fix(terraform): default to a Kubernetes version AKS still builds, and stop recreating built-in databases

Two failures from a real apply that were previously only worked around in the
consuming root.

AKS refused the cluster with K8sVersionNotSupported: 1.33 has aged out of
standard support into Long-Term-Support only, and AKS will not build on an
LTS-only version without the cluster opting into LTS first. The default moves to
1.34, and the description now says where the line is and how to check it, since
this recurs every time a version ages out.

PostgreSQL Flexible Server ships a database called postgres, so asking Terraform
to create one by that name failed with 'already exists' -- and postgres was the
module default, meaning the default configuration could not apply at all.
Naming a database the server ships is now read as 'use the one that is there'
rather than as an error, and the output reports what Onyx connects to either
way.

Neither is visible to the mocked tests: one is a service-side support policy and
the other is a resource the server creates on its own.

Author: justin-tahara

deployment/terraform/modules/azure/aks/tests/aks.tftest.hcl

@@ -47,6 +47,17 @@ run "defaults" {
   }
 }
 
+run "the_default_version_is_one_azure_still_builds" {
+  command = plan
+
+  # Versions age out of standard support into Long-Term-Support only, and AKS
+  # then refuses to build a cluster on them. 1.33 crossed that line.
+  assert {
+    condition     = azurerm_kubernetes_cluster.this.kubernetes_version == "1.34"
+    error_message = "The default version must be one AKS will still build without an LTS opt-in."
+  }
+}
+
 run "dns_service_ip_is_derived_from_the_service_range" {
   command = plan
 

deployment/terraform/modules/azure/aks/variables.tf

@@ -15,8 +15,8 @@ variable "location" {
 
 variable "kubernetes_version" {
   type        = string
-  description = "Kubernetes version for the control plane. Move one minor at a time."
-  default     = "1.33"
+  description = "Kubernetes version for the control plane. Move one minor at a time. Versions age out of standard support and become Long-Term-Support only, at which point AKS refuses to build a cluster on them: check with az aks get-versions."
+  default     = "1.34"
 }
 
 variable "subnet_id" {

deployment/terraform/modules/azure/onyx/variables.tf

@@ -283,8 +283,8 @@ variable "redis_high_availability_enabled" {
 
 variable "kubernetes_version" {
   type        = string
-  description = "Kubernetes version for the control plane"
-  default     = "1.33"
+  description = "Kubernetes version for the control plane Versions age out of standard support and become Long-Term-Support only, at which point AKS refuses to build a cluster on them: check with az aks get-versions."
+  default     = "1.34"
 }
 
 variable "main_node_vm_size" {

deployment/terraform/modules/azure/postgres/main.tf

@@ -1,4 +1,10 @@
 locals {
+  # Flexible Server ships these already. Asking Terraform to create one by any
+  # of these names fails with "already exists", so naming one is read as "use
+  # the database that is already there" rather than as an error.
+  builtin_databases = ["postgres", "azure_maintenance", "azure_sys"]
+  create_database   = !contains(local.builtin_databases, var.db_name)
+
   create_private_dns_zone = var.private_dns_zone_id == null
   private_dns_zone_id     = local.create_private_dns_zone ? azurerm_private_dns_zone.this[0].id : var.private_dns_zone_id
 
@@ -115,6 +121,8 @@ resource "azurerm_postgresql_flexible_server_active_directory_administrator" "th
 }
 
 resource "azurerm_postgresql_flexible_server_database" "this" {
+  count = local.create_database ? 1 : 0
+
   name      = var.db_name
   server_id = azurerm_postgresql_flexible_server.this.id
   charset   = "UTF8"

deployment/terraform/modules/azure/postgres/outputs.tf

@@ -18,9 +18,11 @@ output "port" {
   value       = 5432
 }
 
+# Reported from the variable rather than the resource, because a database the
+# server ships is not one this module creates.
 output "db_name" {
-  description = "Name of the database created on the server"
-  value       = azurerm_postgresql_flexible_server_database.this.name
+  description = "Name of the database Onyx connects to, whether this module created it or the server shipped it"
+  value       = var.db_name
 }
 
 output "username" {

deployment/terraform/modules/azure/postgres/tests/postgres.tftest.hcl

@@ -152,6 +152,39 @@ run "an_existing_dns_zone_is_reused" {
   }
 }
 
+run "a_database_the_server_ships_is_not_recreated" {
+  command = plan
+
+  # Flexible Server already has one called "postgres"; creating it fails with
+  # "already exists".
+  variables {
+    db_name = "postgres"
+  }
+
+  assert {
+    condition     = length(azurerm_postgresql_flexible_server_database.this) == 0
+    error_message = "Naming a built-in database should mean use it, not create it."
+  }
+
+  assert {
+    condition     = output.db_name == "postgres"
+    error_message = "The output still reports what Onyx connects to."
+  }
+}
+
+run "a_database_of_our_own_is_created" {
+  command = plan
+
+  variables {
+    db_name = "onyx"
+  }
+
+  assert {
+    condition     = length(azurerm_postgresql_flexible_server_database.this) == 1
+    error_message = "A name the server does not ship should be created."
+  }
+}
+
 run "no_entra_administrator_by_default" {
   command = plan