feat: (IAC-886) Enable FIPS support (#288)

* feat: (IAC-886) Enable FIPS support

* feat: (IAC-924) Update provider Kubernetes version

Author: riragh

Dockerfile

@@ -1,5 +1,5 @@
 ARG TERRAFORM_VERSION=1.0.0
-ARG AZURECLI_VERSION=2.24.2
+ARG AZURECLI_VERSION=2.45.0
 
 FROM hashicorp/terraform:$TERRAFORM_VERSION as terraform
 FROM mcr.microsoft.com/azure-cli:$AZURECLI_VERSION

README.md

@@ -60,7 +60,7 @@ Access to an **Azure Subscription** and an [**Identity**](./docs/user/TerraformA
 - [Terraform](https://www.terraform.io/downloads.html) - v1.0.0
 - [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl) - v1.24
 - [jq](https://stedolan.github.io/jq/) - v1.6
-- [Azure CLI](https://docs.microsoft.com/en-us/cli/azure) - (optional - useful as an alternative to the Azure Portal) - v2.24.2
+- [Azure CLI](https://docs.microsoft.com/en-us/cli/azure) - (optional - useful as an alternative to the Azure Portal) - v2.45.0
 
 #### Docker Requirements:
 - [Docker](https://docs.docker.com/get-docker/)

container-structure-test.yaml

@@ -29,7 +29,7 @@ commandTests:
       - -c
       - |
         az version -o tsv
-    expectedOutput: ["2.24.2\t2.24.2\t1.0.6"]
+    expectedOutput: ["2.45.0\t2.45.0\t1.0.8"]
 
 metadataTest:
   workdir: "/viya4-iac-azure"

iam.tf

@@ -2,13 +2,13 @@
 # SPDX-License-Identifier: Apache-2.0
 
 data "azurerm_user_assigned_identity" "uai" {
-  count               = var.aks_identity == "uai" ? ( var.aks_uai_name == null ? 0 : 1 ) : 0
+  count               = var.aks_identity == "uai" ? (var.aks_uai_name == null ? 0 : 1) : 0
   name                = var.aks_uai_name
   resource_group_name = local.network_rg.name
 }
 
 resource "azurerm_user_assigned_identity" "uai" {
-  count               = var.aks_identity == "uai" ? ( var.aks_uai_name == null ? 1 : 0 ) : 0
+  count               = var.aks_identity == "uai" ? (var.aks_uai_name == null ? 1 : 0) : 0
   name                = "${var.prefix}-aks-identity"
   resource_group_name = local.aks_rg.name
   location            = var.location

locals.tf

@@ -23,9 +23,9 @@ locals {
   kubeconfig_path     = var.iac_tooling == "docker" ? "/workspace/${local.kubeconfig_filename}" : local.kubeconfig_filename
 
   # PostgreSQL
-  default_postgres_configuration = [{name: "max_prepared_transactions", value: 1024}]
-  postgres_servers        = var.postgres_servers == null ? {} : { for k, v in var.postgres_servers : k => merge(var.postgres_server_defaults, v, ) }
-  postgres_firewall_rules = [for addr in local.postgres_public_access_cidrs : { "name" : replace(replace(addr, "/", "_"), ".", "_"), "start_ip" : cidrhost(addr, 0), "end_ip" : cidrhost(addr, abs(pow(2, 32 - split("/", addr)[1]) - 1)) }]
+  default_postgres_configuration = [{ name : "max_prepared_transactions", value : 1024 }]
+  postgres_servers               = var.postgres_servers == null ? {} : { for k, v in var.postgres_servers : k => merge(var.postgres_server_defaults, v, ) }
+  postgres_firewall_rules        = [for addr in local.postgres_public_access_cidrs : { "name" : replace(replace(addr, "/", "_"), ".", "_"), "start_ip" : cidrhost(addr, 0), "end_ip" : cidrhost(addr, abs(pow(2, 32 - split("/", addr)[1]) - 1)) }]
 
   postgres_outputs = length(module.flex_postgresql) != 0 ? { for k, v in module.flex_postgresql :
     k => {

main.tf

@@ -135,6 +135,7 @@ module "aks" {
   aks_cluster_dns_prefix                   = "${var.prefix}-aks"
   aks_cluster_sku_tier                     = var.aks_cluster_sku_tier
   aks_cluster_location                     = var.location
+  fips_enabled                             = var.fips_enabled
   aks_cluster_node_auto_scaling            = var.default_nodepool_min_nodes == var.default_nodepool_max_nodes ? false : true
   aks_cluster_node_count                   = var.default_nodepool_min_nodes
   aks_cluster_min_nodes                    = var.default_nodepool_min_nodes == var.default_nodepool_max_nodes ? null : var.default_nodepool_min_nodes
@@ -189,6 +190,7 @@ module "node_pools" {
   aks_cluster_id = module.aks.cluster_id
   vnet_subnet_id = module.vnet.subnets["aks"].id
   machine_type   = each.value.machine_type
+  fips_enabled   = var.fips_enabled
   os_disk_size   = each.value.os_disk_size
   # TODO: enable with azurerm v2.37.0
   #  os_disk_type                 = each.value.os_disk_type
@@ -223,9 +225,9 @@ module "flex_postgresql" {
   server_version               = each.value.server_version
   firewall_rule_prefix         = "${var.prefix}-${each.key}-postgres-firewall-"
   firewall_rules               = local.postgres_firewall_rules
-  postgresql_configurations    = each.value.ssl_enforcement_enabled ? concat(each.value.postgresql_configurations, local.default_postgres_configuration) : concat(
-    each.value.postgresql_configurations, [{name: "require_secure_transport", value: "OFF"}], local.default_postgres_configuration)
-  tags                         = var.tags
+  postgresql_configurations = each.value.ssl_enforcement_enabled ? concat(each.value.postgresql_configurations, local.default_postgres_configuration) : concat(
+  each.value.postgresql_configurations, [{ name : "require_secure_transport", value : "OFF" }], local.default_postgres_configuration)
+  tags = var.tags
 }
 
 module "netapp" {

modules/aks_node_pool/main.tf

@@ -9,6 +9,7 @@ resource "azurerm_kubernetes_cluster_node_pool" "autoscale_node_pool" {
   kubernetes_cluster_id        = var.aks_cluster_id
   vnet_subnet_id               = var.vnet_subnet_id
   zones                        = var.zones
+  fips_enabled                 = var.fips_enabled
   proximity_placement_group_id = var.proximity_placement_group_id == "" ? null : var.proximity_placement_group_id
   vm_size                      = var.machine_type
   os_disk_size_gb              = var.os_disk_size
@@ -38,6 +39,7 @@ resource "azurerm_kubernetes_cluster_node_pool" "static_node_pool" {
   kubernetes_cluster_id        = var.aks_cluster_id
   vnet_subnet_id               = var.vnet_subnet_id
   zones                        = var.zones
+  fips_enabled                 = var.fips_enabled
   proximity_placement_group_id = var.proximity_placement_group_id == "" ? null : var.proximity_placement_group_id
   vm_size                      = var.machine_type
   os_disk_size_gb              = var.os_disk_size

modules/aks_node_pool/variables.tf

@@ -17,6 +17,12 @@ variable "zones" {
   default     = []
 }
 
+variable "fips_enabled" {
+  description = "Should the nodes in this Node Pool have Federal Information Processing Standard enabled? Changing this forces a new resource to be created."
+  type        = bool
+  default     = false
+}
+
 variable "vnet_subnet_id" {
   description = "The ID of the Subnet where this Node Pool should exist. Changing this forces a new resource to be created."
   type        = string

modules/azure_aks/main.tf

@@ -55,6 +55,7 @@ resource "azurerm_kubernetes_cluster" "aks" {
     enable_node_public_ip = false
     node_labels           = {}
     node_taints           = []
+    fips_enabled          = var.fips_enabled
     max_pods              = var.aks_cluster_max_pods
     os_disk_size_gb       = var.aks_cluster_os_disk_size
     max_count             = var.aks_cluster_max_nodes

modules/azure_aks/variables.tf

@@ -38,6 +38,12 @@ variable "aks_cluster_sku_tier" {
   }
 }
 
+variable "fips_enabled" {
+  description = "Should the nodes in this Node Pool have Federal Information Processing Standard enabled? Changing this forces a new resource to be created."
+  type        = bool
+  default     = false
+}
+
 variable "aks_private_cluster" {
   description = "Enables cluster API endpoint to use Private IP address"
   type        = bool