Add support for DNS routing policies

modules/dns/README.md

@@ -53,25 +53,58 @@ module "private-dns" {
 }
 # tftest modules=1 resources=1
 ```
+
+### Routing Policies
+
+```hcl
+module "private-dns" {
+  source          = "./fabric/modules/dns"
+  project_id      = "myproject"
+  type            = "private"
+  name            = "test-example"
+  domain          = "test.example."
+  client_networks = [var.vpc.self_link]
+  recordsets = {
+    "A regular" = { records = ["10.20.0.1"] }
+    "A geo" = {
+      geo_routing = [
+        { location = "europe-west1", records = ["10.0.0.1"] },
+        { location = "europe-west2", records = ["10.0.0.2"] },
+        { location = "europe-west3", records = ["10.0.0.3"] }
+      ]
+    }
+
+    "A wrr" = {
+      ttl = 600
+      wrr_routing = [
+        { weight = 0.6, records = ["10.10.0.1"] },
+        { weight = 0.2, records = ["10.10.0.2"] },
+        { weight = 0.2, records = ["10.10.0.3"] }
+      ]
+    }
+  }
+}
+# tftest modules=1 resources=4
+```
 <!-- BEGIN TFDOC -->
 
 ## Variables
 
 | name | description | type | required | default |
 |---|---|:---:|:---:|:---:|
-| [domain](variables.tf#L51) | Zone domain, must end with a period. | <code>string</code> | ✓ |  |
-| [name](variables.tf#L69) | Zone name, must be unique within the project. | <code>string</code> | ✓ |  |
-| [project_id](variables.tf#L80) | Project id for the zone. | <code>string</code> | ✓ |  |
+| [domain](variables.tf#L54) | Zone domain, must end with a period. | <code>string</code> | ✓ |  |
+| [name](variables.tf#L72) | Zone name, must be unique within the project. | <code>string</code> | ✓ |  |
+| [project_id](variables.tf#L83) | Project id for the zone. | <code>string</code> | ✓ |  |
 | [client_networks](variables.tf#L21) | List of VPC self links that can see this zone. | <code>list&#40;string&#41;</code> |  | <code>&#91;&#93;</code> |
 | [description](variables.tf#L28) | Domain description. | <code>string</code> |  | <code>&#34;Terraform managed.&#34;</code> |
-| [dnssec_config](variables.tf#L34) | DNSSEC configuration for this zone. | <code title="object&#40;&#123;&#10;  non_existence &#61; optional&#40;string, &#34;nsec3&#34;&#41;&#10;  state         &#61; string&#10;  key_signing_key &#61; optional&#40;object&#40;&#10;    &#123; algorithm &#61; string, key_length &#61; number &#125;&#41;,&#10;    &#123; algorithm &#61; &#34;rsasha256&#34;, key_length &#61; 2048 &#125;&#10;  &#41;&#10;  zone_signing_key &#61; optional&#40;object&#40;&#10;    &#123; algorithm &#61; string, key_length &#61; number &#125;&#41;,&#10;    &#123; algorithm &#61; &#34;rsasha256&#34;, key_length &#61; 1024 &#125;&#10;  &#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>null</code> |
-| [enable_logging](variables.tf#L62) | Enable query logging for this zone. Only valid for public zones. | <code>bool</code> |  | <code>false</code> |
-| [forwarders](variables.tf#L56) | Map of {IPV4_ADDRESS => FORWARDING_PATH} for 'forwarding' zone types. Path can be 'default', 'private', or null for provider default. | <code>map&#40;string&#41;</code> |  | <code>&#123;&#125;</code> |
-| [peer_network](variables.tf#L74) | Peering network self link, only valid for 'peering' zone types. | <code>string</code> |  | <code>null</code> |
-| [recordsets](variables.tf#L85) | Map of DNS recordsets in \"type name\" => {ttl, [records]} format. | <code title="map&#40;object&#40;&#123;&#10;  ttl     &#61; optional&#40;number, 300&#41;&#10;  records &#61; list&#40;string&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
-| [service_directory_namespace](variables.tf#L102) | Service directory namespace id (URL), only valid for 'service-directory' zone types. | <code>string</code> |  | <code>null</code> |
-| [type](variables.tf#L108) | Type of zone to create, valid values are 'public', 'private', 'forwarding', 'peering', 'service-directory'. | <code>string</code> |  | <code>&#34;private&#34;</code> |
-| [zone_create](variables.tf#L118) | Create zone. When set to false, uses a data source to reference existing zone. | <code>bool</code> |  | <code>true</code> |
+| [dnssec_config](variables.tf#L34) | DNSSEC configuration for this zone. | <code title="object&#40;&#123;&#10;  non_existence &#61; optional&#40;string, &#34;nsec3&#34;&#41;&#10;  state         &#61; string&#10;  key_signing_key &#61; optional&#40;object&#40;&#10;    &#123; algorithm &#61; string, key_length &#61; number &#125;&#41;,&#10;    &#123; algorithm &#61; &#34;rsasha256&#34;, key_length &#61; 2048 &#125;&#10;  &#41;&#10;  zone_signing_key &#61; optional&#40;object&#40;&#10;    &#123; algorithm &#61; string, key_length &#61; number &#125;&#41;,&#10;    &#123; algorithm &#61; &#34;rsasha256&#34;, key_length &#61; 1024 &#125;&#10;  &#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code title="&#123;&#10;  state &#61; &#34;off&#34;&#10;&#125;">&#123;&#8230;&#125;</code> |
+| [enable_logging](variables.tf#L65) | Enable query logging for this zone. Only valid for public zones. | <code>bool</code> |  | <code>false</code> |
+| [forwarders](variables.tf#L59) | Map of {IPV4_ADDRESS => FORWARDING_PATH} for 'forwarding' zone types. Path can be 'default', 'private', or null for provider default. | <code>map&#40;string&#41;</code> |  | <code>&#123;&#125;</code> |
+| [peer_network](variables.tf#L77) | Peering network self link, only valid for 'peering' zone types. | <code>string</code> |  | <code>null</code> |
+| [recordsets](variables.tf#L88) | Map of DNS recordsets in \"type name\" => {ttl, [records]} format. | <code title="map&#40;object&#40;&#123;&#10;  ttl     &#61; optional&#40;number, 300&#41;&#10;  records &#61; optional&#40;list&#40;string&#41;&#41;&#10;  geo_routing &#61; optional&#40;list&#40;object&#40;&#123;&#10;    location &#61; string&#10;    records  &#61; list&#40;string&#41;&#10;  &#125;&#41;&#41;&#41;&#10;  wrr_routing &#61; optional&#40;list&#40;object&#40;&#123;&#10;    weight  &#61; number&#10;    records &#61; list&#40;string&#41;&#10;  &#125;&#41;&#41;&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
+| [service_directory_namespace](variables.tf#L123) | Service directory namespace id (URL), only valid for 'service-directory' zone types. | <code>string</code> |  | <code>null</code> |
+| [type](variables.tf#L129) | Type of zone to create, valid values are 'public', 'private', 'forwarding', 'peering', 'service-directory'. | <code>string</code> |  | <code>&#34;private&#34;</code> |
+| [zone_create](variables.tf#L139) | Create zone. When set to false, uses a data source to reference existing zone. | <code>bool</code> |  | <code>true</code> |
 
 ## Outputs
 

modules/dns/main.tf

@@ -15,10 +15,42 @@
  */
 
 locals {
-  recordsets = {
+  # split record name and type and set as keys in a map
+  _recordsets_0 = {
     for key, attrs in var.recordsets :
     key => merge(attrs, zipmap(["type", "name"], split(" ", key)))
   }
+  # compute the final resource name for the recordset
+  _recordsets = {
+    for key, attrs in local._recordsets_0 :
+    key => merge(attrs, {
+      resource_name = (
+        attrs.name == ""
+        ? var.domain
+        : (
+          substr(attrs.name, -1, 1) == "."
+          ? attrs.name
+          : "${attrs.name}.${var.domain}"
+        )
+      )
+    })
+  }
+  # split recordsets between regular, geo and wrr
+  geo_recordsets = {
+    for k, v in local._recordsets :
+    k => v
+    if v.geo_routing != null
+  }
+  regular_recordsets = {
+    for k, v in local._recordsets :
+    k => v
+    if v.records != null
+  }
+  wrr_recordsets = {
+    for k, v in local._recordsets :
+    k => v
+    if v.wrr_routing != null
+  }
   zone = (
     var.zone_create
     ? try(
@@ -149,23 +181,72 @@ data "google_dns_keys" "dns_keys" {
 resource "google_dns_record_set" "cloud-static-records" {
   for_each = (
     var.type == "public" || var.type == "private"
-    ? local.recordsets
+    ? local.regular_recordsets
     : {}
   )
   project      = var.project_id
   managed_zone = var.name
-  name = (
-    each.value.name == ""
-    ? var.domain
-    : (
-      substr(each.value.name, -1, 1) == "."
-      ? each.value.name
-      : "${each.value.name}.${var.domain}"
-    )
+  name         = each.value.resource_name
+  type         = each.value.type
+  ttl          = each.value.ttl
+  rrdatas      = each.value.records
+
+  depends_on = [
+    google_dns_managed_zone.non-public, google_dns_managed_zone.public
+  ]
+}
+
+resource "google_dns_record_set" "cloud-geo-records" {
+  for_each = (
+    var.type == "public" || var.type == "private"
+    ? local.geo_recordsets
+    : {}
+  )
+  project      = var.project_id
+  managed_zone = var.name
+  name         = each.value.resource_name
+  type         = each.value.type
+  ttl          = each.value.ttl
+
+  routing_policy {
+    dynamic "geo" {
+      for_each = each.value.geo_routing
+      iterator = policy
+      content {
+        location = policy.value.location
+        rrdatas  = policy.value.records
+      }
+    }
+  }
+
+  depends_on = [
+    google_dns_managed_zone.non-public, google_dns_managed_zone.public
+  ]
+}
+
+resource "google_dns_record_set" "cloud-wrr-records" {
+  for_each = (
+    var.type == "public" || var.type == "private"
+    ? local.wrr_recordsets
+    : {}
   )
-  type    = each.value.type
-  ttl     = each.value.ttl
-  rrdatas = each.value.records
+  project      = var.project_id
+  managed_zone = var.name
+  name         = each.value.resource_name
+  type         = each.value.type
+  ttl          = each.value.ttl
+
+  routing_policy {
+    dynamic "wrr" {
+      for_each = each.value.wrr_routing
+      iterator = policy
+      content {
+        weight  = policy.value.weight
+        rrdatas = policy.value.records
+      }
+    }
+  }
+
   depends_on = [
     google_dns_managed_zone.non-public, google_dns_managed_zone.public
   ]

modules/dns/variables.tf

@@ -45,7 +45,10 @@ variable "dnssec_config" {
       { algorithm = "rsasha256", key_length = 1024 }
     )
   })
-  default = null
+  default = {
+    state = "off"
+  }
+  nullable = false
 }
 
 variable "domain" {
@@ -86,17 +89,35 @@ variable "recordsets" {
   description = "Map of DNS recordsets in \"type name\" => {ttl, [records]} format."
   type = map(object({
     ttl     = optional(number, 300)
-    records = list(string)
+    records = optional(list(string))
+    geo_routing = optional(list(object({
+      location = string
+      records  = list(string)
+    })))
+    wrr_routing = optional(list(object({
+      weight  = number
+      records = list(string)
+    })))
   }))
   default  = {}
   nullable = false
   validation {
     condition = alltrue([
-      for k, v in var.recordsets == null ? {} : var.recordsets :
+      for k, v in coalesce(var.recordsets, {}) :
       length(split(" ", k)) == 2
     ])
     error_message = "Recordsets must have keys in the format \"type name\"."
   }
+  validation {
+    condition = alltrue([
+      for k, v in coalesce(var.recordsets, {}) : (
+        (v.records != null && v.wrr_routing == null && v.geo_routing == null) ||
+        (v.records == null && v.wrr_routing != null && v.geo_routing == null) ||
+        (v.records == null && v.wrr_routing == null && v.geo_routing != null)
+      )
+    ])
+    error_message = "Only one of records, wrr_routing or geo_routing can be defined for each recordset."
+  }
 }
 
 variable "service_directory_namespace" {

tests/modules/dns/fixture/variables.tf

@@ -32,15 +32,27 @@ variable "peer_network" {
 }
 
 variable "recordsets" {
-  type = map(object({
-    ttl     = number
-    records = list(string)
-  }))
+  type = any
   default = {
     "A localhost"                = { ttl = 300, records = ["127.0.0.1"] }
     "A local-host.test.example." = { ttl = 300, records = ["127.0.0.2"] }
     "CNAME *"                    = { ttl = 300, records = ["localhost.example.org."] }
     "A "                         = { ttl = 300, records = ["127.0.0.3"] }
+    "A geo" = {
+      geo_routing = [
+        { location = "europe-west1", records = ["127.0.0.4"] },
+        { location = "europe-west2", records = ["127.0.0.5"] },
+        { location = "europe-west3", records = ["127.0.0.6"] }
+      ]
+    }
+    "A wrr" = {
+      ttl = 600
+      wrr_routing = [
+        { weight = 0.6, records = ["127.0.0.7"] },
+        { weight = 0.2, records = ["127.0.0.8"] },
+        { weight = 0.2, records = ["10.10.0.9"] }
+      ]
+    }
   }
 }