AliCloud Private Zone

Provisions and manages an Alibaba Cloud Private Zone (PVTZ) for VPC-internal DNS resolution, with automated VPC attachment and inline DNS record management. Private Zone records are only resolvable within attached VPCs -- they are invisible to the public internet.

What Gets Created

When you deploy an AliCloudPrivateDnsZone resource, OpenMCF provisions:

• Private Zone -- an alicloud_pvtz_zone resource (Pulumi: pvtz.Zone) that creates the private DNS hosted zone
• VPC Attachment -- an alicloud_pvtz_zone_attachment resource (Pulumi: pvtz.ZoneAttachment) that binds the zone to one or more VPCs, enabling DNS resolution within those VPCs. Cross-region attachments are supported.
• Zone Records -- alicloud_pvtz_zone_record resources (Pulumi: pvtz.ZoneRecord) for each record defined in spec.records. Supported types: A, CNAME, MX, PTR, SRV, TXT.
• Tags -- system metadata tags (resource, resource_name, resource_kind, organization, environment) merged with user-defined spec.tags, with user values taking precedence on key conflict

Prerequisites

• Alibaba Cloud credentials configured via environment variables (ALICLOUD_ACCESS_KEY, ALICLOUD_SECRET_KEY) or OpenMCF provider config
• At least one VPC to attach the zone to -- the zone is useless without a VPC attachment since records are only resolvable within attached VPCs
• OpenMCF CLI installed with either Pulumi or Terraform (OpenTofu) backend

Quick Start

Create a file private-zone.yaml:

apiVersion: ali-cloud.openmcf.org/v1
kind: AliCloudPrivateDnsZone
metadata:
  name: my-private-zone
  labels:
    openmcf.org/provisioner: pulumi
    pulumi.openmcf.org/organization: my-org
    pulumi.openmcf.org/project: my-project
    pulumi.openmcf.org/stack.name: dev.AliCloudPrivateDnsZone.my-private-zone
spec:
  region: cn-hangzhou
  zoneName: internal.example.com
  vpcAttachments:
    - vpcId: vpc-abc123
  records:
    - rr: api
      type: A
      value: "10.0.1.50"

Deploy:

openmcf apply -f private-zone.yaml

After deployment, resources within the attached VPC can resolve api.internal.example.com to 10.0.1.50.

Configuration Reference

Required Fields

Optional Fields

VPC Attachment Fields

Record Fields

Examples

Internal Service Discovery

A common pattern: create a private zone for service discovery within a VPC, with A records for each service endpoint.

apiVersion: ali-cloud.openmcf.org/v1
kind: AliCloudPrivateDnsZone
metadata:
  name: svc-zone
  labels:
    openmcf.org/provisioner: pulumi
    pulumi.openmcf.org/organization: my-org
    pulumi.openmcf.org/project: my-project
    pulumi.openmcf.org/stack.name: prod.AliCloudPrivateDnsZone.svc-zone
spec:
  region: cn-hangzhou
  zoneName: svc.internal
  vpcAttachments:
    - vpcId: vpc-app-prod
  records:
    - rr: api
      type: A
      value: "10.0.1.50"
    - rr: cache
      type: A
      value: "10.0.2.30"
    - rr: queue
      type: A
      value: "10.0.3.10"

Multi-VPC Database Zone

Share database endpoints across multiple VPCs, including cross-region.

apiVersion: ali-cloud.openmcf.org/v1
kind: AliCloudPrivateDnsZone
metadata:
  name: db-zone
  org: my-org
  env: production
  labels:
    openmcf.org/provisioner: pulumi
    pulumi.openmcf.org/organization: my-org
    pulumi.openmcf.org/project: my-project
    pulumi.openmcf.org/stack.name: prod.AliCloudPrivateDnsZone.db-zone
spec:
  region: cn-hangzhou
  zoneName: db.corp
  resourceGroupId: rg-prod-123
  vpcAttachments:
    - vpcId: vpc-app-hangzhou
    - vpcId: vpc-app-shanghai
      regionId: cn-shanghai
  records:
    - rr: mysql
      type: A
      value: "10.0.10.100"
    - rr: redis
      type: A
      value: "10.0.11.50"
  tags:
    team: dba

Stack Outputs

After deployment, the following outputs are available in status.outputs:

Related Components

• AliCloudVpc -- VPCs that this private zone attaches to for DNS resolution
• AliCloudDnsZone -- manages public DNS domains in Alidns (separate from private zones)
• AliCloudDnsRecord -- creates public DNS records within an Alidns domain