Add support for fetching DNSSEC keys

[baszoetekouw]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment. If the issue is assigned to the "modular-magician" user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If the issue is assigned to a user, that user is claiming responsibility for the issue. If the issue is assigned to "hashibot", a community member has claimed the issue already.

Description

For DNSSEC-signed managed DNS zones, there is currently no way in terraform to fetch the public key, it's digest or the DS record to configure the domain delegation in the upstream DNS.

I.e., the equivalent of this command doesn't seem to be available in the google_dns_managed_zone output:

╰─▶ gcloud dns dns-keys list --zone testzone
ID  KEY_TAG  TYPE         IS_ACTIVE  DESCRIPTION
0   25047    keySigning   True
1   64046    zoneSigning  True

╰─▶ gcloud dns dns-keys describe --zone testzone 0                              
algorithm: rsasha256
creationTime: '2019-11-05T10:02:53.363Z'
digests:
- digest: B39723B870DF6ADA6ADDCB8BD61420D4C6A7AAB8F41695FA9A3885D3D7144BEF
  type: sha256
id: '0'
isActive: true
keyLength: 2048
keyTag: 31057
kind: dns#dnsKey
publicKey: AwEAAZsfedr6pvLIiZ8qIvWDSImJ3NH8E6vdemP4no9mMbNot/DjE27nVUQ2e6HA5nUYmhgzVhRz
[...]
/EottYKRSfmiEDybRA65SVUmEu1UtAykzdpKBhfQZHbtjrldYrjikB9Ic=
type: keySigning

╰─▶ gcloud dns dns-keys describe --zone sczdev 0 --format "value(ds_record())"

25047 8 2 B39723B870DF6ADA6ADDCB8BD61420D4C6A7AAB8F41695FA9A3885D3D7144BEF

New or Affected Resource(s)

• google_dns_managed_zone

Potential Terraform Configuration

I would propose no new configuration is added, but rather that if dnssec is enabled (i.e., dnssec_config { state = "on" } is set), the provider fetches the dns-key info as described above and returns it in the dnssec_config variable. Specifically, the provider should return something like this:

my_zone = {
  "description" = "An example zone"
  "dns_name" = "test.example.org."
  "dnssec_config" = [
    {
      "default_key_specs" = [
        {
          "algorithm" = "rsasha256"
          "key_length" = 2048
          "key_type" = "keySigning"
          "kind" = "dns#dnsKeySpec"
        },
        {
          "algorithm" = "rsasha256"
          "key_length" = 1024
          "key_type" = "zoneSigning"
          "kind" = "dns#dnsKeySpec"
        },
      ]
      "dns_keys" = [
        {
          "algorithm" = "rsasha256"
          "creationTime" = "2019-11-05T10:02:53.363Z" 
          "digests" = [
            {
              "digest" = "B39723B870DF6ADA6ADDCB8BD61420D4C6A7AAB8F41695FA9A3885D3D7144BEF"  
              "type" = "sha256"    
            },
          ] 
          "id" = "0"        
          "isActive" = "true"    
          "keyLength" = 2048      
          "keyTag" = "25047"    
          "kind" = "dns#dnsKey"    
          "publicKey" = "AwEAAZsfedr6pvLIi[...]mJdpKBhfQZHbtjrldYrjikB9Ic="                                             
          "type" = "keySigning"    
        },
        { 
          "algorithm" = "rsasha256"  
          "creationTime" = "2019-11-05T10:02:53.461Z"        
          "id" = "1"        
          "isActive" = "true"      
          "keyLength" = 1024        
          "keyTag" = "64046"      
          "kind" = "dns#dnsKey"      
          "publicKey" = "AwEAAYZaSw9+pbO7tC8rl[...]tW65CE2vDObTIz1hsYp"                                                 
          "type" = "zoneSigning"      
        },
      ]
      "kind" = "dns#managedZoneDnsSecConfig"
      "non_existence" = "nsec3"
      "state" = "on"
    },
  ]
  "id" = "test"
  "name" = "test"
  "name_servers" = [
    "ns-cloud-d1.googledomains.com.",
    "ns-cloud-d2.googledomains.com.",
    "ns-cloud-d3.googledomains.com.",
    "ns-cloud-d4.googledomains.com.",
  ]
  "private_visibility_config" = []
  "project" = "myproject"
  "visibility" = "public"
}

References

• #0000

[paddycarver]

I believe this is a duplicate of #4802, closing it in favor of that.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!