Skip to content

Import a domain you already host on Cloud DNS

Bring a domain whose DNS zone already lives in one of your own Google Cloud projects into a build environment, so its products can serve from that domain. Alis manages a few records in your zone on your behalf, which needs one role grant before the import.

Prerequisites

  • Permission to manage the build environment's domains. The Domains row on the build environment's page is shown only to people who have it.
  • A public Cloud DNS zone for the domain, in a Google Cloud project you administer, with the domain's registrar pointing at that zone's name servers.

Grant Alis access to the zone

Alis reads and writes your zone as the service account alis-build@alis-os-prod-fczvc6l.iam.gserviceaccount.com.

  1. In the Google Cloud console, open Cloud DNS in the project that holds the zone and select the zone.
  2. Open the zone's permissions panel and add that service account as a principal with the DNS Administrator role (roles/dns.admin). Granting the role on the whole project works too.

Your own build environment has a service account with the same name

The Google Cloud project behind your build environment also carries an alis-build@… service account. That is your environment's own identity, not the one that imports domains, so granting it has no effect. Grant the account named above.

Import the domain

  1. Open Environments, select the build environment and choose Domains.
  2. In Manage Domains, choose Import.
  3. Enter the Domain, then under Google DNS if already exists enter the Project Id of the project that holds the zone and the Zone name exactly as Cloud DNS lists it.
  4. Choose Import domain.

If the import is refused with alis does not have access to zone …, the message names the service account and the role to grant; grant them and import again. zone … was not found in project … means the Project Id or the Zone name is wrong.

Finish the verification

The imported domain opens in Manage Domains with Domain Verification showing Unverified. It becomes Verified once Alis can write to the zone, the managed domain record exists and the zone is the domain's authoritative DNS.

For an imported zone you add the managed domain record yourself: create the A record shown under Managed Domain Record in your zone, with the host and target exactly as displayed. The target is the address of the build environment's load balancer. Then choose Verify. Alis writes its own site-ownership record, and once the domain is verified it deploys the SSL certificate for it.