AKS Terraform Foundation

A production-ready Azure Kubernetes Service (AKS) infrastructure with Crossplane, ArgoCD, and Vault, managed entirely with Terraform.

🚀 Quick Start

# Clone and navigate to the project
cd 03-plat-eng-aks-foundation

# Initialize and deploy
make init ENV=dev
make plan
make apply

# Get AKS credentials
az aks get-credentials --name aks-test --resource-group aks-test-rg

For detailed setup instructions, see the Quickstart Guide.

📋 Table of Contents

Features
Architecture
Prerequisites
Documentation
Project Structure
Quick Reference
Contributing
License

✨ Features

Infrastructure

Azure Kubernetes Service (AKS): Production-ready Kubernetes cluster
Multi-environment Support: Separate workspaces for dev and production
Infrastructure as Code: Complete Terraform configuration
Azure Integration: Workload Identity, Azure CNI, managed identities

Platform Services

ArgoCD: GitOps continuous delivery
- Public endpoint with Azure Public IP
- DNS: luciano-argocd.eastus.cloudapp.azure.com
Crossplane: Cloud-native control plane
- Azure AD Service Principal authentication
- Provider Family Azure and Provider Azure Cache
Azure Service Operator (ASO): Cloud-native Azure resource management (v2.17.0)
Vault: Secrets management (HashiCorp Vault)

Operations

Makefile Commands: Simplified infrastructure management
Terraform Workspaces: Environment isolation
Namespaced Resources: Organized by system component
Logging & Monitoring: Azure Log Analytics integration

🏗️ Architecture

This project implements a modern cloud-native platform on Azure:

┌─────────────────────────────────────────────────────────────────┐
│                         Azure Cloud                             │
│                                                                 │
│  ┌────────────────────────────────────────────────────────────┐ │
│  │                    AKS Cluster                             │ │
│  │                                                            │ │
│  │  ┌──────────────┐  ┌──────────────┐  ┌──────────────┐      │ │
│  │  │   ArgoCD     │  │ Crossplane+ASO│  │    Vault     │      │ │
│  │  │ devops-system│  │resources-sys │  │ devops-system│      │ │
│  │  └──────────────┘  └──────────────┘  └──────────────┘      │ │
│  │                                                            │ │
│  │  ┌──────────────────────────────────────────────────────┐  │ │
│  │  │              Application Namespaces                  │  │ │
│  │  │ jarvix • gateway • observability • pipeline • security │  │ │
│  │  │            test • storage • ai                       │  │ │
│  │  └──────────────────────────────────────────────────────┘  │ │
│  └────────────────────────────────────────────────────────────┘ │
│                                                                 │
│  ┌───────────────┐  ┌────────────────-─┐  ┌─────────────────┐   │
│  │   Public IP   │  │ Service Principal│  │  Log Analytics  │   │
│  │   (ArgoCD)    │  │(Crossplane + ASO)│  │   Workspace     │   │
│  └───────────────┘  └─────────────────-┘  └─────────────────┘   │
└─────────────────────────────────────────────────────────────────┘

For detailed architecture documentation, see:

📦 Prerequisites

Azure CLI: Authenticated with appropriate subscription
Terraform: >= 1.3
kubectl: For Kubernetes cluster management
make: For using Makefile commands
Azure Subscription: With contributor permissions

Required Environment Variables

export ARM_SUBSCRIPTION_ID="your-subscription-id"

📚 Documentation

Setup & Getting Started

Quickstart Guide - Get up and running in minutes
Makefile Reference - All available Make commands

Guides

ArgoCD Public Endpoint - Expose ArgoCD publicly
Namespace Update - Managing Kubernetes namespaces

Architecture & Design

Reference

Crossplane README - Crossplane configuration details
AKS Foundation README - Terraform module documentation

📁 Project Structure

03-plat-eng-aks-foundation/
├── README.md                      # This file
├── makefile                       # Infrastructure management commands
├── .devcontainer/                 # Dev container configuration
├── .github/                       # CI/CD workflows
├── .checkov_config.yaml           # Checkov configuration
├── docs/                          # Documentation
│   ├── setup/                     # Setup and installation guides
│   │   └── quickstart.md
│   ├── guides/                    # How-to guides
│   │   ├── argocd-public-endpoint.md
│   │   └── namespace-update.md
│   ├── architecture/              # Architecture documentation
│   │   ├── crossplane-azure-workload-identity.md
│   │   └── crossplane-implementation-summary.md
│   └── reference/                 # Reference documentation
│       ├── makefile.md
│       └── crossplane-readme.md
├── aks-foundation/                # Terraform configuration
│   ├── main.tf                    # Main AKS cluster configuration
│   ├── variables.tf               # Input variables
│   ├── outputs.tf                 # Output values
│   ├── aks_addons_argocd.tf      # ArgoCD Helm installation
│   ├── aks_cluster_namespaces.tf # Kubernetes namespaces
│   ├── argocd_public_ingress.tf  # ArgoCD public endpoint
│   ├── aso_argocd.tf             # Azure Service Operator deployment
│   ├── crossplane_*.tf           # Crossplane configuration
│   ├── crossplane_managed_resources.tf
│   ├── extra_node_pool.tf
│   ├── role_assignments.tf
│   ├── locals.tf
│   ├── providers.tf
│   ├── versions.tf
│   ├── log_analytics.tf
│   ├── vault.tf                   # Vault installation
│   ├── unit-test-fixture/         # Unit test fixtures
│   └── ...                        # Additional configuration files

⚡ Quick Reference

Common Commands

# Initialize for dev environment
make init

# Plan changes
make plan

# Apply changes
make apply

# Full upgrade cycle
make upgrade

# Switch to production
make init ENV=prd

# Destroy infrastructure (⚠️ careful!)
make destroy

Access Services

# ArgoCD
URL: http://luciano-argocd.eastus.cloudapp.azure.com
Username: admin
Password: kubectl -n devops-system get secret argocd-initial-admin-secret \
  -o jsonpath="{.data.password}" | base64 -d

# Get AKS credentials
az aks get-credentials --name aks-test --resource-group aks-test-rg

# Check cluster status
kubectl get nodes
kubectl get pods -A

Terraform Outputs

# View all outputs
terraform -chdir=./aks-foundation output

# Specific outputs
terraform -chdir=./aks-foundation output argocd_public_fqdn
terraform -chdir=./aks-foundation output crossplane_identity_client_id # App Registration Client ID
terraform -chdir=./aks-foundation output aks_name

🔧 Configuration

Customize Variables

Edit aks-foundation/terraform.tfvars or create your own:

# Environment
location = "eastus"
resource_group_name = "aks-test-rg"

# AKS Configuration
kubernetes_version = "1.34"
agents_count = 3
agents_size = "Standard_D2s_v3"

# Crossplane
crossplane_version = "2.1.3"
crossplane_provider_family_azure_version = "v2.3.0"

# ArgoCD
# Configured via Helm values in aks_addons_argocd.tf

🛠️ Development

Local Development

Clone the repository

git clone <repository-url>
cd 03-plat-eng-aks-foundation

Set up Azure authentication

az login
export ARM_SUBSCRIPTION_ID=$(az account show --query id -o tsv)

Initialize Terraform
```
make init ENV=dev
```
Make changes and test
```
make plan
# Review changes
make apply
```

Testing Changes

# Validate Terraform configuration
terraform -chdir=./aks-foundation validate

# Format Terraform files
terraform -chdir=./aks-foundation fmt -recursive

# Check for issues with checkov
checkov -d aks-foundation/

🔐 Security Considerations

Service Principal: Crossplane and ASO use Azure AD Service Principal with client secret stored as Kubernetes Secret
RBAC: Kubernetes RBAC enabled with Azure AD integration
Network Policies: Configure as needed for your security requirements
Secrets Management: Vault for application secrets
Public Endpoints: ArgoCD exposed publicly - consider adding authentication/TLS

For production:

Enable TLS for ArgoCD
Configure network security groups
Implement Azure Firewall or Application Gateway
Enable Azure Policy for AKS
Configure backup and disaster recovery

📖 Additional Resources

🤝 Contributing

Contributions are welcome! Please feel free to submit a Pull Request.

Fork the repository
Create your feature branch (git checkout -b feature/amazing-feature)
Commit your changes (git commit -m 'Add some amazing feature')
Push to the branch (git push origin feature/amazing-feature)
Open a Pull Request

📝 License

This project is licensed under the MIT License - see the LICENSE file for details.

👥 Authors

Luciano Silva

🙏 Acknowledgments

Azure AKS team for excellent Kubernetes service
Crossplane community for cloud-native infrastructure management
ArgoCD community for GitOps excellence
Terraform community for infrastructure as code

Note: This is a reference implementation. Customize according to your organization's requirements and security policies.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

AKS Terraform Foundation

🚀 Quick Start

📋 Table of Contents

✨ Features

Infrastructure

Platform Services

Operations

🏗️ Architecture

📦 Prerequisites

Required Environment Variables

📚 Documentation

Setup & Getting Started

Guides

Architecture & Design

Reference

📁 Project Structure

⚡ Quick Reference

Common Commands

Access Services

Terraform Outputs

🔧 Configuration

Customize Variables

🛠️ Development

Local Development

Testing Changes

🔐 Security Considerations

📖 Additional Resources

🤝 Contributing

📝 License

👥 Authors

🙏 Acknowledgments

FilesExpand file tree

README.md

Latest commit

History

README.md

File metadata and controls

AKS Terraform Foundation

🚀 Quick Start

📋 Table of Contents

✨ Features

Infrastructure

Platform Services

Operations

🏗️ Architecture

📦 Prerequisites

Required Environment Variables

📚 Documentation

Setup & Getting Started

Guides

Architecture & Design

Reference

📁 Project Structure

⚡ Quick Reference

Common Commands

Access Services

Terraform Outputs

🔧 Configuration

Customize Variables

🛠️ Development

Local Development

Testing Changes

🔐 Security Considerations

📖 Additional Resources

🤝 Contributing

📝 License

👥 Authors

🙏 Acknowledgments