[Module] managedClusters - Add ingressProfile support for AKS

modules/container-service/managed-clusters/.bicep/nested_roleAssignments.bicep

@@ -63,7 +63,7 @@ var builtInRoleNames = {
   'User Access Administrator': subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')
 }
 
-resource managedCluster 'Microsoft.ContainerService/managedClusters@2022-11-01' existing = {
+resource managedCluster 'Microsoft.ContainerService/managedClusters@2023-03-02-preview' existing = {
   name: last(split(resourceId, '/'))!
 }
 

modules/container-service/managed-clusters/.test/azure/dependencies.bicep

@@ -16,6 +16,9 @@ param keyVaultName string
 @description('Required. The name of the Proximity Placement Group to create.')
 param proximityPlacementGroupName string
 
+@description('Required. The name of the DNS Zone to create.')
+param dnsZoneName string
+
 resource virtualNetwork 'Microsoft.Network/virtualNetworks@2022-09-01' = {
     name: virtualNetworkName
     location: location
@@ -118,6 +121,11 @@ output subnetResourceIds array = [
     virtualNetwork.properties.subnets[2].id
 ]
 
+resource dnsZone 'Microsoft.Network/dnsZones@2018-05-01' = {
+    name: dnsZoneName
+    location: 'global'
+}
+
 @description('The principal ID of the created Managed Identity.')
 output managedIdentityPrincipalId string = managedIdentity.properties.principalId
 
@@ -126,3 +134,6 @@ output diskEncryptionSetResourceId string = diskEncryptionSet.id
 
 @description('The resource ID of the created Proximity Placement Group.')
 output proximityPlacementGroupResourceId string = proximityPlacementGroup.id
+
+@description('The resource ID of the created DNS Zone.')
+output dnsZoneResourceId string = dnsZone.id

modules/container-service/managed-clusters/.test/azure/main.test.bicep

@@ -44,6 +44,7 @@ module nestedDependencies 'dependencies.bicep' = {
     proximityPlacementGroupName: 'dep-${namePrefix}-ppg-${serviceShort}'
     // Adding base time to make the name unique as purge protection must be enabled (but may not be longer than 24 characters total)
     keyVaultName: 'dep-${namePrefix}-kv-${serviceShort}-${substring(uniqueString(baseTime), 0, 3)}'
+    dnsZoneName: 'dep-${namePrefix}-dns-${serviceShort}.com'
   }
 }
 

modules/container-service/managed-clusters/.test/kubenet/dependencies.bicep

@@ -4,13 +4,24 @@ param location string = resourceGroup().location
 @description('Required. The name of the Managed Identity to create.')
 param managedIdentityName string
 
+@description('Required. The name of the DNS Zone to create.')
+param dnsZoneName string
+
 resource managedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = {
     name: managedIdentityName
     location: location
 }
 
+resource dnsZone 'Microsoft.Network/dnsZones@2018-05-01' = {
+    name: dnsZoneName
+    location: 'global'
+}
+
 @description('The principal ID of the created Managed Identity.')
 output managedIdentityPrincipalId string = managedIdentity.properties.principalId
 
 @description('The resource ID of the created Managed Identity.')
 output managedIdentityResourceId string = managedIdentity.id
+
+@description('The resource ID of the created DNS Zone.')
+output dnsZoneResourceId string = dnsZone.id

modules/container-service/managed-clusters/.test/kubenet/main.test.bicep

@@ -36,6 +36,7 @@ module nestedDependencies 'dependencies.bicep' = {
   name: '${uniqueString(deployment().name, location)}-nestedDependencies'
   params: {
     managedIdentityName: 'dep-${namePrefix}-msi-${serviceShort}'
+    dnsZoneName: 'dep-${namePrefix}-dns-${serviceShort}.com'
   }
 }
 

modules/container-service/managed-clusters/.test/min/main.test.bicep

@@ -17,9 +17,6 @@ param serviceShort string = 'csmmin'
 @description('Optional. Enable telemetry via a Globally Unique Identifier (GUID).')
 param enableDefaultTelemetry bool = true
 
-@description('Optional. A token to inject into the name of each resource.')
-param namePrefix string = '[[namePrefix]]'
-
 // ============ //
 // Dependencies //
 // ============ //

modules/container-service/managed-clusters/README.md

@@ -16,8 +16,8 @@ This module deploys an Azure Kubernetes Service (AKS) Managed Cluster.
 | :-- | :-- |
 | `Microsoft.Authorization/locks` | [2020-05-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Authorization/2020-05-01/locks) |
 | `Microsoft.Authorization/roleAssignments` | [2022-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Authorization/2022-04-01/roleAssignments) |
-| `Microsoft.ContainerService/managedClusters` | [2023-03-02-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.ContainerService/2023-03-02-preview/managedClusters) |
-| `Microsoft.ContainerService/managedClusters/agentPools` | [2023-03-02-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.ContainerService/2023-03-02-preview/managedClusters/agentPools) |
+| `Microsoft.ContainerService/managedClusters` | [2023-05-02-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.ContainerService/2023-05-02-preview/managedClusters) |
+| `Microsoft.ContainerService/managedClusters/agentPools` | [2023-05-02-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.ContainerService/2023-05-02-preview/managedClusters/agentPools) |
 | `Microsoft.Insights/diagnosticSettings` | [2021-05-01-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Insights/2021-05-01-preview/diagnosticSettings) |
 | `Microsoft.KubernetesConfiguration/extensions` | [2022-03-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.KubernetesConfiguration/2022-03-01/extensions) |
 | `Microsoft.KubernetesConfiguration/fluxConfigurations` | [2022-03-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.KubernetesConfiguration/2022-03-01/fluxConfigurations) |
@@ -98,6 +98,7 @@ This module deploys an Azure Kubernetes Service (AKS) Managed Cluster.
 | `dnsZoneResourceId` | string | `''` |  | Specifies the resource ID of connected DNS zone. It will be ignored if `webApplicationRoutingEnabled` is set to `false`. |
 | `enableAzureDefender` | bool | `False` |  | Whether to enable Azure Defender. |
 | `enableDefaultTelemetry` | bool | `True` |  | Enable telemetry via a Globally Unique Identifier (GUID). |
+| `enableDnsZoneContributorRoleAssignment` | bool | `True` |  | Specifies whether assing the DNS zone contributor role to the cluster service principal. It will be ignored if `webApplicationRoutingEnabled` is set to `false` or `dnsZoneResourceId` not provided. |
 | `enableKeyvaultSecretsProvider` | bool | `False` |  | Specifies whether the KeyvaultSecretsProvider add-on is enabled or not. |
 | `enableOidcIssuerProfile` | bool | `False` |  | Whether the The OIDC issuer profile of the Managed Cluster is enabled. |
 | `enablePodSecurityPolicy` | bool | `False` |  | Whether to enable Kubernetes pod security policy. |

modules/container-service/managed-clusters/agent-pools/README.md

@@ -13,7 +13,7 @@ This module deploys an Azure Kubernetes Service (AKS) Managed Cluster Agent Pool
 
 | Resource Type | API Version |
 | :-- | :-- |
-| `Microsoft.ContainerService/managedClusters/agentPools` | [2023-03-02-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.ContainerService/2023-03-02-preview/managedClusters/agentPools) |
+| `Microsoft.ContainerService/managedClusters/agentPools` | [2023-05-02-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.ContainerService/2023-05-02-preview/managedClusters/agentPools) |
 
 ## Parameters
 

modules/container-service/managed-clusters/agent-pools/main.bicep

@@ -166,11 +166,11 @@ resource defaultTelemetry 'Microsoft.Resources/deployments@2021-04-01' = if (ena
   }
 }
 
-resource managedCluster 'Microsoft.ContainerService/managedClusters@2022-11-01' existing = {
+resource managedCluster 'Microsoft.ContainerService/managedClusters@2023-05-02-preview' existing = {
   name: managedClusterName
 }
 
-resource agentPool 'Microsoft.ContainerService/managedClusters/agentPools@2023-03-02-preview' = {
+resource agentPool 'Microsoft.ContainerService/managedClusters/agentPools@2023-05-02-preview' = {
   name: name
   parent: managedCluster
   properties: {

modules/container-service/managed-clusters/agent-pools/main.json

@@ -4,8 +4,8 @@
   "metadata": {
     "_generator": {
       "name": "bicep",
-      "version": "0.18.4.5664",
-      "templateHash": "13561536489894419213"
+      "version": "0.19.5.34762",
+      "templateHash": "14718876477350380320"
     }
   },
   "parameters": {
@@ -329,7 +329,7 @@
     },
     {
       "type": "Microsoft.ContainerService/managedClusters/agentPools",
-      "apiVersion": "2022-11-01",
+      "apiVersion": "2023-05-02-preview",
       "name": "[format('{0}/{1}', parameters('managedClusterName'), parameters('name'))]",
       "properties": {
         "availabilityZones": "[parameters('availabilityZones')]",

modules/container-service/managed-clusters/main.bicep

@@ -138,6 +138,9 @@ param webApplicationRoutingEnabled bool = false
 @description('Optional. Specifies the resource ID of connected DNS zone. It will be ignored if `webApplicationRoutingEnabled` is set to `false`.')
 param dnsZoneResourceId string = ''
 
+@description('Optional. Specifies whether assing the DNS zone contributor role to the cluster service principal. It will be ignored if `webApplicationRoutingEnabled` is set to `false` or `dnsZoneResourceId` not provided.')
+param enableDnsZoneContributorRoleAssignment bool = true
+
 @description('Optional. Specifies whether the ingressApplicationGateway (AGIC) add-on is enabled or not.')
 param ingressApplicationGatewayEnabled bool = false
 
@@ -406,7 +409,7 @@ resource defaultTelemetry 'Microsoft.Resources/deployments@2022-09-01' = if (ena
   }
 }
 
-resource managedCluster 'Microsoft.ContainerService/managedClusters@2023-03-02-preview' = {
+resource managedCluster 'Microsoft.ContainerService/managedClusters@2023-05-02-preview' = {
   name: name
   location: location
   tags: tags
@@ -635,7 +638,7 @@ resource dnsZone 'Microsoft.Network/dnsZones@2018-05-01' existing = if (dnsZoneR
   name: last(split(dnsZoneResourceId, '/'))!
 }
 
-resource dnsZone_roleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (dnsZoneResourceId != null && webApplicationRoutingEnabled) {
+resource dnsZone_roleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (enableDnsZoneContributorRoleAssignment == true && dnsZoneResourceId != null && webApplicationRoutingEnabled) {
   name: guid(dnsZoneResourceId, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314'), 'DNS Zone Contributor')
   properties: {
     roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314') // 'DNS Zone Contributor'