GCLOUD: Enable support for AutoDNSSEC (#4118)

miono · web-flow · commit 591a7b2ce2fc · 2026-03-02T12:11:44.000-05:00
## Release changelog section

* GCLOUD: Enable AUTODNSSEC
diff --git a/documentation/provider/index.md b/documentation/provider/index.md
@@ -355,6 +355,7 @@ Jump to a table:
 | [`DNSMADEEASY`](dnsmadeeasy.md) | ❔ | ❔ | ❌ |
 | [`DOMAINNAMESHOP`](domainnameshop.md) | ❌ | ❔ | ❔ |
 | [`GANDI_V5`](gandiv5.md) | ❔ | ❔ | ❌ |
+| [`GCLOUD`](gcloud.md) | ✅ | ❔ | ❔ |
 | [`GCORE`](gcore.md) | ✅ | ❔ | ❌ |
 | [`GIDINET`](gidinet.md) | ❌ | ❌ | ❌ |
 | [`HEDNS`](hedns.md) | ❌ | ❔ | ❌ |
diff --git a/providers/gcloud/dnssec.go b/providers/gcloud/dnssec.go
@@ -0,0 +1,104 @@
+package gcloud
+
+import (
+	"time"
+
+	"github.com/StackExchange/dnscontrol/v4/models"
+	gdns "google.golang.org/api/dns/v1"
+)
+
+func (g *gcloudProvider) getDnssecCorrections(dc *models.DomainConfig) ([]*models.Correction, error) {
+	enabled, err := g.isDnssecEnabled(dc.Name)
+	if err != nil {
+		return nil, err
+	}
+	if enabled && dc.AutoDNSSEC == "off" {
+		return []*models.Correction{
+			{
+				Msg: "Disable DNSSEC",
+				F:   func() error { err := g.disableDnssec(dc.Name); return err },
+			},
+		}, nil
+	}
+
+	if !enabled && dc.AutoDNSSEC == "on" {
+		return []*models.Correction{
+			{
+				Msg: "Enable DNSSEC",
+				F:   func() error { err := g.enableDnssec(dc.Name); return err },
+			},
+		}, nil
+	}
+
+	return nil, nil
+}
+
+func (g *gcloudProvider) isDnssecEnabled(domain string) (bool, error) {
+	// Zones that never had DNSSEC enabled will have nil in the DnssecConfig field
+	if g.zones[domain+"."].DnssecConfig == nil {
+		return false, nil
+	}
+	if g.zones[domain+"."].DnssecConfig.State == "on" {
+		return true, nil
+	}
+	// Google Cloud DNS has a "transfer" state for DNSSEC. We treat it as "on".
+	// It basically means that DNSSEC is enabled, but Google won't rotate ZSKs.
+	if g.zones[domain+"."].DnssecConfig.State == "transfer" {
+		return true, nil
+	}
+	return false, nil
+}
+
+func (g *gcloudProvider) enableDnssec(domain string) error {
+	dnssecPatch := &gdns.ManagedZone{
+		DnssecConfig: &gdns.ManagedZoneDnsSecConfig{
+			State: "on",
+		},
+	}
+	resp, err := g.client.ManagedZones.Patch(g.project, g.zones[domain+"."].Name, dnssecPatch).Do()
+	if err != nil {
+		return err
+	}
+	if resp.Status != "done" {
+		// Should we have a timeout here?
+		for {
+			checkOperation, err := g.client.ManagedZoneOperations.Get(g.project, g.zones[domain+"."].Name, resp.Id).Do()
+			if err != nil {
+				return err
+			}
+			if checkOperation.Status == "done" {
+				return nil
+			}
+			time.Sleep(2 * time.Second)
+		}
+	}
+
+	return nil
+}
+
+func (g *gcloudProvider) disableDnssec(domain string) error {
+	dnssecPatch := &gdns.ManagedZone{
+		DnssecConfig: &gdns.ManagedZoneDnsSecConfig{
+			State: "off",
+		},
+	}
+	resp, err := g.client.ManagedZones.Patch(g.project, g.zones[domain+"."].Name, dnssecPatch).Do()
+	if err != nil {
+		return err
+	}
+	if resp.Status != "done" {
+		// Should we have a timeout here?
+		for {
+			checkOperation, err := g.client.ManagedZoneOperations.Get(g.project, g.zones[domain+"."].Name, resp.Id).Do()
+			if err != nil {
+				return err
+			}
+			if checkOperation.Status == "done" {
+				return nil
+			}
+			time.Sleep(2 * time.Second)
+		}
+	}
+
+	return nil
+}
diff --git a/providers/gcloud/gcloudProvider.go b/providers/gcloud/gcloudProvider.go
@@ -24,6 +24,7 @@ const selfLinkBasePath = "https://www.googleapis.com/compute/v1/projects/"
 var features = providers.DocumentationNotes{
 	// The default for unlisted capabilities is 'Cannot'.
 	// See providers/capabilities.go for the entire list of capabilities.
+	providers.CanAutoDNSSEC:          providers.Can(),
 	providers.CanGetZones:            providers.Can(),
 	providers.CanConcur:              providers.Can(),
 	providers.CanUseAlias:            providers.Can(),
@@ -241,15 +242,25 @@ func (g *gcloudProvider) getZoneSets(domain string) (models.Records, error) {
 
 // GetZoneRecordsCorrections returns a list of corrections that will turn existing records into dc.Records.
 func (g *gcloudProvider) GetZoneRecordsCorrections(dc *models.DomainConfig, existingRecords models.Records) ([]*models.Correction, int, error) {
+	dnssecFixes, err := g.getDnssecCorrections(dc)
+	if err != nil {
+		return nil, 0, err
+	}
+
 	changes, actualChangeCount, err := diff2.ByRecordSet(existingRecords, dc, nil)
 	if err != nil {
 		return nil, 0, err
 	}
-	if len(changes) == 0 {
+	if len(changes) == 0 && len(dnssecFixes) == 0 {
 		return nil, 0, nil
 	}
 
 	var corrections []*models.Correction
+	// Inject the dnssec correction if we have one
+	if len(dnssecFixes) != 0 {
+		actualChangeCount += len(dnssecFixes)
+		corrections = append(corrections, dnssecFixes...)
+	}
 	batch := &gdns.Change{Kind: "dns#change"}
 	var accumlatedMsgs []string
 	var newMsgs []string
