Add `var.dns_prefix_private_cluster` #584

lonegunmanb · 2024-08-20T05:23:14Z

Describe your changes

Issue number

#568

Checklist before requesting a review

The pr title can be used to describe what this pr did in CHANGELOG.md file
I have executed pre-commit on my machine
I have passed pr-check on my machine

Thanks for your cooperation!

zioproto · 2024-08-20T09:13:23Z

Warning dns_prefix or dns_prefix_private_cluster are exclusive.

We do have a prefix variable that is not nullable:

variable "prefix" {
  type        = string
  default     = ""
  description = "(Optional) The prefix for the resources created in the specified Azure Resource Group. Omitting this variable requires both `var.cluster_log_analytics_workspace_name` and `var.cluster_name` have been set."
  nullable    = false
}

Would it be okay to have dns_prefix as empty string "" and dns_prefix_private_cluster as a string ?

lonegunmanb · 2024-08-21T01:53:41Z

Thanks for your review @zioproto , quite good catch! I've removed nullable=false from var.prefix now we can set it to null explicitly.

An empty string for var.prefix and non-empty string for var.dns_prefix_private_cluster would trigger a schema validation error so I think it's enough for those two variables. WDYT?

…ter` can be specified

…ario

zioproto · 2024-09-09T08:48:08Z

During the testing I figure out we need more code. I pushed 2 commits with more preconditions.

https://learn.microsoft.com/en-us/azure/aks/private-clusters?tabs=azure-portal#configure-a-private-dns-zone

There is another problem.

the private dns zone name should be in either of these formats:

private.eastus.azmk8s.io
privatelink.eastus.azmk8s.io
[a-zA-Z0-9-]{1,32}.private.eastus.azmk8s.io
[a-zA-Z0-9-]{1,32}.privatelink.eastus.azmk8s.io

Should we also create the necessary role assignments ?

The docs say:
"You also need a user-assigned identity or service principal with the Private DNS Zone Contributor and Network Contributor roles."
I enforced the identities with the precondition but I did not create the assignments yet

zioproto · 2024-09-09T08:49:40Z

Another problem. The default value for var.prefix is "". In my tests I had to pass an explicit var.prefix = null. At one point we could introduce a braking change making the default value for var.prefix = null ?

zioproto · 2024-11-22T11:30:01Z

locals.tf

  query_datasource_for_log_analytics_workspace_location = var.log_analytics_workspace_enabled && (var.log_analytics_workspace != null ? var.log_analytics_workspace.location == null : false)
  subnet_ids                                            = toset([for id in local.potential_subnet_ids : id if id != null])
  use_brown_field_gw_for_ingress                        = var.brown_field_application_gateway_for_ingress != null
  use_green_field_gw_for_ingress                        = var.green_field_application_gateway_for_ingress != null
+  valid_private_dns_zone_regexs = [
+    "private\\.[a-z]+\\.azmk8s\\.io",


the match [a-z] should be changed into [a-z0-9] to match region names with numbers like eastus2

zioproto · 2024-11-22T11:30:46Z

locals.tf

  query_datasource_for_log_analytics_workspace_location = var.log_analytics_workspace_enabled && (var.log_analytics_workspace != null ? var.log_analytics_workspace.location == null : false)
  subnet_ids                                            = toset([for id in local.potential_subnet_ids : id if id != null])
  use_brown_field_gw_for_ingress                        = var.brown_field_application_gateway_for_ingress != null
  use_green_field_gw_for_ingress                        = var.green_field_application_gateway_for_ingress != null
+  valid_private_dns_zone_regexs = [
+    "private\\.[a-z]+\\.azmk8s\\.io",
+    "privatelink\\.[a-z]+\\.azmk8s\\.io",


same here:
the match [a-z] should be changed into [a-z0-9] to match region names with numbers like eastus2

zioproto

the match [a-z] should be changed into [a-z0-9] to match region names with numbers like eastus2

zioproto · 2024-11-22T12:58:30Z

locals.tf

  query_datasource_for_log_analytics_workspace_location = var.log_analytics_workspace_enabled && (var.log_analytics_workspace != null ? var.log_analytics_workspace.location == null : false)
  subnet_ids                                            = toset([for id in local.potential_subnet_ids : id if id != null])
  use_brown_field_gw_for_ingress                        = var.brown_field_application_gateway_for_ingress != null
  use_green_field_gw_for_ingress                        = var.green_field_application_gateway_for_ingress != null
+  valid_private_dns_zone_regexs = [
+    "private\\.[a-z]+\\.azmk8s\\.io",


Suggested change

"private\\.[a-z]+\\.azmk8s\\.io",

"private\\.[a-z0-9]+\\.azmk8s\\.io",

zioproto · 2024-11-22T12:58:49Z

locals.tf

  query_datasource_for_log_analytics_workspace_location = var.log_analytics_workspace_enabled && (var.log_analytics_workspace != null ? var.log_analytics_workspace.location == null : false)
  subnet_ids                                            = toset([for id in local.potential_subnet_ids : id if id != null])
  use_brown_field_gw_for_ingress                        = var.brown_field_application_gateway_for_ingress != null
  use_green_field_gw_for_ingress                        = var.green_field_application_gateway_for_ingress != null
+  valid_private_dns_zone_regexs = [
+    "private\\.[a-z]+\\.azmk8s\\.io",
+    "privatelink\\.[a-z]+\\.azmk8s\\.io",


Suggested change

"privatelink\\.[a-z]+\\.azmk8s\\.io",

"privatelink\\.[a-z0-9]+\\.azmk8s\\.io",

@lonegunmanb can I commit the above change in the regular expression ? thanks

add var.dns_prefix_private_cluster

a449f9c

lonegunmanb temporarily deployed to acctests August 20, 2024 05:23 — with GitHub Actions Inactive

remove nullable=false from var.prefix

7cf3feb

lonegunmanb temporarily deployed to acctests August 21, 2024 01:51 — with GitHub Actions Inactive

lonegunmanb requested a review from zioproto August 21, 2024 08:18

lonegunmanb had a problem deploying to acctests August 26, 2024 02:12 — with GitHub Actions Failure

lonegunmanb had a problem deploying to acctests August 27, 2024 01:23 — with GitHub Actions Failure

lonegunmanb force-pushed the e-568 branch from 941d76b to bd0e046 Compare September 6, 2024 08:31

lonegunmanb had a problem deploying to acctests September 6, 2024 08:31 — with GitHub Actions Failure

lonegunmanb force-pushed the e-568 branch from bd0e046 to 7cf3feb Compare September 6, 2024 08:34

lonegunmanb temporarily deployed to acctests September 6, 2024 08:34 — with GitHub Actions Inactive

Add precondition: Only one of `var.prefix,var.dns_prefix_private_clus…

1118b4e

…ter` can be specified

zioproto temporarily deployed to acctests September 9, 2024 08:07 — with GitHub Actions Inactive

Adding more preconditions for the var.dns_prefix_private_cluster scen…

e344c91

…ario

zioproto had a problem deploying to acctests September 9, 2024 08:44 — with GitHub Actions Failure

lonegunmanb added 2 commits September 10, 2024 10:54

add private dns zone name check

02d0df6

adjust error message

6c537ed

lonegunmanb had a problem deploying to acctests September 10, 2024 02:54 — with GitHub Actions Failure

refactor check expression

6b6e5ea

lonegunmanb had a problem deploying to acctests September 10, 2024 03:01 — with GitHub Actions Failure

refactor check expression

b1086b7

lonegunmanb had a problem deploying to acctests September 10, 2024 03:07 — with GitHub Actions Error

zioproto reviewed Nov 22, 2024

View reviewed changes

zioproto requested changes Nov 22, 2024

View reviewed changes

zioproto reviewed Nov 22, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add `var.dns_prefix_private_cluster` #584

Add `var.dns_prefix_private_cluster` #584

lonegunmanb commented Aug 20, 2024

zioproto commented Aug 20, 2024

lonegunmanb commented Aug 21, 2024

zioproto commented Sep 9, 2024

zioproto commented Sep 9, 2024

zioproto Nov 22, 2024

zioproto Nov 22, 2024

zioproto left a comment

zioproto Nov 22, 2024

zioproto Nov 22, 2024

zioproto Dec 19, 2024

	"private\\.[a-z]+\\.azmk8s\\.io",
	"private\\.[a-z0-9]+\\.azmk8s\\.io",

	"privatelink\\.[a-z]+\\.azmk8s\\.io",
	"privatelink\\.[a-z0-9]+\\.azmk8s\\.io",

Add var.dns_prefix_private_cluster #584

Are you sure you want to change the base?

Add var.dns_prefix_private_cluster #584

Conversation

lonegunmanb commented Aug 20, 2024

Describe your changes

Issue number

Checklist before requesting a review

zioproto commented Aug 20, 2024

lonegunmanb commented Aug 21, 2024

zioproto commented Sep 9, 2024

zioproto commented Sep 9, 2024

zioproto Nov 22, 2024

Choose a reason for hiding this comment

zioproto Nov 22, 2024

Choose a reason for hiding this comment

zioproto left a comment

Choose a reason for hiding this comment

zioproto Nov 22, 2024

Choose a reason for hiding this comment

zioproto Nov 22, 2024

Choose a reason for hiding this comment

zioproto Dec 19, 2024

Choose a reason for hiding this comment

Add `var.dns_prefix_private_cluster` #584

Add `var.dns_prefix_private_cluster` #584