I maintain reusable Terraform modules for AKS on GitHub: terraform-aks-modules. They were pinned to azurerm 3.x, two major versions behind, so I upgraded them to 5.x. Here's what broke.

The expected changes

  • Provider ~> 3.100 → ~> 5.13, and Terraform >= 1.7 (needed for mock providers in tests)
  • enable_auto_scaling → auto_scaling_enabled
  • automatic_channel_upgrade → automatic_upgrade_channel
  • managed removed from the Entra ID block (always on now)
  • New required node_provisioning_profile { mode = "Manual" }
  • Key Vault needs rbac_authorization_enabled set explicitly

What CI caught

After those changes, 6 of 14 checks still failed.

1. Entra ID needs a tenant or admin groups

Error: Missing required argument one of `admin_group_object_ids,tenant_id` must be specified

Fix:

azure_active_directory_role_based_access_control { tenant_id = data.azurerm_client_config.current.tenant_id admin_group_object_ids = var.admin_group_object_ids azure_rbac_enabled = true }

2. Service endpoints became a block

service_endpoint { service = "Microsoft.KeyVault" }

3. A test used the old shape. A splat expression fixed it:

contains(azurerm_subnet.aks.service_endpoint[*].service, "Microsoft.KeyVault")

4. The mock provider invented an invalid tenant ID

expected tenant_id to be a valid UUID, got 5mg23f4a

Fix: give the mock a realistic value.

mock_data "azurerm_client_config" { defaults = { tenant_id = "11111111-1111-1111-1111-111111111111" } }

Lesson

Read the upgrade guide, but trust your tests more. Two of these four weren't obvious from the changelog.

Released as v3.0.0. If you're doing the same upgrade, tell me what broke for you in the comments.