Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add msi_auth_for_monitoring_enabled #446

Merged
merged 8 commits into from
Oct 23, 2023
Merged

add msi_auth_for_monitoring_enabled #446

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
a4f6084
add msi_auth_for_monitoring_enabled
admincasper Sep 21, 2023
4b96aa2
update
admincasper Sep 21, 2023
218e831
fix
admincasper Sep 22, 2023
498e79a
remove nullable
admincasper Sep 22, 2023
f71d278
remove default = null
admincasper Oct 12, 2023
46b5902
set default = null again
admincasper Oct 12, 2023
7807414
remove defaults to null in description
admincasper Oct 13, 2023
7935982
pr-check and pre-commit
admincasper Oct 13, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -336,6 +336,7 @@ No modules.
| <a name="input_maintenance_window_node_os"></a> [maintenance\_window\_node\_os](#input\_maintenance\_window\_node\_os) | - `day_of_month` -<br>- `day_of_week` - (Optional) The day of the week for the maintenance run. Options are `Monday`, `Tuesday`, `Wednesday`, `Thurday`, `Friday`, `Saturday` and `Sunday`. Required in combination with weekly frequency.<br>- `duration` - (Required) The duration of the window for maintenance to run in hours.<br>- `frequency` - (Required) Frequency of maintenance. Possible options are `Daily`, `Weekly`, `AbsoluteMonthly` and `RelativeMonthly`.<br>- `interval` - (Required) The interval for maintenance runs. Depending on the frequency this interval is week or month based.<br>- `start_date` - (Optional) The date on which the maintenance window begins to take effect.<br>- `start_time` - (Optional) The time for maintenance to begin, based on the timezone determined by `utc_offset`. Format is `HH:mm`.<br>- `utc_offset` - (Optional) Used to determine the timezone for cluster maintenance.<br>- `week_index` - (Optional) The week in the month used for the maintenance run. Options are `First`, `Second`, `Third`, `Fourth`, and `Last`.<br><br>---<br>`not_allowed` block supports the following:<br>- `end` - (Required) The end of a time span, formatted as an RFC3339 string.<br>- `start` - (Required) The start of a time span, formatted as an RFC3339 string. | <pre>object({<br> day_of_month = optional(number)<br> day_of_week = optional(string)<br> duration = number<br> frequency = string<br> interval = number<br> start_date = optional(string)<br> start_time = optional(string)<br> utc_offset = optional(string)<br> week_index = optional(string)<br> not_allowed = optional(set(object({<br> end = string<br> start = string<br> })))<br> })</pre> | `null` | no |
| <a name="input_microsoft_defender_enabled"></a> [microsoft\_defender\_enabled](#input\_microsoft\_defender\_enabled) | (Optional) Is Microsoft Defender on the cluster enabled? Requires `var.log_analytics_workspace_enabled` to be `true` to set this variable to `true`. | `bool` | `false` | no |
| <a name="input_monitor_metrics"></a> [monitor\_metrics](#input\_monitor\_metrics) | (Optional) Specifies a Prometheus add-on profile for the Kubernetes Cluster<br>object({<br> annotations\_allowed = "(Optional) Specifies a comma-separated list of Kubernetes annotation keys that will be used in the resource's labels metric."<br> labels\_allowed = "(Optional) Specifies a Comma-separated list of additional Kubernetes label keys that will be used in the resource's labels metric."<br>}) | <pre>object({<br> annotations_allowed = optional(string)<br> labels_allowed = optional(string)<br> })</pre> | `null` | no |
| <a name="input_msi_auth_for_monitoring_enabled"></a> [msi\_auth\_for\_monitoring\_enabled](#input\_msi\_auth\_for\_monitoring\_enabled) | (Optional) Is managed identity authentication for monitoring enabled? Defaults to `false` | `bool` | `false` | no |
| <a name="input_net_profile_dns_service_ip"></a> [net\_profile\_dns\_service\_ip](#input\_net\_profile\_dns\_service\_ip) | (Optional) IP address within the Kubernetes service address range that will be used by cluster service discovery (kube-dns). Changing this forces a new resource to be created. | `string` | `null` | no |
| <a name="input_net_profile_outbound_type"></a> [net\_profile\_outbound\_type](#input\_net\_profile\_outbound\_type) | (Optional) The outbound (egress) routing method which should be used for this Kubernetes Cluster. Possible values are loadBalancer and userDefinedRouting. Defaults to loadBalancer. | `string` | `"loadBalancer"` | no |
| <a name="input_net_profile_pod_cidr"></a> [net\_profile\_pod\_cidr](#input\_net\_profile\_pod\_cidr) | (Optional) The CIDR to use for pod IP addresses. This field can only be set when network\_plugin is set to kubenet. Changing this forces a new resource to be created. | `string` | `null` | no |
Expand Down
3 changes: 2 additions & 1 deletion main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -445,7 +445,8 @@ resource "azurerm_kubernetes_cluster" "main" {
for_each = var.log_analytics_workspace_enabled ? ["oms_agent"] : []
lonegunmanb marked this conversation as resolved.
Show resolved Hide resolved

content {
log_analytics_workspace_id = local.log_analytics_workspace.id
log_analytics_workspace_id = local.log_analytics_workspace.id
msi_auth_for_monitoring_enabled = var.msi_auth_for_monitoring_enabled
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is already present in provider version 3.47.0:
hashicorp/terraform-provider-azurerm#20757

No need to bump versions. All good.

}
}
dynamic "service_principal" {
Expand Down
7 changes: 7 additions & 0 deletions variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -689,6 +689,13 @@ variable "maintenance_window_node_os" {
EOT
}

variable "msi_auth_for_monitoring_enabled" {
type = bool
default = false
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why you have the default at false and not null ?

https://github.com/hashicorp/terraform-provider-azurerm/blob/8078e1bcdb8503e6c3a581f91aa3b201c4545f5c/internal/services/containers/kubernetes_addons.go#L121

Copy link
Contributor Author

@admincasper admincasper Sep 21, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When running module aks with log_analytics_workspace_enabled = true without specifying msi_auth_for_monitoring_enabled the value is false by default. I checked by running az aks addon show --addon monitoring.

So I thought default value was false.

Copy link
Contributor Author

@admincasper admincasper Sep 21, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is weird, because enabling monitoring addon with az aks CLI the default value is True..
image

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also is nullable = false, I interpreted it as only possible values should be either False or True? Correct me if I'm wrong

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree with @zioproto, according to the provider schema, this msi_auth_for_monitoring_enabled argument's default value is null, setting default value to false could cause a configuration drift. Would you please set the default value to null?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@admincasper It is often the case that Terraform has true false and null. But when you read back from the azurerm API the values are just true or false. Now we are interested if this value is explicit in the Terraform state as false. I hope this clarifies why you dont get back null from your az aks show operation.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah thanks for clarifying! I've pushed up the changes.

description = "(Optional) Is managed identity authentication for monitoring enabled? Defaults to `false`"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We can remove "Defaults to false" here

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@admincasper on line 695 at the end of the description string, can you remove:

Defaults to `false`

Thanks

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@admincasper on line 695 at the end of the description string, can you remove:

Defaults to `false`

Thanks

@zioproto I think it needs to default to null. So I changed it to null.

I think everything should be ok now then?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@admincasper line 694 is ok, the correct default is null. don't touch it. In line 695 you have to remove the last statement in the description

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@zioproto Done. Removed "Defaults to 'null'" in description.

nullable = false
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This variable could be set to null, we can just remove this setting.

}

variable "microsoft_defender_enabled" {
type = bool
default = false
Expand Down