Introduce several dnssec related zone options

manifests/zone.pp

@@ -51,6 +51,10 @@
   Optional[Enum['yes', 'no', 'explicit']] $dns_notify   = undef,
   Hash[String, Hash[String, Data]] $update_policy_rules = {}, # deprecated
   Optional[Dns::UpdatePolicy] $update_policy            = undef,
+  Optional[Stdlib::Absolutepath] $key_directory         = undef,
+  Optional[Enum['yes', 'no']] $inline_signing           = undef,
+  Optional[Enum['yes', 'no']] $dnssec_secure_to_insecure  = undef,
+  Optional[Enum['allow', 'maintain', 'off']] $auto_dnssec = undef,
 ) {
 
   $_contact = pick($contact, "root.${zone}.")

spec/defines/dns_zone_spec.rb

@@ -427,4 +427,29 @@
     end
   end
 
+  context 'when several dnssec related parameters are set' do
+    let(:params) { {
+      :inline_signing            => 'yes',
+      :dnssec_secure_to_insecure => 'yes',
+      :key_directory             => '/etc/bind/keys',
+      :auto_dnssec               => 'maintain',
+    } }
+
+    it "should have valid zone configuration" do
+      verify_concat_fragment_exact_contents(catalogue, 'dns_zones+10__GLOBAL__example.com.dns', [
+      'zone "example.com" {',
+      '    type master;',
+      '    file "/var/named/dynamic/db.example.com";',
+      '    auto-dnssec maintain;',
+      '    dnssec-secure-to-insecure yes;',
+      '    inline-signing yes;',
+      '    key-directory "/etc/bind/keys";',
+      '    update-policy {',
+      '            grant rndc-key zonesub ANY;',
+      '    };',
+      '};',
+    ])
+    end
+  end
+
 end

templates/named.zone.erb

@@ -22,6 +22,18 @@ zone "<%= @zone %>" {
     };
 <%   end -%>
 <% end -%>
+<% if @auto_dnssec -%>
+    auto-dnssec <%= @auto_dnssec %>;
+<% end -%>
+<% if @dnssec_secure_to_insecure -%>
+    dnssec-secure-to-insecure <%= @dnssec_secure_to_insecure %>;
+<% end -%>
+<% if @inline_signing -%>
+    inline-signing <%= @inline_signing %>;
+<% end -%>
+<% if @key_directory -%>
+    key-directory "<%= @key_directory %>";
+<% end -%>
 <% unless @zonetype == 'forward' -%>
 <% unless @allow_transfer.empty? -%>
     allow-transfer { <%= @allow_transfer.join('; ') %>; };