You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
V5.0.0 is a major version upgrade and a lot of breaking changes have been introduced. Extreme caution must be taken during the upgrade to avoid resource replacement and downtime by accident.
4
+
5
+
Running the `terraform plan` first to inspect the plan is strongly advised.
6
+
7
+
## Terraform and terraform-provider-azurerm version restrictions
8
+
9
+
Now Terraform core's lowest version is v1.2.0 and terraform-provider-azurerm's lowest version is v3.21.0.
10
+
11
+
## variable `user_assigned_identity_id` has been renamed.
12
+
13
+
variable `user_assigned_identity_id` has been renamed to `identity_ids` and it's type has been changed from `string` to `list(string)`.
14
+
15
+
## `addon_profile` in outputs is no longer available.
16
+
17
+
It has been broken into the following new outputs:
18
+
19
+
*`aci_connector_linux`
20
+
*`aci_connector_linux_enabled`
21
+
*`azure_policy_enabled`
22
+
*`http_application_routing_enabled`
23
+
*`ingress_application_gateway`
24
+
*`ingress_application_gateway_enabled`
25
+
*`key_vault_secrets_provider`
26
+
*`key_vault_secrets_provider_enabled`
27
+
*`oms_agent`
28
+
*`oms_agent_enabled`
29
+
*`open_service_mesh_enabled`
30
+
31
+
## The following variables have been renamed from `enable_xxx` to `xxx_enabled`
32
+
33
+
*`enable_azure_policy` has been renamed to `azure_policy_enabled`
34
+
*`enable_http_application_routing` has been renamed to `http_application_routing_enabled`
35
+
*`enable_ingress_application_gateway` has been renamed to `ingress_application_gateway_enabled`
36
+
*`enable_log_analytics_workspace` has been renamed to `log_analytics_workspace_enabled`
37
+
*`enable_open_service_mesh` has been renamed to `open_service_mesh_enabled`
38
+
*`enable_role_based_access_control` has been renamed to `role_based_access_control_enabled`
39
+
40
+
## `nullable = true` has been added to the following variables so setting them to `null` explicitly will use the default value
41
+
42
+
*`log_analytics_workspace_enable`
43
+
*`os_disk_type`
44
+
*`private_cluster_enabled`
45
+
*`rbac_aad_managed`
46
+
*`rbac_aad_admin_group_object_ids`
47
+
*`network_policy`
48
+
*`enable_node_public_ip`
49
+
50
+
## `var.admin_username`'s default value has been removed
51
+
52
+
In v4.x `var.admin_username` has a default value `azureuser` and has been removed in V5.0.0. Since the `admin_username` argument in `linux_profile` block is a ForceNew argument, any value change to this argument will trigger a Kubernetes cluster replacement **SO THE EXTREME CAUTION MUST BE TAKEN**. The module's callers must set `var.admin_username` to `azureuser` explicitly if they didn't set it before.
53
+
54
+
## `module.ssh-key` has been removed
55
+
56
+
The file named `private_ssh_key` which contains the tls private key will be deleted since the `local_file` resource has been removed. Now the private key is exported via `generated_cluster_private_ssh_key` in output and the corresponding public key is exported via `generated_cluster_public_ssh_key` in output.
57
+
58
+
A `moved` block has been added to relocate the existing `tls_private_key` resource to the new address. If the `var.admin_username` is not `null`, no action is needed.
59
+
60
+
Resource `tls_private_key`'s creation now is conditional. Users may see the destruction of existing `tls_private_key` in the generated plan if `var.admin_username` is `null`.
61
+
62
+
## `system_assigned_identity` in the output has been renamed to `cluster_identity`
63
+
64
+
The `system_assigned_identity` was:
65
+
66
+
```hcl
67
+
output "system_assigned_identity" {
68
+
value = azurerm_kubernetes_cluster.main.identity
69
+
}
70
+
```
71
+
72
+
Now it has been renamed to `cluster_identity`, and the block has been changed to:
73
+
74
+
```hcl
75
+
output "cluster_identity" {
76
+
description = "The `azurerm_kubernetes_cluster`'s `identity` block."
77
+
value = try(azurerm_kubernetes_cluster.main.identity[0], null)
78
+
}
79
+
```
80
+
81
+
The callers who used to read the cluster's identity block need to remove the index in their expression, from `module.aks.system_assigned_identity[0]` to `module.aks.cluster_identity`.
82
+
83
+
## The following outputs are now sensitive. All outputs referenced them must be declared as sensitive too
We've added a CI pipeline for this module to speed up our code review and to enforce a high code quality standard, if you want to contribute by submitting a pull request, please read [Pre-Commit & Pr-Check & Test](#Pre-Commit--Pr-Check--Test) section, or your pull request might be rejected by CI pipeline.
4
+
5
+
A pull request will be reviewed when it has passed Pre Pull Request Check in the pipeline, and will be merged when it has passed the acceptance tests. Once the ci Pipeline failed, please read the pipeline's output, thanks for your cooperation.
## Add validation block to enforce users to change `sku_tier` from `Paid` to `Standard`
4
+
5
+
AzureRM's minimum version is `>= 3.51, < 4.0` now.
6
+
[`var.sku_tier` cannot be set to `Paid` anymore](https://github.com/hashicorp/terraform-provider-azurerm/issues/20887), now possible values are `Free` and `Standard`.
7
+
8
+
## Ignore changes on `kubernetes_version` from outside of Terraform
9
+
10
+
Related issue: #335
11
+
12
+
Two new resources would be created when upgrading from v6.x to v7.x:
13
+
14
+
*`null_resource.kubernetes_version_keeper`
15
+
*`azapi_update_resource.aks_cluster_post_create`
16
+
17
+
`azurerm_kubernetes_cluster.main` resource would ignore change on `kubernetes_version` from outside of Terraform in case AKS cluster's patch version has been upgraded automatically.
18
+
When you change `var.kubernetes_version`'s value, it would trigger a re-creation of `null_resource.kubernetes_version_keeper` and re-creation of `azapi_update_resource.aks_cluster_post_create`, which would upgrade the AKS cluster's `kubernetes_version`.
19
+
20
+
`azapi` provider is required to be configured in your Terraform configuration.
21
+
22
+
## Fix #315 by amending missing `linux_os_config` block
23
+
24
+
In v6.0, `default_node_pool.linux_os_config` block won't be added to `azurerm_kubernetes_cluster.main` resource when `var.enable_auto_scaling` is `true`. This bug has been fixed in v7.0.0 so you might see a diff on `azurerm_kubernetes_cluster.main` resource.
25
+
26
+
## Wrap `log_analytics_solution_id` to an object to fix #263.
27
+
28
+
`var.log_analytics_solution_id` is now an object with `id` attribute. This change is to fix #263.
29
+
30
+
## Remove unused net_profile_docker_bridge_cidr
31
+
32
+
`var.net_profile_docker_bridge_cidr` has been [deprecated](https://github.com/hashicorp/terraform-provider-azurerm/issues/18119) and is not used in the module anymore and has been removed.
Copy file name to clipboardExpand all lines: README.md
+8-94Lines changed: 8 additions & 94 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,105 +6,19 @@ This Terraform module deploys a Kubernetes cluster on Azure using AKS (Azure Kub
6
6
7
7
-> **NOTE:** If you have not assigned `client_id` or `client_secret`, A `SystemAssigned` identity will be created.
8
8
9
-
## Notice on Upgrade to V6.x
9
+
## Notice on breaking changes
10
10
11
-
We've added a CI pipeline for this module to speed up our code review and to enforce a high code quality standard, if you want to contribute by submitting a pull request, please read [Pre-Commit & Pr-Check & Test](#Pre-Commit--Pr-Check--Test) section, or your pull request might be rejected by CI pipeline.
11
+
Please be aware that major version(e.g., from 6.8.0 to 7.0.0) update contains breaking changes that may impact your infrastructure. It is crucial to review these changes with caution before proceeding with the upgrade.
12
12
13
-
A pull request will be reviewed when it has passed Pre Pull Request Check in the pipeline, and will be merged when it has passed the acceptance tests. Once the ci Pipeline failed, please read the pipeline's output, thanks for your cooperation.
13
+
In most cases, you will need to adjust your Terraform code to accommodate the changes introduced in the new major version. We strongly recommend reviewing the changelog and migration guide to understand the modifications and ensure a smooth transition.
14
14
15
-
## Notice on Upgrade to V5.x
15
+
To help you in this process, we have provided detailed documentation on the breaking changes, new features, and any deprecated functionalities. Please take the time to read through these resources to avoid any potential issues or disruptions to your infrastructure.
16
16
17
-
V5.0.0 is a major version upgrade and a lot of breaking changes have been introduced. Extreme caution must be taken during the upgrade to avoid resource replacement and downtime by accident.
17
+
* [Notice on Upgrade to v7.x](./NoticeOnUpgradeTov7.0.md)
18
+
* [Notice on Upgrade to v6.x](./NoticeOnUpgradeTov6.0.md)
19
+
* [Notice on Upgrade to v5.x](./NoticeOnUpgradeTov5.0.md)
18
20
19
-
Running the `terraform plan` first to inspect the plan is strongly advised.
20
-
21
-
### Terraform and terraform-provider-azurerm version restrictions
22
-
23
-
Now Terraform core's lowest version is v1.2.0 and terraform-provider-azurerm's lowest version is v3.21.0.
24
-
25
-
### variable `user_assigned_identity_id` has been renamed.
26
-
27
-
variable `user_assigned_identity_id` has been renamed to `identity_ids` and it's type has been changed from `string` to `list(string)`.
28
-
29
-
### `addon_profile` in outputs is no longer available.
30
-
31
-
It has been broken into the following new outputs:
32
-
33
-
* `aci_connector_linux`
34
-
* `aci_connector_linux_enabled`
35
-
* `azure_policy_enabled`
36
-
* `http_application_routing_enabled`
37
-
* `ingress_application_gateway`
38
-
* `ingress_application_gateway_enabled`
39
-
* `key_vault_secrets_provider`
40
-
* `key_vault_secrets_provider_enabled`
41
-
* `oms_agent`
42
-
* `oms_agent_enabled`
43
-
* `open_service_mesh_enabled`
44
-
45
-
### The following variables have been renamed from `enable_xxx` to `xxx_enabled`
46
-
47
-
* `enable_azure_policy` has been renamed to `azure_policy_enabled`
48
-
* `enable_http_application_routing` has been renamed to `http_application_routing_enabled`
49
-
* `enable_ingress_application_gateway` has been renamed to `ingress_application_gateway_enabled`
50
-
* `enable_log_analytics_workspace` has been renamed to `log_analytics_workspace_enabled`
51
-
* `enable_open_service_mesh` has been renamed to `open_service_mesh_enabled`
52
-
* `enable_role_based_access_control` has been renamed to `role_based_access_control_enabled`
53
-
54
-
### `nullable = true` has been added to the following variables so setting them to `null` explicitly will use the default value
55
-
56
-
* `log_analytics_workspace_enable`
57
-
* `os_disk_type`
58
-
* `private_cluster_enabled`
59
-
* `rbac_aad_managed`
60
-
* `rbac_aad_admin_group_object_ids`
61
-
* `network_policy`
62
-
* `enable_node_public_ip`
63
-
64
-
### `var.admin_username`'s default value has been removed
65
-
66
-
In v4.x `var.admin_username` has a default value `azureuser` and has been removed in V5.0.0. Since the `admin_username` argument in `linux_profile` block is a ForceNew argument, any value change to this argument will trigger a Kubernetes cluster replacement **SO THE EXTREME CAUTION MUST BE TAKEN**. The module's callers must set `var.admin_username` to `azureuser` explicitly if they didn't set it before.
67
-
68
-
### `module.ssh-key` has been removed
69
-
70
-
The file named `private_ssh_key` which contains the tls private key will be deleted since the `local_file` resource has been removed. Now the private key is exported via `generated_cluster_private_ssh_key` in output and the corresponding public key is exported via `generated_cluster_public_ssh_key` in output.
71
-
72
-
A `moved` block has been added to relocate the existing `tls_private_key` resource to the new address. If the `var.admin_username` is not `null`, no action is needed.
73
-
74
-
Resource `tls_private_key`'s creation now is conditional. Users may see the destruction of existing `tls_private_key` in the generated plan if `var.admin_username` is `null`.
75
-
76
-
### `system_assigned_identity` in the output has been renamed to `cluster_identity`
77
-
78
-
The `system_assigned_identity` was:
79
-
80
-
```hcl
81
-
output "system_assigned_identity" {
82
-
value = azurerm_kubernetes_cluster.main.identity
83
-
}
84
-
```
85
-
86
-
Now it has been renamed to `cluster_identity`, and the block has been changed to:
87
-
88
-
```hcl
89
-
output "cluster_identity" {
90
-
description = "The `azurerm_kubernetes_cluster`'s `identity` block."
91
-
value = try(azurerm_kubernetes_cluster.main.identity[0], null)
92
-
}
93
-
```
94
-
95
-
The callers who used to read the cluster's identity block need to remove the index in their expression, from `module.aks.system_assigned_identity[0]` to `module.aks.cluster_identity`.
96
-
97
-
### The following outputs are now sensitive. All outputs referenced them must be declared as sensitive too
98
-
99
-
* `client_certificate`
100
-
* `client_key`
101
-
* `cluster_ca_certificate`
102
-
* `generated_cluster_private_ssh_key`
103
-
* `host`
104
-
* `kube_admin_config_raw`
105
-
* `kube_config_raw`
106
-
* `password`
107
-
* `username`
21
+
Remember, upgrading to a major version with breaking changes should be done carefully and thoroughly tested in your environment. If you have any questions or concerns, please don't hesitate to reach out to our support team for assistance.
0 commit comments