Skip to content

Commit d20ef07

Browse files
riraghriragh
authored
Merge pull request #342 from sassoftware/staging
8.3.0 - October 19, 2023
2 parents a3290c0 + 05cda42 commit d20ef07

File tree

9 files changed

+177
-57
lines changed

9 files changed

+177
-57
lines changed

‎docs/CONFIG-VARS.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -193,6 +193,7 @@ Ubuntu 20.04 LTS is the operating system used on the Jump/NFS servers. Ubuntu cr
193193
| aks_identity | Use UserAssignedIdentity or Service Principal as [AKS identity](https://docs.microsoft.com/en-us/azure/aks/concepts-identity) | string | "uai" | A value of `uai` wil create a Managed Identity based on the permissions of the authenticated user or use [`AKS_UAI_NAME`](#use-existing), if set. A value of `sp` will use values from [`CLIENT_ID`/`CLIENT_SECRET`](#azure-authentication), if set. |
194194
| ssh_public_key | File name of public ssh key for jump and nfs VM | string | "~/.ssh/id_rsa.pub" | Required with `create_jump_vm=true` or `storage_type=standard` |
195195
| cluster_api_mode | Public or private IP for the cluster api | string | "public" | Valid Values: "public", "private" |
196+
| aks_cluster_private_dns_zone_id | Specifies private DNS zone resource ID for AKS private cluster to use | string | "" | For `cluster_api_mode=private` if `aks_cluster_private_dns_zone_id` is not specified then the value `System` is used else it is set to null. For details see [Configure a private DNS zone](https://learn.microsoft.com/en-us/azure/aks/private-clusters?tabs=azure-portal#configure-a-private-dns-zone) |
196197
| aks_cluster_sku_tier | Optimizes api server for cost vs availability | string | "Free" | Valid Values: "Free", "Standard" |
197198

198199
## Node Pools
@@ -359,7 +360,7 @@ Each server element, like `foo = {}`, can contain none, some, or all of the para
359360
| administrator_password | The Password associated with the administrator_login for the PostgreSQL Flexible Server | string | "my$up3rS3cretPassw0rd" | The password must contain between 8 and 128 characters and must contain characters from three of the following categories: English uppercase letters, English lowercase letters, numbers (0 through 9), and non-alphanumeric characters (!, $, #, %, etc.). |
360361
| server_version | The version of the PostgreSQL Flexible server instance | string | "13" | Refer to the [SAS Viya Platform Administration Guide](https://go.documentation.sas.com/doc/en/sasadmincdc/default/itopssr/p05lfgkwib3zxbn1t6nyihexp12n.htm?fromDefault=#p1wq8ouke3c6ixn1la636df9oa1u) for the supported versions of PostgreSQL for the SAS Viya platform. |
361362
| ssl_enforcement_enabled | Enforce SSL on connection to the Azure Database for PostgreSQL Flexible server instance | bool | true | |
362-
| connectivity_method | Network connectivity option to connect to your flexible server. There are two connectivity options available: Public access (allowed IP addresses) and Private access (VNet Integration). Defaults to public access with firewall rules enabled.| string | "public" | Valid options are `public` and `private`. See details [here](https://learn.microsoft.com/en-us/azure/postgresql/flexible-server/concepts-networking) |
363+
| connectivity_method | Network connectivity option to connect to your flexible server. There are two connectivity options available: Public access (allowed IP addresses) and Private access (VNet Integration). Defaults to public access with firewall rules enabled.| string | "public" | Valid options are `public` and `private`. See sample input file [here](../examples/sample-input-postgres.tfvars) and Private access documentation [here](./user/PostgreSQLPrivateAccess.md). For more details see [Networking overview](https://learn.microsoft.com/en-us/azure/postgresql/flexible-server/concepts-networking) |
363364
| postgresql_configurations | Sets a PostgreSQL Configuration value on a Azure PostgreSQL Flexible Server | list(object) | [] | More details can be found [here](https://docs.microsoft.com/en-us/azure/postgresql/flexible-server/howto-configure-server-parameters-using-cli) |
364365

365366
Multiple SAS offerings require a second PostgreSQL instance referred to as SAS Common Data Store, or CDS PostgreSQL. For more information, see [Common Customizations](https://go.documentation.sas.com/?cdcId=itopscdc&cdcVersion=default&docsetId=dplyml0phy0dkr&docsetTarget=n08u2yg8tdkb4jn18u8zsi6yfv3d.htm#p0wkxxi9s38zbzn19ukjjaxsc0kl). A list of SAS offerings that require CDS PostgreSQL is provided in [SAS Common Data Store Requirements](https://go.documentation.sas.com/?cdcId=itopscdc&cdcVersion=default&docsetId=itopssr&docsetTarget=p05lfgkwib3zxbn1t6nyihexp12n.htm#n03wzanutmc6gon1val5fykas9aa). To create and configure an external CDS PostgreSQL instance in addition to the external platform PostgreSQL instance named `default`, specify `cds-postgres` as a second PostgreSQL instance, as shown in the example below.

‎docs/user/PostgreSQLPrivateAccess.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ In this document, we will focus on PostgreSQL server with Private access (VNet I
99

1010
You can deploy a flexible server into your Azure virtual network (VNet). Azure virtual networks provide private and secure network communication. Resources in a virtual network can communicate through private IP addresses that were assigned on this network. In Private access, the connections to the PostgreSQL server are restricted to only within your virtual network. To learn more about it, refer to [Private access (VNet Integration)](https://learn.microsoft.com/en-us/azure/postgresql/flexible-server/concepts-networking#private-access-vnet-integration).
1111

12-
To create PostgreSQL Flexible Server with the private access connectivity method use the example file provided [here](../../examples/sample-input-ppg.tfvars).
12+
To create PostgreSQL Flexible Server with the private access connectivity method use the example file provided [here](../../examples/sample-input-postgres.tfvars).
1313

1414
# Connect Azure Database for PostgreSQL Flexible Server with the private access connectivity method
1515

‎examples/sample-input-postgres.tfvars‎

Lines changed: 154 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,154 @@
1+
# !NOTE! - These are only a subset of CONFIG-VARS.md provided as examples.
2+
# Customize this file to add any variables from 'CONFIG-VARS.md' whose default
3+
# values you want to change.
4+
5+
# **************** REQUIRED VARIABLES ****************
6+
# Values for these required variables MUST be provided
7+
prefix = "<prefix-value>" # this is a prefix that you assign for the resources to be created
8+
location = "<azure-location-value>" # e.g., "eastus2"
9+
# **************** REQUIRED VARIABLES ****************
10+
11+
# !NOTE! - Without specifying your CIDR block access rules, ingress traffic
12+
# to your cluster will be blocked by default.
13+
14+
# ************** RECOMMENDED VARIABLES ***************
15+
default_public_access_cidrs = [] # e.g., ["123.45.6.89/32"]
16+
ssh_public_key = "~/.ssh/id_rsa.pub"
17+
# ************** RECOMMENDED VARIABLES ***************
18+
19+
# Tags can be specified matching your tagging strategy.
20+
tags = {} # for example: { "owner|email" = "<you>@<domain>.<com>", "key1" = "value1", "key2" = "value2" }
21+
22+
# PostgreSQL
23+
24+
# Postgres config - By having this entry a database server is created.
25+
# Default networking option: Public access (allowed IP addresses) is enabled
26+
# If you do not need an external database server remove the 'postgres_servers'
27+
# block below.
28+
postgres_servers = {
29+
default = {},
30+
}
31+
32+
# To use Private access (VNet Integration) remove the 'postgres_servers' block above and uncomment the blocks below:
33+
# postgres_servers and subnets
34+
35+
# postgres_servers = {
36+
# default = {
37+
# connectivity_method = "private"
38+
# }
39+
# }
40+
#
41+
# # Subnet for PostgreSQL
42+
# subnets = {
43+
# aks = {
44+
# "prefixes" : ["192.168.0.0/23"],
45+
# "service_endpoints" : ["Microsoft.Sql"],
46+
# "private_endpoint_network_policies_enabled" : true,
47+
# "private_link_service_network_policies_enabled" : false,
48+
# "service_delegations" : {},
49+
# }
50+
# misc = {
51+
# "prefixes" : ["192.168.2.0/24"],
52+
# "service_endpoints" : ["Microsoft.Sql"],
53+
# "private_endpoint_network_policies_enabled" : true,
54+
# "private_link_service_network_policies_enabled" : false,
55+
# "service_delegations" : {},
56+
# }
57+
# netapp = {
58+
# "prefixes" : ["192.168.3.0/24"],
59+
# "service_endpoints" : [],
60+
# "private_endpoint_network_policies_enabled" : false,
61+
# "private_link_service_network_policies_enabled" : false,
62+
# "service_delegations" : {
63+
# netapp = {
64+
# "name" : "Microsoft.Netapp/volumes"
65+
# "actions" : ["Microsoft.Network/networkinterfaces/*", "Microsoft.Network/virtualNetworks/subnets/join/action"]
66+
# }
67+
# }
68+
# }
69+
# postgresql = {
70+
# "prefixes": ["192.168.4.0/24"],
71+
# "service_endpoints": ["Microsoft.Sql"],
72+
# "private_endpoint_network_policies_enabled": true,
73+
# "private_link_service_network_policies_enabled": false,
74+
# "service_delegations": {
75+
# flexpostgres = {
76+
# "name" : "Microsoft.DBforPostgreSQL/flexibleServers"
77+
# "actions" : ["Microsoft.Network/virtualNetworks/subnets/join/action"]
78+
# }
79+
# }
80+
# }
81+
# }
82+
83+
# Azure Container Registry config
84+
create_container_registry = false
85+
container_registry_sku = "Standard"
86+
container_registry_admin_enabled = false
87+
88+
# AKS config
89+
kubernetes_version = "1.26"
90+
default_nodepool_min_nodes = 2
91+
default_nodepool_vm_type = "Standard_D8s_v4"
92+
93+
# AKS Node Pools config
94+
node_pools = {
95+
cas = {
96+
"machine_type" = "Standard_E16s_v3"
97+
"os_disk_size" = 200
98+
"min_nodes" = 1
99+
"max_nodes" = 1
100+
"max_pods" = 110
101+
"node_taints" = ["workload.sas.com/class=cas:NoSchedule"]
102+
"node_labels" = {
103+
"workload.sas.com/class" = "cas"
104+
}
105+
},
106+
compute = {
107+
"machine_type" = "Standard_E16s_v3"
108+
"os_disk_size" = 200
109+
"min_nodes" = 1
110+
"max_nodes" = 1
111+
"max_pods" = 110
112+
"node_taints" = ["workload.sas.com/class=compute:NoSchedule"]
113+
"node_labels" = {
114+
"workload.sas.com/class" = "compute"
115+
"launcher.sas.com/prepullImage" = "sas-programming-environment"
116+
}
117+
},
118+
stateless = {
119+
"machine_type" = "Standard_D16s_v3"
120+
"os_disk_size" = 200
121+
"min_nodes" = 1
122+
"max_nodes" = 2
123+
"max_pods" = 110
124+
"node_taints" = ["workload.sas.com/class=stateless:NoSchedule"]
125+
"node_labels" = {
126+
"workload.sas.com/class" = "stateless"
127+
}
128+
},
129+
stateful = {
130+
"machine_type" = "Standard_D8s_v3"
131+
"os_disk_size" = 200
132+
"min_nodes" = 1
133+
"max_nodes" = 3
134+
"max_pods" = 110
135+
"node_taints" = ["workload.sas.com/class=stateful:NoSchedule"]
136+
"node_labels" = {
137+
"workload.sas.com/class" = "stateful"
138+
}
139+
}
140+
}
141+
142+
# Jump Server
143+
create_jump_public_ip = true
144+
jump_vm_admin = "jumpuser"
145+
jump_vm_machine_type = "Standard_B2s"
146+
147+
# Storage for SAS Viya CAS/Compute
148+
storage_type = "standard"
149+
# required ONLY when storage_type is "standard" to create NFS Server VM
150+
create_nfs_public_ip = false
151+
nfs_vm_admin = "nfsuser"
152+
nfs_vm_machine_type = "Standard_D8s_v4"
153+
nfs_raid_disk_size = 128
154+
nfs_raid_disk_type = "Standard_LRS"

‎examples/sample-input-ppg.tfvars‎

Lines changed: 0 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,6 @@ ssh_public_key = "~/.ssh/id_rsa.pub"
1919
# Tags can be specified matching your tagging strategy.
2020
tags = {} # for example: { "owner|email" = "<you>@<domain>.<com>", "key1" = "value1", "key2" = "value2" }
2121

22-
# PostgreSQL
23-
2422
# Postgres config - By having this entry a database server is created.
2523
# Default networking option: Public access (allowed IP addresses) is enabled
2624
# If you do not need an external database server remove the 'postgres_servers'
@@ -29,57 +27,6 @@ postgres_servers = {
2927
default = {},
3028
}
3129

32-
# To use Private access (VNet Integration) remove the 'postgres_servers' block above and uncomment the blocks below:
33-
# postgres_servers and subnets
34-
35-
# postgres_servers = {
36-
# default = {
37-
# connectivity_method = "private"
38-
# }
39-
# }
40-
#
41-
# # Subnet for PostgreSQL
42-
# subnets = {
43-
# aks = {
44-
# "prefixes" : ["192.168.0.0/23"],
45-
# "service_endpoints" : ["Microsoft.Sql"],
46-
# "private_endpoint_network_policies_enabled" : true,
47-
# "private_link_service_network_policies_enabled" : false,
48-
# "service_delegations" : {},
49-
# }
50-
# misc = {
51-
# "prefixes" : ["192.168.2.0/24"],
52-
# "service_endpoints" : ["Microsoft.Sql"],
53-
# "private_endpoint_network_policies_enabled" : true,
54-
# "private_link_service_network_policies_enabled" : false,
55-
# "service_delegations" : {},
56-
# }
57-
# netapp = {
58-
# "prefixes" : ["192.168.3.0/24"],
59-
# "service_endpoints" : [],
60-
# "private_endpoint_network_policies_enabled" : false,
61-
# "private_link_service_network_policies_enabled" : false,
62-
# "service_delegations" : {
63-
# netapp = {
64-
# "name" : "Microsoft.Netapp/volumes"
65-
# "actions" : ["Microsoft.Network/networkinterfaces/*", "Microsoft.Network/virtualNetworks/subnets/join/action"]
66-
# }
67-
# }
68-
# }
69-
# postgresql = {
70-
# "prefixes": ["192.168.4.0/24"],
71-
# "service_endpoints": ["Microsoft.Sql"],
72-
# "private_endpoint_network_policies_enabled": true,
73-
# "private_link_service_network_policies_enabled": false,
74-
# "service_delegations": {
75-
# flexpostgres = {
76-
# "name" : "Microsoft.DBforPostgreSQL/flexibleServers"
77-
# "actions" : ["Microsoft.Network/virtualNetworks/subnets/join/action"]
78-
# }
79-
# }
80-
# }
81-
# }
82-
8330
# Azure Container Registry config
8431
create_container_registry = false
8532
container_registry_sku = "Standard"

‎main.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -145,6 +145,7 @@ module "aks" {
145145
aks_cluster_node_vm_size = var.default_nodepool_vm_type
146146
aks_cluster_node_admin = var.node_vm_admin
147147
aks_cluster_ssh_public_key = try(file(var.ssh_public_key), "")
148+
aks_cluster_private_dns_zone_id = var.aks_cluster_private_dns_zone_id
148149
aks_vnet_subnet_id = module.vnet.subnets["aks"].id
149150
kubernetes_version = var.kubernetes_version
150151
aks_cluster_endpoint_public_access_cidrs = var.cluster_api_mode == "private" ? [] : local.cluster_endpoint_public_access_cidrs # "Private cluster cannot be enabled with AuthorizedIPRanges.""

‎modules/azure_aks/main.tf‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,9 @@ resource "azurerm_kubernetes_cluster" "aks" {
66
name = var.aks_cluster_name
77
location = var.aks_cluster_location
88
resource_group_name = var.aks_cluster_rg
9-
dns_prefix = var.aks_cluster_dns_prefix
9+
dns_prefix = var.aks_private_cluster == false || var.aks_cluster_private_dns_zone_id == "" ? var.aks_cluster_dns_prefix : null
10+
dns_prefix_private_cluster = var.aks_private_cluster && var.aks_cluster_private_dns_zone_id != "" ? var.aks_cluster_dns_prefix : null
11+
1012
sku_tier = var.aks_cluster_sku_tier
1113
role_based_access_control_enabled = true
1214
http_application_routing_enabled = false
@@ -16,7 +18,7 @@ resource "azurerm_kubernetes_cluster" "aks" {
1618
kubernetes_version = var.kubernetes_version
1719
api_server_authorized_ip_ranges = var.aks_cluster_endpoint_public_access_cidrs
1820
private_cluster_enabled = var.aks_private_cluster
19-
private_dns_zone_id = var.aks_private_cluster ? "System" : null
21+
private_dns_zone_id = var.aks_private_cluster && var.aks_cluster_private_dns_zone_id != "" ? var.aks_cluster_private_dns_zone_id : (var.aks_private_cluster ? "System" : null)
2022

2123
network_profile {
2224
network_plugin = var.aks_network_plugin

‎modules/azure_aks/variables.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -223,3 +223,8 @@ variable "cluster_egress_type" {
223223
type = string
224224
default = "loadBalancer"
225225
}
226+
227+
variable "aks_cluster_private_dns_zone_id" {
228+
type = string
229+
default = ""
230+
}

‎outputs.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,10 @@ output "aks_cluster_password" {
2626
sensitive = true
2727
}
2828

29+
output "aks_pod_cidr" {
30+
value = var.aks_pod_cidr
31+
}
32+
2933
# postgres
3034

3135
output "postgres_servers" {

‎variables.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -754,6 +754,12 @@ variable "aks_identity" {
754754
}
755755
}
756756

757+
variable "aks_cluster_private_dns_zone_id" {
758+
description = "Specify private DNS zone resource ID for AKS private cluster to use."
759+
type = string
760+
default = ""
761+
}
762+
757763
## Message Broker - Azure Service Bus - Experimental
758764
variable "create_azure_message_broker" {
759765
description = "Allows user to create a fully managed enterprise message broker: Azure Service Bus"

0 commit comments

Comments
 (0)