terraform-azurerm-aks

Deploys a Kubernetes cluster on AKS with monitoring support through Azure Log Analytics

This Terraform module deploys a Kubernetes cluster on Azure using AKS (Azure Kubernetes Service) and adds support for monitoring with Log Analytics.

Usage

resource "azurerm_resource_group" "example" {
  name     = "ask-resource-group"
  location = "eastus"
}

module "aks" {
  source              = "Azure/aks/azurerm"
  resource_group_name = azurerm_resource_group.example.name
  client_id           = "your-service-principal-client-appid"
  client_secret       = "your-service-principal-client-password"
  prefix              = "prefix"
}

The module supports some outputs that may be used to configure a kubernetes provider after deploying an AKS cluster.

provider "kubernetes" {
  host                   = "${module.aks.host}"
  client_certificate     = "${base64decode(module.aks.client_certificate)}"
  client_key             = "${base64decode(module.aks.client_key)}"
  cluster_ca_certificate = "${base64decode(module.aks.cluster_ca_certificate)}"
}

Test

Configurations

• Configure Terraform for Azure

We provide 2 ways to build, run, and test the module on a local development machine. Native (Mac/Linux) or Docker.

Native (Mac/Linux)

Prerequisites

• Ruby (~> 2.3)
• Bundler (~> 1.15)
• Terraform (~> 0.11.7)
• Golang (~> 1.10.3)

Environment setup

We provide simple script to quickly set up module development environment:

$ curl -sSL https://raw.githubusercontent.com/Azure/terramodtest/master/tool/env_setup.sh | sudo bash

Run test

Then simply run it in local shell:

$ cd $GOPATH/src/{directory_name}/
$ dep ensure

# set service principal
$ export ARM_CLIENT_ID="service-principal-client-id"
$ export ARM_CLIENT_SECRET="service-principal-client-secret"
$ export ARM_SUBSCRIPTION_ID="subscription-id"
$ export ARM_TENANT_ID="tenant-id"
$ export ARM_TEST_LOCATION="eastus"
$ export ARM_TEST_LOCATION_ALT="eastus2"
$ export ARM_TEST_LOCATION_ALT2="westus"

# set aks variables
$ export TF_VAR_client_id="service-principal-client-id"
$ export TF_VAR_client_secret="service-principal-client-secret"

# run test
$ go test -v ./test/ -timeout 45m

Docker

We provide a Dockerfile to build a new image based FROM the mcr.microsoft.com/terraform-test Docker hub image which adds additional tools / packages specific for this module (see Custom Image section). Alternatively use only the microsoft/terraform-test Docker hub image by using these instructions.

Prerequisites

• Docker

Custom Image

This builds the custom image:

$ docker build --build-arg BUILD_ARM_SUBSCRIPTION_ID=$ARM_SUBSCRIPTION_ID --build-arg BUILD_ARM_CLIENT_ID=$ARM_CLIENT_ID --build-arg BUILD_ARM_CLIENT_SECRET=$ARM_CLIENT_SECRET --build-arg BUILD_ARM_TENANT_ID=$ARM_TENANT_ID -t azure-aks .

This runs the build and unit tests:

$ docker run --rm azure-aks /bin/bash -c "bundle install && rake build"

This runs the end to end tests:

$ docker run --rm azure-aks /bin/bash -c "bundle install && rake e2e"

This runs the full tests:

$ docker run --rm azure-aks /bin/bash -c "bundle install && rake full"

Documentation

Requirements

Name	Version
terraform	>= 1.0.5

Providers

Name	Version
azurerm	n/a
random	n/a

Modules

Name	Source	Version
ssh-key	./modules/ssh-key	n/a

Resources

Name	Type
azurerm_kubernetes_cluster.primary	resource
azurerm_log_analytics_solution.main	resource
azurerm_log_analytics_workspace.main	resource
random_id.workspace	resource
azurerm_kubernetes_service_versions.current	data source

Inputs

Name	Description	Type	Default	Required
addon_profile	(Optional) addons profile for the kubernetes cluster	map(map(string))	{ "aci_connector_linux": { "enabled": false, "subnet_name": "default" }, "azure_policy": { "enabled": false }, "http_application_routing": { "enabled": false }, "ingress_application_gateway": { "enabled": false }, "kube_dashboard": { "enabled": false }, "oms_agent": { "enabled": true } }	no
admin_username	The username of the local administrator to be created on the Kubernetes cluster	string	"azureuser"	no
api_server_authorized_ip_ranges	(Optional) The IP ranges to allow for incoming traffic to the server nodes.	list(string)	[]	no
client_id	The Client ID (appId) for the Service Principal used for the AKS deployment	string	n/a	yes
client_secret	The Client Secret (password) for the Service Principal used for the AKS deployment	string	n/a	yes
default_node_pool	Parameters name: by default 'default' vm_size availability_zones enable_auto_scaling: (Optional) Should the Kubernetes Auto Scaler be enabled for this Node Pool? Defaults to false. enable_node_public_ip: (Optional) Should nodes in this Node Pool have a Public IP Address? Defaults to false. node_taints os_disk_size_gb type vnet_subnet_id min_count: minimun node count max_count: maximum node count, by default 30 node_count: initial node count max_pods: max count of node More information about node count and cidr ranges, visit https://docs.microsoft.com/en-us/azure/aks/configure-azure-cni	any	{ "availability_zones": "", "enable_auto_scaling": false, "enable_node_public_ip": false, "max_count": null, "max_pods": null, "min_count": null, "name": "default", "node_count": null, "node_taints": [], "os_disk_size_gb": "", "type": "", "vm_size": "Standard_DS2_v2", "vnet_subnet_id": "" }	no
k8s_version_include_preview	n/a	bool	false	no
kubernetes_version	(Optional) The kubernetes version, by default the latest version	string	""	no
log_analytics_workspace_sku	The SKU (pricing level) of the Log Analytics workspace. For new subscriptions the SKU should be set to PerGB2018	string	"PerGB2018"	no
log_retention_in_days	The retention period for the logs in days	number	30	no
network_profile	Network profile block, more information https://www.terraform.io/docs/providers/azurerm/r/kubernetes_cluster.html#network_profile	map(string)	n/a	yes
public_ssh_key	A custom ssh key to control access to the AKS cluster, if not provided going to generate a new one	string	""	no
rbac_enabled	(Required) Is Role Based Access Control Enabled? Changing this forces a new resource to be created.	bool	true	no
resource_group	Resource group name that the AKS will be created in	object({ name = string location = string })	n/a	yes
resource_prefix_name	The prefix for the resources created in the specified Azure Resource Group	any	n/a	yes
tags	Any tags that should be present on the Virtual Network resources	map(string)	{}	no

Outputs

Name	Description
aks_id	n/a
client_certificate	n/a
client_key	n/a
cluster_ca_certificate	n/a
host	n/a
location	n/a
node_resource_group	n/a
password	n/a
username	n/a

Authors

Originally created by Damien Caro and Malte Lantin

License

MIT

Contributing

This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit https://cla.microsoft.com.

When you submit a pull request, a CLA-bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., label, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact [email protected] with any additional questions or comments.