feat: Add forwarding_path to google_dns_policy (#4045) (#7416)

Signed-off-by: Modular Magician <[email protected]>

.changelog/4045.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+dns: added `forwarding_path` field to `google_dns_policy` resource
+```

google/resource_dns_policy.go

@@ -23,6 +23,7 @@ import (
 	"time"
 
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 )
 
 func resourceDNSPolicy() *schema.Resource {
@@ -131,6 +132,14 @@ func dnsPolicyAlternativeNameServerConfigTargetNameServersSchema() *schema.Resou
 				Required:    true,
 				Description: `IPv4 address to forward to.`,
 			},
+			"forwarding_path": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				ValidateFunc: validation.StringInSlice([]string{"default", "private", ""}, false),
+				Description: `Forwarding path for this TargetNameServer. If unset or 'default' Cloud DNS will make forwarding
+decision based on address ranges, i.e. RFC1918 addresses go to the VPC, Non-RFC1918 addresses go
+to the Internet. When set to 'private', Cloud DNS will always send queries through VPC for this target Possible values: ["default", "private"]`,
+			},
 		},
 	}
 }
@@ -470,7 +479,8 @@ func flattenDNSPolicyAlternativeNameServerConfigTargetNameServers(v interface{},
 			continue
 		}
 		transformed.Add(map[string]interface{}{
-			"ipv4_address": flattenDNSPolicyAlternativeNameServerConfigTargetNameServersIpv4Address(original["ipv4Address"], d, config),
+			"ipv4_address":    flattenDNSPolicyAlternativeNameServerConfigTargetNameServersIpv4Address(original["ipv4Address"], d, config),
+			"forwarding_path": flattenDNSPolicyAlternativeNameServerConfigTargetNameServersForwardingPath(original["forwardingPath"], d, config),
 		})
 	}
 	return transformed
@@ -479,6 +489,10 @@ func flattenDNSPolicyAlternativeNameServerConfigTargetNameServersIpv4Address(v i
 	return v
 }
 
+func flattenDNSPolicyAlternativeNameServerConfigTargetNameServersForwardingPath(v interface{}, d *schema.ResourceData, config *Config) interface{} {
+	return v
+}
+
 func flattenDNSPolicyDescription(v interface{}, d *schema.ResourceData, config *Config) interface{} {
 	return v
 }
@@ -562,6 +576,13 @@ func expandDNSPolicyAlternativeNameServerConfigTargetNameServers(v interface{},
 			transformed["ipv4Address"] = transformedIpv4Address
 		}
 
+		transformedForwardingPath, err := expandDNSPolicyAlternativeNameServerConfigTargetNameServersForwardingPath(original["forwarding_path"], d, config)
+		if err != nil {
+			return nil, err
+		} else if val := reflect.ValueOf(transformedForwardingPath); val.IsValid() && !isEmptyValue(val) {
+			transformed["forwardingPath"] = transformedForwardingPath
+		}
+
 		req = append(req, transformed)
 	}
 	return req, nil
@@ -571,6 +592,10 @@ func expandDNSPolicyAlternativeNameServerConfigTargetNameServersIpv4Address(v in
 	return v, nil
 }
 
+func expandDNSPolicyAlternativeNameServerConfigTargetNameServersForwardingPath(v interface{}, d TerraformResourceData, config *Config) (interface{}, error) {
+	return v, nil
+}
+
 func expandDNSPolicyDescription(v interface{}, d TerraformResourceData, config *Config) (interface{}, error) {
 	return v, nil
 }

google/resource_dns_policy_generated_test.go

@@ -60,7 +60,8 @@ resource "google_dns_policy" "example-policy" {
 
   alternative_name_server_config {
     target_name_servers {
-      ipv4_address = "172.16.1.10"
+      ipv4_address    = "172.16.1.10"
+      forwarding_path = "private"
     }
     target_name_servers {
       ipv4_address = "172.16.1.20"

google/resource_dns_policy_test.go

@@ -18,15 +18,15 @@ func TestAccDNSPolicy_update(t *testing.T) {
 		CheckDestroy: testAccCheckDNSPolicyDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccDnsPolicy_privateUpdate(policySuffix, "true", "172.16.1.10", "network-1"),
+				Config: testAccDnsPolicy_privateUpdate(policySuffix, "true", "172.16.1.10", "172.16.1.30", "network-1"),
 			},
 			{
 				ResourceName:      "google_dns_policy.example-policy",
 				ImportState:       true,
 				ImportStateVerify: true,
 			},
 			{
-				Config: testAccDnsPolicy_privateUpdate(policySuffix, "false", "172.16.1.20", "network-2"),
+				Config: testAccDnsPolicy_privateUpdate(policySuffix, "false", "172.16.1.20", "172.16.1.40", "network-2"),
 			},
 			{
 				ResourceName:      "google_dns_policy.example-policy",
@@ -37,7 +37,7 @@ func TestAccDNSPolicy_update(t *testing.T) {
 	})
 }
 
-func testAccDnsPolicy_privateUpdate(suffix, forwarding, nameserver, network string) string {
+func testAccDnsPolicy_privateUpdate(suffix, forwarding, first_nameserver, second_nameserver, network string) string {
 	return fmt.Sprintf(`
 resource "google_dns_policy" "example-policy" {
   name                      = "example-policy-%s"
@@ -46,6 +46,10 @@ resource "google_dns_policy" "example-policy" {
   alternative_name_server_config {
     target_name_servers {
       ipv4_address = "%s"
+    }
+	target_name_servers {
+	  ipv4_address    = "%s"
+	  forwarding_path = "private"
     }
   }
 
@@ -63,5 +67,5 @@ resource "google_compute_network" "network-2" {
   name                    = "network-2-%s"
   auto_create_subnetworks = false
 }
-`, suffix, forwarding, nameserver, network, suffix, suffix)
+`, suffix, forwarding, first_nameserver, second_nameserver, network, suffix, suffix)
 }

website/docs/r/dns_policy.html.markdown

@@ -50,7 +50,8 @@ resource "google_dns_policy" "example-policy" {
 
   alternative_name_server_config {
     target_name_servers {
-      ipv4_address = "172.16.1.10"
+      ipv4_address    = "172.16.1.10"
+      forwarding_path = "private"
     }
     target_name_servers {
       ipv4_address = "172.16.1.20"
@@ -137,6 +138,13 @@ The `target_name_servers` block supports:
   (Required)
   IPv4 address to forward to.
 
+* `forwarding_path` -
+  (Optional)
+  Forwarding path for this TargetNameServer. If unset or `default` Cloud DNS will make forwarding
+  decision based on address ranges, i.e. RFC1918 addresses go to the VPC, Non-RFC1918 addresses go
+  to the Internet. When set to `private`, Cloud DNS will always send queries through VPC for this target
+  Possible values are `default` and `private`.
+
 The `networks` block supports:
 
 * `network_url` -