Skip to content
You are reading dev: the documentation of main. The last release, 0.1.0, predates this site.

Limits

What no apply can finish

Section titled “What no apply can finish”
  • One apply for the whole socle: no opentofu/clusters/azure; the foundations and the bootstrap are two applies (quickstart).
  • A login from helm_kubernetes: it needs Entra ID authentication, which the module does not enable; use az aks get-credentials --admin.
  • The bootstrap from outside the VNet: the API server is private; run it from the VNet or a connected network, with the private DNS zone resolvable.
  • The bootstrap without an aws provider block: give it a placeholder (measured).
  • A kubernetes_version that follows the cluster: once AKS moves the minor, the next plan may propose a downgrade AKS refuses (read from the code, not seen). Set it to az aks show --resource-group <rg> --name <cluster> --query currentKubernetesVersion -o tsv first.

Provider limits

Section titled “Provider limits”
  • Node Auto-Provisioning refuses Windows pools, IPv6, a cluster stop, and an outbound type change after creation.
  • BYO CNI: Microsoft support excludes CNI issues; nodes and control plane stay supported.
  • No pod_cidr and no network_policy on the cluster under network_plugin = "none"; Cilium’s pool and policies are the only ones.
  • AKS kube-proxy still runs beside Cilium’s replacement.
  • Deployment Safeguards: no azurerm 4.x attribute.
  • Maintenance windows are best effort, 4 to 24 hours; share none between clusters, or ARM may throttle.
  • One non-zonal NAT gateway: other zones cross a zone boundary, and lose egress if its zone fails.
  • Managed Prometheus and Container Insights are still created, superseded by the socle’s in-cluster monitoring, billed per GB.

What the socle does not offer here yet

Section titled “What the socle does not offer here yet”
  • Velero: refused at plan on azure.
  • A Crossplane Azure provider: providers render for aws and gcp only.
  • kube.keda.services: refused; use a TriggerAuthentication Secret or podIdentity.azureWorkload in values.
  • external-dns credentials: create the external-dns-azure Secret (external-dns).
  • Deployment Safeguards: Kyverno is the policy path.
  • Readers of Azure metrics, quotas and cost.
  • A real-cloud proof: planned with mocked providers only.