Upgrade AKS to Kubernetes 1.36.3 and azurerm to 5.4.0 - #57
Merged
Merged
Conversation
1.36 is on KubernetesOfficial + AKSLongTermSupport in westus2 and is offered directly by `az aks get-upgrades`, so it's a single-hop upgrade from 1.35.7. The node OS is unaffected. The default `Ubuntu` os_sku maps to Ubuntu 24.04 on 1.35+, and the pool is already there (AKSUbuntu-2404gen2arm64containerd), so 1.36 reimages the nodes without changing the Ubuntu version. Updated the os_sku comment, which still described the 22.04 -> 24.04 migration as pending. azurerm 5.4.0 adds list resources and API version bumps that don't touch anything here; `tofu plan` shows no drift from the bump. `max_unavailable` is still absent from the upgrade_settings schema, so that comment's reasoning holds -- only its version number changed. Also normalized the actions/github-script pin. It was `d746ffe...`, which is the annotated *tag object* for v9.0.0 rather than a commit. Actions resolves it and it's equally immutable, but the REST commits API 404s on it and pinning tooling expects a commit SHA, so it now points at `3a2844b...` -- the commit that tag dereferences to. Same code. Plan: 0 to add, 1 to change, 0 to destroy. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Aw2e3hf3pyTXnfL7j4EVaN
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Team Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
OpenTofu Format and Style
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Version audit of everything pinned in the repo. Two things were behind; the rest were already current.
.opentofu-version)hashicorp/azureadhashicorp/azurermhashicorp/kubernetesactions/checkoutopentofu/setup-opentofuactions/cacheazure/loginactions/github-scriptKubernetes 1.35.7 → 1.36.3
1.36 is on
KubernetesOfficial+AKSLongTermSupportin westus2, isn't preview, andaz aks get-upgradesoffers it directly — a single-hop upgrade with no skipped minor.The node OS is unaffected. The default
Ubuntuos_sku maps to Ubuntu 24.04 on 1.35+, and the pool is already on it (AKSUbuntu-2404gen2arm64containerd-202608.14.0), so 1.36 reimages the nodes without changing the Ubuntu version. The os_sku comment still described the 22.04 → 24.04 migration as something this upgrade would do, so it's been rewritten.One workload-level note that's outside this repo: 1.36 makes faster SELinux volume labeling the default for all volumes. Sharing a volume between privileged and unprivileged pods on the same node can misbehave under that change.
azurerm 5.3.0 → 5.4.0
New list resources, API version bumps for mongo/netapp, and one
azurerm_synapse_spark_poolbug fix — nothing touching the resources here, andtofu planconfirms no drift from the bump.max_unavailableis still absent from theupgrade_settingsschema in 5.4.0, so the reasoning in that comment holds; only its version number changed.actions/github-scriptpinThe pinned
d746ffe…isn't a commit — it's the annotated tag object for v9.0.0, which dereferences to commit3a2844b…. Actions resolves it fine and a tag object is just as immutable, so this was never broken. But the REST commits API 404s on it and pinning tooling (dependabot, zizmor, ratchet) expects a commit SHA, which makes it look like a bogus pin under audit. Now points at the commit. Same code.Verification
tofu fmt -check,tofu validate, andtflintpass; all pre-commit hooks including zizmor and actionlint pass..terraform.lock.hclis regenerated fromtofu init -upgrade; it also picks upconstraints = …lines for all three providers that the previous lock was missing.🤖 Generated with Claude Code
https://claude.ai/code/session_01Aw2e3hf3pyTXnfL7j4EVaN