如何用Terraform在GCP中自动切换DNS至新镜像实例？

Absolutely! You can automate DNS switching in GCP using Terraform to fit your Packer-based image workflow—even with limited hands-on Terraform experience. Let’s walk through exactly how to set this up, using the google_dns resources you’ve already found.

Prerequisites First #

Before diving in:

• Make sure you’ve configured the GCP Terraform provider with a service account that has permissions to create Compute Engine instances and modify DNS records (at minimum roles/compute.instanceAdmin.v1 and roles/dns.admin).
• Ensure your Packer-built image is available in your GCP project (you’ll reference its name/self-link in Terraform).
• If your DNS zone already exists, we’ll reference it as a data source; if not, Terraform can create it too.

Step 1: Configure the GCP Provider #

Start with the basic provider setup to connect Terraform to your GCP project:

terraform {
  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "~> 4.0" # Use a recent stable version
    }
  }
}

provider "google" {
  project = "your-gcp-project-id"
  region  = "us-central1" # Match your preferred region
}

Step 2: Launch Your Packer-Built Instance #

Define the new Compute Engine instance using your Packer image. We’ll capture its public IP to use in the DNS record:

resource "google_compute_instance" "new_app_server" {
  name         = "new-app-server"
  machine_type = "n1-standard-1" # Match your current instance's machine type
  zone         = "us-central1-a"

  boot_disk {
    initialize_params {
      # Replace with your Packer image's name or self-link
      image = "projects/your-project-id/global/images/your-packer-image-name"
    }
  }

  network_interface {
    network = "default"
    access_config {
      # This assigns a public external IP to the instance
    }
  }
}

Step 3: Automate DNS Record Update #

Next, update your A record to point to the new instance’s public IP. We’ll reference your existing managed DNS zone as a data source first:

# Pull in your existing DNS managed zone
data "google_dns_managed_zone" "existing_zone" {
  name    = "your-domain-zone" # e.g., "example-com" for example.com
  project = "your-gcp-project-id"
}

# Update the A record to point to the new instance's IP
resource "google_dns_record_set" "app_domain" {
  name         = "app.yourdomain.com." # Important: Trailing dot is required!
  type         = "A"
  ttl          = 300 # Use a short TTL for fast propagation during testing
  managed_zone = data.google_dns_managed_zone.existing_zone.name
  project      = "your-gcp-project-id"

  # Dynamically reference the new instance's public IP
  rrdatas = [google_compute_instance.new_app_server.network_interface.0.access_config.0.nat_ip]
}

Key Things to Note #

• Automatic Dependency Handling: Terraform will automatically wait for the new instance to be fully provisioned (and its public IP assigned) before updating the DNS record—no manual timing needed.
• Existing DNS Records: If your app.yourdomain.com record already exists, do not let Terraform create a new one! Instead, import the existing record into your Terraform state first to avoid conflicts:

  terraform import google_dns_record_set.app_domain projects/your-project-id/managedZones/your-domain-zone/rrsets/app.yourdomain.com./A
  

• Testing & Rollback: Set a short TTL (like 300 seconds) so DNS changes propagate quickly during testing. If something goes wrong, simply roll back your Terraform configuration (e.g., point the DNS record back to your old instance’s IP) and run terraform apply.
• Packer Integration: If you want to fully automate the image build + instance launch + DNS switch, you can chain Packer and Terraform together (e.g., run Packer first to build the image, then pass the image name to Terraform via variables).

Optional: Add a Health Check (For Smoother Switches) #

If you want to ensure the new instance is healthy before switching DNS, you can add a Compute Engine health check and tie it to the instance. Terraform will only proceed with the DNS update once the instance passes the health check:

resource "google_compute_http_health_check" "app_health" {
  name               = "app-health-check"
  request_path       = "/health" # Adjust to your app's health endpoint
  check_interval_sec = 5
  timeout_sec        = 5
}

# Attach the health check to your instance's network interface
resource "google_compute_instance_group" "new_app_group" {
  name        = "new-app-group"
  zone        = "us-central1-a"
  instances   = [google_compute_instance.new_app_server.self_link]
  named_port {
    name = "http"
    port = 80
  }
}

resource "google_compute_backend_service" "app_backend" {
  name        = "app-backend"
  protocol    = "HTTP"
  port_name   = "http"
  health_checks = [google_compute_http_health_check.app_health.self_link]

  backend {
    group = google_compute_instance_group.new_app_group.self_link
  }
}

# Update DNS to point to the backend service's IP (or use a load balancer if needed)
# For simplicity, you can still use the instance IP, but the health check ensures it's ready

That’s it! With this setup, running terraform apply will launch your new Packer-built instance and automatically switch your DNS to point to it.

内容的提问来源于stack exchange，提问作者oligofren