From 2a5e90b13770cb5fa168986165d8b35e654061ef Mon Sep 17 00:00:00 2001 From: JulianGV21 Date: Mon, 3 Aug 2026 12:57:04 +0200 Subject: [PATCH 1/3] Migrate AKS module first steps --- modules/azure-aks/aks.tf | 83 +++++++++++------------- modules/azure-aks/auto_scaler_profile.tf | 19 ++++++ modules/azure-aks/main.tf | 4 +- modules/azure-aks/node_pool.tf | 73 +++++++++++++++------ modules/azure-aks/role_assignment.tf | 18 +++-- 5 files changed, 124 insertions(+), 73 deletions(-) create mode 100644 modules/azure-aks/auto_scaler_profile.tf diff --git a/modules/azure-aks/aks.tf b/modules/azure-aks/aks.tf index 4e27793ad..982b1dd0b 100644 --- a/modules/azure-aks/aks.tf +++ b/modules/azure-aks/aks.tf @@ -1,62 +1,53 @@ # AKS section module "aks" { - # https://registry.terraform.io/modules/Azure/aks/azurerm/latest - source = "github.com/Azure/terraform-azurerm-aks?ref=11.1.0" + # https://registry.terraform.io/modules/Azure/avm-res-containerservice-managedcluster/azurerm/latest + source = "github.com/Azure/terraform-azurerm-avm-res-containerservice-managedcluster?ref=v0.7.1" location = var.location - agents_count = var.aks_agents_count - agents_labels = var.aks_default_pool_custom_labels - agents_max_pods = var.aks_agents_max_pods - agents_pool_drain_timeout_in_minutes = var.aks_agents_pool_drain_timeout_in_minutes - agents_pool_max_surge = var.aks_agents_pool_max_surge - agents_pool_name = var.aks_agents_pool_name - agents_size = var.aks_agents_size + default_agent_pool = local.default_agent_pool api_server_authorized_ip_ranges = var.api_server_authorized_ip_ranges - attached_acr_id_map = var.acr_map - auto_scaler_profile_enabled = var.auto_scaler_profile_enabled - auto_scaler_profile_expander = var.auto_scaler_profile_expander - auto_scaler_profile_max_graceful_termination_sec = var.auto_scaler_profile_max_graceful_termination_sec - auto_scaler_profile_max_node_provisioning_time = var.auto_scaler_profile_max_node_provisioning_time - auto_scaler_profile_max_unready_nodes = var.auto_scaler_profile_max_unready_nodes - auto_scaler_profile_max_unready_percentage = var.auto_scaler_profile_max_unready_percentage - auto_scaler_profile_new_pod_scale_up_delay = var.auto_scaler_profile_new_pod_scale_up_delay - auto_scaler_profile_scale_down_delay_after_add = var.auto_scaler_profile_scale_down_delay_after_add - auto_scaler_profile_scale_down_delay_after_delete = var.auto_scaler_profile_scale_down_delay_after_delete - auto_scaler_profile_scale_down_delay_after_failure = var.auto_scaler_profile_scale_down_delay_after_failure - auto_scaler_profile_scale_down_unneeded = var.auto_scaler_profile_scale_down_unneeded - auto_scaler_profile_scale_down_unready = var.auto_scaler_profile_scale_down_unready - auto_scaler_profile_scale_down_utilization_threshold = var.auto_scaler_profile_scale_down_utilization_threshold - auto_scaler_profile_scan_interval = var.auto_scaler_profile_scan_interval - auto_scaler_profile_skip_nodes_with_local_storage = var.auto_scaler_profile_skip_nodes_with_local_storage - auto_scaler_profile_skip_nodes_with_system_pods = var.auto_scaler_profile_skip_nodes_with_system_pods + auto_scaler_profile = local.auto_scaler_profile key_vault_secrets_provider_enabled = var.key_vault_secrets_provider_enabled kubernetes_version = var.aks_kubernetes_version - load_balancer_profile_enabled = var.net_profile_outbound_type == "loadBalancer" ? var.load_balancer_profile_enabled : false - load_balancer_profile_outbound_ip_address_ids = var.net_profile_outbound_type == "loadBalancer" && length(data.azurerm_public_ip.aks_public_ip) > 0 ? [data.azurerm_public_ip.aks_public_ip[0].id] : null - load_balancer_sku = var.load_balancer_sku - log_analytics_workspace_enabled = false network_contributor_role_assigned_subnet_ids = { aks_subnet = data.azurerm_subnet.aks_subnet.id } - network_plugin = var.aks_network_plugin - network_policy = var.aks_network_policy node_os_channel_upgrade = var.node_os_channel_upgrade - node_pools = local.extra_pools + agent_pools = local.agent_pools oidc_issuer_enabled = var.oidc_issuer_enabled orchestrator_version = var.aks_orchestrator_version - os_disk_size_gb = var.aks_os_disk_size_gb - prefix = var.aks_prefix - rbac_aad_azure_rbac_enabled = true - rbac_aad_tenant_id = data.azurerm_client_config.current.tenant_id - resource_group_name = var.resource_group_name - role_based_access_control_enabled = true - secret_rotation_enabled = var.secret_rotation_enabled - secret_rotation_interval = var.secret_rotation_interval + name = var.aks_prefix + + aad_profile = { + managed = true + enable_azure_rbac = true + tenant_id = data.azurerm_client_config.current.tenant_id + } + + network_profile = { + network_plugin = var.aks_network_plugin + network_policy = var.aks_network_policy + + load_balancer_sku = var.load_balancer_sku + + outbound_type = var.net_profile_outbound_type + + load_balancer_profile = ( + var.net_profile_outbound_type == "loadBalancer" && + var.load_balancer_profile_enabled + ) ? { + outbound_ip_address_ids = length(data.azurerm_public_ip.aks_public_ip) > 0 ? [ + data.azurerm_public_ip.aks_public_ip[0].id + ] : null + } : null + } + + key_vault_secrets_provider = { + secret_rotation_enabled = var.secret_rotation_enabled + secret_rotation_interval = var.secret_rotation_interval + } + + parent_id = data.azurerm_resource_group.this.id sku_tier = var.aks_sku_tier tags = local.tags - temporary_name_for_rotation = var.temporary_name_for_rotation - vnet_subnet = { - id = data.azurerm_subnet.aks_subnet.id - } upgrade_override = var.upgrade_override workload_identity_enabled = var.workload_identity_enabled - net_profile_outbound_type = var.net_profile_outbound_type } diff --git a/modules/azure-aks/auto_scaler_profile.tf b/modules/azure-aks/auto_scaler_profile.tf new file mode 100644 index 000000000..ae96f02ff --- /dev/null +++ b/modules/azure-aks/auto_scaler_profile.tf @@ -0,0 +1,19 @@ +locals { + auto_scaler_profile = var.auto_scaler_profile_enabled ? { + expander = var.auto_scaler_profile_expander + max_graceful_termination_sec = var.auto_scaler_profile_max_graceful_termination_sec + max_node_provisioning_time = var.auto_scaler_profile_max_node_provisioning_time + max_unready_nodes = var.auto_scaler_profile_max_unready_nodes + max_unready_percentage = var.auto_scaler_profile_max_unready_percentage + new_pod_scale_up_delay = var.auto_scaler_profile_new_pod_scale_up_delay + scale_down_delay_after_add = var.auto_scaler_profile_scale_down_delay_after_add + scale_down_delay_after_delete = var.auto_scaler_profile_scale_down_delay_after_delete + scale_down_delay_after_failure = var.auto_scaler_profile_scale_down_delay_after_failure + scale_down_unneeded = var.auto_scaler_profile_scale_down_unneeded + scale_down_unready = var.auto_scaler_profile_scale_down_unready + scale_down_utilization_threshold = var.auto_scaler_profile_scale_down_utilization_threshold + scan_interval = var.auto_scaler_profile_scan_interval + skip_nodes_with_local_storage = var.auto_scaler_profile_skip_nodes_with_local_storage + skip_nodes_with_system_pods = var.auto_scaler_profile_skip_nodes_with_system_pods + } : null +} diff --git a/modules/azure-aks/main.tf b/modules/azure-aks/main.tf index 8eb215a32..641627009 100644 --- a/modules/azure-aks/main.tf +++ b/modules/azure-aks/main.tf @@ -3,10 +3,10 @@ terraform { required_providers { azapi = { - source = "Azure/azapi" + source = "Azure/azapi" } azurerm = { - source = "hashicorp/azurerm" + source = "hashicorp/azurerm" } } } diff --git a/modules/azure-aks/node_pool.tf b/modules/azure-aks/node_pool.tf index de1e9f8e9..57476eb1b 100644 --- a/modules/azure-aks/node_pool.tf +++ b/modules/azure-aks/node_pool.tf @@ -1,24 +1,55 @@ locals { - extra_pools = { - for pool in var.extra_node_pools : - pool.name => { - name = pool.pool_name - vm_size = pool.vm_size - auto_scaling_enabled = pool.enable_auto_scaling - - node_count = pool.enable_auto_scaling ? null : pool.node_count - vnet_subnet = { - id = data.azurerm_subnet.aks_subnet.id + default_agent_pool = { + name = var.aks_agents_pool_name + vm_size = var.aks_agents_size + + node_count = var.aks_agents_count + + enable_auto_scaling = false + + max_pods = var.aks_agents_max_pods + os_disk_size_gb = var.aks_os_disk_size_gb + + node_labels = var.aks_default_pool_custom_labels + + orchestrator_version = var.aks_orchestrator_version + + vnet_subnet_id = data.azurerm_subnet.aks_subnet.id + + temporary_name_for_rotation = var.temporary_name_for_rotation + + upgrade_settings = { + drain_timeout_in_minutes = var.aks_agents_pool_drain_timeout_in_minutes + max_surge = var.aks_agents_pool_max_surge + } + } + + agent_pools = { + for pool in var.extra_node_pools : pool.name => { + name = pool.pool_name + vm_size = pool.vm_size + + enable_auto_scaling = pool.enable_auto_scaling + + node_count = pool.enable_auto_scaling ? null : pool.node_count + + min_count = pool.min_count + max_count = pool.max_count + + max_pods = pool.max_pod_per_node + mode = pool.mode + + os_disk_type = pool.os_disk_type + node_labels = pool.custom_labels + + orchestrator_version = ( + pool.orchestrator_version != "" ? pool.orchestrator_version : var.aks_orchestrator_version + ) + + vnet_subnet_id = data.azurerm_subnet.aks_subnet.id + create_nodepool_before_destroy = pool.create_before_destroy + + upgrade_settings = pool.upgrade_settings + } } - create_before_destroy = pool.create_before_destroy - max_count = pool.max_count - min_count = pool.min_count - max_pods = pool.max_pod_per_node - os_disk_type = pool.os_disk_type - mode = pool.mode - node_labels = pool.custom_labels - orchestrator_version = pool.orchestrator_version == "" ? var.aks_orchestrator_version : pool.orchestrator_version - upgrade_settings = pool.upgrade_settings } - } -} diff --git a/modules/azure-aks/role_assignment.tf b/modules/azure-aks/role_assignment.tf index 098aaac1d..8d43c0e1a 100644 --- a/modules/azure-aks/role_assignment.tf +++ b/modules/azure-aks/role_assignment.tf @@ -1,7 +1,17 @@ # https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment resource "azurerm_role_assignment" "role_assignment_network_contributor_over_public_ip_aks" { - count = var.create_role_assignment_public_ip && var.net_profile_outbound_type == "loadBalancer" && var.public_ip_name != null ? 1 : 0 - scope = data.azurerm_public_ip.aks_public_ip[0].id - role_definition_name = "Network Contributor" - principal_id = module.aks.cluster_identity.principal_id + count = var.create_role_assignment_public_ip && var.net_profile_outbound_type == "loadBalancer" && var.public_ip_name != null ? 1 : 0 + scope = data.azurerm_public_ip.aks_public_ip[0].id + role_definition_name = "Network Contributor" + principal_id = module.aks.cluster_identity.principal_id +} + +resource "azurerm_role_assignment" "acr_pull" { + for_each = var.acr_map + + scope = each.value + role_definition_name = "AcrPull" + principal_id = module.aks.kubelet_identity.objectId + + skip_service_principal_aad_check = true } From 62bcaf01a53ac879a605b49070e5ae199509cec7 Mon Sep 17 00:00:00 2001 From: JulianGV21 Date: Tue, 4 Aug 2026 18:06:55 +0200 Subject: [PATCH 2/3] Rename variables --- modules/azure-aks/aks.tf | 47 +++++++++++++++++----- modules/azure-aks/node_pool.tf | 60 ++++++++++------------------ modules/azure-aks/role_assignment.tf | 6 +++ modules/azure-aks/variables.tf | 20 ++++------ 4 files changed, 74 insertions(+), 59 deletions(-) diff --git a/modules/azure-aks/aks.tf b/modules/azure-aks/aks.tf index 982b1dd0b..c8226472c 100644 --- a/modules/azure-aks/aks.tf +++ b/modules/azure-aks/aks.tf @@ -4,16 +4,43 @@ module "aks" { source = "github.com/Azure/terraform-azurerm-avm-res-containerservice-managedcluster?ref=v0.7.1" location = var.location + default_agent_pool = local.default_agent_pool - api_server_authorized_ip_ranges = var.api_server_authorized_ip_ranges + + api_server_access_profile = var.api_server_authorized_ip_ranges == null ? null : { + authorized_ip_ranges = var.api_server_authorized_ip_ranges + } + auto_scaler_profile = local.auto_scaler_profile - key_vault_secrets_provider_enabled = var.key_vault_secrets_provider_enabled + + addon_profile_key_vault_secrets_provider = var.key_vault_secrets_provider_enabled ? { + enabled = true + + config = { + enable_secret_rotation = var.secret_rotation_enabled + rotation_poll_interval = var.secret_rotation_interval + } + } : null + kubernetes_version = var.aks_kubernetes_version - network_contributor_role_assigned_subnet_ids = { aks_subnet = data.azurerm_subnet.aks_subnet.id } - node_os_channel_upgrade = var.node_os_channel_upgrade + + auto_upgrade_profile = { + node_os_upgrade_channel = var.auto_upgrade_profile.node_os_channel_upgrade + upgrade_channel = var.auto_upgrade_profile.upgrade_channel + } + agent_pools = local.agent_pools - oidc_issuer_enabled = var.oidc_issuer_enabled - orchestrator_version = var.aks_orchestrator_version + + oidc_issuer_profile = { + enabled = var.oidc_issuer_enabled + } + + security_profile = { + workload_identity = { + enabled = var.workload_identity_enabled + } + } + name = var.aks_prefix aad_profile = { @@ -46,8 +73,10 @@ module "aks" { } parent_id = data.azurerm_resource_group.this.id - sku_tier = var.aks_sku_tier + + sku = { + tier = var.aks_sku_tier + } + tags = local.tags - upgrade_override = var.upgrade_override - workload_identity_enabled = var.workload_identity_enabled } diff --git a/modules/azure-aks/node_pool.tf b/modules/azure-aks/node_pool.tf index 57476eb1b..7ad4b67e1 100644 --- a/modules/azure-aks/node_pool.tf +++ b/modules/azure-aks/node_pool.tf @@ -2,54 +2,38 @@ locals { default_agent_pool = { name = var.aks_agents_pool_name vm_size = var.aks_agents_size - node_count = var.aks_agents_count - enable_auto_scaling = false - max_pods = var.aks_agents_max_pods os_disk_size_gb = var.aks_os_disk_size_gb - node_labels = var.aks_default_pool_custom_labels - - orchestrator_version = var.aks_orchestrator_version - + orchestrator_version = var.aks_kubernetes_version vnet_subnet_id = data.azurerm_subnet.aks_subnet.id - temporary_name_for_rotation = var.temporary_name_for_rotation - upgrade_settings = { drain_timeout_in_minutes = var.aks_agents_pool_drain_timeout_in_minutes max_surge = var.aks_agents_pool_max_surge - } } - - agent_pools = { - for pool in var.extra_node_pools : pool.name => { - name = pool.pool_name - vm_size = pool.vm_size - - enable_auto_scaling = pool.enable_auto_scaling - - node_count = pool.enable_auto_scaling ? null : pool.node_count - - min_count = pool.min_count - max_count = pool.max_count - - max_pods = pool.max_pod_per_node - mode = pool.mode - - os_disk_type = pool.os_disk_type - node_labels = pool.custom_labels - - orchestrator_version = ( - pool.orchestrator_version != "" ? pool.orchestrator_version : var.aks_orchestrator_version - ) - - vnet_subnet_id = data.azurerm_subnet.aks_subnet.id - create_nodepool_before_destroy = pool.create_before_destroy - - upgrade_settings = pool.upgrade_settings - } + } + + agent_pools = { + for pool in var.extra_node_pools : pool.name => { + name = pool.pool_name + vm_size = pool.vm_size + enable_auto_scaling = pool.enable_auto_scaling + node_count = pool.enable_auto_scaling ? null : pool.node_count + min_count = pool.min_count + max_count = pool.max_count + max_pods = pool.max_pod_per_node + mode = pool.mode + os_disk_type = pool.os_disk_type + node_labels = pool.custom_labels + orchestrator_version = ( + pool.orchestrator_version != "" ? pool.orchestrator_version : var.aks_orchestrator_version + ) + vnet_subnet_id = data.azurerm_subnet.aks_subnet.id + create_nodepool_before_destroy = pool.create_before_destroy + upgrade_settings = pool.upgrade_settings } } + } diff --git a/modules/azure-aks/role_assignment.tf b/modules/azure-aks/role_assignment.tf index 8d43c0e1a..b236ff666 100644 --- a/modules/azure-aks/role_assignment.tf +++ b/modules/azure-aks/role_assignment.tf @@ -6,6 +6,12 @@ resource "azurerm_role_assignment" "role_assignment_network_contributor_over_pub principal_id = module.aks.cluster_identity.principal_id } +resource "azurerm_role_assignment" "role_assignment_network_contributor_over_subnet_aks" { + scope = data.azurerm_subnet.aks_subnet.id + role_definition_name = "Network Contributor" + principal_id = module.aks.cluster_identity.principal_id +} + resource "azurerm_role_assignment" "acr_pull" { for_each = var.acr_map diff --git a/modules/azure-aks/variables.tf b/modules/azure-aks/variables.tf index efb4c1f59..8eca4d243 100644 --- a/modules/azure-aks/variables.tf +++ b/modules/azure-aks/variables.tf @@ -122,13 +122,18 @@ variable "load_balancer_sku" { default = "standard" } -variable "node_os_channel_upgrade" { - description = "The automatic node channel upgrade setting for the AKS cluster" - default = "None" +variable "auto_upgrade_profile" { + description = "Auto upgrade profile for a managed cluster" + type = object({ + node_os_upgrade_channel = optional(string, "NodeImage") + upgrade_channel = optional(string, "none") + }) + default = null } variable "oidc_issuer_enabled" { description = "Whether to enable OIDC Issuer for the AKS cluster" + type = bool } variable "secret_rotation_enabled" { @@ -295,12 +300,3 @@ variable "create_role_assignment_public_ip" { type = bool default = false } - -# AKS version upgrade_override -variable "upgrade_override" { - type = object({ - force_upgrade_enabled = bool - effective_until = optional(string) - }) - default = null -} From 729c5ec9bdd3283daaeafa9655a913a7ea3cb469 Mon Sep 17 00:00:00 2001 From: JulianGV21 Date: Tue, 4 Aug 2026 18:11:50 +0200 Subject: [PATCH 3/3] remove duplicated value --- modules/azure-aks/aks.tf | 4 ---- 1 file changed, 4 deletions(-) diff --git a/modules/azure-aks/aks.tf b/modules/azure-aks/aks.tf index c8226472c..8cbb63759 100644 --- a/modules/azure-aks/aks.tf +++ b/modules/azure-aks/aks.tf @@ -67,10 +67,6 @@ module "aks" { } : null } - key_vault_secrets_provider = { - secret_rotation_enabled = var.secret_rotation_enabled - secret_rotation_interval = var.secret_rotation_interval - } parent_id = data.azurerm_resource_group.this.id