Skip to content

Commit 1bfd4af

Browse files
nddqnddq
committed
azurerm_kubernetes_cluster - add advanced_network_policies property to advanced_networking block
This change adds support for the `advanced_network_policies` property within the `network_profile.advanced_networking` block for Azure Kubernetes Service clusters. Changes: - Add `advanced_network_policies` field with valid values: `FQDN`, `L7`, `None` - Add validation to ensure `advanced_network_policies` can only be set to `FQDN` or `L7` when `security_enabled` is `true` - Upgrade managedclusters SDK from 2025-07-01 to 2025-10-01 API version to support the new field - Add tests for the new property and validation - Update documentation Signed-off-by: Quang Nguyen <nguyenquang@microsoft.com>
1 parent ad80225 commit 1bfd4af

168 files changed

Lines changed: 689 additions & 48 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎internal/services/containers/client/client.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ import (
1616
"github.com/hashicorp/go-azure-sdk/resource-manager/containerservice/2024-04-01/updateruns"
1717
"github.com/hashicorp/go-azure-sdk/resource-manager/containerservice/2025-07-01/agentpools"
1818
"github.com/hashicorp/go-azure-sdk/resource-manager/containerservice/2025-07-01/maintenanceconfigurations"
19-
"github.com/hashicorp/go-azure-sdk/resource-manager/containerservice/2025-07-01/managedclusters"
19+
"github.com/hashicorp/go-azure-sdk/resource-manager/containerservice/2025-10-01/managedclusters"
2020
"github.com/hashicorp/go-azure-sdk/resource-manager/containerservice/2025-07-01/snapshots"
2121
"github.com/hashicorp/go-azure-sdk/resource-manager/containerservice/2025-07-01/trustedaccess"
2222
"github.com/hashicorp/go-azure-sdk/resource-manager/kubernetesconfiguration/2024-11-01/extensions"

‎internal/services/containers/kubernetes_addons.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ import (
99

1010
"github.com/hashicorp/go-azure-helpers/lang/pointer"
1111
"github.com/hashicorp/go-azure-helpers/resourcemanager/commonids"
12-
"github.com/hashicorp/go-azure-sdk/resource-manager/containerservice/2025-07-01/managedclusters"
12+
"github.com/hashicorp/go-azure-sdk/resource-manager/containerservice/2025-10-01/managedclusters"
1313
"github.com/hashicorp/go-azure-sdk/resource-manager/network/2023-11-01/applicationgateways"
1414
"github.com/hashicorp/go-azure-sdk/resource-manager/operationalinsights/2020-08-01/workspaces"
1515
"github.com/hashicorp/go-azure-sdk/sdk/environments"

‎internal/services/containers/kubernetes_cluster_data_source.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ import (
1717
"github.com/hashicorp/go-azure-helpers/resourcemanager/location"
1818
"github.com/hashicorp/go-azure-helpers/resourcemanager/tags"
1919
"github.com/hashicorp/go-azure-helpers/resourcemanager/zones"
20-
"github.com/hashicorp/go-azure-sdk/resource-manager/containerservice/2025-07-01/managedclusters"
20+
"github.com/hashicorp/go-azure-sdk/resource-manager/containerservice/2025-10-01/managedclusters"
2121
"github.com/hashicorp/go-azure-sdk/resource-manager/operationalinsights/2020-08-01/workspaces"
2222
"github.com/hashicorp/terraform-provider-azurerm/internal/clients"
2323
"github.com/hashicorp/terraform-provider-azurerm/internal/services/containers/kubernetes"

‎internal/services/containers/kubernetes_cluster_network_resource_test.go‎

Lines changed: 184 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,56 @@ func TestAccKubernetesCluster_advancedNetworkingNetworkDataplane(t *testing.T) {
101101
})
102102
}
103103

104+
func TestAccKubernetesCluster_advancedNetworkingPolicies(t *testing.T) {
105+
data := acceptance.BuildTestData(t, "azurerm_kubernetes_cluster", "test")
106+
r := KubernetesClusterResource{}
107+
108+
data.ResourceTest(t, r, []acceptance.TestStep{
109+
{
110+
Config: r.advancedNetworkingWithPolicies(data, "FQDN"),
111+
Check: acceptance.ComposeTestCheckFunc(
112+
check.That(data.ResourceName).ExistsInAzure(r),
113+
check.That(data.ResourceName).Key("network_profile.0.advanced_networking.0.security_enabled").HasValue("true"),
114+
check.That(data.ResourceName).Key("network_profile.0.advanced_networking.0.advanced_network_policies").HasValue("FQDN"),
115+
),
116+
},
117+
data.ImportStep(),
118+
{
119+
Config: r.advancedNetworkingWithPolicies(data, "L7"),
120+
Check: acceptance.ComposeTestCheckFunc(
121+
check.That(data.ResourceName).ExistsInAzure(r),
122+
check.That(data.ResourceName).Key("network_profile.0.advanced_networking.0.security_enabled").HasValue("true"),
123+
check.That(data.ResourceName).Key("network_profile.0.advanced_networking.0.advanced_network_policies").HasValue("L7"),
124+
),
125+
},
126+
data.ImportStep(),
127+
})
128+
}
129+
130+
func TestAccKubernetesCluster_advancedNetworkingPoliciesFQDNRequiresSecurity(t *testing.T) {
131+
data := acceptance.BuildTestData(t, "azurerm_kubernetes_cluster", "test")
132+
r := KubernetesClusterResource{}
133+
134+
data.ResourceTest(t, r, []acceptance.TestStep{
135+
{
136+
Config: r.advancedNetworkingWithPoliciesSecurityDisabled(data, "FQDN"),
137+
ExpectError: regexp.MustCompile("`network_profile.0.advanced_networking.0.advanced_network_policies` can only be set to `FQDN` or `L7` when `network_profile.0.advanced_networking.0.security_enabled` is set to `true`"),
138+
},
139+
})
140+
}
141+
142+
func TestAccKubernetesCluster_advancedNetworkingPoliciesL7RequiresSecurity(t *testing.T) {
143+
data := acceptance.BuildTestData(t, "azurerm_kubernetes_cluster", "test")
144+
r := KubernetesClusterResource{}
145+
146+
data.ResourceTest(t, r, []acceptance.TestStep{
147+
{
148+
Config: r.advancedNetworkingWithPoliciesSecurityDisabled(data, "L7"),
149+
ExpectError: regexp.MustCompile("`network_profile.0.advanced_networking.0.advanced_network_policies` can only be set to `FQDN` or `L7` when `network_profile.0.advanced_networking.0.security_enabled` is set to `true`"),
150+
},
151+
})
152+
}
153+
104154
func TestAccKubernetesCluster_serviceMeshProfile(t *testing.T) {
105155
data := acceptance.BuildTestData(t, "azurerm_kubernetes_cluster", "test")
106156
r := KubernetesClusterResource{}
@@ -1395,6 +1445,140 @@ resource "azurerm_kubernetes_cluster" "test" {
13951445
`, data.RandomInteger, data.Locations.Primary, data.RandomInteger, data.RandomInteger, data.RandomInteger, data.RandomInteger, data.RandomInteger, networkPlugin)
13961446
}
13971447

1448+
func (KubernetesClusterResource) advancedNetworkingWithPolicies(data acceptance.TestData, advancedNetworkPolicies string) string {
1449+
return fmt.Sprintf(`
1450+
provider "azurerm" {
1451+
features {}
1452+
}
1453+
1454+
resource "azurerm_resource_group" "test" {
1455+
name = "acctestRG-aks-%d"
1456+
location = "%s"
1457+
}
1458+
1459+
resource "azurerm_virtual_network" "test" {
1460+
name = "acctestvirtnet%d"
1461+
address_space = ["10.0.0.0/8"]
1462+
location = azurerm_resource_group.test.location
1463+
resource_group_name = azurerm_resource_group.test.name
1464+
}
1465+
1466+
resource "azurerm_subnet" "test" {
1467+
name = "acctestsubnet%d"
1468+
resource_group_name = azurerm_resource_group.test.name
1469+
virtual_network_name = azurerm_virtual_network.test.name
1470+
address_prefixes = ["10.1.0.0/16"]
1471+
}
1472+
1473+
resource "azurerm_kubernetes_cluster" "test" {
1474+
name = "acctestaks%d"
1475+
location = azurerm_resource_group.test.location
1476+
resource_group_name = azurerm_resource_group.test.name
1477+
dns_prefix = "acctestaks%d"
1478+
1479+
linux_profile {
1480+
admin_username = "acctestuser%d"
1481+
1482+
ssh_key {
1483+
key_data = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqaZoyiz1qbdOQ8xEf6uEu1cCwYowo5FHtsBhqLoDnnp7KUTEBN+L2NxRIfQ781rxV6Iq5jSav6b2Q8z5KiseOlvKA/RF2wqU0UPYqQviQhLmW6THTpmrv/YkUCuzxDpsH7DUDhZcwySLKVVe0Qm3+5N2Ta6UYH3lsDf9R9wTP2K/+vAnflKebuypNlmocIvakFWoZda18FOmsOoIVXQ8HWFNCuw9ZCunMSN62QGamCe3dL5cXlkgHYv7ekJE15IA9aOJcM7e90oeTqo+7HTcWfdu0qQqPWY5ujyMw/llas8tsXY85LFqRnr3gJ02bAscjc477+X+j/gkpFoN1QEmt terraform@demo.tld"
1484+
}
1485+
}
1486+
1487+
default_node_pool {
1488+
name = "default"
1489+
node_count = 2
1490+
vm_size = "Standard_DS2_v2"
1491+
vnet_subnet_id = azurerm_subnet.test.id
1492+
upgrade_settings {
1493+
max_surge = "10%%"
1494+
}
1495+
}
1496+
1497+
identity {
1498+
type = "SystemAssigned"
1499+
}
1500+
1501+
network_profile {
1502+
network_plugin = "azure"
1503+
network_data_plane = "cilium"
1504+
1505+
advanced_networking {
1506+
observability_enabled = true
1507+
security_enabled = true
1508+
advanced_network_policies = "%s"
1509+
}
1510+
}
1511+
}
1512+
`, data.RandomInteger, data.Locations.Primary, data.RandomInteger, data.RandomInteger, data.RandomInteger, data.RandomInteger, data.RandomInteger, advancedNetworkPolicies)
1513+
}
1514+
1515+
func (KubernetesClusterResource) advancedNetworkingWithPoliciesSecurityDisabled(data acceptance.TestData, advancedNetworkPolicies string) string {
1516+
return fmt.Sprintf(`
1517+
provider "azurerm" {
1518+
features {}
1519+
}
1520+
1521+
resource "azurerm_resource_group" "test" {
1522+
name = "acctestRG-aks-%d"
1523+
location = "%s"
1524+
}
1525+
1526+
resource "azurerm_virtual_network" "test" {
1527+
name = "acctestvirtnet%d"
1528+
address_space = ["10.0.0.0/8"]
1529+
location = azurerm_resource_group.test.location
1530+
resource_group_name = azurerm_resource_group.test.name
1531+
}
1532+
1533+
resource "azurerm_subnet" "test" {
1534+
name = "acctestsubnet%d"
1535+
resource_group_name = azurerm_resource_group.test.name
1536+
virtual_network_name = azurerm_virtual_network.test.name
1537+
address_prefixes = ["10.1.0.0/16"]
1538+
}
1539+
1540+
resource "azurerm_kubernetes_cluster" "test" {
1541+
name = "acctestaks%d"
1542+
location = azurerm_resource_group.test.location
1543+
resource_group_name = azurerm_resource_group.test.name
1544+
dns_prefix = "acctestaks%d"
1545+
1546+
linux_profile {
1547+
admin_username = "acctestuser%d"
1548+
1549+
ssh_key {
1550+
key_data = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqaZoyiz1qbdOQ8xEf6uEu1cCwYowo5FHtsBhqLoDnnp7KUTEBN+L2NxRIfQ781rxV6Iq5jSav6b2Q8z5KiseOlvKA/RF2wqU0UPYqQviQhLmW6THTpmrv/YkUCuzxDpsH7DUDhZcwySLKVVe0Qm3+5N2Ta6UYH3lsDf9R9wTP2K/+vAnflKebuypNlmocIvakFWoZda18FOmsOoIVXQ8HWFNCuw9ZCunMSN62QGamCe3dL5cXlkgHYv7ekJE15IA9aOJcM7e90oeTqo+7HTcWfdu0qQqPWY5ujyMw/llas8tsXY85LFqRnr3gJ02bAscjc477+X+j/gkpFoN1QEmt terraform@demo.tld"
1551+
}
1552+
}
1553+
1554+
default_node_pool {
1555+
name = "default"
1556+
node_count = 2
1557+
vm_size = "Standard_DS2_v2"
1558+
vnet_subnet_id = azurerm_subnet.test.id
1559+
upgrade_settings {
1560+
max_surge = "10%%"
1561+
}
1562+
}
1563+
1564+
identity {
1565+
type = "SystemAssigned"
1566+
}
1567+
1568+
network_profile {
1569+
network_plugin = "azure"
1570+
network_data_plane = "cilium"
1571+
1572+
advanced_networking {
1573+
observability_enabled = true
1574+
security_enabled = false
1575+
advanced_network_policies = "%s"
1576+
}
1577+
}
1578+
}
1579+
`, data.RandomInteger, data.Locations.Primary, data.RandomInteger, data.RandomInteger, data.RandomInteger, data.RandomInteger, data.RandomInteger, advancedNetworkPolicies)
1580+
}
1581+
13981582
func (KubernetesClusterResource) serviceMeshProfile(data acceptance.TestData, internalIngressEnabled bool, externalIngressEnabled bool) string {
13991583
return fmt.Sprintf(`
14001584
provider "azurerm" {

‎internal/services/containers/kubernetes_cluster_node_pool_resource.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ import (
2121
"github.com/hashicorp/go-azure-sdk/resource-manager/compute/2022-03-01/capacityreservationgroups"
2222
"github.com/hashicorp/go-azure-sdk/resource-manager/compute/2022-03-01/proximityplacementgroups"
2323
"github.com/hashicorp/go-azure-sdk/resource-manager/containerservice/2025-07-01/agentpools"
24-
"github.com/hashicorp/go-azure-sdk/resource-manager/containerservice/2025-07-01/managedclusters"
24+
"github.com/hashicorp/go-azure-sdk/resource-manager/containerservice/2025-10-01/managedclusters"
2525
"github.com/hashicorp/go-azure-sdk/resource-manager/containerservice/2025-07-01/snapshots"
2626
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
2727
"github.com/hashicorp/terraform-provider-azurerm/helpers/tf"

‎internal/services/containers/kubernetes_cluster_resource.go‎

Lines changed: 32 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ import (
2323
"github.com/hashicorp/go-azure-sdk/resource-manager/containerregistry/2025-04-01/registries"
2424
"github.com/hashicorp/go-azure-sdk/resource-manager/containerservice/2025-07-01/agentpools"
2525
"github.com/hashicorp/go-azure-sdk/resource-manager/containerservice/2025-07-01/maintenanceconfigurations"
26-
"github.com/hashicorp/go-azure-sdk/resource-manager/containerservice/2025-07-01/managedclusters"
26+
"github.com/hashicorp/go-azure-sdk/resource-manager/containerservice/2025-10-01/managedclusters"
2727
dnsValidate "github.com/hashicorp/go-azure-sdk/resource-manager/dns/2018-05-01/zones"
2828
"github.com/hashicorp/go-azure-sdk/resource-manager/operationalinsights/2020-08-01/workspaces"
2929
"github.com/hashicorp/go-azure-sdk/resource-manager/privatedns/2024-06-01/privatezones"
@@ -152,6 +152,11 @@ func resourceKubernetesCluster() *pluginsdk.Resource {
152152
if d.Get("network_profile.0.network_plugin").(string) != string(managedclusters.NetworkPluginAzure) {
153153
return fmt.Errorf("when `network_profile.0.advanced_networking` is set, `network_profile.0.network_plugin` must be set to `%s`", managedclusters.NetworkPluginAzure)
154154
}
155+
securityEnabled := d.Get("network_profile.0.advanced_networking.0.security_enabled").(bool)
156+
advancedNetworkPolicies := d.Get("network_profile.0.advanced_networking.0.advanced_network_policies").(string)
157+
if !securityEnabled && advancedNetworkPolicies != "" && advancedNetworkPolicies != string(managedclusters.AdvancedNetworkPoliciesNone) {
158+
return fmt.Errorf("`network_profile.0.advanced_networking.0.advanced_network_policies` can only be set to `%s` or `%s` when `network_profile.0.advanced_networking.0.security_enabled` is set to `true`", managedclusters.AdvancedNetworkPoliciesFQDN, managedclusters.AdvancedNetworkPoliciesLSeven)
159+
}
155160
}
156161
return nil
157162
},
@@ -1337,6 +1342,15 @@ func resourceKubernetesCluster() *pluginsdk.Resource {
13371342
Default: false,
13381343
AtLeastOneOf: []string{"network_profile.0.advanced_networking.0.observability_enabled", "network_profile.0.advanced_networking.0.security_enabled"},
13391344
},
1345+
"advanced_network_policies": {
1346+
Type: pluginsdk.TypeString,
1347+
Optional: true,
1348+
ValidateFunc: validation.StringInSlice([]string{
1349+
string(managedclusters.AdvancedNetworkPoliciesFQDN),
1350+
string(managedclusters.AdvancedNetworkPoliciesLSeven),
1351+
string(managedclusters.AdvancedNetworkPoliciesNone),
1352+
}, false),
1353+
},
13401354
},
13411355
},
13421356
},
@@ -3676,14 +3690,21 @@ func expandKubernetesClusterAdvancedNetworking(input []interface{}, d *pluginsdk
36763690
observabilityEnabled := config["observability_enabled"].(bool)
36773691
securityEnabled := config["security_enabled"].(bool)
36783692

3693+
security := &managedclusters.AdvancedNetworkingSecurity{
3694+
Enabled: pointer.To(securityEnabled),
3695+
}
3696+
3697+
if v, ok := config["advanced_network_policies"].(string); ok && v != "" {
3698+
advancedNetworkPolicies := managedclusters.AdvancedNetworkPolicies(v)
3699+
security.AdvancedNetworkPolicies = &advancedNetworkPolicies
3700+
}
3701+
36793702
return &managedclusters.AdvancedNetworking{
36803703
Enabled: pointer.To(true),
36813704
Observability: &managedclusters.AdvancedNetworkingObservability{
36823705
Enabled: pointer.To(observabilityEnabled),
36833706
},
3684-
Security: &managedclusters.AdvancedNetworkingSecurity{
3685-
Enabled: pointer.To(securityEnabled),
3686-
},
3707+
Security: security,
36873708
}
36883709
}
36893710

@@ -3698,14 +3719,19 @@ func flattenKubernetesClusterAdvancedNetworking(advancedNetworking *managedclust
36983719
}
36993720

37003721
securityEnabled := false
3722+
advancedNetworkPolicies := ""
37013723
if advancedNetworking.Security != nil {
37023724
securityEnabled = pointer.From(advancedNetworking.Security.Enabled)
3725+
if advancedNetworking.Security.AdvancedNetworkPolicies != nil {
3726+
advancedNetworkPolicies = string(*advancedNetworking.Security.AdvancedNetworkPolicies)
3727+
}
37033728
}
37043729

37053730
return []interface{}{
37063731
map[string]interface{}{
3707-
"observability_enabled": observabilityEnabled,
3708-
"security_enabled": securityEnabled,
3732+
"observability_enabled": observabilityEnabled,
3733+
"security_enabled": securityEnabled,
3734+
"advanced_network_policies": advancedNetworkPolicies,
37093735
},
37103736
}
37113737
}

‎internal/services/containers/kubernetes_cluster_validate.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ import (
1313
"github.com/hashicorp/go-azure-helpers/resourcemanager/commonids"
1414
"github.com/hashicorp/go-azure-helpers/resourcemanager/identity"
1515
"github.com/hashicorp/go-azure-sdk/resource-manager/containerservice/2025-07-01/agentpools"
16-
"github.com/hashicorp/go-azure-sdk/resource-manager/containerservice/2025-07-01/managedclusters"
16+
"github.com/hashicorp/go-azure-sdk/resource-manager/containerservice/2025-10-01/managedclusters"
1717
"github.com/hashicorp/terraform-provider-azurerm/internal/services/containers/client"
1818
"github.com/hashicorp/terraform-provider-azurerm/internal/tf/pluginsdk"
1919
)

‎internal/services/containers/kubernetes_nodepool.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ import (
1717
"github.com/hashicorp/go-azure-sdk/resource-manager/compute/2022-03-01/capacityreservationgroups"
1818
"github.com/hashicorp/go-azure-sdk/resource-manager/compute/2022-03-01/proximityplacementgroups"
1919
"github.com/hashicorp/go-azure-sdk/resource-manager/containerservice/2025-07-01/agentpools"
20-
"github.com/hashicorp/go-azure-sdk/resource-manager/containerservice/2025-07-01/managedclusters"
20+
"github.com/hashicorp/go-azure-sdk/resource-manager/containerservice/2025-10-01/managedclusters"
2121
"github.com/hashicorp/go-azure-sdk/resource-manager/containerservice/2025-07-01/snapshots"
2222
"github.com/hashicorp/go-azure-sdk/resource-manager/network/2023-09-01/applicationsecuritygroups"
2323
"github.com/hashicorp/go-azure-sdk/resource-manager/network/2023-11-01/publicipprefixes"

‎internal/services/machinelearning/machine_learning_inference_cluster_resource.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ import (
1313
"github.com/hashicorp/go-azure-helpers/resourcemanager/commonschema"
1414
"github.com/hashicorp/go-azure-helpers/resourcemanager/location"
1515
"github.com/hashicorp/go-azure-helpers/resourcemanager/tags"
16-
"github.com/hashicorp/go-azure-sdk/resource-manager/containerservice/2025-07-01/managedclusters"
16+
"github.com/hashicorp/go-azure-sdk/resource-manager/containerservice/2025-10-01/managedclusters"
1717
"github.com/hashicorp/go-azure-sdk/resource-manager/machinelearningservices/2025-06-01/machinelearningcomputes"
1818
"github.com/hashicorp/go-azure-sdk/resource-manager/machinelearningservices/2025-06-01/workspaces"
1919
"github.com/hashicorp/terraform-provider-azurerm/helpers/tf"

‎vendor/github.com/hashicorp/go-azure-sdk/resource-manager/containerservice/2025-07-01/managedclusters/model_clouderrorbody.go‎

Lines changed: 0 additions & 11 deletions
This file was deleted.

0 commit comments

Comments
 (0)