feat: Adds Parent DNS Linking to AKS

.editorconfig

@@ -0,0 +1,27 @@
+# Editor configuration, see http://editorconfig.org
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_style = space
+indent_size = 4
+insert_final_newline = true
+trim_trailing_whitespace = true
+max_line_length = 80
+
+[*.md]
+max_line_length = off
+trim_trailing_whitespace = false
+
+[*.ps1]
+indent_style = tab
+
+[*.{yml,yaml}]
+indent_size = 2
+
+[yamllint.conf]
+indent_size = 2
+
+[*.{tf,tfvars}]
+indent_size = 2

azurerm/modules/azurerm-aks/constraints.tf

@@ -4,7 +4,6 @@ terraform {
     azurerm = {
       source = "hashicorp/azurerm"
     }
-
     tls = {
       source = "hashicorp/tls"
     }

azurerm/modules/azurerm-aks/dns.tf

@@ -0,0 +1,78 @@
+# DNS
+# this is the base which will hold all your ingress records
+# ensure you provide the NS records to the TLD owner
+resource "azurerm_dns_zone" "default" {
+  count               = var.create_dns_zone ? 1 : 0
+  name                = var.dns_zone
+  resource_group_name = azurerm_resource_group.default.name
+
+  tags = var.tags
+
+  depends_on = [azurerm_resource_group.default]
+
+  lifecycle {
+    ignore_changes = [
+      tags,
+    ]
+  }
+}
+
+resource "azurerm_private_dns_zone" "default" {
+  count               = var.create_dns_zone ? 1 : 0
+  name                = var.internal_dns_zone
+  resource_group_name = azurerm_resource_group.default.name
+
+  tags = var.tags
+
+  depends_on = [azurerm_resource_group.default]
+
+  lifecycle {
+    ignore_changes = [
+      tags,
+    ]
+  }
+}
+
+resource "azurerm_private_dns_zone_virtual_network_link" "default" {
+  name                  = var.resource_namer
+  virtual_network_id    = azurerm_virtual_network.default.0.id
+  resource_group_name   = local.dns_resource_group
+  private_dns_zone_name = var.internal_dns_zone
+
+  tags = var.tags
+
+  depends_on = [
+    azurerm_virtual_network.default,
+    azurerm_private_dns_zone.default.0
+  ]
+
+  lifecycle {
+    ignore_changes = [
+      tags,
+    ]
+  }
+}
+
+## Parent DNS Setup
+data "azurerm_dns_zone" "parent" {
+  count = var.create_dns_zone && var.dns_create_parent_zone_ns_records ? 1 : 0
+
+  name                = var.dns_parent_zone
+  resource_group_name = var.dns_parent_resource_group
+}
+
+resource "azurerm_dns_ns_record" "parent_link" {
+  count = var.create_dns_zone && var.dns_create_parent_zone_ns_records ? 1 : 0
+
+  # This replaces all stuff at the end of the passed DNS zone from the parent
+  # E.g. `dns_zone` is nonprod.baz.stacks.com and `dns_parent_zone` is
+  # stacks.com, then the value of the parent record needs to be `nonprod.baz`
+  name                = replace(var.dns_zone, "/.${var.dns_parent_zone}$/", "")
+  zone_name           = data.azurerm_dns_zone.parent.0.name
+  resource_group_name = var.dns_parent_resource_group
+  ttl                 = var.dns_parent_ns_ttl
+
+  records = azurerm_dns_zone.default.0.name_servers
+
+  tags = var.tags
+}

azurerm/modules/azurerm-aks/examples/entire-infra/constraints.tf

@@ -1,9 +1,10 @@
 terraform {
-  required_version = ">= 0.13"
+  required_version = ">= 1.5.1"
+
   required_providers {
     azurerm = {
       source  = "hashicorp/azurerm"
-      version = "~> 2.5"
+      version = "~> 3.0"
     }
   }
 }

azurerm/modules/azurerm-aks/examples/entire-infra/main.tf

@@ -1,7 +1,7 @@
 data "azurerm_client_config" "current" {}
 
 module "default_label" {
-  source     = "git::https://github.com/cloudposse/terraform-null-label.git?ref=0.24.1"
+  source     = "git::https://github.com/cloudposse/terraform-null-label.git?ref=0.25.0"
   namespace  = "${var.name_company}-${var.name_project}"
   stage      = var.stage
   name       = var.name_component
@@ -19,37 +19,34 @@ variable "vnet_cidr" {
   default = ["10.1.0.0/16"]
 }
 
-module "sample_aks_bootstrap" {
-  # source                  = "git::https://github.com/ensono/stacks-webapp-template//libs/orchestration/terraform-azurerm-amido-aks?ref=feat/1357"
-  source                  = "git::https://github.com/ensono/stacks-webapp-template//libs/orchestration/terraform-azurerm-amido-aks?ref=master"
+module "example_aks" {
+  source                  = "../../"
   resource_namer          = module.default_label.id
-  create_rg               = true
-  resource_group_name     = module.default_label.id
   resource_group_location = "uksouth"
-  client_id               = data.azurerm_client_config.current.client_id
   spn_object_id           = data.azurerm_client_config.current.object_id
-  client_secret           = var.client_secret
   tenant_id               = data.azurerm_client_config.current.tenant_id
-  # client_id            = var.create_aksspn ? module.aks-spn.spn_applicationid : var.cluster_spn_clientid
-  # client_secret        = var.create_aksspn ? random_string.spn_password.0.result : var.cluster_spn_clientsecret
-  cluster_version         = "1.24.6"
-  name_environment        = "dev"
-  name_project            = var.name_project
-  name_company            = var.name_company
-  name_component          = var.name_component
-  create_dns_zone         = true
-  dns_zone                = "nonprod.amidostacks.com"
-  internal_dns_zone       = "nonprod.amidostacks.internal"
-  create_acr              = true
-  acr_registry_name       = replace(module.default_label.id, "-", "")
-  create_aksvnet          = true
-  vnet_name               = module.default_label.id
-  vnet_cidr               = var.vnet_cidr
-  subnet_front_end_prefix = cidrsubnet(var.vnet_cidr.0, 4, 3)
-  subnet_prefixes         = ["${cidrsubnet(var.vnet_cidr.0, 4, 0)}", "${cidrsubnet(var.vnet_cidr.0, 4, 1)}", "${cidrsubnet(var.vnet_cidr.0, 4, 2)}"]
-  subnet_names            = ["k8s1", "k8s2", "k8s3"]
-  create_aks_spn          = true
-  spn_name                = "foo-123"
-  enable_auto_scaling     = true
-  log_application_type    = "Node.JS"
+  # client_id                         = var.create_aksspn ? module.aks-spn.spn_applicationid : var.cluster_spn_clientid
+  # client_secret                     = var.create_aksspn ? random_string.spn_password.0.result : var.cluster_spn_clientsecret
+  cluster_version                   = "1.29.0"
+  name_environment                  = "dev"
+  name_project                      = var.name_project
+  name_company                      = var.name_company
+  name_component                    = var.name_component
+  create_dns_zone                   = true
+  dns_zone                          = "example.stacks.ensono.com"
+  internal_dns_zone                 = "example.stacks.ensono.internal"
+  dns_create_parent_zone_ns_records = true
+  dns_parent_resource_group         = "stacks-ancillary-resources"
+  dns_parent_zone                   = "stacks.ensono.com"
+  create_acr                        = true
+  acr_registry_name                 = replace(module.default_label.id, "-", "")
+  create_aksvnet                    = true
+  vnet_name                         = module.default_label.id
+  vnet_cidr                         = var.vnet_cidr
+  subnet_front_end_prefix           = cidrsubnet(var.vnet_cidr.0, 4, 3)
+  subnet_prefixes                   = ["${cidrsubnet(var.vnet_cidr.0, 4, 0)}", "${cidrsubnet(var.vnet_cidr.0, 4, 1)}", "${cidrsubnet(var.vnet_cidr.0, 4, 2)}"]
+  subnet_names                      = ["k8s1", "k8s2", "k8s3"]
+  enable_auto_scaling               = true
+  log_application_type              = "Node.JS"
+  aks_ingress_private_ip            = cidrhost(cidrsubnet(var.vnet_cidr.0, 4, 0), -3)
 }

azurerm/modules/azurerm-aks/examples/entire-infra/provider.tf

@@ -1,6 +1,7 @@
 terraform {
-  backend "azurerm" {
-  }
+  # NOTE: If you want a backend, uncomment this, else local will be used
+  # backend "azurerm" {
+  # }
 }
 
 provider "azurerm" {

azurerm/modules/azurerm-aks/examples/entire-infra/vars.tf → azurerm/modules/azurerm-aks/examples/entire-infra/variables.tf

@@ -8,12 +8,12 @@
 
 variable "name_company" {
   type    = string
-  default = "amido"
+  default = "ensono"
 }
 
 variable "name_project" {
   type    = string
-  default = "stacks-node"
+  default = "example"
 }
 
 variable "name_component" {
@@ -52,16 +52,6 @@ variable "location_name_map" {
   }
 }
 
-############################################
-# AZURE INFORMATION
-############################################
-
-# RELYING PURELY ON ENVIRONMENT VARIABLES as the user can control these from their own environment
-
-variable "client_secret" {
-  type = string
-}
-
 ############################################
 # RESOURCE INFORMATION
 ############################################
@@ -99,4 +89,3 @@ variable "client_secret" {
 #   type = string
 #   default = "https://portal.azure.com"
 # }
-

azurerm/modules/azurerm-aks/identity.tf

@@ -20,15 +20,15 @@ resource "azurerm_key_vault" "default" {
     object_id = var.spn_object_id
 
     key_permissions = [
-      "get",
+      "Get",
     ]
 
     secret_permissions = [
-      "get",
+      "Get",
     ]
 
     storage_permissions = [
-      "get",
+      "Get",
     ]
   }
 

azurerm/modules/azurerm-aks/network.tf

@@ -79,46 +79,3 @@ resource "azurerm_subnet" "default" {
 #   subnet_id      = azurerm_subnet.default.id
 #   route_table_id = azurerm_route_table.default.id
 # }
-
-# DNS
-# this is the base which will hold all your ingress records
-# ensure you provide the NS records to the TLD owner
-resource "azurerm_dns_zone" "default" {
-  count               = var.create_dns_zone ? 1 : 0
-  name                = var.dns_zone
-  resource_group_name = azurerm_resource_group.default.name
-  depends_on          = [azurerm_resource_group.default]
-  lifecycle {
-    ignore_changes = [
-      tags,
-    ]
-  }
-}
-
-resource "azurerm_private_dns_zone" "default" {
-  count               = var.create_dns_zone ? 1 : 0
-  name                = var.internal_dns_zone
-  resource_group_name = azurerm_resource_group.default.name
-  depends_on          = [azurerm_resource_group.default]
-  lifecycle {
-    ignore_changes = [
-      tags,
-    ]
-  }
-}
-
-resource "azurerm_private_dns_zone_virtual_network_link" "default" {
-  name                  = var.resource_namer
-  virtual_network_id    = azurerm_virtual_network.default.0.id
-  resource_group_name   = local.dns_resource_group
-  private_dns_zone_name = var.internal_dns_zone
-  depends_on = [
-    azurerm_virtual_network.default,
-    azurerm_private_dns_zone.default.0
-  ]
-  lifecycle {
-    ignore_changes = [
-      tags,
-    ]
-  }
-}

azurerm/modules/azurerm-aks/outputs.tf

@@ -49,10 +49,6 @@ output "acr_registry_name" {
   depends_on  = [azurerm_resource_group.default]
 }
 
-# output "aks_vmss" {
-#   value = azurerm_kubernetes_cluster.default.
-# }
-
 output "aks_node_resource_group" {
   value = azurerm_kubernetes_cluster.default.0.node_resource_group
 }
@@ -122,10 +118,15 @@ output "dns_internal_resource_group_name" {
   value = var.dns_resource_group
 }
 
+# TODO: This is not even the Base DNS, it's the Environment DNS, terminology needs tidying up..?
 output "dns_base_domain" {
   value = var.dns_zone
 }
 
 output "dns_base_domain_internal" {
   value = var.internal_dns_zone
 }
+
+output "dns_base_domain_name_servers" {
+  value = var.create_dns_zone ? azurerm_dns_zone.default.0.name_servers : []
+}