Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add type field to DNS authorization reosurce #10030

Merged
Show file tree
Hide file tree
Changes from 5 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions mmv1/products/certificatemanager/Certificate.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -88,6 +88,13 @@ examples:
dns_auth_name2: 'dns-auth2'
dns_auth_subdomain2: 'subdomain2'
cert_name: 'dns-cert'
- !ruby/object:Provider::Terraform::Examples
name: 'certificate_manager_google_managed_regional_certificate_dns_auth'
primary_resource_id: 'default'
vars:
dns_auth_name: 'dns-auth'
dns_auth_subdomain: 'subdomain'
cert_name: 'dns-cert'
custom_code: !ruby/object:Provider::Terraform::CustomCode
constants: templates/terraform/constants/cert_manager.erb
parameters:
Expand Down
23 changes: 23 additions & 0 deletions mmv1/products/certificatemanager/DnsAuthorization.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,13 @@ examples:
dns_auth_name: 'dns-auth'
zone_name: 'my-zone'
subdomain: 'subdomain'
- !ruby/object:Provider::Terraform::Examples
name: 'certificate_manager_dns_authorization_regional'
primary_resource_id: 'default'
vars:
dns_auth_name: 'dns-auth'
zone_name: 'my-zone'
subdomain: 'subdomain'
parameters:
- !ruby/object:Api::Type::String
name: 'name'
Expand Down Expand Up @@ -84,6 +91,22 @@ properties:
A domain which is being authorized. A DnsAuthorization resource covers a
single domain and its wildcard, e.g. authorization for "example.com" can
be used to issue certificates for "example.com" and "*.example.com".
- !ruby/object:Api::Type::Enum
name: type
description: |
type of DNS authorization. If unset during the resource creation, FIXED_RECORD will
be used for global resources, and PER_PROJECT_RECORD will be used for other locations.

FIXED_RECORD DNS authorization uses DNS-01 validation method

PER_PROJECT_RECORD DNS authorization allows for independent management
of Google-managed certificates with DNS authorization across multiple
projects.
immutable: true
values:
- :FIXED_RECORD
- :PER_PROJECT_RECORD
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Seems like when an ENUM field is marked with default_from_api, TF accepts whatever value that comes from the API without checking if this value is a valid ENUM value. It looks to me as a bug in TF side.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

not necessarily, since we know that the type value will be returned as any of the values listed, being either FIXED_RECORD or PER_PROJECT_RECORD

default_from_api: true
- !ruby/object:Api::Type::NestedObject
name: 'dnsResourceRecord'
output: true
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
resource "google_certificate_manager_dns_authorization" "<%= ctx[:primary_resource_id] %>" {
name = "<%= ctx[:vars]['dns_auth_name'] %>"
location = "us-central1"
description = "reginal dns"
domain = "<%= ctx[:vars]['subdomain'] %>.hashicorptest.com"
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
resource "google_certificate_manager_certificate" "<%= ctx[:primary_resource_id] %>" {
name = "<%= ctx[:vars]['cert_name'] %>"
description = "regional managed certs"
location = "us-central1"
managed {
domains = [
google_certificate_manager_dns_authorization.instance.domain,
]
dns_authorizations = [
google_certificate_manager_dns_authorization.instance.id,
]
}
}
resource "google_certificate_manager_dns_authorization" "instance" {
name = "<%= ctx[:vars]['dns_auth_name'] %>"
location = "us-central1"
description = "The default dnss"
domain = "<%= ctx[:vars]['dns_auth_subdomain'] %>.hashicorptest.com"
}