Skip to content

Commit 6dfbc10

Browse files
nddqnddq
committed
azurerm_kubernetes_cluster - add advanced_network_policies property to advanced_networking block
This change adds support for the `advanced_network_policies` property within the `network_profile.advanced_networking` block for Azure Kubernetes Service clusters. Changes: - Add `advanced_network_policies` field with valid values: `FQDN`, `L7`, `None` - Add validation to ensure `advanced_network_policies` can only be set to `FQDN` or `L7` when `security_enabled` is `true` - Upgrade managedclusters SDK from 2025-07-01 to 2025-10-01 API version to support the new field - Add tests for the new property and validation - Update documentation Signed-off-by: Quang Nguyen <nguyenquang@microsoft.com>
1 parent 06301cb commit 6dfbc10

3 files changed

Lines changed: 217 additions & 5 deletions

File tree

‎internal/services/containers/kubernetes_cluster_network_resource_test.go‎

Lines changed: 184 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,56 @@ func TestAccKubernetesCluster_advancedNetworkingNetworkDataplane(t *testing.T) {
101101
})
102102
}
103103

104+
func TestAccKubernetesCluster_advancedNetworkingPolicies(t *testing.T) {
105+
data := acceptance.BuildTestData(t, "azurerm_kubernetes_cluster", "test")
106+
r := KubernetesClusterResource{}
107+
108+
data.ResourceTest(t, r, []acceptance.TestStep{
109+
{
110+
Config: r.advancedNetworkingWithPolicies(data, "FQDN"),
111+
Check: acceptance.ComposeTestCheckFunc(
112+
check.That(data.ResourceName).ExistsInAzure(r),
113+
check.That(data.ResourceName).Key("network_profile.0.advanced_networking.0.security_enabled").HasValue("true"),
114+
check.That(data.ResourceName).Key("network_profile.0.advanced_networking.0.advanced_network_policies").HasValue("FQDN"),
115+
),
116+
},
117+
data.ImportStep(),
118+
{
119+
Config: r.advancedNetworkingWithPolicies(data, "L7"),
120+
Check: acceptance.ComposeTestCheckFunc(
121+
check.That(data.ResourceName).ExistsInAzure(r),
122+
check.That(data.ResourceName).Key("network_profile.0.advanced_networking.0.security_enabled").HasValue("true"),
123+
check.That(data.ResourceName).Key("network_profile.0.advanced_networking.0.advanced_network_policies").HasValue("L7"),
124+
),
125+
},
126+
data.ImportStep(),
127+
})
128+
}
129+
130+
func TestAccKubernetesCluster_advancedNetworkingPoliciesFQDNRequiresSecurity(t *testing.T) {
131+
data := acceptance.BuildTestData(t, "azurerm_kubernetes_cluster", "test")
132+
r := KubernetesClusterResource{}
133+
134+
data.ResourceTest(t, r, []acceptance.TestStep{
135+
{
136+
Config: r.advancedNetworkingWithPoliciesSecurityDisabled(data, "FQDN"),
137+
ExpectError: regexp.MustCompile("`network_profile.0.advanced_networking.0.advanced_network_policies` can only be set to `FQDN` or `L7` when `network_profile.0.advanced_networking.0.security_enabled` is set to `true`"),
138+
},
139+
})
140+
}
141+
142+
func TestAccKubernetesCluster_advancedNetworkingPoliciesL7RequiresSecurity(t *testing.T) {
143+
data := acceptance.BuildTestData(t, "azurerm_kubernetes_cluster", "test")
144+
r := KubernetesClusterResource{}
145+
146+
data.ResourceTest(t, r, []acceptance.TestStep{
147+
{
148+
Config: r.advancedNetworkingWithPoliciesSecurityDisabled(data, "L7"),
149+
ExpectError: regexp.MustCompile("`network_profile.0.advanced_networking.0.advanced_network_policies` can only be set to `FQDN` or `L7` when `network_profile.0.advanced_networking.0.security_enabled` is set to `true`"),
150+
},
151+
})
152+
}
153+
104154
func TestAccKubernetesCluster_serviceMeshProfile(t *testing.T) {
105155
data := acceptance.BuildTestData(t, "azurerm_kubernetes_cluster", "test")
106156
r := KubernetesClusterResource{}
@@ -1417,6 +1467,140 @@ resource "azurerm_kubernetes_cluster" "test" {
14171467
`, data.RandomInteger, data.Locations.Primary, data.RandomInteger, data.RandomInteger, data.RandomInteger, data.RandomInteger, data.RandomInteger, networkPlugin)
14181468
}
14191469

1470+
func (KubernetesClusterResource) advancedNetworkingWithPolicies(data acceptance.TestData, advancedNetworkPolicies string) string {
1471+
return fmt.Sprintf(`
1472+
provider "azurerm" {
1473+
features {}
1474+
}
1475+
1476+
resource "azurerm_resource_group" "test" {
1477+
name = "acctestRG-aks-%d"
1478+
location = "%s"
1479+
}
1480+
1481+
resource "azurerm_virtual_network" "test" {
1482+
name = "acctestvirtnet%d"
1483+
address_space = ["10.0.0.0/8"]
1484+
location = azurerm_resource_group.test.location
1485+
resource_group_name = azurerm_resource_group.test.name
1486+
}
1487+
1488+
resource "azurerm_subnet" "test" {
1489+
name = "acctestsubnet%d"
1490+
resource_group_name = azurerm_resource_group.test.name
1491+
virtual_network_name = azurerm_virtual_network.test.name
1492+
address_prefixes = ["10.1.0.0/16"]
1493+
}
1494+
1495+
resource "azurerm_kubernetes_cluster" "test" {
1496+
name = "acctestaks%d"
1497+
location = azurerm_resource_group.test.location
1498+
resource_group_name = azurerm_resource_group.test.name
1499+
dns_prefix = "acctestaks%d"
1500+
1501+
linux_profile {
1502+
admin_username = "acctestuser%d"
1503+
1504+
ssh_key {
1505+
key_data = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqaZoyiz1qbdOQ8xEf6uEu1cCwYowo5FHtsBhqLoDnnp7KUTEBN+L2NxRIfQ781rxV6Iq5jSav6b2Q8z5KiseOlvKA/RF2wqU0UPYqQviQhLmW6THTpmrv/YkUCuzxDpsH7DUDhZcwySLKVVe0Qm3+5N2Ta6UYH3lsDf9R9wTP2K/+vAnflKebuypNlmocIvakFWoZda18FOmsOoIVXQ8HWFNCuw9ZCunMSN62QGamCe3dL5cXlkgHYv7ekJE15IA9aOJcM7e90oeTqo+7HTcWfdu0qQqPWY5ujyMw/llas8tsXY85LFqRnr3gJ02bAscjc477+X+j/gkpFoN1QEmt terraform@demo.tld"
1506+
}
1507+
}
1508+
1509+
default_node_pool {
1510+
name = "default"
1511+
node_count = 2
1512+
vm_size = "Standard_DS2_v2"
1513+
vnet_subnet_id = azurerm_subnet.test.id
1514+
upgrade_settings {
1515+
max_surge = "10%%"
1516+
}
1517+
}
1518+
1519+
identity {
1520+
type = "SystemAssigned"
1521+
}
1522+
1523+
network_profile {
1524+
network_plugin = "azure"
1525+
network_data_plane = "cilium"
1526+
1527+
advanced_networking {
1528+
observability_enabled = true
1529+
security_enabled = true
1530+
advanced_network_policies = "%s"
1531+
}
1532+
}
1533+
}
1534+
`, data.RandomInteger, data.Locations.Primary, data.RandomInteger, data.RandomInteger, data.RandomInteger, data.RandomInteger, data.RandomInteger, advancedNetworkPolicies)
1535+
}
1536+
1537+
func (KubernetesClusterResource) advancedNetworkingWithPoliciesSecurityDisabled(data acceptance.TestData, advancedNetworkPolicies string) string {
1538+
return fmt.Sprintf(`
1539+
provider "azurerm" {
1540+
features {}
1541+
}
1542+
1543+
resource "azurerm_resource_group" "test" {
1544+
name = "acctestRG-aks-%d"
1545+
location = "%s"
1546+
}
1547+
1548+
resource "azurerm_virtual_network" "test" {
1549+
name = "acctestvirtnet%d"
1550+
address_space = ["10.0.0.0/8"]
1551+
location = azurerm_resource_group.test.location
1552+
resource_group_name = azurerm_resource_group.test.name
1553+
}
1554+
1555+
resource "azurerm_subnet" "test" {
1556+
name = "acctestsubnet%d"
1557+
resource_group_name = azurerm_resource_group.test.name
1558+
virtual_network_name = azurerm_virtual_network.test.name
1559+
address_prefixes = ["10.1.0.0/16"]
1560+
}
1561+
1562+
resource "azurerm_kubernetes_cluster" "test" {
1563+
name = "acctestaks%d"
1564+
location = azurerm_resource_group.test.location
1565+
resource_group_name = azurerm_resource_group.test.name
1566+
dns_prefix = "acctestaks%d"
1567+
1568+
linux_profile {
1569+
admin_username = "acctestuser%d"
1570+
1571+
ssh_key {
1572+
key_data = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqaZoyiz1qbdOQ8xEf6uEu1cCwYowo5FHtsBhqLoDnnp7KUTEBN+L2NxRIfQ781rxV6Iq5jSav6b2Q8z5KiseOlvKA/RF2wqU0UPYqQviQhLmW6THTpmrv/YkUCuzxDpsH7DUDhZcwySLKVVe0Qm3+5N2Ta6UYH3lsDf9R9wTP2K/+vAnflKebuypNlmocIvakFWoZda18FOmsOoIVXQ8HWFNCuw9ZCunMSN62QGamCe3dL5cXlkgHYv7ekJE15IA9aOJcM7e90oeTqo+7HTcWfdu0qQqPWY5ujyMw/llas8tsXY85LFqRnr3gJ02bAscjc477+X+j/gkpFoN1QEmt terraform@demo.tld"
1573+
}
1574+
}
1575+
1576+
default_node_pool {
1577+
name = "default"
1578+
node_count = 2
1579+
vm_size = "Standard_DS2_v2"
1580+
vnet_subnet_id = azurerm_subnet.test.id
1581+
upgrade_settings {
1582+
max_surge = "10%%"
1583+
}
1584+
}
1585+
1586+
identity {
1587+
type = "SystemAssigned"
1588+
}
1589+
1590+
network_profile {
1591+
network_plugin = "azure"
1592+
network_data_plane = "cilium"
1593+
1594+
advanced_networking {
1595+
observability_enabled = true
1596+
security_enabled = false
1597+
advanced_network_policies = "%s"
1598+
}
1599+
}
1600+
}
1601+
`, data.RandomInteger, data.Locations.Primary, data.RandomInteger, data.RandomInteger, data.RandomInteger, data.RandomInteger, data.RandomInteger, advancedNetworkPolicies)
1602+
}
1603+
14201604
func (KubernetesClusterResource) serviceMeshProfile(data acceptance.TestData, internalIngressEnabled bool, externalIngressEnabled bool) string {
14211605
return fmt.Sprintf(`
14221606
provider "azurerm" {

‎internal/services/containers/kubernetes_cluster_resource.go‎

Lines changed: 31 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -154,6 +154,11 @@ func resourceKubernetesCluster() *pluginsdk.Resource {
154154
if d.Get("network_profile.0.network_plugin").(string) != string(managedclusters.NetworkPluginAzure) {
155155
return fmt.Errorf("when `network_profile.0.advanced_networking` is set, `network_profile.0.network_plugin` must be set to `%s`", managedclusters.NetworkPluginAzure)
156156
}
157+
securityEnabled := d.Get("network_profile.0.advanced_networking.0.security_enabled").(bool)
158+
advancedNetworkPolicies := d.Get("network_profile.0.advanced_networking.0.advanced_network_policies").(string)
159+
if !securityEnabled && advancedNetworkPolicies != "" && advancedNetworkPolicies != string(managedclusters.AdvancedNetworkPoliciesNone) {
160+
return fmt.Errorf("`network_profile.0.advanced_networking.0.advanced_network_policies` can only be set to `%s` or `%s` when `network_profile.0.advanced_networking.0.security_enabled` is set to `true`", managedclusters.AdvancedNetworkPoliciesFQDN, managedclusters.AdvancedNetworkPoliciesLSeven)
161+
}
157162
}
158163
return nil
159164
},
@@ -1339,6 +1344,15 @@ func resourceKubernetesCluster() *pluginsdk.Resource {
13391344
Default: false,
13401345
AtLeastOneOf: []string{"network_profile.0.advanced_networking.0.observability_enabled", "network_profile.0.advanced_networking.0.security_enabled"},
13411346
},
1347+
"advanced_network_policies": {
1348+
Type: pluginsdk.TypeString,
1349+
Optional: true,
1350+
ValidateFunc: validation.StringInSlice([]string{
1351+
string(managedclusters.AdvancedNetworkPoliciesFQDN),
1352+
string(managedclusters.AdvancedNetworkPoliciesLSeven),
1353+
string(managedclusters.AdvancedNetworkPoliciesNone),
1354+
}, false),
1355+
},
13421356
},
13431357
},
13441358
},
@@ -3680,14 +3694,21 @@ func expandKubernetesClusterAdvancedNetworking(input []interface{}, d *pluginsdk
36803694
observabilityEnabled := config["observability_enabled"].(bool)
36813695
securityEnabled := config["security_enabled"].(bool)
36823696

3697+
security := &managedclusters.AdvancedNetworkingSecurity{
3698+
Enabled: pointer.To(securityEnabled),
3699+
}
3700+
3701+
if v, ok := config["advanced_network_policies"].(string); ok && v != "" {
3702+
advancedNetworkPolicies := managedclusters.AdvancedNetworkPolicies(v)
3703+
security.AdvancedNetworkPolicies = &advancedNetworkPolicies
3704+
}
3705+
36833706
return &managedclusters.AdvancedNetworking{
36843707
Enabled: pointer.To(true),
36853708
Observability: &managedclusters.AdvancedNetworkingObservability{
36863709
Enabled: pointer.To(observabilityEnabled),
36873710
},
3688-
Security: &managedclusters.AdvancedNetworkingSecurity{
3689-
Enabled: pointer.To(securityEnabled),
3690-
},
3711+
Security: security,
36913712
}
36923713
}
36933714

@@ -3702,14 +3723,19 @@ func flattenKubernetesClusterAdvancedNetworking(advancedNetworking *managedclust
37023723
}
37033724

37043725
securityEnabled := false
3726+
advancedNetworkPolicies := ""
37053727
if advancedNetworking.Security != nil {
37063728
securityEnabled = pointer.From(advancedNetworking.Security.Enabled)
3729+
if advancedNetworking.Security.AdvancedNetworkPolicies != nil {
3730+
advancedNetworkPolicies = string(*advancedNetworking.Security.AdvancedNetworkPolicies)
3731+
}
37073732
}
37083733

37093734
return []interface{}{
37103735
map[string]interface{}{
3711-
"observability_enabled": observabilityEnabled,
3712-
"security_enabled": securityEnabled,
3736+
"observability_enabled": observabilityEnabled,
3737+
"security_enabled": securityEnabled,
3738+
"advanced_network_policies": advancedNetworkPolicies,
37133739
},
37143740
}
37153741
}

‎website/docs/r/kubernetes_cluster.html.markdown‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -728,6 +728,8 @@ An `advanced_networking` block supports the following:
728728

729729
* `security_enabled` - (Optional) Is security enabled? Defaults to `false`.
730730

731+
* `advanced_network_policies` - (Optional) Specifies the advanced network policy for the cluster. Possible values are `FQDN`, `L7` and `None`. This can only be specified when `security_enabled` is set to `true`. Defaults to `FQDN`.
732+
731733
---
732734

733735
A `load_balancer_profile` block supports the following:

0 commit comments

Comments
 (0)