<p>I want AKS POD to add and delete DNS records whenever a Service is created. I have achieved the same via GUI, But I want to use terraform to do the same.</p>
<p>Created AKS Cluster:</p>
<pre><code>resource &quot;azurerm_kubernetes_cluster&quot; &quot;aks_cluster&quot; {
  name                = &quot;${azurerm_resource_group.my-res-grp-in-tf.name}-cluster&quot;
  location            = azurerm_resource_group.my-res-grp-in-tf.location
  resource_group_name = azurerm_resource_group.my-res-grp-in-tf.name
  dns_prefix          = &quot;${azurerm_resource_group.my-res-grp-in-tf.name}-cluster&quot;
  kubernetes_version  = data.azurerm_kubernetes_service_versions.current.latest_version
  node_resource_group = &quot;${azurerm_resource_group.my-res-grp-in-tf.name}-nrg&quot;

  default_node_pool {
    name                 = &quot;systempool&quot;
    vm_size              = &quot;standard_d2s_v3&quot; 
    orchestrator_version = data.azurerm_kubernetes_service_versions.current.latest_version
    availability_zones   = [1, 2, 3]
    enable_auto_scaling  = true
    max_count            = 1
    min_count            = 1
    os_disk_size_gb      = 30
    type                 = &quot;VirtualMachineScaleSets&quot;
    node_labels = {
      &quot;nodepool-type&quot;    = &quot;system&quot;
      &quot;environment&quot;      = var.env
      &quot;nodepoolos&quot;       = &quot;linux&quot;
      &quot;app&quot;              = &quot;system-apps&quot; 
    } 
   tags = {
      &quot;nodepool-type&quot;    = &quot;system&quot;
      &quot;environment&quot;      = var.env
      &quot;nodepoolos&quot;       = &quot;linux&quot;
      &quot;app&quot;              = &quot;system-apps&quot; 
   } 
  }

# Identity (one of either identity or service_principal blocks must be specified.)
  identity {
    type = &quot;SystemAssigned&quot;
  }

# Add On Profiles
  addon_profile {
        azure_policy {
            enabled =  true
    }
    kube_dashboard {
            enabled = false
        }
        http_application_routing {
            enabled = false
        }
        oms_agent {
            enabled =  true
            log_analytics_workspace_id = azurerm_log_analytics_workspace.insights.id
        }

  }

# RBAC and Azure AD Integration Block
  role_based_access_control {
    enabled = true
    azure_active_directory {
      managed = true
      admin_group_object_ids = [azuread_group.aks_administrators.id]
    }
  }

# Windows Profile
  windows_profile {
    admin_username = var.windows_admin_username
    admin_password = var.windows_admin_password
  }

# Linux Profile
  linux_profile {
    admin_username = &quot;ubuntu&quot;
    ssh_key {
      key_data = file(var.ssh_public_key)
    }
  }

# Network Profile
  network_profile {
    network_plugin = &quot;azure&quot;
    load_balancer_sku = &quot;Standard&quot;
  }

  tags = {
    Environment = var.env
  }


# login into cluster 
provisioner &quot;local-exec&quot; {
        command = &quot;az aks get-credentials --name ${azurerm_kubernetes_cluster.aks_cluster.name} --resource-group ${azurerm_resource_group.my-res-grp-in-tf.name} --admin&quot;
  }

}
</code></pre>
<p>I have created a resource group named &quot;dns-zone-rg&quot;  specifically for this task.</p>
<pre><code>resource &quot;azurerm_resource_group&quot; &quot;dns-zone-rg-tf&quot; {
  name     = &quot;dns-zone-rg&quot;
  location = var.location
}
</code></pre>
<p>Created a DNS zone in &quot;dns-zone-rg&quot; resource group</p>
<pre><code>resource &quot;azurerm_dns_zone&quot; &quot;public-domain-dns-zone&quot; {
  name                = &quot;mydomain.xyz&quot;
  resource_group_name = azurerm_resource_group.dns-zone-rg-tf.name
}
</code></pre>
<p>Created Manage Identity &quot;mi-for-dns-zone-rg&quot; in &quot;dns-zone-rg&quot; resource group</p>
<pre><code>resource &quot;azurerm_user_assigned_identity&quot; &quot;manage-identity-tf&quot; {
  resource_group_name = azurerm_resource_group.dns-zone-rg-tf.name
  location            = var.location
  name = &quot;mi-for-dns-zone-rg&quot;
}
</code></pre>
<p>Assigned &quot;Contributor&quot; role to manage identity &quot;mi-for-dns-zone-rg&quot; and given a scope to manage resources in resource group &quot;dns-zone-rg&quot;.</p>
<pre><code>resource &quot;azurerm_role_assignment&quot; &quot;assign-reader-to-manage-identity&quot; {
  scope                = azurerm_resource_group.dns-zone-rg-tf.id
  role_definition_name = &quot;Contributor&quot;
  principal_id         = azurerm_user_assigned_identity.manage-identity-tf.principal_id
}
</code></pre>
<p>Now I want to associate this Manage Identity &quot;mi-for-dns-zone-rg&quot; to the &quot;SystemNode Pool&quot; created by AKS. I am not able to figure out how to do that. and how to fetch node pool details created by AKS.</p>

<p>Currently, It's not possible in Terraform.
You have to use local-exec in Terraform and Azure CLI commands to achieve the same.</p>
<pre><code>resource &quot;null_resource&quot; &quot;node-pool-name&quot;{
  depends_on = [azurerm_kubernetes_cluster.aks_cluster,azurerm_role_assignment.assign-reader-to-manage-identity]

  provisioner &quot;local-exec&quot; {
    command = &quot;az vmss list -g ${azurerm_kubernetes_cluster.aks_cluster.node_resource_group} --query \&quot;[?contains(name,'aks-systempool')].name\&quot; --out tsv &gt; ${path.module}/system-node-poolname.txt&quot;
  }

  provisioner &quot;local-exec&quot; {
    command = &quot;az vmss identity assign -g ${azurerm_kubernetes_cluster.aks_cluster.node_resource_group} -n `cat ${path.module}/system-node-poolname.txt` --identities ${azurerm_user_assigned_identity.manage-identity-tf.id}&quot;
  }
}
</code></pre>
