Skip to content

wigo4it/module-tf-azure-aks

BranchesTags

Repository files navigation

Terraform module: Haven

This module sets up all needed to run a Haven-compliant Kubernetes cluster in Azure. It includes networking, DNS, AKS and Workload Identity configuration.

Requirements

Name Version
terraform ~> 1.11
azurerm ~> 4.58

Providers

Name Version
azurerm 4.58.0

Modules

No modules.

Resources

Name Type
azurerm_kubernetes_cluster.default resource
azurerm_kubernetes_cluster_node_pool.userpool resource
azurerm_log_analytics_workspace.default resource
azurerm_monitor_diagnostic_setting.aks_audit_logs resource
azurerm_public_ip.egress_ipv4 resource
azurerm_public_ip.ingress_ipv4 resource
azurerm_role_assignment.aks_identity_network_contributor resource
azurerm_role_assignment.aks_identity_private_dns_zone_contributor resource
azurerm_subnet.default resource
azurerm_user_assigned_identity.aks_identity resource
azurerm_virtual_network.default resource
azurerm_virtual_network_peering.default resource
azurerm_subnet.existing data source

Inputs

Name Description Type Default Required
aks_additional_node_pools (Optional) Map of additional node pools to create for the AKS cluster. 
map(object({
    vm_size                        = string
    node_count                     = optional(number, 1)
    zones                          = optional(list(string), ["1", "3"])
    mode                           = optional(string, "System")
    max_pods                       = optional(number, 120)
    labels                         = optional(map(string), {})
    taints                         = optional(list(string), [])
    spot_node                      = optional(bool, false)
    spot_max_price                 = optional(number, null)
    eviction_policy                = optional(string, null)
    node_os                        = optional(string, null)
    os_disk_size_gb                = optional(number, null)
    os_disk_type                   = optional(string, null)
    cluster_auto_scaling_enabled   = optional(bool, false)
    cluster_auto_scaling_min_count = optional(number, null)
    cluster_auto_scaling_max_count = optional(number, null)
    node_public_ip_enabled         = optional(bool, false)
    upgrade_settings = optional(object({
      drain_timeout_in_minutes = number
      max_surge                = string
      }), {
      drain_timeout_in_minutes = 5
      max_surge                = "10%"
    })
  }))
 {} no
aks_audit_categories (Optional) List of audit categories to enable for the AKS cluster. This is recommended for security compliance. list(string) 
[
  "kube-apiserver",
  "kube-audit",
  "kube-audit-admin",
  "kube-controller-manager",
  "kube-scheduler",
  "cluster-autoscaler",
  "guard",
  "csi-azuredisk-controller",
  "csi-azurefile-controller",
  "csi-snapshot-controller"
]
 no
aks_authorized_ip_ranges (Optional) List of authorized IP ranges for API server access. For security compliance, specify your organization's IP ranges. list(string) 
[
  "10.0.0.0/8",
  "172.16.0.0/12",
  "192.168.0.0/16"
]
 no
aks_azure_active_directory_role_based_access_control (Optional) Azure Active Directory integration for RBAC. Required when local_account_disabled is true. 
object({
    admin_group_object_ids = list(string)
    azure_rbac_enabled     = bool
    tenant_id              = optional(string)
  })
 null no
aks_default_node_pool (Required) Configuration for the default node pool in the AKS cluster. 
object({
    name                           = optional(string, "default")
    vm_size                        = string
    node_count                     = optional(number, 1)
    zones                          = optional(list(string), ["1", "2", "3"])
    mode                           = optional(string, "System")
    max_pods                       = optional(number, 120)
    labels                         = optional(map(string), {})
    spot_node                      = optional(bool, false)
    spot_max_price                 = optional(number, null)
    eviction_policy                = optional(string, null)
    node_os                        = optional(string, null)
    os_disk_size_gb                = optional(number, null)
    os_disk_type                   = optional(string, null)
    cluster_auto_scaling_enabled   = optional(bool, false)
    cluster_auto_scaling_min_count = optional(number, null)
    cluster_auto_scaling_max_count = optional(number, null)
    node_public_ip_enabled         = optional(bool, false)
    only_critical_addons_enabled   = optional(bool, false)
    upgrade_settings = optional(object({
      drain_timeout_in_minutes = number
      max_surge                = string
      }), {
      drain_timeout_in_minutes = 5
      max_surge                = "10%"
    })
  })
 n/a yes
automatic_upgrade_channel (Optional) The automatic upgrade channel for the AKS cluster. string "patch" no
azure_policy_enabled (Optional) Should the Azure Policy Add-On be enabled? For more details please visit Understand Azure Policy for Azure Kubernetes Service. Defaults to true. bool true no
disk_encryption_set_id (Optional) The ID of the Disk Encryption Set which should be used for the Nodes and Volumes. More information can be found in the documentation. string null no
dns_prefix (Optional) The DNS prefix for the AKS cluster. This will be used to create the DNS records. string null no
enable_audit_logs (Optional) Enable audit logs for security compliance. This is recommended for production clusters. bool true no
existing_log_analytics_workspace_id (Optional) ID of existing Log Analytics workspace to use for AKS monitoring. If not provided, a new workspace will be created. string null no
image_cleaner_enabled (Optional) Enable image cleaner to remove unused images from the AKS cluster. bool true no
image_cleaner_interval_hours (Optional) Interval in hours for the image cleaner to run. number 48 no
key_vault_secrets_provider (Optional) Key Vault Secrets Provider configuration for enhanced secret management. 
object({
    secret_rotation_enabled  = bool
    secret_rotation_interval = string
  })
 
{
  "secret_rotation_enabled": true,
  "secret_rotation_interval": "2m"
}
 no
kubernetes_version (Required) The Kubernetes version to use for the AKS cluster. string n/a yes
loadbalancer_ips (Optional) The loadbalancer IP address(es) of the public ingress controller. If not provided, an azurerm_public_ip will be created. list(string) [] no
local_account_disabled (Optional) Disable local accounts for security compliance. This is recommended. bool false no
location (Required) Azure region where resources will be created. string n/a yes
log_analytics_destination_type (Optional) Possible values are AzureDiagnostics and Dedicated. When set to Dedicated, logs sent to a Log Analytics workspace will go into resource specific tables, instead of the legacy AzureDiagnostics table. string "Dedicated" no
microsoft_defender_enabled (Optional) Enable Microsoft Defender for Containers bool false no
name (Required) The name of the AKS cluster. string n/a yes
network_profile (Optional) Network configuration for the AKS cluster. To use Azure CNI powered by Cilium, set network_data_plane to 'cilium', network_policy to 'cilium', and either network_plugin_mode to 'overlay' or configure pod_subnet_id on the default node pool. 
object({
    network_plugin      = optional(string, "azure")
    network_policy      = optional(string, "calico")
    network_data_plane  = optional(string, null)
    network_plugin_mode = optional(string, null)
    pod_cidr            = optional(string, null)
    load_balancer_sku   = optional(string, "standard")
    ip_versions         = optional(list(string), ["IPv4"])
    advanced_networking = optional(object({
      observability_enabled = optional(bool, false)
      security_enabled      = optional(bool, false)
    }), null)
  })
 
{
  "ip_versions": [
    "IPv4"
  ],
  "load_balancer_sku": "standard",
  "network_plugin": "azure",
  "network_policy": "calico"
}
 no
oidc_issuer_enabled (Optional) Enable OIDC issuer for the AKS cluster. bool true no
private_cluster_enabled (Optional) Enable private cluster mode for the AKS cluster. bool false no
private_dns_zone_id (Optional) ID of the private DNS zone to use for the AKS cluster. Required if private_cluster_enabled is true. string null no
resource_group_name (Required) Name of the resource group where resources will be created. string n/a yes
role_based_access_control_enabled (Optional) Enable role-based access control (RBAC) for the AKS cluster. This is recommended for security compliance. bool true no
sku_tier (Optional) The SKU tier for the AKS cluster. Standard is recommended for production Haven clusters. string "Standard" no
storage_profile (Optional) Storage profile configuration for the AKS cluster. 
object({
    blob_driver_enabled         = bool
    disk_driver_enabled         = bool
    file_driver_enabled         = bool
    snapshot_controller_enabled = bool
  })
 
{
  "blob_driver_enabled": false,
  "disk_driver_enabled": true,
  "file_driver_enabled": true,
  "snapshot_controller_enabled": true
}
 no
tags (Optional) A map of tags to assign to all resources. map(string) 
{
  "deployment_method": "terraform",
  "module_name": "module-haven-cluster-azure-digilab"
}
 no
virtual_network (Required) Virtual network configuration for the AKS cluster. If is_existing is true, id must be provided. 
object({
    is_existing         = optional(bool, false)
    id                  = optional(string)
    name                = string
    resource_group_name = string
    address_space       = optional(list(string), [])
    peerings            = optional(list(string), [])
    subnet = optional(object({
      is_existing       = optional(bool, false)
      name              = string
      address_prefixes  = optional(list(string), [])
      service_endpoints = optional(list(string), ["Microsoft.Storage", "Microsoft.KeyVault", "Microsoft.ContainerRegistry"])
    }))
  })
 n/a yes
workload_autoscaler_profile (Optional) Workload autoscaler profile for the AKS cluster. 
object({
    keda_enabled                    = bool
    vertical_pod_autoscaler_enabled = bool
  })
 
{
  "keda_enabled": false,
  "vertical_pod_autoscaler_enabled": false
}
 no
workload_identity_enabled (Optional) Enable workload identity for the AKS cluster. bool true no

Outputs

Name Description
cluster_name Name of the AKS cluster
cluster_oidc_issuer_url n/a
kubeconfig_raw Raw kubeconfig for the AKS cluster
kubelet_identity The kubelet identity of the AKS cluster used for pulling container images
load_balancer_ips n/a
subnet_id n/a

Examples

This module includes comprehensive examples to help you get started:

  • minimal: A complete AKS cluster with all infrastructure created by the module
  • existing-infrastructure: AKS cluster using existing VNet, DNS, and Log Analytics workspace

See the CONTRIBUTING.md file for detailed usage instructions and best practices.

Testing

This module includes a comprehensive integration test suite that validates both examples:

Quick Test

# Test the minimal example
cd examples && ./integration-test.sh minimal

# Test the existing-infrastructure example
cd examples && ./integration-test.sh existing-infrastructure

# Test all examples
cd examples && ./integration-test.sh all

Advanced Testing Options

# Dry run (no actual deployment)
DRY_RUN=true ./integration-test.sh all

# Skip infrastructure destruction (for debugging)
SKIP_DESTROY=true ./integration-test.sh minimal

# CI/CD mode (no colors, structured output)
CI_MODE=true ./integration-test.sh all

The integration test suite:

  • Validates Terraform configuration and formatting
  • Deploys the complete infrastructure
  • Tests AKS cluster connectivity and basic operations
  • Validates monitoring integration
  • Tests DNS configuration (if applicable)
  • Generates GitLab CI-compatible JUnit XML reports
  • Automatically destroys infrastructure after testing

Test Reports

After running tests, you'll find detailed reports in the test-results/ directory:

  • integration-test-report.xml - JUnit XML report for CI/CD integration
  • integration-test.log - Detailed execution log
  • summary.txt - Human-readable test summary

About

Wigo4it AKS module

Resources

Readme

License

EUPL-1.2 license

Contributing

Contributing
Activity
Custom properties

Stars

1 star

Watchers

0 watching

Forks

0 forks
Report repository

Releases 6

v0.1.0 Latest
Mar 30, 2026
+ 5 releases

Packages

 
 
 

Contributors

Languages