identity_type is either SystemAssigned or UserAssigned

Author: zioproto

README.md

@@ -314,7 +314,7 @@ No modules.
 | <a name="input_enable_node_public_ip"></a> [enable\_node\_public\_ip](#input\_enable\_node\_public\_ip)                                                                                                    | (Optional) Should nodes in this Node Pool have a Public IP Address? Defaults to false.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `bool`                                                                                                                                                                                                                     | `false`                     |    no    |
 | <a name="input_http_application_routing_enabled"></a> [http\_application\_routing\_enabled](#input\_http\_application\_routing\_enabled)                                                                   | Enable HTTP Application Routing Addon (forces recreation).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | `bool`                                                                                                                                                                                                                     | `false`                     |    no    |
 | <a name="input_identity_ids"></a> [identity\_ids](#input\_identity\_ids)                                                                                                                                   | (Optional) Specifies a list of User Assigned Managed Identity IDs to be assigned to this Kubernetes Cluster.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | `list(string)`                                                                                                                                                                                                             | `null`                      |    no    |
-| <a name="input_identity_type"></a> [identity\_type](#input\_identity\_type)                                                                                                                                | (Optional) The type of identity used for the managed cluster. Conflict with `client_id` and `client_secret`. Possible values are `SystemAssigned`, `UserAssigned`, `SystemAssigned, UserAssigned`(to enable both). If `UserAssigned` or `SystemAssigned, UserAssigned` is set, an `identity_ids` must be set as well.                                                                                                                                                                                                                                                                                                                                                  | `string`                                                                                                                                                                                                                   | `"SystemAssigned"`          |    no    |
+| <a name="input_identity_type"></a> [identity\_type](#input\_identity\_type)                                                                                                                                | (Optional) The type of identity used for the managed cluster. Conflicts with `client_id` and `client_secret`. Possible values are `SystemAssigned` and `UserAssigned`. If `UserAssigned` is set, an `identity_ids` must be set as well.                                                                                                                                                                                                                                                                                                                                                                                                                                | `string`                                                                                                                                                                                                                   | `"SystemAssigned"`          |    no    |
 | <a name="input_ingress_application_gateway_enabled"></a> [ingress\_application\_gateway\_enabled](#input\_ingress\_application\_gateway\_enabled)                                                          | Whether to deploy the Application Gateway ingress controller to this Kubernetes Cluster?                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | `bool`                                                                                                                                                                                                                     | `false`                     |    no    |
 | <a name="input_ingress_application_gateway_id"></a> [ingress\_application\_gateway\_id](#input\_ingress\_application\_gateway\_id)                                                                         | The ID of the Application Gateway to integrate with the ingress controller of this Kubernetes Cluster.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `string`                                                                                                                                                                                                                   | `null`                      |    no    |
 | <a name="input_ingress_application_gateway_name"></a> [ingress\_application\_gateway\_name](#input\_ingress\_application\_gateway\_name)                                                                   | The name of the Application Gateway to be used or created in the Nodepool Resource Group, which in turn will be integrated with the ingress controller of this Kubernetes Cluster.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `string`                                                                                                                                                                                                                   | `null`                      |    no    |

main.tf

@@ -265,7 +265,7 @@ resource "azurerm_kubernetes_cluster" "main" {
     precondition {
       # Why don't use var.identity_ids != null && length(var.identity_ids)>0 ? Because bool expression in Terraform is not short circuit so even var.identity_ids is null Terraform will still invoke length function with null and cause error. https://github.com/hashicorp/terraform/issues/24128
       condition     = (var.client_id != "" && var.client_secret != "") || (var.identity_type == "SystemAssigned") || (var.identity_ids == null ? false : length(var.identity_ids) > 0)
-      error_message = "If use identity and `UserAssigned` or `SystemAssigned, UserAssigned` is set, an `identity_ids` must be set as well."
+      error_message = "If use identity and `UserAssigned` is set, an `identity_ids` must be set as well."
     }
     precondition {
       condition     = !(var.microsoft_defender_enabled && !var.log_analytics_workspace_enabled)

variables.tf

@@ -288,12 +288,12 @@ variable "identity_ids" {
 
 variable "identity_type" {
   type        = string
-  description = "(Optional) The type of identity used for the managed cluster. Conflict with `client_id` and `client_secret`. Possible values are `SystemAssigned`, `UserAssigned`, `SystemAssigned, UserAssigned`(to enable both). If `UserAssigned` or `SystemAssigned, UserAssigned` is set, an `identity_ids` must be set as well."
+  description = "(Optional) The type of identity used for the managed cluster. Conflicts with `client_id` and `client_secret`. Possible values are `SystemAssigned` and `UserAssigned`. If `UserAssigned` is set, an `identity_ids` must be set as well."
   default     = "SystemAssigned"
 
   validation {
-    condition     = var.identity_type == "SystemAssigned" || var.identity_type == "UserAssigned" || var.identity_type == "SystemAssigned, UserAssigned"
-    error_message = "`identity_type`'s possible values are `SystemAssigned`, `UserAssigned`, `SystemAssigned, UserAssigned`(to enable both)."
+    condition     = var.identity_type == "SystemAssigned" || var.identity_type == "UserAssigned"
+    error_message = "`identity_type`'s possible values are `SystemAssigned` and `UserAssigned`"
   }
 }