Description

This PR fixes issue #683 where the cluster_identity output was incorrectly marked as sensitive, forcing users to mark their own outputs as sensitive unnecessarily.

Changes Made

• main.tf: Updated the identity dynamic block to use nonsensitive(var.client_secret) in the for_each expression to prevent sensitivity propagation
• outputs.tf: Removed sensitive = true flag from the cluster_identity output
• NoticeOnUpgradeTov11.0.md: Added documentation for this breaking change

Root Cause

The issue occurred because the identity block's for_each expression referenced var.client_secret, which is marked as sensitive. This caused Terraform to treat the entire identity block as sensitive, even though the identity information (principal_id, tenant_id, type) is not actually sensitive data.

Impact

• Breaking Change: Users who previously had to mark their outputs as sensitive when using module.aks.cluster_identity can now remove the sensitive = true flag
• Improved UX: Users no longer need to unnecessarily mark outputs as sensitive
• Terraform Best Practices: Aligns with proper handling of sensitivity in Terraform

Testing

• ✅ Pre-commit checks passed
• ✅ Terraform validation passed
• ✅ Linting checks passed

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• Breaking change (fix that would cause existing functionality to not work as expected)

Fixes #683

This PR was composed by GitHub Copilot agent as part of automated issue resolution.