Skip to content

Commit fb89f45

Browse files
florianowflorianow
committed
chore: update module
chore: update module
1 parent 4f33034 commit fb89f45

File tree

10 files changed

+618
-84
lines changed

10 files changed

+618
-84
lines changed

‎modules/AGENTS.md‎

Lines changed: 20 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -55,18 +55,25 @@ aws/
5555

5656
## Provider Version Strategy
5757

58-
**Pinning Guidelines:**
59-
- **Use `~>` for stable APIs:** AWS (`~> 5.0`), Azure (`~> 3.116.0`)
60-
- **Use exact versions for frequent breaking changes:** Google (`6.12.0`)
61-
- **Review provider versions quarterly** to stay current with security patches
62-
- **Exception:** Pin to exact versions when a specific feature is required
63-
64-
**Current Latest Versions:**
65-
- AWS Provider: `~> 5.0`
66-
- Azure Provider: `~> 3.116.0`
67-
- Google Provider: `6.12.0` (exact due to API volatility)
68-
- SAP BTP Provider: `~> 1.8.0`
69-
- Time Provider: `~> 0.11.1`
58+
**Provider versions are module-specific, not repository-wide.** Each module should declare the minimum provider version it requires based on testing and feature needs.
59+
60+
**Version Selection Criteria:**
61+
62+
When choosing a provider version for a module, consider:
63+
64+
1. **Feature Requirements** - Does the module need specific APIs/resources from newer versions?
65+
2. **Testing Validation** - Which version has been tested with this module?
66+
3. **Breaking Changes** - Are there known breaking changes to avoid?
67+
4. **Stability** - Prefer versions with `~>` for patch updates unless there's a specific reason
68+
5. **Backwards Compatibility** - Will this work with existing deployments?
69+
70+
**Version Constraint Best Practices:**
71+
72+
- **Use `~> X.Y.Z`** to allow patch updates (recommended for most cases)
73+
- **Use exact versions** (`X.Y.Z`) only for providers with frequent breaking changes
74+
- **Document in the module's README** why a specific version is required
75+
- **Test against specific versions** - Each module should be validated with the provider version it declares
76+
- **Review provider versions quarterly** to stay current with security patches and new features
7077

7178
## Terraform Version Requirements
7279

@@ -226,4 +233,4 @@ category: storage
226233
- [ ] Shared responsibility matrix documented
227234
- [ ] Cross-provider consistency maintained
228235

229-
This comprehensive guide ensures consistency and quality across all building block modules in the multi-cloud platform.
236+
This comprehensive guide ensures consistency and quality across all building block modules in the multi-cloud platform.

‎modules/azure/aks/backplane/README.md‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,8 @@ across all subscriptions underneath a management group (typically the top-level
1212

1313
| Name | Version |
1414
|------|---------|
15-
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.5.0 |
16-
| <a name="requirement_azurerm"></a> [azurerm](#requirement\_azurerm) | 4.36.0 |
15+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.3.0 |
16+
| <a name="requirement_azurerm"></a> [azurerm](#requirement\_azurerm) | ~> 4.36.0 |
1717

1818
## Modules
1919

@@ -23,8 +23,8 @@ No modules.
2323

2424
| Name | Type |
2525
|------|------|
26-
| [azurerm_role_assignment.buildingblock_deploy](https://registry.terraform.io/providers/hashicorp/azurerm/4.36.0/docs/resources/role_assignment) | resource |
27-
| [azurerm_role_definition.buildingblock_deploy](https://registry.terraform.io/providers/hashicorp/azurerm/4.36.0/docs/resources/role_definition) | resource |
26+
| [azurerm_role_assignment.buildingblock_deploy](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) | resource |
27+
| [azurerm_role_definition.buildingblock_deploy](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_definition) | resource |
2828

2929
## Inputs
3030

‎modules/azure/aks/backplane/main.tf‎

Lines changed: 39 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -5,15 +5,46 @@ resource "azurerm_role_definition" "buildingblock_deploy" {
55

66
permissions {
77
actions = [
8-
"Microsoft.ContainerService/managedClusters/*",
9-
"Microsoft.ContainerService/managedClusters/accessProfiles/*",
10-
"Microsoft.Network/virtualNetworks/*",
8+
"Microsoft.ContainerService/managedClusters/read",
9+
"Microsoft.ContainerService/managedClusters/write",
10+
"Microsoft.ContainerService/managedClusters/delete",
11+
"Microsoft.ContainerService/managedClusters/listClusterAdminCredential/action",
12+
"Microsoft.ContainerService/managedClusters/listClusterUserCredential/action",
13+
"Microsoft.ContainerService/managedClusters/listClusterMonitoringUserCredential/action",
14+
"Microsoft.ContainerService/managedClusters/accessProfiles/listCredential/action",
15+
"Microsoft.ContainerService/managedClusters/accessProfiles/read",
16+
"Microsoft.ContainerService/managedClusters/agentPools/read",
17+
"Microsoft.ContainerService/managedClusters/agentPools/write",
18+
"Microsoft.ContainerService/managedClusters/agentPools/delete",
19+
"Microsoft.Network/virtualNetworks/read",
20+
"Microsoft.Network/virtualNetworks/write",
21+
"Microsoft.Network/virtualNetworks/delete",
22+
"Microsoft.Network/virtualNetworks/subnets/read",
23+
"Microsoft.Network/virtualNetworks/subnets/write",
24+
"Microsoft.Network/virtualNetworks/subnets/delete",
25+
"Microsoft.Network/virtualNetworks/subnets/join/action",
1126
"Microsoft.Network/networkInterfaces/read",
12-
"Microsoft.Network/networkSecurityGroups/*",
13-
"Microsoft.Resources/deployments/*",
14-
"Microsoft.Resources/subscriptions/resourceGroups/*",
15-
"Microsoft.OperationalInsights/*",
16-
"Microsoft.Insights/diagnosticSettings/*",
27+
"Microsoft.Network/networkSecurityGroups/read",
28+
"Microsoft.Network/networkSecurityGroups/write",
29+
"Microsoft.Network/networkSecurityGroups/delete",
30+
"Microsoft.Network/publicIPAddresses/read",
31+
"Microsoft.Network/publicIPAddresses/write",
32+
"Microsoft.Network/publicIPAddresses/delete",
33+
"Microsoft.Network/loadBalancers/read",
34+
"Microsoft.Network/loadBalancers/write",
35+
"Microsoft.Network/loadBalancers/delete",
36+
"Microsoft.Resources/deployments/read",
37+
"Microsoft.Resources/deployments/write",
38+
"Microsoft.Resources/deployments/delete",
39+
"Microsoft.Resources/subscriptions/resourceGroups/read",
40+
"Microsoft.Resources/subscriptions/resourceGroups/write",
41+
"Microsoft.Resources/subscriptions/resourceGroups/delete",
42+
"Microsoft.OperationalInsights/workspaces/read",
43+
"Microsoft.OperationalInsights/workspaces/write",
44+
"Microsoft.OperationalInsights/workspaces/delete",
45+
"Microsoft.Insights/diagnosticSettings/read",
46+
"Microsoft.Insights/diagnosticSettings/write",
47+
"Microsoft.Insights/diagnosticSettings/delete",
1748
"Microsoft.Authorization/roleAssignments/read"
1849
]
1950
}

‎modules/azure/aks/backplane/versions.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
terraform {
2-
required_version = ">= 1.5.0"
2+
required_version = ">= 1.3.0"
33

44
required_providers {
55
azurerm = {
66
source = "hashicorp/azurerm"
7-
version = "4.36.0" # oder aktuelle getestete Version
7+
version = "~> 4.36.0"
88
}
99
}
1010
}

‎modules/azure/aks/buildingblock/APP_TEAM_README.md‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
# Azure Kubernetes Service (AKS)
2+
3+
## Description
4+
This building block provides a production-grade Azure Kubernetes Service (AKS) cluster with integrated security, monitoring, and networking features. It delivers a fully managed Kubernetes environment with Azure AD authentication, workload identity support, and comprehensive observability through Log Analytics.
5+
6+
## Usage Motivation
7+
This building block is for application teams that need to deploy containerized applications on a secure, scalable, and managed Kubernetes platform. The AKS cluster comes pre-configured with enterprise-grade security features, eliminating the operational complexity of managing Kubernetes infrastructure while maintaining the flexibility to run any containerized workload.
8+
9+
## 🚀 Usage Examples
10+
- A development team deploys microservices-based applications using Kubernetes deployments, services, and ingress controllers.
11+
- A data engineering team runs distributed data processing workloads using Kubernetes jobs and cron jobs.
12+
- An operations team manages multi-tenant applications with namespace isolation and resource quotas.
13+
- A DevOps team implements GitOps-based continuous deployment pipelines targeting the AKS cluster.
14+
15+
## 🔄 Shared Responsibility
16+
17+
| Responsibility | Platform Team | Application Team |
18+
|----------------|--------------|-----------------|
19+
| Provisioning and configuring the AKS cluster | ✅ | ❌ |
20+
| Managing cluster upgrades and patches | ✅ | ❌ |
21+
| Configuring Azure AD authentication and RBAC | ✅ | ❌ |
22+
| Setting up Log Analytics and monitoring infrastructure | ✅ | ❌ |
23+
| Managing virtual network and subnet configuration | ✅ | ❌ |
24+
| Deploying and managing applications and workloads | ❌ | ✅ |
25+
| Configuring application-level resource limits and quotas | ❌ | ✅ |
26+
| Managing Kubernetes namespaces and RBAC within the cluster | ❌ | ✅ |
27+
| Monitoring application performance and logs | ❌ | ✅ |
28+
| Implementing application security policies (Network Policies, Pod Security) | ❌ | ✅ |
29+
30+
## 💡 Best Practices for Secure and Efficient AKS Usage
31+
32+
### Security
33+
- **Use Workload Identity**: Leverage Azure AD Workload Identity for secure authentication to Azure resources without storing credentials
34+
- **Implement Network Policies**: Define Kubernetes Network Policies to control pod-to-pod communication
35+
- **Enable Pod Security Standards**: Apply Kubernetes Pod Security Standards to enforce security best practices
36+
- **Use Azure Key Vault**: Store secrets in Azure Key Vault and inject them into pods using CSI Secret Store driver
37+
- **Scan container images**: Regularly scan container images for vulnerabilities before deployment
38+
39+
### Performance & Scalability
40+
- **Set resource requests and limits**: Always define CPU and memory requests/limits for predictable scheduling and resource management
41+
- **Use Horizontal Pod Autoscaler (HPA)**: Implement HPA to automatically scale applications based on metrics
42+
- **Optimize container images**: Use multi-stage builds and minimal base images to reduce image size and startup time
43+
- **Implement health probes**: Configure liveness and readiness probes for reliable application health monitoring
44+
45+
### Operations & Monitoring
46+
- **Use structured logging**: Implement structured logging (JSON) for better log analysis in Log Analytics
47+
- **Monitor cluster metrics**: Regularly review cluster metrics in Azure Monitor for capacity planning
48+
- **Implement GitOps**: Use GitOps tools like Flux or ArgoCD for declarative application deployment
49+
- **Tag resources**: Use labels and annotations consistently for resource organization and cost allocation
50+
51+
### Networking
52+
- **Use Ingress controllers**: Deploy an Ingress controller for HTTP/HTTPS routing instead of multiple LoadBalancer services
53+
- **Implement egress control**: Use Azure Firewall or Network Security Groups to control outbound traffic
54+
- **Enable service mesh**: Consider using a service mesh (like Istio or Linkerd) for advanced traffic management and observability
55+
56+
## Cluster Features
57+
58+
### Authentication & Authorization
59+
- **Azure AD Integration**: Cluster uses Azure AD for authentication, enabling centralized identity management
60+
- **OIDC Issuer**: Workload Identity enabled for secure pod-to-Azure-resource authentication
61+
62+
### Monitoring & Logging
63+
- **Log Analytics Workspace**: Centralized logging for cluster and application logs
64+
- **Container Insights**: Integrated monitoring for container performance and health
65+
- **Diagnostic Settings**: Cluster metrics and logs forwarded to Log Analytics
66+
67+
### Networking
68+
- **Custom VNet**: Dedicated virtual network and subnet for cluster isolation
69+
- **Azure CNI**: Advanced networking capabilities with pod-level networking
70+
71+
### Auto-Scaling
72+
- **Cluster Autoscaler**: Automatically adjusts node count based on resource requirements
73+
- **System Node Pool**: Dedicated node pool for system workloads with auto-scaling enabled
74+
75+
## Getting Started
76+
77+
1. **Access the cluster**: Use `az aks get-credentials` to configure kubectl access
78+
2. **Verify connectivity**: Run `kubectl get nodes` to confirm cluster connectivity
79+
3. **Deploy your application**: Use `kubectl apply` or Helm to deploy applications
80+
4. **Monitor your workloads**: View logs and metrics in Azure Monitor or Log Analytics

0 commit comments

Comments
 (0)