Azure RBAC feature toggle for AKS

[aristosvo]

Fixes #8535

Acceptance Tests

• Existing RBAC tests succeed:

--- PASS: TestAccKubernetesCluster_roleBasedAccessControl (584.95s)
--- PASS: TestAccKubernetesCluster_roleBasedAccessControlAADManaged (613.16s)
--- PASS: TestAccKubernetesCluster_roleBasedAccessControlAAD (668.37s)
--- PASS: TestAccKubernetesCluster_roleBasedAccessControlAADUpdateToManaged (754.84s)
--- PASS: TestAccKubernetesCluster_roleBasedAccessControlAADManagedChange (881.14s)
PASS

• Specific test is passing after enabling Preview Feature

# Test fails without registering for the Preview Feature
❯ TF_ACC=1 go test -v ./azurerm/internal/services/containers/ -run=TestAccKubernetesCluster_roleBasedAccessControlAzure -timeout 180m -ldflags="-X=github.com/terraform-providers/terraform-provider-azurerm/version.ProviderVersion=acc"
=== RUN   TestAccKubernetesCluster_roleBasedAccessControlAzure
=== PAUSE TestAccKubernetesCluster_roleBasedAccessControlAzure
=== CONT  TestAccKubernetesCluster_roleBasedAccessControlAzure
    testing.go:684: Step 0 error: errors during apply:
        
        Error: creating Managed Kubernetes Cluster "acctestaks210202221714650343" (Resource Group "acctestRG-aks-210202221714650343"): containerservice.ManagedClustersClient#CreateOrUpdate: Failure sending request: StatusCode=400 -- Original Error: Code="BadRequest" Message="aadProfile.enableAzureRBAC requires Microsoft.ContainerService/EnableAzureRBACPreview feature flag."
   
--- FAIL: TestAccKubernetesCluster_roleBasedAccessControlAzure (79.42s)
❯ az feature register --namespace "Microsoft.ContainerService" --name "EnableAzureRBACPreview"
❯ az feature list -o table --query "[?contains(name, 'Microsoft.ContainerService/EnableAzureRBACPreview')].{Name:name,State:properties.state}"

# Wait until "Registered"
❯ az provider register --namespace Microsoft.ContainerService
❯ TF_ACC=1 go test -v ./azurerm/internal/services/containers/ -run=TestAccKubernetesCluster_roleBasedAccessControlAzure -timeout 180m -ldflags="-X=github.com/terraform-providers/terraform-provider-azurerm/version.ProviderVersion=acc"
=== RUN   TestAccKubernetesCluster_roleBasedAccessControlAzure
=== PAUSE TestAccKubernetesCluster_roleBasedAccessControlAzure
=== CONT  TestAccKubernetesCluster_roleBasedAccessControlAzure
--- PASS: TestAccKubernetesCluster_roleBasedAccessControlAzure (615.32s)
PASS
ok      github.com/terraform-providers/terraform-provider-azurerm/azurerm/internal/services/containers      616.643s

[aristosvo]

@tombuildsstuff Is there a reason we don't want to merge this one?

[katbyte]

Thanks @aristosvo - aside from one comment this looks good

[katbyte]

Thanks @aristosvo - LGTM 👍

[ghost]

This has been released in version 2.57.0 of the provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading. As an example:

provider "azurerm" {
    version = "~> 2.57.0"
}
# ... other configuration ...

[harripaalanen]

Azure RBAC is now GA (Azure/AKS#1786). If I set azure_rbac_enabled=true is it able to update the existing AKS resource or is new resource creation forced?

[aristosvo]

Azure RBAC is now GA (Azure/AKS#1786). If I set azure_rbac_enabled=true is it able to update the existing AKS resource or is new resource creation forced?

New resource creation is forced currently, based on the docs this should be updated as after GA this is not necessary anymore

[aristosvo]

@harripaalanen FYI I checked whether I could loosen up that requirement, but it requires a Preview feature to be enabled:

updating Managed Kubernetes Cluster "acctestaks210526225032917802" (Resource Group "acctestRG-aks-210526225032917802"): containerservice.ManagedClustersClient#CreateOrUpdate: Failure sending request: StatusCode=0 
--
Original Error: Code="BadRequest" Message="aadProfile.enableAzureRBAC requires Microsoft.ContainerService/UpdateAzureRBACPreview feature flag."

For the time being I won't change it and keep an eye on it in the mean time.

[harripaalanen]

@aristosvo I think they fixed it. It should't require the preview feature anymore.

[aristosvo]

@harripaalanen Fixed in #12029

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active contributions.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.