netapp_enable_cmk_encryption

Signed-off-by: Jeff Owens <[email protected]>

Author: ajeffowens

main.tf

@@ -247,14 +247,18 @@ module "netapp" {
   resource_group_name = local.aks_rg.name
   location            = var.location
   subnet_id           = module.vnet.subnets["netapp"].id
-  network_features    = var.netapp_network_features
+  network_features    = var.netapp_enable_cmk_encryption ? "Standard" : var.netapp_network_features
   service_level       = var.netapp_service_level
   size_in_tb          = var.netapp_size_in_tb
   protocols           = var.netapp_protocols
   volume_path         = "${var.prefix}-${var.netapp_volume_path}"
   tags                = var.tags
   allowed_clients     = concat(module.vnet.subnets["aks"].address_prefixes, module.vnet.subnets["misc"].address_prefixes)
   depends_on          = [module.vnet]
+
+  netapp_enable_cmk_encryption  = var.netapp_enable_cmk_encryption
+  netapp_cmk_encryption_key_id  = var.netapp_cmk_encryption_key_id
+  netapp_cmk_encryption_key_uai = var.netapp_cmk_encryption_key_uai
 }
 
 data "external" "git_hash" {

modules/azurerm_netapp/main.tf

@@ -10,6 +10,22 @@ resource "azurerm_netapp_account" "anf" {
   location            = var.location
   resource_group_name = var.resource_group_name
   tags                = var.tags
+
+  dynamic "identity" {
+    for_each = var.netapp_enable_cmk_encryption ? [1] : []
+    content {
+      type         = "UserAssigned"
+      identity_ids = [var.netapp_cmk_encryption_key_uai]
+    }
+  }
+}
+
+resource "azurerm_netapp_account_encryption" "anf" {
+  count = var.netapp_enable_cmk_encryption ? 1 : 0
+
+  netapp_account_id         = azurerm_netapp_account.anf.id
+  encryption_key            = var.netapp_cmk_encryption_key_id
+  user_assigned_identity_id = var.netapp_cmk_encryption_key_uai
 }
 
 resource "azurerm_netapp_pool" "anf" {
@@ -20,6 +36,10 @@ resource "azurerm_netapp_pool" "anf" {
   service_level       = var.service_level
   size_in_tb          = var.size_in_tb
   tags                = var.tags
+  
+  depends_on = [
+    azurerm_netapp_account_encryption.anf
+  ]
 }
 
 resource "azurerm_netapp_volume" "anf" {
@@ -49,6 +69,8 @@ resource "azurerm_netapp_volume" "anf" {
   }
 
   depends_on = [
-    azurerm_netapp_pool.anf
+    azurerm_netapp_pool.anf,
+    azurerm_netapp_account_encryption.anf
   ]
 }
+

modules/azurerm_netapp/variables.tf

@@ -55,6 +55,24 @@ variable "allowed_clients" {
   default     = ["0.0.0.0/0"]
 }
 
+variable "netapp_enable_cmk_encryption" {
+  description = "Setting this variable to true enables CMK encryption on the netapp account.  Only relevant when storage_type=ha."
+  type        = bool
+  default     = false
+}
+
+variable "netapp_cmk_encryption_key_id" {
+  description = "The ID of the key in keyvault to Encrypt ANF with (i.e. https://<keyvault-name>.vault.azure.net/keys/<key-name>).  Must exist before running terraform.  Only relevant when storage_type=ha.  Required if enable_anf_cmk_encryption is true."
+  type        = string
+  default     = null
+}
+
+variable "netapp_cmk_encryption_key_uai" {
+  description = "The user assigned identity that will be used to access the key (i.e. /subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<uai name>).  Must exist and have Key Vault Crypto Service Encryption User permission on the keyvault before running terraform.  Only relevant when storage_type=ha.  Required if enable_anf_cmk_encryption is true."
+  type        = string
+  default     = null
+}
+
 variable "tags" {
   description = "Map of tags to be placed on the Resources"
   type        = map(any)

variables.tf

@@ -528,6 +528,24 @@ variable "netapp_network_features" {
   }
 }
 
+variable "netapp_enable_cmk_encryption" {
+  description = "Setting this variable to true enables CMK encryption on the netapp account.  Only relevant when storage_type=ha."
+  type        = bool
+  default     = false
+}
+
+variable "netapp_cmk_encryption_key_id" {
+  description = "The ID of the key in keyvault to Encrypt ANF with (i.e. https://<keyvault-name>.vault.azure.net/keys/<key-name>).  Must exist before running terraform.  Only relevant when storage_type=ha.  Required if enable_anf_cmk_encryption is true."
+  type        = string
+  default     = null
+}
+
+variable "netapp_cmk_encryption_key_uai" {
+  description = "The user assigned identity that will be used to access the key (i.e. /subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<uai name>).  Must exist and have Key Vault Crypto Service Encryption User permission on the keyvault before running terraform.  Only relevant when storage_type=ha.  Required if enable_anf_cmk_encryption is true."
+  type        = string
+  default     = null
+}
+
 variable "node_pools_availability_zone" {
   description = "Specifies a Availability Zone in which the Kubernetes Cluster Node Pool should be located."
   type        = string