feat(azure): foundations module — VNet, AKS Standard + NAP, identities

[Garinlu]

Summary

• The Azure sprint's deliverable: opentofu/azure/ — VNet, AKS Standard + Node Auto-Provisioning cluster, identities, built on the sprint's four research docs (docs(azure): decide Standard + NAP over AKS Automatic #21, docs(azure): decide the managed scope for upgrades, add-ons, identity #22, docs(azure): decide network & security baseline #23, docs(azure): cloud observability — supervision hors K8s (offre B) #24, all merged).
• Every decision traces to a doc: sku_tier = "Standard" + node_provisioning_profile { mode = "Auto" }, network_plugin = "none" (BYO CNI, Cilium installed later by the factory), automatic_upgrade_channel = "stable" + KubernetesOfficial support plan, private cluster with the public FQDN disabled, Entra Workload ID, Managed Prometheus + Container Insights.
• Two things decided during implementation, not in the research docs: Deployment Safeguards has no azurerm attribute (4.x series) and no open-source GitOps equivalent, so it's left out of this empty-shell module rather than guessed at via azapi; Microsoft Defender for Containers is a subscription-level singleton (same shape as AWS's GuardDuty), so it's excluded entirely rather than exposed as a variable.
• examples/minimal, tests/ (12 tofu test runs — mocked, since azurerm has no offline-plan path the way aws/google do), and tests/emulator (a fixture wrapping the module for CI, required because azurerm has no environment-only configuration path either).
• CI: integration.yaml's azure leg points at the fixture and enables TLS on floci-az. Known red, not blocking (continue-on-error): floci-az's self-signed certificate fails Go's x509 validation, so the plan fails at provider configuration, before any resource — a floci-az bug, not something this repo can fix.
• Validated against a real Azure subscription (Socle-staging, examples/minimal, francecentral): full apply succeeded — resource group, VNet, NAT Gateway, private AKS cluster, Container Insights, Managed Prometheus. Surfaced and fixed one genuine bug: default_node_pool.upgrade_settings gets server-side defaults from AKS regardless of whether it's declared, producing a perpetual plan diff — now declared explicitly. Also exposed zones and system_node_pool_vm_size as passthrough variables on examples/minimal, since both are subscription/region-specific in practice (VM family quota and AZ support vary per subscription — hit both during this validation).
• Addressed the three Trivy code-scanning findings: RBAC (already the provider default, now declared explicitly) fixed directly; network policy and disk encryption set suppressed with #trivy:ignore + inline rationale, matching the pattern already used in opentofu/aws/cluster.tf and opentofu/gcp/cluster.tf (network_policy has no valid value under BYO CNI; a customer-managed disk encryption key is a client's own compliance choice, same class as Defender).

Test plan

• tofu fmt -check -recursive, tofu validate — module root and examples/minimal
• tofu test — 12/12 passing
• tflint (real tflint-ruleset-azurerm 0.32.0) — clean
• terraform-docs --output-check — clean, both locations
• actionlint / yamllint on integration.yaml — clean
• trivy config — 0 misconfigurations (verified locally and in CI)
• Real Azure sandbox: tofu apply/destroy against a live subscription — succeeded, one real bug found and fixed
• floci-az emulator leg — known red (TLS certificate bug in floci-az itself, outside this repo's control); what a working plan would additionally surface (real VNet/AKS/Monitor resource acceptance) stays untested

🤖 Generated with Claude Code