitted networks can be added to a `DNS zone`. [Learn more](https://cloud.ibm.com/docs/dns-svcs?topic=dns-svcs-managing-permitted-networks&interface=ui)
14+
15+
* `DNS Records` - `DNS Records` make the connection between human-readable names and IP addresses.
16+
17+
> Note: To create a `PTR` type record, you must have an existing `A` or `AAAA` record that is not already associated with another `PTR` record. [Learn More](https://cloud.ibm.com/docs/dns-svcs?topic=dns-svcs-managing-dns-records&interface=ui#ptr-record)

‎examples/vpc-with-dns/main.tf‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
##############################################################################
2+
# Resource Group
3+
##############################################################################
4+
5+
module "resource_group" {
6+
source = "terraform-ibm-modules/resource-group/ibm"
7+
version = "1.1.6"
8+
# if an existing resource group is not set (null) create a new one using prefix
9+
resource_group_name = var.resource_group == null ? "${var.prefix}-resource-group" : null
10+
existing_resource_group_name = var.resource_group
11+
}
12+
13+
#############################################################################
14+
# Locals
15+
#############################################################################
16+
locals {
17+
subnets = {
18+
zone-1 = [
19+
{
20+
name = "subnet-a"
21+
cidr = "10.10.10.0/24"
22+
public_gateway = true
23+
acl_name = "vpc-acl"
24+
}
25+
],
26+
zone-2 = [
27+
{
28+
name = "subnet-b"
29+
cidr = "10.20.10.0/24"
30+
public_gateway = false
31+
acl_name = "vpc-acl"
32+
}
33+
]
34+
}
35+
}
36+
37+
#############################################################################
38+
# Provision VPC
39+
#############################################################################
40+
41+
module "slz_vpc" {
42+
source = "../../"
43+
resource_group_id = module.resource_group.resource_group_id
44+
region = var.region
45+
name = var.name
46+
prefix = var.prefix
47+
tags = var.resource_tags
48+
enable_hub = true
49+
dns_zone_name = var.dns_zone_name
50+
dns_records = var.dns_records
51+
subnets = local.subnets
52+
}

‎examples/vpc-with-dns/outputs.tf‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
##############################################################################
2+
# Outputs
3+
##############################################################################
4+
5+
output "vpc_id" {
6+
value = module.slz_vpc.vpc_id
7+
description = "VPC id"
8+
}
9+
10+
output "vpc_crn" {
11+
value = module.slz_vpc.vpc_crn
12+
description = "VPC crn"
13+
}
14+
15+
output "network_acls" {
16+
value = module.slz_vpc.network_acls
17+
description = "VPC network ACLs"
18+
}
19+
20+
output "public_gateways" {
21+
value = module.slz_vpc.public_gateways
22+
description = "VPC public gateways"
23+
}
24+
25+
output "subnet_zone_list" {
26+
value = module.slz_vpc.subnet_zone_list
27+
description = "VPC subnet zone list"
28+
}
29+
30+
output "subnet_detail_map" {
31+
value = module.slz_vpc.subnet_detail_map
32+
description = "VPC subnet detail map"
33+
}
34+
35+
output "dns_zone_state" {
36+
description = "The state of the DNS zone."
37+
value = module.slz_vpc.dns_zone_state
38+
}
39+
40+
output "dns_zone_id" {
41+
description = "The ID of the DNS zone."
42+
value = module.slz_vpc.dns_zone_id
43+
}
44+
output "dns_record_ids" {
45+
description = "List of all the domain resource records."
46+
value = module.slz_vpc.dns_record_ids
47+
}
48+
49+
output "dns_zone" {
50+
description = "A map representing DNS zone information."
51+
value = module.slz_vpc.dns_zone
52+
}

‎examples/vpc-with-dns/provider.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
provider "ibm" {
2+
ibmcloud_api_key = var.ibmcloud_api_key
3+
region = var.region
4+
}

‎examples/vpc-with-dns/variables.tf‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
variable "ibmcloud_api_key" {
2+
description = "APIkey that's associated with the account to provision resources."
3+
type = string
4+
sensitive = true
5+
}
6+
7+
variable "region" {
8+
description = "The region to which to deploy the VPC"
9+
type = string
10+
default = "us-south"
11+
}
12+
13+
variable "prefix" {
14+
description = "The prefix that you would like to append to your resources"
15+
type = string
16+
default = "dns"
17+
}
18+
19+
variable "name" {
20+
description = "The name of the vpc"
21+
type = string
22+
default = "slz-vpc"
23+
}
24+
25+
variable "resource_group" {
26+
type = string
27+
description = "An existing resource group name to use for this example, if unset a new resource group will be created"
28+
default = null
29+
}
30+
31+
variable "resource_tags" {
32+
description = "List of Tags for the resource created"
33+
type = list(string)
34+
default = null
35+
}
36+
37+
variable "dns_records" {
38+
description = "List of DNS records to create"
39+
type = list(object({
40+
name = string
41+
type = string
42+
rdata = string
43+
ttl = optional(number)
44+
preference = optional(number)
45+
priority = optional(number)
46+
port = optional(number)
47+
protocol = optional(string)
48+
service = optional(string)
49+
weight = optional(number)
50+
}))
51+
default = [
52+
{
53+
name = "testA"
54+
type = "A"
55+
rdata = "1.2.3.4"
56+
ttl = 3600
57+
},
58+
{
59+
name = "testMX"
60+
type = "MX"
61+
rdata = "mailserver.test.com"
62+
preference = 10
63+
},
64+
{
65+
type = "SRV"
66+
name = "testSRV"
67+
rdata = "tester.com"
68+
priority = 100
69+
weight = 100
70+
port = 8000
71+
service = "_sip"
72+
protocol = "udp"
73+
},
74+
{
75+
name = "testTXT"
76+
type = "TXT"
77+
rdata = "textinformation"
78+
ttl = 900
79+
}
80+
]
81+
}
82+
83+
variable "dns_zone_name" {
84+
description = "The name of the DNS zone to be created."
85+
type = string
86+
default = "dns-example.com"
87+
}

‎examples/vpc-with-dns/version.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
terraform {
2+
required_version = ">= 1.3.0"
3+
required_providers {
4+
# Pin to the lowest provider version of the range defined in the main module's version.tf to ensure lowest version still works
5+
ibm = {
6+
source = "IBM-Cloud/ibm"
7+
version = "1.59.0"
8+
}
9+
}
10+
}

‎main.tf‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -355,3 +355,57 @@ resource "ibm_is_flow_log" "flow_logs" {
355355
}
356356

357357
##############################################################################
358+
# DNS ZONE
359+
# ##############################################################################
360+
361+
resource "ibm_dns_zone" "dns_zone" {
362+
count = var.enable_hub && !var.skip_custom_resolver_hub_creation ? 1 : 0
363+
name = var.dns_zone_name
364+
instance_id = var.use_existing_dns_instance ? var.existing_dns_instance_id : ibm_resource_instance.dns_instance_hub[0].guid
365+
description = var.dns_zone_description
366+
label = var.dns_zone_label
367+
}
368+
369+
##############################################################################
370+
# DNS PERMITTED NETWORK
371+
##############################################################################
372+
373+
resource "ibm_dns_permitted_network" "dns_permitted_network" {
374+
count = var.enable_hub && !var.skip_custom_resolver_hub_creation ? 1 : 0
375+
instance_id = var.use_existing_dns_instance ? var.existing_dns_instance_id : ibm_resource_instance.dns_instance_hub[0].guid
376+
zone_id = ibm_dns_zone.dns_zone[0].zone_id
377+
vpc_crn = local.vpc_crn
378+
type = "vpc"
379+
}
380+
381+
##############################################################################
382+
# DNS Records
383+
##############################################################################
384+
385+
resource "ibm_dns_resource_record" "dns_record" {
386+
for_each = length(ibm_dns_zone.dns_zone) > 0 ? { for idx, record in var.dns_records : idx => record } : {}
387+
instance_id = var.use_existing_dns_instance ? var.existing_dns_instance_id : ibm_resource_instance.dns_instance_hub[0].guid
388+
zone_id = ibm_dns_zone.dns_zone[0].zone_id
389+
name = each.value.name
390+
type = each.value.type
391+
392+
# Default ttl is 15 minutes [Refer](https://cloud.ibm.com/docs/dns-svcs?topic=dns-svcs-managing-dns-records&interface=ui)
393+
ttl = try(each.value.ttl, 900)
394+
rdata = each.value.rdata
395+
396+
# SRV values
397+
port = each.value.type == "SRV" ? each.value.port : null
398+
priority = each.value.type == "SRV" ? each.value.priority : null
399+
protocol = each.value.type == "SRV" ? each.value.protocol : null
400+
service = each.value.type == "SRV" ? startswith(each.value.service, "_") ? each.value.service : "_${each.value.service}" : null
401+
weight = each.value.type == "SRV" ? each.value.weight : null
402+
403+
# MX record
404+
preference = each.value.type == "MX" ? each.value.preference : null
405+
}
406+
407+
locals {
408+
record_ids = [for record in ibm_dns_resource_record.dns_record : element(split("/", record.id), 2)]
409+
}
410+
411+
##############################################################################

‎outputs.tf‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -176,3 +176,24 @@ output "dns_custom_resolver_id" {
176176
description = "The ID of the DNS Custom Resolver."
177177
value = (var.enable_hub && !var.skip_custom_resolver_hub_creation) ? one(ibm_dns_custom_resolver.custom_resolver_hub[*].instance_id) : null
178178
}
179+
180+
## DNS Zone and Records
181+
output "dns_zone_state" {
182+
description = "The state of the DNS zone."
183+
value = length(ibm_dns_zone.dns_zone) > 0 ? ibm_dns_zone.dns_zone[0].state : null
184+
}
185+
186+
output "dns_zone_id" {
187+
description = "The ID of the DNS zone."
188+
value = length(ibm_dns_zone.dns_zone) > 0 ? ibm_dns_zone.dns_zone[0].zone_id : null
189+
}
190+
191+
output "dns_zone" {
192+
description = "A map representing DNS zone information."
193+
value = length(ibm_dns_zone.dns_zone) > 0 ? ibm_dns_zone.dns_zone[0] : null
194+
}
195+
196+
output "dns_record_ids" {
197+
description = "List of all the domain resource records."
198+
value = length(ibm_dns_resource_record.dns_record) > 0 ? local.record_ids : null
199+
}

0 commit comments

Comments
 (0)