[Terraform] DNS Policies

products/dns/api.yaml

@@ -150,6 +150,86 @@ objects:
         'Managing Zones':
           'https://cloud.google.com/dns/zones/'
       api: 'https://cloud.google.com/dns/api/v1/managedZones'
+  - !ruby/object:Api::Resource
+    name: 'Policy'
+    kind: 'dns#policy'
+    base_url: 'projects/{{project}}/policies'
+    input: true
+    description: |
+      A policy is a collection of DNS rules applied to one or more Virtual
+      Private Cloud resources.
+    collection_url_response: !ruby/object:Api::Resource::ResponseList
+      items: 'policies'
+    properties:
+      - !ruby/object:Api::Type::NestedObject
+        name: 'alternativeNameServerConfig'
+        description: |
+          Sets an alternative name server for the associated networks.
+          When specified, all DNS queries are forwarded to a name server that you choose.
+          Names such as .internal are not available when an alternative name server is specified.
+        update_verb: :PATCH
+        update_url: 'projects/{{project}}/policies/{{name}}'
+        properties:
+          - !ruby/object:Api::Type::Array
+            name: 'targetNameServers'
+            description: |
+              Sets an alternative name server for the associated networks. When specified,
+              all DNS queries are forwarded to a name server that you choose. Names such as .internal
+              are not available when an alternative name server is specified.
+            item_type: !ruby/object:Api::Type::NestedObject
+              properties:
+                - !ruby/object:Api::Type::String
+                  name: 'ipv4Address'
+                  description: 'IPv4 address to forward to.'
+      - !ruby/object:Api::Type::String
+        name: 'description'
+        description: |
+          A mutable string of at most 1024 characters associated with this
+          resource for the user's convenience. Has no effect on the policy's
+          function.
+        update_verb: :PATCH
+        update_url: 'projects/{{project}}/policies/{{name}}'
+        required: true
+      - !ruby/object:Api::Type::Boolean
+        name: 'enableInboundForwarding'
+        description: |
+          Allows networks bound to this policy to receive DNS queries sent
+          by VMs or applications over VPN connections. When enabled, a
+          virtual IP address will be allocated from each of the sub-networks
+          that are bound to this policy.
+        send_empty_value: true
+        update_verb: :PATCH
+        update_url: 'projects/{{project}}/policies/{{name}}'
+      - !ruby/object:Api::Type::Integer
+        name: 'id'
+        description: Unique identifier for the resource; defined by the server.
+        output: true
+      - !ruby/object:Api::Type::String
+        name: 'name'
+        description: |
+          User assigned name for this policy.
+        required: true
+      - !ruby/object:Api::Type::Array
+        name: 'networks'
+        description: 'List of network names specifying networks to which this policy is applied.'
+        item_type: !ruby/object:Api::Type::NestedObject
+          properties:
+            # TODO(drebes): Make 'networkUrl' a ResourceRef once cross-module references
+            # are possible.
+          - !ruby/object:Api::Type::String
+              name: 'networkUrl'
+              description: |
+                The fully qualified URL of the VPC network to bind to.
+                This should be formatted like
+                `https://www.googleapis.com/compute/v1/projects/{project}/global/networks/{network}`
+        update_verb: :PATCH
+        update_url: 'projects/{{project}}/policies/{{name}}'
+    references: !ruby/object:Api::Resource::ReferenceLinks
+      guides:
+        'Using DNS server policies':
+          'https://cloud.google.com/dns/zones/#using-dns-server-policies'
+      api: 'https://cloud.google.com/dns/docs/reference/v1beta2/policies'
+    min_version: beta
   - !ruby/object:Api::Resource
     name: 'Project'
     kind: 'dns#project'

products/dns/terraform.yaml

@@ -73,6 +73,50 @@ overrides: !ruby/object:Overrides::ResourceOverrides
             schema.SerializeResourceForHash(&buf, raw, dnsManagedZoneForwardingConfigTargetNameServersSchema())
             return hashcode.String(buf.String())
           }
+  Policy: !ruby/object:Overrides::Terraform::ResourceOverride
+    examples:
+      - !ruby/object:Provider::Terraform::Examples
+        name: "dns_policy_basic"
+        primary_resource_id: "example-policy"
+        version: <%= version_name %>
+        vars:
+          policy_name: "example-policy"
+          network_1_name: "network-1"
+          network_2_name: "network-2"
+    properties:
+      alternativeNameServerConfig.targetNameServers: !ruby/object:Overrides::Terraform::PropertyOverride
+        is_set: true
+        set_hash_func: |-
+          func(v interface{}) int {
+            raw := v.(map[string]interface{})
+            if address, ok := raw["ipv4_address"]; ok {
+              hashcode.String(address.(string))
+            }
+            var buf bytes.Buffer
+            schema.SerializeResourceForHash(&buf, raw, dnsPolicyAlternativeNameServerConfigTargetNameServersSchema())
+            return hashcode.String(buf.String())
+          }
+      description: !ruby/object:Overrides::Terraform::PropertyOverride
+        description: |
+          A textual description field. Defaults to 'Managed by Terraform'.
+        default_value: 'Managed by Terraform'
+        required: false
+      id: !ruby/object:Overrides::Terraform::PropertyOverride
+        exclude: true
+      networks: !ruby/object:Overrides::Terraform::PropertyOverride
+        is_set: true
+        set_hash_func: |-
+          func(v interface{}) int {
+            raw := v.(map[string]interface{})
+            if url, ok := raw["network_url"]; ok {
+              return selfLinkNameHash(url)
+            }
+            var buf bytes.Buffer
+            schema.SerializeResourceForHash(&buf, raw, dnsPolicyNetworksSchema())
+            return hashcode.String(buf.String())
+          }
+    custom_code: !ruby/object:Provider::Terraform::CustomCode
+      pre_delete: templates/terraform/pre_delete/detach_network.erb
   ResourceRecordSet: !ruby/object:Overrides::Terraform::ResourceOverride
     exclude: true
   Project: !ruby/object:Overrides::Terraform::ResourceOverride

templates/terraform/examples/dns_policy_basic.tf.erb

@@ -0,0 +1,30 @@
+resource "google_dns_policy" "<%= ctx[:primary_resource_id] %>" {
+  name = "<%= ctx[:vars]['policy_name'] %>"
+  enable_inbound_forwarding = true
+
+  alternative_name_server_config {
+    target_name_servers {
+      ipv4_address = "172.16.1.10"
+    }
+    target_name_servers {
+      ipv4_address = "172.16.1.20"
+    }
+  }
+
+  networks {
+    network_url =  "${google_compute_network.network-1.self_link}"
+  }
+  networks {
+    network_url =  "${google_compute_network.network-2.self_link}"
+  }
+}
+
+resource "google_compute_network" "network-1" {
+  name = "<%= ctx[:vars]['network_1_name'] %>"
+  auto_create_subnetworks = false
+}
+
+resource "google_compute_network" "network-2" {
+  name = "<%= ctx[:vars]['network_2_name'] %>"
+  auto_create_subnetworks = false
+}

templates/terraform/pre_delete/detach_network.erb

@@ -0,0 +1,15 @@
+// if networks are attached, they need to be detached before the policy can be deleted
+if d.Get("networks.#").(int) > 0 {
+	patched := make(map[string]interface{})
+	patched["networks"] = nil
+
+	url, err := replaceVars(d, config, "https://www.googleapis.com/dns/v1beta2/projects/{{project}}/policies/{{name}}")
+	if err != nil {
+		return err
+	}
+
+	_, err = sendRequestWithTimeout(config, "PATCH", url, patched, d.Timeout(schema.TimeoutUpdate))
+	if err != nil {
+		return fmt.Errorf("Error updating Policy %q: %s", d.Id(), err)
+	}
+}

third_party/terraform/tests/resource_dns_policy_test.go.erb

@@ -0,0 +1,70 @@
+<% autogen_exception -%>
+package google
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/terraform/helper/acctest"
+	"github.com/hashicorp/terraform/helper/resource"
+)
+
+<% unless version.nil? || version == 'ga' -%>
+func TestAccDnsPolicy_update(t *testing.T) {
+	t.Parallel()
+
+	policySuffix := acctest.RandString(10)
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckDnsPolicyDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccDnsPolicy_privateUpdate(policySuffix, "true", "172.16.1.10", "network-1"),
+			},
+			resource.TestStep{
+				ResourceName:      "google_dns_policy.example-policy",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			resource.TestStep{
+				Config: testAccDnsPolicy_privateUpdate(policySuffix, "false", "172.16.1.20", "network-2"),
+			},
+			resource.TestStep{
+				ResourceName:      "google_dns_policy.example-policy",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func testAccDnsPolicy_privateUpdate(suffix, forwarding, nameserver, network string) string {
+	return fmt.Sprintf(`
+resource "google_dns_policy" "example-policy" {
+	name = "example-policy-%s"
+	enable_inbound_forwarding = %s
+
+	alternative_name_server_config {
+		target_name_servers {
+			ipv4_address = "%s"
+		}
+	}
+
+	networks {
+		network_url =  "${google_compute_network.%s.self_link}"
+	}
+}
+
+resource "google_compute_network" "network-1" {
+	name = "network-1-%s"
+	auto_create_subnetworks = false
+}
+
+resource "google_compute_network" "network-2" {
+	name = "network-2-%s"
+	auto_create_subnetworks = false
+}`, suffix, forwarding, nameserver, network, suffix, suffix)
+}
+<% end -%>