Nameserver Ammendments Causes Zone recreation

[rhysxevans]

Hi

When modifying (adding/changing/removing) the nameservers list, terraform tries to recreate the zone rather than just making the ammendments

Terraform version: 0.12.24
Powerdns Provider Version: v1.4.0

Affected Resource(s)

Please list the resources as a list, for example:

• powerdns_zone

Terraform Configuration Files

variable "master_zones" {
  type = map
}

variable "master_zones_nameservers" {
  type = list
}

master_zones = {
  "1" = "zone1.domain.com."
  "2" = "2.6.in-addr.arpa."
}

master_zones_soa_edit_api = "EPOCH"
master_zones_nameservers = ["nameserver1.domain.com.", "nameserver2.domain.com.","nameserver3.domain.com.", "nameserver4.domain.com."]

resource "powerdns_zone" "master_zone" {
  for_each     = var.master_zones
  name         = each.value
  kind         = "master"
  nameservers  = var.master_zones_nameservers
  soa_edit_api = var.master_zones_soa_edit_api
}

Expected Behavior

Zone should remain, and nameserver/s should get updated

Actual Behavior

Zone gets recreated, from scratch

Steps to Reproduce

1. terraform apply

Important Factoids

Power DNS version: 4.3.1

Any help/advice is appreciated

Thanks

[networksecadmin]

We have the same issue.
Is there any update or workaround?

[mbag]

@rhysxevans thanks for reporting.

The issue with updating nameservers with powerdns_zone resource is that PowerDNS API doesn't have straight forward way to update nameservers via same API endpoint that is used to create/manage zone. During zone creation nameservers become NS type records in RRset and they have to be updated as any other rrset. Original authors of the code must have overlooked this, because in UpdateZone function they only implemented update of the basic zone metadata via this API call

I've investiagted and additional logic will have to be added to UpdateZone which will have to take into consideration that after creation nameservers have to be added via call to ReplaceRecordSet.

[mbag]

Currently, I'm in the process of migrating provider to new workflow, so it would be available via https://registry.terraform.io since I don't think old way of releasing provider version is supported any more. I'll let you know once this is issue is resolved.

[jbe-dw]

You have to update it as a classic record. All the api calls and functions are already in the client. It should be easy to add it.

[networksecadmin]

Hi, are there any updates to this issue?
Is this powerdns terraform provider still being developed further?

[jbe-dw]

Hello,

I can't tell about the development team. I tried to release a patch but it couldn't be 100% functional due to the terraform sdk limitations. Although it was merged, the master branch has been reverted because it was broken.

With that said, I'm using this in prod:

• disable nameserver support in the zone resource with lifecycle/ignore_changes
• Manage NS records with the record resource

This is a good alternative. The NS update don't trigger a zone re-creation anymore.

Regards.

[tacerus]

Thanks @jbe-dw for the lifecycle/ignore_changes workaround tip.