Cannot create a simple Azure AKS with Terraform anymore

Question

I am not able to create a Azure Kubernetes Service using the following code:

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "=2.96.0"
    }
  }
}

resource "azurerm_resource_group" "aks-rg" {
  name     = "aks-rg"
  location = "West Europe"
}

resource "azurerm_kubernetes_cluster" "aks-1" {
  name                = "aks-1"
  location            = azurerm_resource_group.aks-rg.location
  resource_group_name = azurerm_resource_group.aks-rg.name
  dns_prefix          = "aks1"
  
  default_node_pool {
    name       = "nodepool1"
    node_count = 3
    vm_size    = "Standard_D2_v2"
  }

  identity {
    type = "SystemAssigned"
  }

  tags = {
    Environment = "Test"
  }
}

The following error occurs:

│ Error: creating Cluster: (Managed Cluster Name "aks-1" / Resource Group "aks-rg"): 
containerservice.ManagedClustersClient#CreateOrUpdate: Failure sending 
request: StatusCode=400 -- Original Error: Code="RequestDisallowedByPolicy" Message=
"Provisioning of resource(s) for container service aks-1 in resource group aks-rg failed. Message: Resource 
'aks-nodepool1-58423643-vmss' was disallowed by policy. Policy identifiers: 
'[{\"policyAssignment\":{\"name\":\"Enforce automatic OS upgrade with app health checks

What am I doing wrong? Do I need to manually create a VMSS first?

Thanks in advance!

Kombajn zbożowy · Accepted Answer · 2022-02-14 12:23:40Z

1

Enforce automatic OS upgrade with app health checks is a built-in policy enforced on your subscription / resource group that denies creating a VMSS without automatic OS upgrade enabled.

"policyRule": {
  "if": {
    "allOf": [
      {
        "field": "type",
        "equals": "Microsoft.Compute/virtualMachineScaleSets"
      },
      {
        "field": "Microsoft.Compute/VirtualMachineScaleSets/upgradePolicy.automaticOSUpgradePolicy.enableAutomaticOSUpgrade",
        "notEquals": "True"
      },
      {
        "field": "Microsoft.Compute/VirtualMachineScaleSets/upgradePolicy.automaticOSUpgrade",
        "notEquals": "True"
      }
    ]
  },

I've seen others raising same problem for azurerm provider. But it can't be fixed at provider level, as just there is no such param when adding a node pool to AKS (eg. looking though options of Azure CLI).

You can only ask your admins to disable the policy or add an exemption for you.

answered Feb 14, 2022 at 12:23

Kombajn zbożowy

10.8k5 gold badges33 silver badges71 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

FrankS77 Over a year ago

Thanks! Unfortunately, it seems to be the only option at the moment. It works.

Collectives™ on Stack Overflow

Cannot create a simple Azure AKS with Terraform anymore

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related