@robinmordasiewicz/f5xc-terraform-mcp 2.10.0 → 2.11.0

package/README.md

@@ -12,12 +12,47 @@ A Model Context Protocol (MCP) server that provides AI assistants with comprehen
 
 ## Installation
 
+Choose the installation method that best fits your environment:
+
+| Method | Best For | Requirements |
+|--------|----------|--------------|
+| [VSCode MCP Gallery](#vscode-mcp-gallery) | VSCode users with Node.js | VSCode 1.99+, Node.js |
+| [npx (Recommended)](#from-npm) | Developers with Node.js | Node.js 18+ |
+| [MCPB Bundle](#mcpb-bundle-no-nodejs-required) | Corporate laptops | None |
+| [From Source](#from-source) | Contributors | Node.js 18+, npm |
+
+### VSCode MCP Gallery
+
+The easiest way to install if you're using VSCode with GitHub Copilot:
+
+1. Open VSCode
+2. Press `Ctrl+Shift+P` / `Cmd+Shift+P` to open Command Palette
+3. Run `MCP: Add Server`
+4. Search for `f5xc` or `@robinmordasiewicz/f5xc-terraform-mcp`
+5. Click Install
+
 ### From npm
 
 ```bash
 npm install -g @robinmordasiewicz/f5xc-terraform-mcp
 ```
 
+Or run directly with npx (no installation required):
+
+```bash
+npx @robinmordasiewicz/f5xc-terraform-mcp
+```
+
+### MCPB Bundle (No Node.js Required)
+
+For corporate environments where Node.js cannot be installed:
+
+1. Download the latest `.mcpb` file from [GitHub Releases](https://github.com/robinmordasiewicz/terraform-provider-f5xc/releases)
+2. Double-click the file to install, or drag it into Claude Desktop / VSCode
+3. The bundle includes everything needed - no external dependencies
+
+**File**: `f5xc-terraform-mcp-X.Y.Z.mcpb`
+
 ### From Source
 
 ```bash
@@ -159,6 +194,21 @@ To make the MCP server available across all workspaces, add to your VS Code user
 | `f5xc_terraform_get_schema_definition` | Get a schema definition from a spec |
 | `f5xc_terraform_list_definitions` | List all definitions in a spec |
 
+### Subscription Tier Tools
+
+| Tool | Description |
+|------|-------------|
+| `f5xc_terraform_get_subscription_info` | Get subscription tier requirements for resources |
+| `f5xc_terraform_get_property_subscription_info` | Get property-level subscription tier indicators |
+
+### Addon Service Tools
+
+| Tool | Description |
+|------|-------------|
+| `f5xc_terraform_addon_list_services` | List available addon services with activation requirements |
+| `f5xc_terraform_addon_check_activation` | Check if an addon service is activated for the tenant |
+| `f5xc_terraform_addon_activation_workflow` | Get activation workflow and Terraform code for addons |
+
 ### Utility Tools
 
 | Tool | Description |

package/dist/docs/data-sources/dns_zone.md

@@ -2,12 +2,12 @@
 page_title: "f5xc_dns_zone Data Source - terraform-provider-f5xc"
 subcategory: "DNS"
 description: |-
-  Manages a DNS Zone resource in F5 Distributed Cloud.
+  Manages DNS Zone in a given namespace. If one already exist it will give a error. in F5 Distributed Cloud.
 ---
 
 # f5xc_dns_zone (Data Source)
 
-Manages a DNS Zone resource in F5 Distributed Cloud.
+Manages DNS Zone in a given namespace. If one already exist it will give a error. in F5 Distributed Cloud.
 
 ~> **Note** Please refer to [DNS Zone API docs](https://docs.cloud.f5.com/docs-v2/api/dns-zone) to learn more.
 

package/dist/docs/functions/blindfold_file.md

@@ -125,9 +125,9 @@ resource "f5xc_http_loadbalancer" "secure" {
 # Example: Encrypt multiple certificate files using for_each
 locals {
   certificates = {
-    "server"  = "${path.module}/certs/server.key"
-    "client"  = "${path.module}/certs/client.key"
-    "ca"      = "${path.module}/certs/ca.key"
+    "server" = "${path.module}/certs/server.key"
+    "client" = "${path.module}/certs/client.key"
+    "ca"     = "${path.module}/certs/ca.key"
   }
 }
 

package/dist/docs/guides/advanced-http-loadbalancer.md

@@ -13,16 +13,16 @@ This guide extends the [basic HTTP Load Balancer guide](http-loadbalancer) with
 
 By following this guide, you'll deploy an HTTP Load Balancer with **11 security controls**:
 
-| Security Layer | Feature | Protection |
-|----------------|---------|------------|
-| **Perimeter** | IP Reputation | Blocks known malicious IPs by threat category |
-| **Perimeter** | Threat Mesh | Global threat intelligence sharing |
-| **Bot Defense** | JavaScript Challenge | Client-side bot detection |
-| **Bot Defense** | Malicious User Detection | Behavioral analysis and risk scoring |
-| **Application** | Web Application Firewall | Blocks SQLi, XSS, and OWASP Top 10 |
-| **Application** | Bot Protection Settings | Signature-based bot classification |
-| **Rate Control** | Rate Limiting | Prevents abuse with configurable thresholds |
-| **Data Protection** | Data Guard | Masks sensitive data (CC, SSN) in responses |
+| Security Layer      | Feature                    | Protection                                     |
+| ------------------- | -------------------------- | ---------------------------------------------- |
+| **Perimeter**       | IP Reputation              | Blocks known malicious IPs by threat category  |
+| **Perimeter**       | Threat Mesh                | Global threat intelligence sharing             |
+| **Bot Defense**     | JavaScript Challenge       | Client-side bot detection                      |
+| **Bot Defense**     | Malicious User Detection   | Behavioral analysis and risk scoring           |
+| **Application**     | Web Application Firewall   | Blocks SQLi, XSS, and OWASP Top 10             |
+| **Application**     | Bot Protection Settings    | Signature-based bot classification             |
+| **Rate Control**    | Rate Limiting              | Prevents abuse with configurable thresholds    |
+| **Data Protection** | Data Guard                 | Masks sensitive data (CC, SSN) in responses    |
 
 ## Prerequisites
 
@@ -305,16 +305,16 @@ resource "f5xc_http_loadbalancer" "app" {
 
 The IP Reputation service maintains a continuously-updated database of known malicious IP addresses. When enabled, requests from IPs matching configured threat categories are automatically blocked.
 
-| Threat Category | Description |
-|-----------------|-------------|
-| `SPAM_SOURCES` | Known spam-sending IP addresses |
-| `WEB_ATTACKS` | IPs involved in web-based attacks |
-| `BOTNETS` | Command & control and infected hosts |
-| `SCANNERS` | Reconnaissance, probes, brute force |
-| `PHISHING` | Phishing and fraud operations |
-| `PROXY` | Anonymous proxy services |
-| `TOR_PROXY` | Tor exit nodes |
-| `DENIAL_OF_SERVICE` | DoS and DDoS sources |
+| Threat Category       | Description                          |
+| --------------------- | ------------------------------------ |
+| `SPAM_SOURCES`        | Known spam-sending IP addresses      |
+| `WEB_ATTACKS`         | IPs involved in web-based attacks    |
+| `BOTNETS`             | Command & control and infected hosts |
+| `SCANNERS`            | Reconnaissance, probes, brute force  |
+| `PHISHING`            | Phishing and fraud operations        |
+| `PROXY`               | Anonymous proxy services             |
+| `TOR_PROXY`           | Tor exit nodes                       |
+| `DENIAL_OF_SERVICE`   | DoS and DDoS sources                 |
 
 -> **Tip:** Start with all categories enabled, then selectively disable based on your application requirements. For example, disable `TOR_PROXY` if you need to support privacy-focused users.
 

package/dist/docs/guides/authentication.md

@@ -12,11 +12,11 @@ This guide covers authentication configuration for the F5 Distributed Cloud Terr
 
 ## Quick Reference
 
-| Method | Complexity | Best For | Security |
-|--------|------------|----------|----------|
-| API Token | Simplest | Development, quick testing | Bearer token over TLS |
-| P12 Certificate | Moderate | Production, CI/CD | Mutual TLS (mTLS) |
-| PEM Certificate | Advanced | When tooling requires PEM format | Derived from P12, mTLS |
+| Method          | Complexity | Best For                         | Security               |
+| --------------- | ---------- | -------------------------------- | ---------------------- |
+| API Token       | Simplest   | Development, quick testing       | Bearer token over TLS  |
+| P12 Certificate | Moderate   | Production, CI/CD                | Mutual TLS (mTLS)      |
+| PEM Certificate | Advanced   | When tooling requires PEM format | Derived from P12, mTLS |
 
 ## Prerequisites
 
@@ -79,7 +79,7 @@ Service credentials are managed through IAM and recommended for production. They
 7. Select an expiry date
 8. Click **Download** to get the `.p12` file
 
-## Authentication Methods
+## Provider Configuration
 
 ### Method 1: API Token Authentication (Simplest)
 
@@ -170,15 +170,15 @@ provider "f5xc" {
 
 ## Environment Variable Reference
 
-| Variable | Description | Required |
-|----------|-------------|----------|
-| `F5XC_API_URL` | F5XC tenant API URL | Yes |
-| `F5XC_API_TOKEN` | API token for bearer authentication | One of: token, P12, or PEM |
-| `F5XC_P12_FILE` | Path to P12 certificate file | With `F5XC_P12_PASSWORD` |
-| `F5XC_P12_PASSWORD` | Password for P12 file | With `F5XC_P12_FILE` |
-| `F5XC_CERT` | Path to PEM certificate file | With `F5XC_KEY` |
-| `F5XC_KEY` | Path to PEM private key file | With `F5XC_CERT` |
-| `F5XC_CACERT` | Path to CA certificate for server verification | No |
+| Variable            | Description                                    | Required                       |
+| ------------------- | ---------------------------------------------- | ------------------------------ |
+| `F5XC_API_URL`      | F5XC tenant API URL                            | Yes                            |
+| `F5XC_API_TOKEN`    | API token for bearer authentication            | One of: token, P12, or PEM     |
+| `F5XC_P12_FILE`     | Path to P12 certificate file                   | With `F5XC_P12_PASSWORD`       |
+| `F5XC_P12_PASSWORD` | Password for P12 file                          | With `F5XC_P12_FILE`           |
+| `F5XC_CERT`         | Path to PEM certificate file                   | With `F5XC_KEY`                |
+| `F5XC_KEY`          | Path to PEM private key file                   | With `F5XC_CERT`               |
+| `F5XC_CACERT`       | Path to CA certificate for server verification | No                             |
 
 **Adding to Shell Profile:**
 
@@ -241,10 +241,10 @@ jobs:
 
 **GitHub Secrets to configure:**
 
-| Secret Name | Value |
-|-------------|-------|
-| `F5XC_API_URL` | `https://your-tenant.console.ves.volterra.io` |
-| `F5XC_API_TOKEN` | Your API token value |
+| Secret Name        | Value                                          |
+| ------------------ | ---------------------------------------------- |
+| `F5XC_API_URL`     | `https://your-tenant.console.ves.volterra.io`  |
+| `F5XC_API_TOKEN`   | Your API token value                           |
 
 ### GitHub Actions with P12 Certificate
 
@@ -306,11 +306,11 @@ base64 -w 0 your-credentials.p12
 
 **GitHub Secrets to configure:**
 
-| Secret Name | Value |
-|-------------|-------|
-| `F5XC_API_URL` | `https://your-tenant.console.ves.volterra.io` |
-| `F5XC_P12_BASE64` | Base64-encoded P12 file contents |
-| `F5XC_P12_PASSWORD` | Password for the P12 file |
+| Secret Name         | Value                                          |
+| ------------------- | ---------------------------------------------- |
+| `F5XC_API_URL`      | `https://your-tenant.console.ves.volterra.io`  |
+| `F5XC_P12_BASE64`   | Base64-encoded P12 file contents               |
+| `F5XC_P12_PASSWORD` | Password for the P12 file                      |
 
 ## Security Best Practices
 
@@ -321,10 +321,10 @@ base64 -w 0 your-credentials.p12
 
 ### Choosing the Right Method
 
-| Use Case | Recommended Method | Reason |
-|----------|-------------------|--------|
-| Local development | API Token | Simplest setup |
-| CI/CD pipelines | P12 Certificate | mTLS security |
+| Use Case              | Recommended Method  | Reason                    |
+| --------------------- | ------------------- | ------------------------- |
+| Local development     | API Token           | Simplest setup            |
+| CI/CD pipelines       | P12 Certificate     | mTLS security             |
 | Production automation | Service Credentials | Role-based access control |
 
 ## Troubleshooting
@@ -366,8 +366,8 @@ export F5XC_API_TOKEN="token"  # Correct
 F5XC_API_TOKEN="token"         # Won't work
 ```
 
-2. Verify spelling is exact (case-sensitive)
-3. Check for hidden characters in values
+1. Verify spelling is exact (case-sensitive)
+2. Check for hidden characters in values
 
 ## Revoking Credentials
 

package/dist/docs/guides/blindfold.md

@@ -21,7 +21,7 @@ F5 Distributed Cloud Secret Management ("blindfold") provides client-side encryp
 
 ### How It Works
 
-```
+```text
 ┌─────────────────────────────────────────────────────────────────────┐
 │                     Your Local Machine                              │
 │                                                                     │
@@ -64,13 +64,15 @@ Before you begin, ensure you have:
 
 Configure one of these authentication methods via environment variables:
 
-**Option 1: API Token (Recommended for development)**
+#### Option 1: API Token (Recommended for development)
+
 ```bash
 export F5XC_API_URL="https://your-tenant.console.ves.volterra.io"
 export F5XC_API_TOKEN="your-api-token"
 ```
 
-**Option 2: P12 Certificate (Recommended for production)**
+#### Option 2: P12 Certificate (Recommended for production)
+
 ```bash
 export F5XC_API_URL="https://your-tenant.console.ves.volterra.io"
 export F5XC_P12_FILE="/path/to/your-credentials.p12"
@@ -143,13 +145,14 @@ Encrypts base64-encoded plaintext:
 provider::f5xc::blindfold(plaintext, policy_name, namespace)
 ```
 
-| Parameter | Type | Description |
-|-----------|------|-------------|
-| `plaintext` | string | Base64-encoded secret to encrypt |
-| `policy_name` | string | Name of the SecretPolicy |
-| `namespace` | string | Namespace containing the policy |
+| Parameter     | Type   | Description                      |
+| ------------- | ------ | -------------------------------- |
+| `plaintext`   | string | Base64-encoded secret to encrypt |
+| `policy_name` | string | Name of the SecretPolicy         |
+| `namespace`   | string | Namespace containing the policy  |
 
 **Example:**
+
 ```hcl
 location = provider::f5xc::blindfold(
   base64encode(var.my_secret),
@@ -166,13 +169,14 @@ Reads a file and encrypts its contents:
 provider::f5xc::blindfold_file(path, policy_name, namespace)
 ```
 
-| Parameter | Type | Description |
-|-----------|------|-------------|
-| `path` | string | Path to the file to encrypt |
-| `policy_name` | string | Name of the SecretPolicy |
-| `namespace` | string | Namespace containing the policy |
+| Parameter     | Type   | Description                     |
+| ------------- | ------ | ------------------------------- |
+| `path`        | string | Path to the file to encrypt     |
+| `policy_name` | string | Name of the SecretPolicy        |
+| `namespace`   | string | Namespace containing the policy |
 
 **Example:**
+
 ```hcl
 location = provider::f5xc::blindfold_file(
   "${path.module}/certs/server.key",
@@ -361,9 +365,9 @@ locals {
 RSA-OAEP encryption has a maximum plaintext size based on the key size:
 
 | Key Size | Maximum Plaintext |
-|----------|-------------------|
-| 2048-bit | ~190 bytes |
-| 4096-bit | ~446 bytes |
+| -------- | ----------------- |
+| 2048-bit | ~190 bytes        |
+| 4096-bit | ~446 bytes        |
 
 ~> **Note:** If your secret exceeds the size limit, consider splitting it or using a different approach. The function will return a clear error message if the plaintext is too large.
 
@@ -371,7 +375,7 @@ RSA-OAEP encryption has a maximum plaintext size based on the key size:
 
 The blindfold functions return a sealed secret string with the `string:///` prefix followed by a base64-encoded JSON structure:
 
-```
+```text
 string:///eyJrZXlfdmVyc2lvbiI6InYxLjIuMyIsInBvbGljeV9pZCI6InNoYXJlZC92ZXMtaW8tYWxsb3ctdm9sdGVycmEiLCJ0ZW5hbnQiOiJ5b3VyLXRlbmFudCIsImRhdGEiOiJBQkNERUYxMjM0NTY3ODkwLi4uIn0=
 ```
 
@@ -387,6 +391,7 @@ When base64-decoded, the sealed JSON contains these fields:
 ```
 
 Field descriptions:
+
 - `key_version`: Public key version used for encryption
 - `policy_id`: Reference to the SecretPolicy (namespace/name format)
 - `tenant`: Your F5XC tenant identifier
@@ -405,6 +410,7 @@ Field descriptions:
 **Symptom:** Error message about missing authentication configuration.
 
 **Solution:**
+
 ```bash
 # Verify environment variables are set
 echo $F5XC_API_URL
@@ -422,6 +428,7 @@ export F5XC_API_TOKEN="your-api-token"
 **Solutions:**
 
 1. Use the built-in policy:
+
    ```hcl
    policy_name = "ves-io-allow-volterra"
    namespace   = "shared"
@@ -436,6 +443,7 @@ export F5XC_API_TOKEN="your-api-token"
 **Solutions:**
 
 1. Verify your secret size:
+
    ```bash
    wc -c < your-secret-file
    ```
@@ -451,6 +459,7 @@ export F5XC_API_TOKEN="your-api-token"
 **Solutions:**
 
 1. Use `${path.module}` for relative paths:
+
    ```hcl
    location = provider::f5xc::blindfold_file(
      "${path.module}/certs/server.key",  # Correct
@@ -465,6 +474,7 @@ export F5XC_API_TOKEN="your-api-token"
 **Symptom:** Error about invalid base64 encoding.
 
 **Solution:** Ensure you're base64-encoding your plaintext:
+
 ```hcl
 # Correct
 location = provider::f5xc::blindfold(

package/dist/docs/guides/http-loadbalancer.md

@@ -89,9 +89,9 @@ Review the plan output, then type `yes` to confirm deployment.
 
 After deployment, Terraform outputs a CNAME target. Create a DNS record:
 
-| Type | Name | Value |
-|------|------|-------|
-| CNAME | app.example.com | ves-io-app-example-com.ac.vh.ves.io |
+| Type  | Name            | Value                                |
+| ----- | --------------- | ------------------------------------ |
+| CNAME | app.example.com | ves-io-app-example-com.ac.vh.ves.io  |
 
 ~> **Note:** DNS propagation may take up to 48 hours, though typically completes within minutes.
 
@@ -153,7 +153,7 @@ labels = {
 
 This guide creates the following resources:
 
-```
+```text
                     ┌─────────────────────────────────────────┐
                     │        F5 Distributed Cloud             │
                     │                                         │
@@ -185,14 +185,14 @@ This guide creates the following resources:
 
 ### Resources Created
 
-| Resource | Purpose |
-|----------|---------|
-| `f5xc_namespace` | Isolates resources (optional) |
-| `f5xc_healthcheck` | Monitors origin server health |
-| `f5xc_origin_pool` | Defines backend servers |
-| `f5xc_app_firewall` | WAF configuration |
-| `f5xc_rate_limiter` | Rate limiting policy |
-| `f5xc_http_loadbalancer` | Main load balancer |
+| Resource                 | Purpose                       |
+| ------------------------ | ----------------------------- |
+| `f5xc_namespace`         | Isolates resources (optional) |
+| `f5xc_healthcheck`       | Monitors origin server health |
+| `f5xc_origin_pool`       | Defines backend servers       |
+| `f5xc_app_firewall`      | WAF configuration             |
+| `f5xc_rate_limiter`      | Rate limiting policy          |
+| `f5xc_http_loadbalancer` | Main load balancer            |
 
 ## Troubleshooting
 

package/dist/docs/resources/dns_zone.md

@@ -2,12 +2,12 @@
 page_title: "f5xc_dns_zone Resource - terraform-provider-f5xc"
 subcategory: "DNS"
 description: |-
-  Manages a DNS Zone resource in F5 Distributed Cloud.
+  Manages DNS Zone in a given namespace. If one already exist it will give a error. in F5 Distributed Cloud.
 ---
 
 # f5xc_dns_zone (Resource)
 
-Manages a DNS Zone resource in F5 Distributed Cloud.
+Manages DNS Zone in a given namespace. If one already exist it will give a error. in F5 Distributed Cloud.
 
 ~> **Note** Please refer to [DNS Zone API docs](https://docs.cloud.f5.com/docs-v2/api/dns-zone) to learn more.
 
@@ -15,7 +15,7 @@ Manages a DNS Zone resource in F5 Distributed Cloud.
 
 ```terraform
 # DNS Zone Resource Example
-# Manages a DNS Zone resource in F5 Distributed Cloud.
+# Manages DNS Zone in a given namespace. If one already exist it will give a error. in F5 Distributed Cloud.
 
 # Basic DNS Zone configuration
 resource "f5xc_dns_zone" "example" {
@@ -69,15 +69,11 @@ resource "f5xc_dns_zone" "example" {
 
 ### Spec Argument Reference
 
-<a id="primary-servers"></a>&#x2022; [`primary_servers`](#primary-servers) - Optional List<br>DNS Primary Server IP
+-> **One of the following:**
+&#x2022; <a id="primary"></a>[`primary`](#primary) - Optional Block<br>PrimaryDNSCreateSpecType<br>See [Primary](#primary) below for details.
+<br><br>&#x2022; <a id="secondary"></a>[`secondary`](#secondary) - Optional Block<br>SecondaryDNSCreateSpecType
 
-<a id="timeouts"></a>&#x2022; [`timeouts`](#timeouts) - Optional Block<br>See [Timeouts](#timeouts) below for details.
-
-<a id="tsig-key-algorithm"></a>&#x2022; [`tsig_key_algorithm`](#tsig-key-algorithm) - Optional String  Defaults to `UNDEFINED`<br>Possible values are `HMAC_MD5`, `UNDEFINED`, `HMAC_SHA1`, `HMAC_SHA224`, `HMAC_SHA256`, `HMAC_SHA384`, `HMAC_SHA512`<br>[Enum: HMAC_MD5|UNDEFINED|HMAC_SHA1|HMAC_SHA224|HMAC_SHA256|HMAC_SHA384|HMAC_SHA512] TSIG Key Algorithm. TSIG key value must be compatible with the specified algorithm - UNDEFINED: UNDEFINED - HMAC_MD5: HMAC_MD5 - HMAC_SHA1: HMAC_SHA1 - HMAC_SHA224: HMAC_SHA224 - HMAC_SHA256: HMAC_SHA256 - HMAC_SHA384: HMAC_SHA384 - HMAC_SHA512: HMAC_SHA512
-
-<a id="tsig-key-name"></a>&#x2022; [`tsig_key_name`](#tsig-key-name) - Optional String<br>TSIG Key Name. TSIG key name as used in TSIG protocol extension
-
-<a id="tsig-key-value"></a>&#x2022; [`tsig_key_value`](#tsig-key-value) - Optional Block<br>Secret. SecretType is used in an object to indicate a sensitive/confidential field<br>See [Tsig Key Value](#tsig-key-value) below for details.
+<a id="timeouts"></a>&#x2022; [`timeouts`](#timeouts) - Optional Block
 
 ### Attributes Reference
 
@@ -87,43 +83,619 @@ In addition to all arguments above, the following attributes are exported:
 
 ---
 
-#### Timeouts
+#### Primary
 
-A [`timeouts`](#timeouts) block supports the following:
+A [`primary`](#primary) block supports the following:
 
-<a id="timeouts-create"></a>&#x2022; [`create`](#timeouts-create) - Optional String (Defaults to `10 minutes`)<br>Used when creating the resource
+<a id="primary-allow-http-lb-managed-records"></a>&#x2022; [`allow_http_lb_managed_records`](#primary-allow-http-lb-managed-records) - Optional Bool<br>Option to allow user-created HTTP, TCP, and CDN load balancer related resource records to be automatically managed in a protected RRset
 
-<a id="timeouts-delete"></a>&#x2022; [`delete`](#timeouts-delete) - Optional String (Defaults to `10 minutes`)<br>Used when deleting the resource
+<a id="primary-default-rr-set-group"></a>&#x2022; [`default_rr_set_group`](#primary-default-rr-set-group) - Optional Block<br>Add and manage DNS resource record sets part of Default set group<br>See [Default Rr Set Group](#primary-default-rr-set-group) below.
 
-<a id="timeouts-read"></a>&#x2022; [`read`](#timeouts-read) - Optional String (Defaults to `5 minutes`)<br>Used when retrieving the resource
+<a id="primary-default-soa-parameters"></a>&#x2022; [`default_soa_parameters`](#primary-default-soa-parameters) - Optional Block<br>Enable this option
 
-<a id="timeouts-update"></a>&#x2022; [`update`](#timeouts-update) - Optional String (Defaults to `10 minutes`)<br>Used when updating the resource
+<a id="primary-dnssec-mode"></a>&#x2022; [`dnssec_mode`](#primary-dnssec-mode) - Optional Block<br>Disable<br>See [Dnssec Mode](#primary-dnssec-mode) below.
+
+<a id="primary-rr-set-group"></a>&#x2022; [`rr_set_group`](#primary-rr-set-group) - Optional Block<br>Create and manage set groups, and resource record sets within them, x-ves-io-managed set is managed by F5<br>See [Rr Set Group](#primary-rr-set-group) below.
+
+<a id="primary-soa-parameters"></a>&#x2022; [`soa_parameters`](#primary-soa-parameters) - Optional Block<br>SOARecordParameterConfig<br>See [Soa Parameters](#primary-soa-parameters) below.
+
+#### Primary Default Rr Set Group
+
+A [`default_rr_set_group`](#primary-default-rr-set-group) block (within [`primary`](#primary)) supports the following:
+
+<a id="primary-default-rr-set-group-a-record"></a>&#x2022; [`a_record`](#primary-default-rr-set-group-a-record) - Optional Block<br>DNSAResourceRecord. A Records<br>See [A Record](#primary-default-rr-set-group-a-record) below.
+
+<a id="record-6a4ef0"></a>&#x2022; [`aaaa_record`](#record-6a4ef0) - Optional Block<br>DNSAAAAResourceRecord. RecordSet for AAAA Records<br>See [Aaaa Record](#record-6a4ef0) below.
+
+<a id="record-026644"></a>&#x2022; [`afsdb_record`](#record-026644) - Optional Block<br>DNS AFSDB Record. DNS AFSDB Record<br>See [Afsdb Record](#record-026644) below.
+
+<a id="record-6e32d8"></a>&#x2022; [`alias_record`](#record-6e32d8) - Optional Block<br>DNSAliasResourceRecord<br>See [Alias Record](#record-6e32d8) below.
+
+<a id="primary-default-rr-set-group-caa-record"></a>&#x2022; [`caa_record`](#primary-default-rr-set-group-caa-record) - Optional Block<br>DNSCAAResourceRecord<br>See [Caa Record](#primary-default-rr-set-group-caa-record) below.
+
+<a id="primary-default-rr-set-group-cds-record"></a>&#x2022; [`cds_record`](#primary-default-rr-set-group-cds-record) - Optional Block<br>DNS CDS Record. DNS CDS Record<br>See [Cds Record](#primary-default-rr-set-group-cds-record) below.
+
+<a id="record-3ef094"></a>&#x2022; [`cert_record`](#record-3ef094) - Optional Block<br>DNS CERT Record. DNS CERT Record<br>See [Cert Record](#record-3ef094) below.
+
+<a id="record-8b5bff"></a>&#x2022; [`cname_record`](#record-8b5bff) - Optional Block<br>DNSCNAMEResourceRecord<br>See [Cname Record](#record-8b5bff) below.
+
+<a id="spec-4eb13e"></a>&#x2022; [`description_spec`](#spec-4eb13e) - Optional String<br>Comment
+
+<a id="primary-default-rr-set-group-ds-record"></a>&#x2022; [`ds_record`](#primary-default-rr-set-group-ds-record) - Optional Block<br>DNS DS Record. DNS DS Record<br>See [Ds Record](#primary-default-rr-set-group-ds-record) below.
+
+<a id="record-d72d9f"></a>&#x2022; [`eui48_record`](#record-d72d9f) - Optional Block<br>DNS EUI48 Record. DNS EUI48 Record<br>See [Eui48 Record](#record-d72d9f) below.
+
+<a id="record-d3d028"></a>&#x2022; [`eui64_record`](#record-d3d028) - Optional Block<br>DNS EUI64 Record. DNS EUI64 Record<br>See [Eui64 Record](#record-d3d028) below.
+
+<a id="primary-default-rr-set-group-lb-record"></a>&#x2022; [`lb_record`](#primary-default-rr-set-group-lb-record) - Optional Block<br>DNS Load Balancer Record. DNS Load Balancer Record<br>See [LB Record](#primary-default-rr-set-group-lb-record) below.
+
+<a id="primary-default-rr-set-group-loc-record"></a>&#x2022; [`loc_record`](#primary-default-rr-set-group-loc-record) - Optional Block<br>DNS LOC Record. DNS LOC Record<br>See [Loc Record](#primary-default-rr-set-group-loc-record) below.
+
+<a id="primary-default-rr-set-group-mx-record"></a>&#x2022; [`mx_record`](#primary-default-rr-set-group-mx-record) - Optional Block<br>DNSMXResourceRecord<br>See [Mx Record](#primary-default-rr-set-group-mx-record) below.
+
+<a id="record-16470e"></a>&#x2022; [`naptr_record`](#record-16470e) - Optional Block<br>DNS NAPTR Record. DNS NAPTR Record<br>See [Naptr Record](#record-16470e) below.
+
+<a id="primary-default-rr-set-group-ns-record"></a>&#x2022; [`ns_record`](#primary-default-rr-set-group-ns-record) - Optional Block<br>DNSNSResourceRecord<br>See [Ns Record](#primary-default-rr-set-group-ns-record) below.
+
+<a id="primary-default-rr-set-group-ptr-record"></a>&#x2022; [`ptr_record`](#primary-default-rr-set-group-ptr-record) - Optional Block<br>DNSPTRResourceRecord<br>See [Ptr Record](#primary-default-rr-set-group-ptr-record) below.
+
+<a id="primary-default-rr-set-group-srv-record"></a>&#x2022; [`srv_record`](#primary-default-rr-set-group-srv-record) - Optional Block<br>DNSSRVResourceRecord<br>See [Srv Record](#primary-default-rr-set-group-srv-record) below.
+
+<a id="record-cc1927"></a>&#x2022; [`sshfp_record`](#record-cc1927) - Optional Block<br>DNS SSHFP Record. DNS SSHFP Record<br>See [Sshfp Record](#record-cc1927) below.
+
+<a id="record-db5883"></a>&#x2022; [`tlsa_record`](#record-db5883) - Optional Block<br>DNS TLSA Record. DNS TLSA Record<br>See [Tlsa Record](#record-db5883) below.
+
+<a id="primary-default-rr-set-group-ttl"></a>&#x2022; [`ttl`](#primary-default-rr-set-group-ttl) - Optional Number<br>Time to live
+
+<a id="primary-default-rr-set-group-txt-record"></a>&#x2022; [`txt_record`](#primary-default-rr-set-group-txt-record) - Optional Block<br>DNSTXTResourceRecord<br>See [Txt Record](#primary-default-rr-set-group-txt-record) below.
+
+#### Primary Default Rr Set Group A Record
+
+An [`a_record`](#primary-default-rr-set-group-a-record) block (within [`primary.default_rr_set_group`](#primary-default-rr-set-group)) supports the following:
+
+<a id="name-59b7b8"></a>&#x2022; [`name`](#name-59b7b8) - Optional String<br>Record Name (Excluding Domain name). A Record name, please provide only the specific subdomain or record name without the base domain
+
+<a id="values-6ab550"></a>&#x2022; [`values`](#values-6ab550) - Optional List<br>IPv4 Addresses. A valid IPv4 address, for example: 1.1.1.1
+
+#### Primary Default Rr Set Group Aaaa Record
+
+An [`aaaa_record`](#record-6a4ef0) block (within [`primary.default_rr_set_group`](#primary-default-rr-set-group)) supports the following:
+
+<a id="name-c55d66"></a>&#x2022; [`name`](#name-c55d66) - Optional String<br>Record Name (Excluding Domain name). AAAA Record name, please provide only the specific subdomain or record name without the base domain
+
+<a id="values-6b9908"></a>&#x2022; [`values`](#values-6b9908) - Optional List<br>IPv6 Addresses. A valid IPv6 address, for example: 2001:0db8:85a3:0000:0000:8a2e:0370:7334
+
+#### Primary Default Rr Set Group Afsdb Record
+
+An [`afsdb_record`](#record-026644) block (within [`primary.default_rr_set_group`](#primary-default-rr-set-group)) supports the following:
+
+<a id="name-996289"></a>&#x2022; [`name`](#name-996289) - Optional String<br>Record Name (Excluding Domain name). AFSDB Record name, please provide only the specific subdomain or record name without the base domain
+
+<a id="values-776b5a"></a>&#x2022; [`values`](#values-776b5a) - Optional Block<br>AFSDB Value<br>See [Values](#values-776b5a) below.
+
+#### Primary Default Rr Set Group Afsdb Record Values
+
+<a id="deep-7224a6"></a>Deeply nested **Values** block collapsed for readability.
+
+#### Primary Default Rr Set Group Alias Record
+
+An [`alias_record`](#record-6e32d8) block (within [`primary.default_rr_set_group`](#primary-default-rr-set-group)) supports the following:
+
+<a id="value-da5681"></a>&#x2022; [`value`](#value-da5681) - Optional String<br>Domain. A valid domain name, for example: example.com
+
+#### Primary Default Rr Set Group Caa Record
+
+A [`caa_record`](#primary-default-rr-set-group-caa-record) block (within [`primary.default_rr_set_group`](#primary-default-rr-set-group)) supports the following:
+
+<a id="name-5c8e96"></a>&#x2022; [`name`](#name-5c8e96) - Optional String<br>Record Name (Excluding Domain name). CAA Record name, please provide only the specific subdomain or record name without the base domain
+
+<a id="values-41ba0e"></a>&#x2022; [`values`](#values-41ba0e) - Optional Block<br>CAA Record Value<br>See [Values](#values-41ba0e) below.
+
+#### Primary Default Rr Set Group Caa Record Values
+
+<a id="deep-31a8bf"></a>Deeply nested **Values** block collapsed for readability.
+
+#### Primary Default Rr Set Group Cds Record
+
+A [`cds_record`](#primary-default-rr-set-group-cds-record) block (within [`primary.default_rr_set_group`](#primary-default-rr-set-group)) supports the following:
+
+<a id="name-54ff93"></a>&#x2022; [`name`](#name-54ff93) - Optional String<br>Record Name (Excluding Domain name). CDS Record name, please provide only the specific subdomain or record name without the base domain
+
+<a id="values-970128"></a>&#x2022; [`values`](#values-970128) - Optional Block<br>DS Value<br>See [Values](#values-970128) below.
+
+#### Primary Default Rr Set Group Cds Record Values
+
+<a id="deep-6b61a3"></a>Deeply nested **Values** block collapsed for readability.
+
+#### Primary Default Rr Set Group Cds Record Values Sha1 Digest
+
+<a id="deep-336942"></a>Deeply nested **Digest** block collapsed for readability.
+
+#### Primary Default Rr Set Group Cds Record Values Sha256 Digest
+
+<a id="deep-2d3a7f"></a>Deeply nested **Digest** block collapsed for readability.
+
+#### Primary Default Rr Set Group Cds Record Values Sha384 Digest
+
+<a id="deep-107b34"></a>Deeply nested **Digest** block collapsed for readability.
+
+#### Primary Default Rr Set Group Cert Record
+
+A [`cert_record`](#record-3ef094) block (within [`primary.default_rr_set_group`](#primary-default-rr-set-group)) supports the following:
+
+<a id="name-f59c0d"></a>&#x2022; [`name`](#name-f59c0d) - Optional String<br>Record Name (Excluding Domain name). CERT Record name, please provide only the specific subdomain or record name without the base domain
+
+<a id="values-753772"></a>&#x2022; [`values`](#values-753772) - Optional Block<br>CERT Value<br>See [Values](#values-753772) below.
+
+#### Primary Default Rr Set Group Cert Record Values
+
+<a id="deep-4cedd5"></a>Deeply nested **Values** block collapsed for readability.
+
+#### Primary Default Rr Set Group Cname Record
+
+A [`cname_record`](#record-8b5bff) block (within [`primary.default_rr_set_group`](#primary-default-rr-set-group)) supports the following:
+
+<a id="name-73c139"></a>&#x2022; [`name`](#name-73c139) - Optional String<br>Record Name (Excluding Domain name). CName Record name, please provide only the specific subdomain or record name without the base domain
+
+<a id="value-8158f9"></a>&#x2022; [`value`](#value-8158f9) - Optional String<br>Domain
+
+#### Primary Default Rr Set Group Ds Record
+
+A [`ds_record`](#primary-default-rr-set-group-ds-record) block (within [`primary.default_rr_set_group`](#primary-default-rr-set-group)) supports the following:
+
+<a id="name-4472e4"></a>&#x2022; [`name`](#name-4472e4) - Optional String<br>Record Name (Excluding Domain name). DS Record name, please provide only the specific subdomain or record name without the base domain
+
+<a id="values-6934cb"></a>&#x2022; [`values`](#values-6934cb) - Optional Block<br>DS Value<br>See [Values](#values-6934cb) below.
+
+#### Primary Default Rr Set Group Ds Record Values
+
+<a id="deep-235ea7"></a>Deeply nested **Values** block collapsed for readability.
+
+#### Primary Default Rr Set Group Ds Record Values Sha1 Digest
+
+<a id="deep-093891"></a>Deeply nested **Digest** block collapsed for readability.
+
+#### Primary Default Rr Set Group Ds Record Values Sha256 Digest
+
+<a id="deep-b950dc"></a>Deeply nested **Digest** block collapsed for readability.
+
+#### Primary Default Rr Set Group Ds Record Values Sha384 Digest
+
+<a id="deep-6d3795"></a>Deeply nested **Digest** block collapsed for readability.
+
+#### Primary Default Rr Set Group Eui48 Record
+
+An [`eui48_record`](#record-d72d9f) block (within [`primary.default_rr_set_group`](#primary-default-rr-set-group)) supports the following:
+
+<a id="name-fcad11"></a>&#x2022; [`name`](#name-fcad11) - Optional String<br>Record Name (Excluding Domain name). EUI48 Record name, please provide only the specific subdomain or record name without the base domain
+
+<a id="value-9c7097"></a>&#x2022; [`value`](#value-9c7097) - Optional String<br>EUI48 Identifier. A valid eui48 identifier, for example: 01-23-45-67-89-ab
+
+#### Primary Default Rr Set Group Eui64 Record
+
+An [`eui64_record`](#record-d3d028) block (within [`primary.default_rr_set_group`](#primary-default-rr-set-group)) supports the following:
+
+<a id="name-148f42"></a>&#x2022; [`name`](#name-148f42) - Optional String<br>Record Name (Excluding Domain name). EUI64 Record name, please provide only the specific subdomain or record name without the base domain
+
+<a id="value-9f20fd"></a>&#x2022; [`value`](#value-9f20fd) - Optional String<br>EUI64 Identifier. A valid EUI64 identifier, for example: 01-23-45-67-89-ab-cd-ef
+
+#### Primary Default Rr Set Group LB Record
+
+A [`lb_record`](#primary-default-rr-set-group-lb-record) block (within [`primary.default_rr_set_group`](#primary-default-rr-set-group)) supports the following:
+
+<a id="name-423e27"></a>&#x2022; [`name`](#name-423e27) - Optional String<br>Record Name (Excluding Domain name). Load Balancer record name (except for SRV DNS Load balancer record) should be a simple record name and not a subdomain of a subdomain
+
+<a id="value-4b593b"></a>&#x2022; [`value`](#value-4b593b) - Optional Block<br>Object reference. This type establishes a direct reference from one object(the referrer) to another(the referred). Such a reference is in form of tenant/namespace/name<br>See [Value](#value-4b593b) below.
+
+#### Primary Default Rr Set Group LB Record Value
+
+<a id="deep-b51e9f"></a>Deeply nested **Value** block collapsed for readability.
+
+#### Primary Default Rr Set Group Loc Record
+
+A [`loc_record`](#primary-default-rr-set-group-loc-record) block (within [`primary.default_rr_set_group`](#primary-default-rr-set-group)) supports the following:
+
+<a id="name-568c6c"></a>&#x2022; [`name`](#name-568c6c) - Optional String<br>Record Name (Excluding Domain name). LOC Record name, please provide only the specific subdomain or record name without the base domain
+
+<a id="values-17d6e4"></a>&#x2022; [`values`](#values-17d6e4) - Optional Block<br>LOC Value<br>See [Values](#values-17d6e4) below.
+
+#### Primary Default Rr Set Group Loc Record Values
+
+<a id="deep-6917cb"></a>Deeply nested **Values** block collapsed for readability.
+
+#### Primary Default Rr Set Group Mx Record
+
+A [`mx_record`](#primary-default-rr-set-group-mx-record) block (within [`primary.default_rr_set_group`](#primary-default-rr-set-group)) supports the following:
+
+<a id="name-0ee04c"></a>&#x2022; [`name`](#name-0ee04c) - Optional String<br>Record Name (Excluding Domain name). MX Record name, please provide only the specific subdomain or record name without the base domain
+
+<a id="values-032997"></a>&#x2022; [`values`](#values-032997) - Optional Block<br>MX Record Value<br>See [Values](#values-032997) below.
+
+#### Primary Default Rr Set Group Mx Record Values
+
+<a id="deep-877222"></a>Deeply nested **Values** block collapsed for readability.
+
+#### Primary Default Rr Set Group Naptr Record
+
+A [`naptr_record`](#record-16470e) block (within [`primary.default_rr_set_group`](#primary-default-rr-set-group)) supports the following:
+
+<a id="name-9ba043"></a>&#x2022; [`name`](#name-9ba043) - Optional String<br>Record Name (Excluding Domain name). NAPTR Record name, please provide only the specific subdomain or record name without the base domain
+
+<a id="values-8f9cd5"></a>&#x2022; [`values`](#values-8f9cd5) - Optional Block<br>NAPTR Value<br>See [Values](#values-8f9cd5) below.
+
+#### Primary Default Rr Set Group Naptr Record Values
+
+<a id="deep-26168f"></a>Deeply nested **Values** block collapsed for readability.
+
+#### Primary Default Rr Set Group Ns Record
+
+A [`ns_record`](#primary-default-rr-set-group-ns-record) block (within [`primary.default_rr_set_group`](#primary-default-rr-set-group)) supports the following:
+
+<a id="name-816a8e"></a>&#x2022; [`name`](#name-816a8e) - Optional String<br>Record Name (Excluding Domain name). NS Record name, please provide only the specific subdomain or record name without the base domain
+
+<a id="values-0b1572"></a>&#x2022; [`values`](#values-0b1572) - Optional List<br>Name Servers
+
+#### Primary Default Rr Set Group Ptr Record
+
+A [`ptr_record`](#primary-default-rr-set-group-ptr-record) block (within [`primary.default_rr_set_group`](#primary-default-rr-set-group)) supports the following:
+
+<a id="name-87ab5a"></a>&#x2022; [`name`](#name-87ab5a) - Optional String<br>Record Name (Excluding Domain name). PTR Record name, please provide only the specific subdomain or record name without the base domain
+
+<a id="values-987974"></a>&#x2022; [`values`](#values-987974) - Optional List<br>Domain Name
+
+#### Primary Default Rr Set Group Srv Record
+
+A [`srv_record`](#primary-default-rr-set-group-srv-record) block (within [`primary.default_rr_set_group`](#primary-default-rr-set-group)) supports the following:
+
+<a id="name-d7e083"></a>&#x2022; [`name`](#name-d7e083) - Optional String<br>Record Name (Excluding Domain name). SRV Record name, please provide only the specific subdomain or record name without the base domain
+
+<a id="values-41fcb0"></a>&#x2022; [`values`](#values-41fcb0) - Optional Block<br>SRV Value<br>See [Values](#values-41fcb0) below.
+
+#### Primary Default Rr Set Group Srv Record Values
+
+<a id="deep-6da59a"></a>Deeply nested **Values** block collapsed for readability.
+
+#### Primary Default Rr Set Group Sshfp Record
+
+A [`sshfp_record`](#record-cc1927) block (within [`primary.default_rr_set_group`](#primary-default-rr-set-group)) supports the following:
+
+<a id="name-dba42e"></a>&#x2022; [`name`](#name-dba42e) - Optional String<br>Record Name (Excluding Domain name). SSHFP Record name, please provide only the specific subdomain or record name without the base domain
+
+<a id="values-eea3f2"></a>&#x2022; [`values`](#values-eea3f2) - Optional Block<br>SSHFP Value<br>See [Values](#values-eea3f2) below.
+
+#### Primary Default Rr Set Group Sshfp Record Values
+
+<a id="deep-240021"></a>Deeply nested **Values** block collapsed for readability.
+
+#### Primary Default Rr Set Group Sshfp Record Values Sha1 Fingerprint
+
+<a id="deep-080f3e"></a>Deeply nested **Fingerprint** block collapsed for readability.
+
+#### Primary Default Rr Set Group Sshfp Record Values Sha256 Fingerprint
+
+<a id="deep-95a797"></a>Deeply nested **Fingerprint** block collapsed for readability.
+
+#### Primary Default Rr Set Group Tlsa Record
+
+A [`tlsa_record`](#record-db5883) block (within [`primary.default_rr_set_group`](#primary-default-rr-set-group)) supports the following:
+
+<a id="name-687010"></a>&#x2022; [`name`](#name-687010) - Optional String<br>Record Name (Excluding Domain name). TLSA Record name, please provide only the specific subdomain or record name without the base domain
 
-#### Tsig Key Value
+<a id="values-49e48c"></a>&#x2022; [`values`](#values-49e48c) - Optional Block<br>TLSA Value<br>See [Values](#values-49e48c) below.
 
-A [`tsig_key_value`](#tsig-key-value) block supports the following:
+#### Primary Default Rr Set Group Tlsa Record Values
 
-<a id="tsig-key-value-blindfold-secret-info"></a>&#x2022; [`blindfold_secret_info`](#tsig-key-value-blindfold-secret-info) - Optional Block<br>Blindfold Secret. BlindfoldSecretInfoType specifies information about the Secret managed by F5XC Secret Management<br>See [Blindfold Secret Info](#tsig-key-value-blindfold-secret-info) below.
+<a id="deep-1962b2"></a>Deeply nested **Values** block collapsed for readability.
 
-<a id="tsig-key-value-clear-secret-info"></a>&#x2022; [`clear_secret_info`](#tsig-key-value-clear-secret-info) - Optional Block<br>In-Clear Secret. ClearSecretInfoType specifies information about the Secret that is not encrypted<br>See [Clear Secret Info](#tsig-key-value-clear-secret-info) below.
+#### Primary Default Rr Set Group Txt Record
 
-#### Tsig Key Value Blindfold Secret Info
+A [`txt_record`](#primary-default-rr-set-group-txt-record) block (within [`primary.default_rr_set_group`](#primary-default-rr-set-group)) supports the following:
 
-A [`blindfold_secret_info`](#tsig-key-value-blindfold-secret-info) block (within [`tsig_key_value`](#tsig-key-value)) supports the following:
+<a id="name-ea3275"></a>&#x2022; [`name`](#name-ea3275) - Optional String<br>Record Name (Excluding Domain name). TXT Record name, please provide only the specific subdomain or record name without the base domain
 
-<a id="provider-88cdbf"></a>&#x2022; [`decryption_provider`](#provider-88cdbf) - Optional String<br>Decryption Provider. Name of the Secret Management Access object that contains information about the backend Secret Management service
+<a id="values-49770a"></a>&#x2022; [`values`](#values-49770a) - Optional List<br>Text
 
-<a id="location-8d9440"></a>&#x2022; [`location`](#location-8d9440) - Optional String<br>Location. Location is the uri_ref. It could be in URL format for string:/// Or it could be a path if the store provider is an HTTP/HTTPS location
+#### Primary Dnssec Mode
 
-<a id="provider-2b7ae5"></a>&#x2022; [`store_provider`](#provider-2b7ae5) - Optional String<br>Store Provider. Name of the Secret Management Access object that contains information about the store to get encrypted bytes This field needs to be provided only if the URL scheme is not string:///
+A [`dnssec_mode`](#primary-dnssec-mode) block (within [`primary`](#primary)) supports the following:
 
-#### Tsig Key Value Clear Secret Info
+<a id="primary-dnssec-mode-disable"></a>&#x2022; [`disable`](#primary-dnssec-mode-disable) - Optional Block<br>Enable this option
 
-A [`clear_secret_info`](#tsig-key-value-clear-secret-info) block (within [`tsig_key_value`](#tsig-key-value)) supports the following:
+<a id="primary-dnssec-mode-enable"></a>&#x2022; [`enable`](#primary-dnssec-mode-enable) - Optional Block<br>Enable. DNSSEC enable
 
-<a id="ref-236f42"></a>&#x2022; [`provider_ref`](#ref-236f42) - Optional String<br>Provider. Name of the Secret Management Access object that contains information about the store to get encrypted bytes This field needs to be provided only if the URL scheme is not string:///
+#### Primary Rr Set Group
 
-<a id="tsig-key-value-clear-secret-info-url"></a>&#x2022; [`url`](#tsig-key-value-clear-secret-info-url) - Optional String<br>URL. URL of the secret. Currently supported URL schemes is string:///. For string:/// scheme, Secret needs to be encoded Base64 format. When asked for this secret, caller will get Secret bytes after Base64 decoding
+A [`rr_set_group`](#primary-rr-set-group) block (within [`primary`](#primary)) supports the following:
+
+<a id="primary-rr-set-group-metadata"></a>&#x2022; [`metadata`](#primary-rr-set-group-metadata) - Optional Block<br>Message Metadata. MessageMetaType is metadata (common attributes) of a message that only certain messages have. This information is propagated to the metadata of a child object that gets created from the containing message during view processing. The information in this type can be specified by user during create and replace APIs<br>See [Metadata](#primary-rr-set-group-metadata) below.
+
+<a id="primary-rr-set-group-rr-set"></a>&#x2022; [`rr_set`](#primary-rr-set-group-rr-set) - Optional Block<br>Resource Record Sets. Collection of DNS resource record sets<br>See [Rr Set](#primary-rr-set-group-rr-set) below.
+
+#### Primary Rr Set Group Metadata
+
+A [`metadata`](#primary-rr-set-group-metadata) block (within [`primary.rr_set_group`](#primary-rr-set-group)) supports the following:
+
+<a id="spec-383031"></a>&#x2022; [`description_spec`](#spec-383031) - Optional String<br>Description. Human readable description
+
+<a id="primary-rr-set-group-metadata-name"></a>&#x2022; [`name`](#primary-rr-set-group-metadata-name) - Optional String<br>Name. This is the name of the message. The value of name has to follow DNS-1035 format
+
+#### Primary Rr Set Group Rr Set
+
+A [`rr_set`](#primary-rr-set-group-rr-set) block (within [`primary.rr_set_group`](#primary-rr-set-group)) supports the following:
+
+<a id="primary-rr-set-group-rr-set-a-record"></a>&#x2022; [`a_record`](#primary-rr-set-group-rr-set-a-record) - Optional Block<br>DNSAResourceRecord. A Records<br>See [A Record](#primary-rr-set-group-rr-set-a-record) below.
+
+<a id="primary-rr-set-group-rr-set-aaaa-record"></a>&#x2022; [`aaaa_record`](#primary-rr-set-group-rr-set-aaaa-record) - Optional Block<br>DNSAAAAResourceRecord. RecordSet for AAAA Records<br>See [Aaaa Record](#primary-rr-set-group-rr-set-aaaa-record) below.
+
+<a id="record-5fff7a"></a>&#x2022; [`afsdb_record`](#record-5fff7a) - Optional Block<br>DNS AFSDB Record. DNS AFSDB Record<br>See [Afsdb Record](#record-5fff7a) below.
+
+<a id="record-62faa8"></a>&#x2022; [`alias_record`](#record-62faa8) - Optional Block<br>DNSAliasResourceRecord<br>See [Alias Record](#record-62faa8) below.
+
+<a id="primary-rr-set-group-rr-set-caa-record"></a>&#x2022; [`caa_record`](#primary-rr-set-group-rr-set-caa-record) - Optional Block<br>DNSCAAResourceRecord<br>See [Caa Record](#primary-rr-set-group-rr-set-caa-record) below.
+
+<a id="primary-rr-set-group-rr-set-cds-record"></a>&#x2022; [`cds_record`](#primary-rr-set-group-rr-set-cds-record) - Optional Block<br>DNS CDS Record. DNS CDS Record<br>See [Cds Record](#primary-rr-set-group-rr-set-cds-record) below.
+
+<a id="primary-rr-set-group-rr-set-cert-record"></a>&#x2022; [`cert_record`](#primary-rr-set-group-rr-set-cert-record) - Optional Block<br>DNS CERT Record. DNS CERT Record<br>See [Cert Record](#primary-rr-set-group-rr-set-cert-record) below.
+
+<a id="record-c00906"></a>&#x2022; [`cname_record`](#record-c00906) - Optional Block<br>DNSCNAMEResourceRecord<br>See [Cname Record](#record-c00906) below.
+
+<a id="spec-fe6497"></a>&#x2022; [`description_spec`](#spec-fe6497) - Optional String<br>Comment
+
+<a id="primary-rr-set-group-rr-set-ds-record"></a>&#x2022; [`ds_record`](#primary-rr-set-group-rr-set-ds-record) - Optional Block<br>DNS DS Record. DNS DS Record<br>See [Ds Record](#primary-rr-set-group-rr-set-ds-record) below.
+
+<a id="record-9b288e"></a>&#x2022; [`eui48_record`](#record-9b288e) - Optional Block<br>DNS EUI48 Record. DNS EUI48 Record<br>See [Eui48 Record](#record-9b288e) below.
+
+<a id="record-4ddc4d"></a>&#x2022; [`eui64_record`](#record-4ddc4d) - Optional Block<br>DNS EUI64 Record. DNS EUI64 Record<br>See [Eui64 Record](#record-4ddc4d) below.
+
+<a id="primary-rr-set-group-rr-set-lb-record"></a>&#x2022; [`lb_record`](#primary-rr-set-group-rr-set-lb-record) - Optional Block<br>DNS Load Balancer Record. DNS Load Balancer Record<br>See [LB Record](#primary-rr-set-group-rr-set-lb-record) below.
+
+<a id="primary-rr-set-group-rr-set-loc-record"></a>&#x2022; [`loc_record`](#primary-rr-set-group-rr-set-loc-record) - Optional Block<br>DNS LOC Record. DNS LOC Record<br>See [Loc Record](#primary-rr-set-group-rr-set-loc-record) below.
+
+<a id="primary-rr-set-group-rr-set-mx-record"></a>&#x2022; [`mx_record`](#primary-rr-set-group-rr-set-mx-record) - Optional Block<br>DNSMXResourceRecord<br>See [Mx Record](#primary-rr-set-group-rr-set-mx-record) below.
+
+<a id="record-8d4520"></a>&#x2022; [`naptr_record`](#record-8d4520) - Optional Block<br>DNS NAPTR Record. DNS NAPTR Record<br>See [Naptr Record](#record-8d4520) below.
+
+<a id="primary-rr-set-group-rr-set-ns-record"></a>&#x2022; [`ns_record`](#primary-rr-set-group-rr-set-ns-record) - Optional Block<br>DNSNSResourceRecord<br>See [Ns Record](#primary-rr-set-group-rr-set-ns-record) below.
+
+<a id="primary-rr-set-group-rr-set-ptr-record"></a>&#x2022; [`ptr_record`](#primary-rr-set-group-rr-set-ptr-record) - Optional Block<br>DNSPTRResourceRecord<br>See [Ptr Record](#primary-rr-set-group-rr-set-ptr-record) below.
+
+<a id="primary-rr-set-group-rr-set-srv-record"></a>&#x2022; [`srv_record`](#primary-rr-set-group-rr-set-srv-record) - Optional Block<br>DNSSRVResourceRecord<br>See [Srv Record](#primary-rr-set-group-rr-set-srv-record) below.
+
+<a id="record-736138"></a>&#x2022; [`sshfp_record`](#record-736138) - Optional Block<br>DNS SSHFP Record. DNS SSHFP Record<br>See [Sshfp Record](#record-736138) below.
+
+<a id="primary-rr-set-group-rr-set-tlsa-record"></a>&#x2022; [`tlsa_record`](#primary-rr-set-group-rr-set-tlsa-record) - Optional Block<br>DNS TLSA Record. DNS TLSA Record<br>See [Tlsa Record](#primary-rr-set-group-rr-set-tlsa-record) below.
+
+<a id="primary-rr-set-group-rr-set-ttl"></a>&#x2022; [`ttl`](#primary-rr-set-group-rr-set-ttl) - Optional Number<br>Time to live
+
+<a id="primary-rr-set-group-rr-set-txt-record"></a>&#x2022; [`txt_record`](#primary-rr-set-group-rr-set-txt-record) - Optional Block<br>DNSTXTResourceRecord<br>See [Txt Record](#primary-rr-set-group-rr-set-txt-record) below.
+
+#### Primary Rr Set Group Rr Set A Record
+
+<a id="deep-533e88"></a>Deeply nested **Record** block collapsed for readability.
+
+#### Primary Rr Set Group Rr Set Aaaa Record
+
+<a id="deep-42bc39"></a>Deeply nested **Record** block collapsed for readability.
+
+#### Primary Rr Set Group Rr Set Afsdb Record
+
+<a id="deep-477f8d"></a>Deeply nested **Record** block collapsed for readability.
+
+#### Primary Rr Set Group Rr Set Afsdb Record Values
+
+<a id="deep-7e2a54"></a>Deeply nested **Values** block collapsed for readability.
+
+#### Primary Rr Set Group Rr Set Alias Record
+
+<a id="deep-482a6d"></a>Deeply nested **Record** block collapsed for readability.
+
+#### Primary Rr Set Group Rr Set Caa Record
+
+<a id="deep-66ae76"></a>Deeply nested **Record** block collapsed for readability.
+
+#### Primary Rr Set Group Rr Set Caa Record Values
+
+<a id="deep-c100ec"></a>Deeply nested **Values** block collapsed for readability.
+
+#### Primary Rr Set Group Rr Set Cds Record
+
+<a id="deep-89f1fe"></a>Deeply nested **Record** block collapsed for readability.
+
+#### Primary Rr Set Group Rr Set Cds Record Values
+
+<a id="deep-ca260e"></a>Deeply nested **Values** block collapsed for readability.
+
+#### Primary Rr Set Group Rr Set Cds Record Values Sha1 Digest
+
+<a id="deep-8ef0c5"></a>Deeply nested **Digest** block collapsed for readability.
+
+#### Primary Rr Set Group Rr Set Cds Record Values Sha256 Digest
+
+<a id="deep-affe0f"></a>Deeply nested **Digest** block collapsed for readability.
+
+#### Primary Rr Set Group Rr Set Cds Record Values Sha384 Digest
+
+<a id="deep-023fe9"></a>Deeply nested **Digest** block collapsed for readability.
+
+#### Primary Rr Set Group Rr Set Cert Record
+
+<a id="deep-91c89f"></a>Deeply nested **Record** block collapsed for readability.
+
+#### Primary Rr Set Group Rr Set Cert Record Values
+
+<a id="deep-d23a7c"></a>Deeply nested **Values** block collapsed for readability.
+
+#### Primary Rr Set Group Rr Set Cname Record
+
+<a id="deep-ebf6fd"></a>Deeply nested **Record** block collapsed for readability.
+
+#### Primary Rr Set Group Rr Set Ds Record
+
+<a id="deep-56b2e6"></a>Deeply nested **Record** block collapsed for readability.
+
+#### Primary Rr Set Group Rr Set Ds Record Values
+
+<a id="deep-cc2512"></a>Deeply nested **Values** block collapsed for readability.
+
+#### Primary Rr Set Group Rr Set Ds Record Values Sha1 Digest
+
+<a id="deep-58123e"></a>Deeply nested **Digest** block collapsed for readability.
+
+#### Primary Rr Set Group Rr Set Ds Record Values Sha256 Digest
+
+<a id="deep-551194"></a>Deeply nested **Digest** block collapsed for readability.
+
+#### Primary Rr Set Group Rr Set Ds Record Values Sha384 Digest
+
+<a id="deep-7a7126"></a>Deeply nested **Digest** block collapsed for readability.
+
+#### Primary Rr Set Group Rr Set Eui48 Record
+
+<a id="deep-407753"></a>Deeply nested **Record** block collapsed for readability.
+
+#### Primary Rr Set Group Rr Set Eui64 Record
+
+<a id="deep-b94961"></a>Deeply nested **Record** block collapsed for readability.
+
+#### Primary Rr Set Group Rr Set LB Record
+
+<a id="deep-6258c5"></a>Deeply nested **Record** block collapsed for readability.
+
+#### Primary Rr Set Group Rr Set LB Record Value
+
+<a id="deep-96233f"></a>Deeply nested **Value** block collapsed for readability.
+
+#### Primary Rr Set Group Rr Set Loc Record
+
+<a id="deep-fdb347"></a>Deeply nested **Record** block collapsed for readability.
+
+#### Primary Rr Set Group Rr Set Loc Record Values
+
+<a id="deep-706e2d"></a>Deeply nested **Values** block collapsed for readability.
+
+#### Primary Rr Set Group Rr Set Mx Record
+
+<a id="deep-7baabe"></a>Deeply nested **Record** block collapsed for readability.
+
+#### Primary Rr Set Group Rr Set Mx Record Values
+
+<a id="deep-cc2223"></a>Deeply nested **Values** block collapsed for readability.
+
+#### Primary Rr Set Group Rr Set Naptr Record
+
+<a id="deep-4722da"></a>Deeply nested **Record** block collapsed for readability.
+
+#### Primary Rr Set Group Rr Set Naptr Record Values
+
+<a id="deep-978399"></a>Deeply nested **Values** block collapsed for readability.
+
+#### Primary Rr Set Group Rr Set Ns Record
+
+<a id="deep-d1e54f"></a>Deeply nested **Record** block collapsed for readability.
+
+#### Primary Rr Set Group Rr Set Ptr Record
+
+<a id="deep-22ef4c"></a>Deeply nested **Record** block collapsed for readability.
+
+#### Primary Rr Set Group Rr Set Srv Record
+
+<a id="deep-fd89f4"></a>Deeply nested **Record** block collapsed for readability.
+
+#### Primary Rr Set Group Rr Set Srv Record Values
+
+<a id="deep-468bb2"></a>Deeply nested **Values** block collapsed for readability.
+
+#### Primary Rr Set Group Rr Set Sshfp Record
+
+<a id="deep-902aa9"></a>Deeply nested **Record** block collapsed for readability.
+
+#### Primary Rr Set Group Rr Set Sshfp Record Values
+
+<a id="deep-8adb01"></a>Deeply nested **Values** block collapsed for readability.
+
+#### Primary Rr Set Group Rr Set Sshfp Record Values Sha1 Fingerprint
+
+<a id="deep-2e2d00"></a>Deeply nested **Fingerprint** block collapsed for readability.
+
+#### Primary Rr Set Group Rr Set Sshfp Record Values Sha256 Fingerprint
+
+<a id="deep-af6d05"></a>Deeply nested **Fingerprint** block collapsed for readability.
+
+#### Primary Rr Set Group Rr Set Tlsa Record
+
+<a id="deep-5be176"></a>Deeply nested **Record** block collapsed for readability.
+
+#### Primary Rr Set Group Rr Set Tlsa Record Values
+
+<a id="deep-a25b62"></a>Deeply nested **Values** block collapsed for readability.
+
+#### Primary Rr Set Group Rr Set Txt Record
+
+<a id="deep-6399bb"></a>Deeply nested **Record** block collapsed for readability.
+
+#### Primary Soa Parameters
+
+A [`soa_parameters`](#primary-soa-parameters) block (within [`primary`](#primary)) supports the following:
+
+<a id="primary-soa-parameters-expire"></a>&#x2022; [`expire`](#primary-soa-parameters-expire) - Optional Number<br>Expire. expire value indicates when secondary nameservers should stop answering request for this zone if primary does not respond
+
+<a id="primary-soa-parameters-negative-ttl"></a>&#x2022; [`negative_ttl`](#primary-soa-parameters-negative-ttl) - Optional Number<br>Negative TTL. negative TTL value indicates how long to cache non-existent resource record for this zone
+
+<a id="primary-soa-parameters-refresh"></a>&#x2022; [`refresh`](#primary-soa-parameters-refresh) - Optional Number<br>Refresh interval. refresh value indicates when secondary nameservers should query for the SOA record to detect zone changes
+
+<a id="primary-soa-parameters-retry"></a>&#x2022; [`retry`](#primary-soa-parameters-retry) - Optional Number<br>Retry Interval. retry value indicates when secondary nameservers should retry to request the serial number if primary does not respond
+
+<a id="primary-soa-parameters-ttl"></a>&#x2022; [`ttl`](#primary-soa-parameters-ttl) - Optional Number<br>TTL. SOA record time to live (in seconds)
+
+#### Secondary
+
+A [`secondary`](#secondary) block supports the following:
+
+<a id="secondary-primary-servers"></a>&#x2022; [`primary_servers`](#secondary-primary-servers) - Optional List<br>DNS Primary Server IP
+
+<a id="secondary-tsig-key-algorithm"></a>&#x2022; [`tsig_key_algorithm`](#secondary-tsig-key-algorithm) - Optional String  Defaults to `UNDEFINED`<br>Possible values are `HMAC_MD5`, `UNDEFINED`, `HMAC_SHA1`, `HMAC_SHA224`, `HMAC_SHA256`, `HMAC_SHA384`, `HMAC_SHA512`<br>[Enum: HMAC_MD5|UNDEFINED|HMAC_SHA1|HMAC_SHA224|HMAC_SHA256|HMAC_SHA384|HMAC_SHA512] TSIG Key Algorithm. TSIG key value must be compatible with the specified algorithm - UNDEFINED: UNDEFINED - HMAC_MD5: HMAC_MD5 - HMAC_SHA1: HMAC_SHA1 - HMAC_SHA224: HMAC_SHA224 - HMAC_SHA256: HMAC_SHA256 - HMAC_SHA384: HMAC_SHA384 - HMAC_SHA512: HMAC_SHA512
+
+<a id="secondary-tsig-key-name"></a>&#x2022; [`tsig_key_name`](#secondary-tsig-key-name) - Optional String<br>TSIG Key Name. TSIG key name as used in TSIG protocol extension
+
+<a id="secondary-tsig-key-value"></a>&#x2022; [`tsig_key_value`](#secondary-tsig-key-value) - Optional Block<br>Secret. SecretType is used in an object to indicate a sensitive/confidential field<br>See [Tsig Key Value](#secondary-tsig-key-value) below.
+
+#### Secondary Tsig Key Value
+
+A [`tsig_key_value`](#secondary-tsig-key-value) block (within [`secondary`](#secondary)) supports the following:
+
+<a id="info-dc8549"></a>&#x2022; [`blindfold_secret_info`](#info-dc8549) - Optional Block<br>Blindfold Secret. BlindfoldSecretInfoType specifies information about the Secret managed by F5XC Secret Management<br>See [Blindfold Secret Info](#info-dc8549) below.
+
+<a id="info-712cd8"></a>&#x2022; [`clear_secret_info`](#info-712cd8) - Optional Block<br>In-Clear Secret. ClearSecretInfoType specifies information about the Secret that is not encrypted<br>See [Clear Secret Info](#info-712cd8) below.
+
+#### Secondary Tsig Key Value Blindfold Secret Info
+
+A [`blindfold_secret_info`](#info-dc8549) block (within [`secondary.tsig_key_value`](#secondary-tsig-key-value)) supports the following:
+
+<a id="provider-9d03fe"></a>&#x2022; [`decryption_provider`](#provider-9d03fe) - Optional String<br>Decryption Provider. Name of the Secret Management Access object that contains information about the backend Secret Management service
+
+<a id="location-ef4bdb"></a>&#x2022; [`location`](#location-ef4bdb) - Optional String<br>Location. Location is the uri_ref. It could be in URL format for string:/// Or it could be a path if the store provider is an HTTP/HTTPS location
+
+<a id="provider-be11a9"></a>&#x2022; [`store_provider`](#provider-be11a9) - Optional String<br>Store Provider. Name of the Secret Management Access object that contains information about the store to get encrypted bytes This field needs to be provided only if the URL scheme is not string:///
+
+#### Secondary Tsig Key Value Clear Secret Info
+
+A [`clear_secret_info`](#info-712cd8) block (within [`secondary.tsig_key_value`](#secondary-tsig-key-value)) supports the following:
+
+<a id="ref-f21028"></a>&#x2022; [`provider_ref`](#ref-f21028) - Optional String<br>Provider. Name of the Secret Management Access object that contains information about the store to get encrypted bytes This field needs to be provided only if the URL scheme is not string:///
+
+<a id="url-f87f89"></a>&#x2022; [`url`](#url-f87f89) - Optional String<br>URL. URL of the secret. Currently supported URL schemes is string:///. For string:/// scheme, Secret needs to be encoded Base64 format. When asked for this secret, caller will get Secret bytes after Base64 decoding
+
+#### Timeouts
+
+A [`timeouts`](#timeouts) block supports the following:
+
+<a id="timeouts-create"></a>&#x2022; [`create`](#timeouts-create) - Optional String (Defaults to `10 minutes`)<br>Used when creating the resource
+
+<a id="timeouts-delete"></a>&#x2022; [`delete`](#timeouts-delete) - Optional String (Defaults to `10 minutes`)<br>Used when deleting the resource
+
+<a id="timeouts-read"></a>&#x2022; [`read`](#timeouts-read) - Optional String (Defaults to `5 minutes`)<br>Used when retrieving the resource
+
+<a id="timeouts-update"></a>&#x2022; [`update`](#timeouts-update) - Optional String (Defaults to `10 minutes`)<br>Used when updating the resource
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@robinmordasiewicz/f5xc-terraform-mcp",
-  "version": "2.10.0",
+  "version": "2.11.0",
   "description": "MCP server for F5 Distributed Cloud Terraform provider - provides documentation and API specification access for AI assistants",
   "type": "module",
   "main": "dist/index.js",