Skip to content

Commit d890f69

Browse files
siijmDqEaiPRsrinioci
siijmDqEaiPR
authored and
srinioci
committed
Added - Support for DNSSEC
1 parent 719910b commit d890f69

34 files changed

+1553
-92
lines changed

‎examples/dns/dnssec/provider.tf‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
// Copyright (c) 2017, 2023, Oracle and/or its affiliates. All rights reserved.
2+
// Licensed under the Mozilla Public License v2.0
3+
4+
/*
5+
* Provider config for dns sample
6+
*/
7+
8+
variable "tenancy_ocid" {
9+
}
10+
11+
variable "user_ocid" {
12+
}
13+
14+
variable "fingerprint" {
15+
}
16+
17+
variable "private_key_path" {
18+
}
19+
20+
variable "compartment_ocid" {
21+
}
22+
23+
variable "region" {
24+
}
25+
26+
provider "oci" {
27+
region = var.region
28+
tenancy_ocid = var.tenancy_ocid
29+
user_ocid = var.user_ocid
30+
fingerprint = var.fingerprint
31+
private_key_path = var.private_key_path
32+
}
33+

‎examples/dns/dnssec/zone.tf‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
// Copyright (c) 2017, 2023, Oracle and/or its affiliates. All rights reserved.
2+
// Licensed under the Mozilla Public License v2.0
3+
4+
/*
5+
* This file demonstrates initial setup of a dnssec enabled zone when the zone's
6+
* parent zone is in OCI. It does not demonstrate setting up dnssec for the parent
7+
* zone or handle rotating the dnssec key versions.
8+
*/
9+
10+
resource "random_string" "random_prefix" {
11+
length = 4
12+
numeric = false
13+
special = false
14+
}
15+
16+
resource "oci_dns_zone" "dnssec_parent_zone" {
17+
compartment_id = var.compartment_ocid
18+
name = "${data.oci_identity_tenancy.tenancy.name}-${random_string.random_prefix.result}-tf-example-dnssec-parent.oci-dns"
19+
zone_type = "PRIMARY"
20+
scope = "GLOBAL"
21+
dnssec_state = "ENABLED"
22+
}
23+
24+
resource "oci_dns_zone" "dnssec_child_zone" {
25+
compartment_id = var.compartment_ocid
26+
name = "child.${oci_dns_zone.dnssec_parent_zone.name}"
27+
zone_type = "PRIMARY"
28+
scope = "GLOBAL"
29+
dnssec_state = "ENABLED"
30+
}
31+
32+
resource "oci_dns_rrset" "parent_zone_ns_rrset" {
33+
zone_name_or_id = oci_dns_zone.dnssec_parent_zone.id
34+
domain = oci_dns_zone.dnssec_child_zone.name
35+
rtype = "NS"
36+
37+
items {
38+
domain = oci_dns_zone.dnssec_child_zone.name
39+
rtype = "NS"
40+
rdata = oci_dns_zone.dnssec_child_zone.nameservers[0].hostname
41+
ttl = 86400
42+
}
43+
}
44+
45+
locals {
46+
ksk = oci_dns_zone.dnssec_child_zone.dnssec_config[0].ksk_dnssec_key_versions[0]
47+
}
48+
49+
resource "oci_dns_rrset" "parent_zone_ds_rrset" {
50+
zone_name_or_id = oci_dns_zone.dnssec_parent_zone.id
51+
domain = oci_dns_zone.dnssec_child_zone.name
52+
rtype = "DS"
53+
54+
items {
55+
domain = oci_dns_zone.dnssec_child_zone.name
56+
rtype = "DS"
57+
rdata = local.ksk.ds_data[0].rdata
58+
ttl = 86400
59+
}
60+
61+
lifecycle {
62+
ignore_changes = [
63+
items,
64+
]
65+
}
66+
}
67+
68+
resource "oci_dns_zone_promote_dnssec_key_version" "promote_dnssec_key_version" {
69+
dnssec_key_version_uuid = local.ksk.uuid
70+
zone_id = oci_dns_zone.dnssec_child_zone.id
71+
scope = "GLOBAL"
72+
depends_on = [oci_dns_rrset.parent_zone_ds_rrset]
73+
lifecycle {
74+
ignore_changes = [
75+
dnssec_key_version_uuid,
76+
]
77+
}
78+
}
79+
80+
data "oci_identity_tenancy" "tenancy" {
81+
tenancy_id = var.tenancy_ocid
82+
}
83+

‎examples/dns/global/zone.tf‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,20 @@ resource "oci_dns_zone" "zone3" {
4646
zone_type = "PRIMARY"
4747
}
4848

49+
resource "oci_dns_zone" "zone4" {
50+
compartment_id = var.compartment_ocid
51+
name = "${data.oci_identity_tenancy.tenancy.name}-${random_string.random_prefix.result}-tf-example-primary.oci-dns4"
52+
zone_type = "PRIMARY"
53+
scope = "GLOBAL"
54+
dnssec_state = "ENABLED"
55+
}
56+
57+
resource "oci_dns_zone_stage_dnssec_key_version" "stage_dnssec_key_version" {
58+
predecessor_dnssec_key_version_uuid = oci_dns_zone.zone4.dnssec_config[0].zsk_dnssec_key_versions[0].uuid
59+
zone_id = oci_dns_zone.zone4.id
60+
scope = "GLOBAL"
61+
}
62+
4963
data "oci_dns_zones" "zs" {
5064
compartment_id = var.compartment_ocid
5165
name_contains = "example"

‎internal/integrationtest/dns_zone_dnssec_test.go‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
// Copyright (c) 2017, 2023, Oracle and/or its affiliates. All rights reserved.
2+
// Licensed under the Mozilla Public License v2.0
3+
4+
package integrationtest
5+
6+
import (
7+
"fmt"
8+
"testing"
9+
10+
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
11+
12+
"github.com/oracle/terraform-provider-oci/httpreplay"
13+
"github.com/oracle/terraform-provider-oci/internal/acctest"
14+
"github.com/oracle/terraform-provider-oci/internal/utils"
15+
)
16+
17+
var (
18+
zoneRepresentationGlobal = map[string]interface{}{
19+
"compartment_id": acctest.Representation{RepType: acctest.Required, Create: `${var.compartment_id}`},
20+
"name": acctest.Representation{RepType: acctest.Required,
21+
Create: `${data.oci_identity_tenancy.test_tenancy.name}.{{.token}}.stage-dnssec-key-version-test`},
22+
"zone_type": acctest.Representation{RepType: acctest.Required, Create: `PRIMARY`},
23+
"scope": acctest.Representation{RepType: acctest.Required, Create: `GLOBAL`},
24+
}
25+
26+
ZoneResourceDnssecDependencies = `
27+
data "oci_identity_tenancy" "test_tenancy" {
28+
tenancy_id = "${var.tenancy_ocid}"
29+
}
30+
`
31+
)
32+
33+
func TestDnsZoneResourceDnssec(t *testing.T) {
34+
httpreplay.SetScenario("TestDnsZoneResourceDnssec")
35+
defer httpreplay.SaveScenario()
36+
37+
config := acctest.ProviderTestConfig()
38+
39+
compartmentId := utils.GetEnvSettingWithBlankDefault("compartment_ocid")
40+
compartmentIdVariableStr := fmt.Sprintf("variable \"compartment_id\" { default = \"%s\" }\n", compartmentId)
41+
42+
resourceName := "oci_dns_zone.test_zone"
43+
44+
_, tokenFn := acctest.TokenizeWithHttpReplay("dns_zone")
45+
46+
acctest.ResourceTest(t, testAccCheckDnsZoneDestroy, []resource.TestStep{
47+
// create a zone with DNSSEC disabled
48+
{
49+
Config: tokenFn(config+compartmentIdVariableStr+ZoneResourceDnssecDependencies+
50+
acctest.GenerateResourceFromRepresentationMap("oci_dns_zone", "test_zone", acctest.Required,
51+
acctest.Create, zoneRepresentationGlobal), nil),
52+
Check: acctest.ComposeAggregateTestCheckFuncWrapper(
53+
resource.TestCheckResourceAttr(resourceName, "dnssec_state", "DISABLED"),
54+
),
55+
},
56+
57+
// verify enabling DNSSEC
58+
{
59+
Config: tokenFn(config+compartmentIdVariableStr+ZoneResourceDnssecDependencies+
60+
acctest.GenerateResourceFromRepresentationMap("oci_dns_zone", "test_zone", acctest.Optional,
61+
acctest.Update, acctest.RepresentationCopyWithNewProperties(zoneRepresentationGlobal,
62+
map[string]interface{}{
63+
"dnssec_state": acctest.Representation{RepType: acctest.Optional,
64+
Create: `ENABLED`},
65+
})), nil),
66+
Check: acctest.ComposeAggregateTestCheckFuncWrapper(
67+
resource.TestCheckResourceAttr(resourceName, "dnssec_state", "ENABLED"),
68+
resource.TestCheckResourceAttr(resourceName, "dnssec_config.0.zsk_dnssec_key_versions.#", "1"),
69+
resource.TestCheckResourceAttr(resourceName, "dnssec_config.0.ksk_dnssec_key_versions.#", "1"),
70+
),
71+
},
72+
73+
// delete before next Create
74+
{
75+
Config: tokenFn(config+compartmentIdVariableStr, nil),
76+
},
77+
78+
// verify zone creation with DNSSEC enabled
79+
{
80+
Config: tokenFn(config+compartmentIdVariableStr+ZoneResourceDnssecDependencies+
81+
acctest.GenerateResourceFromRepresentationMap("oci_dns_zone", "test_zone", acctest.Optional, acctest.Create,
82+
acctest.RepresentationCopyWithNewProperties(zoneRepresentationGlobal, map[string]interface{}{
83+
"dnssec_state": acctest.Representation{RepType: acctest.Required,
84+
Create: `ENABLED`},
85+
})), nil),
86+
Check: acctest.ComposeAggregateTestCheckFuncWrapper(
87+
resource.TestCheckResourceAttr(resourceName, "dnssec_state", "ENABLED"),
88+
resource.TestCheckResourceAttr(resourceName, "dnssec_config.0.zsk_dnssec_key_versions.#", "1"),
89+
resource.TestCheckResourceAttr(resourceName, "dnssec_config.0.ksk_dnssec_key_versions.#", "1"),
90+
),
91+
},
92+
93+
// verify disabling DNSSEC
94+
{
95+
Config: tokenFn(config+compartmentIdVariableStr+ZoneResourceDnssecDependencies+
96+
acctest.GenerateResourceFromRepresentationMap("oci_dns_zone", "test_zone", acctest.Optional,
97+
acctest.Update, acctest.RepresentationCopyWithNewProperties(zoneRepresentationGlobal,
98+
map[string]interface{}{
99+
"dnssec_state": acctest.Representation{RepType: acctest.Optional,
100+
Create: `DISABLED`},
101+
})), nil),
102+
Check: acctest.ComposeAggregateTestCheckFuncWrapper(
103+
resource.TestCheckResourceAttr(resourceName, "dnssec_state", "DISABLED"),
104+
),
105+
},
106+
})
107+
}

‎internal/integrationtest/dns_zone_promote_dnssec_key_version_test.go‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
// Copyright (c) 2017, 2024, Oracle and/or its affiliates. All rights reserved.
2+
// Licensed under the Mozilla Public License v2.0
3+
4+
package integrationtest
5+
6+
import (
7+
"fmt"
8+
"testing"
9+
10+
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
11+
12+
"github.com/oracle/terraform-provider-oci/httpreplay"
13+
"github.com/oracle/terraform-provider-oci/internal/acctest"
14+
"github.com/oracle/terraform-provider-oci/internal/utils"
15+
)
16+
17+
var (
18+
ZonePromoteDnssecKeyVersionResourceDependencies = acctest.GenerateResourceFromRepresentationMap("oci_dns_zone",
19+
"test_dnssec_zone", acctest.Required, acctest.Create, zoneRepresentationDnssec) +
20+
DefinedTagsDependencies + `
21+
data "oci_identity_tenancy" "test_tenancy" {
22+
tenancy_id = "${var.tenancy_ocid}"
23+
}
24+
`
25+
)
26+
27+
// issue-routing-tag: dns/default
28+
func TestDnsZonePromoteDnssecKeyVersionResource_basic(t *testing.T) {
29+
httpreplay.SetScenario("TestDnsZonePromoteDnssecKeyVersionResource_basic")
30+
defer httpreplay.SaveScenario()
31+
32+
config := acctest.ProviderTestConfig()
33+
34+
compartmentId := utils.GetEnvSettingWithBlankDefault("compartment_ocid")
35+
compartmentIdVariableStr := fmt.Sprintf("variable \"compartment_id\" { default = \"%s\" }\n", compartmentId)
36+
37+
resourceName := "oci_dns_zone.test_dnssec_zone"
38+
39+
_, tokenFn := acctest.TokenizeWithHttpReplay("dns_resource")
40+
41+
acctest.ResourceTest(t, nil, []resource.TestStep{
42+
43+
// Create a dnssec enabled zone
44+
{
45+
Config: tokenFn(config+compartmentIdVariableStr+ZonePromoteDnssecKeyVersionResourceDependencies, nil),
46+
},
47+
48+
// Promote the staged KSK version
49+
{
50+
Config: tokenFn(config+compartmentIdVariableStr+ZonePromoteDnssecKeyVersionResourceDependencies+`
51+
resource "oci_dns_zone_promote_dnssec_key_version" "test_zone_promote_dnssec_key_version" {
52+
zone_id = oci_dns_zone.test_dnssec_zone.id
53+
dnssec_key_version_uuid = oci_dns_zone.test_dnssec_zone.dnssec_config[0].ksk_dnssec_key_versions[0].uuid
54+
scope = "GLOBAL"
55+
}
56+
`, nil),
57+
},
58+
59+
// Validate that the KSK key version's time_promoted was updated.
60+
// This requires a separate step because it requires a refresh of the/zone resource.
61+
{
62+
Config: tokenFn(config+compartmentIdVariableStr+ZonePromoteDnssecKeyVersionResourceDependencies, nil),
63+
Check: acctest.ComposeAggregateTestCheckFuncWrapper(
64+
resource.TestCheckResourceAttrSet(resourceName, "dnssec_config.0.ksk_dnssec_key_versions.0.time_promoted"),
65+
),
66+
},
67+
})
68+
}

‎internal/integrationtest/dns_zone_stage_dnssec_key_version_test.go‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
// Copyright (c) 2017, 2024, Oracle and/or its affiliates. All rights reserved.
2+
// Licensed under the Mozilla Public License v2.0
3+
4+
package integrationtest
5+
6+
import (
7+
"fmt"
8+
"testing"
9+
10+
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
11+
12+
"github.com/oracle/terraform-provider-oci/httpreplay"
13+
"github.com/oracle/terraform-provider-oci/internal/acctest"
14+
"github.com/oracle/terraform-provider-oci/internal/utils"
15+
)
16+
17+
var (
18+
zoneRepresentationDnssec = map[string]interface{}{
19+
"compartment_id": acctest.Representation{RepType: acctest.Required, Create: `${var.compartment_id}`},
20+
"name": acctest.Representation{RepType: acctest.Required,
21+
Create: `${data.oci_identity_tenancy.test_tenancy.name}.{{.token}}.stage-dnssec-key-version-test`},
22+
"zone_type": acctest.Representation{RepType: acctest.Required, Create: `PRIMARY`},
23+
"scope": acctest.Representation{RepType: acctest.Required, Create: `GLOBAL`},
24+
"dnssec_state": acctest.Representation{RepType: acctest.Required, Create: `ENABLED`},
25+
}
26+
27+
ZoneStageDnssecKeyVersionResourceDependencies = acctest.GenerateResourceFromRepresentationMap("oci_dns_zone",
28+
"test_dnssec_zone", acctest.Required, acctest.Create, zoneRepresentationDnssec) +
29+
DefinedTagsDependencies + `
30+
data "oci_identity_tenancy" "test_tenancy" {
31+
tenancy_id = "${var.tenancy_ocid}"
32+
}
33+
`
34+
)
35+
36+
// issue-routing-tag: dns/default
37+
func TestDnsZoneStageDnssecKeyVersionResource_basic(t *testing.T) {
38+
httpreplay.SetScenario("TestDnsZoneStageDnssecKeyVersionResource_basic")
39+
defer httpreplay.SaveScenario()
40+
41+
config := acctest.ProviderTestConfig()
42+
43+
compartmentId := utils.GetEnvSettingWithBlankDefault("compartment_ocid")
44+
compartmentIdVariableStr := fmt.Sprintf("variable \"compartment_id\" { default = \"%s\" }\n", compartmentId)
45+
46+
resourceName := "oci_dns_zone.test_dnssec_zone"
47+
48+
_, tokenFn := acctest.TokenizeWithHttpReplay("dns_resource")
49+
50+
acctest.ResourceTest(t, nil, []resource.TestStep{
51+
52+
// Create a dnssec enabled zone
53+
{
54+
Config: tokenFn(config+compartmentIdVariableStr+ZoneStageDnssecKeyVersionResourceDependencies, nil),
55+
},
56+
57+
// Stage a replacement ZSK version
58+
{
59+
Config: tokenFn(config+compartmentIdVariableStr+ZoneStageDnssecKeyVersionResourceDependencies+`
60+
locals {
61+
predecessor_uuid = length(oci_dns_zone.test_dnssec_zone.dnssec_config[0].zsk_dnssec_key_versions) == 1 ? oci_dns_zone.test_dnssec_zone.dnssec_config[0].zsk_dnssec_key_versions[0].uuid : [ for zsk in oci_dns_zone.test_dnssec_zone.dnssec_config[0].zsk_dnssec_key_versions : zsk if zsk.successor_dnssec_key_version_uuid != ""][0].uuid
62+
}
63+
resource "oci_dns_zone_stage_dnssec_key_version" "test_zone_stage_dnssec_key_version" {
64+
zone_id = oci_dns_zone.test_dnssec_zone.id
65+
predecessor_dnssec_key_version_uuid = local.predecessor_uuid
66+
scope = "GLOBAL"
67+
}
68+
`, nil),
69+
},
70+
71+
// Validate that a second ZSK key version was added to the dnssec configuration.
72+
// This requires a separate step because it requires a refresh of the zone resource.
73+
{
74+
Config: tokenFn(config+compartmentIdVariableStr+ZoneStageDnssecKeyVersionResourceDependencies, nil),
75+
Check: acctest.ComposeAggregateTestCheckFuncWrapper(
76+
resource.TestCheckResourceAttr(resourceName, "dnssec_config.0.zsk_dnssec_key_versions.#", "2"),
77+
),
78+
},
79+
})
80+
}

0 commit comments

Comments
 (0)