feat: manage datum.net corp DNS records as IaC - #1525
Draft
ecv wants to merge 2 commits into
Draft
Conversation
Bring datum.net's corp, marketing, and email DNS records under version control as DNSRecordSet manifests. datum.net is served from an existing zone (datum-net-xq088a) in the datum-cloud project control plane; these records were hand-entered directly with no source of truth. Covers apex A/AAAA and Google Workspace MX, SaaS verification TXT and SPF, SendGrid/Resend DKIM, DMARC (including the live p=none records for the Resend send subdomains), and the status/go/wiki/edge subdomains. Infra-wiring CNAMEs (www/docs to prism, api/admin/cloud/auth to prod.env) stay in datum-cloud/infra by the repo-ownership boundary. Apply path is datumctl against the project control plane; the CI job to run it on merge is a follow-up.
Add a workflow that manages the datum.net DNS records in dns/ against the datum-cloud project control plane: datumctl diff on pull requests, datumctl apply on push to main. Modeled on the infra repo's apply-datum-cloud-resources workflow, using setup-datumctl-action. Requires the DATUM_API_CI_DEPLOY_SA_PROD service-account secret to be available to this repo, with RBAC to write DNSRecordSet in the datum-cloud project.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
datum.net's corp, marketing, and email DNS records were hand-entered directly in the DNS backend with no source of truth. Lose one and we may not know its value. This brings them under version control asDNSRecordSetmanifests, applied viadatumctlagainst the datum-cloud project control plane where thedatum.netzone lives (datum-net-xq088a).Covers apex
AandAAAA, Google WorkspaceMX, SaaS verificationTXTand SPF, SendGrid and Resend DKIM, DMARC (including the livep=nonesend-subdomain records), and thestatus,go,wiki, andedgesubdomains.The infra-wiring CNAMEs (
wwwanddocsto prism,api,admin,cloud, andauthtoprod.env) stay indatum-cloud/infraby the repo-ownership boundary.CI
Includes a
DNS Recordsworkflow (.github/workflows/dns-apply.yml), modeled on the infra repo'sapply-datum-cloud-resources.yaml:datumctl diffruns against the datum-cloud project.main,datumctl applyruns.Validated with a
datumctlserver dry-run: 10 recordsets adopt in place, anddatum-net-dmarc-send-subdomainsreportsunchanged(already live in prod).Note
Prerequisite before the workflow can apply: the
DATUM_API_CI_DEPLOY_SA_PRODservice-account secret must be available to this repo, with RBAC to writeDNSRecordSetin the datum-cloud project. It's the same secret the infra repo already uses.Test plan
DATUM_API_CI_DEPLOY_SA_PRODis available to this repo (org secret or add it)datumctl diffon this PR shows the records adopting in placeAcceptedandProgrammeddigconfirms values unchanged post-applyRelated to datum-cloud/infra#1444