Skip to content

Commit 016b727

Browse files
PixelRobotsAlexanderSehreriqua
authored
feat: fix ps rule error for waf aligned aks - avm/res/container-service/managed-cluster (#3228)
## Description <!-- >Thank you for your contribution ! > Please include a summary of the change and which issue is fixed. > Please also include the context. > List any dependencies that are required for this change. Fixes #123 Fixes #456 Closes #123 Closes #456 --> Fixes issue with ps rule for WAF. For some reason it still complains about default, But I don't think the ps rule should be running on the default test as it is not required. I am unsure how to change that. Happy to do so with some guidance. ## Pipeline Reference <!-- Insert your Pipeline Status Badge below --> | Pipeline | | -------- | | [![avm.res.container-service.managed-cluster](https://github.com/PixelRobots/bicep-registry-modules/actions/workflows/avm.res.container-service.managed-cluster.yml/badge.svg?branch=fix-ps-rule-error-aks-rh)](https://github.com/PixelRobots/bicep-registry-modules/actions/workflows/avm.res.container-service.managed-cluster.yml) | ## Type of Change <!-- Use the checkboxes [x] on the options that are relevant. --> - [ ] Update to CI Environment or utilities (Non-module affecting changes) - [x] Azure Verified Module updates: - [ ] Bugfix containing backwards-compatible bug fixes, and I have NOT bumped the MAJOR or MINOR version in `version.json`: - [ ] Someone has opened a bug report issue, and I have included "Closes #{bug_report_issue_number}" in the PR description. - [ ] The bug was found by the module author, and no one has opened an issue to report it yet. - [ ] Feature update backwards compatible feature updates, and I have bumped the MINOR version in `version.json`. - [ ] Breaking changes and I have bumped the MAJOR version in `version.json`. - [x] Update to documentation ## Checklist - [ ] I'm sure there are no other open Pull Requests for the same update/change - [ ] I have run `Set-AVMModule` locally to generate the supporting module files. - [ ] My corresponding pipelines / checks run clean and green without any errors or warnings <!-- Please keep up to date with the contribution guide at https://aka.ms/avm/contribute/bicep --> --------- Signed-off-by: PixelRobots <[email protected]> Co-authored-by: Alexander Sehr <[email protected]> Co-authored-by: Erika Gressi <[email protected]>
1 parent 456d2bd commit 016b727

File tree

8 files changed

+461
-92
lines changed

8 files changed

+461
-92
lines changed

‎avm/res/container-service/managed-cluster/README.md

+298-50
Large diffs are not rendered by default.

‎avm/res/container-service/managed-cluster/main.bicep

+25-9
Original file line numberDiff line numberDiff line change
@@ -156,8 +156,8 @@ param primaryAgentPoolProfile array
156156
@description('Optional. Define one or more secondary/additional agent pools.')
157157
param agentPools agentPoolType
158158

159-
@description('Optional. Whether or not to use AKS Automatic mode.')
160-
param maintenanceConfiguration maintenanceConfigurationType
159+
@description('Optional. Maintenance Window for Cluster auto upgrade and node OS upgrade.')
160+
param maintenanceConfigurations maintenanceConfigurationType
161161

162162
@description('Optional. Specifies whether the cost analysis add-on is enabled or not. If Enabled `enableStorageProfileDiskCSIDriver` is set to true as it is needed.')
163163
param costAnalysisEnabled bool = false
@@ -270,6 +270,15 @@ param autoScalerProfileSkipNodesWithSystemPods bool = true
270270
@description('Optional. Auto-upgrade channel on the AKS cluster.')
271271
param autoUpgradeProfileUpgradeChannel string = 'stable'
272272

273+
@allowed([
274+
'NodeImage'
275+
'None'
276+
'SecurityPatch'
277+
'Unmanaged'
278+
])
279+
@description('Optional. Auto-upgrade channel on the Node Os.')
280+
param autoNodeOsUpgradeProfileUpgradeChannel string = 'Unmanaged'
281+
273282
@description('Optional. Running in Kubenet is disabled by default due to the security related nature of AAD Pod Identity and the risks of IP spoofing.')
274283
param podIdentityProfileAllowNetworkPluginKubenet bool = false
275284

@@ -684,6 +693,7 @@ resource managedCluster 'Microsoft.ContainerService/managedClusters@2024-03-02-p
684693
}
685694
autoUpgradeProfile: {
686695
upgradeChannel: autoUpgradeProfileUpgradeChannel
696+
nodeOSUpgradeChannel: autoNodeOsUpgradeProfileUpgradeChannel
687697
}
688698
apiServerAccessProfile: {
689699
authorizedIPRanges: authorizedIPRanges
@@ -757,13 +767,16 @@ resource managedCluster 'Microsoft.ContainerService/managedClusters@2024-03-02-p
757767
}
758768
}
759769

760-
module managedCluster_maintenanceConfigurations 'maintenance-configurations/main.bicep' = if (!empty(maintenanceConfiguration)) {
761-
name: '${uniqueString(deployment().name, location)}-ManagedCluster-MaintenanceConfigurations'
762-
params: {
763-
maintenanceWindow: maintenanceConfiguration!.maintenanceWindow
764-
managedClusterName: managedCluster.name
770+
module managedCluster_maintenanceConfigurations 'maintenance-configurations/main.bicep' = [
771+
for (maintenanceConfiguration, index) in (maintenanceConfigurations ?? []): if (!empty(maintenanceConfiguration)) {
772+
name: '${uniqueString(deployment().name, location)}-ManagedCluster-MaintenanceConfigurations-${index}'
773+
params: {
774+
name: maintenanceConfiguration!.name
775+
maintenanceWindow: maintenanceConfiguration!.maintenanceWindow
776+
managedClusterName: managedCluster.name
777+
}
765778
}
766-
}
779+
]
767780

768781
module managedCluster_agentPools 'agent-pool/main.bicep' = [
769782
for (agentPool, index) in (agentPools ?? []): {
@@ -1202,6 +1215,9 @@ type customerManagedKeyType = {
12021215
}?
12031216

12041217
type maintenanceConfigurationType = {
1218+
@description('Required. Name of maintenance window.')
1219+
name: ('aksManagedAutoUpgradeSchedule' | 'aksManagedNodeOSUpgradeSchedule')
1220+
12051221
@description('Required. Maintenance window for the maintenance configuration.')
12061222
maintenanceWindow: object
1207-
}?
1223+
}[]?

‎avm/res/container-service/managed-cluster/main.json

+52-18
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,8 @@
55
"metadata": {
66
"_generator": {
77
"name": "bicep",
8-
"version": "0.29.47.4906",
9-
"templateHash": "6707709888421096485"
8+
"version": "0.30.23.60470",
9+
"templateHash": "13565722664676041295"
1010
},
1111
"name": "Azure Kubernetes Service (AKS) Managed Clusters",
1212
"description": "This module deploys an Azure Kubernetes Service (AKS) Managed Cluster.",
@@ -671,12 +671,25 @@
671671
"nullable": true
672672
},
673673
"maintenanceConfigurationType": {
674-
"type": "object",
675-
"properties": {
676-
"maintenanceWindow": {
677-
"type": "object",
678-
"metadata": {
679-
"description": "Required. Maintenance window for the maintenance configuration."
674+
"type": "array",
675+
"items": {
676+
"type": "object",
677+
"properties": {
678+
"name": {
679+
"type": "string",
680+
"allowedValues": [
681+
"aksManagedAutoUpgradeSchedule",
682+
"aksManagedNodeOSUpgradeSchedule"
683+
],
684+
"metadata": {
685+
"description": "Required. Name of maintenance window."
686+
}
687+
},
688+
"maintenanceWindow": {
689+
"type": "object",
690+
"metadata": {
691+
"description": "Required. Maintenance window for the maintenance configuration."
692+
}
680693
}
681694
}
682695
},
@@ -985,10 +998,10 @@
985998
"description": "Optional. Define one or more secondary/additional agent pools."
986999
}
9871000
},
988-
"maintenanceConfiguration": {
1001+
"maintenanceConfigurations": {
9891002
"$ref": "#/definitions/maintenanceConfigurationType",
9901003
"metadata": {
991-
"description": "Optional. Whether or not to use AKS Automatic mode."
1004+
"description": "Optional. Maintenance Window for Cluster auto upgrade and node OS upgrade."
9921005
}
9931006
},
9941007
"costAnalysisEnabled": {
@@ -1228,6 +1241,19 @@
12281241
"description": "Optional. Auto-upgrade channel on the AKS cluster."
12291242
}
12301243
},
1244+
"autoNodeOsUpgradeProfileUpgradeChannel": {
1245+
"type": "string",
1246+
"defaultValue": "Unmanaged",
1247+
"allowedValues": [
1248+
"NodeImage",
1249+
"None",
1250+
"SecurityPatch",
1251+
"Unmanaged"
1252+
],
1253+
"metadata": {
1254+
"description": "Optional. Auto-upgrade channel on the Node Os."
1255+
}
1256+
},
12311257
"podIdentityProfileAllowNetworkPluginKubenet": {
12321258
"type": "bool",
12331259
"defaultValue": false,
@@ -1676,7 +1702,8 @@
16761702
"skip-nodes-with-system-pods": "[toLower(string(parameters('autoScalerProfileSkipNodesWithSystemPods')))]"
16771703
},
16781704
"autoUpgradeProfile": {
1679-
"upgradeChannel": "[parameters('autoUpgradeProfileUpgradeChannel')]"
1705+
"upgradeChannel": "[parameters('autoUpgradeProfileUpgradeChannel')]",
1706+
"nodeOSUpgradeChannel": "[parameters('autoNodeOsUpgradeProfileUpgradeChannel')]"
16801707
},
16811708
"apiServerAccessProfile": {
16821709
"authorizedIPRanges": "[parameters('authorizedIPRanges')]",
@@ -1818,18 +1845,25 @@
18181845
]
18191846
},
18201847
"managedCluster_maintenanceConfigurations": {
1821-
"condition": "[not(empty(parameters('maintenanceConfiguration')))]",
1848+
"copy": {
1849+
"name": "managedCluster_maintenanceConfigurations",
1850+
"count": "[length(coalesce(parameters('maintenanceConfigurations'), createArray()))]"
1851+
},
1852+
"condition": "[not(empty(coalesce(parameters('maintenanceConfigurations'), createArray())[copyIndex()]))]",
18221853
"type": "Microsoft.Resources/deployments",
18231854
"apiVersion": "2022-09-01",
1824-
"name": "[format('{0}-ManagedCluster-MaintenanceConfigurations', uniqueString(deployment().name, parameters('location')))]",
1855+
"name": "[format('{0}-ManagedCluster-MaintenanceConfigurations-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
18251856
"properties": {
18261857
"expressionEvaluationOptions": {
18271858
"scope": "inner"
18281859
},
18291860
"mode": "Incremental",
18301861
"parameters": {
1862+
"name": {
1863+
"value": "[coalesce(parameters('maintenanceConfigurations'), createArray())[copyIndex()].name]"
1864+
},
18311865
"maintenanceWindow": {
1832-
"value": "[parameters('maintenanceConfiguration').maintenanceWindow]"
1866+
"value": "[coalesce(parameters('maintenanceConfigurations'), createArray())[copyIndex()].maintenanceWindow]"
18331867
},
18341868
"managedClusterName": {
18351869
"value": "[parameters('name')]"
@@ -1841,8 +1875,8 @@
18411875
"metadata": {
18421876
"_generator": {
18431877
"name": "bicep",
1844-
"version": "0.29.47.4906",
1845-
"templateHash": "12168542117744033419"
1878+
"version": "0.30.23.60470",
1879+
"templateHash": "2505380725266419010"
18461880
},
18471881
"name": "Azure Kubernetes Service (AKS) Managed Cluster Maintenance Configurations",
18481882
"description": "This module deploys an Azure Kubernetes Service (AKS) Managed Cluster Maintenance Configurations.",
@@ -2038,8 +2072,8 @@
20382072
"metadata": {
20392073
"_generator": {
20402074
"name": "bicep",
2041-
"version": "0.29.47.4906",
2042-
"templateHash": "2004205618690542488"
2075+
"version": "0.30.23.60470",
2076+
"templateHash": "4315564225725874539"
20432077
},
20442078
"name": "Azure Kubernetes Service (AKS) Managed Cluster Agent Pools",
20452079
"description": "This module deploys an Azure Kubernetes Service (AKS) Managed Cluster Agent Pool.",

‎avm/res/container-service/managed-cluster/tests/e2e/automatic/main.test.bicep

+17-14
Original file line numberDiff line numberDiff line change
@@ -39,23 +39,26 @@ module testDeployment '../../../main.bicep' = [
3939
params: {
4040
name: '${namePrefix}${serviceShort}001'
4141
location: resourceLocation
42-
maintenanceConfiguration: {
43-
maintenanceWindow: {
44-
schedule: {
45-
daily: null
46-
weekly: {
47-
intervalWeeks: 1
48-
dayOfWeek: 'Sunday'
42+
maintenanceConfigurations: [
43+
{
44+
name: 'aksManagedAutoUpgradeSchedule'
45+
maintenanceWindow: {
46+
schedule: {
47+
daily: null
48+
weekly: {
49+
intervalWeeks: 1
50+
dayOfWeek: 'Sunday'
51+
}
52+
absoluteMonthly: null
53+
relativeMonthly: null
4954
}
50-
absoluteMonthly: null
51-
relativeMonthly: null
55+
durationHours: 4
56+
utcOffset: '+00:00'
57+
startDate: '2024-07-03'
58+
startTime: '00:00'
5259
}
53-
durationHours: 4
54-
utcOffset: '+00:00'
55-
startDate: '2024-07-03'
56-
startTime: '00:00'
5760
}
58-
}
61+
]
5962
managedIdentities: {
6063
systemAssigned: true
6164
}

‎avm/res/container-service/managed-cluster/tests/e2e/azure/main.test.bicep

+33
Original file line numberDiff line numberDiff line change
@@ -144,6 +144,39 @@ module testDeployment '../../../main.bicep' = [
144144
}
145145
]
146146
autoUpgradeProfileUpgradeChannel: 'stable'
147+
autoNodeOsUpgradeProfileUpgradeChannel: 'Unmanaged'
148+
maintenanceConfigurations: [
149+
{
150+
name: 'aksManagedAutoUpgradeSchedule'
151+
maintenanceWindow: {
152+
schedule: {
153+
weekly: {
154+
intervalWeeks: 1
155+
dayOfWeek: 'Sunday'
156+
}
157+
}
158+
durationHours: 4
159+
utcOffset: '+00:00'
160+
startDate: '2024-07-15'
161+
startTime: '00:00'
162+
}
163+
}
164+
{
165+
name: 'aksManagedNodeOSUpgradeSchedule'
166+
maintenanceWindow: {
167+
schedule: {
168+
weekly: {
169+
intervalWeeks: 1
170+
dayOfWeek: 'Sunday'
171+
}
172+
}
173+
durationHours: 4
174+
utcOffset: '+00:00'
175+
startDate: '2024-07-15'
176+
startTime: '00:00'
177+
}
178+
}
179+
]
147180
enableWorkloadIdentity: true
148181
enableOidcIssuerProfile: true
149182
networkPlugin: 'azure'

‎avm/res/container-service/managed-cluster/tests/e2e/waf-aligned/main.test.bicep

+33
Original file line numberDiff line numberDiff line change
@@ -139,6 +139,39 @@ module testDeployment '../../../main.bicep' = [
139139
}
140140
]
141141
autoUpgradeProfileUpgradeChannel: 'stable'
142+
autoNodeOsUpgradeProfileUpgradeChannel: 'Unmanaged'
143+
maintenanceConfigurations: [
144+
{
145+
name: 'aksManagedAutoUpgradeSchedule'
146+
maintenanceWindow: {
147+
schedule: {
148+
weekly: {
149+
intervalWeeks: 1
150+
dayOfWeek: 'Sunday'
151+
}
152+
}
153+
durationHours: 4
154+
utcOffset: '+00:00'
155+
startDate: '2024-07-15'
156+
startTime: '00:00'
157+
}
158+
}
159+
{
160+
name: 'aksManagedNodeOSUpgradeSchedule'
161+
maintenanceWindow: {
162+
schedule: {
163+
weekly: {
164+
intervalWeeks: 1
165+
dayOfWeek: 'Sunday'
166+
}
167+
}
168+
durationHours: 4
169+
utcOffset: '+00:00'
170+
startDate: '2024-07-15'
171+
startTime: '00:00'
172+
}
173+
}
174+
]
142175
networkPlugin: 'azure'
143176
networkPolicy: 'azure'
144177
skuTier: 'Standard'

‎avm/res/container-service/managed-cluster/version.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"$schema": "https://aka.ms/bicep-registry-module-version-file-schema#",
3-
"version": "0.3",
3+
"version": "0.4",
44
"pathFilters": [
55
"./main.json"
66
]

‎avm/utilities/pipelines/staticValidation/psrule/.ps-rule/min-suppress.Rule.yaml

+2
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,8 @@ spec:
4646
# Azure API Management
4747
- Azure.APIM.MultiRegion # Team agreed this is too expensive for most use cases and is safe to ignore. Would require dependencies for a min deployment.
4848
- Azure.APIM.ManagedIdentity
49+
# AKS specific
50+
- Azure.AKS.MaintenanceWindow # Excluded as it requires user input
4951
if:
5052
name: "."
5153
contains:

0 commit comments

Comments
 (0)