Skip to content

Commit 7da3edb

Browse files
ffederighiffederighi
committed
feat: add azure modules
1 parent 16b0f12 commit 7da3edb

File tree

258 files changed

+7559
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

258 files changed

+7559
-0
lines changed

‎azure/aks-cluster/README.md‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
# Azure AKS Cluster Module
2+
3+
This module manages Azure AKS Cluster resources.
4+
5+
<!-- BEGIN_TF_DOCS -->
6+
## Requirements
7+
8+
| Name | Version |
9+
|------|---------|
10+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | ~> 1.3 |
11+
| <a name="requirement_azuread"></a> [azuread](#requirement\_azuread) | >= 3.5.0, <4.0.0 |
12+
| <a name="requirement_time"></a> [time](#requirement\_time) | ~> 0.13.1 |
13+
14+
## Providers
15+
16+
| Name | Version |
17+
|------|---------|
18+
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 4.54.0 |
19+
| <a name="provider_time"></a> [time](#provider\_time) | 0.13.1 |
20+
21+
## Modules
22+
23+
No modules.
24+
25+
## Resources
26+
27+
| Name | Type |
28+
|------|------|
29+
| [azurerm_kubernetes_cluster.aks](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/kubernetes_cluster) | resource |
30+
| [azurerm_role_assignment.aks_acr](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) | resource |
31+
| [azurerm_role_assignment.aks_dns_contributor](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) | resource |
32+
| [azurerm_role_assignment.aks_network_contributor](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) | resource |
33+
| [azurerm_user_assigned_identity.aks_identity](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/user_assigned_identity) | resource |
34+
| [time_static.last_update](https://registry.terraform.io/providers/hashicorp/time/latest/docs/resources/static) | resource |
35+
36+
## Inputs
37+
38+
| Name | Description | Type | Default | Required |
39+
|------|-------------|------|---------|:--------:|
40+
| <a name="input_acr_id"></a> [acr\_id](#input\_acr\_id) | Azure Container Registry ID to grant AcrPull access to the AKS cluster | `string` | `null` | no |
41+
| <a name="input_admin_group_object_ids"></a> [admin\_group\_object\_ids](#input\_admin\_group\_object\_ids) | List of Azure AD group object IDs that should have admin access to the AKS cluster | `list(string)` | `[]` | no |
42+
| <a name="input_auto_scaling_enabled"></a> [auto\_scaling\_enabled](#input\_auto\_scaling\_enabled) | n/a | `bool` | `false` | no |
43+
| <a name="input_azure_rbac_enabled"></a> [azure\_rbac\_enabled](#input\_azure\_rbac\_enabled) | Enable Azure RBAC for Kubernetes authorization | `bool` | `false` | no |
44+
| <a name="input_customer"></a> [customer](#input\_customer) | Customer applied to this AKS Cluster | `string` | `""` | no |
45+
| <a name="input_dns_prefix"></a> [dns\_prefix](#input\_dns\_prefix) | DNS prefix for the cluster | `string` | `null` | no |
46+
| <a name="input_dns_prefix_private_cluster"></a> [dns\_prefix\_private\_cluster](#input\_dns\_prefix\_private\_cluster) | DNS prefix for the private cluster | `string` | `null` | no |
47+
| <a name="input_dns_service_ip"></a> [dns\_service\_ip](#input\_dns\_service\_ip) | IP address within the Kubernetes service address range that will be used by cluster service discovery (kube-dns) | `string` | `null` | no |
48+
| <a name="input_drain_timeout_in_minutes"></a> [drain\_timeout\_in\_minutes](#input\_drain\_timeout\_in\_minutes) | The amount of time in minutes to wait on eviction of pods and graceful termination per node. | `number` | `30` | no |
49+
| <a name="input_environment"></a> [environment](#input\_environment) | Environment applied to this AKS Cluster | `string` | `""` | no |
50+
| <a name="input_host_encryption_enabled"></a> [host\_encryption\_enabled](#input\_host\_encryption\_enabled) | n/a | `bool` | `false` | no |
51+
| <a name="input_kubernetes_version"></a> [kubernetes\_version](#input\_kubernetes\_version) | Version of Kubernetes specified when creating the AKS managed cluster | `string` | `null` | no |
52+
| <a name="input_load_balancer_sku"></a> [load\_balancer\_sku](#input\_load\_balancer\_sku) | Specifies the SKU of the Load Balancer used for this Kubernetes Cluster. Possible values are basic and standard | `string` | `"standard"` | no |
53+
| <a name="input_location"></a> [location](#input\_location) | Azure region where the AKS cluster will be created | `string` | n/a | yes |
54+
| <a name="input_max_count"></a> [max\_count](#input\_max\_count) | n/a | `number` | `null` | no |
55+
| <a name="input_max_pods"></a> [max\_pods](#input\_max\_pods) | The maximum number of pods that can run on a node in the node pool | `number` | `250` | no |
56+
| <a name="input_max_surge"></a> [max\_surge](#input\_max\_surge) | The maximum number or percentage of nodes which will be added to the Node Pool size during an upgrade | `string` | `"33%"` | no |
57+
| <a name="input_min_count"></a> [min\_count](#input\_min\_count) | n/a | `number` | `null` | no |
58+
| <a name="input_name"></a> [name](#input\_name) | Name applied to this AKS Cluster | `string` | n/a | yes |
59+
| <a name="input_network_data_plane"></a> [network\_data\_plane](#input\_network\_data\_plane) | Specifies the data plane used for building the Kubernetes network. Possible values are azure and cilium | `string` | `"azure"` | no |
60+
| <a name="input_network_plugin"></a> [network\_plugin](#input\_network\_plugin) | Network plugin to use | `string` | n/a | yes |
61+
| <a name="input_network_plugin_mode"></a> [network\_plugin\_mode](#input\_network\_plugin\_mode) | Specifies the network plugin mode used for building the Kubernetes network | `string` | `null` | no |
62+
| <a name="input_network_policy"></a> [network\_policy](#input\_network\_policy) | Network policy to use | `string` | n/a | yes |
63+
| <a name="input_node_count"></a> [node\_count](#input\_node\_count) | n/a | `number` | `3` | no |
64+
| <a name="input_node_pool_name"></a> [node\_pool\_name](#input\_node\_pool\_name) | n/a | `string` | n/a | yes |
65+
| <a name="input_node_public_ip_enabled"></a> [node\_public\_ip\_enabled](#input\_node\_public\_ip\_enabled) | n/a | `bool` | `false` | no |
66+
| <a name="input_node_soak_duration_in_minutes"></a> [node\_soak\_duration\_in\_minutes](#input\_node\_soak\_duration\_in\_minutes) | n/a | `number` | `10` | no |
67+
| <a name="input_oidc_issuer_enabled"></a> [oidc\_issuer\_enabled](#input\_oidc\_issuer\_enabled) | Enable OIDC issuer for workload identity federation | `bool` | `false` | no |
68+
| <a name="input_os_disk_size_gb"></a> [os\_disk\_size\_gb](#input\_os\_disk\_size\_gb) | The size of the OS Disk which should be used for each agent in the Node Pool | `number` | `null` | no |
69+
| <a name="input_os_disk_type"></a> [os\_disk\_type](#input\_os\_disk\_type) | The type of disk for the OS (Managed, Ephemeral) | `string` | `"Managed"` | no |
70+
| <a name="input_os_sku"></a> [os\_sku](#input\_os\_sku) | The OS SKU for the default node pool (e.g., Ubuntu, AzureLinux, Windows2019, Windows2022) | `string` | `"Ubuntu"` | no |
71+
| <a name="input_outbound_type"></a> [outbound\_type](#input\_outbound\_type) | The outbound (egress) routing method which should be used for this Kubernetes Cluster. Possible values are loadBalancer, userDefinedRouting, managedNATGateway, userAssignedNATGateway and none. | `string` | `"loadBalancer"` | no |
72+
| <a name="input_pod_cidr"></a> [pod\_cidr](#input\_pod\_cidr) | The CIDR to use for pod IP addresses. This field can only be set when network\_plugin is set to kubenet or network\_plugin\_mode is set to overlay | `string` | `null` | no |
73+
| <a name="input_private_cluster_enabled"></a> [private\_cluster\_enabled](#input\_private\_cluster\_enabled) | Exposed API server only on internal IP addresses | `bool` | `false` | no |
74+
| <a name="input_private_dns_zone_id"></a> [private\_dns\_zone\_id](#input\_private\_dns\_zone\_id) | ID of Private DNS Zone | `string` | `null` | no |
75+
| <a name="input_resource_group_name"></a> [resource\_group\_name](#input\_resource\_group\_name) | The name of the resource group in which to create the AKS cluster | `string` | n/a | yes |
76+
| <a name="input_role_based_access_control_enabled"></a> [role\_based\_access\_control\_enabled](#input\_role\_based\_access\_control\_enabled) | Enable Kubernetes RBAC | `bool` | `true` | no |
77+
| <a name="input_service_cidr"></a> [service\_cidr](#input\_service\_cidr) | The Network Range used by the Kubernetes service. | `string` | `null` | no |
78+
| <a name="input_sku_tier"></a> [sku\_tier](#input\_sku\_tier) | The SKU Tier that should be used for this Kubernetes Cluster | `string` | `"Free"` | no |
79+
| <a name="input_tags"></a> [tags](#input\_tags) | Tags applied to this AKS Cluster | `map(any)` | `{}` | no |
80+
| <a name="input_vm_size"></a> [vm\_size](#input\_vm\_size) | n/a | `string` | `"Standard_D2_v4"` | no |
81+
| <a name="input_vnet_subnet_id"></a> [vnet\_subnet\_id](#input\_vnet\_subnet\_id) | n/a | `string` | `null` | no |
82+
| <a name="input_workload_identity_enabled"></a> [workload\_identity\_enabled](#input\_workload\_identity\_enabled) | Enable workload identity for the AKS cluster | `bool` | `false` | no |
83+
| <a name="input_zones"></a> [zones](#input\_zones) | A list of Availability Zones across which the Node Pool should be spread | `list(string)` | `null` | no |
84+
85+
## Outputs
86+
87+
| Name | Description |
88+
|------|-------------|
89+
| <a name="output_id"></a> [id](#output\_id) | The ID of the created AKS Cluster |
90+
| <a name="output_identity"></a> [identity](#output\_identity) | Identity block |
91+
| <a name="output_kube_config"></a> [kube\_config](#output\_kube\_config) | Configuration kubectl |
92+
<!-- END_TF_DOCS -->

‎azure/aks-cluster/_aks-cluster.tf‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
resource "azurerm_user_assigned_identity" "aks_identity" {
2+
name = "id-${var.name}"
3+
location = var.location
4+
resource_group_name = var.resource_group_name
5+
tags = var.tags
6+
}
7+
8+
resource "azurerm_kubernetes_cluster" "aks" {
9+
name = var.name
10+
location = var.location
11+
resource_group_name = var.resource_group_name
12+
sku_tier = var.sku_tier
13+
dns_prefix = var.dns_prefix
14+
dns_prefix_private_cluster = var.dns_prefix_private_cluster
15+
private_dns_zone_id = var.private_dns_zone_id
16+
kubernetes_version = var.kubernetes_version
17+
private_cluster_enabled = var.private_cluster_enabled
18+
role_based_access_control_enabled = var.role_based_access_control_enabled
19+
20+
tags = local.interpolated_tags
21+
22+
oidc_issuer_enabled = var.oidc_issuer_enabled
23+
workload_identity_enabled = var.workload_identity_enabled
24+
25+
default_node_pool {
26+
name = var.node_pool_name
27+
node_count = var.node_count
28+
max_pods = var.max_pods
29+
vm_size = var.vm_size
30+
os_sku = var.os_sku
31+
os_disk_type = var.os_disk_type
32+
zones = var.zones
33+
os_disk_size_gb = var.os_disk_size_gb
34+
auto_scaling_enabled = var.auto_scaling_enabled
35+
min_count = var.min_count
36+
max_count = var.max_count
37+
host_encryption_enabled = var.host_encryption_enabled
38+
node_public_ip_enabled = var.node_public_ip_enabled
39+
vnet_subnet_id = var.vnet_subnet_id
40+
temporary_name_for_rotation = "nodepooltmp"
41+
upgrade_settings {
42+
drain_timeout_in_minutes = var.drain_timeout_in_minutes
43+
max_surge = var.max_surge
44+
node_soak_duration_in_minutes = var.node_soak_duration_in_minutes
45+
}
46+
}
47+
48+
dynamic "azure_active_directory_role_based_access_control" {
49+
for_each = var.azure_rbac_enabled ? [1] : []
50+
content {
51+
azure_rbac_enabled = true
52+
admin_group_object_ids = var.admin_group_object_ids
53+
}
54+
}
55+
56+
identity {
57+
type = "UserAssigned"
58+
identity_ids = [azurerm_user_assigned_identity.aks_identity.id]
59+
}
60+
61+
network_profile {
62+
network_plugin = var.network_plugin
63+
network_policy = var.network_policy
64+
network_plugin_mode = var.network_plugin_mode
65+
network_data_plane = var.network_data_plane
66+
pod_cidr = var.pod_cidr
67+
outbound_type = var.outbound_type
68+
service_cidr = var.service_cidr
69+
dns_service_ip = var.dns_service_ip
70+
load_balancer_sku = var.load_balancer_sku
71+
}
72+
}
73+
74+
resource "azurerm_role_assignment" "aks_dns_contributor" {
75+
count = var.private_cluster_enabled && var.private_dns_zone_id != null ? 1 : 0
76+
scope = var.private_dns_zone_id
77+
role_definition_name = "Private DNS Zone Contributor"
78+
principal_id = azurerm_user_assigned_identity.aks_identity.principal_id
79+
}
80+
81+
resource "azurerm_role_assignment" "aks_network_contributor" {
82+
scope = var.vnet_subnet_id
83+
role_definition_name = "Network Contributor"
84+
principal_id = azurerm_user_assigned_identity.aks_identity.principal_id
85+
}
86+
87+
resource "azurerm_role_assignment" "aks_acr" {
88+
count = var.acr_id != null ? 1 : 0
89+
principal_id = azurerm_kubernetes_cluster.aks.kubelet_identity[0].object_id
90+
role_definition_name = "AcrPull"
91+
scope = var.acr_id
92+
skip_service_principal_aad_check = true
93+
}

‎azure/aks-cluster/main.tf‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
locals {
2+
interpolated_tags = merge({
3+
"Name" = var.name,
4+
"Customer" = var.customer,
5+
"Environment" = var.environment,
6+
"ManagedBy" = "Terraform",
7+
"LastModifiedAt" = time_static.last_update.rfc3339,
8+
},
9+
var.tags
10+
)
11+
}
12+
13+
resource "time_static" "last_update" {
14+
}

‎azure/aks-cluster/outputs.tf‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
output "id" {
2+
description = "The ID of the created AKS Cluster"
3+
value = azurerm_kubernetes_cluster.aks.id
4+
}
5+
6+
output "kube_config" {
7+
description = "Configuration kubectl"
8+
value = azurerm_kubernetes_cluster.aks.kube_config_raw
9+
sensitive = true
10+
}
11+
12+
output "identity" {
13+
description = "Identity block"
14+
value = azurerm_kubernetes_cluster.aks.identity
15+
}
16+

0 commit comments

Comments
 (0)