Skip to content

Commit 2945e61

Browse files
florianowflorianow
committed
feat: adding run first test successfully
feat: adding run first test successfully
1 parent 1920e18 commit 2945e61

File tree

7 files changed

+305
-74
lines changed

7 files changed

+305
-74
lines changed

‎modules/azure/aks/backplane/main.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -119,6 +119,7 @@ resource "azurerm_role_definition" "buildingblock_deploy" {
119119
"Microsoft.OperationalInsights/workspaces/read",
120120
"Microsoft.OperationalInsights/workspaces/write",
121121
"Microsoft.OperationalInsights/workspaces/delete",
122+
"Microsoft.OperationalInsights/workspaces/sharedKeys/action",
122123
"Microsoft.Insights/diagnosticSettings/read",
123124
"Microsoft.Insights/diagnosticSettings/write",
124125
"Microsoft.Insights/diagnosticSettings/delete",

‎modules/azure/aks/buildingblock/README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -231,7 +231,7 @@ No modules.
231231
|------|-------------|------|---------|:--------:|
232232
| <a name="input_aks_admin_group_object_id"></a> [aks\_admin\_group\_object\_id](#input\_aks\_admin\_group\_object\_id) | Object ID of the Azure AD group used for AKS admin access. If null, Azure AD RBAC will not be configured. | `string` | `null` | no |
233233
| <a name="input_aks_cluster_name"></a> [aks\_cluster\_name](#input\_aks\_cluster\_name) | Name of the AKS cluster | `string` | `"prod-aks"` | no |
234-
| <a name="input_allow_gateway_transit_from_hub"></a> [allow\_gateway\_transit\_from\_hub](#input\_allow\_gateway\_transit\_from\_hub) | Allow gateway transit from hub to spoke. Set to true if hub has a gateway and you want spoke to use it. | `bool` | `true` | no |
234+
| <a name="input_allow_gateway_transit_from_hub"></a> [allow\_gateway\_transit\_from\_hub](#input\_allow\_gateway\_transit\_from\_hub) | Allow gateway transit from hub to spoke. Set to true if hub has a gateway and you want spoke to use it. | `bool` | `false` | no |
235235
| <a name="input_dns_prefix"></a> [dns\_prefix](#input\_dns\_prefix) | DNS prefix for the AKS cluster | `string` | `"prodaks"` | no |
236236
| <a name="input_dns_service_ip"></a> [dns\_service\_ip](#input\_dns\_service\_ip) | IP address for Kubernetes DNS service (must be within service\_cidr) | `string` | `"10.0.0.10"` | no |
237237
| <a name="input_enable_auto_scaling"></a> [enable\_auto\_scaling](#input\_enable\_auto\_scaling) | Enable auto-scaling for the default node pool | `bool` | `false` | no |
@@ -257,7 +257,7 @@ No modules.
257257
| <a name="input_subnet_address_prefix"></a> [subnet\_address\_prefix](#input\_subnet\_address\_prefix) | Address prefix for the AKS subnet (only used if subnet\_name is not provided) | `string` | `"10.240.0.0/20"` | no |
258258
| <a name="input_subnet_name"></a> [subnet\_name](#input\_subnet\_name) | Name of the subnet for AKS. If not provided, a new subnet will be created. | `string` | `null` | no |
259259
| <a name="input_tags"></a> [tags](#input\_tags) | Tags to apply to all resources | `map(string)` | `{}` | no |
260-
| <a name="input_vm_size"></a> [vm\_size](#input\_vm\_size) | Size of the virtual machines for the default node pool | `string` | `"Standard_DS3_v2"` | no |
260+
| <a name="input_vm_size"></a> [vm\_size](#input\_vm\_size) | Size of the virtual machines for the default node pool | `string` | `"Standard_A2_v2"` | no |
261261
| <a name="input_vnet_address_space"></a> [vnet\_address\_space](#input\_vnet\_address\_space) | Address space for the AKS virtual network (only used if vnet\_name is not provided) | `string` | `"10.240.0.0/16"` | no |
262262
| <a name="input_vnet_name"></a> [vnet\_name](#input\_vnet\_name) | Name of the virtual network for AKS. If not provided, a new VNet will be created. | `string` | `null` | no |
263263

‎modules/azure/aks/buildingblock/aks.tftest.hcl‎

Lines changed: 214 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -1,51 +1,169 @@
1-
run "valid_aks_configuration" {
2-
command = plan
1+
run "scenario_1_new_vnet_with_hub_peering" {
32

43
variables {
54
subscription_id = "ffb344c9-26d7-45f5-9ba0-806a024ae697"
6-
resource_group_name = "test-aks-rg"
7-
location = "West Europe"
8-
aks_cluster_name = "test-aks-cluster"
9-
dns_prefix = "testaks"
10-
node_count = 3
11-
vm_size = "Standard_DS2_v2"
12-
kubernetes_version = "1.29.2"
5+
aks_cluster_name = "test-aks-hub"
6+
resource_group_name = "test-aks-hub-rg"
7+
location = "Germany West Central"
8+
dns_prefix = "testakshub"
9+
aks_admin_group_object_id = "12345678-1234-1234-1234-123456789012"
10+
log_analytics_workspace_name = "test-law"
11+
12+
private_cluster_enabled = true
13+
private_dns_zone_id = "System"
14+
private_cluster_public_fqdn_enabled = false
15+
16+
vnet_address_space = "10.240.0.0/16"
17+
subnet_address_prefix = "10.240.0.0/20"
18+
19+
hub_subscription_id = "5066eff7-4173-4fea-8c67-268456b4a4f7"
20+
hub_resource_group_name = "likvid-hub-vnet-rg"
21+
hub_vnet_name = "hub-vnet"
22+
}
23+
24+
assert {
25+
condition = azurerm_kubernetes_cluster.aks.private_cluster_enabled == true
26+
error_message = "AKS cluster should be private"
27+
}
28+
29+
assert {
30+
condition = length(azurerm_virtual_network.vnet) == 1
31+
error_message = "VNet should be created when vnet_name is null"
32+
}
33+
34+
assert {
35+
condition = contains(one(azurerm_virtual_network.vnet[*].address_space), "10.240.0.0/16")
36+
error_message = "VNet should have correct address space"
37+
}
38+
39+
assert {
40+
condition = length(azurerm_subnet.aks_subnet) == 1
41+
error_message = "Subnet should be created when subnet_name is null"
42+
}
43+
44+
assert {
45+
condition = length(azurerm_virtual_network_peering.aks_to_hub) == 1
46+
error_message = "Peering to hub should be created when creating new VNet"
47+
}
48+
49+
assert {
50+
condition = length(azurerm_virtual_network_peering.hub_to_aks) == 1
51+
error_message = "Peering from hub should be created when creating new VNet"
52+
}
53+
54+
assert {
55+
condition = one(azurerm_virtual_network_peering.hub_to_aks[*].allow_gateway_transit) == false
56+
error_message = "Hub should not allow gateway transit when not configured"
57+
}
58+
59+
assert {
60+
condition = one(azurerm_virtual_network_peering.aks_to_hub[*].use_remote_gateways) == false
61+
error_message = "AKS VNet should not use remote gateways when not configured"
62+
}
63+
}
64+
65+
run "scenario_2_existing_shared_vnet" {
66+
67+
variables {
68+
subscription_id = "ffb344c9-26d7-45f5-9ba0-806a024ae697"
69+
aks_cluster_name = "test-aks-shared"
70+
resource_group_name = "test-aks-shared-rg"
71+
location = "Germany West Central"
72+
dns_prefix = "testaksshared"
1373
aks_admin_group_object_id = "12345678-1234-1234-1234-123456789012"
14-
vnet_address_space = "10.1.0.0/16"
15-
subnet_address_prefix = "10.1.0.0/20"
16-
service_cidr = "10.2.0.0/16"
17-
dns_service_ip = "10.2.0.10"
1874
log_analytics_workspace_name = "test-law"
75+
76+
private_cluster_enabled = true
77+
private_dns_zone_id = "System"
78+
private_cluster_public_fqdn_enabled = false
79+
80+
vnet_name = "lz102-on-prem-nwk-vnet"
81+
existing_vnet_resource_group_name = "connectivity"
82+
subnet_name = "default"
83+
}
84+
85+
assert {
86+
condition = azurerm_kubernetes_cluster.aks.private_cluster_enabled == true
87+
error_message = "AKS cluster should be private"
1988
}
2089

2190
assert {
22-
condition = azurerm_kubernetes_cluster.aks.name == "test-aks-cluster"
23-
error_message = "AKS cluster name should match the input variable"
91+
condition = length(azurerm_virtual_network.vnet) == 0
92+
error_message = "VNet should NOT be created when vnet_name is provided"
2493
}
2594

2695
assert {
27-
condition = azurerm_kubernetes_cluster.aks.kubernetes_version == "1.29.2"
28-
error_message = "Kubernetes version should match the input variable"
96+
condition = length(azurerm_subnet.aks_subnet) == 0
97+
error_message = "Subnet should NOT be created when subnet_name is provided"
2998
}
3099

31100
assert {
32-
condition = one(azurerm_virtual_network.vnet.address_space) == "10.1.0.0/16"
33-
error_message = "VNet address space should match the input variable"
101+
condition = length(azurerm_virtual_network_peering.aks_to_hub) == 0
102+
error_message = "Peering to hub should NOT be created when using existing VNet"
34103
}
35104

36105
assert {
37-
condition = one(azurerm_subnet.aks_subnet.address_prefixes) == "10.1.0.0/20"
38-
error_message = "Subnet address prefix should match the input variable"
106+
condition = length(azurerm_virtual_network_peering.hub_to_aks) == 0
107+
error_message = "Peering from hub should NOT be created when using existing VNet"
108+
}
109+
110+
assert {
111+
condition = var.existing_vnet_resource_group_name == "connectivity"
112+
error_message = "Should use VNet from different resource group"
113+
}
114+
}
115+
116+
117+
118+
run "scenario_4_public_cluster" {
119+
120+
variables {
121+
subscription_id = "ffb344c9-26d7-45f5-9ba0-806a024ae697"
122+
aks_cluster_name = "test-aks-public"
123+
resource_group_name = "test-aks-public-rg"
124+
location = "Germany West Central"
125+
dns_prefix = "testakspublic"
126+
aks_admin_group_object_id = "12345678-1234-1234-1234-123456789012"
127+
log_analytics_workspace_name = "test-law"
128+
129+
private_cluster_enabled = false
130+
131+
vnet_address_space = "10.240.0.0/16"
132+
subnet_address_prefix = "10.240.0.0/20"
133+
}
134+
135+
assert {
136+
condition = azurerm_kubernetes_cluster.aks.private_cluster_enabled == false
137+
error_message = "AKS cluster should be public"
138+
}
139+
140+
assert {
141+
condition = length(azurerm_virtual_network.vnet) == 1
142+
error_message = "VNet should be created"
143+
}
144+
145+
assert {
146+
condition = length(azurerm_subnet.aks_subnet) == 1
147+
error_message = "Subnet should be created"
148+
}
149+
150+
assert {
151+
condition = length(azurerm_virtual_network_peering.aks_to_hub) == 0
152+
error_message = "Peering should NOT be created for public cluster"
153+
}
154+
155+
assert {
156+
condition = output.oidc_issuer_url != ""
157+
error_message = "OIDC issuer URL should be available"
39158
}
40159
}
41160

42161
run "valid_autoscaling_configuration" {
43-
command = plan
44162

45163
variables {
46164
subscription_id = "ffb344c9-26d7-45f5-9ba0-806a024ae697"
47165
resource_group_name = "test-aks-autoscale-rg"
48-
location = "West Europe"
166+
location = "Germany West Central"
49167
aks_cluster_name = "test-aks-autoscale"
50168
dns_prefix = "testaksautoscale"
51169
aks_admin_group_object_id = "12345678-1234-1234-1234-123456789012"
@@ -66,12 +184,11 @@ run "valid_autoscaling_configuration" {
66184
}
67185

68186
run "no_monitoring_when_law_null" {
69-
command = plan
70187

71188
variables {
72189
subscription_id = "ffb344c9-26d7-45f5-9ba0-806a024ae697"
73190
resource_group_name = "test-aks-no-monitoring-rg"
74-
location = "West Europe"
191+
location = "Germany West Central"
75192
aks_cluster_name = "test-aks-no-monitoring"
76193
dns_prefix = "testaksnomon"
77194
aks_admin_group_object_id = "12345678-1234-1234-1234-123456789012"
@@ -95,7 +212,7 @@ run "invalid_dns_prefix" {
95212
variables {
96213
subscription_id = "ffb344c9-26d7-45f5-9ba0-806a024ae697"
97214
resource_group_name = "test-aks-rg"
98-
location = "West Europe"
215+
location = "Germany West Central"
99216
aks_cluster_name = "test-aks"
100217
dns_prefix = "Invalid_DNS_Prefix!"
101218
aks_admin_group_object_id = "12345678-1234-1234-1234-123456789012"
@@ -112,7 +229,7 @@ run "invalid_kubernetes_version" {
112229
variables {
113230
subscription_id = "ffb344c9-26d7-45f5-9ba0-806a024ae697"
114231
resource_group_name = "test-aks-rg"
115-
location = "West Europe"
232+
location = "Germany West Central"
116233
aks_cluster_name = "test-aks"
117234
dns_prefix = "testaks"
118235
kubernetes_version = "invalid-version"
@@ -130,7 +247,7 @@ run "invalid_admin_group_object_id" {
130247
variables {
131248
subscription_id = "ffb344c9-26d7-45f5-9ba0-806a024ae697"
132249
resource_group_name = "test-aks-rg"
133-
location = "West Europe"
250+
location = "Germany West Central"
134251
aks_cluster_name = "test-aks"
135252
dns_prefix = "testaks"
136253
aks_admin_group_object_id = "not-a-valid-guid"
@@ -147,7 +264,7 @@ run "invalid_node_count_too_low" {
147264
variables {
148265
subscription_id = "ffb344c9-26d7-45f5-9ba0-806a024ae697"
149266
resource_group_name = "test-aks-rg"
150-
location = "West Europe"
267+
location = "Germany West Central"
151268
aks_cluster_name = "test-aks"
152269
dns_prefix = "testaks"
153270
node_count = 0
@@ -165,7 +282,7 @@ run "invalid_os_disk_size" {
165282
variables {
166283
subscription_id = "ffb344c9-26d7-45f5-9ba0-806a024ae697"
167284
resource_group_name = "test-aks-rg"
168-
location = "West Europe"
285+
location = "Germany West Central"
169286
aks_cluster_name = "test-aks"
170287
dns_prefix = "testaks"
171288
os_disk_size_gb = 20
@@ -178,12 +295,11 @@ run "invalid_os_disk_size" {
178295
}
179296

180297
run "custom_network_plugin_kubenet" {
181-
command = plan
182298

183299
variables {
184300
subscription_id = "ffb344c9-26d7-45f5-9ba0-806a024ae697"
185301
resource_group_name = "test-aks-rg"
186-
location = "West Europe"
302+
location = "Germany West Central"
187303
aks_cluster_name = "test-aks-kubenet"
188304
dns_prefix = "testakskube"
189305
network_plugin = "kubenet"
@@ -203,25 +319,24 @@ run "custom_network_plugin_kubenet" {
203319
}
204320

205321
run "naming_derived_from_cluster_name" {
206-
command = plan
207322

208323
variables {
209324
subscription_id = "ffb344c9-26d7-45f5-9ba0-806a024ae697"
210325
resource_group_name = "test-aks-rg"
211-
location = "West Europe"
326+
location = "Germany West Central"
212327
aks_cluster_name = "myapp-prod"
213328
dns_prefix = "myappprod"
214329
aks_admin_group_object_id = "12345678-1234-1234-1234-123456789012"
215330
log_analytics_workspace_name = "test-law"
216331
}
217332

218333
assert {
219-
condition = azurerm_virtual_network.vnet.name == "myapp-prod-vnet"
334+
condition = one(azurerm_virtual_network.vnet[*].name) == "myapp-prod-vnet"
220335
error_message = "VNet name should be derived from cluster name"
221336
}
222337

223338
assert {
224-
condition = azurerm_subnet.aks_subnet.name == "myapp-prod-subnet"
339+
condition = one(azurerm_subnet.aks_subnet[*].name) == "myapp-prod-subnet"
225340
error_message = "Subnet name should be derived from cluster name"
226341
}
227342

@@ -230,3 +345,66 @@ run "naming_derived_from_cluster_name" {
230345
error_message = "Log Analytics Workspace name should be derived from cluster name"
231346
}
232347
}
348+
349+
run "workload_identity_enabled" {
350+
351+
variables {
352+
subscription_id = "ffb344c9-26d7-45f5-9ba0-806a024ae697"
353+
resource_group_name = "test-aks-rg"
354+
location = "Germany West Central"
355+
aks_cluster_name = "test-aks-wi"
356+
dns_prefix = "testakswi"
357+
aks_admin_group_object_id = "12345678-1234-1234-1234-123456789012"
358+
}
359+
360+
assert {
361+
condition = azurerm_kubernetes_cluster.aks.workload_identity_enabled == true
362+
error_message = "Workload Identity should be enabled"
363+
}
364+
365+
assert {
366+
condition = azurerm_kubernetes_cluster.aks.oidc_issuer_enabled == true
367+
error_message = "OIDC issuer should be enabled"
368+
}
369+
370+
assert {
371+
condition = output.oidc_issuer_url != ""
372+
error_message = "OIDC issuer URL should be available"
373+
}
374+
}
375+
376+
run "gateway_transit_configuration" {
377+
command = plan
378+
379+
variables {
380+
subscription_id = "ffb344c9-26d7-45f5-9ba0-806a024ae697"
381+
aks_cluster_name = "test-aks-gateway"
382+
resource_group_name = "test-aks-gateway-rg"
383+
location = "Germany West Central"
384+
dns_prefix = "testaksgateway"
385+
aks_admin_group_object_id = "12345678-1234-1234-1234-123456789012"
386+
log_analytics_workspace_name = "test-law"
387+
388+
private_cluster_enabled = true
389+
private_dns_zone_id = "System"
390+
private_cluster_public_fqdn_enabled = false
391+
392+
vnet_address_space = "10.240.0.0/16"
393+
subnet_address_prefix = "10.240.0.0/20"
394+
395+
hub_subscription_id = "5066eff7-4173-4fea-8c67-268456b4a4f7"
396+
hub_resource_group_name = "likvid-hub-vnet-rg"
397+
hub_vnet_name = "hub-vnet"
398+
allow_gateway_transit_from_hub = false
399+
}
400+
401+
assert {
402+
condition = one(azurerm_virtual_network_peering.hub_to_aks[*].allow_gateway_transit) == false
403+
error_message = "Hub should not allow gateway transit when disabled"
404+
}
405+
406+
assert {
407+
condition = one(azurerm_virtual_network_peering.aks_to_hub[*].use_remote_gateways) == false
408+
error_message = "AKS VNet should not use remote gateways when gateway transit disabled"
409+
}
410+
}

0 commit comments

Comments
 (0)