Remove module.ssh-key. Moving tls_private_key inside the module to root directory, output tls keys.

main.tf

@@ -2,9 +2,14 @@ data "azurerm_resource_group" "main" {
   name = var.resource_group_name
 }
 
-module "ssh-key" {
-  source         = "./modules/ssh-key"
-  public_ssh_key = var.public_ssh_key == "" ? "" : var.public_ssh_key
+moved {
+  from = module.ssh-key.tls_private_key.ssh
+  to   = tls_private_key.ssh
+}
+
+resource "tls_private_key" "ssh" {
+  algorithm = "RSA"
+  rsa_bits  = 2048
 }
 
 resource "azurerm_kubernetes_cluster" "main" {
@@ -17,12 +22,15 @@ resource "azurerm_kubernetes_cluster" "main" {
   sku_tier                = var.sku_tier
   private_cluster_enabled = var.private_cluster_enabled
 
-  linux_profile {
-    admin_username = var.admin_username
+  dynamic "linux_profile" {
+    for_each = var.admin_username == null ? [] : ["linux_profile"]
+    content {
+      admin_username = var.admin_username
 
-    ssh_key {
-      # remove any new lines using the replace interpolation function
-      key_data = replace(var.public_ssh_key == "" ? module.ssh-key.public_ssh_key : var.public_ssh_key, "\n", "")
+      ssh_key {
+        # remove any new lines using the replace interpolation function
+        key_data = replace(coalesce(var.public_ssh_key, tls_private_key.ssh.public_key_openssh), "\n", "")
+      }
     }
   }
 

outputs.tf

@@ -133,3 +133,14 @@ output "open_service_mesh_enabled" {
 output "oidc_issuer_url" {
   value = azurerm_kubernetes_cluster.main.oidc_issuer_url
 }
+
+output "generated_cluster_public_ssh_key" {
+  description = "The cluster will use this generated public key as ssh key when `var.public_ssh_key` is empty or null."
+  value       = try(azurerm_kubernetes_cluster.main.linux_profile[0], null) != null ? (var.public_ssh_key == "" || var.public_ssh_key == null ? tls_private_key.ssh.public_key_openssh : null) : null
+}
+
+output "generated_cluster_private_ssh_key" {
+  description = "The cluster will use this generated private key as ssh key when `var.public_ssh_key` is empty or null."
+  sensitive   = true
+  value       = try(azurerm_kubernetes_cluster.main.linux_profile[0], null) != null ? (var.public_ssh_key == "" || var.public_ssh_key == null ? tls_private_key.ssh.private_key_pem : null) : null
+}

test/fixture/main.tf

@@ -90,6 +90,8 @@ module "aks_cluster_name" {
   prefix                               = "prefix"
   resource_group_name                  = azurerm_resource_group.main.name
   enable_log_analytics_workspace       = true
+  # Not necessary, just for demo purpose.
+  admin_username                       = "azureuser"
   cluster_log_analytics_workspace_name = "test-cluster"
   net_profile_pod_cidr                 = "10.1.0.0/16"
   identity_type                        = "UserAssigned"

test/fixture/outputs.tf

@@ -67,4 +67,4 @@ output "test_password" {
 output "test_kube_raw" {
   sensitive = true
   value     = module.aks.kube_config_raw
-}
+}

variables.tf

@@ -39,8 +39,8 @@ variable "client_secret" {
 }
 
 variable "admin_username" {
-  default     = "azureuser"
-  description = "The username of the local administrator to be created on the Kubernetes cluster"
+  default     = null
+  description = "The username of the local administrator to be created on the Kubernetes cluster. Set this variable to `null` to turn off the cluster's `linux_profile`. Changing this forces a new resource to be created."
   type        = string
 }
 
@@ -69,7 +69,7 @@ variable "agents_count" {
 }
 
 variable "public_ssh_key" {
-  description = "A custom ssh key to control access to the AKS cluster"
+  description = "A custom ssh key to control access to the AKS cluster. Changing this forces a new resource to be created."
   type        = string
   default     = ""
 }

versions.tf

@@ -3,7 +3,7 @@ terraform {
   required_providers {
     azurerm = {
       source  = "hashicorp/azurerm"
-      version = "~> 3.11"
+      version = "~> 3.3"
     }
   }