Skip to content

Commit 38b063c

Browse files
florianowflorianow
committed
feat: adding backplane
feat: adding backplane
1 parent 2796ae7 commit 38b063c

File tree

8 files changed

+159
-2
lines changed

8 files changed

+159
-2
lines changed

‎modules/azure/aks/backplane/README.md

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
# AKS CLuster
2+
3+
This documentation is intended as a reference documentation for cloud foundation or platform engineers using this module.
4+
5+
## Permissions
6+
7+
This is a very simple building block, which means we let the SPN have access to AKS Clusters
8+
across all subscriptions underneath a management group (typically the top-level management group for landing zones).
9+
10+
<!-- BEGIN_TF_DOCS -->
11+
## Requirements
12+
13+
| Name | Version |
14+
|------|---------|
15+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.5.0 |
16+
| <a name="requirement_azurerm"></a> [azurerm](#requirement\_azurerm) | 4.36.0 |
17+
18+
## Modules
19+
20+
No modules.
21+
22+
## Resources
23+
24+
| Name | Type |
25+
|------|------|
26+
| [azurerm_role_assignment.buildingblock_deploy](https://registry.terraform.io/providers/hashicorp/azurerm/4.36.0/docs/resources/role_assignment) | resource |
27+
| [azurerm_role_definition.buildingblock_deploy](https://registry.terraform.io/providers/hashicorp/azurerm/4.36.0/docs/resources/role_definition) | resource |
28+
29+
## Inputs
30+
31+
| Name | Description | Type | Default | Required |
32+
|------|-------------|------|---------|:--------:|
33+
| <a name="input_name"></a> [name](#input\_name) | name of the building block, used for naming resources | `string` | `"aks"` | no |
34+
| <a name="input_principal_ids"></a> [principal\_ids](#input\_principal\_ids) | set of principal ids that will be granted permissions to deploy the building block | `set(string)` | n/a | yes |
35+
| <a name="input_scope"></a> [scope](#input\_scope) | Scope where the building block should be deployable, typically the parent of all Landing Zones. | `string` | n/a | yes |
36+
37+
## Outputs
38+
39+
| Name | Description |
40+
|------|-------------|
41+
| <a name="output_documentation_md"></a> [documentation\_md](#output\_documentation\_md) | Markdown documentation with information about the AKS Building Block building block backplane |
42+
| <a name="output_role_assignment_ids"></a> [role\_assignment\_ids](#output\_role\_assignment\_ids) | The IDs of the role assignments for the service principals. |
43+
| <a name="output_role_assignment_principal_ids"></a> [role\_assignment\_principal\_ids](#output\_role\_assignment\_principal\_ids) | The principal IDs of the service principals that have been assigned the role. |
44+
| <a name="output_role_definition_id"></a> [role\_definition\_id](#output\_role\_definition\_id) | The ID of the role definition that enables deployment of the building block to subscriptions. |
45+
| <a name="output_role_definition_name"></a> [role\_definition\_name](#output\_role\_definition\_name) | The name of the role definition that enables deployment of the building block to subscriptions. |
46+
| <a name="output_scope"></a> [scope](#output\_scope) | The scope where the role definition and role assignments are applied. |
47+
<!-- END_TF_DOCS -->

‎modules/azure/aks/backplane/documentation.tf

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
output "documentation_md" {
2+
value = <<EOF
3+
# AKS Building Block
4+
5+
The Azure AKS Building Block configures a AKS (Kubernetes Service) cluster in the Azure cloud, which can be used to deploy and run containerized applications.
6+
7+
## Automation
8+
9+
We automate the deployment of a AKS Building Block using the common [Azure Building Blocks Automation Infrastructure](../automation.md).
10+
In order to deploy this building block, this infrastructure receives the following roles.
11+
12+
| Role Name | Description | Permissions |
13+
|-----------|-------------|-------------|
14+
| `${azurerm_role_definition.buildingblock_deploy.name}` | ${azurerm_role_definition.buildingblock_deploy.description} | ${join("<br>", formatlist("- `%s`", azurerm_role_definition.buildingblock_deploy.permissions[0].actions))} |
15+
16+
EOF
17+
description = "Markdown documentation with information about the AKS Building Block building block backplane"
18+
}

‎modules/azure/aks/backplane/main.tf

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
resource "azurerm_role_definition" "buildingblock_deploy" {
2+
name = "${var.name}-deploy"
3+
scope = var.scope
4+
description = "Enables deployment of the ${var.name} building block to subscriptions"
5+
6+
permissions {
7+
actions = [
8+
"Microsoft.ContainerService/managedClusters/*",
9+
"Microsoft.ContainerService/managedClusters/accessProfiles/*",
10+
"Microsoft.Network/virtualNetworks/*",
11+
"Microsoft.Network/networkInterfaces/read",
12+
"Microsoft.Network/networkSecurityGroups/*",
13+
"Microsoft.Resources/deployments/*",
14+
"Microsoft.Resources/subscriptions/resourceGroups/*",
15+
"Microsoft.OperationalInsights/*",
16+
"Microsoft.Insights/diagnosticSettings/*",
17+
"Microsoft.Authorization/roleAssignments/read"
18+
]
19+
}
20+
}
21+
22+
resource "azurerm_role_assignment" "buildingblock_deploy" {
23+
for_each = var.principal_ids
24+
25+
role_definition_id = azurerm_role_definition.buildingblock_deploy.role_definition_resource_id
26+
principal_id = each.value
27+
scope = var.scope
28+
}

‎modules/azure/aks/backplane/outputs.tf

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
output "role_definition_id" {
2+
value = azurerm_role_definition.buildingblock_deploy.id
3+
description = "The ID of the role definition that enables deployment of the building block to subscriptions."
4+
}
5+
6+
output "role_definition_name" {
7+
value = azurerm_role_definition.buildingblock_deploy.name
8+
description = "The name of the role definition that enables deployment of the building block to subscriptions."
9+
}
10+
11+
output "role_assignment_ids" {
12+
value = [for id in azurerm_role_assignment.buildingblock_deploy : id.id]
13+
description = "The IDs of the role assignments for the service principals."
14+
}
15+
16+
output "role_assignment_principal_ids" {
17+
value = [for id in azurerm_role_assignment.buildingblock_deploy : id.principal_id]
18+
description = "The principal IDs of the service principals that have been assigned the role."
19+
}
20+
21+
output "scope" {
22+
value = var.scope
23+
description = "The scope where the role definition and role assignments are applied."
24+
}

‎modules/azure/aks/backplane/provider.tf

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
provider "azurerm" {
2+
features {}
3+
}

‎modules/azure/aks/backplane/variables.tf

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
variable "name" {
2+
type = string
3+
nullable = false
4+
default = "aks"
5+
description = "name of the building block, used for naming resources"
6+
validation {
7+
condition = can(regex("^[-a-z0-9]+$", var.name))
8+
error_message = "Only alphanumeric lowercase characters and dashes are allowed"
9+
}
10+
}
11+
12+
variable "principal_ids" {
13+
type = string
14+
description = "Object ID of the SCP (Terraform SPN or federated identity)"
15+
}
16+
17+
variable "scope" {
18+
type = string
19+
nullable = false
20+
description = "Scope where the building block should be deployable, typically the parent of all Landing Zones."
21+
}
22+
23+
variable "principal_ids" {
24+
type = set(string)
25+
nullable = false
26+
description = "set of principal ids that will be granted permissions to deploy the building block"
27+
}

‎modules/azure/aks/backplane/versions.tf

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
terraform {
2+
required_version = ">= 1.5.0"
3+
4+
required_providers {
5+
azurerm = {
6+
source = "hashicorp/azurerm"
7+
version = "4.36.0" # oder aktuelle getestete Version
8+
}
9+
}
10+
}

‎modules/azure/aks/buildingblock/README.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
---
2-
name: Azure AKS Cluster
2+
name: AKS Cluster
33
supportedPlatforms:
44
- azure
55
description: |
66
Provision a production-grade Azure Kubernetes Service (AKS) cluster with Azure AD, OIDC, Workload Identity, Log Analytics and custom VNet using Terraform."
77
---
88

9-
# Azure AKS Terraform Module
9+
# AKS Building Block
1010

1111
This Terraform module provisions a production-ready [Azure Kubernetes Service (AKS)](https://learn.microsoft.com/en-us/azure/aks/) cluster including:
1212

0 commit comments

Comments
 (0)