Skip to content

Add AKS Azure Policy quickstart - #504

Merged
Rebecca Calixte (Rebecca-Calixte) merged 5 commits into
masterfrom
rebecca/aks-use-azure-policy
Aug 27, 2026
Merged

Rebecca Calixte (Rebecca-Calixte) merged 5 commits into
masterfrom
rebecca/aks-use-azure-policy

Conversation

@Rebecca-Calixte

Copy link
Copy Markdown
Collaborator

Summary

  • Adds a Terraform quickstart for assigning the built-in Azure Policy pod security baseline initiative to an existing AKS cluster.
  • Includes the Terraform configuration and a README with deployment and validation instructions.
  • Requires an existing AKS cluster with the Azure Policy add-on enabled.

Related work item:
568336

This README provides a comprehensive guide on configuring Azure Policy for an existing AKS cluster using Terraform, including prerequisites, Terraform configuration, and verification steps.
Co-authored-by: vranade-microsoft <269690592+vranade-microsoft@users.noreply.github.com>
Copilot AI and others added 2 commits August 26, 2026 08:44
Co-authored-by: vranade-microsoft <269690592+vranade-microsoft@users.noreply.github.com>
Co-authored-by: vranade-microsoft <269690592+vranade-microsoft@users.noreply.github.com>

Copy link
Copy Markdown
Collaborator

Root cause & fix for the failing e2e-check job

Job: e2e-check run 32945850829, job 98106611353

Root cause:
quickstart/101-aks-use-azure-policy/main.tf declared data "azurerm_kubernetes_cluster" "aks" to look up the existing AKS cluster. In the e2e test, that cluster is provisioned by the quickstart/101-aks-automatic prerequisite, which creates a cluster with SKU Automatic. The azurerm_kubernetes_cluster data source in the AzureRM provider does not support the Automatic SKU, so the apply step failed with:

Error: retrieving : azurerm_kubernetes_cluster datasource does not support SKU `Automatic`

Fix:

  • Removed the data "azurerm_kubernetes_cluster" "aks" block from main.tf — it was never actually referenced by the policy assignment resource, which is scoped to the resource group via data.azurerm_resource_group.aks.id, so it was dead code causing an avoidable failure.
  • Added an aks_cluster_name output so the aks_cluster_name variable remains meaningfully used (per code review feedback).
  • Updated README.md to match the simplified configuration.

Commits: f2ac39e0 (remove unsupported data source), 9f65487a (add output, doc updates).

@Rebecca-Calixte
Rebecca Calixte (Rebecca-Calixte) merged commit 4894d51 into master Aug 27, 2026
4 checks passed

This branch was previously deployed

1 inactive deployment
test — 9f65487a Deployed Aug 26, 2026 by Copilot via e2e-check #938
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants