Applies to: ✔️ Fleet Manager ✔️ Fleet Manager with hub cluster
Learn how to create an Azure Kubernetes Fleet Manager using Terraform.
Before you begin
If you don't have an Azure account, create a free account before you begin.
Important
If you're using the 4.x AzureRM Terraform provider, you must explicitly specify the Azure subscription ID to authenticate to Azure before running commands.
One way to specify the Azure subscription ID without putting it in the providers block is to specify the subscription ID in an environment variable named ARM_SUBSCRIPTION_ID.
For more information, see the Azure provider reference documentation.
Create a Fleet Manager
You can create a Fleet Manager and later add your AKS and Arc-enabled clusters as member clusters. If the Fleet Manager has a hub cluster, more features are enabled, such as Kubernetes object propagation and Managed Fleet Namespaces. For more information, see the conceptual overview of Fleet Manager types, which provides a comparison of different Fleet Manager configurations.
Note
Once a Fleet Manager is created, it's possible to upgrade a Fleet Manager resource without a hub cluster to one with a hub cluster. For Fleet Manager resources with a hub cluster, once private or public is selected it can't be changed.
To create a Fleet Manager without a hub cluster, use the following steps.
Create a directory you can use to test the sample Terraform code and make it your current directory.
Create a file named providers.tf and insert the following code:
terraform {
required_providers {
azurerm = {
source = "hashicorp/azurerm"
version = "~>4.0"
}
random = {
source = "hashicorp/random"
version = "~>3.0"
}
}
}
provider "azurerm" {
features {}
}
Create a file named main.tf and insert the following code:
resource "random_pet" "rg_name" {
prefix = var.resource_group_name_prefix
}
resource "azurerm_resource_group" "fleet_rg" {
name = random_pet.rg_name.id
location = var.resource_group_location
}
resource "random_string" "fleet_name" {
length = 63
lower = true
numeric = false
special = false
upper = false
}
resource "azurerm_kubernetes_fleet_manager" "fleet" {
location = azurerm_resource_group.fleet_rg.location
name = coalesce(var.fleet_name, random_string.fleet_name.result)
resource_group_name = azurerm_resource_group.fleet_rg.name
}
Create a file named variables.tf and insert the following code:
variable "resource_group_location" {
type = string
default = "eastus"
description = "Location of the resource group"
}
variable "resource_group_name_prefix" {
type = string
default = "rg"
description = "Prefix of the resource group name that's combined with a random ID so name is unique in your Azure subscription."
}
variable "fleet_name" {
type = string
description = "Name of the fleet resource. If left blank, this value is randomly generated."
default = ""
}
Create a file named outputs.tf and insert the following code:
output "resource_group_name" {
value = azurerm_resource_group.fleet_rg.name
}
output "fleet_name" {
value = azurerm_kubernetes_fleet_manager.fleet.name
}
To use Fleet Manager for Kubernetes object propagation or Managed Fleet Namespaces in addition to cluster upgrades, you need to create the Fleet Manager with a hub cluster.
Fleet Manager hub clusters support both public and private modes for network access. For more information, see Choose an Azure Kubernetes Fleet Manager option.
Create a directory you can use to test the sample Terraform code and make it your current directory.
Create a file named providers.tf and insert the following code:
terraform {
required_providers {
azapi = {
source = "azure/azapi"
version = "~> 2.0"
}
azurerm = {
source = "hashicorp/azurerm"
version = "~> 4.0"
}
random = {
source = "hashicorp/random"
version = "~> 3.1"
}
}
}
provider "azurerm" {
features {}
}
provider "azapi" {
}
Create a file named variables.tf insert the following code.
variable "location" {
description = "The Azure region where resources will be created"
type = string
default = "Australia East"
}
variable "resource_group_name" {
description = "The name of the resource group"
type = string
default = null
}
variable "fleet_name" {
description = "The name of the Fleet"
type = string
default = null
}
variable "hub_cluster_vm_size" {
description = "VM size for the Fleet hub cluster"
type = string
default = "Standard_D2s_v3"
}
Create a file named main.tf and insert the following code:
# Generate random suffix for unique resource names
resource "random_string" "suffix" {
length = 4
special = false
upper = false
}
# Local values for resource naming
locals {
resource_group_name = coalesce(var.resource_group_name, "rg-fleet-example-${random_string.suffix.result}")
fleet_name = coalesce(var.fleet_name, "fleet-example-${random_string.suffix.result}")
}
# Resource Group
resource "azurerm_resource_group" "fleet_rg" {
name = local.resource_group_name
location = var.location
}
Public hub cluster
Create a file named fleet.tf and insert the following code:
resource "azapi_resource" "fleet_public" {
type = "Microsoft.ContainerService/fleets@2025-03-01"
name = "${local.fleet_name}-pub"
location = azurerm_resource_group.fleet_rg.location
parent_id = azurerm_resource_group.fleet_rg.id
body = {
properties = {
hubProfile = {
agentProfile = {
vmSize = var.hub_cluster_vm_size
}
apiServerAccessProfile = {
enablePrivateCluster = false
enableVnetIntegration = false
}
dnsPrefix = "${local.fleet_name}-pub"
}
}
}
identity {
type = "SystemAssigned"
}
depends_on = [
azurerm_resource_group.fleet_rg
]
}
Private hub cluster
When you create a Fleet Manager with a private hub cluster, take these additional considerations into account:
- Fleet Manager requires you to provide the subnet on which the Fleet Manager hub cluster's node Virtual Machine (VM) is placed. This can be done by setting
subnetId in the agentProfile within the Fleet Manager's hubProfile.
- The address prefix of the vnet vnetName must not overlap with the Azure Kubernetes Service's (AKS) default service range of
10.0.0.0/16.
- Private access mode doesn't allow configuring domain names.
- Private access mode requires a
Network Contributor role assignment on the agent subnet for Fleet Manager's first party service principal (Fleet Manager's first party service principal ID varies across different Entra tenants). This role assignment is NOT needed when creating private Fleet Manager using the az fleet create command because the CLI automatically creates the role assignment.
Fetch Fleet Manager's service principal object ID:
az ad sp list \
--display-name "Azure Kubernetes Service - Fleet RP" \
--query "[].{id:id}" \
--output tsv
xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
Create a file named identity.tf and insert the following code, updating the placeholder principal_id to match the output from the earlier service principal query:
##
# REQUIRED: Assign Network Contributor Role to "Azure Kubernetes Service - Fleet RP" to enable hub cluster updates
##
resource "azurerm_role_assignment" "fleet_identity_01_network_contributor" {
scope = azurerm_subnet.hub-cluster-subnet.id
role_definition_name = "Network Contributor"
principal_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
principal_type = "ServicePrincipal"
depends_on = [azurerm_subnet.hub-cluster-subnet]
}
##
# REQUIRED: Create User Assigned Managed Identity for Fleet Manager
##
resource "azurerm_user_assigned_identity" "fleet_user_assigned_identity" {
location = azurerm_resource_group.fleet_rg.location
name = "${local.fleet_name}-uai"
resource_group_name = azurerm_resource_group.fleet_rg.name
}
# REQUIRED: Assign Managed Identity the Network Contributor Role scoped to Hub Cluster API Server Subnet
resource "azurerm_role_assignment" "fleet_user_assign_id_api_subnet_network_contributor" {
scope = azurerm_subnet.fleet-hub-apiserver-subnet.id
role_definition_name = "Network Contributor"
principal_id = azurerm_user_assigned_identity.fleet_user_assigned_identity.principal_id
principal_type = "ServicePrincipal"
depends_on = [azurerm_subnet.fleet-hub-apiserver-subnet, azurerm_user_assigned_identity.fleet_user_assigned_identity]
}
# REQUIRED: Assign Managed Identity the Network Contributor Role scoped to Hub Cluster Subnet
resource "azurerm_role_assignment" "fleet_user_assign_id_hub_subnet_network_contributor" {
scope = azurerm_subnet.hub-cluster-subnet.id
role_definition_name = "Network Contributor"
principal_id = azurerm_user_assigned_identity.fleet_user_assigned_identity.principal_id
principal_type = "ServicePrincipal"
depends_on = [azurerm_subnet.hub-cluster-subnet, azurerm_user_assigned_identity.fleet_user_assigned_identity]
}
Create a file named vnet.tf and insert the following code. If you want to use an existing virtual network you can replace the contents of vnet.tf file with resource references only, ensuring you have the correct subnets and delegations in place.
resource "azurerm_virtual_network" "hub-vnet" {
name = "${local.fleet_name}-vnet"
location = azurerm_resource_group.fleet_rg.location
resource_group_name = azurerm_resource_group.fleet_rg.name
address_space = ["10.224.0.0/12"]
}
resource "azurerm_subnet" "hub-cluster-subnet" {
name = "fleet-hub-cluster-subnet"
resource_group_name = azurerm_resource_group.fleet_rg.name
virtual_network_name = azurerm_virtual_network.hub-vnet.name
address_prefixes = ["10.224.0.0/15"]
private_endpoint_network_policies = "Disabled"
private_link_service_network_policies_enabled = true
}
resource "azurerm_subnet" "fleet-hub-apiserver-subnet" {
name = "fleet-hub-apiserver-subnet"
resource_group_name = azurerm_resource_group.fleet_rg.name
virtual_network_name = azurerm_virtual_network.hub-vnet.name
address_prefixes = ["10.226.0.0/15"]
delegation {
name = "aksApiServerSubnetDelegation"
service_delegation {
name = "Microsoft.ContainerService/managedClusters"
}
}
}
Create a file named fleet.tf and insert the following code:
# Fleet Resource
resource "azapi_resource" "fleet" {
type = "Microsoft.ContainerService/fleets@2025-03-01"
name = local.fleet_name
location = azurerm_resource_group.fleet_rg.location
parent_id = azurerm_resource_group.fleet_rg.id
body = {
properties = {
hubProfile = {
agentProfile = {
subnetId = azurerm_subnet.hub-cluster-subnet.id
vmSize = var.hub_cluster_vm_size
}
apiServerAccessProfile = {
enablePrivateCluster = true
enableVnetIntegration = true
subnetId = azurerm_subnet.fleet-hub-apiserver-subnet.id
}
dnsPrefix = local.fleet_name
}
}
}
identity {
type = "UserAssigned"
identity_ids = [azurerm_user_assigned_identity.fleet_user_assigned_identity.id]
}
depends_on = [
azurerm_resource_group.fleet_rg,
azurerm_role_assignment.fleet_identity_01_network_contributor,
azurerm_user_assigned_identity.fleet_user_assigned_identity,
azurerm_role_assignment.fleet_user_assign_id_api_subnet_network_contributor,
azurerm_role_assignment.fleet_user_assign_id_hub_subnet_network_contributor
]
}
Run terraform init to initialize the Terraform deployment. This command downloads the Azure provider required to manage your Azure resources.
terraform init -upgrade
Key points:
- The
-upgrade parameter upgrades the necessary provider plugins to the newest version that complies with the configuration's version constraints.
Run terraform plan to create an execution plan.
terraform plan -out main.tfplan
Key points:
- The
terraform plan command creates an execution plan, but doesn't execute it. Instead, it determines what actions are necessary to create the configuration specified in your configuration files. This pattern allows you to verify whether the execution plan matches your expectations before making any changes to actual resources.
- The optional
-out parameter allows you to specify an output file for the plan. Using the -out parameter ensures that the plan you reviewed is exactly what is applied.
Run terraform apply to apply the execution plan to your cloud infrastructure.
terraform apply main.tfplan
Key points:
- The example
terraform apply command assumes you previously ran terraform plan -out main.tfplan.
- If you specified a different filename for the
-out parameter, use that same filename in the call to terraform apply.
- If you didn't use the
-out parameter, call terraform apply without any parameters.
Verify the results
Verify results using either Azure CLI or Azure PowerShell.
Get the Azure resource group name.
resource_group_name=$(terraform output -raw resource_group_name)
Get the Fleet Manager name.
batch_name=$(terraform output -raw fleet_name)
Run az fleet show to view the Azure Kubernetes Fleet Manager.
az fleet show --resource-group $resource_group_name --name $fleet_name
Get the Azure resource group name.
$resource_group_name=$(terraform output -raw resource_group_name)
Get the Fleet Manager name.
$batch_name=$(terraform output -raw fleet_name)
Run Get-AzFleet to view the Azure Kubernetes Fleet Manager.
Get-AzFleet -ResourceGroupName $resource_group_name -Name $fleet_name
Clean up resources
When you no longer need the resources created via Terraform, do the following steps:
Run terraform plan and specify the destroy flag.
terraform plan -destroy -out main.destroy.tfplan
Key points:
- The
terraform plan command creates an execution plan, but doesn't execute it. Instead, it determines what actions are necessary to create the configuration specified in your configuration files. This pattern allows you to verify whether the execution plan matches your expectations before making any changes to actual resources.
- The optional
-out parameter allows you to specify an output file for the plan. Using the -out parameter ensures that the plan you reviewed is exactly what is applied.
Run terraform apply to apply the execution plan.
terraform apply main.destroy.tfplan
Next steps