"azurerm_kubernetes_cluster" - supports property "dns_prefix_private_cluster"

azurerm/internal/services/containers/kubernetes_cluster_network_resource_test.go

@@ -368,6 +368,25 @@ func testAccKubernetesCluster_privateClusterOnWithPrivateDNSZoneAndServicePrinci
 	})
 }
 
+func TestAccKubernetesCluster_privateClusterOnWithPrivateDNSZoneSubDomain(t *testing.T) {
+	checkIfShouldRunTestsIndividually(t)
+	testAccKubernetesCluster_privateClusterOnWithPrivateDNSZoneSubDomain(t)
+}
+
+func testAccKubernetesCluster_privateClusterOnWithPrivateDNSZoneSubDomain(t *testing.T) {
+	data := acceptance.BuildTestData(t, "azurerm_kubernetes_cluster", "test")
+	r := KubernetesClusterResource{}
+
+	data.ResourceTest(t, r, []resource.TestStep{
+		{
+			Config: r.privateClusterWithPrivateDNSZoneSubDomain(data),
+			Check: resource.ComposeTestCheckFunc(
+				check.That(data.ResourceName).ExistsInAzure(r),
+			),
+		},
+	})
+}
+
 func TestAccKubernetesCluster_privateClusterOnWithPrivateDNSZoneSystem(t *testing.T) {
 	checkIfShouldRunTestsIndividually(t)
 	testAccKubernetesCluster_privateClusterOnWithPrivateDNSZoneSystem(t)
@@ -1241,6 +1260,67 @@ resource "azurerm_kubernetes_cluster" "test" {
 `, data.RandomInteger, data.Locations.Primary, data.Locations.Primary, data.RandomInteger, data.RandomInteger, enablePrivateCluster, clientId, clientSecret, data.RandomInteger)
 }
 
+func (KubernetesClusterResource) privateClusterWithPrivateDNSZoneSubDomain(data acceptance.TestData) string {
+	return fmt.Sprintf(`
+provider "azurerm" {
+  features {}
+}
+resource "azurerm_resource_group" "test" {
+  name     = "acctestRG-aks-%d"
+  location = "%s"
+}
+resource "azurerm_private_dns_zone" "test" {
+  name                = "privatelink.%s.azmk8s.io"
+  resource_group_name = azurerm_resource_group.test.name
+}
+resource "azurerm_user_assigned_identity" "test" {
+  name                = "acctestRG-aks-%d"
+  resource_group_name = azurerm_resource_group.test.name
+  location            = azurerm_resource_group.test.location
+}
+resource "azurerm_role_assignment" "test" {
+  scope                = azurerm_private_dns_zone.test.id
+  role_definition_name = "Private DNS Zone Contributor"
+  principal_id         = azurerm_user_assigned_identity.test.principal_id
+}
+resource "azurerm_kubernetes_cluster" "test" {
+  name                              = "acctestaks%d"
+  location                          = azurerm_resource_group.test.location
+  resource_group_name               = azurerm_resource_group.test.name
+  private_cluster_enabled           = true
+  private_dns_zone_id               = azurerm_private_dns_zone.test.id
+  private_cluster_custom_dns_prefix = "prefix"
+
+  linux_profile {
+    admin_username = "acctestuser%d"
+    ssh_key {
+      key_data = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqaZoyiz1qbdOQ8xEf6uEu1cCwYowo5FHtsBhqLoDnnp7KUTEBN+L2NxRIfQ781rxV6Iq5jSav6b2Q8z5KiseOlvKA/RF2wqU0UPYqQviQhLmW6THTpmrv/YkUCuzxDpsH7DUDhZcwySLKVVe0Qm3+5N2Ta6UYH3lsDf9R9wTP2K/+vAnflKebuypNlmocIvakFWoZda18FOmsOoIVXQ8HWFNCuw9ZCunMSN62QGamCe3dL5cXlkgHYv7ekJE15IA9aOJcM7e90oeTqo+7HTcWfdu0qQqPWY5ujyMw/llas8tsXY85LFqRnr3gJ02bAscjc477+X+j/gkpFoN1QEmt [email protected]"
+    }
+  }
+
+  default_node_pool {
+    name       = "default"
+    node_count = 1
+    vm_size    = "Standard_DS2_v2"
+  }
+
+  identity {
+    type                      = "UserAssigned"
+    user_assigned_identity_id = azurerm_user_assigned_identity.test.id
+  }
+
+  network_profile {
+    network_plugin    = "kubenet"
+    load_balancer_sku = "standard"
+  }
+
+  depends_on = [
+    azurerm_role_assignment.test,
+  ]
+}
+`, data.RandomInteger, data.Locations.Primary, data.Locations.Primary, data.RandomInteger, data.RandomInteger, data.RandomInteger)
+}
+
 func (KubernetesClusterResource) privateClusterWithPrivateDNSZoneSystemConfig(data acceptance.TestData, enablePrivateCluster bool) string {
 	return fmt.Sprintf(`
 provider "azurerm" {

azurerm/internal/services/containers/kubernetes_cluster_other_resource_test.go

@@ -11,24 +11,25 @@ import (
 )
 
 var kubernetesOtherTests = map[string]func(t *testing.T){
-	"basicAvailabilitySet":           testAccKubernetesCluster_basicAvailabilitySet,
-	"basicVMSS":                      testAccKubernetesCluster_basicVMSS,
-	"requiresImport":                 testAccKubernetesCluster_requiresImport,
-	"criticalAddonsTaint":            testAccKubernetesCluster_criticalAddonsTaint,
-	"linuxProfile":                   testAccKubernetesCluster_linuxProfile,
-	"nodeLabels":                     testAccKubernetesCluster_nodeLabels,
-	"nodeResourceGroup":              testAccKubernetesCluster_nodeResourceGroup,
-	"paidSku":                        testAccKubernetesCluster_paidSku,
-	"upgradeConfig":                  testAccKubernetesCluster_upgrade,
-	"tags":                           testAccKubernetesCluster_tags,
-	"windowsProfile":                 testAccKubernetesCluster_windowsProfile,
-	"outboundTypeLoadBalancer":       testAccKubernetesCluster_outboundTypeLoadBalancer,
-	"privateClusterOn":               testAccKubernetesCluster_privateClusterOn,
-	"privateClusterOff":              testAccKubernetesCluster_privateClusterOff,
-	"privateClusterPrivateDNS":       testAccKubernetesCluster_privateClusterOnWithPrivateDNSZone,
-	"privateClusterPrivateDNSSystem": testAccKubernetesCluster_privateClusterOnWithPrivateDNSZoneSystem,
-	"privateClusterPrivateDNSAndSP":  testAccKubernetesCluster_privateClusterOnWithPrivateDNSZoneAndServicePrincipal,
-	"upgradeChannel":                 testAccKubernetesCluster_upgradeChannel,
+	"basicAvailabilitySet":              testAccKubernetesCluster_basicAvailabilitySet,
+	"basicVMSS":                         testAccKubernetesCluster_basicVMSS,
+	"requiresImport":                    testAccKubernetesCluster_requiresImport,
+	"criticalAddonsTaint":               testAccKubernetesCluster_criticalAddonsTaint,
+	"linuxProfile":                      testAccKubernetesCluster_linuxProfile,
+	"nodeLabels":                        testAccKubernetesCluster_nodeLabels,
+	"nodeResourceGroup":                 testAccKubernetesCluster_nodeResourceGroup,
+	"paidSku":                           testAccKubernetesCluster_paidSku,
+	"upgradeConfig":                     testAccKubernetesCluster_upgrade,
+	"tags":                              testAccKubernetesCluster_tags,
+	"windowsProfile":                    testAccKubernetesCluster_windowsProfile,
+	"outboundTypeLoadBalancer":          testAccKubernetesCluster_outboundTypeLoadBalancer,
+	"privateClusterOn":                  testAccKubernetesCluster_privateClusterOn,
+	"privateClusterOff":                 testAccKubernetesCluster_privateClusterOff,
+	"privateClusterPrivateDNS":          testAccKubernetesCluster_privateClusterOnWithPrivateDNSZone,
+	"privateClusterPrivateDNSSystem":    testAccKubernetesCluster_privateClusterOnWithPrivateDNSZoneSystem,
+	"privateClusterPrivateDNSAndSP":     testAccKubernetesCluster_privateClusterOnWithPrivateDNSZoneAndServicePrincipal,
+	"privateClusterPrivateDNSSubDomain": testAccKubernetesCluster_privateClusterOnWithPrivateDNSZoneSubDomain,
+	"upgradeChannel":                    testAccKubernetesCluster_upgradeChannel,
 }
 
 func TestAccKubernetesCluster_basicAvailabilitySet(t *testing.T) {

azurerm/internal/services/containers/kubernetes_cluster_resource.go

@@ -70,11 +70,19 @@ func resourceKubernetesCluster() *schema.Resource {
 
 			"dns_prefix": {
 				Type:         schema.TypeString,
-				Required:     true,
+				Optional:     true,
 				ForceNew:     true,
+				ExactlyOneOf: []string{"dns_prefix", "private_cluster_custom_dns_prefix"},
 				ValidateFunc: containerValidate.KubernetesDNSPrefix,
 			},
 
+			"private_cluster_custom_dns_prefix": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				ForceNew:     true,
+				ExactlyOneOf: []string{"dns_prefix", "private_cluster_custom_dns_prefix"},
+			},
+
 			"kubernetes_version": {
 				Type:         schema.TypeString,
 				Optional:     true,
@@ -797,6 +805,10 @@ func resourceKubernetesClusterCreate(d *schema.ResourceData, meta interface{}) e
 		enablePrivateCluster = v.(bool)
 	}
 
+	if !enablePrivateCluster && dnsPrefix == "" {
+		return fmt.Errorf("`dns_prefix` should be set if it is not a private cluster")
+	}
+
 	apiAccessProfile := containerservice.ManagedClusterAPIServerAccessProfile{
 		EnablePrivateCluster: &enablePrivateCluster,
 		AuthorizedIPRanges:   apiServerAuthorizedIPRanges,
@@ -872,6 +884,13 @@ func resourceKubernetesClusterCreate(d *schema.ResourceData, meta interface{}) e
 		apiAccessProfile.PrivateDNSZone = utils.String(v.(string))
 	}
 
+	if v, ok := d.GetOk("private_cluster_custom_dns_prefix"); ok {
+		if !enablePrivateCluster || apiAccessProfile.PrivateDNSZone == nil || *apiAccessProfile.PrivateDNSZone == "System" || *apiAccessProfile.PrivateDNSZone == "None" {
+			return fmt.Errorf("`private_cluster_custom_dns_prefix` should only be set for private cluster with custom private dns zone")
+		}
+		parameters.FqdnSubdomain = utils.String(v.(string))
+	}
+
 	if v, ok := d.GetOk("disk_encryption_set_id"); ok && v.(string) != "" {
 		parameters.ManagedClusterProperties.DiskEncryptionSetID = utils.String(v.(string))
 	}
@@ -1271,6 +1290,7 @@ func resourceKubernetesClusterRead(d *schema.ResourceData, meta interface{}) err
 	if props := resp.ManagedClusterProperties; props != nil {
 		d.Set("dns_prefix", props.DNSPrefix)
 		d.Set("fqdn", props.Fqdn)
+		d.Set("private_cluster_custom_dns_prefix", props.FqdnSubdomain)
 		d.Set("private_fqdn", props.PrivateFQDN)
 		d.Set("disk_encryption_set_id", props.DiskEncryptionSetID)
 		d.Set("kubernetes_version", props.KubernetesVersion)

website/docs/r/kubernetes_cluster.html.markdown

@@ -66,7 +66,9 @@ The following arguments are supported:
 
 * `default_node_pool` - (Required) A `default_node_pool` block as defined below.
 
-* `dns_prefix` - (Required) DNS prefix specified when creating the managed cluster. Changing this forces a new resource to be created.
+* `dns_prefix` - (Optional) DNS prefix specified when creating the managed cluster. Changing this forces a new resource to be created.
+
+* `private_cluster_custom_dns_prefix` - (Optional) Specifies the Custom DNS prefix when creating the private cluster. Changing this forces a new resource to be created.
 
 -> **NOTE:** The `dns_prefix` must contain between 3 and 45 characters, and can contain only letters, numbers, and hyphens. It must start with a letter and must end with a letter or a number.