Skip to content
LogoLogo

Vertex Azure Terraform module v3.0.0

This is the Vertex Azure Terraform module, versioned separately from the Vertex itself. See Upgrading the Module.

Breaking

  • Requires newer providers (azurerm 4.81 or later, azapi 2.13 or later): run terraform init -upgrade.
  • A Managed HSM is required: running without Secure Key Release (unsafe_mode with vertex_basic_encryption_key) is no longer supported.
  • The admin token input is vertex_admin_token: rename admin_access_token if your configuration sets it.
  • The PostgreSQL firewall rule that allowed every IP address is removed: the server only has private access.
  • Clusters running Azure CNI Overlay must set aks_network_plugin_mode = "overlay".
  • Before the first plan, remove the old kubeconfig actions from the Terraform state, or the plan prints the cluster's admin credentials. See Upgrading the Module.

Added

  • The vertex-azure-aci chart, signed by Sodot, which pins the Vertex image and its SKR sidecar by digest. vertex_chart_version (default 1.18.5) selects it, and the same version generates the policy and deploys.
  • Redundancy: two virtual nodes and two admission controllers (virtual_node_replicas, virtual_node_admission_controller_replicas), two Vertex pods (vertex_min_replicas, vertex_max_replicas), PodDisruptionBudgets, health probes and resource requests.
  • kubernetes_version, virtual_node_chart_version, aks_node_vm_size and aks_network_plugin_mode.
  • database_sku_name, database_backup_retention_days and database_storage_auto_grow_enabled.
  • Observability: OpenTelemetry export through a collector sidecar (otel_endpoint), and Azure Monitor (Container Insights, managed Prometheus, diagnostic and audit logs, recommended alerts).
  • secure_key_release_encryption_key_version, to select the HSM key version an existing database uses.

Changed

  • Upgrades keep the running Vertex's access to its HSM key: the new release policy is added next to the previous one on the same key, at apply time and before the rollout. terraform plan no longer changes the key.
  • Terraform refuses any plan that replaces or destroys the database or the Vertex's identity. See Destroying a Deployment.
  • The module grants the Terraform identity Managed HSM Crypto User on keys, which key creation needs in addition to Managed HSM Crypto Officer. It only assigns roles the identity doesn't already hold.
  • Several deployments can use the same Managed HSM.
  • Applying no longer replaces the virtual nodes' roles, which blocked new Vertex pods for about 20 minutes on every apply.
  • Database storage grows automatically.