Merge branch 'main' into kubelet_disk_type_temp

Author: Carus11

CONTRIBUTING.md

@@ -1,19 +1,19 @@
 # How to Contribute
-
-We'd love to accept your patches and contributions to this project. There are
-just a few small guidelines you need to follow.
+We'd love to accept your patches and contributions to this project.
+We just ask that you follow our contribution guidelines when you do.
 
 ## Contributor License Agreement
-
-Contributions to this project must be accompanied by a signed
-[Contributor Agreement](ContributorAgreement.txt).
-You (or your employer) retain the copyright to your contribution,
-this simply gives us permission to use and redistribute your contributions as
-part of the project.
+Contributions to this project must be accompanied by a signed [Contributor Agreement](ContributorAgreement.txt).
+You (or your employer) retain the copyright to your contribution; this simply grants us permission to use and redistribute your contributions as part of the project.
 
 ## Code reviews
+All submissions to this project—including submissions from project members—require review.
+Our review process typically involves performing unit tests, development tests, integration tests, and security scans using internal SAS infrastructure.
+For this reason, we don’t often merge pull requests directly from GitHub.
+
+Instead, we work with submissions internally first, vetting them to ensure they meet our security and quality standards.
+We’ll do our best to work with contributors in public issues and pull requests; however, to ensure our code meets our internal compliance standards, we may need to incorporate your submission into a solution we push ourselves.
 
-All submissions, including submissions by project members, require review. We
-use GitHub pull requests for this purpose. Consult
-[GitHub Help](https://help.github.com/articles/about-pull-requests/) for more
-information on using pull requests.
+This does not mean we don’t value or appreciate your contribution.
+We simply need to review your code internally before merging it.
+We work to ensure all contributors receive appropriate recognition for their contributions, at least by acknowledging them in our release notes.

Dockerfile

@@ -1,18 +1,17 @@
-ARG TERRAFORM_VERSION=1.8.2
-ARG AZURECLI_VERSION=2.59.0
+ARG TERRAFORM_VERSION=1.9.6
+ARG AZURECLI_VERSION=2.64.0
 
 FROM hashicorp/terraform:$TERRAFORM_VERSION as terraform
 FROM mcr.microsoft.com/azure-cli:$AZURECLI_VERSION
-ARG KUBECTL_VERSION=1.28.7
+ARG KUBECTL_VERSION=1.29.7
 
 WORKDIR /viya4-iac-azure
 
 COPY --from=terraform /bin/terraform /bin/terraform
 COPY . .
 
-RUN apk update \
-  && apk upgrade \
-  && apk add --no-cache git openssh curl\
+RUN yum -y install git openssh jq which curl \
+  && yum clean all && rm -rf /var/cache/yum \
   && curl -sLO https://storage.googleapis.com/kubernetes-release/release/v$KUBECTL_VERSION/bin/linux/amd64/kubectl \
   && chmod 755 ./kubectl /viya4-iac-azure/docker-entrypoint.sh \
   && mv ./kubectl /usr/local/bin/kubectl \

README.md

@@ -57,10 +57,10 @@ This project supports two options for running Terraform scripts:
 Access to an **Azure Subscription** and an [**Identity**](./docs/user/TerraformAzureAuthentication.md) with the *Contributor* role are required.
 
 #### Terraform Requirements:
-- [Terraform](https://www.terraform.io/downloads.html) - v1.8.2
-- [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl) - v1.28.7
+- [Terraform](https://www.terraform.io/downloads.html) - v1.9.6
+- [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl) - v1.29.7
 - [jq](https://stedolan.github.io/jq/) - v1.6
-- [Azure CLI](https://docs.microsoft.com/en-us/cli/azure) - (optional - useful as an alternative to the Azure Portal) - v2.59.0
+- [Azure CLI](https://docs.microsoft.com/en-us/cli/azure) - (optional - useful as an alternative to the Azure Portal) - v2.64.0
 
 #### Docker Requirements:
 - [Docker](https://docs.docker.com/get-docker/)

container-structure-test.yaml

@@ -9,15 +9,15 @@ fileExistenceTests:
     shouldExist: true
     permissions: '-rwxr-xr-x'
   - name: 'azure-cli'
-    path: '/usr/local/bin/az'
+    path: '/usr/bin/az'
     shouldExist: true
     permissions: '-rwxr-xr-x'
 
 commandTests:
   - name: "terraform version"
     command: "terraform"
     args: ["--version"]
-    expectedOutput: ["Terraform v1.8.2"]
+    expectedOutput: ["Terraform v1.9.6"]
   - name: "python version"
     command: "python3"
     args: ["--version"]
@@ -29,7 +29,7 @@ commandTests:
       - -c
       - |
         az version -o tsv
-    expectedOutput: ["2.59.0\t2.59.0\t1.1.0"]
+    expectedOutput: ["2.64.0\t2.64.0\t1.1.0"]
 
 metadataTest:
   workdir: "/viya4-iac-azure"

docs/CONFIG-VARS.md

@@ -127,22 +127,22 @@ The default values for the `subnets` variable are as follows:
   aks = {
     "prefixes": ["192.168.0.0/23"],
     "service_endpoints": ["Microsoft.Sql"],
-    "private_endpoint_network_policies_enabled": false,
+    "private_endpoint_network_policies": "Disabled",
     "private_link_service_network_policies_enabled": false,
     "service_delegations": {},
   }
   misc = {
     "prefixes": ["192.168.2.0/24"],
     "service_endpoints": ["Microsoft.Sql"],
-    "private_endpoint_network_policies_enabled": false,
+    "private_endpoint_network_policies": "Disabled",
     "private_link_service_network_policies_enabled": false,
     "service_delegations": {},
   }
   ## If using ha storage then the following is also added
   netapp = {
     "prefixes": ["192.168.3.0/24"],
     "service_endpoints": [],
-    "private_endpoint_network_policies_enabled": false,
+    "private_endpoint_network_policies": "Disabled",
     "private_link_service_network_policies_enabled": false,
     "service_delegations": {
       netapp = {
@@ -197,7 +197,7 @@ Ubuntu 20.04 LTS is the operating system used on the Jump/NFS servers. Ubuntu cr
 | :--- | ---: | ---: | ---: | ---: |
 | partner_id | A GUID that is registered with Microsoft to facilitate partner resource usage attribution | string | "5d27f3ae-e49c-4dea-9aa3-b44e4750cd8c" | Defaults to SAS partner GUID. When you deploy this Terraform configuration, Microsoft can identify the installation of SAS software with the deployed Azure resources. Microsoft can then correlate the resources that are used to support the software. Microsoft collects this information to provide the best experiences with their products and to operate their business. The data is collected and governed by Microsoft's privacy policies, located at https://www.microsoft.com/trustcenter. |
 | create_static_kubeconfig | Allows the user to create a provider / service account-based kubeconfig file | bool | true | A value of `false` will default to using the cloud provider's mechanism for generating the kubeconfig file. A value of `true` will create a static kubeconfig that uses a `Service Account` and `Cluster Role Binding` to provide credentials. |
-| kubernetes_version | The AKS cluster Kubernetes version | string | "1.28" |Use of specific versions is still supported. If you need exact kubernetes version please use format `x.y.z`, where `x` is the major version, `y` is the minor version, and `z` is the patch version |
+| kubernetes_version | The AKS cluster Kubernetes version | string | "1.29" |Use of specific versions is still supported. If you need exact kubernetes version please use format `x.y.z`, where `x` is the major version, `y` is the minor version, and `z` is the patch version |
 | create_jump_vm | Create bastion host | bool | true | |
 | create_jump_public_ip | Add public IP address to the jump VM | bool | true | |
 | enable_jump_public_static_ip | Enables `Static` allocation method for the public IP address of Jump Server. Setting false will enable `Dynamic` allocation method. | bool | true | Only used with `create_jump_public_ip=true` |
@@ -219,7 +219,7 @@ Ubuntu 20.04 LTS is the operating system used on the Jump/NFS servers. Ubuntu cr
 | Name | Description | Type | Default | Notes |
 | :--- | ---: | ---: | ---: | ---: |
 | node_vm_admin | Operating system Admin User for VMs of AKS cluster nodes | string | "azureuser" | |
-| default_nodepool_vm_type | Type of the default node pool VMs | string | "Standard_D8s_v4" | |
+| default_nodepool_vm_type | Type of the default node pool VMs | string | "Standard_E8s_v5" | |
 | default_nodepool_os_disk_size | Disk size for default node pool VMs in GB | number | 128 ||
 | default_nodepool_max_pods | Maximum number of pods that can run on each | number | 110 | Changing this forces a new resource to be created. |
 | default_nodepool_min_nodes | Minimum and initial number of nodes for the default node pool | number | 1 |  Value must be between 0 and 100. Setting min and max node counts the same disables autoscaling. |
@@ -247,7 +247,7 @@ The default values for the `node_pools` variable are as follows:
 ```yaml
 {
   cas = {
-    "machine_type"          = "Standard_E16s_v3"
+    "machine_type"          = "Standard_E16ds_v5"
     "os_disk_size"          = 200
     "min_nodes"             = 0
     "max_nodes"             = 5
@@ -258,7 +258,7 @@ The default values for the `node_pools` variable are as follows:
     }
   },
   compute = {
-    "machine_type"          = "Standard_E16s_v3"
+    "machine_type"          = "Standard_D4ds_v5"
     "os_disk_size"          = 200
     "min_nodes"             = 1
     "max_nodes"             = 5
@@ -270,7 +270,7 @@ The default values for the `node_pools` variable are as follows:
     }
   },
   stateless = {
-    "machine_type"          = "Standard_D16s_v3"
+    "machine_type"          = "Standard_D4s_v5"
     "os_disk_size"          = 200
     "min_nodes"             = 0
     "max_nodes"             = 5
@@ -281,7 +281,7 @@ The default values for the `node_pools` variable are as follows:
     }
   },
   stateful = {
-    "machine_type"          = "Standard_D8s_v3"
+    "machine_type"          = "Standard_D4s_v5"
     "os_disk_size"          = 200
     "min_nodes"             = 0
     "max_nodes"             = 3
@@ -320,10 +320,10 @@ When `storage_type=standard`, a NFS Server VM is created, only when these variab
 | create_nfs_public_ip | Add public ip to the NFS server VM | bool | false | |
 | enable_nfs_public_static_ip | Enables `Static` allocation method for the public IP address of NFS Server. Setting false will enable `Dynamic` allocation method | bool | true | Only used with `create_nfs_public_ip=true` |
 | nfs_vm_admin | OS Admin User for the NFS server VM | string | "nfsuser" | |
-| nfs_vm_machine_type | SKU to use for NFS server VM | string | "Standard_D8s_v4" | To check for valid types for your subscription, run: `az vm list-skus --resource-type virtualMachines --subscription $subscription --location $location -o table`|
+| nfs_vm_machine_type | SKU to use for NFS server VM | string | "Standard_D4s_v5" | To check for valid types for your subscription, run: `az vm list-skus --resource-type virtualMachines --subscription $subscription --location $location -o table`|
 | nfs_vm_zone | Zone in which NFS server VM should be created | string | null | |
 | nfs_raid_disk_type | Managed disk types | string | "Standard_LRS" | Supported values: Standard_LRS, Premium_LRS, StandardSSD_LRS or UltraSSD_LRS. When using `UltraSSD_LRS`, `nfs_vm_zone` and `nfs_raid_disk_zone` must be specified. See the [Azure documentation](https://docs.microsoft.com/en-us/azure/virtual-machines/disks-enable-ultra-ssd) for limitations on Availability Zones and VM types. |
-| nfs_raid_disk_size | Size in Gb for each disk of the RAID5 cluster on the NFS server VM | number | 128 | |
+| nfs_raid_disk_size | Size in Gb for each disk of the RAID5 cluster on the NFS server VM | number | 256 | |
 | nfs_raid_disk_zone | The Availability Zone in which the Managed Disk should be located. Changing this property forces a new resource to be created. | string | null | |
 
 ### Azure NetApp Files (only when `storage_type=ha`)
@@ -368,8 +368,8 @@ Each server element, like `foo = {}`, can contain none, some, or all of the para
 
 | Name | Description | Type | Default | Notes |
 | :--- | ---: | ---: | ---: | ---: |
-| sku_name| The SKU Name for the PostgreSQL Flexible Server | string | "GP_Standard_D16s_v3" | The name pattern is the SKU, followed by the tier + family + cores (e.g. B_Standard_B1ms, GP_Standard_D2s_v3, MO_Standard_E4s_v3).|
-| storage_mb | The max storage allowed for the PostgreSQL Flexible Server | number | 65536 | Possible values are 32768, 65536, 131072, 262144, 524288, 1048576, 2097152, 4194304, 8388608, 16777216, and 33554432. |
+| sku_name| The SKU Name for the PostgreSQL Flexible Server | string | "GP_Standard_D4ds_v5" | The name pattern is the SKU, followed by the tier + family + cores (e.g. B_Standard_B1ms, GP_Standard_D2s_v3, MO_Standard_E4s_v3).|
+| storage_mb | The max storage allowed for the PostgreSQL Flexible Server | number | 131072 | Possible values are 32768, 65536, 131072, 262144, 524288, 1048576, 2097152, 4194304, 8388608, 16777216, and 33554432. |
 | backup_retention_days | Backup retention days for the PostgreSQL Flexible server | number | 7 | Supported values are between 7 and 35 days. |
 | geo_redundant_backup_enabled | Enable Geo-redundant or not for server backup | bool | false | Not supported for the basic tier. |
 | administrator_login | The Administrator Login for the PostgreSQL Flexible Server. Changing this forces a new resource to be created. | string | "pgadmin" | The admin login name cannot be azure_superuser, azure_pg_admin, admin, administrator, root, guest, or public. It cannot start with pg_. See: [Microsoft Quickstart Server Database](https://docs.microsoft.com/en-us/azure/postgresql/flexible-server/quickstart-create-server-portal) |
@@ -395,8 +395,8 @@ postgres_servers = {
       ]
   },
   cds-postgres = {
-    sku_name                     = "GP_Standard_D16s_v3"
-    storage_mb                   = 65536
+    sku_name                     = "GP_Standard_D4ds_v5"
+    storage_mb                   = 131072
     backup_retention_days        = 7
     administrator_login          = "pgadmin"
     administrator_password       = "1tsAB3aut1fulDay"

examples/sample-input-byo.tfvars

@@ -45,14 +45,14 @@ container_registry_sku              = "Standard"
 container_registry_admin_enabled    = false
 
 # AKS config
-kubernetes_version         = "1.28"
+kubernetes_version         = "1.29"
 default_nodepool_min_nodes = 2
-default_nodepool_vm_type   = "Standard_D8s_v4"
+default_nodepool_vm_type   = "Standard_E8s_v5"
 
 # AKS Node Pools config
 node_pools = {
   cas = {
-    "machine_type" = "Standard_E16s_v3"
+    "machine_type" = "Standard_E16ds_v5"
     "os_disk_size" = 200
     "min_nodes"    = 1
     "max_nodes"    = 1
@@ -63,7 +63,7 @@ node_pools = {
     }
   },
   compute = {
-    "machine_type" = "Standard_E16s_v3"
+    "machine_type" = "Standard_D4ds_v5"
     "os_disk_size" = 200
     "min_nodes"    = 1
     "max_nodes"    = 1
@@ -75,21 +75,21 @@ node_pools = {
     }
   },
   stateless = {
-    "machine_type" = "Standard_D16s_v3"
+    "machine_type" = "Standard_D4s_v5"
     "os_disk_size" = 200
     "min_nodes"    = 1
-    "max_nodes"    = 2
+    "max_nodes"    = 4
     "max_pods"     = 110
     "node_taints"  = ["workload.sas.com/class=stateless:NoSchedule"]
     "node_labels" = {
       "workload.sas.com/class" = "stateless"
     }
   },
   stateful = {
-    "machine_type" = "Standard_D8s_v3"
+    "machine_type" = "Standard_D4s_v5"
     "os_disk_size" = 200
     "min_nodes"    = 1
-    "max_nodes"    = 3
+    "max_nodes"    = 2
     "max_pods"     = 110
     "node_taints"  = ["workload.sas.com/class=stateful:NoSchedule"]
     "node_labels" = {
@@ -108,6 +108,6 @@ storage_type = "standard"
 # required ONLY when storage_type is "standard" to create NFS Server VM
 create_nfs_public_ip = false
 nfs_vm_admin         = "nfsuser"
-nfs_vm_machine_type  = "Standard_D8s_v4"
-nfs_raid_disk_size   = 128
+nfs_vm_machine_type  = "Standard_D4s_v5"
+nfs_raid_disk_size   = 256
 nfs_raid_disk_type   = "Standard_LRS"

examples/sample-input-connect.tfvars

@@ -34,14 +34,14 @@ container_registry_sku              = "Standard"
 container_registry_admin_enabled    = false
 
 # AKS config
-kubernetes_version         = "1.28"
+kubernetes_version         = "1.29"
 default_nodepool_min_nodes = 2
-default_nodepool_vm_type   = "Standard_D8s_v4"
+default_nodepool_vm_type   = "Standard_E8s_v5"
 
 # AKS Node Pools config
 node_pools = {
   cas = {
-    "machine_type" = "Standard_E16s_v3"
+    "machine_type" = "Standard_E16ds_v5"
     "os_disk_size" = 200
     "min_nodes"    = 1
     "max_nodes"    = 1
@@ -52,7 +52,7 @@ node_pools = {
     }
   },
   compute = {
-    "machine_type" = "Standard_E16s_v3"
+    "machine_type" = "Standard_D4ds_v5"
     "os_disk_size" = 200
     "min_nodes"    = 1
     "max_nodes"    = 1
@@ -76,21 +76,21 @@ node_pools = {
     }
   },
   stateless = {
-    "machine_type" = "Standard_D16s_v3"
+    "machine_type" = "Standard_D4s_v5"
     "os_disk_size" = 200
     "min_nodes"    = 1
-    "max_nodes"    = 2
+    "max_nodes"    = 4
     "max_pods"     = 110
     "node_taints"  = ["workload.sas.com/class=stateless:NoSchedule"]
     "node_labels" = {
       "workload.sas.com/class" = "stateless"
     }
   },
   stateful = {
-    "machine_type" = "Standard_D8s_v3"
+    "machine_type" = "Standard_D4s_v5"
     "os_disk_size" = 200
     "min_nodes"    = 1
-    "max_nodes"    = 3
+    "max_nodes"    = 2
     "max_pods"     = 110
     "node_taints"  = ["workload.sas.com/class=stateful:NoSchedule"]
     "node_labels" = {
@@ -109,6 +109,6 @@ storage_type = "standard"
 # required ONLY when storage_type is "standard" to create NFS Server VM
 create_nfs_public_ip = false
 nfs_vm_admin         = "nfsuser"
-nfs_vm_machine_type  = "Standard_D8s_v4"
-nfs_raid_disk_size   = 128
+nfs_vm_machine_type  = "Standard_D4s_v5"
+nfs_raid_disk_size   = 256
 nfs_raid_disk_type   = "Standard_LRS"

examples/sample-input-ha.tfvars

@@ -32,14 +32,14 @@ container_registry_sku              = "Standard"
 container_registry_admin_enabled    = false
 
 # AKS config
-kubernetes_version         = "1.28"
+kubernetes_version         = "1.29"
 default_nodepool_min_nodes = 2
-default_nodepool_vm_type   = "Standard_D8s_v4"
+default_nodepool_vm_type   = "Standard_E8s_v5"
 
 # AKS Node Pools config
 node_pools = {
   cas = {
-    "machine_type" = "Standard_E16s_v3"
+    "machine_type" = "Standard_E16ds_v5"
     "os_disk_size" = 200
     "min_nodes"    = 2
     "max_nodes"    = 3
@@ -50,7 +50,7 @@ node_pools = {
     }
   },
   compute = {
-    "machine_type" = "Standard_E16s_v3"
+    "machine_type" = "Standard_D4ds_v5"
     "os_disk_size" = 200
     "min_nodes"    = 2
     "max_nodes"    = 3
@@ -62,18 +62,18 @@ node_pools = {
     }
   },
   stateless = {
-    "machine_type" = "Standard_D16s_v3"
+    "machine_type" = "Standard_D4s_v5"
     "os_disk_size" = 200
     "min_nodes"    = 2
-    "max_nodes"    = 3
+    "max_nodes"    = 4
     "max_pods"     = 110
     "node_taints"  = ["workload.sas.com/class=stateless:NoSchedule"]
     "node_labels" = {
       "workload.sas.com/class" = "stateless"
     }
   },
   stateful = {
-    "machine_type" = "Standard_D8s_v3"
+    "machine_type" = "Standard_D4s_v5"
     "os_disk_size" = 200
     "min_nodes"    = 2
     "max_nodes"    = 3