Check api_server_authorized_ip_ranges when public_network_access_enabled is true

examples/multiple_node_pools/main.tf

@@ -45,11 +45,12 @@ locals {
 module "aks" {
   source = "../.."
 
-  prefix              = "prefix-${random_id.prefix.hex}"
-  resource_group_name = local.resource_group.name
-  os_disk_size_gb     = 60
-  sku_tier            = "Standard"
-  rbac_aad            = false
-  vnet_subnet_id      = azurerm_subnet.test.id
-  node_pools          = local.nodes
+  prefix                        = "prefix-${random_id.prefix.hex}"
+  resource_group_name           = local.resource_group.name
+  os_disk_size_gb               = 60
+  public_network_access_enabled = false
+  sku_tier                      = "Standard"
+  rbac_aad                      = false
+  vnet_subnet_id                = azurerm_subnet.test.id
+  node_pools                    = local.nodes
 }

examples/named_cluster/main.tf

@@ -69,6 +69,7 @@ module "aks_cluster_name" {
   cluster_log_analytics_workspace_name = "test-cluster"
   cluster_name                         = "test-cluster"
   disk_encryption_set_id               = azurerm_disk_encryption_set.des.id
+  public_network_access_enabled        = false
   identity_ids                         = [azurerm_user_assigned_identity.test.id]
   identity_type                        = "UserAssigned"
   log_analytics_solution = {

examples/startup/main.tf

@@ -47,11 +47,13 @@ module "aks" {
   agents_pool_linux_os_configs = [
     {
       transparent_huge_page_enabled = "always"
-      sysctl_configs = [{
-        fs_aio_max_nr               = 65536
-        fs_file_max                 = 100000
-        fs_inotify_max_user_watches = 1000000
-      }]
+      sysctl_configs = [
+        {
+          fs_aio_max_nr               = 65536
+          fs_file_max                 = 100000
+          fs_inotify_max_user_watches = 1000000
+        }
+      ]
     }
   ]
   agents_type                             = "VirtualMachineScaleSets"
@@ -87,7 +89,7 @@ module "aks" {
   network_policy                    = "azure"
   os_disk_size_gb                   = 60
   private_cluster_enabled           = true
-  public_network_access_enabled     = true
+  public_network_access_enabled     = false
   rbac_aad                          = true
   rbac_aad_managed                  = true
   role_based_access_control_enabled = true

examples/with_acr/main.tf

@@ -60,10 +60,11 @@ module "aks" {
   attached_acr_id_map = {
     example = azurerm_container_registry.example.id
   }
-  network_plugin  = "azure"
-  network_policy  = "azure"
-  os_disk_size_gb = 60
-  sku_tier        = "Standard"
-  rbac_aad        = false
-  vnet_subnet_id  = azurerm_subnet.test.id
+  public_network_access_enabled = false
+  network_plugin                = "azure"
+  network_policy                = "azure"
+  os_disk_size_gb               = 60
+  sku_tier                      = "Standard"
+  rbac_aad                      = false
+  vnet_subnet_id                = azurerm_subnet.test.id
 }

examples/without_monitor/main.tf

@@ -39,11 +39,12 @@ resource "azurerm_dns_zone" "aks_web_app_routing" {
 module "aks_without_monitor" {
   source = "../.."
 
-  prefix                 = "prefix2-${random_id.prefix.hex}"
-  resource_group_name    = local.resource_group.name
-  admin_username         = null
-  azure_policy_enabled   = true
-  disk_encryption_set_id = azurerm_disk_encryption_set.des.id
+  prefix                        = "prefix2-${random_id.prefix.hex}"
+  resource_group_name           = local.resource_group.name
+  admin_username                = null
+  azure_policy_enabled          = true
+  disk_encryption_set_id        = azurerm_disk_encryption_set.des.id
+  public_network_access_enabled = false
   #checkov:skip=CKV_AZURE_4:The logging is turn off for demo purpose. DO NOT DO THIS IN PRODUCTION ENVIRONMENT!
   log_analytics_workspace_enabled   = false
   net_profile_pod_cidr              = "10.1.0.0/16"

main.tf

@@ -442,6 +442,10 @@ resource "azurerm_kubernetes_cluster" "main" {
       condition     = !(var.kms_enabled && var.identity_type != "UserAssigned")
       error_message = "KMS etcd encryption doesn't work with system-assigned managed identity."
     }
+    precondition {
+      condition     = !var.public_network_access_enabled || try(contains(var.api_server_authorized_ip_ranges, "0.0.0.0/32"), false)
+      error_message = "When `public_network_access_enabled` is set to true, `0.0.0.0/32` must be added to `authorized_ip_ranges` in the `api_server_access_profile block` (https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/kubernetes_cluster#public_network_access_enabled)."
+    }
   }
 }