Feature/aks

.gitignore

@@ -18,6 +18,5 @@ yarn-error.log*
 *.terraform*
 *.tfstate*
 *tfvars*
-
 .terraform.lock.hcl
 .env

modules/AGENTS.md

@@ -55,18 +55,25 @@ aws/
 
 ## Provider Version Strategy
 
-**Pinning Guidelines:**
-- **Use `~>` for stable APIs:** AWS (`~> 5.0`), Azure (`~> 3.116.0`)
-- **Use exact versions for frequent breaking changes:** Google (`6.12.0`)
-- **Review provider versions quarterly** to stay current with security patches
-- **Exception:** Pin to exact versions when a specific feature is required
-
-**Current Latest Versions:**
-- AWS Provider: `~> 5.0`
-- Azure Provider: `~> 3.116.0`
-- Google Provider: `6.12.0` (exact due to API volatility)
-- SAP BTP Provider: `~> 1.8.0`
-- Time Provider: `~> 0.11.1`
+**Provider versions are module-specific, not repository-wide.** Each module should declare the minimum provider version it requires based on testing and feature needs.
+
+**Version Selection Criteria:**
+
+When choosing a provider version for a module, consider:
+
+1. **Feature Requirements** - Does the module need specific APIs/resources from newer versions?
+2. **Testing Validation** - Which version has been tested with this module?
+3. **Breaking Changes** - Are there known breaking changes to avoid?
+4. **Stability** - Prefer versions with `~>` for patch updates unless there's a specific reason
+5. **Backwards Compatibility** - Will this work with existing deployments?
+
+**Version Constraint Best Practices:**
+
+- **Use `~> X.Y.Z`** to allow patch updates (recommended for most cases)
+- **Use exact versions** (`X.Y.Z`) only for providers with frequent breaking changes
+- **Document in the module's README** why a specific version is required
+- **Test against specific versions** - Each module should be validated with the provider version it declares
+- **Review provider versions quarterly** to stay current with security patches and new features
 
 ## Terraform Version Requirements
 
@@ -273,4 +280,4 @@ category: storage
 - [ ] Shared responsibility matrix documented
 - [ ] Cross-provider consistency maintained
 
-This comprehensive guide ensures consistency and quality across all building block modules in the multi-cloud platform.
+This comprehensive guide ensures consistency and quality across all building block modules in the multi-cloud platform.

modules/azure/aks/backplane/README.md

@@ -0,0 +1,53 @@
+# AKS CLuster
+
+This documentation is intended as a reference documentation for cloud foundation or platform engineers using this module.
+
+## Permissions
+
+This is a very simple building block, which means we let the SPN have access to AKS Clusters
+across all subscriptions underneath a management group (typically the top-level management group for landing zones).
+
+<!-- BEGIN_TF_DOCS -->
+## Requirements
+
+| Name | Version |
+|------|---------|
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.3.0 |
+| <a name="requirement_azurerm"></a> [azurerm](#requirement\_azurerm) | ~> 4.36.0 |
+
+## Modules
+
+No modules.
+
+## Resources
+
+| Name | Type |
+|------|------|
+| [azurerm_role_assignment.buildingblock_deploy](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) | resource |
+| [azurerm_role_assignment.buildingblock_deploy_hub](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) | resource |
+| [azurerm_role_definition.buildingblock_deploy](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_definition) | resource |
+| [azurerm_role_definition.buildingblock_deploy_hub](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_definition) | resource |
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| <a name="input_name"></a> [name](#input\_name) | name of the building block, used for naming resources | `string` | `"aks"` | no |
+| <a name="input_principal_ids"></a> [principal\_ids](#input\_principal\_ids) | set of principal ids that will be granted permissions to deploy the building block | `set(string)` | n/a | yes |
+| <a name="input_scope"></a> [scope](#input\_scope) | Scope where the building block should be deployable, typically the parent of all Landing Zones. | `string` | n/a | yes |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| <a name="output_documentation_md"></a> [documentation\_md](#output\_documentation\_md) | Markdown documentation with information about the AKS Building Block building block backplane |
+| <a name="output_hub_role_assignment_ids"></a> [hub\_role\_assignment\_ids](#output\_hub\_role\_assignment\_ids) | The IDs of the hub role assignments for the service principals. |
+| <a name="output_hub_role_assignment_principal_ids"></a> [hub\_role\_assignment\_principal\_ids](#output\_hub\_role\_assignment\_principal\_ids) | The principal IDs of the service principals that have been assigned the hub role. |
+| <a name="output_hub_role_definition_id"></a> [hub\_role\_definition\_id](#output\_hub\_role\_definition\_id) | The ID of the role definition that enables deployment of the building block to the hub. |
+| <a name="output_hub_role_definition_name"></a> [hub\_role\_definition\_name](#output\_hub\_role\_definition\_name) | The name of the role definition that enables deployment of the building block to the hub. |
+| <a name="output_role_assignment_ids"></a> [role\_assignment\_ids](#output\_role\_assignment\_ids) | The IDs of the role assignments for the service principals. |
+| <a name="output_role_assignment_principal_ids"></a> [role\_assignment\_principal\_ids](#output\_role\_assignment\_principal\_ids) | The principal IDs of the service principals that have been assigned the role. |
+| <a name="output_role_definition_id"></a> [role\_definition\_id](#output\_role\_definition\_id) | The ID of the role definition that enables deployment of the building block to subscriptions. |
+| <a name="output_role_definition_name"></a> [role\_definition\_name](#output\_role\_definition\_name) | The name of the role definition that enables deployment of the building block to subscriptions. |
+| <a name="output_scope"></a> [scope](#output\_scope) | The scope where the role definition and role assignments are applied. |
+<!-- END_TF_DOCS -->

modules/azure/aks/backplane/documentation.tf

@@ -0,0 +1,18 @@
+output "documentation_md" {
+  value       = <<EOF
+# AKS Building Block
+
+The Azure AKS Building Block configures a AKS (Kubernetes Service) cluster in the Azure cloud, which can be used to deploy and run containerized applications.
+
+## Automation
+
+We automate the deployment of a AKS Building Block using the common [Azure Building Blocks Automation Infrastructure](../automation.md).
+In order to deploy this building block, this infrastructure receives the following roles.
+
+| Role Name | Description | Permissions |
+|-----------|-------------|-------------|
+| `${azurerm_role_definition.buildingblock_deploy.name}` | ${azurerm_role_definition.buildingblock_deploy.description} | ${join("<br>", formatlist("- `%s`", azurerm_role_definition.buildingblock_deploy.permissions[0].actions))} |
+
+EOF
+  description = "Markdown documentation with information about the AKS Building Block building block backplane"
+}

modules/azure/aks/backplane/main.tf

@@ -0,0 +1,95 @@
+resource "azurerm_role_definition" "buildingblock_deploy" {
+  name        = "${var.name}-deploy"
+  scope       = var.scope
+  description = "Enables deployment of the ${var.name} building block to subscriptions"
+
+  permissions {
+    actions = [
+      "Microsoft.ContainerService/managedClusters/read",
+      "Microsoft.ContainerService/managedClusters/write",
+      "Microsoft.ContainerService/managedClusters/delete",
+      "Microsoft.ContainerService/managedClusters/listClusterAdminCredential/action",
+      "Microsoft.ContainerService/managedClusters/listClusterUserCredential/action",
+      "Microsoft.ContainerService/managedClusters/listClusterMonitoringUserCredential/action",
+      "Microsoft.ContainerService/managedClusters/accessProfiles/listCredential/action",
+      "Microsoft.ContainerService/managedClusters/accessProfiles/read",
+      "Microsoft.ContainerService/managedClusters/agentPools/read",
+      "Microsoft.ContainerService/managedClusters/agentPools/write",
+      "Microsoft.ContainerService/managedClusters/agentPools/delete",
+      "Microsoft.Network/virtualNetworks/read",
+      "Microsoft.Network/virtualNetworks/write",
+      "Microsoft.Network/virtualNetworks/delete",
+      "Microsoft.Network/virtualNetworks/subnets/read",
+      "Microsoft.Network/virtualNetworks/subnets/write",
+      "Microsoft.Network/virtualNetworks/subnets/delete",
+      "Microsoft.Network/virtualNetworks/subnets/join/action",
+      "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/read",
+      "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write",
+      "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/delete",
+      "Microsoft.Network/virtualNetworks/peer/action",
+      "Microsoft.Network/networkInterfaces/read",
+      "Microsoft.Network/networkSecurityGroups/read",
+      "Microsoft.Network/networkSecurityGroups/write",
+      "Microsoft.Network/networkSecurityGroups/delete",
+      "Microsoft.Network/publicIPAddresses/read",
+      "Microsoft.Network/publicIPAddresses/write",
+      "Microsoft.Network/publicIPAddresses/delete",
+      "Microsoft.Network/loadBalancers/read",
+      "Microsoft.Network/loadBalancers/write",
+      "Microsoft.Network/loadBalancers/delete",
+      "Microsoft.Network/privateDnsZones/read",
+      "Microsoft.Network/privateDnsZones/write",
+      "Microsoft.Network/privateDnsZones/delete",
+      "Microsoft.Network/privateDnsZones/virtualNetworkLinks/read",
+      "Microsoft.Network/privateDnsZones/virtualNetworkLinks/write",
+      "Microsoft.Network/privateDnsZones/virtualNetworkLinks/delete",
+      "Microsoft.Resources/deployments/read",
+      "Microsoft.Resources/deployments/write",
+      "Microsoft.Resources/deployments/delete",
+      "Microsoft.Resources/subscriptions/resourceGroups/read",
+      "Microsoft.Resources/subscriptions/resourceGroups/write",
+      "Microsoft.Resources/subscriptions/resourceGroups/delete",
+      "Microsoft.OperationalInsights/workspaces/read",
+      "Microsoft.OperationalInsights/workspaces/write",
+      "Microsoft.OperationalInsights/workspaces/delete",
+      "Microsoft.Insights/diagnosticSettings/read",
+      "Microsoft.Insights/diagnosticSettings/write",
+      "Microsoft.Insights/diagnosticSettings/delete",
+      "Microsoft.Authorization/roleAssignments/read"
+    ]
+  }
+}
+
+resource "azurerm_role_assignment" "buildingblock_deploy" {
+  for_each = var.principal_ids
+
+  role_definition_id = azurerm_role_definition.buildingblock_deploy.role_definition_resource_id
+  principal_id       = each.value
+  scope              = var.scope
+}
+
+resource "azurerm_role_definition" "buildingblock_deploy_hub" {
+  name        = "${var.name}-deploy-hub"
+  description = "Enables deployment of the ${var.name} building block to the hub (for private cluster peering)"
+  scope       = var.scope
+
+  permissions {
+    actions = [
+      "Microsoft.Resources/subscriptions/resourceGroups/read",
+      "Microsoft.Network/virtualNetworks/read",
+      "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/read",
+      "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write",
+      "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/delete",
+      "Microsoft.Network/virtualNetworks/peer/action",
+    ]
+  }
+}
+
+resource "azurerm_role_assignment" "buildingblock_deploy_hub" {
+  for_each = var.principal_ids
+
+  role_definition_id = azurerm_role_definition.buildingblock_deploy_hub.role_definition_resource_id
+  description        = azurerm_role_definition.buildingblock_deploy_hub.description
+  principal_id       = each.value
+  scope              = var.scope
+}

modules/azure/aks/backplane/outputs.tf

@@ -0,0 +1,44 @@
+output "role_definition_id" {
+  value       = azurerm_role_definition.buildingblock_deploy.id
+  description = "The ID of the role definition that enables deployment of the building block to subscriptions."
+}
+
+output "role_definition_name" {
+  value       = azurerm_role_definition.buildingblock_deploy.name
+  description = "The name of the role definition that enables deployment of the building block to subscriptions."
+}
+
+output "role_assignment_ids" {
+  value       = [for id in azurerm_role_assignment.buildingblock_deploy : id.id]
+  description = "The IDs of the role assignments for the service principals."
+}
+
+output "role_assignment_principal_ids" {
+  value       = [for id in azurerm_role_assignment.buildingblock_deploy : id.principal_id]
+  description = "The principal IDs of the service principals that have been assigned the role."
+}
+
+output "scope" {
+  value       = var.scope
+  description = "The scope where the role definition and role assignments are applied."
+}
+
+output "hub_role_definition_id" {
+  value       = azurerm_role_definition.buildingblock_deploy_hub.id
+  description = "The ID of the role definition that enables deployment of the building block to the hub."
+}
+
+output "hub_role_definition_name" {
+  value       = azurerm_role_definition.buildingblock_deploy_hub.name
+  description = "The name of the role definition that enables deployment of the building block to the hub."
+}
+
+output "hub_role_assignment_ids" {
+  value       = { for id in var.principal_ids : id => azurerm_role_assignment.buildingblock_deploy_hub[id].id }
+  description = "The IDs of the hub role assignments for the service principals."
+}
+
+output "hub_role_assignment_principal_ids" {
+  value       = { for id in var.principal_ids : id => azurerm_role_assignment.buildingblock_deploy_hub[id].principal_id }
+  description = "The principal IDs of the service principals that have been assigned the hub role."
+}

modules/azure/aks/backplane/provider.tf

@@ -0,0 +1,3 @@
+provider "azurerm" {
+  features {}
+}

modules/azure/aks/backplane/variables.tf

@@ -0,0 +1,27 @@
+variable "name" {
+  type        = string
+  nullable    = false
+  default     = "aks"
+  description = "name of the building block, used for naming resources"
+  validation {
+    condition     = can(regex("^[-a-z0-9]+$", var.name))
+    error_message = "Only alphanumeric lowercase characters and dashes are allowed"
+  }
+}
+
+variable "principal_ids" {
+  type        = string
+  description = "Object ID of the SCP (Terraform SPN or federated identity)"
+}
+
+variable "scope" {
+  type        = string
+  nullable    = false
+  description = "Scope where the building block should be deployable, typically the parent of all Landing Zones."
+}
+
+variable "principal_ids" {
+  type        = set(string)
+  nullable    = false
+  description = "set of principal ids that will be granted permissions to deploy the building block"
+}

modules/azure/aks/backplane/versions.tf

@@ -0,0 +1,10 @@
+terraform {
+  required_version = ">= 1.3.0"
+
+  required_providers {
+    azurerm = {
+      source  = "hashicorp/azurerm"
+      version = "~> 4.36.0"
+    }
+  }
+}