You can create a Service Directory zone that allows your Google Cloud-based services to query your Service Directory namespace via DNS.
These instructions require that you already have a Service Directory namespace in place. If you do not, first create a namespace using the procedure in Configuring Service Directory.
Once you have attached a Service Directory zone to the namespace, all services and endpoints within it become available over DNS on the private network. All service and endpoint updates are immediately reflected in their DNS records. However, neither service nor endpoint metadata is available over DNS.
There is a special permission,
servicedirectory.namespaces.associatePrivateZone, you must have to create a
Service Directory DNS zone. This permission is automatically a part of the
Creating a Service Directory zone backed by a namespace
You can only associate a Service Directory zone with a namespace when you create the zone. A Service Directory zone cannot also be a forwarding zone, a regular private zone, or a public zone.
- Go to the Cloud DNS page in the Google Cloud Console.
Go to the Cloud DNS page
- Click Create zone.
- In the Zone type section, click
- Give the zone a name.
- Give the zone a DNS name
- Under Options, select
Use a service directory namespace.
- Under Networks, select one or more networks that can use the Service Directory zone.
- Select the Region where the namespace you want to link lives.
- Select the Namespace you want to link.
- Click Create.
gcloud beta dns managed-zones create sd-zone \ --dns-name "dns-name" \ --description "this zone is backed by Service Directory" \ --visibility private \ --networks https://www.googleapis.com/compute/v1/projects/project_ID/global/networks/network \ --service-directory-namespace https://servicedirectory.googleapis.com/v1/projects/project_ID/locations/region/namespaces/namespace-name
- sd-zone is the name of the Service Directory zone you are creating.
- dns-name holds the DNS name, such as
us-east1.example.com., for the new zone.
- https://www.googleapis.com/compute/v1/projects/project_ID/global/networks/network is the FQDN of the networks that can use the zone.
- https://www.servicedirectory.googleapis.com/v1/projects/project_ID/locations/region/registries/namespace-name is the FQDN of the namespace you are linking.
Deleting the Service Directory zone
At any point, you can delete a Service Directory zone. This deletion happens through Cloud DNS and has no effect on any associated Service Directory namespaces. The associated namespace continues to be available for look up via HTTP and gRPC.
You can delete a service or namespace that has a Service Directory zone pointing to it without deleting the zone. If you do, any further DNS queries for that service returns NXDOMAIN.
- Securing Service Directory in a service perimeter