Skip to content

Commit 5e25566

Browse files
committed
Make the Azure Key Vault public because private Key Vault requires preview API
Running Microsoft Terraform module AKS end to end tests I get this new error message I have never seen before from the ARM API: https://github.com/Azure/terraform-azurerm-aks/actions/runs/11665268834/job/32477571013?pr=598#step:3:6605 HTTP 400 "Vnet integration should be enabled when KeyVault network access is Private." I believe this is the root cause: https://learn.microsoft.com/en-us/azure/aks/use-kms-etcd-encryption#prerequisites ( See yellow warning box) However Vnet Integration is still preview as far as I know. Terraform provider azurerm V4 will not support preview features. https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/guides/4.0-upgrade-guide#aks-migration-to-stable-api
1 parent 495d0ab commit 5e25566

File tree

2 files changed

+2
-2
lines changed

2 files changed

+2
-2
lines changed

examples/named_cluster/key_vault.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ resource "azurerm_key_vault" "des_vault" {
2929

3030
network_acls {
3131
bypass = "AzureServices"
32-
default_action = "Deny"
32+
default_action = "Allow"
3333
ip_rules = [local.public_ip]
3434
}
3535
}

examples/named_cluster/main.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -97,7 +97,7 @@ module "aks_cluster_name" {
9797
# KMS etcd encryption
9898
kms_enabled = true
9999
kms_key_vault_key_id = azurerm_key_vault_key.kms.id
100-
kms_key_vault_network_access = "Private"
100+
kms_key_vault_network_access = "Public"
101101

102102
depends_on = [
103103
azurerm_key_vault_access_policy.kms,

0 commit comments

Comments
 (0)