Add support for using application gateway for ingress

main.tf

@@ -44,6 +44,7 @@ resource "azurerm_kubernetes_cluster" "main" {
       tags                   = merge(var.tags, var.agents_tags)
       max_pods               = var.agents_max_pods
       enable_host_encryption = var.enable_host_encryption
+      os_disk_type           = var.os_disk_type
     }
   }
 
@@ -65,6 +66,7 @@ resource "azurerm_kubernetes_cluster" "main" {
       tags                   = merge(var.tags, var.agents_tags)
       max_pods               = var.agents_max_pods
       enable_host_encryption = var.enable_host_encryption
+      os_disk_type           = var.os_disk_type
     }
   }
 
@@ -85,6 +87,11 @@ resource "azurerm_kubernetes_cluster" "main" {
   }
 
   addon_profile {
+    ingress_application_gateway {
+      enabled    = var.ingress_application_gateway_id != null
+      gateway_id = var.ingress_application_gateway_id
+    }
+
     http_application_routing {
       enabled = var.enable_http_application_routing
     }
@@ -166,4 +173,11 @@ resource "azurerm_log_analytics_solution" "main" {
   tags = var.tags
 }
 
+resource "azurerm_role_assignment" "ingress_gw_management" {
+  principal_id         = azurerm_kubernetes_cluster.main.addon_profile[0].ingress_application_gateway[0].ingress_application_gateway_identity[0].object_id
+  scope                = var.ingress_application_gateway_id
+  role_definition_name = "Contributor"
+  description          = "Allow application gateway controller to manage the application gateway"
 
+  count = var.ingress_application_gateway_id == null ? 0 : 1
+}

outputs.tf

@@ -74,3 +74,7 @@ output "admin_username" {
 output "admin_password" {
   value = length(azurerm_kubernetes_cluster.main.kube_admin_config) > 0 ? azurerm_kubernetes_cluster.main.kube_admin_config.0.password : ""
 }
+
+output "ingress_application_gateway_identity" {
+  value = var.ingress_application_gateway_id != null ? flatten(azurerm_kubernetes_cluster.main.addon_profile[*].ingress_application_gateway[*].ingress_application_gateway_identity[*]) : []
+}

variables.tf

@@ -92,6 +92,12 @@ variable "os_disk_size_gb" {
   default     = 50
 }
 
+variable "os_disk_type" {
+  description = "(Optional) Type of disk the nodes should use for the Operating System. Possible values are `Ephemeral` and `Managed`. Defaults to `Managed`."
+  type        = string
+  default     = "Managed"
+}
+
 variable "private_cluster_enabled" {
   description = "If true cluster API server will be exposed only on internal IP address and available only in cluster vnet."
   type        = bool
@@ -289,3 +295,9 @@ variable "enable_host_encryption" {
   type        = bool
   default     = false
 }
+
+variable "ingress_application_gateway_id" {
+  description = "(Optional) ID of the Application Gateway should be used for ingress"
+  type        = string
+  default     = null
+}