add workload identity and oidc issuer vars

README.md

@@ -42,13 +42,15 @@ An opinionated Terraform module that can be used to create and manage an AKS clu
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
 | <a name="input_admin_azuread_group_names"></a> [admin\_azuread\_group\_names](#input\_admin\_azuread\_group\_names) | The list of Azure AD groups that should be granted admin access to the AKS cluster. | `list(string)` | `[]` | no |
+| <a name="input_enable_auto_scaling"></a> [enable\_auto\_scaling](#input\_enable\_auto\_scaling) | Enable auto scaling | `bool` | `false` | no |
 | <a name="input_instance_type"></a> [instance\_type](#input\_instance\_type) | The type of instance to use for the single node pool to be created. (NOTE: The upstream AKS module doesn't support multiple node pools yet.) | `string` | `"Standard_D2s_v3"` | no |
 | <a name="input_kube_proxy_disabled"></a> [kube\_proxy\_disabled](#input\_kube\_proxy\_disabled) | Disable kube-proxy | `bool` | `false` | no |
 | <a name="input_kubernetes_version"></a> [kubernetes\_version](#input\_kubernetes\_version) | The version of Kubernetes to use. | `string` | `"1.29.4"` | no |
 | <a name="input_max_nodes"></a> [max\_nodes](#input\_max\_nodes) | The maximum number of nodes in the AKS cluster. | `number` | `4` | no |
 | <a name="input_min_nodes"></a> [min\_nodes](#input\_min\_nodes) | The minimum number of nodes in the AKS cluster. | `number` | `3` | no |
 | <a name="input_name"></a> [name](#input\_name) | The name of the AKS cluster. | `string` | n/a | yes |
 | <a name="input_network_plugin"></a> [network\_plugin](#input\_network\_plugin) | The network plugin to use (one of 'azure' or 'none'). | `string` | `"azure"` | no |
+| <a name="input_oidc_issuer_enabled"></a> [oidc\_issuer\_enabled](#input\_oidc\_issuer\_enabled) | Enable OIDC issuer | `bool` | `false` | no |
 | <a name="input_owner"></a> [owner](#input\_owner) | Your name. | `string` | n/a | yes |
 | <a name="input_paid_tier"></a> [paid\_tier](#input\_paid\_tier) | Whether to use the "Standard" AKS tier. | `bool` | `false` | no |
 | <a name="input_region"></a> [region](#input\_region) | The region in which to create the AKS cluster and associated resources. | `string` | n/a | yes |
@@ -57,6 +59,7 @@ An opinionated Terraform module that can be used to create and manage an AKS clu
 | <a name="input_service_cidr"></a> [service\_cidr](#input\_service\_cidr) | The CIDR block to use for services. | `string` | n/a | yes |
 | <a name="input_sp_enabled"></a> [sp\_enabled](#input\_sp\_enabled) | Set to false to disable service principle creation | `bool` | `true` | no |
 | <a name="input_subnet_id"></a> [subnet\_id](#input\_subnet\_id) | The ID of the subnet where to place the node pool. | `string` | n/a | yes |
+| <a name="input_workload_identity_enabled"></a> [workload\_identity\_enabled](#input\_workload\_identity\_enabled) | Enable workload identity | `bool` | `false` | no |
 
 ## Outputs
 
@@ -67,6 +70,7 @@ An opinionated Terraform module that can be used to create and manage an AKS clu
 | <a name="output_cluster_endpoint"></a> [cluster\_endpoint](#output\_cluster\_endpoint) | n/a |
 | <a name="output_cluster_name"></a> [cluster\_name](#output\_cluster\_name) | n/a |
 | <a name="output_node_resource_group"></a> [node\_resource\_group](#output\_node\_resource\_group) | n/a |
+| <a name="output_oidc_issuer_url"></a> [oidc\_issuer\_url](#output\_oidc\_issuer\_url) | n/a |
 | <a name="output_path_to_kubeconfig_file"></a> [path\_to\_kubeconfig\_file](#output\_path\_to\_kubeconfig\_file) | n/a |
 | <a name="output_resource_group"></a> [resource\_group](#output\_resource\_group) | n/a |
 <!-- END_TF_DOCS -->

main.tf

@@ -41,7 +41,7 @@ module "main" {
   agents_tags                       = local.tags
   agents_size                       = var.instance_type
   cluster_name                      = var.name
-  enable_auto_scaling               = true
+  enable_auto_scaling               = var.enable_auto_scaling
   role_based_access_control_enabled = true
   kubernetes_version                = var.kubernetes_version
   net_profile_dns_service_ip        = cidrhost(var.service_cidr, 10)
@@ -53,11 +53,13 @@ module "main" {
   rbac_aad_admin_group_object_ids = [
     for k, v in data.azuread_group.admins : v.id
   ]
-  rbac_aad_managed    = true
-  resource_group_name = var.resource_group_name
-  sku_tier            = var.paid_tier ? "Standard" : "Free"
-  prefix              = var.name
-  vnet_subnet_id      = var.subnet_id
+  rbac_aad_managed          = true
+  resource_group_name       = var.resource_group_name
+  sku_tier                  = var.paid_tier ? "Standard" : "Free"
+  prefix                    = var.name
+  vnet_subnet_id            = var.subnet_id
+  oidc_issuer_enabled       = var.oidc_issuer_enabled
+  workload_identity_enabled = var.workload_identity_enabled
 }
 
 // Create an Azure AD service principal that Cilium can run under.

outputs.tf

@@ -39,3 +39,8 @@ output "resource_group" {
 output "cluster_endpoint" {
   value = module.main.cluster_fqdn
 }
+
+
+output "oidc_issuer_url" {
+  value = module.main.oidc_issuer_url
+}

variables.tf

@@ -100,4 +100,22 @@ variable "sp_enabled" {
   description = "Set to false to disable service principle creation"
   default     = true
   type        = bool
+}
+
+variable "oidc_issuer_enabled" {
+  description = "Enable OIDC issuer"
+  default     = false
+  type        = bool
+}
+
+variable "workload_identity_enabled" {
+  description = "Enable workload identity"
+  default     = false
+  type        = bool
+}
+
+variable "enable_auto_scaling" {
+  description = "Enable auto scaling"
+  default     = false
+  type        = bool
 }