Upgrading AKS Terraform modules from azurerm 3.x to 5.x: what broke and how I fixed it

Sai Medarametla — Fri, 13 Nov 2026 15:32:07 +0000

I maintain reusable Terraform modules for AKS on GitHub: terraform-aks-modules. They were pinned to azurerm 3.x, two major versions behind, so I upgraded them to 5.x. Here's what broke.

The expected changes

Provider ~> 3.100 → ~> 5.13, and Terraform >= 1.7 (needed for mock providers in tests)
enable_auto_scaling → auto_scaling_enabled
automatic_channel_upgrade → automatic_upgrade_channel
managed removed from the Entra ID block (always on now)
New required node_provisioning_profile { mode = "Manual" }
Key Vault needs rbac_authorization_enabled set explicitly

What CI caught

After those changes, 6 of 14 checks still failed.

1. Entra ID needs a tenant or admin groups

Error: Missing required argument
one of `admin_group_object_ids,tenant_id` must be specified

Fix:

azure_active_directory_role_based_access_control {
  tenant_id              = data.azurerm_client_config.current.tenant_id
  admin_group_object_ids = var.admin_group_object_ids
  azure_rbac_enabled     = true
}

2. Service endpoints became a block

service_endpoint {
  service = "Microsoft.KeyVault"
}

3. A test used the old shape. A splat expression fixed it:

contains(azurerm_subnet.aks.service_endpoint[*].service, "Microsoft.KeyVault")

4. The mock provider invented an invalid tenant ID

expected tenant_id to be a valid UUID, got 5mg23f4a

Fix: give the mock a realistic value.

mock_data "azurerm_client_config" {
  defaults = {
    tenant_id = "11111111-1111-1111-1111-111111111111"
  }
}

Lesson

Read the upgrade guide, but trust your tests more. Two of these four weren't obvious from the changelog.

Released as v3.0.0. If you're doing the same upgrade, tell me what broke for you in the comments.

DEV Community: Sai Medarametla

Upgrading AKS Terraform modules from azurerm 3.x to 5.x: what broke and how I fixed it

The expected changes

What CI caught

Lesson