Skip to content

Conversation

@mlec1
Copy link
Contributor

@mlec1 mlec1 commented Oct 4, 2025

Description

The DNS command are not zone dependent, so this MR remove the need to change the zone for DNS command.

The reason behind that: I created a role for DNS challenge for getting web certificate.

{
  "default-service-strategy": "deny",
  "services": {
    "dns": {
      "type": "rules",
      "rules": [
        {
          "expression": "parameters.has('type') && parameters.type != 'TXT'",
          "action": "deny"
        },
        {
          "expression": "parameters.has('name') && !parameters.name.startsWith('_acme-challenge')",
          "action": "deny"
        },
        {
          "expression": "resources.has('dns_domain_record') && resources.dns_domain_record.has('type') && resources.dns_domain_record.type != 'TXT'",
          "action": "deny"
        },
        {
          "expression": "resources.has('dns_domain_record') && resources.dns_domain_record.has('name') && !resources.dns_domain_record.name.startsWith('_acme-challenge')",
          "action": "deny"
        },
        {
          "expression": "operation in ['list-dns-domains', 'list-dns-domain-records', 'get-dns-domain-record', 'create-dns-domain-record', 'delete-dns-domain-record']",
          "action": "allow"
        }
      ]
    }
  }
}

I wanted to test if my role allows only the TXT records that I wanted. The easiest was to test with the exo cli.

However, due to the SwitchClientZoneV3, the role need also the permission compute.list-zones (or something similar), if I want to edit DNS Records with the exo cli, which is not needed for the tools like lego or cert-manager.

From what I understood, the client will be created within the buildClient. Let me know if I missed something.

Checklist

(For exoscale contributors)

  • Changelog updated (under Unreleased block)
  • Testing

Testing

Create, delete, update DNS records work.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant