Fix 301-aks-enterprise

quickstart/301-aks-enterprise/aks.tf

@@ -1,36 +1,36 @@
+data "azurerm_client_config" "current" {}
+
 resource "azurerm_kubernetes_cluster" "default" {
   name                = "${var.name}-aks"
-  location            = "${azurerm_resource_group.default.location}"
-  resource_group_name = "${azurerm_resource_group.default.name}"
+  location            = azurerm_resource_group.default.location
+  resource_group_name = azurerm_resource_group.default.name
   dns_prefix          = "${var.dns_prefix}-${var.name}-aks-${var.environment}"
   depends_on          = ["azurerm_role_assignment.default"]
 
-  agent_pool_profile {
+  default_node_pool {
     name            = "default"
-    count           = "${var.node_count}"
-    vm_size         = "${var.node_type}"
-    os_type         = "${var.node_os}"
+    node_count      = var.node_count
+    vm_size         = var.node_type
     os_disk_size_gb = 30
-    vnet_subnet_id  = "${azurerm_subnet.aks.id}"
+    vnet_subnet_id  = azurerm_subnet.aks.id
   }
 
   service_principal {
-    client_id     = "${azuread_application.default.application_id}"
-    client_secret = "${azuread_service_principal_password.default.value}"
+    client_id     = azuread_application.default.application_id
+    client_secret = azuread_service_principal_password.default.value
   }
 
-  role_based_access_control {
-    enabled = true
+  azure_active_directory_role_based_access_control {
+    tenant_id          = data.azurerm_client_config.current.tenant_id
+    managed            = true
+    azure_rbac_enabled = true
   }
 
   network_profile {
     network_plugin = "azure"
   }
 
-  addon_profile {
-    oms_agent {
-      enabled                    = true
-      log_analytics_workspace_id = "${azurerm_log_analytics_workspace.default.id}"
-    }
+  oms_agent {
+    log_analytics_workspace_id = azurerm_log_analytics_workspace.default.id
   }
 }

quickstart/301-aks-enterprise/azuread.tf

@@ -1,9 +1,9 @@
 resource "azuread_application" "default" {
-  name = "${var.name}-${var.environment}"
+  display_name = "${var.name}-${var.environment}"
 }
 
 resource "azuread_service_principal" "default" {
-  application_id = "${azuread_application.default.application_id}"
+  application_id = azuread_application.default.application_id
 }
 
 resource "random_string" "password" {
@@ -12,13 +12,12 @@ resource "random_string" "password" {
 }
 
 resource "azuread_service_principal_password" "default" {
-  service_principal_id = "${azuread_service_principal.default.id}"
-  value                = "${random_string.password.result}"
+  service_principal_id = azuread_service_principal.default.id
   end_date             = "2099-01-01T01:00:00Z"
 }
 
 resource "azurerm_role_assignment" "default" {
   scope                = "${data.azurerm_subscription.current.id}/resourceGroups/${azurerm_resource_group.default.name}"
   role_definition_name = "Network Contributor"
-  principal_id         = "${azuread_service_principal.default.id}"
+  principal_id         = azuread_service_principal.default.id
 }

quickstart/301-aks-enterprise/helm.tf

@@ -1,14 +1,12 @@
 # Define the helm provider to use the AKS cluster
 provider "helm" {
   kubernetes {
-    host = "${azurerm_kubernetes_cluster.default.kube_config.0.host}"
+    host = azurerm_kubernetes_cluster.default.kube_config.0.host
 
-    client_certificate     = "${base64decode(azurerm_kubernetes_cluster.default.kube_config.0.client_certificate)}"
-    client_key             = "${base64decode(azurerm_kubernetes_cluster.default.kube_config.0.client_key)}"
-    cluster_ca_certificate = "${base64decode(azurerm_kubernetes_cluster.default.kube_config.0.cluster_ca_certificate)}"
+    client_certificate     = base64decode(azurerm_kubernetes_cluster.default.kube_config.0.client_certificate)
+    client_key             = base64decode(azurerm_kubernetes_cluster.default.kube_config.0.client_key)
+    cluster_ca_certificate = base64decode(azurerm_kubernetes_cluster.default.kube_config.0.cluster_ca_certificate)
   }
-
-  service_account = "tiller"
 }
 
 # Install a load-balanced nginx-ingress controller onto the cluster
@@ -27,13 +25,9 @@ controller:
       service.beta.kubernetes.io/azure-load-balancer-internal-subnet: "${azurerm_subnet.ingress.name}"
 EOF
   ]
-
-  depends_on = ["kubernetes_cluster_role_binding.tiller"]
 }
 
 resource "helm_release" "ghost" {
-  name      = "ghost-blog"
-  chart     = "bitnami/ghost"
-
-  depends_on = ["kubernetes_cluster_role_binding.tiller"]
+  name  = "ghost-blog"
+  chart = "bitnami/ghost"
 }

quickstart/301-aks-enterprise/kubernetes.tf

@@ -1,37 +1,14 @@
 # Define Kubernetes provider to use the AKS cluster
 provider "kubernetes" {
-  host = "${azurerm_kubernetes_cluster.default.kube_config.0.host}"
+  host = azurerm_kubernetes_cluster.default.kube_config.0.host
 
-  client_certificate     = "${base64decode(azurerm_kubernetes_cluster.default.kube_config.0.client_certificate)}"
-  client_key             = "${base64decode(azurerm_kubernetes_cluster.default.kube_config.0.client_key)}"
-  cluster_ca_certificate = "${base64decode(azurerm_kubernetes_cluster.default.kube_config.0.cluster_ca_certificate)}"
+  client_certificate     = base64decode(azurerm_kubernetes_cluster.default.kube_config.0.client_certificate)
+  client_key             = base64decode(azurerm_kubernetes_cluster.default.kube_config.0.client_key)
+  cluster_ca_certificate = base64decode(azurerm_kubernetes_cluster.default.kube_config.0.cluster_ca_certificate)
 }
 
-# Create a service account for the Helm Tiller
-resource "kubernetes_service_account" "tiller" {
-  metadata {
-    name      = "tiller"
-    namespace = "kube-system"
-  }
-}
-
-# Grant cluster-admin rights to the Tiller Service Account
-resource "kubernetes_cluster_role_binding" "tiller" {
-  metadata {
-    name = "${kubernetes_service_account.tiller.metadata.0.name}"
-  }
-
-  role_ref {
-    api_group = "rbac.authorization.k8s.io"
-    kind      = "ClusterRole"
-    name      = "cluster-admin"
-  }
-
-  subject {
-    kind      = "ServiceAccount"
-    name      = "${kubernetes_service_account.tiller.metadata.0.name}"
-    namespace = "kube-system"
-  }
+provider "azurerm" {
+  features {}
 }
 
 # Grant cluster-admin rights to the default service account

quickstart/301-aks-enterprise/monitoring.tf

@@ -1,24 +1,24 @@
 resource "azurerm_application_insights" "default" {
   name                = "${var.name}-${var.environment}-ai"
-  location            = "${azurerm_resource_group.default.location}"
-  resource_group_name = "${azurerm_resource_group.default.name}"
-  application_type    = "Web"
+  location            = azurerm_resource_group.default.location
+  resource_group_name = azurerm_resource_group.default.name
+  application_type    = "web"
 }
 
 resource "azurerm_log_analytics_workspace" "default" {
   name                = "${var.name}-${var.environment}-law"
-  location            = "${azurerm_resource_group.default.location}"
-  resource_group_name = "${azurerm_resource_group.default.name}"
+  location            = azurerm_resource_group.default.location
+  resource_group_name = azurerm_resource_group.default.name
   sku                 = "PerGB2018"
   retention_in_days   = 30
 }
 
 resource "azurerm_log_analytics_solution" "default" {
   solution_name         = "ContainerInsights"
-  location              = "${azurerm_log_analytics_workspace.default.location}"
-  resource_group_name   = "${azurerm_resource_group.default.name}"
-  workspace_resource_id = "${azurerm_log_analytics_workspace.default.id}"
-  workspace_name        = "${azurerm_log_analytics_workspace.default.name}"
+  location              = azurerm_log_analytics_workspace.default.location
+  resource_group_name   = azurerm_resource_group.default.name
+  workspace_resource_id = azurerm_log_analytics_workspace.default.id
+  workspace_name        = azurerm_log_analytics_workspace.default.name
 
   plan {
     publisher = "Microsoft"