Closed riragh closed 5 months ago
Are these breaking changes? I see where we are adding items into the node pool definitions and how the vms are being created as well.
No not a breaking change. The default values are set for the variables as false
and null
, which guards this. So it doesn't affect the existing user.
Changes:
This PR adds EncryptAtHost requirements in the VMs and AKS nodes.
Note: You must enable the feature for your subscription before you use the EncryptionAtHost property for your VM/VMSS. Use the following steps to enable the feature for your subscription:
This is an optional features, to enable encryption at host for nodes and VMs you would set the following variables:
By default, when using AKS, OS and data disks use server-side encryption with platform-managed keys. The caches for these disks are encrypted at rest with platform-managed keys. You can specify your own managed keys following Bring your own keys (BYOK) with Azure disks in Azure Kubernetes Service. The caches for these disks are also encrypted using the key you specify.
When using customer-managed-keys, ensure you have the proper AKS credentials. The managed identity needs to have contributor access to the resource group where the diskencryptionset is deployed. Otherwise, you'll get an error suggesting that the managed identity does not have permissions. Also, make sure the VNet of your deployment has access to the Key Vault which has the diskencryptionset. Note: Adding the subnet service endpoints makes the process smooth.
Tests:
enable_vm_host_encryption = true
,aks_cluster_enable_host_encryption = true
enable_vm_host_encryption = true
,vm_disk_encryption_set_id = "<disk_encryption_set_id>"
,aks_cluster_enable_host_encryption = true
,aks_node_disk_encryption_set_id = "<disk_encryption_set_id>"