feat: Implement support for KMS arguments

Azure · Jan 20, 2023 · 1eef1ef · 1eef1ef
1 parent 7cb58ac
commit 1eef1ef
Show file tree

Hide file tree

Showing 3 changed files with 29 additions and 0 deletions.
diff --git a/README.md b/README.md
@@ -321,6 +321,9 @@ No modules.
 | <a name="input_ingress_application_gateway_subnet_cidr"></a> [ingress\_application\_gateway\_subnet\_cidr](#input\_ingress\_application\_gateway\_subnet\_cidr)                                            | The subnet CIDR to be used to create an Application Gateway, which in turn will be integrated with the ingress controller of this Kubernetes Cluster.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | `string`                                                                                                                                                                                                                   | `null`                      |    no    |
 | <a name="input_ingress_application_gateway_subnet_id"></a> [ingress\_application\_gateway\_subnet\_id](#input\_ingress\_application\_gateway\_subnet\_id)                                                  | The ID of the subnet on which to create an Application Gateway, which in turn will be integrated with the ingress controller of this Kubernetes Cluster.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | `string`                                                                                                                                                                                                                   | `null`                      |    no    |
 | <a name="input_key_vault_secrets_provider_enabled"></a> [key\_vault\_secrets\_provider\_enabled](#input\_key\_vault\_secrets\_provider\_enabled)                                                           | (Optional) Whether to use the Azure Key Vault Provider for Secrets Store CSI Driver in an AKS cluster. For more details: https://docs.microsoft.com/en-us/azure/aks/csi-secrets-store-driver                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | `bool`                                                                                                                                                                                                                     | `false`                     |    no    |
+| <a name="input_kms_enabled"></a> [kms\_enabled](#input\_kms\_enabled)                                                                                                                                      | (Optional) Enable Azure KeyVault Key Management Service.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | `bool`                                                                                                                                                                                                                     | `false`                     |    no    |
+| <a name="input_kms_key_vault_key_id"></a> [kms\_key\_vault\_key\_id](#input\_kms\_key\_vault\_key\_id)                                                                                                     | (Optional) Identifier of Azure Key Vault key. When Azure Key Vault key management service is enabled, this field is required and must be a valid key identifier.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | `string`                                                                                                                                                                                                                   | `null`                      |    no    |
+| <a name="input_kms_key_vault_network_access"></a> [kms\_key\_vault\_network\_access](#input\_kms\_key\_vault\_network\_access)                                                                             | (Optional) Network Access of Azure Key Vault. Possible values are: `Private` and `Public`. If not set, defaults to type `Public`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `string`                                                                                                                                                                                                                   | `null`                      |    no    |
 | <a name="input_kubernetes_version"></a> [kubernetes\_version](#input\_kubernetes\_version)                                                                                                                 | Specify which Kubernetes release to use. The default used is the latest Kubernetes version available in the region                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `string`                                                                                                                                                                                                                   | `null`                      |    no    |
 | <a name="input_load_balancer_profile_enabled"></a> [load\_balancer\_profile\_enabled](#input\_load\_balancer\_profile\_enabled)                                                                            | (Optional) Enable a load\_balancer\_profile block. This can only be used when load\_balancer\_sku is set to `standard`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | `bool`                                                                                                                                                                                                                     | `false`                     |    no    |
 | <a name="input_load_balancer_profile_idle_timeout_in_minutes"></a> [load\_balancer\_profile\_idle\_timeout\_in\_minutes](#input\_load\_balancer\_profile\_idle\_timeout\_in\_minutes)                      | (Optional) Desired outbound flow idle timeout in minutes for the cluster load balancer. Must be between `4` and `120` inclusive.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | `number`                                                                                                                                                                                                                   | `30`                        |    no    |

diff --git a/main.tf b/main.tf
@@ -159,6 +159,14 @@ resource "azurerm_kubernetes_cluster" "main" {
       subnet_id    = var.ingress_application_gateway_subnet_id
     }
   }
+  dynamic "key_management_service" {
+    for_each = var.kms_enabled ? ["key_management_service"] : []
+
+    content {
+      key_vault_key_id         = var.kms_key_vault_key_id
+      key_vault_network_access = var.kms_key_vault_network_access
+    }
+  }
   dynamic "key_vault_secrets_provider" {
     for_each = var.key_vault_secrets_provider_enabled ? ["key_vault_secrets_provider"] : []
 

diff --git a/variables.tf b/variables.tf
@@ -328,6 +328,24 @@ variable "ingress_application_gateway_subnet_id" {
   default     = null
 }
 
+variable "kms_enabled" {
+  type        = bool
+  description = "(Optional) Enable Azure KeyVault Key Management Service."
+  default     = false
+}
+
+variable "kms_key_vault_key_id" {
+  type        = string
+  description = "(Optional) Identifier of Azure Key Vault key. When Azure Key Vault key management service is enabled, this field is required and must be a valid key identifier."
+  default     = null
+}
+
+variable "kms_key_vault_network_access" {
+  type        = string
+  description = "(Optional) Network Access of Azure Key Vault. Possible values are: `Private` and `Public`. If not set, defaults to type `Public`."
+  default     = null
+}
+
 variable "key_vault_secrets_provider_enabled" {
   type        = bool
   description = "(Optional) Whether to use the Azure Key Vault Provider for Secrets Store CSI Driver in an AKS cluster. For more details: https://docs.microsoft.com/en-us/azure/aks/csi-secrets-store-driver"