Reconciling azure terraform state with what is actually deployed in the sub

Signed-off-by: Mark Rossetti <[email protected]>

Author: marosset

infra/azure/terraform/capz/capz-monitoring/main.tf

@@ -26,13 +26,22 @@ variable "subscription_id" {
   type = string
 }
 
+locals {
+  # reproduce the previous pattern seen in state:
+  # "<first-10-of-rg>-<rg>-<first-6-of-subscription>"
+  computed_dns_prefix = format("%s-%s-%s",
+    substr(var.resource_group_name, 0, 10),
+    var.resource_group_name,
+    substr(var.subscription_id, 0, 6)
+  )
+}
+
 # Create the "capz-monitoring" resource group
 resource "azurerm_resource_group" "capz-monitoring" {
   location = var.location
   name     = var.resource_group_name
   tags = {
     DO-NOT-DELETE     = "contact capz"
-    creationTimestamp = timestamp()
   }
 }
 
@@ -50,7 +59,7 @@ resource "azurerm_role_assignment" "monitoring_reader" {
 }
 
 resource "azurerm_kubernetes_cluster" "capz-monitoring" {
-  dns_prefix            = var.resource_group_name
+  dns_prefix            = local.computed_dns_prefix
   location              = var.location
   name                  = var.resource_group_name
   resource_group_name   = var.resource_group_name
@@ -64,6 +73,8 @@ resource "azurerm_kubernetes_cluster" "capz-monitoring" {
   ]
   kubelet_identity {
     user_assigned_identity_id = azurerm_user_assigned_identity.capz_monitoring_user_identity.id
+    client_id                 = azurerm_user_assigned_identity.capz_monitoring_user_identity.client_id
+    object_id                 = azurerm_user_assigned_identity.capz_monitoring_user_identity.principal_id
   }
   identity {
     type                     = "UserAssigned"
@@ -72,8 +83,14 @@ resource "azurerm_kubernetes_cluster" "capz-monitoring" {
     ]
   }
   default_node_pool {
-    name       = "default"
+    name       = "nodepool1"
     node_count = 1
-    vm_size    = "Standard_Ds2_v2"
+    vm_size    = "Standard_DS2_v2"
+  }
+
+  lifecycle {
+    ignore_changes = [
+      "linux_profile",
+    ]
   }
 }

infra/azure/terraform/capz/cluster-api-gallery/main.tf

@@ -62,6 +62,7 @@ resource "azurerm_user_assigned_identity" "pipelines_user_identity" {
   name                = "ado-pipeline-mi"
   resource_group_name = var.resource_group_name
   tags = {
+    DO-NOT-DELETE     = "UpstreamInfra"
     creationTimestamp = "2024-10-24T00:00:00Z"
   }
   depends_on = [

infra/azure/terraform/capz/main.tf

@@ -140,8 +140,8 @@ module "role_assignments" {
 # Import Cluster API gallery module
 module "cluster_api_gallery" {
   source              = "./cluster-api-gallery"
-  resource_group_name = var.resource_group_name
-  location            = var.location
+  resource_group_name = "cluster-api-gallery"
+  location            = "northcentralus"
   depends_on          = [
     module.role_assignments
   ]
@@ -150,7 +150,7 @@ module "cluster_api_gallery" {
 # Import CAPZ monitoring module
 module "capz_monitoring" {
   source              = "./capz-monitoring"
-  resource_group_name = var.resource_group_name
+  resource_group_name = "capz-monitoring"
   location            = var.location
   subscription_id     = data.azurerm_client_config.current.subscription_id
 }

infra/azure/terraform/capz/role-assignments/main.tf

@@ -37,19 +37,19 @@ data "azuread_service_principal" "az_service_principal" {
 }
 
 resource "azurerm_role_assignment" "rg_contributor" {
-  principal_id         = data.azuread_service_principal.az_service_principal.id
+  principal_id         = data.azuread_service_principal.az_service_principal.object_id
   role_definition_name = "Contributor"
   scope                = "/subscriptions/${var.subscription_id}"
 }
 
 resource "azurerm_role_assignment" "storage_blob_data_contributor" {
-  principal_id         = data.azuread_service_principal.az_service_principal.id
+  principal_id         = data.azuread_service_principal.az_service_principal.object_id
   role_definition_name = "Storage Blob Data Contributor"
   scope                = "/subscriptions/${var.subscription_id}"
 }
 
 resource "azurerm_role_assignment" "acr_pull" {
-  principal_id         = data.azuread_service_principal.az_service_principal.id
+  principal_id         = data.azuread_service_principal.az_service_principal.object_id
   role_definition_name = "AcrPull"
   scope                = var.container_registry_scope
 }
@@ -71,15 +71,15 @@ resource "azurerm_role_definition" "custom_role" {
 }
 
 resource "azurerm_role_assignment" "sp_custom_role_assignment" {
-  principal_id         = data.azuread_service_principal.az_service_principal.id
+  principal_id         = data.azuread_service_principal.az_service_principal.object_id
   role_definition_name = azurerm_role_definition.custom_role.name
   scope                = "/subscriptions/${var.subscription_id}"
 }
 
 resource "azurerm_key_vault_access_policy" "access_policy_gmsa_sp" {
   key_vault_id = var.key_vault_id
   tenant_id    = data.azuread_service_principal.az_service_principal.application_tenant_id
-  object_id    = data.azuread_service_principal.az_service_principal.id
+  object_id    = data.azuread_service_principal.az_service_principal.object_id
   secret_permissions = [
     "Get",
     "Delete",