problem with some fields

[gevraud]

Is there an existing issue for this?

• I have searched the existing issues

Greenfield/Brownfield provisioning

brownfield

Terraform Version

1.13.1

Module Version

11.0.0

AzureRM Provider Version

4.42.0

Affected Resource(s)/Data Source(s)

azurerm_kubernetes_cluster

Terraform Configuration Files

module "aks" {
  source  = "Azure/aks/azurerm"
  version = "11.0.0"
  tags = var.tags

  cluster_name               = var.kubernetes_cluster_name
  resource_group_name        = azurerm_resource_group.this.name
  location                   = azurerm_resource_group.this.location
  kubernetes_version         = "1.33"
  automatic_channel_upgrade  = "patch"
  sku_tier                   = "Standard"
  identity_ids               = [azurerm_user_assigned_identity.this.id]
  identity_type              = "UserAssigned"
  microsoft_defender_enabled = true
  node_resource_group        = "node-${azurerm_resource_group.this.name}"
  node_os_channel_upgrade    = "NodeImage"


  // Monitoring
  monitor_metrics = {}
  log_analytics_solution = {
    id = azurerm_log_analytics_solution.this.id
  }
  log_analytics_workspace_enabled = true
  log_analytics_workspace = {
    id       = data.azurerm_log_analytics_workspace.azurelogs.id
    name     = data.azurerm_log_analytics_workspace.azurelogs.name
    location = var.location
  }
  msi_auth_for_monitoring_enabled = true
  role_based_access_control_enabled = true
  rbac_aad_admin_group_object_ids = [
    data.azuread_group.cluster_admins.object_id
  ]
  workload_identity_enabled = true
  oidc_issuer_enabled       = true

  // KV
  key_vault_secrets_provider_enabled = true

  // acr 
  attached_acr_id_map = {
    acr1 = azurerm_container_registry.this.id
  }

  // Network
  vnet_subnet = {
    id = module.vnet_aks.subnets["subnet1"].resource_id
  }
  private_dns_zone_id                 = "/subscriptions/xx/resourceGroups/rg01/providers/Microsoft.Network/privateDnsZones/axxx"
  prefix                              = "aks" // use for dns
  private_cluster_enabled             = true
  private_cluster_public_fqdn_enabled = false
  azure_policy_enabled                = true
  net_profile_outbound_type           = "userDefinedRouting"
  network_plugin                      = "azure"
  network_plugin_mode                 = "overlay" 
  network_policy                      = "calico"  
  // Node Pools
  agents_availability_zones = ["1"]
  agents_count              = null // because autoscalling enabled
  agents_pool_name          = "default"
  agents_labels = {
    type = "system"
  }
  agents_pool_max_surge                = "10%"
  agents_pool_drain_timeout_in_minutes = 30
  agents_max_count                     = 10 // for all
  agents_min_count                     = 2
  agents_max_pods                      = 50
  agents_type                          = "VirtualMachineScaleSets"
  agents_size                          = "Standard_D4s_v3"
  temporary_name_for_rotation          = "defaulttemp"
  

  node_pools = {
    //worker1 deleted
    worker2 = {
      name      = "worker2"
      vm_size   = "Standard_DS3_v2"
      max_count = 10
      vnet_subnet = {
        id = module.vnet_aks.subnets["subnet3"].resource_id
      }
      auto_scaling_enabled = true
      os_disk_size_gb     = 128
      os_sku              = "Ubuntu"
      node_labels = {
        type = "compute"
      }
      create_before_destroy = true
      upgrade_settings = {
        drain_timeout_in_minutes      = 30
        max_surge                     = "10%"
        node_soak_duration_in_minutes = 0
      }
    }
  }
  maintenance_window = {
    allowed = [
      {
        day   = "Sunday",
        hours = [20, 23]
      },
    ]
    not_allowed = [
      {
        start = "2035-01-01T20:00:00Z",
        end   = "2035-01-01T21:00:00Z"
      },
    ]
  }
  maintenance_window_node_os = {
    frequency  = "Daily"
    interval   = 1
    start_time = "02:00"
    utc_offset = "+01:00"
    duration   = 16
  }

  depends_on = [
    module.vnet_aks
  ]
}

tfvars variables values

.

Debug Output/Panic Output

# module.aks.azurerm_kubernetes_cluster.main will be updated in-place
  ~ resource "azurerm_kubernetes_cluster" "main" {
        id                                  = "/subscriptions/xxx/resourceGroups/rg/providers/Microsoft.ContainerService/managedClusters/aks"
        name                                = "aks"
        tags                                = {
            "deployed_by" = "Terraform"
        }
        # (38 unchanged attributes hidden)

      ~ default_node_pool {
          ~ auto_scaling_enabled          = true -> false
          - max_count                     = 10 -> null
          - min_count                     = 2 -> null
            name                          = "default"
            tags                          = {
                "deployed_by" = "Terraform"
            }
            # (28 unchanged attributes hidden)

            # (1 unchanged block hidden)
        }

      ~ identity {
          # Warning: this attribute value will no longer be marked as sensitive
          # after applying this change. The value is unchanged.
          ~ identity_ids = (sensitive value)
          # Warning: this attribute value will no longer be marked as sensitive
          # after applying this change. The value is unchanged.
          ~ type         = (sensitive value)
            # (2 unchanged attributes hidden)
        }

      - upgrade_override {
          - force_upgrade_enabled = false -> null
            # (1 unchanged attribute hidden)
        }

        # (11 unchanged blocks hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Expected Behaviour

I expected a message with no changes.

Actual Behaviour

auto scaling can't be set for default nodepool
upgrade_override doesn't work

Steps to Reproduce

No response

Important Factoids

No response

References

No response

[lonegunmanb]

Thanks for reporting! We analyzed each issue in your plan output:

1. auto_scaling_enabled = true -> false + max_count/min_count -> null

The module variable auto_scaling_enabled defaults to false (variables.tf L512-516). Your module call sets agents_max_count and agents_min_count, but is missing auto_scaling_enabled = true. Without it, the module uses the manual scaling code path which sets max_count and min_count to null.

Fix — add this to your module call:

auto_scaling_enabled = true    # required for agents_max_count / agents_min_count to take effect
agents_count         = null
agents_max_count     = 10
agents_min_count     = 2

2. upgrade_override block removal

The module's upgrade_override is a dynamic block controlled by var.upgrade_override (defaults to null). For brownfield clusters, Azure API returns a default upgrade_override { force_upgrade_enabled = false } block, which causes drift when the module doesn't produce one.

Per the AzureRM Provider docs, once set, the upgrade_override block cannot be removed from the configuration.

Fix — add this to your module call:

upgrade_override = {
  force_upgrade_enabled = false
}

3. identity block sensitive value changes

This is an expected one-time change after upgrading to module v11.0.0. The v11 release fixed an issue where the identity block was incorrectly marked as sensitive due to var.client_secret being referenced in a for_each expression. See NoticeOnUpgradeTov11.0.md for details. This diff will disappear after the first terraform apply.

---

After applying these three changes, terraform plan should show no changes. Closing as a configuration question — please reopen if you still see unexpected drift after the fixes.

[lonegunmanb]

Closing as a configuration question. The three issues are addressed in the comment above. Please reopen if you still experience unexpected drift after applying the suggested fixes.