Terraform-provider-cloudflare: Support for Creating Partial (CNAME) Zones

[jelinn]

Terraform Version

Terraform v0.11.11

Affected Resource(s)

-cloudflare_zone

Support creating partial (CNAME) Zones:

Please add support for creating and managing partial (CNAME) zones.

https://support.cloudflare.com/hc/en-us/articles/360020615111-Configuring-a-CNAME-setup
https://support.cloudflare.com/hc/en-us/articles/360020348832-Understanding-a-CNAME-Setup

API Call to Create Partial Zone

curl -X POST "https://api.cloudflare.com/client/v4/zones"
-H "X-Auth-Email: [email protected]"
-H "X-Auth-Key: API-KEY"
-H "Content-Type: application/json"
--data '{"type": "partial", "name":"example.com","jump_start":true,"account":{"id":"ACCOUNTID"}}'

[jacobbednarz]

@jelinn What currently doesn't work for the existing cloudflare_zone resource?

[farberjd]

@jacobbednarz The response does not contain the activation token which is the TXT record required to activate the zone. The Cloudflare API already returns it properly. (I work at Cloudflare).

In addition, you cannot set the 'type' of zone when you are creating a new zone. We receive an error: "Error: cloudflare_zone.testZone: "type": this field cannot be set".

[jacobbednarz]

Thanks for the additional information @farberjd, that isn't mentioned in the issue description hence the question as to what doesn't work :) I'll take a look at this and see if we can easily export it along with the other attributes as I assume you want access to that in order to manage the DNS entry automatically?

resource "cloudflare_zone" "example" {
  zone = "example.com"
  type = "partial"
}

resource "some_dns_resource" "partial_cloudflare_record" {
  value = "${cloudflare_zone.example.txt_record}"
  ....
}

[farberjd]

Yes, that is exactly right.

[d-gagne]

@jacobbednarz I'm hoping to use this along with a separate dns provider to auto populate the text record, which is a requirement for authorizing dns if you are in a CNAME setup (dns managed externally to Cloudflare).

Any idea if I can expect this relatively soon? I can come up with an alternative solution if not.

[jacobbednarz]

@davidgagnegarmin I only managed to iron out the issue and expected outcome as of yesterday so there hasn't been any further investigation as of yet. I'll probably take a look in the next week or so but if this is a pressing issue for you, you're welcome to propose a PR and I'll happily review it.

[jacobbednarz]

OK, I've just scoped out the requirements here:

• API docs need to be updated to include that type is an optional parameter. @farberjd can you please look into this? If not, I'm happy to raise a support ticket and go through the usual channels. I'm a 🙅 to adding support for functionality that isn't publicly documented as it generally means it's not intended for public consumption or the endpoints aren't intended to be exposed yet. Until this is done, we can't reliably add support for this feature.
• Support needs to be added to CreateZone (via cloudflare-go) to accept the type as a parameter. Right now it doesn't even get sent in the request.
• The terraform provider (this repository) can then be updated to allow Type to be set within the schema.

[jacobbednarz]

It's worth noting, this functionality is only available to paid (potentially enterprise accounts?). Doing this on a free account results in 1104 error ("Partial zone signup not allowed").

[farberjd]

OK, I've just scoped out the requirements here:

• API docs need to be updated to include that type is an optional parameter. @farberjd can you please look into this? If not, I'm happy to raise a support ticket and go through the usual channels. I'm a 🙅 to adding support for functionality that isn't publicly documented as it generally means it's not intended for public consumption or the endpoints aren't intended to be exposed yet. Until this is done, we can't reliably add support for this feature.
• Support needs to be added to CreateZone (via cloudflare-go) to accept the type as a parameter. Right now it doesn't even get sent in the request.
• The terraform provider (this repository) can then be updated to allow Type to be set within the schema.

I will work on this.

It's worth noting, this functionality is only available to paid (potentially enterprise accounts?). Doing this on a free account results in 1104 error ("Partial zone signup not allowed").

This is true.

[jacobbednarz]

I'm happy to knock out the cloudflare-go and terraform stuff if needed but the API docs is something that is probably easier to field internally.

Can you confirm if it's just a paid account that is required? Or whether it's an enterprise feature?

[garrettgalow]

its an enterprise feature since you can only use the flag if you have the ability to self provision cname zones.

[garrettgalow]

also we will get the docs updated. more of an oversight than lack of official support or anything like that.

[jacobbednarz]

🙇 awesome, thanks @garrettgalow and @farberjd. Happy to 🚢 now we've confirmed that.

[jacobbednarz]

@farberjd I had some time this morning so I added support to cloudflare-go via cloudflare/cloudflare-go#294.

[inge4pres]

Hi 😄

thanks for the hard work in this issue.
I'd like to reopen it since we are not able to complete the configuration of partial zone with the provider: because the VerificationKey field of the response from the API is not visible when creating a zone of type partial, the zone activation cannot be automated - the activation TXT records are not readable from Terraform state.

I think the necessary steps to have it work at full potential for enterprise customers is:

• add VerificationKey exported field in https://github.com/cloudflare/cloudflare-go/blob/c70f6a08eddbafee3dda58e9fab8302a1ea31d75/zone.go#L24 with an optional exported field

VerificationKey string `json:"verification_key,omitempty"`

(visible with API call for enterprise users).

• add the verification_key attribute in https://github.com/terraform-providers/terraform-provider-cloudflare/blob/master/cloudflare/resource_cloudflare_zone.go#L32 and make it readable from the resource metadata

When doing so the TXT records can be used in another provider to drive the DNS setup.
What do you think?
Currently the use of the provider v2.0 is limited by this use case for all of our zones...

[inge4pres]

Raised https://github.com/cloudflare/cloudflare-go/pull/355 on cloudflare-go

[inge4pres]

Raised https://github.com/terraform-providers/terraform-provider-cloudflare/pull/492 to complete this issue

[jacobbednarz]

addressed in #532