From 3f2d9142d201a1c97f626f9af4be04a0e86895c2 Mon Sep 17 00:00:00 2001 From: Marco Mari <130982006+mamari90@users.noreply.github.com> Date: Wed, 13 Nov 2024 14:52:11 +0100 Subject: [PATCH] feat: PAYMCLOUD-140 added kubernetes private dns zone output (#371) * PAYMCLOUD-140 - added aks managed dns zone output * updated minimum required version --- kubernetes_cluster/10_outputs.tf | 5 +++++ kubernetes_cluster/99_locals.tf | 4 ++++ kubernetes_cluster/99_versions.tf | 2 +- kubernetes_cluster/README.md | 15 ++++++++------- kubernetes_cluster_udr/10_outputs.tf | 5 +++++ kubernetes_cluster_udr/99_locals.tf | 4 ++++ kubernetes_cluster_udr/README.md | 13 +++++++------ 7 files changed, 34 insertions(+), 14 deletions(-) create mode 100644 kubernetes_cluster/99_locals.tf create mode 100644 kubernetes_cluster_udr/99_locals.tf diff --git a/kubernetes_cluster/10_outputs.tf b/kubernetes_cluster/10_outputs.tf index 6060f5f3..58fc4d1a 100644 --- a/kubernetes_cluster/10_outputs.tf +++ b/kubernetes_cluster/10_outputs.tf @@ -16,6 +16,11 @@ output "private_fqdn" { description = "The FQDN for the Kubernetes Cluster when private link has been enabled, which is only resolvable inside the Virtual Network used by the Kubernetes Cluster." } +output "managed_private_dns_zone_name" { + value = local.managed_private_dns_zone_name + description = "The managed private dns zone name for the Kubernetes Cluster when private link has been enabled. Derived from private_fqdn" +} + output "kubelet_identity_id" { value = azurerm_kubernetes_cluster.this.kubelet_identity[0].object_id description = "The Object ID of the user-defined Managed Identity assigned to the Kubelets.If not specified a Managed Identity is created automatically. Changing this forces a new resource to be created." diff --git a/kubernetes_cluster/99_locals.tf b/kubernetes_cluster/99_locals.tf new file mode 100644 index 00000000..f217f29b --- /dev/null +++ b/kubernetes_cluster/99_locals.tf @@ -0,0 +1,4 @@ +locals { + aks_fqdn_levels = length(split(".", azurerm_kubernetes_cluster.this.private_fqdn)) + managed_private_dns_zone_name = join(".", slice(split(".", azurerm_kubernetes_cluster.this.private_fqdn), 1, local.aks_fqdn_levels)) +} diff --git a/kubernetes_cluster/99_versions.tf b/kubernetes_cluster/99_versions.tf index 3730a1c3..77706d56 100644 --- a/kubernetes_cluster/99_versions.tf +++ b/kubernetes_cluster/99_versions.tf @@ -4,7 +4,7 @@ terraform { required_providers { azurerm = { source = "hashicorp/azurerm" - version = "~>3.100" + version = "~>3.105" } null = { source = "hashicorp/null" diff --git a/kubernetes_cluster/README.md b/kubernetes_cluster/README.md index d94831a6..c32e4feb 100644 --- a/kubernetes_cluster/README.md +++ b/kubernetes_cluster/README.md @@ -664,7 +664,7 @@ sh terraform.sh import dev01 'module.aks[0].azurerm_kubernetes_cluster_node_pool | Name | Version | |------|---------| | [terraform](#requirement\_terraform) | >= 1.3.0 | -| [azurerm](#requirement\_azurerm) | ~>3.100 | +| [azurerm](#requirement\_azurerm) | ~>3.105 | | [null](#requirement\_null) | ~> 3.2 | ## Modules @@ -692,21 +692,21 @@ No modules. | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| | [aad\_admin\_group\_ids](#input\_aad\_admin\_group\_ids) | IDs of the Azure AD group for cluster-admin access | `list(string)` | n/a | yes | -| [action](#input\_action) | The ID of the Action Group and optional map of custom string properties to include with the post webhook operation. | 
set(object(
    {
      action_group_id    = string
      webhook_properties = map(string)
    }
  ))
| `[]` | no | +| [action](#input\_action) | The ID of the Action Group and optional map of custom string properties to include with the post webhook operation. | 
set(object(
    {
      action_group_id    = string
      webhook_properties = map(string)
    }
  ))
| `[]` | no | | [addon\_azure\_key\_vault\_secrets\_provider\_enabled](#input\_addon\_azure\_key\_vault\_secrets\_provider\_enabled) | Should the Azure Secrets Store CSI addon be enabled for this Node Pool? | `bool` | `false` | no | | [addon\_azure\_pod\_identity\_enabled](#input\_addon\_azure\_pod\_identity\_enabled) | Should the AAD pod-managed identities be enabled for this Node Pool? | `bool` | `false` | no | | [addon\_azure\_policy\_enabled](#input\_addon\_azure\_policy\_enabled) | Should the Azure Policy addon be enabled for this Node Pool? | `bool` | `false` | no | | [alerts\_enabled](#input\_alerts\_enabled) | Should Metrics Alert be enabled? | `bool` | `true` | no | | [automatic\_channel\_upgrade](#input\_automatic\_channel\_upgrade) | (Optional) The upgrade channel for this Kubernetes Cluster. Possible values are patch, rapid, node-image and stable. Omitting this field sets this value to none. | `string` | `null` | no | -| [custom\_metric\_alerts](#input\_custom\_metric\_alerts) | Map of name = criteria objects | 
map(object({
    # criteria.*.aggregation to be one of [Average Count Minimum Maximum Total]
    aggregation = string
    # "Insights.Container/pods" "Insights.Container/nodes"
    metric_namespace = string
    metric_name      = string
    # criteria.0.operator to be one of [Equals NotEquals GreaterThan GreaterThanOrEqual LessThan LessThanOrEqual]
    operator  = string
    threshold = number
    # Possible values are PT1M, PT5M, PT15M, PT30M and PT1H
    frequency = string
    # Possible values are PT1M, PT5M, PT15M, PT30M, PT1H, PT6H, PT12H and P1D.
    window_size = string
    # Skip metrics validation
    skip_metric_validation = optional(bool, false)

    dimension = list(object(
      {
        name     = string
        operator = string
        values   = list(string)
      }
    ))
  }))
| `{}` | no | -| [default\_metric\_alerts](#input\_default\_metric\_alerts) | Map of name = criteria objects | 
map(object({
    # criteria.*.aggregation to be one of [Average Count Minimum Maximum Total]
    aggregation = string
    # "Insights.Container/pods" "Insights.Container/nodes"
    metric_namespace = string
    metric_name      = string
    # criteria.0.operator to be one of [Equals NotEquals GreaterThan GreaterThanOrEqual LessThan LessThanOrEqual]
    operator  = string
    threshold = number
    # Possible values are PT1M, PT5M, PT15M, PT30M and PT1H
    frequency = string
    # Possible values are PT1M, PT5M, PT15M, PT30M, PT1H, PT6H, PT12H and P1D.
    window_size = string
    # Skip metrics validation
    skip_metric_validation = optional(bool, false)


    dimension = list(object(
      {
        name     = string
        operator = string
        values   = list(string)
      }
    ))
  }))
| 
{
  "node_cpu_usage_percentage": {
    "aggregation": "Average",
    "dimension": [
      {
        "name": "node",
        "operator": "Include",
        "values": [
          "*"
        ]
      }
    ],
    "frequency": "PT15M",
    "metric_name": "node_cpu_usage_percentage",
    "metric_namespace": "Microsoft.ContainerService/managedClusters",
    "operator": "GreaterThan",
    "threshold": 80,
    "window_size": "PT1H"
  },
  "node_disk": {
    "aggregation": "Average",
    "dimension": [
      {
        "name": "node",
        "operator": "Include",
        "values": [
          "*"
        ]
      },
      {
        "name": "device",
        "operator": "Include",
        "values": [
          "*"
        ]
      }
    ],
    "frequency": "PT15M",
    "metric_name": "node_disk_usage_percentage",
    "metric_namespace": "Microsoft.ContainerService/managedClusters",
    "operator": "GreaterThan",
    "threshold": 80,
    "window_size": "PT1H"
  },
  "node_memory_working_set_percentage": {
    "aggregation": "Average",
    "dimension": [
      {
        "name": "node",
        "operator": "Include",
        "values": [
          "*"
        ]
      }
    ],
    "frequency": "PT15M",
    "metric_name": "node_memory_working_set_percentage",
    "metric_namespace": "Microsoft.ContainerService/managedClusters",
    "operator": "GreaterThan",
    "threshold": 80,
    "window_size": "PT1H"
  },
  "node_not_ready": {
    "aggregation": "Average",
    "dimension": [
      {
        "name": "status2",
        "operator": "Include",
        "values": [
          "NotReady"
        ]
      }
    ],
    "frequency": "PT15M",
    "metric_name": "kube_node_status_condition",
    "metric_namespace": "Microsoft.ContainerService/managedClusters",
    "operator": "GreaterThan",
    "threshold": 0,
    "window_size": "PT1H"
  },
  "pods_failed": {
    "aggregation": "Average",
    "dimension": [
      {
        "name": "phase",
        "operator": "Include",
        "values": [
          "Failed"
        ]
      },
      {
        "name": "namespace",
        "operator": "Include",
        "values": [
          "*"
        ]
      }
    ],
    "frequency": "PT15M",
    "metric_name": "kube_pod_status_phase",
    "metric_namespace": "Microsoft.ContainerService/managedClusters",
    "operator": "GreaterThan",
    "threshold": 0,
    "window_size": "PT1H"
  }
}
| no | +| [custom\_metric\_alerts](#input\_custom\_metric\_alerts) | Map of name = criteria objects | 
map(object({
    # criteria.*.aggregation to be one of [Average Count Minimum Maximum Total]
    aggregation = string
    # "Insights.Container/pods" "Insights.Container/nodes"
    metric_namespace = string
    metric_name      = string
    # criteria.0.operator to be one of [Equals NotEquals GreaterThan GreaterThanOrEqual LessThan LessThanOrEqual]
    operator  = string
    threshold = number
    # Possible values are PT1M, PT5M, PT15M, PT30M and PT1H
    frequency = string
    # Possible values are PT1M, PT5M, PT15M, PT30M, PT1H, PT6H, PT12H and P1D.
    window_size = string
    # Skip metrics validation
    skip_metric_validation = optional(bool, false)

    dimension = list(object(
      {
        name     = string
        operator = string
        values   = list(string)
      }
    ))
  }))
| `{}` | no | +| [default\_metric\_alerts](#input\_default\_metric\_alerts) | Map of name = criteria objects | 
map(object({
    # criteria.*.aggregation to be one of [Average Count Minimum Maximum Total]
    aggregation = string
    # "Insights.Container/pods" "Insights.Container/nodes"
    metric_namespace = string
    metric_name      = string
    # criteria.0.operator to be one of [Equals NotEquals GreaterThan GreaterThanOrEqual LessThan LessThanOrEqual]
    operator  = string
    threshold = number
    # Possible values are PT1M, PT5M, PT15M, PT30M and PT1H
    frequency = string
    # Possible values are PT1M, PT5M, PT15M, PT30M, PT1H, PT6H, PT12H and P1D.
    window_size = string
    # Skip metrics validation
    skip_metric_validation = optional(bool, false)


    dimension = list(object(
      {
        name     = string
        operator = string
        values   = list(string)
      }
    ))
  }))
| 
{
  "node_cpu_usage_percentage": {
    "aggregation": "Average",
    "dimension": [
      {
        "name": "node",
        "operator": "Include",
        "values": [
          "*"
        ]
      }
    ],
    "frequency": "PT15M",
    "metric_name": "node_cpu_usage_percentage",
    "metric_namespace": "Microsoft.ContainerService/managedClusters",
    "operator": "GreaterThan",
    "threshold": 80,
    "window_size": "PT1H"
  },
  "node_disk": {
    "aggregation": "Average",
    "dimension": [
      {
        "name": "node",
        "operator": "Include",
        "values": [
          "*"
        ]
      },
      {
        "name": "device",
        "operator": "Include",
        "values": [
          "*"
        ]
      }
    ],
    "frequency": "PT15M",
    "metric_name": "node_disk_usage_percentage",
    "metric_namespace": "Microsoft.ContainerService/managedClusters",
    "operator": "GreaterThan",
    "threshold": 80,
    "window_size": "PT1H"
  },
  "node_memory_working_set_percentage": {
    "aggregation": "Average",
    "dimension": [
      {
        "name": "node",
        "operator": "Include",
        "values": [
          "*"
        ]
      }
    ],
    "frequency": "PT15M",
    "metric_name": "node_memory_working_set_percentage",
    "metric_namespace": "Microsoft.ContainerService/managedClusters",
    "operator": "GreaterThan",
    "threshold": 80,
    "window_size": "PT1H"
  },
  "node_not_ready": {
    "aggregation": "Average",
    "dimension": [
      {
        "name": "status2",
        "operator": "Include",
        "values": [
          "NotReady"
        ]
      }
    ],
    "frequency": "PT15M",
    "metric_name": "kube_node_status_condition",
    "metric_namespace": "Microsoft.ContainerService/managedClusters",
    "operator": "GreaterThan",
    "threshold": 0,
    "window_size": "PT1H"
  },
  "pods_failed": {
    "aggregation": "Average",
    "dimension": [
      {
        "name": "phase",
        "operator": "Include",
        "values": [
          "Failed"
        ]
      },
      {
        "name": "namespace",
        "operator": "Include",
        "values": [
          "*"
        ]
      }
    ],
    "frequency": "PT15M",
    "metric_name": "kube_pod_status_phase",
    "metric_namespace": "Microsoft.ContainerService/managedClusters",
    "operator": "GreaterThan",
    "threshold": 0,
    "window_size": "PT1H"
  }
}
| no | | [dns\_prefix](#input\_dns\_prefix) | (Required) DNS prefix specified when creating the managed cluster. Changing this forces a new resource to be created. | `string` | n/a | yes | | [kubernetes\_version](#input\_kubernetes\_version) | (Required) Version of Kubernetes specified when creating the AKS managed cluster. | `string` | n/a | yes | | [location](#input\_location) | n/a | `string` | n/a | yes | | [log\_analytics\_workspace\_id](#input\_log\_analytics\_workspace\_id) | The ID of the Log Analytics Workspace which the OMS Agent should send data to. | `string` | `null` | no | | [microsoft\_defender\_log\_analytics\_workspace\_id](#input\_microsoft\_defender\_log\_analytics\_workspace\_id) | Specifies the ID of the Log Analytics Workspace where the audit logs collected by Microsoft Defender should be sent to | `string` | `null` | no | | [name](#input\_name) | (Required) Cluster name | `string` | n/a | yes | -| [network\_profile](#input\_network\_profile) | See variable description to understand how to use it, and see examples | 
object({
    dns_service_ip      = optional(string, "10.2.0.10")    # e.g. '10.2.0.10'. IP address within the Kubernetes service address range that will be used by cluster service discovery (kube-dns)
    network_policy      = optional(string, "azure")        # e.g. 'azure'. Sets up network policy to be used with Azure CNI. Currently supported values are calico and azure.
    network_plugin      = optional(string, "azure")        # e.g. 'azure'. Network plugin to use for networking. Currently supported values are azure and kubenet
    network_plugin_mode = optional(string, null)           # e.g. 'azure'. Network plugin mode to use for networking. Currently supported value is overlay
    outbound_type       = optional(string, "loadBalancer") # e.g. 'loadBalancer'. The outbound (egress) routing method which should be used for this Kubernetes Cluster. Possible values are loadBalancer, userDefinedRouting, managedNATGateway and userAssignedNATGateway. Defaults to loadBalancer
    service_cidr        = optional(string, "10.2.0.0/16")  # e.g. '10.2.0.0/16'. The Network Range used by the Kubernetes service
    network_data_plane  = optional(string, "azure")        # e.g. 'azure'. (Optional) Specifies the data plane used for building the Kubernetes network. Possible values are azure and cilium. Defaults to azure. Disabling this forces a new resource to be created.
  })
| 
{
  "dns_service_ip": "10.2.0.10",
  "network_data_plane": "azure",
  "network_plugin": "azure",
  "network_plugin_mode": null,
  "network_policy": "azure",
  "outbound_type": "loadBalancer",
  "service_cidr": "10.2.0.0/16"
}
| no | +| [network\_profile](#input\_network\_profile) | See variable description to understand how to use it, and see examples | 
object({
    dns_service_ip      = optional(string, "10.2.0.10")    # e.g. '10.2.0.10'. IP address within the Kubernetes service address range that will be used by cluster service discovery (kube-dns)
    network_policy      = optional(string, "azure")        # e.g. 'azure'. Sets up network policy to be used with Azure CNI. Currently supported values are calico and azure.
    network_plugin      = optional(string, "azure")        # e.g. 'azure'. Network plugin to use for networking. Currently supported values are azure and kubenet
    network_plugin_mode = optional(string, null)           # e.g. 'azure'. Network plugin mode to use for networking. Currently supported value is overlay
    outbound_type       = optional(string, "loadBalancer") # e.g. 'loadBalancer'. The outbound (egress) routing method which should be used for this Kubernetes Cluster. Possible values are loadBalancer, userDefinedRouting, managedNATGateway and userAssignedNATGateway. Defaults to loadBalancer
    service_cidr        = optional(string, "10.2.0.0/16")  # e.g. '10.2.0.0/16'. The Network Range used by the Kubernetes service
    network_data_plane  = optional(string, "azure")        # e.g. 'azure'. (Optional) Specifies the data plane used for building the Kubernetes network. Possible values are azure and cilium. Defaults to azure. Disabling this forces a new resource to be created.
  })
| 
{
  "dns_service_ip": "10.2.0.10",
  "network_data_plane": "azure",
  "network_plugin": "azure",
  "network_plugin_mode": null,
  "network_policy": "azure",
  "outbound_type": "loadBalancer",
  "service_cidr": "10.2.0.0/16"
}
| no | | [oidc\_issuer\_enabled](#input\_oidc\_issuer\_enabled) | (Optional) Enable or Disable the OIDC issuer URL | `bool` | `false` | no | | [oms\_agent\_monitoring\_metrics\_role\_assignment\_enabled](#input\_oms\_agent\_monitoring\_metrics\_role\_assignment\_enabled) | Enabled oms agent monitoring metrics roles | `bool` | `true` | no | | [oms\_agent\_msi\_auth\_for\_monitoring\_enabled](#input\_oms\_agent\_msi\_auth\_for\_monitoring\_enabled) | (Optional) Is managed identity authentication for monitoring enabled? Default false | `bool` | `false` | no | @@ -721,7 +721,7 @@ No modules. | [storage\_profile\_disk\_driver\_version](#input\_storage\_profile\_disk\_driver\_version) | (Optional) Disk CSI Driver version to be used. Possible values are v1 and v2. Defaults to v1 | `string` | `"v1"` | no | | [storage\_profile\_file\_driver\_enabled](#input\_storage\_profile\_file\_driver\_enabled) | (Optional) Is the File CSI driver enabled? Defaults to true | `bool` | `true` | no | | [storage\_profile\_snapshot\_controller\_enabled](#input\_storage\_profile\_snapshot\_controller\_enabled) | (Optional) Is the Snapshot Controller enabled? Defaults to true | `bool` | `true` | no | -| [system\_node\_pool\_availability\_zones](#input\_system\_node\_pool\_availability\_zones) | (Optional) List of availability zones for system node pool | `list(string)` | 
[
  "1",
  "2",
  "3"
]
| no | +| [system\_node\_pool\_availability\_zones](#input\_system\_node\_pool\_availability\_zones) | (Optional) List of availability zones for system node pool | `list(string)` | 
[
  "1",
  "2",
  "3"
]
| no | | [system\_node\_pool\_enable\_host\_encryption](#input\_system\_node\_pool\_enable\_host\_encryption) | (Optional) Should the nodes in the Default Node Pool have host encryption enabled? Defaults to true. | `bool` | `true` | no | | [system\_node\_pool\_max\_pods](#input\_system\_node\_pool\_max\_pods) | (Optional) The maximum number of pods that can run on each agent. Changing this forces a new resource to be created. | `number` | `250` | no | | [system\_node\_pool\_name](#input\_system\_node\_pool\_name) | (Required) The name which should be used for the default Kubernetes Node Pool. Changing this forces a new resource to be created. | `string` | n/a | yes | @@ -737,7 +737,7 @@ No modules. | [system\_node\_pool\_vm\_size](#input\_system\_node\_pool\_vm\_size) | (Required) The size of the Virtual Machine, such as Standard\_B4ms or Standard\_D4s\_vX. See https://pagopa.atlassian.net/wiki/spaces/DEVOPS/pages/134840344/Best+practice+su+prodotti | `string` | n/a | yes | | [tags](#input\_tags) | n/a | `map(any)` | n/a | yes | | [upgrade\_settings\_max\_surge](#input\_upgrade\_settings\_max\_surge) | The maximum number or percentage of nodes which will be added to the Node Pool size during an upgrade. | `string` | `"33%"` | no | -| [user\_node\_pool\_availability\_zones](#input\_user\_node\_pool\_availability\_zones) | (Optional) List of availability zones for user node pool | `list(string)` | 
[
  "1",
  "2",
  "3"
]
| no | +| [user\_node\_pool\_availability\_zones](#input\_user\_node\_pool\_availability\_zones) | (Optional) List of availability zones for user node pool | `list(string)` | 
[
  "1",
  "2",
  "3"
]
| no | | [user\_node\_pool\_enable\_host\_encryption](#input\_user\_node\_pool\_enable\_host\_encryption) | (Optional) Should the nodes in the Default Node Pool have host encryption enabled? Defaults to true. | `bool` | `false` | no | | [user\_node\_pool\_enabled](#input\_user\_node\_pool\_enabled) | Is user node pool enabled? | `bool` | `false` | no | | [user\_node\_pool\_max\_pods](#input\_user\_node\_pool\_max\_pods) | (Optional) The maximum number of pods that can run on each agent. Changing this forces a new resource to be created. | `number` | `250` | no | @@ -766,6 +766,7 @@ No modules. | [id](#output\_id) | n/a | | [identity\_principal\_id](#output\_identity\_principal\_id) | The Principal ID associated with this Managed Service Identity. | | [kubelet\_identity\_id](#output\_kubelet\_identity\_id) | The Object ID of the user-defined Managed Identity assigned to the Kubelets.If not specified a Managed Identity is created automatically. Changing this forces a new resource to be created. | +| [managed\_private\_dns\_zone\_name](#output\_managed\_private\_dns\_zone\_name) | The managed private dns zone name for the Kubernetes Cluster when private link has been enabled. Derived from private\_fqdn | | [managed\_resource\_group\_id](#output\_managed\_resource\_group\_id) | The ID of the Resource Group containing the resources for this Managed Kubernetes Cluster. | | [managed\_resource\_group\_name](#output\_managed\_resource\_group\_name) | The auto-generated Resource Group which contains the resources for this Managed Kubernetes Cluster. | | [name](#output\_name) | n/a | diff --git a/kubernetes_cluster_udr/10_outputs.tf b/kubernetes_cluster_udr/10_outputs.tf index caa6d863..2677efb1 100644 --- a/kubernetes_cluster_udr/10_outputs.tf +++ b/kubernetes_cluster_udr/10_outputs.tf @@ -30,3 +30,8 @@ output "managed_resource_group_name" { value = azurerm_kubernetes_cluster.this.node_resource_group description = " The auto-generated Resource Group which contains the resources for this Managed Kubernetes Cluster." } + +output "managed_private_dns_zone_name" { + value = local.managed_private_dns_zone_name + description = "The managed private dns zone name for the Kubernetes Cluster when private link has been enabled. Derived from private_fqdn" +} diff --git a/kubernetes_cluster_udr/99_locals.tf b/kubernetes_cluster_udr/99_locals.tf new file mode 100644 index 00000000..f217f29b --- /dev/null +++ b/kubernetes_cluster_udr/99_locals.tf @@ -0,0 +1,4 @@ +locals { + aks_fqdn_levels = length(split(".", azurerm_kubernetes_cluster.this.private_fqdn)) + managed_private_dns_zone_name = join(".", slice(split(".", azurerm_kubernetes_cluster.this.private_fqdn), 1, local.aks_fqdn_levels)) +} diff --git a/kubernetes_cluster_udr/README.md b/kubernetes_cluster_udr/README.md index 897280c5..15fd0cf9 100644 --- a/kubernetes_cluster_udr/README.md +++ b/kubernetes_cluster_udr/README.md @@ -685,15 +685,15 @@ No modules. | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| | [aad\_admin\_group\_ids](#input\_aad\_admin\_group\_ids) | IDs of the Azure AD group for cluster-admin access | `list(string)` | n/a | yes | -| [action](#input\_action) | The ID of the Action Group and optional map of custom string properties to include with the post webhook operation. | 
set(object(
    {
      action_group_id    = string
      webhook_properties = map(string)
    }
  ))
| `[]` | no | +| [action](#input\_action) | The ID of the Action Group and optional map of custom string properties to include with the post webhook operation. | 
set(object(
    {
      action_group_id    = string
      webhook_properties = map(string)
    }
  ))
| `[]` | no | | [addon\_azure\_key\_vault\_secrets\_provider\_enabled](#input\_addon\_azure\_key\_vault\_secrets\_provider\_enabled) | Should the Azure Secrets Store CSI addon be enabled for this Node Pool? | `bool` | `false` | no | | [addon\_azure\_pod\_identity\_enabled](#input\_addon\_azure\_pod\_identity\_enabled) | Should the AAD pod-managed identities be enabled for this Node Pool? | `bool` | `false` | no | | [addon\_azure\_policy\_enabled](#input\_addon\_azure\_policy\_enabled) | Should the Azure Policy addon be enabled for this Node Pool? | `bool` | `false` | no | | [alerts\_enabled](#input\_alerts\_enabled) | Should Metrics Alert be enabled? | `bool` | `true` | no | | [api\_server\_authorized\_ip\_ranges](#input\_api\_server\_authorized\_ip\_ranges) | The IP ranges to whitelist for incoming traffic to the masters. | `list(string)` | `[]` | no | | [automatic\_channel\_upgrade](#input\_automatic\_channel\_upgrade) | (Optional) The upgrade channel for this Kubernetes Cluster. Possible values are patch, rapid, node-image and stable. Omitting this field sets this value to none. | `string` | `null` | no | -| [custom\_metric\_alerts](#input\_custom\_metric\_alerts) | Map of name = criteria objects | 
map(object({
    # criteria.*.aggregation to be one of [Average Count Minimum Maximum Total]
    aggregation = string
    # "Insights.Container/pods" "Insights.Container/nodes"
    metric_namespace = string
    metric_name      = string
    # criteria.0.operator to be one of [Equals NotEquals GreaterThan GreaterThanOrEqual LessThan LessThanOrEqual]
    operator  = string
    threshold = number
    # Possible values are PT1M, PT5M, PT15M, PT30M and PT1H
    frequency = string
    # Possible values are PT1M, PT5M, PT15M, PT30M, PT1H, PT6H, PT12H and P1D.
    window_size = string

    dimension = list(object(
      {
        name     = string
        operator = string
        values   = list(string)
      }
    ))
  }))
| `{}` | no | -| [default\_metric\_alerts](#input\_default\_metric\_alerts) | Map of name = criteria objects | 
map(object({
    # criteria.*.aggregation to be one of [Average Count Minimum Maximum Total]
    aggregation = string
    # "Insights.Container/pods" "Insights.Container/nodes"
    metric_namespace = string
    metric_name      = string
    # criteria.0.operator to be one of [Equals NotEquals GreaterThan GreaterThanOrEqual LessThan LessThanOrEqual]
    operator  = string
    threshold = number
    # Possible values are PT1M, PT5M, PT15M, PT30M and PT1H
    frequency = string
    # Possible values are PT1M, PT5M, PT15M, PT30M, PT1H, PT6H, PT12H and P1D.
    window_size = string

    dimension = list(object(
      {
        name     = string
        operator = string
        values   = list(string)
      }
    ))
  }))
| 
{
  "container_cpu": {
    "aggregation": "Average",
    "dimension": [
      {
        "name": "kubernetes namespace",
        "operator": "Include",
        "values": [
          "*"
        ]
      },
      {
        "name": "controllerName",
        "operator": "Include",
        "values": [
          "*"
        ]
      }
    ],
    "frequency": "PT5M",
    "metric_name": "cpuExceededPercentage",
    "metric_namespace": "Insights.Container/containers",
    "operator": "GreaterThan",
    "threshold": 95,
    "window_size": "PT30M"
  },
  "container_memory": {
    "aggregation": "Average",
    "dimension": [
      {
        "name": "kubernetes namespace",
        "operator": "Include",
        "values": [
          "*"
        ]
      },
      {
        "name": "controllerName",
        "operator": "Include",
        "values": [
          "*"
        ]
      }
    ],
    "frequency": "PT5M",
    "metric_name": "memoryWorkingSetExceededPercentage",
    "metric_namespace": "Insights.Container/containers",
    "operator": "GreaterThan",
    "threshold": 95,
    "window_size": "PT30M"
  },
  "container_oom": {
    "aggregation": "Average",
    "dimension": [
      {
        "name": "kubernetes namespace",
        "operator": "Include",
        "values": [
          "*"
        ]
      },
      {
        "name": "controllerName",
        "operator": "Include",
        "values": [
          "*"
        ]
      }
    ],
    "frequency": "PT5M",
    "metric_name": "oomKilledContainerCount",
    "metric_namespace": "Insights.Container/pods",
    "operator": "GreaterThan",
    "threshold": 0,
    "window_size": "PT30M"
  },
  "container_restart": {
    "aggregation": "Average",
    "dimension": [
      {
        "name": "kubernetes namespace",
        "operator": "Include",
        "values": [
          "*"
        ]
      },
      {
        "name": "controllerName",
        "operator": "Include",
        "values": [
          "*"
        ]
      }
    ],
    "frequency": "PT5M",
    "metric_name": "restartingContainerCount",
    "metric_namespace": "Insights.Container/pods",
    "operator": "GreaterThan",
    "threshold": 0,
    "window_size": "PT30M"
  },
  "node_cpu": {
    "aggregation": "Average",
    "dimension": [
      {
        "name": "host",
        "operator": "Include",
        "values": [
          "*"
        ]
      }
    ],
    "frequency": "PT5M",
    "metric_name": "cpuUsagePercentage",
    "metric_namespace": "Insights.Container/nodes",
    "operator": "GreaterThan",
    "threshold": 80,
    "window_size": "PT30M"
  },
  "node_disk": {
    "aggregation": "Average",
    "dimension": [
      {
        "name": "host",
        "operator": "Include",
        "values": [
          "*"
        ]
      },
      {
        "name": "device",
        "operator": "Include",
        "values": [
          "*"
        ]
      }
    ],
    "frequency": "PT5M",
    "metric_name": "DiskUsedPercentage",
    "metric_namespace": "Insights.Container/nodes",
    "operator": "GreaterThan",
    "threshold": 80,
    "window_size": "PT30M"
  },
  "node_memory": {
    "aggregation": "Average",
    "dimension": [
      {
        "name": "host",
        "operator": "Include",
        "values": [
          "*"
        ]
      }
    ],
    "frequency": "PT5M",
    "metric_name": "memoryWorkingSetPercentage",
    "metric_namespace": "Insights.Container/nodes",
    "operator": "GreaterThan",
    "threshold": 80,
    "window_size": "PT30M"
  },
  "node_not_ready": {
    "aggregation": "Average",
    "dimension": [
      {
        "name": "status",
        "operator": "Include",
        "values": [
          "NotReady"
        ]
      }
    ],
    "frequency": "PT5M",
    "metric_name": "nodesCount",
    "metric_namespace": "Insights.Container/nodes",
    "operator": "GreaterThan",
    "threshold": 0,
    "window_size": "PT30M"
  },
  "pods_failed": {
    "aggregation": "Average",
    "dimension": [
      {
        "name": "phase",
        "operator": "Include",
        "values": [
          "Failed"
        ]
      }
    ],
    "frequency": "PT5M",
    "metric_name": "podCount",
    "metric_namespace": "Insights.Container/pods",
    "operator": "GreaterThan",
    "threshold": 0,
    "window_size": "PT30M"
  },
  "pods_ready": {
    "aggregation": "Average",
    "dimension": [
      {
        "name": "kubernetes namespace",
        "operator": "Include",
        "values": [
          "*"
        ]
      },
      {
        "name": "controllerName",
        "operator": "Include",
        "values": [
          "*"
        ]
      }
    ],
    "frequency": "PT5M",
    "metric_name": "PodReadyPercentage",
    "metric_namespace": "Insights.Container/pods",
    "operator": "LessThan",
    "threshold": 80,
    "window_size": "PT30M"
  }
}
| no | +| [custom\_metric\_alerts](#input\_custom\_metric\_alerts) | Map of name = criteria objects | 
map(object({
    # criteria.*.aggregation to be one of [Average Count Minimum Maximum Total]
    aggregation = string
    # "Insights.Container/pods" "Insights.Container/nodes"
    metric_namespace = string
    metric_name      = string
    # criteria.0.operator to be one of [Equals NotEquals GreaterThan GreaterThanOrEqual LessThan LessThanOrEqual]
    operator  = string
    threshold = number
    # Possible values are PT1M, PT5M, PT15M, PT30M and PT1H
    frequency = string
    # Possible values are PT1M, PT5M, PT15M, PT30M, PT1H, PT6H, PT12H and P1D.
    window_size = string

    dimension = list(object(
      {
        name     = string
        operator = string
        values   = list(string)
      }
    ))
  }))
| `{}` | no | +| [default\_metric\_alerts](#input\_default\_metric\_alerts) | Map of name = criteria objects | 
map(object({
    # criteria.*.aggregation to be one of [Average Count Minimum Maximum Total]
    aggregation = string
    # "Insights.Container/pods" "Insights.Container/nodes"
    metric_namespace = string
    metric_name      = string
    # criteria.0.operator to be one of [Equals NotEquals GreaterThan GreaterThanOrEqual LessThan LessThanOrEqual]
    operator  = string
    threshold = number
    # Possible values are PT1M, PT5M, PT15M, PT30M and PT1H
    frequency = string
    # Possible values are PT1M, PT5M, PT15M, PT30M, PT1H, PT6H, PT12H and P1D.
    window_size = string

    dimension = list(object(
      {
        name     = string
        operator = string
        values   = list(string)
      }
    ))
  }))
| 
{
  "container_cpu": {
    "aggregation": "Average",
    "dimension": [
      {
        "name": "kubernetes namespace",
        "operator": "Include",
        "values": [
          "*"
        ]
      },
      {
        "name": "controllerName",
        "operator": "Include",
        "values": [
          "*"
        ]
      }
    ],
    "frequency": "PT5M",
    "metric_name": "cpuExceededPercentage",
    "metric_namespace": "Insights.Container/containers",
    "operator": "GreaterThan",
    "threshold": 95,
    "window_size": "PT30M"
  },
  "container_memory": {
    "aggregation": "Average",
    "dimension": [
      {
        "name": "kubernetes namespace",
        "operator": "Include",
        "values": [
          "*"
        ]
      },
      {
        "name": "controllerName",
        "operator": "Include",
        "values": [
          "*"
        ]
      }
    ],
    "frequency": "PT5M",
    "metric_name": "memoryWorkingSetExceededPercentage",
    "metric_namespace": "Insights.Container/containers",
    "operator": "GreaterThan",
    "threshold": 95,
    "window_size": "PT30M"
  },
  "container_oom": {
    "aggregation": "Average",
    "dimension": [
      {
        "name": "kubernetes namespace",
        "operator": "Include",
        "values": [
          "*"
        ]
      },
      {
        "name": "controllerName",
        "operator": "Include",
        "values": [
          "*"
        ]
      }
    ],
    "frequency": "PT5M",
    "metric_name": "oomKilledContainerCount",
    "metric_namespace": "Insights.Container/pods",
    "operator": "GreaterThan",
    "threshold": 0,
    "window_size": "PT30M"
  },
  "container_restart": {
    "aggregation": "Average",
    "dimension": [
      {
        "name": "kubernetes namespace",
        "operator": "Include",
        "values": [
          "*"
        ]
      },
      {
        "name": "controllerName",
        "operator": "Include",
        "values": [
          "*"
        ]
      }
    ],
    "frequency": "PT5M",
    "metric_name": "restartingContainerCount",
    "metric_namespace": "Insights.Container/pods",
    "operator": "GreaterThan",
    "threshold": 0,
    "window_size": "PT30M"
  },
  "node_cpu": {
    "aggregation": "Average",
    "dimension": [
      {
        "name": "host",
        "operator": "Include",
        "values": [
          "*"
        ]
      }
    ],
    "frequency": "PT5M",
    "metric_name": "cpuUsagePercentage",
    "metric_namespace": "Insights.Container/nodes",
    "operator": "GreaterThan",
    "threshold": 80,
    "window_size": "PT30M"
  },
  "node_disk": {
    "aggregation": "Average",
    "dimension": [
      {
        "name": "host",
        "operator": "Include",
        "values": [
          "*"
        ]
      },
      {
        "name": "device",
        "operator": "Include",
        "values": [
          "*"
        ]
      }
    ],
    "frequency": "PT5M",
    "metric_name": "DiskUsedPercentage",
    "metric_namespace": "Insights.Container/nodes",
    "operator": "GreaterThan",
    "threshold": 80,
    "window_size": "PT30M"
  },
  "node_memory": {
    "aggregation": "Average",
    "dimension": [
      {
        "name": "host",
        "operator": "Include",
        "values": [
          "*"
        ]
      }
    ],
    "frequency": "PT5M",
    "metric_name": "memoryWorkingSetPercentage",
    "metric_namespace": "Insights.Container/nodes",
    "operator": "GreaterThan",
    "threshold": 80,
    "window_size": "PT30M"
  },
  "node_not_ready": {
    "aggregation": "Average",
    "dimension": [
      {
        "name": "status",
        "operator": "Include",
        "values": [
          "NotReady"
        ]
      }
    ],
    "frequency": "PT5M",
    "metric_name": "nodesCount",
    "metric_namespace": "Insights.Container/nodes",
    "operator": "GreaterThan",
    "threshold": 0,
    "window_size": "PT30M"
  },
  "pods_failed": {
    "aggregation": "Average",
    "dimension": [
      {
        "name": "phase",
        "operator": "Include",
        "values": [
          "Failed"
        ]
      }
    ],
    "frequency": "PT5M",
    "metric_name": "podCount",
    "metric_namespace": "Insights.Container/pods",
    "operator": "GreaterThan",
    "threshold": 0,
    "window_size": "PT30M"
  },
  "pods_ready": {
    "aggregation": "Average",
    "dimension": [
      {
        "name": "kubernetes namespace",
        "operator": "Include",
        "values": [
          "*"
        ]
      },
      {
        "name": "controllerName",
        "operator": "Include",
        "values": [
          "*"
        ]
      }
    ],
    "frequency": "PT5M",
    "metric_name": "PodReadyPercentage",
    "metric_namespace": "Insights.Container/pods",
    "operator": "LessThan",
    "threshold": 80,
    "window_size": "PT30M"
  }
}
| no | | [disk\_encryption\_set\_id](#input\_disk\_encryption\_set\_id) | ID of the disk EncryptionSet . | `string` | `null` | no | | [dns\_prefix](#input\_dns\_prefix) | (Required) DNS prefix specified when creating the managed cluster. Changing this forces a new resource to be created. | `string` | n/a | yes | | [dns\_prefix\_private\_cluster](#input\_dns\_prefix\_private\_cluster) | Specifies the DNS prefix to use with private clusters. Changing this forces a new resource to be created. | `string` | `null` | no | @@ -702,7 +702,7 @@ No modules. | [log\_analytics\_workspace\_id](#input\_log\_analytics\_workspace\_id) | The ID of the Log Analytics Workspace which the OMS Agent should send data to. | `string` | `null` | no | | [microsoft\_defender\_log\_analytics\_workspace\_id](#input\_microsoft\_defender\_log\_analytics\_workspace\_id) | Specifies the ID of the Log Analytics Workspace where the audit logs collected by Microsoft Defender should be sent to | `string` | `null` | no | | [name](#input\_name) | (Required) Cluster name | `string` | n/a | yes | -| [network\_profile](#input\_network\_profile) | See variable description to understand how to use it, and see examples | 
object({
    network_plugin      = string # e.g. 'azure'. Network plugin to use for networking. Currently supported values are azure and kubenet
    outbound_type       = string # e.g. 'loadBalancer'. The outbound (egress) routing method which should be used for this Kubernetes Cluster. Possible values are loadBalancer, userDefinedRouting, managedNATGateway and userAssignedNATGateway. Defaults to loadBalancer
    network_plugin_mode = string
  })
| 
{
  "network_plugin": "azure",
  "network_plugin_mode": "Overlay",
  "outbound_type": "userDefinedRouting"
}
| no | +| [network\_profile](#input\_network\_profile) | See variable description to understand how to use it, and see examples | 
object({
    network_plugin      = string # e.g. 'azure'. Network plugin to use for networking. Currently supported values are azure and kubenet
    outbound_type       = string # e.g. 'loadBalancer'. The outbound (egress) routing method which should be used for this Kubernetes Cluster. Possible values are loadBalancer, userDefinedRouting, managedNATGateway and userAssignedNATGateway. Defaults to loadBalancer
    network_plugin_mode = string
  })
| 
{
  "network_plugin": "azure",
  "network_plugin_mode": "Overlay",
  "outbound_type": "userDefinedRouting"
}
| no | | [outbound\_ip\_address\_ids](#input\_outbound\_ip\_address\_ids) | The ID of the Public IP Addresses which should be used for outbound communication for the cluster load balancer. | `list(string)` | `[]` | no | | [private\_cluster\_enabled](#input\_private\_cluster\_enabled) | (Optional) Provides a Private IP Address for the Kubernetes API on the Virtual Network where the Kubernetes Cluster is located. | `bool` | `false` | no | | [rbac\_enabled](#input\_rbac\_enabled) | Is Role Based Access Control Enabled? | `bool` | `true` | no | @@ -710,7 +710,7 @@ No modules. | [sec\_log\_analytics\_workspace\_id](#input\_sec\_log\_analytics\_workspace\_id) | Log analytics workspace security (it should be in a different subscription). | `string` | `null` | no | | [sec\_storage\_id](#input\_sec\_storage\_id) | Storage Account security (it should be in a different subscription). | `string` | `null` | no | | [sku\_tier](#input\_sku\_tier) | (Optional) The SKU Tier that should be used for this Kubernetes Cluster. Possible values are Free and Paid (which includes the Uptime SLA) | `string` | `"Free"` | no | -| [system\_node\_pool\_availability\_zones](#input\_system\_node\_pool\_availability\_zones) | (Optional) List of availability zones for system node pool | `list(string)` | 
[
  "1",
  "2",
  "3"
]
| no | +| [system\_node\_pool\_availability\_zones](#input\_system\_node\_pool\_availability\_zones) | (Optional) List of availability zones for system node pool | `list(string)` | 
[
  "1",
  "2",
  "3"
]
| no | | [system\_node\_pool\_enable\_host\_encryption](#input\_system\_node\_pool\_enable\_host\_encryption) | (Optional) Should the nodes in the Default Node Pool have host encryption enabled? Defaults to true. | `bool` | `true` | no | | [system\_node\_pool\_max\_pods](#input\_system\_node\_pool\_max\_pods) | (Optional) The maximum number of pods that can run on each agent. Changing this forces a new resource to be created. | `number` | `250` | no | | [system\_node\_pool\_name](#input\_system\_node\_pool\_name) | (Required) The name which should be used for the default Kubernetes Node Pool. Changing this forces a new resource to be created. | `string` | n/a | yes | @@ -725,7 +725,7 @@ No modules. | [system\_node\_pool\_vm\_size](#input\_system\_node\_pool\_vm\_size) | (Required) The size of the Virtual Machine, such as Standard\_B4ms or Standard\_D4s\_vX. See https://pagopa.atlassian.net/wiki/spaces/DEVOPS/pages/134840344/Best+practice+su+prodotti | `string` | n/a | yes | | [tags](#input\_tags) | n/a | `map(any)` | n/a | yes | | [upgrade\_settings\_max\_surge](#input\_upgrade\_settings\_max\_surge) | The maximum number or percentage of nodes which will be added to the Node Pool size during an upgrade. | `string` | `"33%"` | no | -| [user\_node\_pool\_availability\_zones](#input\_user\_node\_pool\_availability\_zones) | (Optional) List of availability zones for user node pool | `list(string)` | 
[
  "1",
  "2",
  "3"
]
| no | +| [user\_node\_pool\_availability\_zones](#input\_user\_node\_pool\_availability\_zones) | (Optional) List of availability zones for user node pool | `list(string)` | 
[
  "1",
  "2",
  "3"
]
| no | | [user\_node\_pool\_enable\_host\_encryption](#input\_user\_node\_pool\_enable\_host\_encryption) | (Optional) Should the nodes in the Default Node Pool have host encryption enabled? Defaults to true. | `bool` | `false` | no | | [user\_node\_pool\_enabled](#input\_user\_node\_pool\_enabled) | Is user node pool enabled? | `bool` | `false` | no | | [user\_node\_pool\_max\_pods](#input\_user\_node\_pool\_max\_pods) | (Optional) The maximum number of pods that can run on each agent. Changing this forces a new resource to be created. | `number` | `250` | no | @@ -752,6 +752,7 @@ No modules. | [id](#output\_id) | n/a | | [identity\_principal\_id](#output\_identity\_principal\_id) | The Principal ID associated with this Managed Service Identity. | | [kubelet\_identity\_id](#output\_kubelet\_identity\_id) | The Object ID of the user-defined Managed Identity assigned to the Kubelets.If not specified a Managed Identity is created automatically. Changing this forces a new resource to be created. | +| [managed\_private\_dns\_zone\_name](#output\_managed\_private\_dns\_zone\_name) | The managed private dns zone name for the Kubernetes Cluster when private link has been enabled. Derived from private\_fqdn | | [managed\_resource\_group\_name](#output\_managed\_resource\_group\_name) | The auto-generated Resource Group which contains the resources for this Managed Kubernetes Cluster. | | [name](#output\_name) | n/a | | [private\_fqdn](#output\_private\_fqdn) | The FQDN for the Kubernetes Cluster when private link has been enabled, which is only resolvable inside the Virtual Network used by the Kubernetes Cluster. |