azurerm_kubernetes_cluster data source doesn't return the vlan when created automatically

[MartinKosicky]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

Is there a way how to retrieve the virtual network for an AKS cluster, that was created in a way, that the AKS created it's vnet automatically? I would like to add firewall network policy that only the AKS nodes can communicate with EventHub, CosmosDB but there doesn't seem to be a way.

New or Affected Resource(s)

• azurerm_kubernetes_cluster

[aristosvo]

I want to give this a try, but I noticed after using both TerraForm and az aks list that the subnet property for the node pools (which I can use to retrieve the VNet) is not exposed, at least not in case of an automatically generated Subnet/VNet.

See also Azure/azure-sdk-for-go#7498 and Azure/azure-rest-api-specs#8494 for the issue I opened.

[aristosvo]

@jluk Can you help me here? This issue (Azure/azure-rest-api-specs#8494, a fix in the AKS REST API) would make it possible to extend the azurerm_kubernetes_cluster resource and solve this issue.

[jluk]

@aristosvo is the ask to have a GET of an agentpool return the subnetid being used?

This should be returned, when I make an az aks show the agentpoolprofile exposes this.

  "agentPoolProfiles": [
    {
      "availabilityZones": null,
      "count": 5,
      "enableAutoScaling": null,
      "enableNodePublicIp": null,
      "maxCount": null,
      "maxPods": 30,
      "minCount": null,
      "name": "nodepool1",
      "nodeLabels": null,
      "nodeTaints": null,
      "orchestratorVersion": "1.15.7",
      "osDiskSizeGb": 100,
      "osType": "Linux",
      "provisioningState": "Succeeded",
      "scaleSetEvictionPolicy": null,
      "scaleSetPriority": null,
      "spotMaxPrice": null,
      "tags": null,
      "type": "VirtualMachineScaleSets",
      "vmSize": "Standard_DS2_v2",
      "vnetSubnetId": "<REMOVED_ID>"
    }

[aristosvo]

@jluk: If I ask for it, az aks show -n aks -g aks-rg, it returns no vnetSubnetId.

"agentPoolProfiles": [
    {
      "availabilityZones": null,
      "count": 1,
      "enableAutoScaling": false,
      "enableNodePublicIp": false,
      "maxCount": null,
      "maxPods": 110,
      "minCount": null,
      "name": "nodepool1",
      "nodeTaints": null,
      "orchestratorVersion": "1.15.7",
      "osDiskSizeGb": 100,
      "osType": "Linux",
      "provisioningState": "Succeeded",
      "scaleSetEvictionPolicy": null,
      "scaleSetPriority": null,
      "type": "AvailabilitySet",
      "vmSize": "Standard_DS2_v2"
    }
  ]

I tried VirtualMachineScaleSets as well, no difference in the results. I even updated the version of the Azure CLI to 2.2.0, still no luck.

[tombuildsstuff]

👋

Based on what I can tell this information should be exposed as a part of fixing #5134 - as such I'm going to close this issue in favour of #5134, where this information should be exposed as a part of that new Data Source. Would you mind subscribing to that issue for updates?

Thanks!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 hashibot-feedback@hashicorp.com. Thanks!