Skip to main content
emisar

Google Cloud DNS diagnostics and record control

v0.2.4

Cloud DNS diagnostics plus governed exact-record control: managed-zone, DNSSEC, server-policy, response-policy, paginated zone record sets, and exact-record reads, and upsert or delete of one exact record set with explicit zone, name, type, TTL, and value semantics. Arbitrary change batches are intentionally excluded.

7 allowed by default 2 need approval by default
Pack ID
gcp-dns
Vendor
emisar
OS
linux
Actions
9
Required binaries. Install these on the host before relying on the pack. An action that calls a missing binary fails at run time.
gcloud jq curl

Install

emisar pack install fetches this pack, re-validates it, and verifies its content hash against the --hash below before copying it into the runner's packs dir. That hash covers the exact bytes this page was built from, so a tampered copy is rejected. The command reloads a running daemon itself, so you don't need to restart it manually.

on the runner host 
sudo emisar pack install gcp-dns --hash sha256:36aacefa64aff84f96ca705e786c17581844e99fcb29a46442a1fa4d0bd01e6a

Setup

Drives gcloud and bounded HTTPS reads, and projects Cloud DNS API responses locally before they leave the runner. Authenticate gcloud before loading the pack.

Environment

Set these on the runner host, then add each name to execution.inherit_env so the value reaches the action.

  • CLOUDSDK_CONFIG

    Optional gcloud configuration directory.

  • CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE

    Optional credential file that overrides the active gcloud account.

Notes

  • Credential/config env and any operator endpoint override or CURL_CA_BUNDLE must be allowlisted in the runner's execution.inherit_env .
  • Grant least privilege for the actions you enable: reads need roles/dns.reader or equivalent; the record upsert and delete mutations need roles/dns.admin-equivalent permissions on the target zones.
  • Record-set pages, exact records, and response-policy rules return full DNS record data, including TXT values.
  • The paginated record-set read uses gcloud authentication and curl over HTTPS. It sends a quota-project header only for an explicitly configured concrete billing/quota_project; that opt-in requires serviceusage.services.use on the quota project.
  • Projected actions use mode-0600 temporary response files and remove them before exit.
  • This remote-target pack declares no host detection signal and is never auto-suggested merely because gcloud is installed.

Verify it works

Runs gcp.dns_zones, a low-risk read that confirms the pack can reach its target. Run it on the host once the pack is installed; pack install runs it for you.

on the runner host 
sudo emisar pack verify gcp-dns

Install and configure a pack walks through the whole sequence on a host.

Actions 9 total

View on GitHub
  • gcp.dns_policies script low Low: read-only or trivially reversible

    gcloud dns policies list

    List bounded Cloud DNS server policies, networks, forwarding targets, and logging state.

    View source on GitHub
  • gcp.dns_record_delete script high High: can disrupt service

    gcloud dns record-sets delete

    Delete one exact DNS record set from a managed zone after verifying that the live record data matches the expected values; refuses without mutating when the live data differs, the set is absent, or it carries a routing policy instead of plain record data. The deletion is applied through a DNS change that names the verified record data, so the provider rejects it — deleting nothing — if the record set changes concurrently. Returns the deleted record set — roll back by recreating it with gcp.dns_record_upsert. Resolvers keep serving cached answers until the TTL expires.

    View source on GitHub
  • gcp.dns_record_lookup script low Low: read-only or trivially reversible

    gcloud dns record-sets list --name --type

    Look up one exact DNS name and record type in a managed zone.

    View source on GitHub
  • gcp.dns_record_sets script low Low: read-only or trivially reversible

    List a zone's DNS record sets

    Read one bounded page of a managed zone's record sets, retaining each name, type, TTL, and full record data, including TXT values. Routing-policy-only records are identified without returning the policy. Continue with next_page_cursor and the same project and zone; pagination is not a snapshot.

    View source on GitHub
  • gcp.dns_record_upsert script high High: can disrupt service

    gcloud dns record-sets create or update

    Create or replace one exact DNS record set in a managed zone with the given TTL and record data. Existing data for that name and type is overwritten: read it first with gcp.dns_record_lookup, and roll back by upserting the previous values. Resolvers keep serving cached answers until the previous TTL expires.

    View source on GitHub
  • gcp.dns_response_policies script low Low: read-only or trivially reversible

    gcloud dns response-policies list

    List bounded Cloud DNS response policies and attached networks or GKE clusters.

    View source on GitHub
  • gcp.dns_response_policy_rules script low Low: read-only or trivially reversible

    gcloud dns response-policies rules list

    List bounded DNS names, behavior, and local record data in one response policy.

    View source on GitHub
  • gcp.dns_zone_describe script low Low: read-only or trivially reversible

    gcloud dns managed-zones describe

    Show one managed zone's visibility, DNSSEC, nameservers, and forwarding or peering topology.

    View source on GitHub
  • gcp.dns_zones script low Low: read-only or trivially reversible

    gcloud dns managed-zones list

    List bounded managed-zone visibility, DNSSEC, nameservers, and forwarding or peering topology.

    View source on GitHub
← Back to registry
Pack reference  Publish your own