Container Service Api server authorized ip ranges

[fraserdarwent]

Updated the container service SDK version, made necessary changes for compatibility and added additional field from SDK

Fixes #3262

[katbyte]

Hi @fraserdarwent,

Thank you for the PR, there are a couple things that stand out:

• you have updated the container test, but only added the property to AKS, did you mean to add it to both?
• you are not reading the property back in on read, could we add that in?

[tombuildsstuff]

hey @fraserdarwent

Thanks for pushing those changes - this now LGTM 👍

[tombuildsstuff]

hey @fraserdarwent

Running the tests for those I noticed this should be a TypeSet rather than a TypeMap (since a Map is a Dictionary/key-value pair); as such I'm going to push these changes; I hope you don't mind!

Thanks!

dismissing since changes have been pushed

[katbyte]

@fraserdarwent,

This is ready to merge, however we are having a hard time getting the tests to pass:

------- Stdout: -------
=== RUN   TestAccAzureRMKubernetesCluster_apiServerAuthorizedIPRanges
=== PAUSE TestAccAzureRMKubernetesCluster_apiServerAuthorizedIPRanges
=== CONT  TestAccAzureRMKubernetesCluster_apiServerAuthorizedIPRanges
--- FAIL: TestAccAzureRMKubernetesCluster_apiServerAuthorizedIPRanges (69.26s)
    testing.go:568: Step 0 error: errors during apply:
        
        Error: Error creating/updating Managed Kubernetes Cluster "acctestaks190429172120205848" (Resource Group "acctestRG-190429172120205848"): containerservice.ManagedClustersClient#CreateOrUpdate: Failure sending request: StatusCode=400 -- Original Error: Code="BadRequest" Message="APIServer Authorized IP Ranges is not allowed since feature \"Microsoft.ContainerService/APIServerSecurityPreview\" is not enabled."

However checking from cloudshell:

PS Azure:\> Get-AzureRmProviderFeature

FeatureName                                  ProviderName               RegistrationState
-----------                                  ------------               -----------------
APIServerSecurityPreview                     Microsoft.ContainerService Registered
...

Is there anything else we need to do on our end to enable the feature?

[jlpedrosa]

@fraserdarwent, @katbyte

This is ready to merge, however we are having a hard time getting the tests to pass:

------- Stdout: -------
=== RUN   TestAccAzureRMKubernetesCluster_apiServerAuthorizedIPRanges
=== PAUSE TestAccAzureRMKubernetesCluster_apiServerAuthorizedIPRanges
=== CONT  TestAccAzureRMKubernetesCluster_apiServerAuthorizedIPRanges
--- FAIL: TestAccAzureRMKubernetesCluster_apiServerAuthorizedIPRanges (69.26s)
    testing.go:568: Step 0 error: errors during apply:
        
        Error: Error creating/updating Managed Kubernetes Cluster "acctestaks190429172120205848" (Resource Group "acctestRG-190429172120205848"): containerservice.ManagedClustersClient#CreateOrUpdate: Failure sending request: StatusCode=400 -- Original Error: Code="BadRequest" Message="APIServer Authorized IP Ranges is not allowed since feature \"Microsoft.ContainerService/APIServerSecurityPreview\" is not enabled."

However checking from cloudshell:

PS Azure:\> Get-AzureRmProviderFeature

FeatureName                                  ProviderName               RegistrationState
-----------                                  ------------               -----------------
APIServerSecurityPreview                     Microsoft.ContainerService Registered
...

Is there anything else we need to do on our end to enable the feature?

In the az cli you need to propagate the changes after registering the extension.
Once the feature 'APIServerSecurityPreview' is registered, invoking 'az provider register -n Microsoft.ContainerService' is required to get the change propagated

Probably in PS after the command you already ran:
Register-AzureRmProviderFeature -FeatureName APIServerSecurityPreview -ProviderNamespace Microsoft.ContainerService

you'd need to run:
'Register-AzureRmResourceProvider -ProviderNamespace Microsoft.ContainerService'

[katbyte]

Thanks @jlpedrosa! that did the trick 🙂

Now we are blocked on a real test failures here:

------- Stdout: -------
=== RUN   TestAccAzureRMKubernetesCluster_apiServerAuthorizedIPRanges
=== PAUSE TestAccAzureRMKubernetesCluster_apiServerAuthorizedIPRanges
=== CONT  TestAccAzureRMKubernetesCluster_apiServerAuthorizedIPRanges
--- FAIL: TestAccAzureRMKubernetesCluster_apiServerAuthorizedIPRanges (3594.49s)
    testing.go:568: Step 0 error: Check failed: Check 14/16 error: azurerm_kubernetes_cluster.test: Attribute 'api_server_authorized_ip_ranges' expected to be set

@fraserdarwent

[fraserdarwent]

@katbyte
Removed the failing line. I am not sure it was correct of me to check the set itself is set, and I should instead be checking the elements of the set.

[katbyte]

Thanks for the updates @fraserdarwent!

Aside from one minor comment about adding to the docs the LGTM 👍

[katbyte]

Just a thought, should we detail how to opt in here? something like

-> **Note:** `api_server_authorized_ip_ranges` Is currently in Preview on an opt-in basis. You can enable this by running the following in Azure Cloudshell:
Register-AzureRmProviderFeature -FeatureName APIServerSecurityPreview -ProviderNamespace Microsoft.ContainerService
Get-AzureRmProviderFeature # Wait for feature to become registered and then
Register-AzureRmResourceProvider -ProviderNamespace Microsoft.ContainerService

[ghost]

This has been released in version 1.28.0 of the provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading. As an example:

provider "azurerm" {
	version = "~> 1.28.0"
}
# ... other configuration ...

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 hashibot-feedback@hashicorp.com. Thanks!