terraform-azurerm-aks

LocalDNS in AKS allows you to customize DNS resolution behavior for pods based on their dnsPolicy. The module supports two primary types of overrides:

1. VNet DNS Overrides: Targets pods using dnsPolicy: default. These pods use VNet DNS.
2. Kube DNS Overrides: Targets pods using dnsPolicy: ClusterFirst. These pods use Kubernetes CoreDNS.

You can enforce LocalDNS usage by setting the mode to Required.

In v7.x, the module manages kubernetes_version upgrades using null_resource.kubernetes_version_keeper and azapi_update_resource.aks_cluster_post_create.

Key behaviors:

• The azurerm_kubernetes_cluster.main resource will now ignore kubernetes_version changes made by Azure (e.g., automatic patch upgrades) to prevent unnecessary Terraform churn.
• To trigger a manual version upgrade, change the value of var.kubernetes_version. This will trigger a re-creation of the keeper and update resources.
• Requirement: You must have the azapi provider configured in your Terraform environment.

To prevent downtime during node pool upgrades, azurerm_kubernetes_cluster_node_pool.node_pool now uses create_before_destroy = true.

Important Implications:

• Name Suffix: A 4-character random suffix is appended to the node pool name (e.g., nodepool1 becomes nodepool1xxxx). This suffix is deterministic based on the pool's configuration.
• Naming Strategy: You may need to shorten your existing node pool names to accommodate this suffix.
• Tracking: The module uses null_resource.pool_name_keeper to track names in case they are changed.

Due to a change in how for_each is implemented (moving from a set of strings to a map of objects), the azurerm_role_assignment.network_contributor resource will be re-created.

Warning: This will cause the role assignment to be removed and re-added, which may result in a brief period where the role assignment is missing.

Usage Requirements

If var.create_role_assignment_network_contributor is set to true:

• You must set a different subnet for every node pool (including the default pool).

If you cannot provide different subnets for each node pool:

• You must set var.create_role_assignment_network_contributor to false and manage the role assignments manually.

To run tests or pre-commit checks using the provided Docker image, you must set up your Azure Service Principal credentials in your environment variables.

Linux/macOS:

export ARM_SUBSCRIPTION_ID="<azure_subscription_id>"
export ARM_TENANT_ID="<azure_subscription_tenant_id>"
export ARM_CLIENT_ID="<service_principal_appid>"
export ARM_CLIENT_SECRET="<service_principal_password>"

Windows PowerShell:

$env:ARM_SUBSCRIPTION_ID="<azure_subscription_id>"
$env:ARM_TENANT_ID="<azure_subscription_tenant_id>"
$env:ARM_CLIENT_ID="<service_principal_appid>"
$env:ARM_CLIENT_SECRET="<service_principal_password>"

To deploy the LocalDNS configuration example, follow these steps:

1. Set Azure credentials in your environment:

   export ARM_CLIENT_ID="your-client-id"
   export ARM_CLIENT_SECRET="your-client-secret"
   export ARM_SUBSCRIPTION_ID="your-subscription-id"
   export ARM_TENANT_ID="your-tenant-id"

2. Initialize and apply Terraform:

   terraform init
   terraform plan
   terraform apply

3. Connect to the AKS cluster using the outputs from the Terraform deployment:

   az aks get-credentials --resource-group $(terraform output -raw resource_group_name) --name $(terraform output -raw aks_cluster_name)