nullplatform · gdrojas · Aug 14, 2026 · Aug 13, 2026 · Aug 13, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## [6.13.0](https://github.com/nullplatform/tofu-modules/compare/v6.12.0...v6.13.0) (2026-08-13)
+
+
+### Features
+
+* **aks:** support disabling local accounts with an Entra ID authorization path ([#461](https://github.com/nullplatform/tofu-modules/issues/461)) ([3e3c412](https://github.com/nullplatform/tofu-modules/commit/3e3c412b5a996241da6a904f9e86b3faf51c6487))
+
 ## [6.12.0](https://github.com/nullplatform/tofu-modules/compare/v6.11.3...v6.12.0) (2026-08-12)
 
 

diff --git a/infrastructure/aws/acm/README.md b/infrastructure/aws/acm/README.md
@@ -18,7 +18,7 @@ The module creates an aws_acm_certificate resource with DNS validation, which is
 
 ```hcl
 module "acm" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/acm?ref=v6.12.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/acm?ref=v6.13.0"
 
   domain_name = "your-domain-name"
   zone_id     = "your-zone-id"

diff --git a/infrastructure/aws/aws_load_balancer_controller/README.md b/infrastructure/aws/aws_load_balancer_controller/README.md
@@ -18,7 +18,7 @@ This module creates a helm_release resource to deploy the AWS Load Balancer Cont
 
 ```hcl
 module "aws_load_balancer_controller" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/aws_load_balancer_controller?ref=v6.12.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/aws_load_balancer_controller?ref=v6.13.0"
 
   cluster_name = "your-cluster-name"
   vpc_id       = "your-vpc-id"

diff --git a/infrastructure/aws/backend/README.md b/infrastructure/aws/backend/README.md
@@ -20,7 +20,7 @@ This module creates an S3 bucket with versioning and server-side encryption enab
 
 ```hcl
 module "backend" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/backend?ref=v6.12.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/backend?ref=v6.13.0"
 }
 ```
 

diff --git a/infrastructure/aws/dns/README.md b/infrastructure/aws/dns/README.md
@@ -21,7 +21,7 @@ The module conditionally creates an aws_route53_zone resource for a public hoste
 
 ```hcl
 module "dns" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/dns?ref=v6.12.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/dns?ref=v6.13.0"
 
   domain_name = "your-domain-name"
   vpc_id      = "your-vpc-id"

diff --git a/infrastructure/aws/eks/README.md b/infrastructure/aws/eks/README.md
@@ -22,7 +22,7 @@ The module wraps terraform-aws-modules/eks to create the EKS cluster (aws_eks_cl
 
 ```hcl
 module "eks" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/eks?ref=v6.12.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/eks?ref=v6.13.0"
 
   aws_subnets_private_ids = "your-aws-subnets-private-ids"
   aws_vpc_vpc_id          = "your-aws-vpc-vpc-id"

diff --git a/infrastructure/aws/iam/agent/README.md b/infrastructure/aws/iam/agent/README.md
@@ -21,7 +21,7 @@ The module uses the terraform-aws-modules/iam//modules/iam-role-for-service-acco
 
 ```hcl
 module "agent" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/agent?ref=v6.12.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/agent?ref=v6.13.0"
 
   agent_namespace                     = "your-agent-namespace"
   aws_iam_openid_connect_provider_arn = "your-aws-iam-openid-connect-provider-arn"

diff --git a/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md b/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md
@@ -19,7 +19,7 @@ This module creates an IAM role for the AWS Load Balancer Controller using the t
 
 ```hcl
 module "aws_load_balancer_controller_iam" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/aws_load_balancer_controller_iam?ref=v6.12.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/aws_load_balancer_controller_iam?ref=v6.13.0"
 
   aws_iam_openid_connect_provider_arn = "your-aws-iam-openid-connect-provider-arn"
   cluster_name                        = "your-cluster-name"

diff --git a/infrastructure/aws/iam/cert_manager/README.md b/infrastructure/aws/iam/cert_manager/README.md
@@ -20,7 +20,7 @@ An aws_iam_policy resource is always created granting route53:GetChange, route53
 
 ```hcl
 module "cert_manager" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cert_manager?ref=v6.12.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cert_manager?ref=v6.13.0"
 
   cluster_name = "your-cluster-name"
 }

diff --git a/infrastructure/aws/iam/ci-build-workflow-user/README.md b/infrastructure/aws/iam/ci-build-workflow-user/README.md
@@ -21,7 +21,7 @@ The module creates an aws_iam_user named with the cluster_name prefix and genera
 
 ```hcl
 module "ci-build-workflow-user" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ci-build-workflow-user?ref=v6.12.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ci-build-workflow-user?ref=v6.13.0"
 
   cluster_name = "your-cluster-name"
 }

diff --git a/infrastructure/aws/iam/cloudwatch/README.md b/infrastructure/aws/iam/cloudwatch/README.md
@@ -20,7 +20,7 @@ The module creates an aws_iam_policy granting CloudWatch Logs and Metrics write
 
 ```hcl
 module "cloudwatch" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cloudwatch?ref=v6.12.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cloudwatch?ref=v6.13.0"
 
   cluster_name = "your-cluster-name"
 }

diff --git a/infrastructure/aws/iam/ecr/README.md b/infrastructure/aws/iam/ecr/README.md
@@ -20,7 +20,7 @@ The module creates an aws_iam_role named nullplatform-{cluster_name}-application
 
 ```hcl
 module "ecr" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ecr?ref=v6.12.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ecr?ref=v6.13.0"
 
   build_workflow_group_name = "your-build-workflow-group-name"
   cluster_name              = "your-cluster-name"

diff --git a/infrastructure/aws/iam/external_dns/README.md b/infrastructure/aws/iam/external_dns/README.md
@@ -20,7 +20,7 @@ An aws_iam_policy resource named nullplatform_external_dns_policy is always crea
 
 ```hcl
 module "external_dns" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/external_dns?ref=v6.12.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/external_dns?ref=v6.13.0"
 
   cluster_name = "your-cluster-name"
 }

diff --git a/infrastructure/aws/iam/s3/README.md b/infrastructure/aws/iam/s3/README.md
@@ -18,7 +18,7 @@ The module creates an aws_iam_policy resource that allows s3:PutObject and s3:Ge
 
 ```hcl
 module "s3" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/s3?ref=v6.12.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/s3?ref=v6.13.0"
 
   bucket                    = "your-bucket"
   build_workflow_group_name = "your-build-workflow-group-name"

diff --git a/infrastructure/aws/ingress/README.md b/infrastructure/aws/ingress/README.md
@@ -22,7 +22,7 @@ The module creates up to two kubernetes_ingress_v1 resources — one for an inte
 
 ```hcl
 module "ingress" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/ingress?ref=v6.12.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/ingress?ref=v6.13.0"
 
   certificate_arn = "your-certificate-arn"
 }

diff --git a/infrastructure/aws/security/README.md b/infrastructure/aws/security/README.md
@@ -22,7 +22,7 @@ The module uses data sources (aws_eks_cluster, aws_vpc) to automatically derive
 
 ```hcl
 module "security" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/security?ref=v6.12.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/security?ref=v6.13.0"
 
   cluster_name = "your-cluster-name"
 }

diff --git a/infrastructure/aws/vpc/README.md b/infrastructure/aws/vpc/README.md
@@ -22,7 +22,7 @@ This module creates a terraform-aws-modules/vpc/aws module resource with DNS hos
 
 ```hcl
 module "vpc" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/vpc?ref=v6.12.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/vpc?ref=v6.13.0"
 
   account      = "your-account"
   organization = "your-organization"

diff --git a/infrastructure/azure/acr/README.md b/infrastructure/azure/acr/README.md
@@ -18,7 +18,7 @@ The module uses the azurerm_container_registry resource to create the container
 
 ```hcl
 module "acr" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/acr?ref=v6.12.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/acr?ref=v6.13.0"
 
   containerregistry_name = "your-containerregistry-name"
   location               = "your-location"

diff --git a/infrastructure/azure/aks/README.md b/infrastructure/azure/aks/README.md
@@ -2,28 +2,27 @@
 
 ## Description
 
-Deploys an Azure Kubernetes Service (AKS) cluster with configurable system and user node pools, workload identity, OIDC issuer, and optional ACR integration using the Azure/aks/azurerm upstream module
+Deploys an Azure Kubernetes Service (AKS) cluster using the Azure/aks/azurerm module with system and user node pools, OIDC/workload identity, Azure RBAC integration, and optional ACR attachment
 
 ## Architecture
 
-The module wraps the Azure/aks/azurerm community module (version 11.0.0) and feeds all input variables into it, creating an AKS cluster with a system node pool and a separate autoscaling user node pool both attached to the provided vnet_subnet_id. It retrieves the current Azure client config via azurerm_client_config to wire the tenant_id into AAD RBAC settings and enables workload_identity and oidc_issuer on the cluster. Network Contributor role assignments are applied to the node subnet and any additional subnets supplied via additional_network_contributor_subnet_ids, and an optional AcrPull role binding is conditionally created on the supplied ACR when acr_id is provided.
+The module wraps the Azure/aks/azurerm community module (version 11.0.0) and uses a data source (azurerm_client_config) to retrieve the current tenant ID for AAD RBAC configuration. It provisions a system node pool via the module's top-level agents_* arguments and a separate user node pool via the node_pools map, both attached to the provided vnet_subnet_id with Network Contributor role assignments handled internally. OIDC issuer and workload identity are unconditionally enabled, and ACR attachment is controlled by a conditional attached_acr_id_map derived from the attach_acr and acr_id variables. Outputs expose cluster credentials, OIDC issuer URL, and node resource group for downstream consumption.
 
 ## Features
 
-- Creates AKS cluster with RBAC, AAD integration, OIDC issuer, and workload identity enabled
-- Supports disabling local admin accounts, guarded by a precondition that requires an Entra ID authorization path
-- Configures a fixed system node pool with configurable VM size, node count, and availability zones
-- Deploys an autoscaling user node pool with configurable min/max counts and availability zone spread
-- Grants Network Contributor role on the node subnet and any additional load-balancer subnets to the cluster identity
-- Optionally attaches an Azure Container Registry by granting AcrPull role to the cluster identity
-- Exposes cluster credentials and OIDC issuer URL as outputs for downstream Kubernetes provider configuration
-- Supports private cluster mode and API server authorized IP range restrictions
+- Creates an AKS cluster with a dedicated system node pool and an autoscaling user node pool in the specified VNet subnet
+- Enables OIDC issuer and workload identity unconditionally for Kubernetes service account federation
+- Configures Azure RBAC and Entra ID admin group integration for cluster authorization
+- Assigns Network Contributor role to node subnet and any additional subnets required for internal load balancers
+- Attaches an Azure Container Registry with AcrPull role when acr_id is provided
+- Supports availability zone spread for both system and user node pools via configurable zone variables
+- Exposes cluster CA certificate, client credentials, and OIDC issuer URL as sensitive outputs
 
 ## Basic Usage
 
 ```hcl
 module "aks" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks?ref=v6.12.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks?ref=v6.13.0"
 
   cluster_name        = "your-cluster-name"
   location            = "your-location"
@@ -33,47 +32,6 @@ module "aks" {
 }
 ```
 
-## Hardened Access
-
-Local admin accounts are certificate-based and bypass Entra ID, so security baselines often require
-them off. Disabling them removes the only credential that works without Entra ID, which means an
-authorization path has to be configured in the same change — the module enforces this with a
-precondition rather than letting the cluster become unreachable.
-
-```hcl
-module "aks" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks?ref=v6.12.0"
-
-  cluster_name        = "your-cluster-name"
-  location            = "your-location"
-  resource_group_name = "your-resource-group-name"
-  subscription_id     = "your-subscription-id"
-  vnet_subnet_id      = "your-vnet-subnet-id"
-
-  local_account_disabled = true
-  azure_rbac_enabled     = true # grant access with Azure role assignments
-  # admin_group_object_ids = ["<entra-id-group-object-id>"] # or keep authorization in Kubernetes RBAC
-}
-```
-
-With `azure_rbac_enabled = true`, cluster access is granted outside this module with Azure role
-assignments such as `Azure Kubernetes Service RBAC Cluster Admin`. Consumers reaching the API server
-from Terraform must also authenticate through Entra ID, since the `admin_*` outputs are empty once
-local accounts are disabled:
-
-```hcl
-provider "kubernetes" {
-  host                   = module.aks.host
-  cluster_ca_certificate = base64decode(module.aks.cluster_ca_certificate)
-
-  exec {
-    api_version = "client.authentication.k8s.io/v1beta1"
-    command     = "kubelogin"
-    args        = ["get-token", "--login", "azurecli", "--server-id", "6dae42f8-4368-4678-94ff-3960e28e3630"]
-  }
-}
-```
-
 ## Using Outputs
 
 ```hcl
@@ -158,17 +116,16 @@ resource "example_resource" "this" {
 <!-- BEGIN_AI_METADATA
 {
   "name": "aks",
-  "description": "Deploys an Azure Kubernetes Service (AKS) cluster with configurable system and user node pools, workload identity, OIDC issuer, and optional ACR integration using the Azure/aks/azurerm upstream module",
-  "architecture": "The module wraps the Azure/aks/azurerm community module (version 11.0.0) and feeds all input variables into it, creating an AKS cluster with a system node pool and a separate autoscaling user node pool both attached to the provided vnet_subnet_id. It retrieves the current Azure client config via azurerm_client_config to wire the tenant_id into AAD RBAC settings and enables workload_identity and oidc_issuer on the cluster. Network Contributor role assignments are applied to the node subnet and any additional subnets supplied via additional_network_contributor_subnet_ids, and an optional AcrPull role binding is conditionally created on the supplied ACR when acr_id is provided.",
+  "description": "Deploys an Azure Kubernetes Service (AKS) cluster using the Azure/aks/azurerm module with system and user node pools, OIDC/workload identity, Azure RBAC integration, and optional ACR attachment",
+  "architecture": "The module wraps the Azure/aks/azurerm community module (version 11.0.0) and uses a data source (azurerm_client_config) to retrieve the current tenant ID for AAD RBAC configuration. It provisions a system node pool via the module's top-level agents_* arguments and a separate user node pool via the node_pools map, both attached to the provided vnet_subnet_id with Network Contributor role assignments handled internally. OIDC issuer and workload identity are unconditionally enabled, and ACR attachment is controlled by a conditional attached_acr_id_map derived from the attach_acr and acr_id variables. Outputs expose cluster credentials, OIDC issuer URL, and node resource group for downstream consumption.",
   "features": [
-    "Creates AKS cluster with RBAC, AAD integration, OIDC issuer, and workload identity enabled",
-    "Supports disabling local admin accounts, guarded by a precondition that requires an Entra ID authorization path",
-    "Configures a fixed system node pool with configurable VM size, node count, and availability zones",
-    "Deploys an autoscaling user node pool with configurable min/max counts and availability zone spread",
-    "Grants Network Contributor role on the node subnet and any additional load-balancer subnets to the cluster identity",
-    "Optionally attaches an Azure Container Registry by granting AcrPull role to the cluster identity",
-    "Exposes cluster credentials and OIDC issuer URL as outputs for downstream Kubernetes provider configuration",
-    "Supports private cluster mode and API server authorized IP range restrictions"
+    "Creates an AKS cluster with a dedicated system node pool and an autoscaling user node pool in the specified VNet subnet",
+    "Enables OIDC issuer and workload identity unconditionally for Kubernetes service account federation",
+    "Configures Azure RBAC and Entra ID admin group integration for cluster authorization",
+    "Assigns Network Contributor role to node subnet and any additional subnets required for internal load balancers",
+    "Attaches an Azure Container Registry with AcrPull role when acr_id is provided",
+    "Supports availability zone spread for both system and user node pools via configurable zone variables",
+    "Exposes cluster CA certificate, client credentials, and OIDC issuer URL as sensitive outputs"
   ],
   "inputs": [
     {
@@ -304,6 +261,6 @@ resource "example_resource" "this" {
     "oidc_issuer_url",
     "node_resource_group"
   ],
-  "hash": "eecb9a7cb8471fcdabab22199c6e4b4a"
+  "hash": "6bc75daa678ed4082a51b6723427f95a"
 }
 END_AI_METADATA -->
diff --git a/infrastructure/azure/aks_route_table/README.md b/infrastructure/azure/aks_route_table/README.md
@@ -19,7 +19,7 @@ The module uses an azurerm_resources data source to discover the AKS-managed rou
 
 ```hcl
 module "aks_route_table" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks_route_table?ref=v6.12.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks_route_table?ref=v6.13.0"
 
   node_resource_group = "your-node-resource-group"
   subnet_id           = "your-subnet-id"

diff --git a/infrastructure/azure/dns/README.md b/infrastructure/azure/dns/README.md
@@ -18,7 +18,7 @@ This module creates an azurerm_dns_zone resource and configures it with the prov
 
 ```hcl
 module "dns" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/dns?ref=v6.12.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/dns?ref=v6.13.0"
 
   domain_name         = "your-domain-name"
   resource_group_name = "your-resource-group-name"

diff --git a/infrastructure/azure/iam/README.md b/infrastructure/azure/iam/README.md
@@ -21,7 +21,7 @@ The module creates an azurerm_user_assigned_identity resource in the specified r
 
 ```hcl
 module "iam" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/iam?ref=v6.12.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/iam?ref=v6.13.0"
 
   location             = "your-location"
   name                 = "your-name"

diff --git a/infrastructure/azure/private_dns/README.md b/infrastructure/azure/private_dns/README.md
@@ -18,7 +18,7 @@ This module creates an azurerm_private_dns_zone resource and optionally multiple
 
 ```hcl
 module "private_dns" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/private_dns?ref=v6.12.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/private_dns?ref=v6.13.0"
 
   domain_name           = "your-domain-name"
   resource_group_name   = "your-resource-group-name"

diff --git a/infrastructure/azure/resource_group/README.md b/infrastructure/azure/resource_group/README.md
@@ -18,7 +18,7 @@ This module creates an azurerm_resource_group resource and outputs its name and
 
 ```hcl
 module "resource_group" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/resource_group?ref=v6.12.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/resource_group?ref=v6.13.0"
 
   location            = "your-location"
   resource_group_name = "your-resource-group-name"

diff --git a/infrastructure/azure/security/README.md b/infrastructure/azure/security/README.md
@@ -21,7 +21,7 @@ The module uses azurerm_kubernetes_cluster and azurerm_virtual_network data sour
 
 ```hcl
 module "security" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/security?ref=v6.12.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/security?ref=v6.13.0"
 
   cluster_name        = "your-cluster-name"
   resource_group_name = "your-resource-group-name"

diff --git a/infrastructure/azure/vnet/README.md b/infrastructure/azure/vnet/README.md
@@ -18,7 +18,7 @@ This module creates an Azure virtual network using the azurerm provider and conf
 
 ```hcl
 module "vnet" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/vnet?ref=v6.12.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/vnet?ref=v6.13.0"
 
   address_space       = "your-address-space"
   location            = "your-location"
-Original file line number
+Diff line change
@@ Expand Up @@
     ```hcl
     module "backend" {
-      source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/backend?ref=v6.12.0"
+      source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/backend?ref=v6.13.0"
     }
     ```
@@ Expand Down @@