Skip to content

Commit

Permalink
Add support for Azure Policy for AKS add on
Browse files Browse the repository at this point in the history 
Signed-off-by: Graham Hayes <gr@ham.ie>
  • Loading branch information
@grahamhayes
grahamhayes committed Oct 3, 2019
1 parent 8787387 commit fd20620
Show file tree
Hide file tree
Showing 6 changed files with 190 additions and 7 deletions.
28 changes: 28 additions & 0 deletions azurerm/data_source_kubernetes_cluster.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -77,6 +77,20 @@ func dataSourceArmKubernetesCluster() *schema.Resource {
},
},
},

"azure_policy": {
Type: schema.TypeList,
MaxItems: 1,
Optional: true,
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
"enabled": {
Type: schema.TypeBool,
Required: true,
},
},
},
},
},
},
},
Expand Down Expand Up @@ -622,6 +636,20 @@ func flattenKubernetesClusterDataSourceAddonProfiles(profile map[string]*contain
}
values["kube_dashboard"] = kubeDashboards

azurePolicies := make([]interface{}, 0)
if azurePolicy := profile["azurepolicy"]; azurePolicy != nil {
enabled := false
if enabledVal := azurePolicy.Enabled; enabledVal != nil {
enabled = *enabledVal
}

output := map[string]interface{}{
"enabled": enabled,
}
azurePolicies = append(azurePolicies, output)
}
values["azure_policy"] = azurePolicies

return []interface{}{values}
}

Expand Down
36 changes: 36 additions & 0 deletions azurerm/data_source_kubernetes_cluster_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -416,6 +416,30 @@ func TestAccDataSourceAzureRMKubernetesCluster_addOnProfileKubeDashboard(t *test
})
}

func TestAccDataSourceAzureRMKubernetesCluster_addOnProfileAzurePolicy(t *testing.T) {
resourceName := "azurerm_kubernetes_cluster.test"
ri := tf.AccRandTimeInt()
clientId := os.Getenv("ARM_CLIENT_ID")
clientSecret := os.Getenv("ARM_CLIENT_SECRET")
config := testAccDataSourceAzureRMKubernetesCluster_addOnProfileAzurePolicy(ri, clientId, clientSecret, testLocation())

resource.ParallelTest(t, resource.TestCase{
PreCheck: func() { testAccPreCheck(t) },
Providers: testAccProviders,
CheckDestroy: testCheckAzureRMKubernetesClusterDestroy,
Steps: []resource.TestStep{
{
Config: config,
Check: resource.ComposeTestCheckFunc(
testCheckAzureRMKubernetesClusterExists(resourceName),
resource.TestCheckResourceAttr(resourceName, "addon_profile.0.azure_policy.#", "1"),
resource.TestCheckResourceAttr(resourceName, "addon_profile.0.azure_policy.0.enabled", "true"),
),
},
},
})
}

func TestAccDataSourceAzureRMKubernetesCluster_addOnProfileRouting(t *testing.T) {
dataSourceName := "data.azurerm_kubernetes_cluster.test"
ri := tf.AccRandTimeInt()
Expand Down Expand Up @@ -693,6 +717,18 @@ data "azurerm_kubernetes_cluster" "test" {
`, r)
}

func testAccDataSourceAzureRMKubernetesCluster_addOnProfileAzurePolicy(rInt int, clientId string, clientSecret string, location string) string {
r := testAccAzureRMKubernetesCluster_addonProfileAzurePolicy(rInt, clientId, clientSecret, location)
return fmt.Sprintf(`
%s
data "azurerm_kubernetes_cluster" "test" {
name = "${azurerm_kubernetes_cluster.test.name}"
resource_group_name = "${azurerm_kubernetes_cluster.test.resource_group_name}"
}
`, r)
}

func testAccDataSourceAzureRMKubernetesCluster_addOnProfileRouting(rInt int, clientId string, clientSecret string, location string) string {
r := testAccAzureRMKubernetesCluster_addonProfileRouting(rInt, clientId, clientSecret, location)
return fmt.Sprintf(`
Expand Down
39 changes: 39 additions & 0 deletions azurerm/resource_arm_kubernetes_cluster.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -315,6 +315,20 @@ func resourceArmKubernetesCluster() *schema.Resource {
},
},
},

"azure_policy": {
Type: schema.TypeList,
MaxItems: 1,
Optional: true,
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
"enabled": {
Type: schema.TypeBool,
Required: true,
},
},
},
},
},
},
},
Expand Down Expand Up @@ -1043,6 +1057,17 @@ func expandKubernetesClusterAddonProfiles(d *schema.ResourceData) map[string]*co
}
}

azurePolicy := profile["azure_policy"].([]interface{})
if len(azurePolicy) > 0 {
value := azurePolicy[0].(map[string]interface{})
enabled := value["enabled"].(bool)

addonProfiles["azurepolicy"] = &containerservice.ManagedClusterAddonProfile{
Enabled: utils.Bool(enabled),
Config: nil,
}
}

return addonProfiles
}

Expand Down Expand Up @@ -1123,6 +1148,20 @@ func flattenKubernetesClusterAddonProfiles(profile map[string]*containerservice.
}
values["kube_dashboard"] = kubeDashboards

azurePolicies := make([]interface{}, 0)
if azurePolicy := profile["azurepolicy"]; azurePolicy != nil {
enabled := false
if enabledVal := azurePolicy.Enabled; enabledVal != nil {
enabled = *enabledVal
}

output := map[string]interface{}{
"enabled": enabled,
}
azurePolicies = append(azurePolicies, output)
}
values["azure_policy"] = azurePolicies

return []interface{}{values}
}

Expand Down
65 changes: 65 additions & 0 deletions azurerm/resource_arm_kubernetes_cluster_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -439,6 +439,30 @@ func TestAccAzureRMKubernetesCluster_addonProfileKubeDashboard(t *testing.T) {
})
}

func TestAccAzureRMKubernetesCluster_addonProfileAzurePolicy(t *testing.T) {
resourceName := "azurerm_kubernetes_cluster.test"
ri := tf.AccRandTimeInt()
clientId := os.Getenv("ARM_CLIENT_ID")
clientSecret := os.Getenv("ARM_CLIENT_SECRET")
config := testAccAzureRMKubernetesCluster_addonProfileAzurePolicy(ri, clientId, clientSecret, testLocation())

resource.ParallelTest(t, resource.TestCase{
PreCheck: func() { testAccPreCheck(t) },
Providers: testAccProviders,
CheckDestroy: testCheckAzureRMKubernetesClusterDestroy,
Steps: []resource.TestStep{
{
Config: config,
Check: resource.ComposeTestCheckFunc(
testCheckAzureRMKubernetesClusterExists(resourceName),
resource.TestCheckResourceAttr(resourceName, "addon_profile.0.azure_policy.#", "1"),
resource.TestCheckResourceAttr(resourceName, "addon_profile.0.azure_policy.0.enabled", "true"),
),
},
},
})
}

func TestAccAzureRMKubernetesCluster_advancedNetworkingKubenet(t *testing.T) {
resourceName := "azurerm_kubernetes_cluster.test"
ri := tf.AccRandTimeInt()
Expand Down Expand Up @@ -1532,6 +1556,47 @@ resource "azurerm_kubernetes_cluster" "test" {
`, rInt, location, rInt, rInt, rInt, clientId, clientSecret)
}

func testAccAzureRMKubernetesCluster_addonProfileAzurePolicy(rInt int, clientId string, clientSecret string, location string) string {
return fmt.Sprintf(`
resource "azurerm_resource_group" "test" {
name = "acctestRG-%d"
location = "%s"
}
resource "azurerm_kubernetes_cluster" "test" {
name = "acctestaks%d"
location = "${azurerm_resource_group.test.location}"
resource_group_name = "${azurerm_resource_group.test.name}"
dns_prefix = "acctestaks%d"
linux_profile {
admin_username = "acctestuser%d"
ssh_key {
key_data = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqaZoyiz1qbdOQ8xEf6uEu1cCwYowo5FHtsBhqLoDnnp7KUTEBN+L2NxRIfQ781rxV6Iq5jSav6b2Q8z5KiseOlvKA/RF2wqU0UPYqQviQhLmW6THTpmrv/YkUCuzxDpsH7DUDhZcwySLKVVe0Qm3+5N2Ta6UYH3lsDf9R9wTP2K/+vAnflKebuypNlmocIvakFWoZda18FOmsOoIVXQ8HWFNCuw9ZCunMSN62QGamCe3dL5cXlkgHYv7ekJE15IA9aOJcM7e90oeTqo+7HTcWfdu0qQqPWY5ujyMw/llas8tsXY85LFqRnr3gJ02bAscjc477+X+j/gkpFoN1QEmt terraform@demo.tld"
}
}
agent_pool_profile {
name = "default"
count = "1"
vm_size = "Standard_DS2_v2"
}
service_principal {
client_id = "%s"
client_secret = "%s"
}
addon_profile {
azure_policy {
enabled = true
}
}
}
`, rInt, location, rInt, rInt, rInt, clientId, clientSecret)
}

func testAccAzureRMKubernetesCluster_upgrade(rInt int, location, clientId, clientSecret, version string) string {
return fmt.Sprintf(`
resource "azurerm_resource_group" "test" {
Expand Down
16 changes: 12 additions & 4 deletions website/docs/d/kubernetes_cluster.html.markdown
View file
Original file line number Diff line number Diff line change
Expand Up @@ -80,6 +80,8 @@ A `addon_profile` block exports the following:

* `kube_dashboard` - A `kube_dashboard` block.

* `azure_policy` - A `azure_policy` block.

---

A `agent_pool_profile` block exports the following:
Expand All @@ -90,11 +92,11 @@ A `agent_pool_profile` block exports the following:

* `max_pods` - The maximum number of pods that can run on each agent.

* `availability_zones` - The availability zones used for the nodes.
* `availability_zones` - The availability zones used for the nodes.

* `enable_auto_scaling` - If the auto-scaler is enabled.
* `enable_auto_scaling` - If the auto-scaler is enabled.

* `min_count` - Minimum number of nodes for auto-scaling
* `min_count` - Minimum number of nodes for auto-scaling

* `max_count` - Maximum number of nodes for auto-scaling

Expand Down Expand Up @@ -199,7 +201,13 @@ A `oms_agent` block exports the following:

A `kube_dashboard` block supports the following:

* `enabled` - (Required) Is the Kubernetes Dashboard enabled?
* `enabled` - (Required) Is the Kubernetes Dashboard enabled?

---

A `azure_policy` block supports the following:

* `enabled` - (Required) Is Azure Policy for Kubernetes enabled?

---

Expand Down
13 changes: 10 additions & 3 deletions website/docs/r/kubernetes_cluster.html.markdown
View file
Original file line number Diff line number Diff line change
Expand Up @@ -93,7 +93,7 @@ A `aci_connector_linux` block supports the following:

```
resource "azurerm_subnet" "virtual" {
...
delegation {
Expand Down Expand Up @@ -144,6 +144,7 @@ A `addon_profile` block supports the following:
* `http_application_routing` - (Optional) A `http_application_routing` block.
* `oms_agent` - (Optional) A `oms_agent` block. For more details, please visit [How to onboard Azure Monitor for containers](https://docs.microsoft.com/en-us/azure/monitoring/monitoring-container-insights-onboard).
* `kube_dashboard` - (Optional) A `kube_dashboard` block.
* `azure_policy` - (Optional) A `azure_policy` block. For more details please visit [Understand Azure Policy for Azure Kubernetes Service](https://docs.microsoft.com/en-ie/azure/governance/policy/concepts/rego-for-aks)

---

Expand All @@ -159,7 +160,7 @@ A `agent_pool_profile` block supports the following:

* `enable_auto_scaling` - (Optional) Whether to enable [auto-scaler](https://docs.microsoft.com/en-us/azure/aks/cluster-autoscaler). Note that auto scaling feature requires the that the `type` is set to `VirtualMachineScaleSets`

* `min_count` - (Optional) Minimum number of nodes for auto-scaling
* `min_count` - (Optional) Minimum number of nodes for auto-scaling

* `max_count` - (Optional) Maximum number of nodes for auto-scaling

Expand Down Expand Up @@ -247,7 +248,13 @@ A `oms_agent` block supports the following:

A `kube_dashboard` block supports the following:

* `enabled` - (Required) Is the Kubernetes Dashboard enabled?
* `enabled` - (Required) Is the Kubernetes Dashboard enabled?
---


A `azure_policy` block supports the following:

* `enabled` - (Required) Is the Azure Policy for Kubernetes Add On enabled?

---

Expand Down

0 comments on commit fd20620

Please sign in to comment.