{"id":19129464,"url":"https://github.com/launchbynttdata/tf-azurerm-module_reference-kubernetes_cluster","last_synced_at":"2026-03-19T08:13:56.602Z","repository":{"id":230246234,"uuid":"777314835","full_name":"launchbynttdata/tf-azurerm-module_reference-kubernetes_cluster","owner":"launchbynttdata","description":null,"archived":false,"fork":false,"pushed_at":"2026-02-16T14:48:45.000Z","size":2155,"stargazers_count":0,"open_issues_count":2,"forks_count":1,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-02-16T22:29:37.371Z","etag":null,"topics":["azure","infrastructure-as-code","platform-automation","reference","terraform"],"latest_commit_sha":null,"homepage":"","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/launchbynttdata.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":"CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":"NOTICE","maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2024-03-25T16:07:50.000Z","updated_at":"2026-01-13T13:25:30.000Z","dependencies_parsed_at":"2025-11-13T15:05:15.998Z","dependency_job_id":null,"html_url":"https://github.com/launchbynttdata/tf-azurerm-module_reference-kubernetes_cluster","commit_stats":null,"previous_names":["launchbynttdata/tf-azurerm-module_reference-kubernetes_cluster"],"tags_count":20,"template":false,"template_full_name":null,"purl":"pkg:github/launchbynttdata/tf-azurerm-module_reference-kubernetes_cluster","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/launchbynttdata%2Ftf-azurerm-module_reference-kubernetes_cluster","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/launchbynttdata%2Ftf-azurerm-module_reference-kubernetes_cluster/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/launchbynttdata%2Ftf-azurerm-module_reference-kubernetes_cluster/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/launchbynttdata%2Ftf-azurerm-module_reference-kubernetes_cluster/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/launchbynttdata","download_url":"https://codeload.github.com/launchbynttdata/tf-azurerm-module_reference-kubernetes_cluster/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/launchbynttdata%2Ftf-azurerm-module_reference-kubernetes_cluster/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29880075,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-26T23:51:21.483Z","status":"ssl_error","status_checked_at":"2026-02-26T23:50:46.793Z","response_time":89,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["azure","infrastructure-as-code","platform-automation","reference","terraform"],"created_at":"2024-11-09T06:07:34.530Z","updated_at":"2026-02-27T01:13:03.984Z","avatar_url":"https://github.com/launchbynttdata.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# tf-azurerm-module_reference-kubernetes_cluster\n\n[![License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)\n[![License: CC BY-NC-ND 4.0](https://img.shields.io/badge/License-CC_BY--NC--ND_4.0-lightgrey.svg)](https://creativecommons.org/licenses/by-nc-nd/4.0/)\n\n## Overview\n\nThis terraform module will provision an AKS cluster with other dependencies like Resource Group, Key Vault, ACR, etc. This is a collection module as it will encapsulate other primitive modules like `tf-azurerm-module_primitive-kubernetes_cluster`\n\nSome useful examples can be found in the [examples](./examples) directory that demonstrate the usage of this module to provision different flavors of AKS with different configurations and capabilities.\n1. [Private Cluster](./examples/private-cluster/README.md)\n2. [Public Cluster](./examples/public-cluster/README.md)\n\nThere are also several other add-ons that can be deployed on the AKS cluster to provide additional functionalities. They are found\nin the [resources](./resources) directory. Few of the add ons are\n1. [Ingress Controller](./resources/ingress-nginx)\n2. [Linkerd](./resources/linkerd-servicemesh)\n3. [Emissary](./resources/emissary)\n4. [Azure AD Integration and RBAC](./resources/azure-ad-integration)\n5. [Cert Manager](./resources/cert-manager)\n6. [Secrets Controller](./resources/secrets-controller)\n7. [Reloaders](./resources/reloaders)\n8. [Observability](./resources/observability)\n9. [Demo Applications](./resources/demo-apps)\n\n## Architecture\nThe below diagram shows an architecture of a Private AKS clusters will all add-ons and integrations.\n\n![Architecture](./images/AKS-architecture.drawio.png)\n\n## References\n1. [Draw IO diagram source](https://github.com/launchbynttdata/fdoc-drawio)\n2. [Primitive module k8s](https://github.com/launchbynttdata/tf-azurerm-module_primitive-kubernetes_cluster)\n\n## Pre-Commit hooks\n\n[.pre-commit-config.yaml](.pre-commit-config.yaml) file defines certain `pre-commit` hooks that are relevant to terraform, golang and common linting tasks. There are no custom hooks added.\n\n`commitlint` hook enforces commit message in certain format. The commit contains the following structural elements, to communicate intent to the consumers of your commit messages:\n\n- **fix**: a commit of the type `fix` patches a bug in your codebase (this correlates with PATCH in Semantic Versioning).\n- **feat**: a commit of the type `feat` introduces a new feature to the codebase (this correlates with MINOR in Semantic Versioning).\n- **BREAKING CHANGE**: a commit that has a footer `BREAKING CHANGE:`, or appends a `!` after the type/scope, introduces a breaking API change (correlating with MAJOR in Semantic Versioning). A BREAKING CHANGE can be part of commits of any type.\nfooters other than BREAKING CHANGE: \u003cdescription\u003e may be provided and follow a convention similar to git trailer format.\n- **build**: a commit of the type `build` adds changes that affect the build system or external dependencies (example scopes: gulp, broccoli, npm)\n- **chore**: a commit of the type `chore` adds changes that don't modify src or test files\n- **ci**: a commit of the type `ci` adds changes to our CI configuration files and scripts (example scopes: Travis, Circle, BrowserStack, SauceLabs)\n- **docs**: a commit of the type `docs` adds documentation only changes\n- **perf**: a commit of the type `perf` adds code change that improves performance\n- **refactor**: a commit of the type `refactor` adds code change that neither fixes a bug nor adds a feature\n- **revert**: a commit of the type `revert` reverts a previous commit\n- **style**: a commit of the type `style` adds code changes that do not affect the meaning of the code (white-space, formatting, missing semi-colons, etc)\n- **test**: a commit of the type `test` adds missing tests or correcting existing tests\n\nBase configuration used for this project is [commitlint-config-conventional (based on the Angular convention)](https://github.com/conventional-changelog/commitlint/tree/master/@commitlint/config-conventional#type-enum)\n\nIf you are a developer using vscode, [this](https://marketplace.visualstudio.com/items?itemName=joshbolduc.commitlint) plugin may be helpful.\n\n`detect-secrets-hook` prevents new secrets from being introduced into the baseline. TODO: INSERT DOC LINK ABOUT HOOKS\n\nIn order for `pre-commit` hooks to work properly\n\n- You need to have the pre-commit package manager installed. [Here](https://pre-commit.com/#install) are the installation instructions.\n- `pre-commit` would install all the hooks when commit message is added by default except for `commitlint` hook. `commitlint` hook would need to be installed manually using the command below\n\n```\npre-commit install --hook-type commit-msg\n```\n\n## To test the resource group module locally\n\n1. For development/enhancements to this module locally, you'll need to install all of its components. This is controlled by the `configure` target in the project's [`Makefile`](./Makefile). Before you can run `configure`, familiarize yourself with the variables in the `Makefile` and ensure they're pointing to the right places.\n\n```\nmake configure\n```\n\nThis adds in several files and directories that are ignored by `git`. They expose many new Make targets.\n\n2. _THIS STEP APPLIES ONLY TO MICROSOFT AZURE. IF YOU ARE USING A DIFFERENT PLATFORM PLEASE SKIP THIS STEP._ The first target you care about is `env`. This is the common interface for setting up environment variables. The values of the environment variables will be used to authenticate with cloud provider from local development workstation.\n\n`make configure` command will bring down `azure_env.sh` file on local workstation. Devloper would need to modify this file, replace the environment variable values with relevant values.\n\nThese environment variables are used by `terratest` integration suit.\n\nService principle used for authentication(value of ARM_CLIENT_ID) should have below privileges on resource group within the subscription.\n\n```\n\"Microsoft.Resources/subscriptions/resourceGroups/write\"\n\"Microsoft.Resources/subscriptions/resourceGroups/read\"\n\"Microsoft.Resources/subscriptions/resourceGroups/delete\"\n```\n\nThen run this make target to set the environment variables on developer workstation.\n\n```\nmake env\n```\n\n3. The first target you care about is `check`.\n\n**Pre-requisites**\nBefore running this target it is important to ensure that, developer has created files mentioned below on local workstation under root directory of git repository that contains code for primitives/segments. Note that these files are `azure` specific. If primitive/segment under development uses any other cloud provider than azure, this section may not be relevant.\n- Login to Azure cli\n- Export the below environment variables\n```bash\nexport ARM_ENVIRONMENT=\u003cpublic|usgovernment\u003e\nexport ARM_SUBSCRIPTION_ID=\u003csubscription_id\u003e\n```\n- A file named `provider.tf` with contents below\n\n```\nprovider \"azurerm\" {\n features {\n resource_group {\n prevent_deletion_if_contains_resources = false\n }\n }\n skip_provider_registration = true\n}\n\nprovider \"azapi\" {\n use_cli = true\n use_msi = false\n}\n```\n\n- A file named `terraform.tfvars` which contains key value pair of variables used.\n\nNote that since these files are added in `gitignore` they would not be checked in into primitive/segment's git repo.\n\nAfter creating these files, for running tests associated with the primitive/segment, run\n\n```\nmake check\n```\n\nIf `make check` target is successful, developer is good to commit the code to primitive/segment's git repo.\n\n`make check` target\n\n- runs `terraform commands` to `lint`,`validate` and `plan` terraform code.\n- runs `conftests`. `conftests` make sure `policy` checks are successful.\n- runs `terratest`. This is integration test suit.\n- runs `opa` tests\n\n# References\n1. [Terraform Module](https://github.com/Azure/terraform-azurerm-aks)\n\n# Terradocs\n\n\u003c!-- BEGIN_TF_DOCS --\u003e\n## Requirements\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"requirement_terraform\"\u003e\u003c/a\u003e [terraform](#requirement\\_terraform) | ~\u003e 1.0 |\n| \u003ca name=\"requirement_azapi\"\u003e\u003c/a\u003e [azapi](#requirement\\_azapi) | \u003e= 1.4.0, \u003c 2.0 |\n| \u003ca name=\"requirement_azurerm\"\u003e\u003c/a\u003e [azurerm](#requirement\\_azurerm) | ~\u003e3.117 |\n\n## Providers\n\nNo providers.\n\n## Modules\n\n| Name | Source | Version |\n|------|--------|---------|\n| \u003ca name=\"module_resource_names\"\u003e\u003c/a\u003e [resource\\_names](#module\\_resource\\_names) | terraform.registry.launch.nttdata.com/module_library/resource_name/launch | ~\u003e 2.0 |\n| \u003ca name=\"module_resource_group\"\u003e\u003c/a\u003e [resource\\_group](#module\\_resource\\_group) | terraform.registry.launch.nttdata.com/module_primitive/resource_group/azurerm | ~\u003e 1.0 |\n| \u003ca name=\"module_key_vault\"\u003e\u003c/a\u003e [key\\_vault](#module\\_key\\_vault) | terraform.registry.launch.nttdata.com/module_primitive/key_vault/azurerm | ~\u003e 1.0 |\n| \u003ca name=\"module_key_vault_role_assignment\"\u003e\u003c/a\u003e [key\\_vault\\_role\\_assignment](#module\\_key\\_vault\\_role\\_assignment) | terraform.registry.launch.nttdata.com/module_primitive/role_assignment/azurerm | ~\u003e 1.0 |\n| \u003ca name=\"module_additional_key_vaults_role_assignment\"\u003e\u003c/a\u003e [additional\\_key\\_vaults\\_role\\_assignment](#module\\_additional\\_key\\_vaults\\_role\\_assignment) | terraform.registry.launch.nttdata.com/module_primitive/role_assignment/azurerm | ~\u003e 1.0 |\n| \u003ca name=\"module_cluster_identity\"\u003e\u003c/a\u003e [cluster\\_identity](#module\\_cluster\\_identity) | terraform.registry.launch.nttdata.com/module_primitive/user_managed_identity/azurerm | ~\u003e 1.0 |\n| \u003ca name=\"module_workload_user_assigned_identities\"\u003e\u003c/a\u003e [workload\\_user\\_assigned\\_identities](#module\\_workload\\_user\\_assigned\\_identities) | terraform.registry.launch.nttdata.com/module_primitive/user_managed_identity/azurerm | ~\u003e 1.0 |\n| \u003ca name=\"module_workload_federated_identity_credentials\"\u003e\u003c/a\u003e [workload\\_federated\\_identity\\_credentials](#module\\_workload\\_federated\\_identity\\_credentials) | terraform.registry.launch.nttdata.com/module_primitive/federated_identity_credential/azurerm | ~\u003e 1.0 |\n| \u003ca name=\"module_cluster_identity_roles\"\u003e\u003c/a\u003e [cluster\\_identity\\_roles](#module\\_cluster\\_identity\\_roles) | terraform.registry.launch.nttdata.com/module_primitive/role_assignment/azurerm | ~\u003e 1.0 |\n| \u003ca name=\"module_private_cluster_dns_zone\"\u003e\u003c/a\u003e [private\\_cluster\\_dns\\_zone](#module\\_private\\_cluster\\_dns\\_zone) | terraform.registry.launch.nttdata.com/module_primitive/private_dns_zone/azurerm | ~\u003e 1.0 |\n| \u003ca name=\"module_cluster_identity_private_dns_contributor\"\u003e\u003c/a\u003e [cluster\\_identity\\_private\\_dns\\_contributor](#module\\_cluster\\_identity\\_private\\_dns\\_contributor) | terraform.registry.launch.nttdata.com/module_primitive/role_assignment/azurerm | ~\u003e 1.0 |\n| \u003ca name=\"module_vnet_links\"\u003e\u003c/a\u003e [vnet\\_links](#module\\_vnet\\_links) | terraform.registry.launch.nttdata.com/module_primitive/private_dns_vnet_link/azurerm | ~\u003e 1.0 |\n| \u003ca name=\"module_route_table\"\u003e\u003c/a\u003e [route\\_table](#module\\_route\\_table) | terraform.registry.launch.nttdata.com/module_primitive/route_table/azurerm | ~\u003e 1.0 |\n| \u003ca name=\"module_udr_route_table_role_assignment\"\u003e\u003c/a\u003e [udr\\_route\\_table\\_role\\_assignment](#module\\_udr\\_route\\_table\\_role\\_assignment) | terraform.registry.launch.nttdata.com/module_primitive/role_assignment/azurerm | ~\u003e 1.0 |\n| \u003ca name=\"module_routes\"\u003e\u003c/a\u003e [routes](#module\\_routes) | terraform.registry.launch.nttdata.com/module_primitive/route/azurerm | ~\u003e 1.0 |\n| \u003ca name=\"module_subnet_route_table_assoc\"\u003e\u003c/a\u003e [subnet\\_route\\_table\\_assoc](#module\\_subnet\\_route\\_table\\_assoc) | terraform.registry.launch.nttdata.com/module_primitive/routetable_subnet_association/azurerm | ~\u003e 1.0 |\n| \u003ca name=\"module_aks\"\u003e\u003c/a\u003e [aks](#module\\_aks) | terraform.registry.launch.nttdata.com/module_primitive/kubernetes_cluster/azurerm | ~\u003e 2.0 |\n| \u003ca name=\"module_node_pool_identity_roles\"\u003e\u003c/a\u003e [node\\_pool\\_identity\\_roles](#module\\_node\\_pool\\_identity\\_roles) | terraform.registry.launch.nttdata.com/module_primitive/role_assignment/azurerm | ~\u003e 1.0 |\n| \u003ca name=\"module_additional_acr_role_assignments\"\u003e\u003c/a\u003e [additional\\_acr\\_role\\_assignments](#module\\_additional\\_acr\\_role\\_assignments) | terraform.registry.launch.nttdata.com/module_primitive/role_assignment/azurerm | ~\u003e 1.0 |\n| \u003ca name=\"module_public_dns_zone\"\u003e\u003c/a\u003e [public\\_dns\\_zone](#module\\_public\\_dns\\_zone) | terraform.registry.launch.nttdata.com/module_primitive/dns_zone/azurerm | ~\u003e 1.0 |\n| \u003ca name=\"module_kubelet_public_dns_contributor\"\u003e\u003c/a\u003e [kubelet\\_public\\_dns\\_contributor](#module\\_kubelet\\_public\\_dns\\_contributor) | terraform.registry.launch.nttdata.com/module_primitive/role_assignment/azurerm | ~\u003e 1.0 |\n| \u003ca name=\"module_kubelet_resource_group_reader\"\u003e\u003c/a\u003e [kubelet\\_resource\\_group\\_reader](#module\\_kubelet\\_resource\\_group\\_reader) | terraform.registry.launch.nttdata.com/module_primitive/role_assignment/azurerm | ~\u003e 1.0 |\n| \u003ca name=\"module_application_insights\"\u003e\u003c/a\u003e [application\\_insights](#module\\_application\\_insights) | terraform.registry.launch.nttdata.com/module_primitive/application_insights/azurerm | ~\u003e 1.0 |\n| \u003ca name=\"module_prometheus_monitor_workspace\"\u003e\u003c/a\u003e [prometheus\\_monitor\\_workspace](#module\\_prometheus\\_monitor\\_workspace) | terraform.registry.launch.nttdata.com/module_primitive/monitor_workspace/azurerm | ~\u003e 1.0 |\n| \u003ca name=\"module_prometheus_monitor_data_collection\"\u003e\u003c/a\u003e [prometheus\\_monitor\\_data\\_collection](#module\\_prometheus\\_monitor\\_data\\_collection) | terraform.registry.launch.nttdata.com/module_primitive/monitor_prometheus/azurerm | ~\u003e 1.0 |\n| \u003ca name=\"module_prometheus_monitor_workspace_private_dns_zone\"\u003e\u003c/a\u003e [prometheus\\_monitor\\_workspace\\_private\\_dns\\_zone](#module\\_prometheus\\_monitor\\_workspace\\_private\\_dns\\_zone) | terraform.registry.launch.nttdata.com/module_primitive/private_dns_zone/azurerm | ~\u003e 1.0 |\n| \u003ca name=\"module_prometheus_monitor_workspace_vnet_link\"\u003e\u003c/a\u003e [prometheus\\_monitor\\_workspace\\_vnet\\_link](#module\\_prometheus\\_monitor\\_workspace\\_vnet\\_link) | terraform.registry.launch.nttdata.com/module_primitive/private_dns_vnet_link/azurerm | ~\u003e 1.0 |\n| \u003ca name=\"module_prometheus_monitor_workspace_private_endpoint\"\u003e\u003c/a\u003e [prometheus\\_monitor\\_workspace\\_private\\_endpoint](#module\\_prometheus\\_monitor\\_workspace\\_private\\_endpoint) | terraform.registry.launch.nttdata.com/module_primitive/private_endpoint/azurerm | ~\u003e 1.0 |\n| \u003ca name=\"module_monitor_private_link_scope\"\u003e\u003c/a\u003e [monitor\\_private\\_link\\_scope](#module\\_monitor\\_private\\_link\\_scope) | terraform.registry.launch.nttdata.com/module_primitive/azure_monitor_private_link_scope/azurerm | ~\u003e 1.0 |\n| \u003ca name=\"module_monitor_private_link_scope_dns_zone\"\u003e\u003c/a\u003e [monitor\\_private\\_link\\_scope\\_dns\\_zone](#module\\_monitor\\_private\\_link\\_scope\\_dns\\_zone) | terraform.registry.launch.nttdata.com/module_primitive/private_dns_zone/azurerm | ~\u003e 1.0 |\n| \u003ca name=\"module_monitor_private_link_scope_vnet_link\"\u003e\u003c/a\u003e [monitor\\_private\\_link\\_scope\\_vnet\\_link](#module\\_monitor\\_private\\_link\\_scope\\_vnet\\_link) | terraform.registry.launch.nttdata.com/module_primitive/private_dns_vnet_link/azurerm | ~\u003e 1.0 |\n| \u003ca name=\"module_monitor_private_link_scope_private_endpoint\"\u003e\u003c/a\u003e [monitor\\_private\\_link\\_scope\\_private\\_endpoint](#module\\_monitor\\_private\\_link\\_scope\\_private\\_endpoint) | terraform.registry.launch.nttdata.com/module_primitive/private_endpoint/azurerm | ~\u003e 1.0 |\n| \u003ca name=\"module_monitor_private_link_scoped_service\"\u003e\u003c/a\u003e [monitor\\_private\\_link\\_scoped\\_service](#module\\_monitor\\_private\\_link\\_scoped\\_service) | terraform.registry.launch.nttdata.com/module_primitive/monitor_private_link_scoped_service/azurerm | ~\u003e 1.0 |\n\n## Resources\n\nNo resources.\n\n## Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| \u003ca name=\"input_product_family\"\u003e\u003c/a\u003e [product\\_family](#input\\_product\\_family) | (Required) Name of the product family for which the resource is created.\u003cbr\u003e Example: org\\_name, department\\_name. | `string` | `\"dso\"` | no |\n| \u003ca name=\"input_product_service\"\u003e\u003c/a\u003e [product\\_service](#input\\_product\\_service) | (Required) Name of the product service for which the resource is created.\u003cbr\u003e For example, backend, frontend, middleware etc. | `string` | `\"kube\"` | no |\n| \u003ca name=\"input_environment\"\u003e\u003c/a\u003e [environment](#input\\_environment) | Environment in which the resource should be provisioned like dev, qa, prod etc. | `string` | `\"dev\"` | no |\n| \u003ca name=\"input_environment_number\"\u003e\u003c/a\u003e [environment\\_number](#input\\_environment\\_number) | The environment count for the respective environment. Defaults to 000. Increments in value of 1 | `string` | `\"000\"` | no |\n| \u003ca name=\"input_resource_number\"\u003e\u003c/a\u003e [resource\\_number](#input\\_resource\\_number) | The resource count for the respective resource. Defaults to 000. Increments in value of 1 | `string` | `\"000\"` | no |\n| \u003ca name=\"input_region\"\u003e\u003c/a\u003e [region](#input\\_region) | AWS Region in which the infra needs to be provisioned | `string` | `\"eastus\"` | no |\n| \u003ca name=\"input_resource_names_map\"\u003e\u003c/a\u003e [resource\\_names\\_map](#input\\_resource\\_names\\_map) | A map of key to resource\\_name that will be used by tf-launch-module\\_library-resource\\_name to generate resource names | \u003cpre\u003emap(object(\u003cbr\u003e {\u003cbr\u003e name = string\u003cbr\u003e max_length = optional(number, 60)\u003cbr\u003e }\u003cbr\u003e ))\u003c/pre\u003e | \u003cpre\u003e{\u003cbr\u003e \"acr\": {\u003cbr\u003e \"max_length\": 60,\u003cbr\u003e \"name\": \"acr\"\u003cbr\u003e },\u003cbr\u003e \"aks\": {\u003cbr\u003e \"max_length\": 60,\u003cbr\u003e \"name\": \"aks\"\u003cbr\u003e },\u003cbr\u003e \"application_gateway\": {\u003cbr\u003e \"max_length\": 60,\u003cbr\u003e \"name\": \"appgtw\"\u003cbr\u003e },\u003cbr\u003e \"application_insights\": {\u003cbr\u003e \"max_length\": 60,\u003cbr\u003e \"name\": \"appins\"\u003cbr\u003e },\u003cbr\u003e \"cluster_identity\": {\u003cbr\u003e \"max_length\": 60,\u003cbr\u003e \"name\": \"msi\"\u003cbr\u003e },\u003cbr\u003e \"key_vault\": {\u003cbr\u003e \"max_length\": 24,\u003cbr\u003e \"name\": \"kv\"\u003cbr\u003e },\u003cbr\u003e \"monitor_private_link_scope\": {\u003cbr\u003e \"max_length\": 60,\u003cbr\u003e \"name\": \"ampls\"\u003cbr\u003e },\u003cbr\u003e \"monitor_private_link_scope_endpoint\": {\u003cbr\u003e \"max_length\": 60,\u003cbr\u003e \"name\": \"amplspe\"\u003cbr\u003e },\u003cbr\u003e \"monitor_private_link_scope_service_connection\": {\u003cbr\u003e \"max_length\": 60,\u003cbr\u003e \"name\": \"amplspesc\"\u003cbr\u003e },\u003cbr\u003e \"prometheus_data_collection_endpoint\": {\u003cbr\u003e \"max_length\": 60,\u003cbr\u003e \"name\": \"promdce\"\u003cbr\u003e },\u003cbr\u003e \"prometheus_data_collection_rule\": {\u003cbr\u003e \"max_length\": 60,\u003cbr\u003e \"name\": \"promdcr\"\u003cbr\u003e },\u003cbr\u003e \"prometheus_endpoint\": {\u003cbr\u003e \"max_length\": 60,\u003cbr\u003e \"name\": \"prompe\"\u003cbr\u003e },\u003cbr\u003e \"prometheus_monitor_workspace\": {\u003cbr\u003e \"max_length\": 60,\u003cbr\u003e \"name\": \"promamw\"\u003cbr\u003e },\u003cbr\u003e \"prometheus_service_connection\": {\u003cbr\u003e \"max_length\": 60,\u003cbr\u003e \"name\": \"prompesc\"\u003cbr\u003e },\u003cbr\u003e \"public_dns_zone\": {\u003cbr\u003e \"max_length\": 60,\u003cbr\u003e \"name\": \"dns\"\u003cbr\u003e },\u003cbr\u003e \"resource_group\": {\u003cbr\u003e \"max_length\": 60,\u003cbr\u003e \"name\": \"rg\"\u003cbr\u003e },\u003cbr\u003e \"route_table\": {\u003cbr\u003e \"max_length\": 60,\u003cbr\u003e \"name\": \"rt\"\u003cbr\u003e }\u003cbr\u003e}\u003c/pre\u003e | no |\n| \u003ca name=\"input_resource_group_name\"\u003e\u003c/a\u003e [resource\\_group\\_name](#input\\_resource\\_group\\_name) | Name of the resource group in which the AKS cluster will be created. If not provided, this module will create one | `string` | `null` | no |\n| \u003ca name=\"input_kubernetes_version\"\u003e\u003c/a\u003e [kubernetes\\_version](#input\\_kubernetes\\_version) | Specify which Kubernetes release to use. The default used is the latest Kubernetes version available in the region\u003cbr\u003e Use `az aks get-versions --location \u003cregion\u003e` to find the available versions in the region | `string` | `\"1.32\"` | no |\n| \u003ca name=\"input_network_plugin\"\u003e\u003c/a\u003e [network\\_plugin](#input\\_network\\_plugin) | Network plugin to use for networking. Default is azure. | `string` | `\"azure\"` | no |\n| \u003ca name=\"input_network_plugin_mode\"\u003e\u003c/a\u003e [network\\_plugin\\_mode](#input\\_network\\_plugin\\_mode) | (Optional) Specifies the network plugin mode used for building the Kubernetes network. Possible value is `Overlay`. Changing this forces a new resource to be created. | `string` | `null` | no |\n| \u003ca name=\"input_network_policy\"\u003e\u003c/a\u003e [network\\_policy](#input\\_network\\_policy) | (Optional) Sets up network policy to be used with Azure CNI. Network policy allows us to control the traffic flow between pods. Currently supported values are calico and azure. Changing this forces a new resource to be created. | `string` | `null` | no |\n| \u003ca name=\"input_private_cluster_enabled\"\u003e\u003c/a\u003e [private\\_cluster\\_enabled](#input\\_private\\_cluster\\_enabled) | If true cluster API server will be exposed only on internal IP address and available only in cluster vnet. | `bool` | `false` | no |\n| \u003ca name=\"input_private_cluster_public_fqdn_enabled\"\u003e\u003c/a\u003e [private\\_cluster\\_public\\_fqdn\\_enabled](#input\\_private\\_cluster\\_public\\_fqdn\\_enabled) | (Optional) Specifies whether a Public FQDN for this Private Cluster should be added. Defaults to `false`. | `bool` | `false` | no |\n| \u003ca name=\"input_azure_policy_enabled\"\u003e\u003c/a\u003e [azure\\_policy\\_enabled](#input\\_azure\\_policy\\_enabled) | Enable Azure Policy add-on for AKS cluster? Defaults to `false`. | `bool` | `false` | no |\n| \u003ca name=\"input_additional_vnet_links\"\u003e\u003c/a\u003e [additional\\_vnet\\_links](#input\\_additional\\_vnet\\_links) | A list of VNET IDs for which vnet links to be created with the private AKS cluster DNS Zone. Applicable only when private\\_cluster\\_enabled is true. | `map(string)` | `{}` | no |\n| \u003ca name=\"input_cluster_identity_role_assignments\"\u003e\u003c/a\u003e [cluster\\_identity\\_role\\_assignments](#input\\_cluster\\_identity\\_role\\_assignments) | A map of role assignments to be associated with the cluster identity\u003cbr\u003e Should be of the format\u003cbr\u003e {\u003cbr\u003e private-dns = [\"Private DNS Zone Contributor\", \"\u003cprivate-dns-zone-id\u003e\"]\u003cbr\u003e dns = [\"DNS Zone Contributor\", \"\u003cdns-zone-id\u003e\"]\u003cbr\u003e } | `map(list(string))` | `{}` | no |\n| \u003ca name=\"input_node_pool_identity_role_assignments\"\u003e\u003c/a\u003e [node\\_pool\\_identity\\_role\\_assignments](#input\\_node\\_pool\\_identity\\_role\\_assignments) | A map of role assignments to be associated with the node-pool identity\u003cbr\u003e Should be of the format\u003cbr\u003e {\u003cbr\u003e private-dns = [\"Private DNS Zone Contributor\", \"\u003cprivate-dns-zone-id\u003e\"]\u003cbr\u003e dns = [\"DNS Zone Contributor\", \"\u003cdns-zone-id\u003e\"]\u003cbr\u003e } | `map(list(string))` | `{}` | no |\n| \u003ca name=\"input_dns_zone_suffix\"\u003e\u003c/a\u003e [dns\\_zone\\_suffix](#input\\_dns\\_zone\\_suffix) | The DNS Zone suffix for AKS Cluster private DNS Zone. Default is `azmk8s.io` for Public Cloud\u003cbr\u003e For gov cloud it is `cx.aks.containerservice.azure.us` | `string` | `\"azmk8s.io\"` | no |\n| \u003ca name=\"input_vnet_subnet_id\"\u003e\u003c/a\u003e [vnet\\_subnet\\_id](#input\\_vnet\\_subnet\\_id) | (Optional) The ID of a Subnet where the Kubernetes Node Pool should exist. Changing this forces a new resource to be created. | `string` | `null` | no |\n| \u003ca name=\"input_net_profile_dns_service_ip\"\u003e\u003c/a\u003e [net\\_profile\\_dns\\_service\\_ip](#input\\_net\\_profile\\_dns\\_service\\_ip) | (Optional) IP address within the Kubernetes service address range that will be used by cluster service discovery (kube-dns). Changing this forces a new resource to be created. | `string` | `null` | no |\n| \u003ca name=\"input_net_profile_outbound_type\"\u003e\u003c/a\u003e [net\\_profile\\_outbound\\_type](#input\\_net\\_profile\\_outbound\\_type) | (Optional) The outbound (egress) routing method which should be used for this Kubernetes Cluster. Possible values are\u003cbr\u003e loadBalancer and userDefinedRouting. Defaults to loadBalancer.\u003cbr\u003e if `userDefinedRouting` is selected, `user_defined_routing` variable is required. | `string` | `\"loadBalancer\"` | no |\n| \u003ca name=\"input_user_defined_routing\"\u003e\u003c/a\u003e [user\\_defined\\_routing](#input\\_user\\_defined\\_routing) | This variable is required only when net\\_profile\\_outbound\\_type is set to `userDefinedRouting`\u003cbr\u003e The private IP address of the Azure Firewall instance is needed to create route in custom Route table | \u003cpre\u003eobject({\u003cbr\u003e azure_firewall_private_ip_address = string\u003cbr\u003e })\u003c/pre\u003e | `null` | no |\n| \u003ca name=\"input_net_profile_pod_cidr\"\u003e\u003c/a\u003e [net\\_profile\\_pod\\_cidr](#input\\_net\\_profile\\_pod\\_cidr) | (Optional) The CIDR to use for pod IP addresses. This field can only be set when network\\_plugin is set to kubenet. Changing this forces a new resource to be created. | `string` | `null` | no |\n| \u003ca name=\"input_net_profile_service_cidr\"\u003e\u003c/a\u003e [net\\_profile\\_service\\_cidr](#input\\_net\\_profile\\_service\\_cidr) | (Optional) The Network Range used by the Kubernetes service. Changing this forces a new resource to be created. | `string` | `null` | no |\n| \u003ca name=\"input_agents_availability_zones\"\u003e\u003c/a\u003e [agents\\_availability\\_zones](#input\\_agents\\_availability\\_zones) | (Optional) A list of Availability Zones across which the Node Pool should be spread. Changing this forces a new resource to be created. | `list(string)` | `null` | no |\n| \u003ca name=\"input_agents_count\"\u003e\u003c/a\u003e [agents\\_count](#input\\_agents\\_count) | The number of Agents that should exist in the Agent Pool. Please set `agents_count` `null` while `enable_auto_scaling` is `true` to avoid possible `agents_count` changes. | `number` | `2` | no |\n| \u003ca name=\"input_agents_labels\"\u003e\u003c/a\u003e [agents\\_labels](#input\\_agents\\_labels) | (Optional) A map of Kubernetes labels which should be applied to nodes in the Default Node Pool. Changing this forces a new resource to be created. | `map(string)` | `{}` | no |\n| \u003ca name=\"input_agents_max_count\"\u003e\u003c/a\u003e [agents\\_max\\_count](#input\\_agents\\_max\\_count) | Maximum number of nodes in a pool | `number` | `null` | no |\n| \u003ca name=\"input_agents_max_pods\"\u003e\u003c/a\u003e [agents\\_max\\_pods](#input\\_agents\\_max\\_pods) | (Optional) The maximum number of pods that can run on each agent. Changing this forces a new resource to be created. | `number` | `null` | no |\n| \u003ca name=\"input_agents_min_count\"\u003e\u003c/a\u003e [agents\\_min\\_count](#input\\_agents\\_min\\_count) | Minimum number of nodes in a pool | `number` | `null` | no |\n| \u003ca name=\"input_agents_pool_max_surge\"\u003e\u003c/a\u003e [agents\\_pool\\_max\\_surge](#input\\_agents\\_pool\\_max\\_surge) | The maximum number or percentage of nodes which will be added to the Default Node Pool size during an upgrade. | `string` | `null` | no |\n| \u003ca name=\"input_agents_pool_linux_os_configs\"\u003e\u003c/a\u003e [agents\\_pool\\_linux\\_os\\_configs](#input\\_agents\\_pool\\_linux\\_os\\_configs) | list(object({\u003cbr\u003e sysctl\\_configs = optional(list(object({\u003cbr\u003e fs\\_aio\\_max\\_nr = (Optional) The sysctl setting fs.aio-max-nr. Must be between `65536` and `6553500`. Changing this forces a new resource to be created.\u003cbr\u003e fs\\_file\\_max = (Optional) The sysctl setting fs.file-max. Must be between `8192` and `12000500`. Changing this forces a new resource to be created.\u003cbr\u003e fs\\_inotify\\_max\\_user\\_watches = (Optional) The sysctl setting fs.inotify.max\\_user\\_watches. Must be between `781250` and `2097152`. Changing this forces a new resource to be created.\u003cbr\u003e fs\\_nr\\_open = (Optional) The sysctl setting fs.nr\\_open. Must be between `8192` and `20000500`. Changing this forces a new resource to be created.\u003cbr\u003e kernel\\_threads\\_max = (Optional) The sysctl setting kernel.threads-max. Must be between `20` and `513785`. Changing this forces a new resource to be created.\u003cbr\u003e net\\_core\\_netdev\\_max\\_backlog = (Optional) The sysctl setting net.core.netdev\\_max\\_backlog. Must be between `1000` and `3240000`. Changing this forces a new resource to be created.\u003cbr\u003e net\\_core\\_optmem\\_max = (Optional) The sysctl setting net.core.optmem\\_max. Must be between `20480` and `4194304`. Changing this forces a new resource to be created.\u003cbr\u003e net\\_core\\_rmem\\_default = (Optional) The sysctl setting net.core.rmem\\_default. Must be between `212992` and `134217728`. Changing this forces a new resource to be created.\u003cbr\u003e net\\_core\\_rmem\\_max = (Optional) The sysctl setting net.core.rmem\\_max. Must be between `212992` and `134217728`. Changing this forces a new resource to be created.\u003cbr\u003e net\\_core\\_somaxconn = (Optional) The sysctl setting net.core.somaxconn. Must be between `4096` and `3240000`. Changing this forces a new resource to be created.\u003cbr\u003e net\\_core\\_wmem\\_default = (Optional) The sysctl setting net.core.wmem\\_default. Must be between `212992` and `134217728`. Changing this forces a new resource to be created.\u003cbr\u003e net\\_core\\_wmem\\_max = (Optional) The sysctl setting net.core.wmem\\_max. Must be between `212992` and `134217728`. Changing this forces a new resource to be created.\u003cbr\u003e net\\_ipv4\\_ip\\_local\\_port\\_range\\_min = (Optional) The sysctl setting net.ipv4.ip\\_local\\_port\\_range max value. Must be between `1024` and `60999`. Changing this forces a new resource to be created.\u003cbr\u003e net\\_ipv4\\_ip\\_local\\_port\\_range\\_max = (Optional) The sysctl setting net.ipv4.ip\\_local\\_port\\_range min value. Must be between `1024` and `60999`. Changing this forces a new resource to be created.\u003cbr\u003e net\\_ipv4\\_neigh\\_default\\_gc\\_thresh1 = (Optional) The sysctl setting net.ipv4.neigh.default.gc\\_thresh1. Must be between `128` and `80000`. Changing this forces a new resource to be created.\u003cbr\u003e net\\_ipv4\\_neigh\\_default\\_gc\\_thresh2 = (Optional) The sysctl setting net.ipv4.neigh.default.gc\\_thresh2. Must be between `512` and `90000`. Changing this forces a new resource to be created.\u003cbr\u003e net\\_ipv4\\_neigh\\_default\\_gc\\_thresh3 = (Optional) The sysctl setting net.ipv4.neigh.default.gc\\_thresh3. Must be between `1024` and `100000`. Changing this forces a new resource to be created.\u003cbr\u003e net\\_ipv4\\_tcp\\_fin\\_timeout = (Optional) The sysctl setting net.ipv4.tcp\\_fin\\_timeout. Must be between `5` and `120`. Changing this forces a new resource to be created.\u003cbr\u003e net\\_ipv4\\_tcp\\_keepalive\\_intvl = (Optional) The sysctl setting net.ipv4.tcp\\_keepalive\\_intvl. Must be between `10` and `75`. Changing this forces a new resource to be created.\u003cbr\u003e net\\_ipv4\\_tcp\\_keepalive\\_probes = (Optional) The sysctl setting net.ipv4.tcp\\_keepalive\\_probes. Must be between `1` and `15`. Changing this forces a new resource to be created.\u003cbr\u003e net\\_ipv4\\_tcp\\_keepalive\\_time = (Optional) The sysctl setting net.ipv4.tcp\\_keepalive\\_time. Must be between `30` and `432000`. Changing this forces a new resource to be created.\u003cbr\u003e net\\_ipv4\\_tcp\\_max\\_syn\\_backlog = (Optional) The sysctl setting net.ipv4.tcp\\_max\\_syn\\_backlog. Must be between `128` and `3240000`. Changing this forces a new resource to be created.\u003cbr\u003e net\\_ipv4\\_tcp\\_max\\_tw\\_buckets = (Optional) The sysctl setting net.ipv4.tcp\\_max\\_tw\\_buckets. Must be between `8000` and `1440000`. Changing this forces a new resource to be created.\u003cbr\u003e net\\_ipv4\\_tcp\\_tw\\_reuse = (Optional) The sysctl setting net.ipv4.tcp\\_tw\\_reuse. Changing this forces a new resource to be created.\u003cbr\u003e net\\_netfilter\\_nf\\_conntrack\\_buckets = (Optional) The sysctl setting net.netfilter.nf\\_conntrack\\_buckets. Must be between `65536` and `147456`. Changing this forces a new resource to be created.\u003cbr\u003e net\\_netfilter\\_nf\\_conntrack\\_max = (Optional) The sysctl setting net.netfilter.nf\\_conntrack\\_max. Must be between `131072` and `1048576`. Changing this forces a new resource to be created.\u003cbr\u003e vm\\_max\\_map\\_count = (Optional) The sysctl setting vm.max\\_map\\_count. Must be between `65530` and `262144`. Changing this forces a new resource to be created.\u003cbr\u003e vm\\_swappiness = (Optional) The sysctl setting vm.swappiness. Must be between `0` and `100`. Changing this forces a new resource to be created.\u003cbr\u003e vm\\_vfs\\_cache\\_pressure = (Optional) The sysctl setting vm.vfs\\_cache\\_pressure. Must be between `0` and `100`. Changing this forces a new resource to be created.\u003cbr\u003e })), [])\u003cbr\u003e transparent\\_huge\\_page\\_enabled = (Optional) Specifies the Transparent Huge Page enabled configuration. Possible values are `always`, `madvise` and `never`. Changing this forces a new resource to be created.\u003cbr\u003e transparent\\_huge\\_page\\_defrag = (Optional) specifies the defrag configuration for Transparent Huge Page. Possible values are `always`, `defer`, `defer+madvise`, `madvise` and `never`. Changing this forces a new resource to be created.\u003cbr\u003e swap\\_file\\_size\\_mb = (Optional) Specifies the size of the swap file on each node in MB. Changing this forces a new resource to be created.\u003cbr\u003e})) | \u003cpre\u003elist(object({\u003cbr\u003e sysctl_configs = optional(list(object({\u003cbr\u003e fs_aio_max_nr = optional(number)\u003cbr\u003e fs_file_max = optional(number)\u003cbr\u003e fs_inotify_max_user_watches = optional(number)\u003cbr\u003e fs_nr_open = optional(number)\u003cbr\u003e kernel_threads_max = optional(number)\u003cbr\u003e net_core_netdev_max_backlog = optional(number)\u003cbr\u003e net_core_optmem_max = optional(number)\u003cbr\u003e net_core_rmem_default = optional(number)\u003cbr\u003e net_core_rmem_max = optional(number)\u003cbr\u003e net_core_somaxconn = optional(number)\u003cbr\u003e net_core_wmem_default = optional(number)\u003cbr\u003e net_core_wmem_max = optional(number)\u003cbr\u003e net_ipv4_ip_local_port_range_min = optional(number)\u003cbr\u003e net_ipv4_ip_local_port_range_max = optional(number)\u003cbr\u003e net_ipv4_neigh_default_gc_thresh1 = optional(number)\u003cbr\u003e net_ipv4_neigh_default_gc_thresh2 = optional(number)\u003cbr\u003e net_ipv4_neigh_default_gc_thresh3 = optional(number)\u003cbr\u003e net_ipv4_tcp_fin_timeout = optional(number)\u003cbr\u003e net_ipv4_tcp_keepalive_intvl = optional(number)\u003cbr\u003e net_ipv4_tcp_keepalive_probes = optional(number)\u003cbr\u003e net_ipv4_tcp_keepalive_time = optional(number)\u003cbr\u003e net_ipv4_tcp_max_syn_backlog = optional(number)\u003cbr\u003e net_ipv4_tcp_max_tw_buckets = optional(number)\u003cbr\u003e net_ipv4_tcp_tw_reuse = optional(bool)\u003cbr\u003e net_netfilter_nf_conntrack_buckets = optional(number)\u003cbr\u003e net_netfilter_nf_conntrack_max = optional(number)\u003cbr\u003e vm_max_map_count = optional(number)\u003cbr\u003e vm_swappiness = optional(number)\u003cbr\u003e vm_vfs_cache_pressure = optional(number)\u003cbr\u003e })), [])\u003cbr\u003e transparent_huge_page_enabled = optional(string)\u003cbr\u003e transparent_huge_page_defrag = optional(string)\u003cbr\u003e swap_file_size_mb = optional(number)\u003cbr\u003e }))\u003c/pre\u003e | `[]` | no |\n| \u003ca name=\"input_agents_pool_name\"\u003e\u003c/a\u003e [agents\\_pool\\_name](#input\\_agents\\_pool\\_name) | The default Azure AKS agentpool (nodepool) name. | `string` | `\"nodepool\"` | no |\n| \u003ca name=\"input_agents_proximity_placement_group_id\"\u003e\u003c/a\u003e [agents\\_proximity\\_placement\\_group\\_id](#input\\_agents\\_proximity\\_placement\\_group\\_id) | (Optional) The ID of the Proximity Placement Group of the default Azure AKS agentpool (nodepool). Changing this forces a new resource to be created. | `string` | `null` | no |\n| \u003ca name=\"input_agents_size\"\u003e\u003c/a\u003e [agents\\_size](#input\\_agents\\_size) | The default virtual machine size for the Kubernetes agents. Changing this without specifying `var.temporary_name_for_rotation` forces a new resource to be created. | `string` | `\"Standard_D2_v2\"` | no |\n| \u003ca name=\"input_temporary_name_for_rotation\"\u003e\u003c/a\u003e [temporary\\_name\\_for\\_rotation](#input\\_temporary\\_name\\_for\\_rotation) | (Optional) Specifies the name of the temporary node pool used to cycle the default node pool for VM resizing. the `var.agents_size` is no longer ForceNew and can be resized by specifying `temporary_name_for_rotation` | `string` | `null` | no |\n| \u003ca name=\"input_agents_tags\"\u003e\u003c/a\u003e [agents\\_tags](#input\\_agents\\_tags) | (Optional) A mapping of tags to assign to the Node Pool. | `map(string)` | `{}` | no |\n| \u003ca name=\"input_agents_taints\"\u003e\u003c/a\u003e [agents\\_taints](#input\\_agents\\_taints) | (Optional) A list of the taints added to new nodes during node pool create and scale. Changing this forces a new resource to be created. | `list(string)` | `null` | no |\n| \u003ca name=\"input_agents_type\"\u003e\u003c/a\u003e [agents\\_type](#input\\_agents\\_type) | (Optional) The type of Node Pool which should be created. Possible values are AvailabilitySet and VirtualMachineScaleSets. Defaults to VirtualMachineScaleSets. | `string` | `\"VirtualMachineScaleSets\"` | no |\n| \u003ca name=\"input_api_server_authorized_ip_ranges\"\u003e\u003c/a\u003e [api\\_server\\_authorized\\_ip\\_ranges](#input\\_api\\_server\\_authorized\\_ip\\_ranges) | (Optional) The IP ranges to allow for incoming traffic to the server nodes. | `set(string)` | `null` | no |\n| \u003ca name=\"input_api_server_subnet_id\"\u003e\u003c/a\u003e [api\\_server\\_subnet\\_id](#input\\_api\\_server\\_subnet\\_id) | (Optional) The ID of the Subnet where the API server endpoint is delegated to. | `string` | `null` | no |\n| \u003ca name=\"input_attached_acr_id_map\"\u003e\u003c/a\u003e [attached\\_acr\\_id\\_map](#input\\_attached\\_acr\\_id\\_map) | Azure Container Registry ids that need an authentication mechanism with Azure Kubernetes Service (AKS). Map key must be static string as acr's name, the value is acr's resource id. Changing this forces some new resources to be created. | `map(string)` | `{}` | no |\n| \u003ca name=\"input_enable_auto_scaling\"\u003e\u003c/a\u003e [enable\\_auto\\_scaling](#input\\_enable\\_auto\\_scaling) | Enable node pool autoscaling. Please set `agents_count` `null` while `enable_auto_scaling` is `true` to avoid possible `agents_count` changes. | `bool` | `false` | no |\n| \u003ca name=\"input_auto_scaler_profile_balance_similar_node_groups\"\u003e\u003c/a\u003e [auto\\_scaler\\_profile\\_balance\\_similar\\_node\\_groups](#input\\_auto\\_scaler\\_profile\\_balance\\_similar\\_node\\_groups) | Detect similar node groups and balance the number of nodes between them. Defaults to `false`. | `bool` | `false` | no |\n| \u003ca name=\"input_auto_scaler_profile_empty_bulk_delete_max\"\u003e\u003c/a\u003e [auto\\_scaler\\_profile\\_empty\\_bulk\\_delete\\_max](#input\\_auto\\_scaler\\_profile\\_empty\\_bulk\\_delete\\_max) | Maximum number of empty nodes that can be deleted at the same time. Defaults to `10`. | `number` | `10` | no |\n| \u003ca name=\"input_auto_scaler_profile_enabled\"\u003e\u003c/a\u003e [auto\\_scaler\\_profile\\_enabled](#input\\_auto\\_scaler\\_profile\\_enabled) | Enable configuring the auto scaler profile | `bool` | `false` | no |\n| \u003ca name=\"input_auto_scaler_profile_expander\"\u003e\u003c/a\u003e [auto\\_scaler\\_profile\\_expander](#input\\_auto\\_scaler\\_profile\\_expander) | Expander to use. Possible values are `least-waste`, `priority`, `most-pods` and `random`. Defaults to `random`. | `string` | `\"random\"` | no |\n| \u003ca name=\"input_auto_scaler_profile_max_graceful_termination_sec\"\u003e\u003c/a\u003e [auto\\_scaler\\_profile\\_max\\_graceful\\_termination\\_sec](#input\\_auto\\_scaler\\_profile\\_max\\_graceful\\_termination\\_sec) | Maximum number of seconds the cluster autoscaler waits for pod termination when trying to scale down a node. Defaults to `600`. | `string` | `\"600\"` | no |\n| \u003ca name=\"input_auto_scaler_profile_max_node_provisioning_time\"\u003e\u003c/a\u003e [auto\\_scaler\\_profile\\_max\\_node\\_provisioning\\_time](#input\\_auto\\_scaler\\_profile\\_max\\_node\\_provisioning\\_time) | Maximum time the autoscaler waits for a node to be provisioned. Defaults to `15m`. | `string` | `\"15m\"` | no |\n| \u003ca name=\"input_auto_scaler_profile_max_unready_nodes\"\u003e\u003c/a\u003e [auto\\_scaler\\_profile\\_max\\_unready\\_nodes](#input\\_auto\\_scaler\\_profile\\_max\\_unready\\_nodes) | Maximum Number of allowed unready nodes. Defaults to `3`. | `number` | `3` | no |\n| \u003ca name=\"input_auto_scaler_profile_max_unready_percentage\"\u003e\u003c/a\u003e [auto\\_scaler\\_profile\\_max\\_unready\\_percentage](#input\\_auto\\_scaler\\_profile\\_max\\_unready\\_percentage) | Maximum percentage of unready nodes the cluster autoscaler will stop if the percentage is exceeded. Defaults to `45`. | `number` | `45` | no |\n| \u003ca name=\"input_auto_scaler_profile_new_pod_scale_up_delay\"\u003e\u003c/a\u003e [auto\\_scaler\\_profile\\_new\\_pod\\_scale\\_up\\_delay](#input\\_auto\\_scaler\\_profile\\_new\\_pod\\_scale\\_up\\_delay) | For scenarios like burst/batch scale where you don't want CA to act before the kubernetes scheduler could schedule all the pods, you can tell CA to ignore unscheduled pods before they're a certain age. Defaults to `10s`. | `string` | `\"10s\"` | no |\n| \u003ca name=\"input_auto_scaler_profile_scale_down_delay_after_add\"\u003e\u003c/a\u003e [auto\\_scaler\\_profile\\_scale\\_down\\_delay\\_after\\_add](#input\\_auto\\_scaler\\_profile\\_scale\\_down\\_delay\\_after\\_add) | How long after the scale up of AKS nodes the scale down evaluation resumes. Defaults to `10m`. | `string` | `\"10m\"` | no |\n| \u003ca name=\"input_auto_scaler_profile_scale_down_delay_after_delete\"\u003e\u003c/a\u003e [auto\\_scaler\\_profile\\_scale\\_down\\_delay\\_after\\_delete](#input\\_auto\\_scaler\\_profile\\_scale\\_down\\_delay\\_after\\_delete) | How long after node deletion that scale down evaluation resumes. Defaults to the value used for `scan_interval`. | `string` | `null` | no |\n| \u003ca name=\"input_auto_scaler_profile_scale_down_delay_after_failure\"\u003e\u003c/a\u003e [auto\\_scaler\\_profile\\_scale\\_down\\_delay\\_after\\_failure](#input\\_auto\\_scaler\\_profile\\_scale\\_down\\_delay\\_after\\_failure) | How long after scale down failure that scale down evaluation resumes. Defaults to `3m`. | `string` | `\"3m\"` | no |\n| \u003ca name=\"input_auto_scaler_profile_scale_down_unneeded\"\u003e\u003c/a\u003e [auto\\_scaler\\_profile\\_scale\\_down\\_unneeded](#input\\_auto\\_scaler\\_profile\\_scale\\_down\\_unneeded) | How long a node should be unneeded before it is eligible for scale down. Defaults to `10m`. | `string` | `\"10m\"` | no |\n| \u003ca name=\"input_auto_scaler_profile_scale_down_unready\"\u003e\u003c/a\u003e [auto\\_scaler\\_profile\\_scale\\_down\\_unready](#input\\_auto\\_scaler\\_profile\\_scale\\_down\\_unready) | How long an unready node should be unneeded before it is eligible for scale down. Defaults to `20m`. | `string` | `\"20m\"` | no |\n| \u003ca name=\"input_auto_scaler_profile_scale_down_utilization_threshold\"\u003e\u003c/a\u003e [auto\\_scaler\\_profile\\_scale\\_down\\_utilization\\_threshold](#input\\_auto\\_scaler\\_profile\\_scale\\_down\\_utilization\\_threshold) | Node utilization level, defined as sum of requested resources divided by capacity, below which a node can be considered for scale down. Defaults to `0.5`. | `string` | `\"0.5\"` | no |\n| \u003ca name=\"input_auto_scaler_profile_scan_interval\"\u003e\u003c/a\u003e [auto\\_scaler\\_profile\\_scan\\_interval](#input\\_auto\\_scaler\\_profile\\_scan\\_interval) | How often the AKS Cluster should be re-evaluated for scale up/down. Defaults to `10s`. | `string` | `\"10s\"` | no |\n| \u003ca name=\"input_auto_scaler_profile_skip_nodes_with_local_storage\"\u003e\u003c/a\u003e [auto\\_scaler\\_profile\\_skip\\_nodes\\_with\\_local\\_storage](#input\\_auto\\_scaler\\_profile\\_skip\\_nodes\\_with\\_local\\_storage) | If `true` cluster autoscaler will never delete nodes with pods with local storage, for example, EmptyDir or HostPath. Defaults to `true`. | `bool` | `true` | no |\n| \u003ca name=\"input_auto_scaler_profile_skip_nodes_with_system_pods\"\u003e\u003c/a\u003e [auto\\_scaler\\_profile\\_skip\\_nodes\\_with\\_system\\_pods](#input\\_auto\\_scaler\\_profile\\_skip\\_nodes\\_with\\_system\\_pods) | If `true` cluster autoscaler will never delete nodes with pods from kube-system (except for DaemonSet or mirror pods). Defaults to `true`. | `bool` | `true` | no |\n| \u003ca name=\"input_os_disk_size_gb\"\u003e\u003c/a\u003e [os\\_disk\\_size\\_gb](#input\\_os\\_disk\\_size\\_gb) | Disk size of nodes in GBs. | `number` | `50` | no |\n| \u003ca name=\"input_os_disk_type\"\u003e\u003c/a\u003e [os\\_disk\\_type](#input\\_os\\_disk\\_type) | The type of disk which should be used for the Operating System. Possible values are `Ephemeral` and `Managed`. Defaults to `Managed`. Changing this forces a new resource to be created. | `string` | `\"Managed\"` | no |\n| \u003ca name=\"input_os_sku\"\u003e\u003c/a\u003e [os\\_sku](#input\\_os\\_sku) | (Optional) Specifies the OS SKU used by the agent pool. Possible values include: `Ubuntu`, `CBLMariner`, `Mariner`, `Windows2019`, `Windows2022`. If not specified, the default is `Ubuntu` if OSType=Linux or `Windows2019` if OSType=Windows. And the default Windows OSSKU will be changed to `Windows2022` after Windows2019 is deprecated. Changing this forces a new resource to be created. | `string` | `null` | no |\n| \u003ca name=\"input_pod_subnet_id\"\u003e\u003c/a\u003e [pod\\_subnet\\_id](#input\\_pod\\_subnet\\_id) | (Optional) The ID of the Subnet where the pods in the default Node Pool should exist. Changing this forces a new resource to be created. | `string` | `null` | no |\n| \u003ca name=\"input_rbac_aad\"\u003e\u003c/a\u003e [rbac\\_aad](#input\\_rbac\\_aad) | (Optional) Is Azure Active Directory integration enabled? | `bool` | `false` | no |\n| \u003ca name=\"input_rbac_aad_admin_group_object_ids\"\u003e\u003c/a\u003e [rbac\\_aad\\_admin\\_group\\_object\\_ids](#input\\_rbac\\_aad\\_admin\\_group\\_object\\_ids) | Object ID of groups with admin access. | `list(string)` | `null` | no |\n| \u003ca name=\"input_rbac_aad_azure_rbac_enabled\"\u003e\u003c/a\u003e [rbac\\_aad\\_azure\\_rbac\\_enabled](#input\\_rbac\\_aad\\_azure\\_rbac\\_enabled) | (Optional) Is Role Based Access Control based on Azure AD enabled? | `bool` | `null` | no |\n| \u003ca name=\"input_rbac_aad_client_app_id\"\u003e\u003c/a\u003e [rbac\\_aad\\_client\\_app\\_id](#input\\_rbac\\_aad\\_client\\_app\\_id) | The Client ID of an Azure Active Directory Application. | `string` | `null` | no |\n| \u003ca name=\"input_rbac_aad_managed\"\u003e\u003c/a\u003e [rbac\\_aad\\_managed](#input\\_rbac\\_aad\\_managed) | Is the Azure Active Directory integration Managed, meaning that Azure will create/manage the Service Principal used for integration. | `bool` | `false` | no |\n| \u003ca name=\"input_rbac_aad_server_app_id\"\u003e\u003c/a\u003e [rbac\\_aad\\_server\\_app\\_id](#input\\_rbac\\_aad\\_server\\_app\\_id) | The Server ID of an Azure Active Directory Application. | `string` | `null` | no |\n| \u003ca name=\"input_rbac_aad_server_app_secret\"\u003e\u003c/a\u003e [rbac\\_aad\\_server\\_app\\_secret](#input\\_rbac\\_aad\\_server\\_app\\_secret) | The Server Secret of an Azure Active Directory Application. | `string` | `null` | no |\n| \u003ca name=\"input_rbac_aad_tenant_id\"\u003e\u003c/a\u003e [rbac\\_aad\\_tenant\\_id](#input\\_rbac\\_aad\\_tenant\\_id) | (Optional) The Tenant ID used for Azure Active Directory Application. If this isn't specified the Tenant ID of the current Subscription is used. | `string` | `null` | no |\n| \u003ca name=\"input_role_based_access_control_enabled\"\u003e\u003c/a\u003e [role\\_based\\_access\\_control\\_enabled](#input\\_role\\_based\\_access\\_control\\_enabled) | Enable Role Based Access Control. If this is disabled, then identity\\_type='SystemAssigned' by default | `bool` | `false` | no |\n| \u003ca name=\"input_local_account_disabled\"\u003e\u003c/a\u003e [local\\_account\\_disabled](#input\\_local\\_account\\_disabled) | (Optional) - If `true` local accounts will be disabled. Defaults to `false`. See [the documentation](https://docs.microsoft.com/azure/aks/managed-aad#disable-local-accounts) for more information. | `bool` | `null` | no |\n| \u003ca name=\"input_oidc_issuer_enabled\"\u003e\u003c/a\u003e [oidc\\_issuer\\_enabled](#input\\_oidc\\_issuer\\_enabled) | Enable or Disable the OIDC issuer URL. Defaults to false. | `bool` | `false` | no |\n| \u003ca name=\"input_workload_identity_enabled\"\u003e\u003c/a\u003e [workload\\_identity\\_enabled](#input\\_workload\\_identity\\_enabled) | Enable or Disable Workload Identity. If enabled, oidc\\_issuer\\_enabled must be true. Defaults to false. | `bool` | `false` | no |\n| \u003ca name=\"input_cluster_log_analytics_workspace_name\"\u003e\u003c/a\u003e [cluster\\_log\\_analytics\\_workspace\\_name](#input\\_cluster\\_log\\_analytics\\_workspace\\_name) | (Optional) The name of the Analytics workspace to create | `string` | `null` | no |\n| \u003ca name=\"input_log_analytics_workspace\"\u003e\u003c/a\u003e [log\\_analytics\\_workspace](#input\\_log\\_analytics\\_workspace) | (Optional) Existing azurerm\\_log\\_analytics\\_workspace to attach azurerm\\_log\\_analytics\\_solution. Providing the config disables creation of azurerm\\_log\\_analytics\\_workspace. | \u003cpre\u003eobject({\u003cbr\u003e id = string\u003cbr\u003e name = string\u003cbr\u003e location = optional(string)\u003cbr\u003e resource_group_name = optional(string)\u003cbr\u003e })\u003c/pre\u003e | `null` | no |\n| \u003ca name=\"input_log_analytics_workspace_allow_resource_only_permissions\"\u003e\u003c/a\u003e [log\\_analytics\\_workspace\\_allow\\_resource\\_only\\_permissions](#input\\_log\\_analytics\\_workspace\\_allow\\_resource\\_only\\_permissions) | (Optional) Specifies if the log Analytics Workspace allow users accessing to data associated with resources they have permission to view, without permission to workspace. Defaults to `true`. | `bool` | `null` | no |\n| \u003ca name=\"input_log_analytics_workspace_cmk_for_query_forced\"\u003e\u003c/a\u003e [log\\_analytics\\_workspace\\_cmk\\_for\\_query\\_forced](#input\\_log\\_analytics\\_workspace\\_cmk\\_for\\_query\\_forced) | (Optional) Is Customer Managed Storage mandatory for query management? | `bool` | `null` | no |\n| \u003ca name=\"input_log_analytics_workspace_daily_quota_gb\"\u003e\u003c/a\u003e [log\\_analytics\\_workspace\\_daily\\_quota\\_gb](#input\\_log\\_analytics\\_workspace\\_daily\\_quota\\_gb) | (Optional) The workspace daily quota for ingestion in GB. Defaults to -1 (unlimited) if omitted. | `number` | `null` | no |\n| \u003ca name=\"input_log_analytics_workspace_data_collection_rule_id\"\u003e\u003c/a\u003e [log\\_analytics\\_workspace\\_data\\_collection\\_rule\\_id](#input\\_log\\_analytics\\_workspace\\_data\\_collection\\_rule\\_id) | (Optional) The ID of the Data Collection Rule to use for this workspace. | `string` | `null` | no |\n| \u003ca name=\"input_log_analytics_workspace_enabled\"\u003e\u003c/a\u003e [log\\_analytics\\_workspace\\_enabled](#input\\_log\\_analytics\\_workspace\\_enabled) | Enable the integration of azurerm\\_log\\_analytics\\_workspace and azurerm\\_log\\_analytics\\_solution: https://docs.microsoft.com/en-us/azure/azure-monitor/containers/container-insights-onboard | `bool` | `true` | no |\n| \u003ca name=\"input_log_analytics_workspace_resource_group_name\"\u003e\u003c/a\u003e [log\\_analytics\\_workspace\\_resource\\_group\\_name](#input\\_log\\_analytics\\_workspace\\_resource\\_group\\_name) | (Optional) Resource group name to create azurerm\\_log\\_analytics\\_solution. | `string` | `null` | no |\n| \u003ca name=\"input_log_analytics_workspace_sku\"\u003e\u003c/a\u003e [log\\_analytics\\_workspace\\_sku](#input\\_log\\_analytics\\_workspace\\_sku) | The SKU (pricing level) of the Log Analytics workspace. For new subscriptions the SKU should be set to PerGB2018 | `string` | `\"PerGB2018\"` | no |\n| \u003ca name=\"input_log_analytics_workspace_identity\"\u003e\u003c/a\u003e [log\\_analytics\\_workspace\\_identity](#input\\_log\\_analytics\\_workspace\\_identity) | - `identity_ids` - (Optional) Specifies a list of user managed identity ids to be assigned. Required if `type` is `UserAssigned`.\u003cbr\u003e- `type` - (Required) Specifies the identity type of the Log Analytics Workspace. Possible values are `SystemAssigned` (where Azure will generate a Service Principal for you) and `UserAssigned` where you can specify the Service Principal IDs in the `identity_ids` field. | \u003cpre\u003eobject({\u003cbr\u003e identity_ids = optional(set(string))\u003cbr\u003e type = string\u003cbr\u003e })\u003c/pre\u003e | `null` | no |\n| \u003ca name=\"input_log_analytics_workspace_immediate_data_purge_on_30_days_enabled\"\u003e\u003c/a\u003e [log\\_analytics\\_workspace\\_immediate\\_data\\_purge\\_on\\_30\\_days\\_enabled](#input\\_log\\_analytics\\_workspace\\_immediate\\_data\\_purge\\_on\\_30\\_days\\_enabled) | (Optional) Whether to remove the data in the Log Analytics Workspace immediately after 30 days. | `bool` | `null` | no |\n| \u003ca name=\"input_log_analytics_workspace_internet_ingestion_enabled\"\u003e\u003c/a\u003e [log\\_analytics\\_workspace\\_internet\\_ingestion\\_enabled](#input\\_log\\_analytics\\_workspace\\_internet\\_ingestion\\_enabled) | (Optional) Should the Log Analytics Workspace support ingestion over the Public Internet? Defaults to `true`. | `bool` | `null` | no |\n| \u003ca name=\"input_log_analytics_workspace_internet_query_enabled\"\u003e\u003c/a\u003e [log\\_analytics\\_workspace\\_internet\\_query\\_enabled](#input\\_log\\_analytics\\_workspace\\_internet\\_query\\_enabled) | (Optional) Should the Log Analytics Workspace support querying over the Public Internet? Defaults to `true`. | `bool` | `null` | no |\n| \u003ca name=\"input_log_analytics_workspace_local_authentication_disabled\"\u003e\u003c/a\u003e [log\\_analytics\\_workspace\\_local\\_authentication\\_disabled](#input\\_log\\_analytics\\_workspace\\_local\\_authentication\\_disabled) | (Optional) Specifies if the log Analytics workspace should enforce authentication using Azure AD. Defaults to `false`. | `bool` | `null` | no |\n| \u003ca name=\"input_log_analytics_workspace_reservation_capacity_in_gb_per_day\"\u003e\u003c/a\u003e [log\\_analytics\\_workspace\\_reservation\\_capacity\\_in\\_gb\\_per\\_day](#input\\_log\\_analytics\\_workspace\\_reservation\\_capacity\\_in\\_gb\\_per\\_day) | (Optional) The capacity reservation level in GB for this workspace. Possible values are `100`, `200`, `300`, `400`, `500`, `1000`, `2000` and `5000`. | `number` | `null` | no |\n| \u003ca name=\"input_log_retention_in_days\"\u003e\u003c/a\u003e [log\\_retention\\_in\\_days](#input\\_log\\_retention\\_in\\_days) | The retention period for the logs in days | `number` | `30` | no |\n| \u003ca name=\"input_node_pools\"\u003e\u003c/a\u003e [node\\_pools](#input\\_node\\_pools) | A map of node pools that need to be created and attached on the Kubernetes cluster. The key of the map can be the name of the node pool, and the key must be static string. The value of the map is a `node_pool` block as defined below:\u003cbr\u003emap(object({\u003cbr\u003e name = (Required) The name of the Node Pool which should be created within the Kubernetes Cluster. Changing this forces a new resource to be created. A Windows Node Pool cannot have a `name` longer than 6 characters. A random suffix of 4 characters is always added to the name to avoid clashes during recreates.\u003cbr\u003e node\\_count = (Optional) The initial number of nodes which should exist within this Node Pool. Valid values are between `0` and `1000` (inclusive) for user pools and between `1` and `1000` (inclusive) for system pools and must be a value in the range `min_count` - `max_count`.\u003cbr\u003e tags = (Optional) A mapping of tags to assign to the resource. At this time there's a bug in the AKS API where Tags for a Node Pool are not stored in the correct case - you [may wish to use Terraform's `ignore_changes` functionality to ignore changes to the casing](https://www.terraform.io/language/meta-arguments/lifecycle#ignore_changess) until this is fixed in the AKS API.\u003cbr\u003e vm\\_size = (Required) The SKU which should be used for the Virtual Machines used in this Node Pool. Changing this forces a new resource to be created.\u003cbr\u003e host\\_group\\_id = (Optional) The fully qualified resource ID of the Dedicated Host Group to provision virtual machines from. Changing this forces a new resource to be created.\u003cbr\u003e capacity\\_reservation\\_group\\_id = (Optional) Specifies the ID of the Capacity Reservation Group where this Node Pool should exist. Changing this forces a new resource to be created.\u003cbr\u003e custom\\_ca\\_trust\\_enabled = (Optional) Specifies whether to trust a Custom CA. This requires that the Preview Feature `Microsoft.ContainerService/CustomCATrustPreview` is enabled and the Resource Provider is re-registered, see [the documentation](https://learn.microsoft.com/en-us/azure/aks/custom-certificate-authority) for more information.\u003cbr\u003e enable\\_auto\\_scaling = (Optional) Whether to enable [auto-scaler](https://docs.microsoft.com/azure/aks/cluster-autoscaler).\u003cbr\u003e enable\\_host\\_encryption = (Optional) Should the nodes in this Node Pool have host encryption enabled? Changing this forces a new resource to be created.\u003cbr\u003e enable\\_node\\_public\\_ip = (Optional) Should each node have a Public IP Address? Changing this forces a new resource to be created.\u003cbr\u003e eviction\\_policy = (Optional) The Eviction Policy which should be used for Virtual Machines within the Virtual Machine Scale Set powering this Node Pool. Possible values are `Deallocate` and `Delete`. Changing this forces a new resource to be created. An Eviction Policy can only be configured when `priority` is set to `Spot` and will default to `Delete` unless otherwise specified.\u003cbr\u003e gpu\\_instance = (Optional) Specifies the GPU MIG instance profile for supported GPU VM SKU. The allowed values are `MIG1g`, `MIG2g`, `MIG3g`, `MIG4g` and `MIG7g`. Changing this forces a new resource to be created.\u003cbr\u003e kubelet\\_config = optional(object({\u003cbr\u003e cpu\\_manager\\_policy = (Optional) Specifies the CPU Manager policy to use. Possible values are `none` and `static`, Changing this forces a new resource to be created.\u003cbr\u003e cpu\\_cfs\\_quota\\_enabled = (Optional) Is CPU CFS quota enforcement for containers enabled? Changing this forces a new resource to be created.\u003cbr\u003e cpu\\_cfs\\_quota\\_period = (Optional) Specifies the CPU CFS quota period value. Changing this forces a new resource to be created.\u003cbr\u003e image\\_gc\\_high\\_threshold = (Optional) Specifies the percent of disk usage above which image garbage collection is always run. Must be between `0` and `100`. Changing this forces a new resource to be created.\u003cbr\u003e image\\_gc\\_low\\_threshold = (Optional) Specifies the percent of disk usage lower than which image garbage collection is never run. Must be between `0` and `100`. Changing this forces a new resource to be created.\u003cbr\u003e topology\\_manager\\_policy = (Optional) Specifies the Topology Manager policy to use. Possible values are `none`, `best-effort`, `restricted` or `single-numa-node`. Changing this forces a new resource to be created.\u003cbr\u003e allowed\\_unsafe\\_sysctls = (Optional) Specifies the allow list of unsafe sysctls command or patterns (ending in `*`). Changing this forces a new resource to be created.\u003cbr\u003e container\\_log\\_max\\_size\\_mb = (Optional) Specifies the maximum size (e.g. 10MB) of container log file before it is rotated. Changing this forces a new resource to be created.\u003cbr\u003e container\\_log\\_max\\_files = (Optional) Specifies the maximum number of container log files that can be present for a container. must be at least 2. Changing this forces a new resource to be created.\u003cbr\u003e pod\\_max\\_pid = (Optional) Specifies the maximum number of processes per pod. Changing this forces a new resource to be created.\u003cbr\u003e }))\u003cbr\u003e linux\\_os\\_config = optional(object({\u003cbr\u003e sysctl\\_config = optional(object({\u003cbr\u003e fs\\_aio\\_max\\_nr = (Optional) The sysctl setting fs.aio-max-nr. Must be between `65536` and `6553500`. Changing this forces a new resource to be created.\u003cbr\u003e fs\\_file\\_max = (Optional) The sysctl setting fs.file-max. Must be between `8192` and `12000500`. Changing this forces a new resource to be created.\u003cbr\u003e fs\\_inotify\\_max\\_user\\_watches = (Optional) The sysctl setting fs.inotify.max\\_user\\_watches. Must be between `781250` and `2097152`. Changing this forces a new resource to be created.\u003cbr\u003e fs\\_nr\\_open = (Optional) The sysctl setting fs.nr\\_open. Must be between `8192` and `20000500`. Changing this forces a new resource to be created.\u003cbr\u003e kernel\\_threads\\_max = (Optional) The sysctl setting kernel.threads-max. Must be between `20` and `513785`. Changing this forces a new resource to be created.\u003cbr\u003e net\\_core\\_netdev\\_max\\_backlog = (Optional) The sysctl setting net.core.netdev\\_max\\_backlog. Must be between `1000` and `3240000`. Changing this forces a new resource to be created.\u003cbr\u003e net\\_core\\_optmem\\_max = (Optional) The sysctl setting net.core.optmem\\_max. Must be between `20480` and `4194304`. Changing this forces a new resource to be created.\u003cbr\u003e net\\_core\\_rmem\\_default = (Optional) The sysctl setting net.core.rmem\\_default. Must be between `212992` and `134217728`. Changing this forces a new resource to be created.\u003cbr\u003e net\\_core\\_rmem\\_max = (Optional) The sysctl setting net.core.rmem\\_max. Must be between `212992` and `134217728`. Changing this forces a new resource to be created.\u003cbr\u003e net\\_core\\_somaxconn = (Optional) The sysctl setting net.core.somaxconn. Must be between `4096` and `3240000`. Changing this forces a new resource to be created.\u003cbr\u003e net\\_core\\_wmem\\_default = (Optional) The sysctl setting net.core.wmem\\_default. Must be between `212992` and `134217728`. Changing this forces a new resource to be created.\u003cbr\u003e net\\_core\\_wmem\\_max = (Optional) The sysctl setting net.core.wmem\\_max. Must be between `212992` and `134217728`. Changing this forces a new resource to be created.\u003cbr\u003e net\\_ipv4\\_ip\\_local\\_port\\_range\\_min = (Optional) The sysctl setting net.ipv4.ip\\_local\\_port\\_range min value. Must be between `1024` and `60999`. Changing this forces a new resource to be created.\u003cbr\u003e net\\_ipv4\\_ip\\_local\\_port\\_range\\_max = (Optional) The sysctl setting net.ipv4.ip\\_local\\_port\\_range max value. Must be between `1024` and `60999`. Changing this forces a new resource to be created.\u003cbr\u003e net\\_ipv4\\_neigh\\_default\\_gc\\_thresh1 = (Optional) The sysctl setting net.ipv4.neigh.default.gc\\_thresh1. Must be between `128` and `80000`. Changing this forces a new resource to be created.\u003cbr\u003e net\\_ipv4\\_neigh\\_default\\_gc\\_thresh2 = (Optional) The sysctl setting net.ipv4.neigh.default.gc\\_thresh2. Must be between `512` and `90000`. Changing this forces a new resource to be created.\u003cbr\u003e net\\_ipv4\\_neigh\\_default\\_gc\\_thresh3 = (Optional) The sysctl setting net.ipv4.neigh.default.gc\\_thresh3. Must be between `1024` and `100000`. Changing this forces a new resource to be created.\u003cbr\u003e net\\_ipv4\\_tcp\\_fin\\_timeout = (Optional) The sysctl setting net.ipv4.tcp\\_fin\\_timeout. Must be between `5` and `120`. Changing this forces a new resource to be created.\u003cbr\u003e net\\_ipv4\\_tcp\\_keepalive\\_intvl = (Optional) The sysctl setting net.ipv4.tcp\\_keepalive\\_intvl. Must be between `10` and `75`. Changing this forces a new resource to be created.\u003cbr\u003e net\\_ipv4\\_tcp\\_keepalive\\_probes = (Optional) The sysctl setting net.ipv4.tcp\\_keepalive\\_probes. Must be between `1` and `15`. Changing this forces a new resource to be created.\u003cbr\u003e net\\_ipv4\\_tcp\\_keepalive\\_time = (Optional) The sysctl setting net.ipv4.tcp\\_keepalive\\_time. Must be between `30` and `432000`. Changing this forces a new resource to be created.\u003cbr\u003e net\\_ipv4\\_tcp\\_max\\_syn\\_backlog = (Optional) The sysctl setting net.ipv4.tcp\\_max\\_syn\\_backlog. Must be between `128` and `3240000`. Changing this forces a new resource to be created.\u003cbr\u003e net\\_ipv4\\_tcp\\_max\\_tw\\_buckets = (Optional) The sysctl setting net.ipv4.tcp\\_max\\_tw\\_buckets. Must be between `8000` and `1440000`. Changing this forces a new resource to be created.\u003cbr\u003e net\\_ipv4\\_tcp\\_tw\\_reuse = (Optional) Is sysctl setting net.ipv4.tcp\\_tw\\_reuse enabled? Changing this forces a new resource to be created.\u003cbr\u003e net\\_netfilter\\_nf\\_conntrack\\_buckets = (Optional) The sysctl setting net.netfilter.nf\\_conntrack\\_buckets. Must be between `65536` and `147456`. Changing this forces a new resource to be created.\u003cbr\u003e net\\_netfilter\\_nf\\_conntrack\\_max = (Optional) The sysctl setting net.netfilter.nf\\_conntrack\\_max. Must be between `131072` and `1048576`. Changing this forces a new resource to be created.\u003cbr\u003e vm\\_max\\_map\\_count = (Optional) The sysctl setting vm.max\\_map\\_count. Must be between `65530` and `262144`. Changing this forces a new resource to be created.\u003cbr\u003e vm\\_swappiness = (Optional) The sysctl setting vm.swappiness. Must be between `0` and `100`. Changing this forces a new resource to be created.\u003cbr\u003e vm\\_vfs\\_cache\\_pressure = (Optional) The sysctl setting vm.vfs\\_cache\\_pressure. Must be between `0` and `100`. Changing this forces a new resource to be created.\u003cbr\u003e }))\u003cbr\u003e transparent\\_huge\\_page\\_enabled = (Optional) Specifies the Transparent Huge Page enabled configuration. Possible values are `always`, `madvise` and `never`. Changing this forces a new resource to be created.\u003cbr\u003e transparent\\_huge\\_page\\_defrag = (Optional) specifies the defrag configuration for Transparent Huge Page. Possible values are `always`, `defer`, `defer+madvise`, `madvise` and `never`. Changing this forces a new resource to be created.\u003cbr\u003e swap\\_file\\_size\\_mb = (Optional) Specifies the size of swap file on each node in MB. Changing this forces a new resource to be created.\u003cbr\u003e }))\u003cbr\u003e fips\\_enabled = (Optional) Should the nodes in this Node Pool have Federal Information Processing Standard enabled? Changing this forces a new resource to be created. FIPS support is in Public Preview - more information and details on how to opt into the Preview can be found in [this article](https://docs.microsoft.com/azure/aks/use-multiple-node-pools#add-a-fips-enabled-node-pool-preview).\u003cbr\u003e kubelet\\_disk\\_type = (Optional) The type of disk used by kubelet. Possible values are `OS` and `Temporary`.\u003cbr\u003e max\\_count = (Optional) The maximum number of nodes which should exist within this Node Pool. Valid values are between `0` and `1000` and must be greater than or equal to `min_count`.\u003cbr\u003e max\\_pods = (Optional) The minimum number of nodes which should exist within this Node Pool. Valid values are between `0` and `1000` and must be less than or equal to `max_count`.\u003cbr\u003e message\\_of\\_the\\_day = (Optional) A base64-encoded string which will be written to /etc/motd after decoding. This allows customization of the message of the day for Linux nodes. It cannot be specified for Windows nodes and must be a static string (i.e. will be printed raw and not executed as a script). Changing this forces a new resource to be created.\u003cbr\u003e mode = (Optional) Should this Node Pool be used for System or User resources? Possible values are `System` and `User`. Defaults to `User`.\u003cbr\u003e min\\_count = (Optional) The minimum number of nodes which should exist within this Node Pool. Valid values are between `0` and `1000` and must be less than or equal to `max_count`.\u003cbr\u003e node\\_network\\_profile = optional(object({\u003cbr\u003e node\\_public\\_ip\\_tags = (Optional) Specifies a mapping of tags to the instance-level public IPs. Changing this forces a new resource to be created.\u003cbr\u003e }))\u003cbr\u003e node\\_labels = (Optional) A map of Kubernetes labels which should be applied to nodes in this Node Pool.\u003cbr\u003e node\\_public\\_ip\\_prefix\\_id = (Optional) Resource ID for the Public IP Addresses Prefix for the nodes in this Node Pool. `enable_node_public_ip` should be `true`. Changing this forces a new resource to be created.\u003cbr\u003e node\\_taints = (Optional) A list of Kubernetes taints which should be applied to nodes in the agent pool (e.g `key=value:NoSchedule`). Changing this forces a new resource to be created.\u003cbr\u003e orchestrator\\_version = (Optional) Version of Kubernetes used for the Agents. If not specified, the latest recommended version will be used at provisioning time (but won't auto-upgrade). AKS does not require an exact patch version to be specified, minor version aliases such as `1.22` are also supported. - The minor version's latest GA patch is automatically chosen in that case. More details can be found in [the documentation](https://docs.microsoft.com/en-us/azure/aks/supported-kubernetes-versions?tabs=azure-cli#alias-minor-version). This version must be supported by the Kubernetes Cluster - as such the version of Kubernetes used on the Cluster/Control Plane may need to be upgraded first.\u003cbr\u003e os\\_disk\\_size\\_gb = (Optional) The Agent Operating System disk size in GB. Changing this forces a new resource to be created.\u003cbr\u003e os\\_disk\\_type = (Optional) The type of disk which should be used for the Operating System. Possible values are `Ephemeral` and `Managed`. Defaults to `Managed`. Changing this forces a new resource to be created.\u003cbr\u003e os\\_sku = (Optional) Specifies the OS SKU used by the agent pool. Possible values include: `Ubuntu`, `CBLMariner`, `Mariner`, `Windows2019`, `Windows2022`. If not specified, the default is `Ubuntu` if OSType=Linux or `Windows2019` if OSType=Windows. And the default Windows OSSKU will be changed to `Windows2022` after Windows2019 is deprecated. Changing this forces a new resource to be created.\u003cbr\u003e os\\_type = (Optional) The Operating System which should be used for this Node Pool. Changing this forces a new resource to be created. Possible values are `Linux` and `Windows`. Defaults to `Linux`.\u003cbr\u003e pod\\_subnet\\_id = (Optional) The ID of the Subnet where the pods in the Node Pool should exist. Changing this forces a new resource to be created.\u003cbr\u003e priority = (Optional) The Priority for Virtual Machines within the Virtual Machine Scale Set that powers this Node Pool. Possible values are `Regular` and `Spot`. Defaults to `Regular`. Changing this forces a new resource to be created.\u003cbr\u003e proximity\\_placement\\_group\\_id = (Optional) The ID of the Proximity Placement Group where the Virtual Machine Scale Set that powers this Node Pool will be placed. Changing this forces a new resource to be created. When setting `priority` to Spot - you must configure an `eviction_policy`, `spot_max_price` and add the applicable `node_labels` and `node_taints` [as per the Azure Documentation](https://docs.microsoft.com/azure/aks/spot-node-pool).\u003cbr\u003e spot\\_max\\_price = (Optional) The maximum price you're willing to pay in USD per Virtual Machine. Valid values are `-1` (the current on-demand price for a Virtual Machine) or a positive value with up to five decimal places. Changing this forces a new resource to be created. This field can only be configured when `priority` is set to `Spot`.\u003cbr\u003e scale\\_down\\_mode = (Optional) Specifies how the node pool should deal with scaled-down nodes. Allowed values are `Delete` and `Deallocate`. Defaults to `Delete`.\u003cbr\u003e snapshot\\_id = (Optional) The ID of the Snapshot which should be used to create this Node Pool. Changing this forces a new resource to be created.\u003cbr\u003e ultra\\_ssd\\_enabled = (Optional) Used to specify whether the UltraSSD is enabled in the Node Pool. Defaults to `false`. See [the documentation](https://docs.microsoft.com/azure/aks/use-ultra-disks) for more information. Changing this forces a new resource to be created.\u003cbr\u003e vnet\\_subnet\\_id = (Optional) The ID of the Subnet where this Node Pool should exist. Changing this forces a new resource to be created. A route table must be configured on this Subnet.\u003cbr\u003e upgrade\\_settings = optional(object({\u003cbr\u003e drain\\_timeout\\_in\\_minutes = number\u003cbr\u003e node\\_soak\\_duration\\_in\\_minutes = number\u003cbr\u003e max\\_surge = string\u003cbr\u003e }))\u003cbr\u003e windows\\_profile = optional(object({\u003cbr\u003e outbound\\_nat\\_enabled = optional(bool, true)\u003cbr\u003e }))\u003cbr\u003e workload\\_runtime = (Optional) Used to specify the workload runtime. Allowed values are `OCIContainer` and `WasmWasi`. WebAssembly System Interface node pools are in Public Preview - more information and details on how to opt into the preview can be found in [this article](https://docs.microsoft.com/azure/aks/use-wasi-node-pools)\u003cbr\u003e zones = (Optional) Specifies a list of Availability Zones in which this Kubernetes Cluster Node Pool should be located. Changing this forces a new Kubernetes Cluster Node Pool to be created.\u003cbr\u003e create\\_before\\_destroy = (Optional) Create a new node pool before destroy the old one when Terraform must update an argument that cannot be updated in-place. Set this argument to `true` will add add a random suffix to pool's name to avoid conflict. Default to `true`.\u003cbr\u003e})) | \u003cpre\u003emap(object({\u003cbr\u003e name = string\u003cbr\u003e node_count = optional(number)\u003cbr\u003e tags = optional(map(string))\u003cbr\u003e vm_size = string\u003cbr\u003e host_group_id = optional(string)\u003cbr\u003e capacity_reservation_group_id = optional(string)\u003cbr\u003e custom_ca_trust_enabled = optional(bool)\u003cbr\u003e enable_auto_scaling = optional(bool)\u003cbr\u003e enable_host_encryption = optional(bool)\u003cbr\u003e enable_node_public_ip = optional(bool)\u003cbr\u003e eviction_policy = optional(string)\u003cbr\u003e gpu_instance = optional(string)\u003cbr\u003e kubelet_config = optional(object({\u003cbr\u003e cpu_manager_policy = optional(string)\u003cbr\u003e cpu_cfs_quota_enabled = optional(bool)\u003cbr\u003e cpu_cfs_quota_period = optional(string)\u003cbr\u003e image_gc_high_threshold = optional(number)\u003cbr\u003e image_gc_low_threshold = optional(number)\u003cbr\u003e topology_manager_policy = optional(string)\u003cbr\u003e allowed_unsafe_sysctls = optional(set(string))\u003cbr\u003e container_log_max_size_mb = optional(number)\u003cbr\u003e container_log_max_files = optional(number)\u003cbr\u003e pod_max_pid = optional(number)\u003cbr\u003e }))\u003cbr\u003e linux_os_config = optional(object({\u003cbr\u003e sysctl_config = optional(object({\u003cbr\u003e fs_aio_max_nr = optional(number)\u003cbr\u003e fs_file_max = optional(number)\u003cbr\u003e fs_inotify_max_user_watches = optional(number)\u003cbr\u003e fs_nr_open = optional(number)\u003cbr\u003e kernel_threads_max = optional(number)\u003cbr\u003e net_core_netdev_max_backlog = optional(number)\u003cbr\u003e net_core_optmem_max = optional(number)\u003cbr\u003e net_core_rmem_default = optional(number)\u003cbr\u003e net_core_rmem_max = optional(number)\u003cbr\u003e net_core_somaxconn = optional(number)\u003cbr\u003e net_core_wmem_default = optional(number)\u003cbr\u003e net_core_wmem_max = optional(number)\u003cbr\u003e net_ipv4_ip_local_port_range_min = optional(number)\u003cbr\u003e net_ipv4_ip_local_port_range_max = optional(number)\u003cbr\u003e net_ipv4_neigh_default_gc_thresh1 = optional(number)\u003cbr\u003e net_ipv4_neigh_default_gc_thresh2 = optional(number)\u003cbr\u003e net_ipv4_neigh_default_gc_thresh3 = optional(number)\u003cbr\u003e net_ipv4_tcp_fin_timeout = optional(number)\u003cbr\u003e net_ipv4_tcp_keepalive_intvl = optional(number)\u003cbr\u003e net_ipv4_tcp_keepalive_probes = optional(number)\u003cbr\u003e net_ipv4_tcp_keepalive_time = optional(number)\u003cbr\u003e net_ipv4_tcp_max_syn_backlog = optional(number)\u003cbr\u003e net_ipv4_tcp_max_tw_buckets = optional(number)\u003cbr\u003e net_ipv4_tcp_tw_reuse = optional(bool)\u003cbr\u003e net_netfilter_nf_conntrack_buckets = optional(number)\u003cbr\u003e net_netfilter_nf_conntrack_max = optional(number)\u003cbr\u003e vm_max_map_count = optional(number)\u003cbr\u003e vm_swappiness = optional(number)\u003cbr\u003e vm_vfs_cache_pressure = optional(number)\u003cbr\u003e }))\u003cbr\u003e transparent_huge_page_enabled = optional(string)\u003cbr\u003e transparent_huge_page_defrag = optional(string)\u003cbr\u003e swap_file_size_mb = optional(number)\u003cbr\u003e }))\u003cbr\u003e fips_enabled = optional(bool)\u003cbr\u003e kubelet_disk_type = optional(string)\u003cbr\u003e max_count = optional(number)\u003cbr\u003e max_pods = optional(number)\u003cbr\u003e message_of_the_day = optional(string)\u003cbr\u003e mode = optional(string, \"User\")\u003cbr\u003e min_count = optional(number)\u003cbr\u003e node_network_profile = optional(object({\u003cbr\u003e node_public_ip_tags = optional(map(string))\u003cbr\u003e }))\u003cbr\u003e node_labels = optional(map(string))\u003cbr\u003e node_public_ip_prefix_id = optional(string)\u003cbr\u003e node_taints = optional(list(string))\u003cbr\u003e orchestrator_version = optional(string)\u003cbr\u003e os_disk_size_gb = optional(number)\u003cbr\u003e os_disk_type = optional(string, \"Managed\")\u003cbr\u003e os_sku = optional(string)\u003cbr\u003e os_type = optional(string, \"Linux\")\u003cbr\u003e pod_subnet_id = optional(string)\u003cbr\u003e priority = optional(string, \"Regular\")\u003cbr\u003e proximity_placement_group_id = optional(string)\u003cbr\u003e spot_max_price = optional(number)\u003cbr\u003e scale_down_mode = optional(string, \"Delete\")\u003cbr\u003e snapshot_id = optional(string)\u003cbr\u003e ultra_ssd_enabled = optional(bool)\u003cbr\u003e vnet_subnet_id = optional(string)\u003cbr\u003e upgrade_settings = optional(object({\u003cbr\u003e drain_timeout_in_minutes = number\u003cbr\u003e node_soak_duration_in_minutes = number\u003cbr\u003e max_surge = string\u003cbr\u003e }))\u003cbr\u003e windows_profile = optional(object({\u003cbr\u003e outbound_nat_enabled = optional(bool, true)\u003cbr\u003e }))\u003cbr\u003e workload_runtime = optional(string)\u003cbr\u003e zones = optional(set(string))\u003cbr\u003e create_before_destroy = optional(bool, true)\u003cbr\u003e }))\u003c/pre\u003e | `{}` | no |\n| \u003ca name=\"input_open_service_mesh_enabled\"\u003e\u003c/a\u003e [open\\_service\\_mesh\\_enabled](#input\\_open\\_service\\_mesh\\_enabled) | Is Open Service Mesh enabled? For more details, please visit [Open Service Mesh for AKS](https://docs.microsoft.com/azure/aks/open-service-mesh-about). | `bool` | `null` | no |\n| \u003ca name=\"input_key_vault_secrets_provider_enabled\"\u003e\u003c/a\u003e [key\\_vault\\_secrets\\_provider\\_enabled](#input\\_key\\_vault\\_secrets\\_provider\\_enabled) | (Optional) Whether to use the Azure Key Vault Provider for Secrets Store CSI Driver in an AKS cluster.\u003cbr\u003e If enabled, it creates an MSI for key vault, assigns it to the VMSS identity for key vault and assigns necessary\u003cbr\u003e permissions to the key vault. For more details: https://docs.microsoft.com/en-us/azure/aks/csi-secrets-store-driver | `bool` | `false` | no |\n| \u003ca name=\"input_secret_rotation_enabled\"\u003e\u003c/a\u003e [secret\\_rotation\\_enabled](#input\\_secret\\_rotation\\_enabled) | Is secret rotation enabled? This variable is only used when `key_vault_secrets_provider_enabled` is `true` and defaults to `false` | `bool` | `false` | no |\n| \u003ca name=\"input_secret_rotation_interval\"\u003e\u003c/a\u003e [secret\\_rotation\\_interval](#input\\_secret\\_rotation\\_interval) | The interval to poll for secret rotation. This attribute is only set when `secret_rotation` is `true` and defaults to `2m` | `string` | `\"2m\"` | no |\n| \u003ca name=\"input_create_key_vault\"\u003e\u003c/a\u003e [create\\_key\\_vault](#input\\_create\\_key\\_vault) | Create a new Key Vault to be associated with the AKS cluster | `bool` | `false` | no |\n| \u003ca name=\"input_key_vault_name\"\u003e\u003c/a\u003e [key\\_vault\\_name](#input\\_key\\_vault\\_name) | The name of the key vault to override the naming module | `string` | `null` | no |\n| \u003ca name=\"input_key_vault_role_definition\"\u003e\u003c/a\u003e [key\\_vault\\_role\\_definition](#input\\_key\\_vault\\_role\\_definition) | Permission assigned to the key vault MSI on the key vault. Default is `Key Vault Administrator` | `string` | `\"Key Vault Administrator\"` | no |\n| \u003ca name=\"input_additional_key_vault_ids\"\u003e\u003c/a\u003e [additional\\_key\\_vault\\_ids](#input\\_additional\\_key\\_vault\\_ids) | IDs of the additional key vaults to be associated with the AKS cluster. The key vault MSI will be assigned\u003cbr\u003e the role defined in `key_vault_role_definition` on these key vaults. | `list(string)` | `[]` | no |\n| \u003ca name=\"input_enable_rbac_authorization\"\u003e\u003c/a\u003e [enable\\_rbac\\_authorization](#input\\_enable\\_rbac\\_authorization) | Enable Kubernetes Role-Based Access Control on the Key Vault | `bool` | `false` | no |\n| \u003ca name=\"input_sku_tier\"\u003e\u003c/a\u003e [sku\\_tier](#input\\_sku\\_tier) | The SKU Tier that should be used for this Kubernetes Cluster. Possible values are `Free` and `Standard` | `string` | `\"Free\"` | no |\n| \u003ca name=\"input_node_resource_group\"\u003e\u003c/a\u003e [node\\_resource\\_group](#input\\_node\\_resource\\_group) | The auto-generated Resource Group which contains the resources for this Managed Kubernetes Cluster. Changing this forces a new resource to be created. | `string` | `null` | no |\n| \u003ca name=\"input_brown_field_application_gateway_for_ingress\"\u003e\u003c/a\u003e [brown\\_field\\_application\\_gateway\\_for\\_ingress](#input\\_brown\\_field\\_application\\_gateway\\_for\\_ingress) | [Definition of `brown_field`](https://learn.microsoft.com/en-us/azure/application-gateway/tutorial-ingress-controller-add-on-existing)\u003cbr\u003e* `id` - (Required) The ID of the Application Gateway that be used as cluster ingress.\u003cbr\u003e* `subnet_id` - (Required) The ID of the Subnet which the Application Gateway is connected to. Must be set when `create_role_assignments` is `true`. | \u003cpre\u003eobject({\u003cbr\u003e id = string\u003cbr\u003e subnet_id = string\u003cbr\u003e })\u003c/pre\u003e | `null` | no |\n| \u003ca name=\"input_green_field_application_gateway_for_ingress\"\u003e\u003c/a\u003e [green\\_field\\_application\\_gateway\\_for\\_ingress](#input\\_green\\_field\\_application\\_gateway\\_for\\_ingress) | [Definition of `green_field`](https://learn.microsoft.com/en-us/azure/application-gateway/tutorial-ingress-controller-add-on-new)\u003cbr\u003e* `name` - (Optional) The name of the Application Gateway to be used or created in the Nodepool Resource Group, which in turn will be integrated with the ingress controller of this Kubernetes Cluster.\u003cbr\u003e* `subnet_cidr` - (Optional) The subnet CIDR to be used to create an Application Gateway, which in turn will be integrated with the ingress controller of this Kubernetes Cluster.\u003cbr\u003e* `subnet_id` - (Optional) The ID of the subnet on which to create an Application Gateway, which in turn will be integrated with the ingress controller of this Kubernetes Cluster. | \u003cpre\u003eobject({\u003cbr\u003e name = optional(string)\u003cbr\u003e subnet_cidr = optional(string)\u003cbr\u003e subnet_id = optional(string)\u003cbr\u003e })\u003c/pre\u003e | `null` | no |\n| \u003ca name=\"input_web_app_routing\"\u003e\u003c/a\u003e [web\\_app\\_routing](#input\\_web\\_app\\_routing) | object({\u003cbr\u003e dns\\_zone\\_id = \"(Required) Specifies the ID of the DNS Zone in which DNS entries are created for applications deployed to the cluster when Web App Routing is enabled.\"\u003cbr\u003e}) | \u003cpre\u003eobject({\u003cbr\u003e dns_zone_id = string\u003cbr\u003e })\u003c/pre\u003e | `null` | no |\n| \u003ca name=\"input_identity_ids\"\u003e\u003c/a\u003e [identity\\_ids](#input\\_identity\\_ids) | (Optional) Specifies a list of User Assigned Managed Identity IDs to be assigned to this Kubernetes Cluster. | `list(string)` | `[]` | no |\n| \u003ca name=\"input_identity_type\"\u003e\u003c/a\u003e [identity\\_type](#input\\_identity\\_type) | (Optional) The type of identity used for the managed cluster. Conflicts with `client_id` and `client_secret`. Possible values are `SystemAssigned` and `UserAssigned`. If `UserAssigned` is set, an `identity_ids` must be set as well. | `string` | `\"SystemAssigned\"` | no |\n| \u003ca name=\"input_client_id\"\u003e\u003c/a\u003e [client\\_id](#input\\_client\\_id) | (Optional) The Client ID (appId) for the Service Principal used for the AKS deployment | `string` | `\"\"` | no |\n| \u003ca name=\"input_client_secret\"\u003e\u003c/a\u003e [client\\_secret](#input\\_client\\_secret) | (Optional) The Client Secret (password) for the Service Principal used for the AKS deployment | `string` | `\"\"` | no |\n| \u003ca name=\"input_monitor_metrics\"\u003e\u003c/a\u003e [monitor\\_metrics](#input\\_monitor\\_metrics) | (Optional) Specifies a Prometheus add-on profile for the Kubernetes Cluster\u003cbr\u003eobject({\u003cbr\u003e annotations\\_allowed = \"(Optional) Specifies a comma-separated list of Kubernetes annotation keys that will be used in the resource's labels metric.\"\u003cbr\u003e labels\\_allowed = \"(Optional) Specifies a Comma-separated list of additional Kubernetes label keys that will be used in the resource's labels metric.\"\u003cbr\u003e}) | \u003cpre\u003eobject({\u003cbr\u003e annotations_allowed = optional(string)\u003cbr\u003e labels_allowed = optional(string)\u003cbr\u003e })\u003c/pre\u003e | `null` | no |\n| \u003ca name=\"input_container_registry_ids\"\u003e\u003c/a\u003e [container\\_registry\\_ids](#input\\_container\\_registry\\_ids) | List of container registry IDs to associate with AKS. This module will assign role `AcrPull` to AKS for these registries | `list(string)` | `[]` | no |\n| \u003ca name=\"input_public_dns_zone_name\"\u003e\u003c/a\u003e [public\\_dns\\_zone\\_name](#input\\_public\\_dns\\_zone\\_name) | Name of a public DNS zone to create with the kubernetes cluster | `string` | `null` | no |\n| \u003ca name=\"input_kv_soft_delete_retention_days\"\u003e\u003c/a\u003e [kv\\_soft\\_delete\\_retention\\_days](#input\\_kv\\_soft\\_delete\\_retention\\_days) | Number of retention days for soft delete for key vault | `number` | `7` | no |\n| \u003ca name=\"input_kv_sku\"\u003e\u003c/a\u003e [kv\\_sku](#input\\_kv\\_sku) | SKU for the key vault - standard or premium | `string` | `\"standard\"` | no |\n| \u003ca name=\"input_kv_access_policies\"\u003e\u003c/a\u003e [kv\\_access\\_policies](#input\\_kv\\_access\\_policies) | Additional Access policies for the vault except the current user which are added by default | \u003cpre\u003emap(object({\u003cbr\u003e object_id = string\u003cbr\u003e tenant_id = string\u003cbr\u003e key_permissions = list(string)\u003cbr\u003e certificate_permissions = list(string)\u003cbr\u003e secret_permissions = list(string)\u003cbr\u003e storage_permissions = list(string)\u003cbr\u003e }))\u003c/pre\u003e | `{}` | no |\n| \u003ca name=\"input_certificates\"\u003e\u003c/a\u003e [certificates](#input\\_certificates) | List of certificates to be imported. The pfx files should be present in the root of the module (path.root) and its name denoted as certificate\\_name | \u003cpre\u003emap(object({\u003cbr\u003e certificate_name = string\u003cbr\u003e password = string\u003cbr\u003e }))\u003c/pre\u003e | `{}` | no |\n| \u003ca name=\"input_secrets\"\u003e\u003c/a\u003e [secrets](#input\\_secrets) | List of secrets (name and value) | `map(string)` | `{}` | no |\n| \u003ca name=\"input_keys\"\u003e\u003c/a\u003e [keys](#input\\_keys) | List of keys to be created in key vault. Name of the key is the key of the map | \u003cpre\u003emap(object({\u003cbr\u003e key_type = string\u003cbr\u003e key_size = number\u003cbr\u003e key_opts = list(string)\u003cbr\u003e }))\u003c/pre\u003e | `{}` | no |\n| \u003ca name=\"input_disable_bgp_route_propagation\"\u003e\u003c/a\u003e [disable\\_bgp\\_route\\_propagation](#input\\_disable\\_bgp\\_route\\_propagation) | Disable BGP route propagation on the routing table that AKS manages. | `bool` | `false` | no |\n| \u003ca name=\"input_create_application_insights\"\u003e\u003c/a\u003e [create\\_application\\_insights](#input\\_create\\_application\\_insights) | Ff true, create a new Application Insights resource to be associated with the AKS cluster | `bool` | `false` | no |\n| \u003ca name=\"input_application_insights\"\u003e\u003c/a\u003e [application\\_insights](#input\\_application\\_insights) | Details for the Application Insights resource to be associated with the AKS cluster. Required only when create\\_application\\_insights=true | \u003cpre\u003eobject({\u003cbr\u003e application_type = optional(string, \"web\")\u003cbr\u003e retention_in_days = optional(number, 30)\u003cbr\u003e daily_data_cap_in_gb = optional(number, 1)\u003cbr\u003e daily_data_cap_notifications_disabled = optional(bool, false)\u003cbr\u003e sampling_percentage = optional(number, 100)\u003cbr\u003e disabling_ip_masking = optional(bool, false)\u003cbr\u003e local_authentication_disabled = optional(bool, false)\u003cbr\u003e internet_ingestion_enabled = optional(bool, false)\u003cbr\u003e internet_query_enabled = optional(bool, true)\u003cbr\u003e force_customer_storage_for_profiler = optional(bool, false)\u003cbr\u003e })\u003c/pre\u003e | `{}` | no |\n| \u003ca name=\"input_create_monitor_private_link_scope\"\u003e\u003c/a\u003e [create\\_monitor\\_private\\_link\\_scope](#input\\_create\\_monitor\\_private\\_link\\_scope) | If true, create a new Private Link Scope for Azure Monitor.\u003cbr\u003e NOTE: This will cause all azure monitor / log analytics traffic to go through private link. | `bool` | `false` | no |\n| \u003ca name=\"input_brown_field_monitor_private_link_scope_id\"\u003e\u003c/a\u003e [brown\\_field\\_monitor\\_private\\_link\\_scope\\_id](#input\\_brown\\_field\\_monitor\\_private\\_link\\_scope\\_id) | An existing monitor private link scope to associate with azure monitor resources.\u003cbr\u003eUsable only when `create_monitor_private_link_scope` is `false`. | `string` | `null` | no |\n| \u003ca name=\"input_monitor_private_link_scope_subnet_id\"\u003e\u003c/a\u003e [monitor\\_private\\_link\\_scope\\_subnet\\_id](#input\\_monitor\\_private\\_link\\_scope\\_subnet\\_id) | The ID of the subnet to associate with the Azure Monitor private link scope | `string` | `null` | no |\n| \u003ca name=\"input_monitor_private_link_scope_dns_zone_suffixes\"\u003e\u003c/a\u003e [monitor\\_private\\_link\\_scope\\_dns\\_zone\\_suffixes](#input\\_monitor\\_private\\_link\\_scope\\_dns\\_zone\\_suffixes) | The DNS zone suffixes for the private link scope | `set(string)` | \u003cpre\u003e[\u003cbr\u003e \"privatelink.monitor.azure.com\",\u003cbr\u003e \"privatelink.oms.opinsights.azure.com\",\u003cbr\u003e \"privatelink.ods.opinsights.azure.com\",\u003cbr\u003e \"privatelink.agentsvc.azure-automation.net\",\u003cbr\u003e \"privatelink.blob.core.windows.net\"\u003cbr\u003e]\u003c/pre\u003e | no |\n| \u003ca name=\"input_enable_prometheus_monitoring\"\u003e\u003c/a\u003e [enable\\_prometheus\\_monitoring](#input\\_enable\\_prometheus\\_monitoring) | Deploy Prometheus monitoring resources with the AKS cluster | `bool` | `false` | no |\n| \u003ca name=\"input_brown_field_prometheus_monitor_workspace_id\"\u003e\u003c/a\u003e [brown\\_field\\_prometheus\\_monitor\\_workspace\\_id](#input\\_brown\\_field\\_prometheus\\_monitor\\_workspace\\_id) | The ID of an existing Azure Monitor workspace to use for Prometheus monitoring | `string` | `null` | no |\n| \u003ca name=\"input_prometheus_workspace_public_access_enabled\"\u003e\u003c/a\u003e [prometheus\\_workspace\\_public\\_access\\_enabled](#input\\_prometheus\\_workspace\\_public\\_access\\_enabled) | Enable public access to the Azure Monitor workspace for prometheus | `bool` | `true` | no |\n| \u003ca name=\"input_enable_prometheus_monitoring_private_endpoint\"\u003e\u003c/a\u003e [enable\\_prometheus\\_monitoring\\_private\\_endpoint](#input\\_enable\\_prometheus\\_monitoring\\_private\\_endpoint) | Enable private endpoint for Prometheus monitoring | `bool` | `false` | no |\n| \u003ca name=\"input_prometheus_monitoring_private_endpoint_subnet_id\"\u003e\u003c/a\u003e [prometheus\\_monitoring\\_private\\_endpoint\\_subnet\\_id](#input\\_prometheus\\_monitoring\\_private\\_endpoint\\_subnet\\_id) | The ID of a subnet to create a private endpoint for Prometheus monitoring | `string` | `null` | no |\n| \u003ca name=\"input_prometheus_enable_default_rule_groups\"\u003e\u003c/a\u003e [prometheus\\_enable\\_default\\_rule\\_groups](#input\\_prometheus\\_enable\\_default\\_rule\\_groups) | Enable default recording rules for prometheus | `bool` | `true` | no |\n| \u003ca name=\"input_prometheus_default_rule_group_naming\"\u003e\u003c/a\u003e [prometheus\\_default\\_rule\\_group\\_naming](#input\\_prometheus\\_default\\_rule\\_group\\_naming) | Resource names for the default recording rules | `map(string)` | \u003cpre\u003e{\u003cbr\u003e \"kubernetes_recording\": \"DefaultKubernetesRecordingRuleGroup\",\u003cbr\u003e \"node_recording\": \"DefaultNodeRecordingRuleGroup\"\u003cbr\u003e}\u003c/pre\u003e | no |\n| \u003ca name=\"input_prometheus_default_rule_group_interval\"\u003e\u003c/a\u003e [prometheus\\_default\\_rule\\_group\\_interval](#input\\_prometheus\\_default\\_rule\\_group\\_interval) | Interval to run default recording rules in ISO 8601 format (between PT1M and PT15M) | `string` | `\"PT1M\"` | no |\n| \u003ca name=\"input_prometheus_rule_groups\"\u003e\u003c/a\u003e [prometheus\\_rule\\_groups](#input\\_prometheus\\_rule\\_groups) | map(object({\u003cbr\u003e enabled = Whether or not the rule group is enabled\u003cbr\u003e description = Description of the rule group\u003cbr\u003e interval = Interval to run the rule group in ISO 8601 format (between PT1M and PT15M)\u003cbr\u003e\u003cbr\u003e recording\\_rules = list(object({\u003cbr\u003e name = Name of the recording rule\u003cbr\u003e enabled = Whether or not the recording rule is enabled\u003cbr\u003e expression = PromQL expression for the time series value\u003cbr\u003e labels = Labels to add to the time series\u003cbr\u003e }))\u003cbr\u003e\u003cbr\u003e alert\\_rules = list(object({\u003cbr\u003e name = Name of the alerting rule\u003cbr\u003e action = optional(object({\u003cbr\u003e action\\_group\\_id = ID of the action group to send alerts to\u003cbr\u003e }))\u003cbr\u003e enabled = Whether or not the alert rule is enabled\u003cbr\u003e expression = PromQL expression to evaluate\u003cbr\u003e for = Amount of time the alert must be active before firing, represented in ISO 8601 duration format (i.e. PT5M)\u003cbr\u003e labels = Labels to add to the alerts fired by this rule\u003cbr\u003e alert\\_resolution = optional(object({\u003cbr\u003e auto\\_resolved = Whether or not to auto-resolve the alert after the condition is no longer true\u003cbr\u003e time\\_to\\_resolve = Amount of time to wait before auto-resolving the alert, represented in ISO 8601 duration format (i.e. PT5M)\u003cbr\u003e }))\u003cbr\u003e severity = Severity of the alert, between 0 and 4\u003cbr\u003e annotations = Annotations to add to the alerts fired by this rule\u003cbr\u003e })) | \u003cpre\u003emap(object({\u003cbr\u003e enabled = bool\u003cbr\u003e description = string\u003cbr\u003e interval = string\u003cbr\u003e\u003cbr\u003e recording_rules = list(object({\u003cbr\u003e name = string\u003cbr\u003e enabled = bool\u003cbr\u003e expression = string\u003cbr\u003e labels = map(string)\u003cbr\u003e }))\u003cbr\u003e\u003cbr\u003e alert_rules = list(object({\u003cbr\u003e name = string\u003cbr\u003e action = optional(object({\u003cbr\u003e action_group_id = string\u003cbr\u003e }))\u003cbr\u003e enabled = bool\u003cbr\u003e expression = string\u003cbr\u003e for = string\u003cbr\u003e labels = map(string)\u003cbr\u003e alert_resolution = optional(object({\u003cbr\u003e auto_resolved = optional(bool)\u003cbr\u003e time_to_resolve = optional(string)\u003cbr\u003e }))\u003cbr\u003e severity = optional(number)\u003cbr\u003e annotations = optional(map(string))\u003cbr\u003e }))\u003cbr\u003e\u003cbr\u003e tags = optional(map(string), {})\u003cbr\u003e }))\u003c/pre\u003e | `{}` | no |\n| \u003ca name=\"input_tags\"\u003e\u003c/a\u003e [tags](#input\\_tags) | A map of custom tags to be attached to this module resources | `map(string)` | `{}` | no |\n| \u003ca name=\"input_workload_user_assigned_identities\"\u003e\u003c/a\u003e [workload\\_user\\_assigned\\_identities](#input\\_workload\\_user\\_assigned\\_identities) | Map of additional user-assigned identities for workloads. | \u003cpre\u003emap(object({\u003cbr\u003e name_override = optional(string)\u003cbr\u003e location = optional(string)\u003cbr\u003e }))\u003c/pre\u003e | `{}` | no |\n| \u003ca name=\"input_workload_federated_credentials\"\u003e\u003c/a\u003e [workload\\_federated\\_credentials](#input\\_workload\\_federated\\_credentials) | Map of federated identity credentials that allow AKS workloads\u003cbr\u003e(Kubernetes ServiceAccounts) to assume Azure user-assigned\u003cbr\u003emanaged identities using OIDC (Workload Identity). | \u003cpre\u003emap(object({\u003cbr\u003e # Key referencing workload_user_assigned_identities\u003cbr\u003e user_assigned_identity_key = string\u003cbr\u003e\u003cbr\u003e # Name of the federated identity credential resource\u003cbr\u003e name = string\u003cbr\u003e\u003cbr\u003e # Kubernetes ServiceAccount details\u003cbr\u003e namespace = string\u003cbr\u003e service_account_name = string\u003cbr\u003e\u003cbr\u003e # Audience for the federated credential\u003cbr\u003e audience = optional(list(string), [\"api://AzureADTokenExchange\"])\u003cbr\u003e }))\u003c/pre\u003e | `{}` | no |\n\n## Outputs\n\n| Name | Description |\n|------|-------------|\n| \u003ca name=\"output_kube_config_raw\"\u003e\u003c/a\u003e [kube\\_config\\_raw](#output\\_kube\\_config\\_raw) | The `azurerm_kubernetes_cluster`'s `kube_config_raw` argument. Raw Kubernetes config to be used by\u003cbr\u003e [kubectl](https://kubernetes.io/docs/reference/kubectl/overview/) and other compatible tools. |\n| \u003ca name=\"output_kube_admin_config_raw\"\u003e\u003c/a\u003e [kube\\_admin\\_config\\_raw](#output\\_kube\\_admin\\_config\\_raw) | The `azurerm_kubernetes_cluster`'s `kube_admin_config_raw` argument. Raw Kubernetes config for the admin account to\u003cbr\u003e be used by [kubectl](https://kubernetes.io/docs/reference/kubectl/overview/) and other compatible tools.\u003cbr\u003e This is only available when Role Based Access Control with Azure Active Directory is enabled and local accounts enabled. |\n| \u003ca name=\"output_admin_host\"\u003e\u003c/a\u003e [admin\\_host](#output\\_admin\\_host) | The `host` in the `azurerm_kubernetes_cluster`'s `kube_admin_config` block. The Kubernetes cluster server host. |\n| \u003ca name=\"output_admin_password\"\u003e\u003c/a\u003e [admin\\_password](#output\\_admin\\_password) | The `password` in the `azurerm_kubernetes_cluster`'s `kube_admin_config` block. A password or token used to authenticate to the Kubernetes cluster. |\n| \u003ca name=\"output_admin_username\"\u003e\u003c/a\u003e [admin\\_username](#output\\_admin\\_username) | The `username` in the `azurerm_kubernetes_cluster`'s `kube_admin_config` block. A username used to authenticate to the Kubernetes cluster. |\n| \u003ca name=\"output_azure_policy_enabled\"\u003e\u003c/a\u003e [azure\\_policy\\_enabled](#output\\_azure\\_policy\\_enabled) | The `azurerm_kubernetes_cluster`'s `azure_policy_enabled` argument. Should the Azure Policy Add-On be enabled? For more details please visit [Understand Azure Policy for Azure Kubernetes Service](https://docs.microsoft.com/en-ie/azure/governance/policy/concepts/rego-for-aks) |\n| \u003ca name=\"output_azurerm_log_analytics_workspace_id\"\u003e\u003c/a\u003e [azurerm\\_log\\_analytics\\_workspace\\_id](#output\\_azurerm\\_log\\_analytics\\_workspace\\_id) | The id of the created Log Analytics workspace |\n| \u003ca name=\"output_azurerm_log_analytics_workspace_name\"\u003e\u003c/a\u003e [azurerm\\_log\\_analytics\\_workspace\\_name](#output\\_azurerm\\_log\\_analytics\\_workspace\\_name) | The name of the created Log Analytics workspace |\n| \u003ca name=\"output_azurerm_log_analytics_workspace_primary_shared_key\"\u003e\u003c/a\u003e [azurerm\\_log\\_analytics\\_workspace\\_primary\\_shared\\_key](#output\\_azurerm\\_log\\_analytics\\_workspace\\_primary\\_shared\\_key) | Specifies the workspace key of the log analytics workspace |\n| \u003ca name=\"output_client_certificate\"\u003e\u003c/a\u003e [client\\_certificate](#output\\_client\\_certificate) | The `client_certificate` in the `azurerm_kubernetes_cluster`'s `kube_config` block. Base64 encoded public certificate used by clients to authenticate to the Kubernetes cluster. |\n| \u003ca name=\"output_client_key\"\u003e\u003c/a\u003e [client\\_key](#output\\_client\\_key) | The `client_key` in the `azurerm_kubernetes_cluster`'s `kube_config` block. Base64 encoded private key used by clients to authenticate to the Kubernetes cluster. |\n| \u003ca name=\"output_cluster_ca_certificate\"\u003e\u003c/a\u003e [cluster\\_ca\\_certificate](#output\\_cluster\\_ca\\_certificate) | The `cluster_ca_certificate` in the `azurerm_kubernetes_cluster`'s `kube_config` block. Base64 encoded public CA certificate used as the root of trust for the Kubernetes cluster. |\n| \u003ca name=\"output_cluster_fqdn\"\u003e\u003c/a\u003e [cluster\\_fqdn](#output\\_cluster\\_fqdn) | The FQDN of the Azure Kubernetes Managed Cluster. |\n| \u003ca name=\"output_cluster_portal_fqdn\"\u003e\u003c/a\u003e [cluster\\_portal\\_fqdn](#output\\_cluster\\_portal\\_fqdn) | The FQDN for the Azure Portal resources when private link has been enabled, which is only resolvable inside the Virtual Network used by the Kubernetes Cluster. |\n| \u003ca name=\"output_cluster_private_fqdn\"\u003e\u003c/a\u003e [cluster\\_private\\_fqdn](#output\\_cluster\\_private\\_fqdn) | The FQDN for the Kubernetes Cluster when private link has been enabled, which is only resolvable inside the Virtual Network used by the Kubernetes Cluster. |\n| \u003ca name=\"output_generated_cluster_private_ssh_key\"\u003e\u003c/a\u003e [generated\\_cluster\\_private\\_ssh\\_key](#output\\_generated\\_cluster\\_private\\_ssh\\_key) | The cluster will use this generated private key as ssh key when `var.public_ssh_key` is empty or null. Private key data in [PEM (RFC 1421)](https://datatracker.ietf.org/doc/html/rfc1421) format. |\n| \u003ca name=\"output_generated_cluster_public_ssh_key\"\u003e\u003c/a\u003e [generated\\_cluster\\_public\\_ssh\\_key](#output\\_generated\\_cluster\\_public\\_ssh\\_key) | The cluster will use this generated public key as ssh key when `var.public_ssh_key` is empty or null. The fingerprint of the public key data in OpenSSH MD5 hash format, e.g. `aa:bb:cc:....` Only available if the selected private key format is compatible, similarly to `public_key_openssh` and the [ECDSA P224 limitations](https://registry.terraform.io/providers/hashicorp/tls/latest/docs#limitations). |\n| \u003ca name=\"output_host\"\u003e\u003c/a\u003e [host](#output\\_host) | The `host` in the `azurerm_kubernetes_cluster`'s `kube_config` block. The Kubernetes cluster server host. |\n| \u003ca name=\"output_cluster_name\"\u003e\u003c/a\u003e [cluster\\_name](#output\\_cluster\\_name) | Name of the AKS cluster |\n| \u003ca name=\"output_cluster_id\"\u003e\u003c/a\u003e [cluster\\_id](#output\\_cluster\\_id) | ID of the AKS cluster |\n| \u003ca name=\"output_resource_group_name\"\u003e\u003c/a\u003e [resource\\_group\\_name](#output\\_resource\\_group\\_name) | Name of the Resource Group for the AKS Cluster. Node RG is separate that is created automatically by Azure |\n| \u003ca name=\"output_application_gateway_id\"\u003e\u003c/a\u003e [application\\_gateway\\_id](#output\\_application\\_gateway\\_id) | Application Gateway ID when application |\n| \u003ca name=\"output_key_vault_secrets_provider\"\u003e\u003c/a\u003e [key\\_vault\\_secrets\\_provider](#output\\_key\\_vault\\_secrets\\_provider) | The `azurerm_kubernetes_cluster`'s `key_vault_secrets_provider` block. |\n| \u003ca name=\"output_key_vault_secrets_provider_enabled\"\u003e\u003c/a\u003e [key\\_vault\\_secrets\\_provider\\_enabled](#output\\_key\\_vault\\_secrets\\_provider\\","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flaunchbynttdata%2Ftf-azurerm-module_reference-kubernetes_cluster","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Flaunchbynttdata%2Ftf-azurerm-module_reference-kubernetes_cluster","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flaunchbynttdata%2Ftf-azurerm-module_reference-kubernetes_cluster/lists"}