Skip to main content
emisar

Google Cloud DNS diagnostics and record control

v0.2.3

Cloud DNS diagnostics plus governed exact-record control: managed-zone, DNSSEC, server-policy, response-policy, and exact-record reads, and upsert or delete of one exact record set with explicit zone, name, type, TTL, and value semantics. Zone-wide record dumps and arbitrary change batches are intentionally excluded.

6 allowed by default 2 need approval by default
Pack ID
gcp-dns
Vendor
emisar
OS
linux
Actions
8
Required binaries. Install these on the host before relying on the pack — an action that calls a missing one fails at run time.
gcloud jq

Install

emisar pack install fetches this pack, re-validates it, and verifies its content hash against the --hash below — the exact bytes this page was rendered against, so a tampered copy is rejected — before copying it into the runner's packs dir. The command reloads a running daemon itself; no manual restart.

on the runner host 
sudo emisar pack install gcp-dns --hash sha256:a87c2da9e33fd2200bde098f22b05e5ef53705c1692697978a67e4321755acf8

Setup

Drives gcloud and projects Cloud DNS API responses locally before they leave the runner. Authenticate gcloud before loading the pack.

Environment

Set these on the runner host, then add each name to execution.inherit_env so the value reaches the action.

  • CLOUDSDK_CONFIG

    Optional gcloud configuration directory.

  • CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE

    Optional credential file that overrides the active gcloud account.

Notes

  • Grant least privilege for the actions you enable: reads need roles/dns.reader or equivalent; the record upsert and delete mutations need roles/dns.admin-equivalent permissions on the target zones.
  • Exact record and response-policy-rule actions return DNS record data, including TXT values when explicitly requested.
  • Projected actions use mode-0600 temporary response files and remove them before exit.
  • This remote-target pack declares no host detection signal and is never auto-suggested merely because gcloud is installed.

Verify it works

Runs gcp.dns_zones, a low-risk read that confirms the pack can reach its target. Run it on the host once the pack is installed; pack install runs it for you.

on the runner host 
sudo emisar pack verify gcp-dns

Install and configure a pack walks through the whole sequence on a host.

Actions 8 total

View on GitHub
  • gcp.dns_policies script low Low — read-only or trivially reversible

    gcloud dns policies list

    List bounded Cloud DNS server policies, networks, forwarding targets, and logging state.

    View source on GitHub
  • gcp.dns_record_delete script high High — service-affecting

    gcloud dns record-sets delete

    Delete one exact DNS record set from a managed zone after verifying that the live record data matches the expected values; refuses without mutating when the live data differs, the set is absent, or it carries a routing policy instead of plain record data. The deletion is applied through a DNS change that names the verified record data, so the provider rejects it — deleting nothing — if the record set changes concurrently. Returns the deleted record set — roll back by recreating it with gcp.dns_record_upsert. Resolvers keep serving cached answers until the TTL expires.

    View source on GitHub
  • gcp.dns_record_lookup script low Low — read-only or trivially reversible

    gcloud dns record-sets list --name --type

    Look up one exact DNS name and record type in a managed zone.

    View source on GitHub
  • gcp.dns_record_upsert script high High — service-affecting

    gcloud dns record-sets create or update

    Create or replace one exact DNS record set in a managed zone with the given TTL and record data. Existing data for that name and type is overwritten: read it first with gcp.dns_record_lookup, and roll back by upserting the previous values. Resolvers keep serving cached answers until the previous TTL expires.

    View source on GitHub
  • gcp.dns_response_policies script low Low — read-only or trivially reversible

    gcloud dns response-policies list

    List bounded Cloud DNS response policies and attached networks or GKE clusters.

    View source on GitHub
  • gcp.dns_response_policy_rules script low Low — read-only or trivially reversible

    gcloud dns response-policies rules list

    List bounded DNS names, behavior, and local record data in one response policy.

    View source on GitHub
  • gcp.dns_zone_describe script low Low — read-only or trivially reversible

    gcloud dns managed-zones describe

    Show one managed zone's visibility, DNSSEC, nameservers, and forwarding or peering topology.

    View source on GitHub
  • gcp.dns_zones script low Low — read-only or trivially reversible

    gcloud dns managed-zones list

    List bounded managed-zone visibility, DNSSEC, nameservers, and forwarding or peering topology.

    View source on GitHub
← Back to registry
Pack reference  Publish your own