Skip to content

Commit c10363b

Browse files
tombuildsstufftombuildsstuff
authored
Merge pull request #10398 from brunhil/aks-host-encryption
Add `enable_host_encryption` to AKS node pool resources
2 parents ff2eb7f + b3ec0b7 commit c10363b

6 files changed

+138
-15
lines changed

‎azurerm/internal/services/containers/kubernetes_cluster_node_pool_resource.go

+21-8
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,12 @@ func resourceKubernetesClusterNodePool() *schema.Resource {
8686
Optional: true,
8787
},
8888

89+
"enable_host_encryption": {
90+
Type: schema.TypeBool,
91+
Optional: true,
92+
ForceNew: true,
93+
},
94+
8995
"enable_node_public_ip": {
9096
Type: schema.TypeBool,
9197
Optional: true,
@@ -284,16 +290,18 @@ func resourceKubernetesClusterNodePoolCreate(d *schema.ResourceData, meta interf
284290
spotMaxPrice := d.Get("spot_max_price").(float64)
285291
t := d.Get("tags").(map[string]interface{})
286292
vmSize := d.Get("vm_size").(string)
293+
enableHostEncryption := d.Get("enable_host_encryption").(bool)
287294

288295
profile := containerservice.ManagedClusterAgentPoolProfileProperties{
289-
OsType: containerservice.OSType(osType),
290-
EnableAutoScaling: utils.Bool(enableAutoScaling),
291-
EnableNodePublicIP: utils.Bool(d.Get("enable_node_public_ip").(bool)),
292-
Mode: mode,
293-
ScaleSetPriority: containerservice.ScaleSetPriority(priority),
294-
Tags: tags.Expand(t),
295-
Type: containerservice.VirtualMachineScaleSets,
296-
VMSize: containerservice.VMSizeTypes(vmSize),
296+
OsType: containerservice.OSType(osType),
297+
EnableAutoScaling: utils.Bool(enableAutoScaling),
298+
EnableNodePublicIP: utils.Bool(d.Get("enable_node_public_ip").(bool)),
299+
Mode: mode,
300+
ScaleSetPriority: containerservice.ScaleSetPriority(priority),
301+
Tags: tags.Expand(t),
302+
Type: containerservice.VirtualMachineScaleSets,
303+
VMSize: containerservice.VMSizeTypes(vmSize),
304+
EnableEncryptionAtHost: utils.Bool(enableHostEncryption),
297305

298306
// this must always be sent during creation, but is optional for auto-scaled clusters during update
299307
Count: utils.Int32(int32(count)),
@@ -461,6 +469,10 @@ func resourceKubernetesClusterNodePoolUpdate(d *schema.ResourceData, meta interf
461469
props.EnableAutoScaling = utils.Bool(enableAutoScaling)
462470
}
463471

472+
if d.HasChange("enable_host_encryption") {
473+
props.EnableEncryptionAtHost = utils.Bool(d.Get("enable_host_encryption").(bool))
474+
}
475+
464476
if d.HasChange("enable_node_public_ip") {
465477
props.EnableNodePublicIP = utils.Bool(d.Get("enable_node_public_ip").(bool))
466478
}
@@ -592,6 +604,7 @@ func resourceKubernetesClusterNodePoolRead(d *schema.ResourceData, meta interfac
592604

593605
d.Set("enable_auto_scaling", props.EnableAutoScaling)
594606
d.Set("enable_node_public_ip", props.EnableNodePublicIP)
607+
d.Set("enable_host_encryption", props.EnableEncryptionAtHost)
595608

596609
evictionPolicy := ""
597610
if props.ScaleSetEvictionPolicy != "" {

‎azurerm/internal/services/containers/kubernetes_cluster_node_pool_resource_test.go

+39
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@ var kubernetesNodePoolTests = map[string]func(t *testing.T){
4747
"windows": testAccKubernetesClusterNodePool_windows,
4848
"windowsAndLinux": testAccKubernetesClusterNodePool_windowsAndLinux,
4949
"zeroSize": testAccKubernetesClusterNodePool_zeroSize,
50+
"hostEncryption": testAccKubernetesClusterNodePool_hostEncryption,
5051
}
5152

5253
func TestAccKubernetesClusterNodePool_autoScale(t *testing.T) {
@@ -706,6 +707,26 @@ func testAccKubernetesClusterNodePool_zeroSize(t *testing.T) {
706707
})
707708
}
708709

710+
func TestAccKubernetesClusterNodePool_hostEncryption(t *testing.T) {
711+
checkIfShouldRunTestsIndividually(t)
712+
testAccKubernetesClusterNodePool_hostEncryption(t)
713+
}
714+
715+
func testAccKubernetesClusterNodePool_hostEncryption(t *testing.T) {
716+
data := acceptance.BuildTestData(t, "azurerm_kubernetes_cluster_node_pool", "test")
717+
r := KubernetesClusterNodePoolResource{}
718+
719+
data.ResourceTest(t, r, []resource.TestStep{
720+
{
721+
Config: r.hostEncryption(data),
722+
Check: resource.ComposeTestCheckFunc(
723+
check.That(data.ResourceName).ExistsInAzure(r),
724+
check.That(data.ResourceName).Key("enable_host_encryption").HasValue("true"),
725+
),
726+
},
727+
})
728+
}
729+
709730
func TestAccKubernetesClusterNodePool_maxSize(t *testing.T) {
710731
checkIfShouldRunTestsIndividually(t)
711732
testAccKubernetesClusterNodePool_maxSize(t)
@@ -1539,6 +1560,24 @@ resource "azurerm_kubernetes_cluster_node_pool" "test" {
15391560
`, r.templateConfig(data))
15401561
}
15411562

1563+
func (r KubernetesClusterNodePoolResource) hostEncryption(data acceptance.TestData) string {
1564+
return fmt.Sprintf(`
1565+
provider "azurerm" {
1566+
features {}
1567+
}
1568+
1569+
%s
1570+
1571+
resource "azurerm_kubernetes_cluster_node_pool" "test" {
1572+
name = "internal"
1573+
kubernetes_cluster_id = azurerm_kubernetes_cluster.test.id
1574+
vm_size = "Standard_DS2_v2"
1575+
enable_host_encryption = true
1576+
node_count = 1
1577+
}
1578+
`, r.templateConfig(data))
1579+
}
1580+
15421581
func (r KubernetesClusterNodePoolResource) maxSizeConfig(data acceptance.TestData) string {
15431582
return fmt.Sprintf(`
15441583
provider "azurerm" {

‎azurerm/internal/services/containers/kubernetes_cluster_resource_test.go

+54
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,10 @@ import (
66
"net/http"
77
"testing"
88

9+
"github.com/hashicorp/terraform-plugin-sdk/helper/resource"
910
"github.com/hashicorp/terraform-plugin-sdk/terraform"
1011
"github.com/terraform-providers/terraform-provider-azurerm/azurerm/internal/acceptance"
12+
"github.com/terraform-providers/terraform-provider-azurerm/azurerm/internal/acceptance/check"
1113
"github.com/terraform-providers/terraform-provider-azurerm/azurerm/internal/clients"
1214
"github.com/terraform-providers/terraform-provider-azurerm/azurerm/internal/services/containers/parse"
1315
"github.com/terraform-providers/terraform-provider-azurerm/azurerm/utils"
@@ -86,3 +88,55 @@ func (KubernetesClusterResource) updateDefaultNodePoolAgentCount(nodeCount int)
8688
return nil
8789
}
8890
}
91+
92+
func TestAccKubernetesCluster_hostEncryption(t *testing.T) {
93+
checkIfShouldRunTestsIndividually(t)
94+
testAccKubernetesCluster_hostEncryption(t)
95+
}
96+
97+
func testAccKubernetesCluster_hostEncryption(t *testing.T) {
98+
data := acceptance.BuildTestData(t, "azurerm_kubernetes_cluster", "test")
99+
r := KubernetesClusterResource{}
100+
101+
data.ResourceTest(t, r, []resource.TestStep{
102+
{
103+
Config: r.hostEncryption(data, currentKubernetesVersion),
104+
Check: resource.ComposeTestCheckFunc(
105+
check.That(data.ResourceName).ExistsInAzure(r),
106+
check.That(data.ResourceName).Key("default_node_pool.0.enable_host_encryption").HasValue("true"),
107+
),
108+
},
109+
})
110+
}
111+
112+
func (KubernetesClusterResource) hostEncryption(data acceptance.TestData, controlPlaneVersion string) string {
113+
return fmt.Sprintf(`
114+
provider "azurerm" {
115+
features {}
116+
}
117+
118+
resource "azurerm_resource_group" "test" {
119+
name = "acctestRG-aks-%d"
120+
location = "%s"
121+
}
122+
123+
resource "azurerm_kubernetes_cluster" "test" {
124+
name = "acctestaks%d"
125+
location = azurerm_resource_group.test.location
126+
resource_group_name = azurerm_resource_group.test.name
127+
dns_prefix = "acctestaks%d"
128+
kubernetes_version = %q
129+
130+
default_node_pool {
131+
name = "default"
132+
node_count = 1
133+
vm_size = "Standard_DS2_v2"
134+
enable_host_encryption = true
135+
}
136+
137+
identity {
138+
type = "SystemAssigned"
139+
}
140+
}
141+
`, data.RandomInteger, data.Locations.Primary, data.RandomInteger, data.RandomInteger, controlPlaneVersion)
142+
}

‎azurerm/internal/services/containers/kubernetes_nodepool.go

+20-7
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,12 @@ func SchemaDefaultNodePool() *schema.Schema {
6868
ForceNew: true,
6969
},
7070

71+
"enable_host_encryption": {
72+
Type: schema.TypeBool,
73+
Optional: true,
74+
ForceNew: true,
75+
},
76+
7177
"max_count": {
7278
Type: schema.TypeInt,
7379
Optional: true,
@@ -206,13 +212,14 @@ func ExpandDefaultNodePool(d *schema.ResourceData) (*[]containerservice.ManagedC
206212
t := raw["tags"].(map[string]interface{})
207213

208214
profile := containerservice.ManagedClusterAgentPoolProfile{
209-
EnableAutoScaling: utils.Bool(enableAutoScaling),
210-
EnableNodePublicIP: utils.Bool(raw["enable_node_public_ip"].(bool)),
211-
Name: utils.String(raw["name"].(string)),
212-
NodeLabels: nodeLabels,
213-
Tags: tags.Expand(t),
214-
Type: containerservice.AgentPoolType(raw["type"].(string)),
215-
VMSize: containerservice.VMSizeTypes(raw["vm_size"].(string)),
215+
EnableAutoScaling: utils.Bool(enableAutoScaling),
216+
EnableNodePublicIP: utils.Bool(raw["enable_node_public_ip"].(bool)),
217+
EnableEncryptionAtHost: utils.Bool(raw["enable_host_encryption"].(bool)),
218+
Name: utils.String(raw["name"].(string)),
219+
NodeLabels: nodeLabels,
220+
Tags: tags.Expand(t),
221+
Type: containerservice.AgentPoolType(raw["type"].(string)),
222+
VMSize: containerservice.VMSizeTypes(raw["vm_size"].(string)),
216223

217224
// at this time the default node pool has to be Linux or the AKS cluster fails to provision with:
218225
// Pods not in Running status: coredns-7fc597cc45-v5z7x,coredns-autoscaler-7ccc76bfbd-djl7j,metrics-server-cbd95f966-5rl97,tunnelfront-7d9884977b-wpbvn
@@ -344,6 +351,11 @@ func FlattenDefaultNodePool(input *[]containerservice.ManagedClusterAgentPoolPro
344351
enableNodePublicIP = *agentPool.EnableNodePublicIP
345352
}
346353

354+
enableHostEncryption := false
355+
if agentPool.EnableEncryptionAtHost != nil {
356+
enableHostEncryption = *agentPool.EnableEncryptionAtHost
357+
}
358+
347359
maxCount := 0
348360
if agentPool.MaxCount != nil {
349361
maxCount = int(*agentPool.MaxCount)
@@ -402,6 +414,7 @@ func FlattenDefaultNodePool(input *[]containerservice.ManagedClusterAgentPoolPro
402414
"availability_zones": availabilityZones,
403415
"enable_auto_scaling": enableAutoScaling,
404416
"enable_node_public_ip": enableNodePublicIP,
417+
"enable_host_encryption": enableHostEncryption,
405418
"max_count": maxCount,
406419
"max_pods": maxPods,
407420
"min_count": minCount,

‎website/docs/r/kubernetes_cluster.html.markdown

+2
Original file line numberDiff line numberDiff line change
@@ -229,6 +229,8 @@ A `default_node_pool` block supports the following:
229229

230230
-> **NOTE:** If you're using AutoScaling, you may wish to use [Terraform's `ignore_changes` functionality](https://www.terraform.io/docs/configuration/resources.html#ignore_changes) to ignore changes to the `node_count` field.
231231

232+
* `enable_host_encryption` - (Optional) Should the nodes in the Default Node Pool have host encryption enabled? Defaults to `false`.
233+
232234
* `enable_node_public_ip` - (Optional) Should nodes in this Node Pool have a Public IP Address? Defaults to `false`.
233235

234236
* `max_pods` - (Optional) The maximum number of pods that can run on each agent. Changing this forces a new resource to be created.

‎website/docs/r/kubernetes_cluster_node_pool.html.markdown

+2
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,8 @@ The following arguments are supported:
7373

7474
* `enable_auto_scaling` - (Optional) Whether to enable [auto-scaler](https://docs.microsoft.com/en-us/azure/aks/cluster-autoscaler). Defaults to `false`.
7575

76+
* `enable_host_encryption` - (Optional) Should the nodes in this Node Pool have host encryption enabled? Defaults to `false`.
77+
7678
~> **NOTE:** Additional fields must be configured depending on the value of this field - see below.
7779

7880
* `enable_node_public_ip` - (Optional) Should each node have a Public IP Address? Defaults to `false`.

0 commit comments

Comments
 (0)