Support for azurerm_kubernetes_nodepool to support vtpm and secure boot of underlying VM type capability

[cirix]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave comments along the lines of "+1", "me too" or "any updates", they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment and review the contribution guide to help.

Description

Hi community,
working on a project, we are looking at using terraform to automate the infrastructure. Due to the nature of the platform we have to have enable the vtpm and secure boot feature of nodepools of Azure. Looks like that the support for the following three features is not available:

• Secure Boot
• VTPM
• Encryption with self managed key
  The above for different reasons may be requirements projects have , that require bigger level of security compliance. Can you please enable those "boolean" capabilities and key injection capabilities on the provider of kubernetes or nodepool?

New or Affected Resource(s)/Data Source(s)

azurerm_kubernetes_cluster azurerm_kubernetes_cluster_node_pool

Potential Terraform Configuration

enable_vtpm = true
enable_secure_boot = true

References

Please see for erference
Microsoft support for secure boot/vtpm
Microsoft Azure VM v2

[hqhqhqhqhqhqhqhqhqhqhq]

Hi @cirix , thanks for raising this.

I had a look and these features are supported from the AKS AgentPool API version 2024-07-01 (the current latest azurerm version is using AKS AgentPool API version 2024-05-01).

I will look into updating the api version for agentpool to a newer version and add support for these properties, but this may take some time.

For a temporary solution, you can make use azapi provider to create/update the nodepool with those settings configured, e.g.

resource "azapi_resource" "xxx" {
  type      = "Microsoft.ContainerService/managedClusters/agentPools@2024-07-01"
  parent_id = ...
  name      = ...
  body = {
    properties = {
      ...
      securityProfile = {
        enableSecureBoot = true
        enableVTPM       = true
      }
    }
  }
}