Migrate AKS module first steps

modules/azure-aks/aks.tf

@@ -1,62 +1,78 @@
 # AKS section
 module "aks" {
-  # https://registry.terraform.io/modules/Azure/aks/azurerm/latest
-  source = "github.com/Azure/terraform-azurerm-aks?ref=11.1.0"
+  # https://registry.terraform.io/modules/Azure/avm-res-containerservice-managedcluster/azurerm/latest
+  source = "github.com/Azure/terraform-azurerm-avm-res-containerservice-managedcluster?ref=v0.7.1"
 
   location                                             = var.location
-  agents_count                                         = var.aks_agents_count
-  agents_labels                                        = var.aks_default_pool_custom_labels
-  agents_max_pods                                      = var.aks_agents_max_pods
-  agents_pool_drain_timeout_in_minutes                 = var.aks_agents_pool_drain_timeout_in_minutes
-  agents_pool_max_surge                                = var.aks_agents_pool_max_surge
-  agents_pool_name                                     = var.aks_agents_pool_name
-  agents_size                                          = var.aks_agents_size
-  api_server_authorized_ip_ranges                      = var.api_server_authorized_ip_ranges
-  attached_acr_id_map                                  = var.acr_map
-  auto_scaler_profile_enabled                          = var.auto_scaler_profile_enabled
-  auto_scaler_profile_expander                         = var.auto_scaler_profile_expander
-  auto_scaler_profile_max_graceful_termination_sec     = var.auto_scaler_profile_max_graceful_termination_sec
-  auto_scaler_profile_max_node_provisioning_time       = var.auto_scaler_profile_max_node_provisioning_time
-  auto_scaler_profile_max_unready_nodes                = var.auto_scaler_profile_max_unready_nodes
-  auto_scaler_profile_max_unready_percentage           = var.auto_scaler_profile_max_unready_percentage
-  auto_scaler_profile_new_pod_scale_up_delay           = var.auto_scaler_profile_new_pod_scale_up_delay
-  auto_scaler_profile_scale_down_delay_after_add       = var.auto_scaler_profile_scale_down_delay_after_add
-  auto_scaler_profile_scale_down_delay_after_delete    = var.auto_scaler_profile_scale_down_delay_after_delete
-  auto_scaler_profile_scale_down_delay_after_failure   = var.auto_scaler_profile_scale_down_delay_after_failure
-  auto_scaler_profile_scale_down_unneeded              = var.auto_scaler_profile_scale_down_unneeded
-  auto_scaler_profile_scale_down_unready               = var.auto_scaler_profile_scale_down_unready
-  auto_scaler_profile_scale_down_utilization_threshold = var.auto_scaler_profile_scale_down_utilization_threshold
-  auto_scaler_profile_scan_interval                    = var.auto_scaler_profile_scan_interval
-  auto_scaler_profile_skip_nodes_with_local_storage    = var.auto_scaler_profile_skip_nodes_with_local_storage
-  auto_scaler_profile_skip_nodes_with_system_pods      = var.auto_scaler_profile_skip_nodes_with_system_pods
-  key_vault_secrets_provider_enabled                   = var.key_vault_secrets_provider_enabled
+
+  default_agent_pool                                   = local.default_agent_pool
+
+  api_server_access_profile = var.api_server_authorized_ip_ranges == null ? null : {
+  authorized_ip_ranges = var.api_server_authorized_ip_ranges
+  }
+
+  auto_scaler_profile                                  = local.auto_scaler_profile
+
+  addon_profile_key_vault_secrets_provider = var.key_vault_secrets_provider_enabled ? {
+    enabled = true
+
+    config = {
+      enable_secret_rotation = var.secret_rotation_enabled
+      rotation_poll_interval = var.secret_rotation_interval
+    }
+  } : null
+
   kubernetes_version                                   = var.aks_kubernetes_version
-  load_balancer_profile_enabled                        = var.net_profile_outbound_type == "loadBalancer" ? var.load_balancer_profile_enabled : false
-  load_balancer_profile_outbound_ip_address_ids        = var.net_profile_outbound_type == "loadBalancer" && length(data.azurerm_public_ip.aks_public_ip) > 0 ? [data.azurerm_public_ip.aks_public_ip[0].id] : null
-  load_balancer_sku                                    = var.load_balancer_sku
-  log_analytics_workspace_enabled                      = false
-  network_contributor_role_assigned_subnet_ids         = { aks_subnet = data.azurerm_subnet.aks_subnet.id }
-  network_plugin                                       = var.aks_network_plugin
-  network_policy                                       = var.aks_network_policy
-  node_os_channel_upgrade                              = var.node_os_channel_upgrade
-  node_pools                                           = local.extra_pools
-  oidc_issuer_enabled                                  = var.oidc_issuer_enabled
-  orchestrator_version                                 = var.aks_orchestrator_version
-  os_disk_size_gb                                      = var.aks_os_disk_size_gb
-  prefix                                               = var.aks_prefix
-  rbac_aad_azure_rbac_enabled                          = true
-  rbac_aad_tenant_id                                   = data.azurerm_client_config.current.tenant_id
-  resource_group_name                                  = var.resource_group_name
-  role_based_access_control_enabled                    = true
-  secret_rotation_enabled                              = var.secret_rotation_enabled
-  secret_rotation_interval                             = var.secret_rotation_interval
-  sku_tier                                             = var.aks_sku_tier
-  tags                                                 = local.tags
-  temporary_name_for_rotation                          = var.temporary_name_for_rotation
-  vnet_subnet = {
-    id = data.azurerm_subnet.aks_subnet.id
+
+  auto_upgrade_profile = {
+    node_os_upgrade_channel = var.auto_upgrade_profile.node_os_channel_upgrade
+    upgrade_channel         = var.auto_upgrade_profile.upgrade_channel
+  }
+
+  agent_pools                                          = local.agent_pools
+
+  oidc_issuer_profile = {
+    enabled = var.oidc_issuer_enabled
+  }
+
+  security_profile = {
+    workload_identity = {
+      enabled = var.workload_identity_enabled
+    }
   }
-  upgrade_override                                     = var.upgrade_override
-  workload_identity_enabled                            = var.workload_identity_enabled
-  net_profile_outbound_type                            = var.net_profile_outbound_type
+
+  name                                                 = var.aks_prefix
+
+  aad_profile = {
+    managed           = true
+    enable_azure_rbac = true
+    tenant_id         = data.azurerm_client_config.current.tenant_id
+  }
+
+  network_profile = {
+    network_plugin   = var.aks_network_plugin
+    network_policy   = var.aks_network_policy
+
+    load_balancer_sku = var.load_balancer_sku
+
+    outbound_type = var.net_profile_outbound_type
+
+    load_balancer_profile = (
+      var.net_profile_outbound_type == "loadBalancer" &&
+      var.load_balancer_profile_enabled
+    ) ? {
+      outbound_ip_address_ids = length(data.azurerm_public_ip.aks_public_ip) > 0 ? [
+        data.azurerm_public_ip.aks_public_ip[0].id
+      ] : null
+    } : null
+  }
+
+
+  parent_id                                            = data.azurerm_resource_group.this.id
+
+  sku = {
+    tier = var.aks_sku_tier
+  }
+
+  tags                                                 = local.tags
 }

modules/azure-aks/auto_scaler_profile.tf

@@ -0,0 +1,19 @@
+locals {
+  auto_scaler_profile = var.auto_scaler_profile_enabled ? {
+    expander                         = var.auto_scaler_profile_expander
+    max_graceful_termination_sec     = var.auto_scaler_profile_max_graceful_termination_sec
+    max_node_provisioning_time       = var.auto_scaler_profile_max_node_provisioning_time
+    max_unready_nodes                = var.auto_scaler_profile_max_unready_nodes
+    max_unready_percentage           = var.auto_scaler_profile_max_unready_percentage
+    new_pod_scale_up_delay           = var.auto_scaler_profile_new_pod_scale_up_delay
+    scale_down_delay_after_add       = var.auto_scaler_profile_scale_down_delay_after_add
+    scale_down_delay_after_delete    = var.auto_scaler_profile_scale_down_delay_after_delete
+    scale_down_delay_after_failure   = var.auto_scaler_profile_scale_down_delay_after_failure
+    scale_down_unneeded              = var.auto_scaler_profile_scale_down_unneeded
+    scale_down_unready               = var.auto_scaler_profile_scale_down_unready
+    scale_down_utilization_threshold = var.auto_scaler_profile_scale_down_utilization_threshold
+    scan_interval                    = var.auto_scaler_profile_scan_interval
+    skip_nodes_with_local_storage    = var.auto_scaler_profile_skip_nodes_with_local_storage
+    skip_nodes_with_system_pods      = var.auto_scaler_profile_skip_nodes_with_system_pods
+  } : null
+}

modules/azure-aks/main.tf

@@ -3,10 +3,10 @@ terraform {
 
   required_providers {
     azapi = {
-      source  = "Azure/azapi"
+      source = "Azure/azapi"
     }
     azurerm = {
-      source  = "hashicorp/azurerm"
+      source = "hashicorp/azurerm"
     }
   }
 }

modules/azure-aks/node_pool.tf

@@ -1,24 +1,39 @@
 locals {
-  extra_pools = {
-    for pool in var.extra_node_pools :
-    pool.name => {
-      name                  = pool.pool_name
-      vm_size               = pool.vm_size
-      auto_scaling_enabled = pool.enable_auto_scaling
+  default_agent_pool = {
+    name = var.aks_agents_pool_name
+    vm_size = var.aks_agents_size
+    node_count = var.aks_agents_count
+    enable_auto_scaling = false
+    max_pods = var.aks_agents_max_pods
+    os_disk_size_gb = var.aks_os_disk_size_gb
+    node_labels = var.aks_default_pool_custom_labels
+    orchestrator_version = var.aks_kubernetes_version
+    vnet_subnet_id = data.azurerm_subnet.aks_subnet.id
+    temporary_name_for_rotation = var.temporary_name_for_rotation
+    upgrade_settings = {
+      drain_timeout_in_minutes = var.aks_agents_pool_drain_timeout_in_minutes
+      max_surge = var.aks_agents_pool_max_surge
+    }
+  }
 
+  agent_pools = {
+    for pool in var.extra_node_pools : pool.name => {
+      name = pool.pool_name
+      vm_size = pool.vm_size
+      enable_auto_scaling = pool.enable_auto_scaling
       node_count = pool.enable_auto_scaling ? null : pool.node_count
-      vnet_subnet = {
-        id = data.azurerm_subnet.aks_subnet.id
+      min_count = pool.min_count
+      max_count = pool.max_count
+      max_pods = pool.max_pod_per_node
+      mode = pool.mode
+      os_disk_type = pool.os_disk_type
+      node_labels = pool.custom_labels
+      orchestrator_version = (
+        pool.orchestrator_version != "" ? pool.orchestrator_version : var.aks_orchestrator_version
+      )
+      vnet_subnet_id = data.azurerm_subnet.aks_subnet.id
+      create_nodepool_before_destroy = pool.create_before_destroy
+      upgrade_settings = pool.upgrade_settings
       }
-      create_before_destroy = pool.create_before_destroy
-      max_count             = pool.max_count
-      min_count             = pool.min_count
-      max_pods              = pool.max_pod_per_node
-      os_disk_type          = pool.os_disk_type
-      mode                  = pool.mode
-      node_labels           = pool.custom_labels
-      orchestrator_version  = pool.orchestrator_version == "" ? var.aks_orchestrator_version : pool.orchestrator_version
-      upgrade_settings      = pool.upgrade_settings
     }
   }
-}

modules/azure-aks/role_assignment.tf

@@ -1,7 +1,23 @@
 # https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment
 resource "azurerm_role_assignment" "role_assignment_network_contributor_over_public_ip_aks" {
-    count                = var.create_role_assignment_public_ip && var.net_profile_outbound_type == "loadBalancer" && var.public_ip_name != null ? 1 : 0
-    scope                = data.azurerm_public_ip.aks_public_ip[0].id
-    role_definition_name = "Network Contributor"
-    principal_id         = module.aks.cluster_identity.principal_id
+  count                = var.create_role_assignment_public_ip && var.net_profile_outbound_type == "loadBalancer" && var.public_ip_name != null ? 1 : 0
+  scope                = data.azurerm_public_ip.aks_public_ip[0].id
+  role_definition_name = "Network Contributor"
+  principal_id         = module.aks.cluster_identity.principal_id
+}
+
+resource "azurerm_role_assignment" "role_assignment_network_contributor_over_subnet_aks" {
+  scope                = data.azurerm_subnet.aks_subnet.id
+  role_definition_name = "Network Contributor"
+  principal_id         = module.aks.cluster_identity.principal_id
+}
+
+resource "azurerm_role_assignment" "acr_pull" {
+  for_each = var.acr_map
+
+  scope                = each.value
+  role_definition_name = "AcrPull"
+  principal_id         = module.aks.kubelet_identity.objectId
+
+  skip_service_principal_aad_check = true
 }

modules/azure-aks/variables.tf

@@ -122,13 +122,18 @@ variable "load_balancer_sku" {
   default     = "standard"
 }
 
-variable "node_os_channel_upgrade" {
-  description = "The automatic node channel upgrade setting for the AKS cluster"
-  default     = "None"
+variable "auto_upgrade_profile" {
+  description  = "Auto upgrade profile for a managed cluster"
+  type = object({
+    node_os_upgrade_channel = optional(string, "NodeImage")
+    upgrade_channel         = optional(string, "none")
+  })
+  default     = null
 }
 
 variable "oidc_issuer_enabled" {
   description = "Whether to enable OIDC Issuer for the AKS cluster"
+  type        = bool
 }
 
 variable "secret_rotation_enabled" {
@@ -295,12 +300,3 @@ variable "create_role_assignment_public_ip" {
   type        = bool
   default     = false
 }
-
-# AKS version upgrade_override
-variable "upgrade_override" {
-  type = object({
-    force_upgrade_enabled = bool
-    effective_until       = optional(string)
-  })
-  default = null
-}