-
Notifications
You must be signed in to change notification settings - Fork 468
/
variables.tf
1469 lines (1301 loc) · 78.8 KB
/
variables.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
variable "resource_group_name" {
type = string
description = "The resource group name to be imported"
}
variable "aci_connector_linux_enabled" {
type = bool
default = false
description = "Enable Virtual Node pool"
}
variable "aci_connector_linux_subnet_name" {
type = string
default = null
description = "(Optional) aci_connector_linux subnet name"
}
variable "admin_username" {
type = string
default = null
description = "The username of the local administrator to be created on the Kubernetes cluster. Set this variable to `null` to turn off the cluster's `linux_profile`. Changing this forces a new resource to be created."
}
variable "agents_availability_zones" {
type = list(string)
default = null
description = "(Optional) A list of Availability Zones across which the Node Pool should be spread. Changing this forces a new resource to be created."
}
variable "agents_count" {
type = number
default = 2
description = "The number of Agents that should exist in the Agent Pool. Please set `agents_count` `null` while `enable_auto_scaling` is `true` to avoid possible `agents_count` changes."
}
variable "agents_labels" {
type = map(string)
default = {}
description = "(Optional) A map of Kubernetes labels which should be applied to nodes in the Default Node Pool. Changing this forces a new resource to be created."
}
variable "agents_max_count" {
type = number
default = null
description = "Maximum number of nodes in a pool"
}
variable "agents_max_pods" {
type = number
default = null
description = "(Optional) The maximum number of pods that can run on each agent. Changing this forces a new resource to be created."
}
variable "agents_min_count" {
type = number
default = null
description = "Minimum number of nodes in a pool"
}
variable "agents_pool_drain_timeout_in_minutes" {
type = number
default = null
description = "(Optional) The amount of time in minutes to wait on eviction of pods and graceful termination per node. This eviction wait time honors waiting on pod disruption budgets. If this time is exceeded, the upgrade fails. Unsetting this after configuring it will force a new resource to be created."
}
variable "agents_pool_kubelet_configs" {
type = list(object({
cpu_manager_policy = optional(string)
cpu_cfs_quota_enabled = optional(bool, true)
cpu_cfs_quota_period = optional(string)
image_gc_high_threshold = optional(number)
image_gc_low_threshold = optional(number)
topology_manager_policy = optional(string)
allowed_unsafe_sysctls = optional(set(string))
container_log_max_size_mb = optional(number)
container_log_max_line = optional(number)
pod_max_pid = optional(number)
}))
default = []
description = <<-EOT
list(object({
cpu_manager_policy = (Optional) Specifies the CPU Manager policy to use. Possible values are `none` and `static`, Changing this forces a new resource to be created.
cpu_cfs_quota_enabled = (Optional) Is CPU CFS quota enforcement for containers enabled? Changing this forces a new resource to be created.
cpu_cfs_quota_period = (Optional) Specifies the CPU CFS quota period value. Changing this forces a new resource to be created.
image_gc_high_threshold = (Optional) Specifies the percent of disk usage above which image garbage collection is always run. Must be between `0` and `100`. Changing this forces a new resource to be created.
image_gc_low_threshold = (Optional) Specifies the percent of disk usage lower than which image garbage collection is never run. Must be between `0` and `100`. Changing this forces a new resource to be created.
topology_manager_policy = (Optional) Specifies the Topology Manager policy to use. Possible values are `none`, `best-effort`, `restricted` or `single-numa-node`. Changing this forces a new resource to be created.
allowed_unsafe_sysctls = (Optional) Specifies the allow list of unsafe sysctls command or patterns (ending in `*`). Changing this forces a new resource to be created.
container_log_max_size_mb = (Optional) Specifies the maximum size (e.g. 10MB) of container log file before it is rotated. Changing this forces a new resource to be created.
container_log_max_line = (Optional) Specifies the maximum number of container log files that can be present for a container. must be at least 2. Changing this forces a new resource to be created.
pod_max_pid = (Optional) Specifies the maximum number of processes per pod. Changing this forces a new resource to be created.
}))
EOT
nullable = false
}
variable "agents_pool_linux_os_configs" {
type = list(object({
sysctl_configs = optional(list(object({
fs_aio_max_nr = optional(number)
fs_file_max = optional(number)
fs_inotify_max_user_watches = optional(number)
fs_nr_open = optional(number)
kernel_threads_max = optional(number)
net_core_netdev_max_backlog = optional(number)
net_core_optmem_max = optional(number)
net_core_rmem_default = optional(number)
net_core_rmem_max = optional(number)
net_core_somaxconn = optional(number)
net_core_wmem_default = optional(number)
net_core_wmem_max = optional(number)
net_ipv4_ip_local_port_range_min = optional(number)
net_ipv4_ip_local_port_range_max = optional(number)
net_ipv4_neigh_default_gc_thresh1 = optional(number)
net_ipv4_neigh_default_gc_thresh2 = optional(number)
net_ipv4_neigh_default_gc_thresh3 = optional(number)
net_ipv4_tcp_fin_timeout = optional(number)
net_ipv4_tcp_keepalive_intvl = optional(number)
net_ipv4_tcp_keepalive_probes = optional(number)
net_ipv4_tcp_keepalive_time = optional(number)
net_ipv4_tcp_max_syn_backlog = optional(number)
net_ipv4_tcp_max_tw_buckets = optional(number)
net_ipv4_tcp_tw_reuse = optional(bool)
net_netfilter_nf_conntrack_buckets = optional(number)
net_netfilter_nf_conntrack_max = optional(number)
vm_max_map_count = optional(number)
vm_swappiness = optional(number)
vm_vfs_cache_pressure = optional(number)
})), [])
transparent_huge_page_enabled = optional(string)
transparent_huge_page_defrag = optional(string)
swap_file_size_mb = optional(number)
}))
default = []
description = <<-EOT
list(object({
sysctl_configs = optional(list(object({
fs_aio_max_nr = (Optional) The sysctl setting fs.aio-max-nr. Must be between `65536` and `6553500`. Changing this forces a new resource to be created.
fs_file_max = (Optional) The sysctl setting fs.file-max. Must be between `8192` and `12000500`. Changing this forces a new resource to be created.
fs_inotify_max_user_watches = (Optional) The sysctl setting fs.inotify.max_user_watches. Must be between `781250` and `2097152`. Changing this forces a new resource to be created.
fs_nr_open = (Optional) The sysctl setting fs.nr_open. Must be between `8192` and `20000500`. Changing this forces a new resource to be created.
kernel_threads_max = (Optional) The sysctl setting kernel.threads-max. Must be between `20` and `513785`. Changing this forces a new resource to be created.
net_core_netdev_max_backlog = (Optional) The sysctl setting net.core.netdev_max_backlog. Must be between `1000` and `3240000`. Changing this forces a new resource to be created.
net_core_optmem_max = (Optional) The sysctl setting net.core.optmem_max. Must be between `20480` and `4194304`. Changing this forces a new resource to be created.
net_core_rmem_default = (Optional) The sysctl setting net.core.rmem_default. Must be between `212992` and `134217728`. Changing this forces a new resource to be created.
net_core_rmem_max = (Optional) The sysctl setting net.core.rmem_max. Must be between `212992` and `134217728`. Changing this forces a new resource to be created.
net_core_somaxconn = (Optional) The sysctl setting net.core.somaxconn. Must be between `4096` and `3240000`. Changing this forces a new resource to be created.
net_core_wmem_default = (Optional) The sysctl setting net.core.wmem_default. Must be between `212992` and `134217728`. Changing this forces a new resource to be created.
net_core_wmem_max = (Optional) The sysctl setting net.core.wmem_max. Must be between `212992` and `134217728`. Changing this forces a new resource to be created.
net_ipv4_ip_local_port_range_min = (Optional) The sysctl setting net.ipv4.ip_local_port_range max value. Must be between `1024` and `60999`. Changing this forces a new resource to be created.
net_ipv4_ip_local_port_range_max = (Optional) The sysctl setting net.ipv4.ip_local_port_range min value. Must be between `1024` and `60999`. Changing this forces a new resource to be created.
net_ipv4_neigh_default_gc_thresh1 = (Optional) The sysctl setting net.ipv4.neigh.default.gc_thresh1. Must be between `128` and `80000`. Changing this forces a new resource to be created.
net_ipv4_neigh_default_gc_thresh2 = (Optional) The sysctl setting net.ipv4.neigh.default.gc_thresh2. Must be between `512` and `90000`. Changing this forces a new resource to be created.
net_ipv4_neigh_default_gc_thresh3 = (Optional) The sysctl setting net.ipv4.neigh.default.gc_thresh3. Must be between `1024` and `100000`. Changing this forces a new resource to be created.
net_ipv4_tcp_fin_timeout = (Optional) The sysctl setting net.ipv4.tcp_fin_timeout. Must be between `5` and `120`. Changing this forces a new resource to be created.
net_ipv4_tcp_keepalive_intvl = (Optional) The sysctl setting net.ipv4.tcp_keepalive_intvl. Must be between `10` and `75`. Changing this forces a new resource to be created.
net_ipv4_tcp_keepalive_probes = (Optional) The sysctl setting net.ipv4.tcp_keepalive_probes. Must be between `1` and `15`. Changing this forces a new resource to be created.
net_ipv4_tcp_keepalive_time = (Optional) The sysctl setting net.ipv4.tcp_keepalive_time. Must be between `30` and `432000`. Changing this forces a new resource to be created.
net_ipv4_tcp_max_syn_backlog = (Optional) The sysctl setting net.ipv4.tcp_max_syn_backlog. Must be between `128` and `3240000`. Changing this forces a new resource to be created.
net_ipv4_tcp_max_tw_buckets = (Optional) The sysctl setting net.ipv4.tcp_max_tw_buckets. Must be between `8000` and `1440000`. Changing this forces a new resource to be created.
net_ipv4_tcp_tw_reuse = (Optional) The sysctl setting net.ipv4.tcp_tw_reuse. Changing this forces a new resource to be created.
net_netfilter_nf_conntrack_buckets = (Optional) The sysctl setting net.netfilter.nf_conntrack_buckets. Must be between `65536` and `147456`. Changing this forces a new resource to be created.
net_netfilter_nf_conntrack_max = (Optional) The sysctl setting net.netfilter.nf_conntrack_max. Must be between `131072` and `1048576`. Changing this forces a new resource to be created.
vm_max_map_count = (Optional) The sysctl setting vm.max_map_count. Must be between `65530` and `262144`. Changing this forces a new resource to be created.
vm_swappiness = (Optional) The sysctl setting vm.swappiness. Must be between `0` and `100`. Changing this forces a new resource to be created.
vm_vfs_cache_pressure = (Optional) The sysctl setting vm.vfs_cache_pressure. Must be between `0` and `100`. Changing this forces a new resource to be created.
})), [])
transparent_huge_page_enabled = (Optional) Specifies the Transparent Huge Page enabled configuration. Possible values are `always`, `madvise` and `never`. Changing this forces a new resource to be created.
transparent_huge_page_defrag = (Optional) specifies the defrag configuration for Transparent Huge Page. Possible values are `always`, `defer`, `defer+madvise`, `madvise` and `never`. Changing this forces a new resource to be created.
swap_file_size_mb = (Optional) Specifies the size of the swap file on each node in MB. Changing this forces a new resource to be created.
}))
EOT
nullable = false
}
variable "agents_pool_max_surge" {
type = string
default = "10%"
description = "The maximum number or percentage of nodes which will be added to the Default Node Pool size during an upgrade."
}
variable "agents_pool_name" {
type = string
default = "nodepool"
description = "The default Azure AKS agentpool (nodepool) name."
nullable = false
}
variable "agents_pool_node_soak_duration_in_minutes" {
type = number
default = 0
description = "(Optional) The amount of time in minutes to wait after draining a node and before reimaging and moving on to next node. Defaults to 0."
}
variable "agents_proximity_placement_group_id" {
type = string
default = null
description = "(Optional) The ID of the Proximity Placement Group of the default Azure AKS agentpool (nodepool). Changing this forces a new resource to be created."
}
variable "agents_size" {
type = string
default = "Standard_D2s_v3"
description = "The default virtual machine size for the Kubernetes agents. Changing this without specifying `var.temporary_name_for_rotation` forces a new resource to be created."
}
variable "agents_tags" {
type = map(string)
default = {}
description = "(Optional) A mapping of tags to assign to the Node Pool."
}
variable "agents_type" {
type = string
default = "VirtualMachineScaleSets"
description = "(Optional) The type of Node Pool which should be created. Possible values are AvailabilitySet and VirtualMachineScaleSets. Defaults to VirtualMachineScaleSets."
}
variable "api_server_authorized_ip_ranges" {
type = set(string)
default = null
description = "(Optional) The IP ranges to allow for incoming traffic to the server nodes."
}
variable "attached_acr_id_map" {
type = map(string)
default = {}
description = "Azure Container Registry ids that need an authentication mechanism with Azure Kubernetes Service (AKS). Map key must be static string as acr's name, the value is acr's resource id. Changing this forces some new resources to be created."
nullable = false
}
variable "auto_scaler_profile_balance_similar_node_groups" {
type = bool
default = false
description = "Detect similar node groups and balance the number of nodes between them. Defaults to `false`."
}
variable "auto_scaler_profile_empty_bulk_delete_max" {
type = number
default = 10
description = "Maximum number of empty nodes that can be deleted at the same time. Defaults to `10`."
}
variable "auto_scaler_profile_enabled" {
type = bool
default = false
description = "Enable configuring the auto scaler profile"
nullable = false
}
variable "auto_scaler_profile_expander" {
type = string
default = "random"
description = "Expander to use. Possible values are `least-waste`, `priority`, `most-pods` and `random`. Defaults to `random`."
validation {
condition = contains(["least-waste", "most-pods", "priority", "random"], var.auto_scaler_profile_expander)
error_message = "Must be either `least-waste`, `most-pods`, `priority` or `random`."
}
}
variable "auto_scaler_profile_max_graceful_termination_sec" {
type = string
default = "600"
description = "Maximum number of seconds the cluster autoscaler waits for pod termination when trying to scale down a node. Defaults to `600`."
}
variable "auto_scaler_profile_max_node_provisioning_time" {
type = string
default = "15m"
description = "Maximum time the autoscaler waits for a node to be provisioned. Defaults to `15m`."
}
variable "auto_scaler_profile_max_unready_nodes" {
type = number
default = 3
description = "Maximum Number of allowed unready nodes. Defaults to `3`."
}
variable "auto_scaler_profile_max_unready_percentage" {
type = number
default = 45
description = "Maximum percentage of unready nodes the cluster autoscaler will stop if the percentage is exceeded. Defaults to `45`."
}
variable "auto_scaler_profile_new_pod_scale_up_delay" {
type = string
default = "10s"
description = "For scenarios like burst/batch scale where you don't want CA to act before the kubernetes scheduler could schedule all the pods, you can tell CA to ignore unscheduled pods before they're a certain age. Defaults to `10s`."
}
variable "auto_scaler_profile_scale_down_delay_after_add" {
type = string
default = "10m"
description = "How long after the scale up of AKS nodes the scale down evaluation resumes. Defaults to `10m`."
}
variable "auto_scaler_profile_scale_down_delay_after_delete" {
type = string
default = null
description = "How long after node deletion that scale down evaluation resumes. Defaults to the value used for `scan_interval`."
}
variable "auto_scaler_profile_scale_down_delay_after_failure" {
type = string
default = "3m"
description = "How long after scale down failure that scale down evaluation resumes. Defaults to `3m`."
}
variable "auto_scaler_profile_scale_down_unneeded" {
type = string
default = "10m"
description = "How long a node should be unneeded before it is eligible for scale down. Defaults to `10m`."
}
variable "auto_scaler_profile_scale_down_unready" {
type = string
default = "20m"
description = "How long an unready node should be unneeded before it is eligible for scale down. Defaults to `20m`."
}
variable "auto_scaler_profile_scale_down_utilization_threshold" {
type = string
default = "0.5"
description = "Node utilization level, defined as sum of requested resources divided by capacity, below which a node can be considered for scale down. Defaults to `0.5`."
}
variable "auto_scaler_profile_scan_interval" {
type = string
default = "10s"
description = "How often the AKS Cluster should be re-evaluated for scale up/down. Defaults to `10s`."
}
variable "auto_scaler_profile_skip_nodes_with_local_storage" {
type = bool
default = true
description = "If `true` cluster autoscaler will never delete nodes with pods with local storage, for example, EmptyDir or HostPath. Defaults to `true`."
}
variable "auto_scaler_profile_skip_nodes_with_system_pods" {
type = bool
default = true
description = "If `true` cluster autoscaler will never delete nodes with pods from kube-system (except for DaemonSet or mirror pods). Defaults to `true`."
}
variable "automatic_channel_upgrade" {
type = string
default = null
description = "(Optional) The upgrade channel for this Kubernetes Cluster. Possible values are `patch`, `rapid`, `node-image` and `stable`. By default automatic-upgrades are turned off. Note that you cannot specify the patch version using `kubernetes_version` or `orchestrator_version` when using the `patch` upgrade channel. See [the documentation](https://learn.microsoft.com/en-us/azure/aks/auto-upgrade-cluster) for more information"
validation {
condition = var.automatic_channel_upgrade == null ? true : contains([
"patch", "stable", "rapid", "node-image"
], var.automatic_channel_upgrade)
error_message = "`automatic_channel_upgrade`'s possible values are `patch`, `stable`, `rapid` or `node-image`."
}
}
variable "azure_policy_enabled" {
type = bool
default = false
description = "Enable Azure Policy Addon."
}
variable "brown_field_application_gateway_for_ingress" {
type = object({
id = string
subnet_id = string
})
default = null
description = <<-EOT
[Definition of `brown_field`](https://learn.microsoft.com/en-us/azure/application-gateway/tutorial-ingress-controller-add-on-existing)
* `id` - (Required) The ID of the Application Gateway that be used as cluster ingress.
* `subnet_id` - (Required) The ID of the Subnet which the Application Gateway is connected to. Must be set when `create_role_assignments` is `true`.
EOT
}
variable "client_id" {
type = string
default = ""
description = "(Optional) The Client ID (appId) for the Service Principal used for the AKS deployment"
nullable = false
}
variable "client_secret" {
type = string
default = ""
description = "(Optional) The Client Secret (password) for the Service Principal used for the AKS deployment"
nullable = false
}
variable "cluster_log_analytics_workspace_name" {
type = string
default = null
description = "(Optional) The name of the Analytics workspace"
}
variable "cluster_name" {
type = string
default = null
description = "(Optional) The name for the AKS resources created in the specified Azure Resource Group. This variable overwrites the 'prefix' var (The 'prefix' var will still be applied to the dns_prefix if it is set)"
}
variable "cluster_name_random_suffix" {
type = bool
default = false
description = "Whether to add a random suffix on Aks cluster's name or not. `azurerm_kubernetes_cluster` resource defined in this module is `create_before_destroy = true` implicity now(described [here](https://github.com/Azure/terraform-azurerm-aks/issues/389)), without this random suffix we'll not be able to recreate this cluster directly due to the naming conflict."
nullable = false
}
variable "confidential_computing" {
type = object({
sgx_quote_helper_enabled = bool
})
default = null
description = "(Optional) Enable Confidential Computing."
}
variable "cost_analysis_enabled" {
type = bool
default = false
description = "(Optional) Enable Cost Analysis."
}
variable "create_role_assignment_network_contributor" {
type = bool
default = false
description = "(Deprecated) Create a role assignment for the AKS Service Principal to be a Network Contributor on the subnets used for the AKS Cluster"
nullable = false
}
variable "create_role_assignments_for_application_gateway" {
type = bool
default = true
description = "(Optional) Whether to create the corresponding role assignments for application gateway or not. Defaults to `true`."
nullable = false
}
variable "default_node_pool_fips_enabled" {
type = bool
default = null
description = " (Optional) Should the nodes in this Node Pool have Federal Information Processing Standard enabled? Changing this forces a new resource to be created."
}
variable "disk_encryption_set_id" {
type = string
default = null
description = "(Optional) The ID of the Disk Encryption Set which should be used for the Nodes and Volumes. More information [can be found in the documentation](https://docs.microsoft.com/azure/aks/azure-disk-customer-managed-keys). Changing this forces a new resource to be created."
}
variable "ebpf_data_plane" {
type = string
default = null
description = "(Optional) Specifies the eBPF data plane used for building the Kubernetes network. Possible value is `cilium`. Changing this forces a new resource to be created."
}
variable "enable_auto_scaling" {
type = bool
default = false
description = "Enable node pool autoscaling"
}
variable "enable_host_encryption" {
type = bool
default = false
description = "Enable Host Encryption for default node pool. Encryption at host feature must be enabled on the subscription: https://docs.microsoft.com/azure/virtual-machines/linux/disks-enable-host-based-encryption-cli"
}
variable "enable_node_public_ip" {
type = bool
default = false
description = "(Optional) Should nodes in this Node Pool have a Public IP Address? Defaults to false."
}
variable "green_field_application_gateway_for_ingress" {
type = object({
name = optional(string)
subnet_cidr = optional(string)
subnet_id = optional(string)
})
default = null
description = <<-EOT
[Definition of `green_field`](https://learn.microsoft.com/en-us/azure/application-gateway/tutorial-ingress-controller-add-on-new)
* `name` - (Optional) The name of the Application Gateway to be used or created in the Nodepool Resource Group, which in turn will be integrated with the ingress controller of this Kubernetes Cluster.
* `subnet_cidr` - (Optional) The subnet CIDR to be used to create an Application Gateway, which in turn will be integrated with the ingress controller of this Kubernetes Cluster.
* `subnet_id` - (Optional) The ID of the subnet on which to create an Application Gateway, which in turn will be integrated with the ingress controller of this Kubernetes Cluster.
EOT
validation {
condition = var.green_field_application_gateway_for_ingress == null ? true : (can(coalesce(var.green_field_application_gateway_for_ingress.subnet_id, var.green_field_application_gateway_for_ingress.subnet_cidr)))
error_message = "One of `subnet_cidr` and `subnet_id` must be specified."
}
}
variable "http_proxy_config" {
type = object({
http_proxy = optional(string)
https_proxy = optional(string)
no_proxy = optional(list(string))
trusted_ca = optional(string)
})
default = null
description = <<-EOT
optional(object({
http_proxy = (Optional) The proxy address to be used when communicating over HTTP.
https_proxy = (Optional) The proxy address to be used when communicating over HTTPS.
no_proxy = (Optional) The list of domains that will not use the proxy for communication. Note: If you specify the `default_node_pool.0.vnet_subnet_id`, be sure to include the Subnet CIDR in the `no_proxy` list. Note: You may wish to use Terraform's `ignore_changes` functionality to ignore the changes to this field.
trusted_ca = (Optional) The base64 encoded alternative CA certificate content in PEM format.
}))
Once you have set only one of `http_proxy` and `https_proxy`, this config would be used for both `http_proxy` and `https_proxy` to avoid a configuration drift.
EOT
validation {
condition = var.http_proxy_config == null ? true : can(coalesce(var.http_proxy_config.http_proxy, var.http_proxy_config.https_proxy))
error_message = "`http_proxy` and `https_proxy` cannot be both empty."
}
}
variable "identity_ids" {
type = list(string)
default = null
description = "(Optional) Specifies a list of User Assigned Managed Identity IDs to be assigned to this Kubernetes Cluster."
}
variable "identity_type" {
type = string
default = "SystemAssigned"
description = "(Optional) The type of identity used for the managed cluster. Conflicts with `client_id` and `client_secret`. Possible values are `SystemAssigned` and `UserAssigned`. If `UserAssigned` is set, an `identity_ids` must be set as well."
validation {
condition = var.identity_type == "SystemAssigned" || var.identity_type == "UserAssigned"
error_message = "`identity_type`'s possible values are `SystemAssigned` and `UserAssigned`"
}
}
variable "image_cleaner_enabled" {
type = bool
default = false
description = "(Optional) Specifies whether Image Cleaner is enabled."
}
variable "image_cleaner_interval_hours" {
type = number
default = 48
description = "(Optional) Specifies the interval in hours when images should be cleaned up. Defaults to `48`."
}
variable "key_vault_secrets_provider_enabled" {
type = bool
default = false
description = "(Optional) Whether to use the Azure Key Vault Provider for Secrets Store CSI Driver in an AKS cluster. For more details: https://docs.microsoft.com/en-us/azure/aks/csi-secrets-store-driver"
nullable = false
}
variable "kms_enabled" {
type = bool
default = false
description = "(Optional) Enable Azure KeyVault Key Management Service."
nullable = false
}
variable "kms_key_vault_key_id" {
type = string
default = null
description = "(Optional) Identifier of Azure Key Vault key. When Azure Key Vault key management service is enabled, this field is required and must be a valid key identifier."
}
variable "kms_key_vault_network_access" {
type = string
default = "Public"
description = "(Optional) Network Access of Azure Key Vault. Possible values are: `Private` and `Public`."
validation {
condition = contains(["Private", "Public"], var.kms_key_vault_network_access)
error_message = "Possible values are `Private` and `Public`"
}
}
variable "kubelet_identity" {
type = object({
client_id = optional(string)
object_id = optional(string)
user_assigned_identity_id = optional(string)
})
default = null
description = <<-EOT
- `client_id` - (Optional) The Client ID of the user-defined Managed Identity to be assigned to the Kubelets. If not specified a Managed Identity is created automatically. Changing this forces a new resource to be created.
- `object_id` - (Optional) The Object ID of the user-defined Managed Identity assigned to the Kubelets.If not specified a Managed Identity is created automatically. Changing this forces a new resource to be created.
- `user_assigned_identity_id` - (Optional) The ID of the User Assigned Identity assigned to the Kubelets. If not specified a Managed Identity is created automatically. Changing this forces a new resource to be created.
EOT
}
variable "kubernetes_version" {
type = string
default = null
description = "Specify which Kubernetes release to use. The default used is the latest Kubernetes version available in the region"
}
variable "load_balancer_profile_enabled" {
type = bool
default = false
description = "(Optional) Enable a load_balancer_profile block. This can only be used when load_balancer_sku is set to `standard`."
nullable = false
}
variable "load_balancer_profile_idle_timeout_in_minutes" {
type = number
default = 30
description = "(Optional) Desired outbound flow idle timeout in minutes for the cluster load balancer. Must be between `4` and `120` inclusive."
}
variable "load_balancer_profile_managed_outbound_ip_count" {
type = number
default = null
description = "(Optional) Count of desired managed outbound IPs for the cluster load balancer. Must be between `1` and `100` inclusive"
}
variable "load_balancer_profile_managed_outbound_ipv6_count" {
type = number
default = null
description = "(Optional) The desired number of IPv6 outbound IPs created and managed by Azure for the cluster load balancer. Must be in the range of `1` to `100` (inclusive). The default value is `0` for single-stack and `1` for dual-stack. Note: managed_outbound_ipv6_count requires dual-stack networking. To enable dual-stack networking the Preview Feature Microsoft.ContainerService/AKS-EnableDualStack needs to be enabled and the Resource Provider re-registered, see the documentation for more information. https://learn.microsoft.com/en-us/azure/aks/configure-kubenet-dual-stack?tabs=azure-cli%2Ckubectl#register-the-aks-enabledualstack-preview-feature"
}
variable "load_balancer_profile_outbound_ip_address_ids" {
type = set(string)
default = null
description = "(Optional) The ID of the Public IP Addresses which should be used for outbound communication for the cluster load balancer."
}
variable "load_balancer_profile_outbound_ip_prefix_ids" {
type = set(string)
default = null
description = "(Optional) The ID of the outbound Public IP Address Prefixes which should be used for the cluster load balancer."
}
variable "load_balancer_profile_outbound_ports_allocated" {
type = number
default = 0
description = "(Optional) Number of desired SNAT port for each VM in the clusters load balancer. Must be between `0` and `64000` inclusive. Defaults to `0`"
}
variable "load_balancer_sku" {
type = string
default = "standard"
description = "(Optional) Specifies the SKU of the Load Balancer used for this Kubernetes Cluster. Possible values are `basic` and `standard`. Defaults to `standard`. Changing this forces a new kubernetes cluster to be created."
validation {
condition = contains(["basic", "standard"], var.load_balancer_sku)
error_message = "Possible values are `basic` and `standard`"
}
}
variable "local_account_disabled" {
type = bool
default = null
description = "(Optional) - If `true` local accounts will be disabled. Defaults to `false`. See [the documentation](https://docs.microsoft.com/azure/aks/managed-aad#disable-local-accounts) for more information."
}
variable "location" {
type = string
default = null
description = "Location of cluster, if not defined it will be read from the resource-group"
}
variable "log_analytics_solution" {
type = object({
id = string
})
default = null
description = "(Optional) Object which contains existing azurerm_log_analytics_solution ID. Providing ID disables creation of azurerm_log_analytics_solution."
validation {
condition = var.log_analytics_solution == null ? true : var.log_analytics_solution.id != null && var.log_analytics_solution.id != ""
error_message = "`var.log_analytics_solution` must be `null` or an object with a valid `id`."
}
}
variable "log_analytics_workspace" {
type = object({
id = string
name = string
location = optional(string)
resource_group_name = optional(string)
})
default = null
description = "(Optional) Existing azurerm_log_analytics_workspace to attach azurerm_log_analytics_solution. Providing the config disables creation of azurerm_log_analytics_workspace."
}
variable "log_analytics_workspace_allow_resource_only_permissions" {
type = bool
default = null
description = "(Optional) Specifies if the log Analytics Workspace allow users accessing to data associated with resources they have permission to view, without permission to workspace. Defaults to `true`."
}
variable "log_analytics_workspace_cmk_for_query_forced" {
type = bool
default = null
description = "(Optional) Is Customer Managed Storage mandatory for query management?"
}
variable "log_analytics_workspace_daily_quota_gb" {
type = number
default = null
description = "(Optional) The workspace daily quota for ingestion in GB. Defaults to -1 (unlimited) if omitted."
}
variable "log_analytics_workspace_data_collection_rule_id" {
type = string
default = null
description = "(Optional) The ID of the Data Collection Rule to use for this workspace."
}
variable "log_analytics_workspace_enabled" {
type = bool
default = true
description = "Enable the integration of azurerm_log_analytics_workspace and azurerm_log_analytics_solution: https://docs.microsoft.com/en-us/azure/azure-monitor/containers/container-insights-onboard"
nullable = false
}
variable "log_analytics_workspace_identity" {
type = object({
identity_ids = optional(set(string))
type = string
})
default = null
description = <<-EOT
- `identity_ids` - (Optional) Specifies a list of user managed identity ids to be assigned. Required if `type` is `UserAssigned`.
- `type` - (Required) Specifies the identity type of the Log Analytics Workspace. Possible values are `SystemAssigned` (where Azure will generate a Service Principal for you) and `UserAssigned` where you can specify the Service Principal IDs in the `identity_ids` field.
EOT
}
variable "log_analytics_workspace_immediate_data_purge_on_30_days_enabled" {
type = bool
default = null
description = "(Optional) Whether to remove the data in the Log Analytics Workspace immediately after 30 days."
}
variable "log_analytics_workspace_internet_ingestion_enabled" {
type = bool
default = null
description = "(Optional) Should the Log Analytics Workspace support ingestion over the Public Internet? Defaults to `true`."
}
variable "log_analytics_workspace_internet_query_enabled" {
type = bool
default = null
description = "(Optional) Should the Log Analytics Workspace support querying over the Public Internet? Defaults to `true`."
}
variable "log_analytics_workspace_local_authentication_disabled" {
type = bool
default = null
description = "(Optional) Specifies if the log Analytics workspace should enforce authentication using Azure AD. Defaults to `false`."
}
variable "log_analytics_workspace_reservation_capacity_in_gb_per_day" {
type = number
default = null
description = "(Optional) The capacity reservation level in GB for this workspace. Possible values are `100`, `200`, `300`, `400`, `500`, `1000`, `2000` and `5000`."
}
variable "log_analytics_workspace_resource_group_name" {
type = string
default = null
description = "(Optional) Resource group name to create azurerm_log_analytics_solution."
}
variable "log_analytics_workspace_sku" {
type = string
default = "PerGB2018"
description = "The SKU (pricing level) of the Log Analytics workspace. For new subscriptions the SKU should be set to PerGB2018"
}
variable "log_retention_in_days" {
type = number
default = 30
description = "The retention period for the logs in days"
}
variable "maintenance_window" {
type = object({
allowed = optional(list(object({
day = string
hours = set(number)
})), [
]),
not_allowed = optional(list(object({
end = string
start = string
})), []),
})
default = null
description = "(Optional) Maintenance configuration of the managed cluster."
}
variable "maintenance_window_auto_upgrade" {
type = object({
day_of_month = optional(number)
day_of_week = optional(string)
duration = number
frequency = string
interval = number
start_date = optional(string)
start_time = optional(string)
utc_offset = optional(string)
week_index = optional(string)
not_allowed = optional(set(object({
end = string
start = string
})))
})
default = null
description = <<-EOT
- `day_of_month` - (Optional) The day of the month for the maintenance run. Required in combination with RelativeMonthly frequency. Value between 0 and 31 (inclusive).
- `day_of_week` - (Optional) The day of the week for the maintenance run. Options are `Monday`, `Tuesday`, `Wednesday`, `Thurday`, `Friday`, `Saturday` and `Sunday`. Required in combination with weekly frequency.
- `duration` - (Required) The duration of the window for maintenance to run in hours.
- `frequency` - (Required) Frequency of maintenance. Possible options are `Weekly`, `AbsoluteMonthly` and `RelativeMonthly`.
- `interval` - (Required) The interval for maintenance runs. Depending on the frequency this interval is week or month based.
- `start_date` - (Optional) The date on which the maintenance window begins to take effect.
- `start_time` - (Optional) The time for maintenance to begin, based on the timezone determined by `utc_offset`. Format is `HH:mm`.
- `utc_offset` - (Optional) Used to determine the timezone for cluster maintenance.
- `week_index` - (Optional) The week in the month used for the maintenance run. Options are `First`, `Second`, `Third`, `Fourth`, and `Last`.
---
`not_allowed` block supports the following:
- `end` - (Required) The end of a time span, formatted as an RFC3339 string.
- `start` - (Required) The start of a time span, formatted as an RFC3339 string.
EOT
}
variable "maintenance_window_node_os" {
type = object({
day_of_month = optional(number)
day_of_week = optional(string)
duration = number
frequency = string
interval = number
start_date = optional(string)
start_time = optional(string)
utc_offset = optional(string)
week_index = optional(string)
not_allowed = optional(set(object({
end = string
start = string
})))
})
default = null
description = <<-EOT
- `day_of_month` -
- `day_of_week` - (Optional) The day of the week for the maintenance run. Options are `Monday`, `Tuesday`, `Wednesday`, `Thurday`, `Friday`, `Saturday` and `Sunday`. Required in combination with weekly frequency.
- `duration` - (Required) The duration of the window for maintenance to run in hours.
- `frequency` - (Required) Frequency of maintenance. Possible options are `Daily`, `Weekly`, `AbsoluteMonthly` and `RelativeMonthly`.
- `interval` - (Required) The interval for maintenance runs. Depending on the frequency this interval is week or month based.
- `start_date` - (Optional) The date on which the maintenance window begins to take effect.
- `start_time` - (Optional) The time for maintenance to begin, based on the timezone determined by `utc_offset`. Format is `HH:mm`.
- `utc_offset` - (Optional) Used to determine the timezone for cluster maintenance.
- `week_index` - (Optional) The week in the month used for the maintenance run. Options are `First`, `Second`, `Third`, `Fourth`, and `Last`.
---
`not_allowed` block supports the following:
- `end` - (Required) The end of a time span, formatted as an RFC3339 string.
- `start` - (Required) The start of a time span, formatted as an RFC3339 string.
EOT
}
variable "microsoft_defender_enabled" {
type = bool
default = false
description = "(Optional) Is Microsoft Defender on the cluster enabled? Requires `var.log_analytics_workspace_enabled` to be `true` to set this variable to `true`."
nullable = false
}
variable "monitor_metrics" {
type = object({
annotations_allowed = optional(string)
labels_allowed = optional(string)
})
default = null
description = <<-EOT
(Optional) Specifies a Prometheus add-on profile for the Kubernetes Cluster
object({
annotations_allowed = "(Optional) Specifies a comma-separated list of Kubernetes annotation keys that will be used in the resource's labels metric."
labels_allowed = "(Optional) Specifies a Comma-separated list of additional Kubernetes label keys that will be used in the resource's labels metric."
})
EOT
}
variable "msi_auth_for_monitoring_enabled" {
type = bool
default = null
description = "(Optional) Is managed identity authentication for monitoring enabled?"
}
variable "net_profile_dns_service_ip" {
type = string
default = null
description = "(Optional) IP address within the Kubernetes service address range that will be used by cluster service discovery (kube-dns). Changing this forces a new resource to be created."
}
variable "net_profile_outbound_type" {
type = string
default = "loadBalancer"
description = "(Optional) The outbound (egress) routing method which should be used for this Kubernetes Cluster. Possible values are loadBalancer and userDefinedRouting. Defaults to loadBalancer."
}
variable "net_profile_pod_cidr" {
type = string
default = null
description = " (Optional) The CIDR to use for pod IP addresses. This field can only be set when network_plugin is set to kubenet or network_plugin is set to azure and network_plugin_mode is set to overlay. Changing this forces a new resource to be created."
}
variable "net_profile_service_cidr" {
type = string
default = null
description = "(Optional) The Network Range used by the Kubernetes service. Changing this forces a new resource to be created."
}
variable "network_contributor_role_assigned_subnet_ids" {
type = map(string)
default = {}
description = "Create role assignments for the AKS Service Principal to be a Network Contributor on the subnets used for the AKS Cluster, key should be static string, value should be subnet's id"
nullable = false
}
variable "network_plugin" {
type = string
default = "kubenet"
description = "Network plugin to use for networking."
nullable = false
}
variable "network_plugin_mode" {
type = string
default = null
description = "(Optional) Specifies the network plugin mode used for building the Kubernetes network. Possible value is `overlay`. Changing this forces a new resource to be created."
}
variable "network_policy" {
type = string
default = null
description = " (Optional) Sets up network policy to be used with Azure CNI. Network policy allows us to control the traffic flow between pods. Currently supported values are calico and azure. Changing this forces a new resource to be created."
}
variable "node_network_profile" {
type = object({
node_public_ip_tags = optional(map(string))
})
default = null
description = "(Optional) Specifies a mapping of tags to the instance-level public IPs. Changing this forces a new resource to be created."
}
variable "node_os_channel_upgrade" {
type = string
default = null
description = " (Optional) The upgrade channel for this Kubernetes Cluster Nodes' OS Image. Possible values are `Unmanaged`, `SecurityPatch`, `NodeImage` and `None`."
}
variable "node_pools" {
type = map(object({
name = string
node_count = optional(number)
tags = optional(map(string))
vm_size = string
host_group_id = optional(string)
capacity_reservation_group_id = optional(string)
custom_ca_trust_enabled = optional(bool)
enable_auto_scaling = optional(bool)
enable_host_encryption = optional(bool)
enable_node_public_ip = optional(bool)
eviction_policy = optional(string)
gpu_instance = optional(string)
kubelet_config = optional(object({
cpu_manager_policy = optional(string)
cpu_cfs_quota_enabled = optional(bool)
cpu_cfs_quota_period = optional(string)
image_gc_high_threshold = optional(number)
image_gc_low_threshold = optional(number)
topology_manager_policy = optional(string)
allowed_unsafe_sysctls = optional(set(string))
container_log_max_size_mb = optional(number)
container_log_max_files = optional(number)
pod_max_pid = optional(number)
}))
linux_os_config = optional(object({
sysctl_config = optional(object({
fs_aio_max_nr = optional(number)
fs_file_max = optional(number)
fs_inotify_max_user_watches = optional(number)
fs_nr_open = optional(number)
kernel_threads_max = optional(number)
net_core_netdev_max_backlog = optional(number)
net_core_optmem_max = optional(number)
net_core_rmem_default = optional(number)
net_core_rmem_max = optional(number)
net_core_somaxconn = optional(number)
net_core_wmem_default = optional(number)
net_core_wmem_max = optional(number)
net_ipv4_ip_local_port_range_min = optional(number)
net_ipv4_ip_local_port_range_max = optional(number)
net_ipv4_neigh_default_gc_thresh1 = optional(number)