feat(kms): add Key Vault KMS encryption support for AKS clusters

[xinWeiWei24]

This commit introduces KMS support for AKS cluster creation, including:

• Adding the key_vault_kms_config variable to define a Key Vault with multiple encryption keys.
• Enabling explicit key selection per AKS cluster via the kms_key_name parameter.

When KMS is enabled for an AKS cluster, use a user-assigned identity and grant:

• Key Vault Crypto User role to the Key Vault.
• Key Vault Crypto Service Encryption User role to the Key Vault key.

[Copilot]

Pull request overview

This PR adds Key Management Service (KMS) support for AKS clusters using Azure Key Vault encryption. The implementation enables users to configure a Key Vault with encryption keys and selectively enable KMS on individual AKS clusters for etcd encryption.

Key Changes:

• New key_vault_kms_config variable to define Key Vault and encryption keys
• Per-cluster KMS enablement via kms_key_name parameter in AKS configurations
• User-assigned identity creation and RBAC role assignments for KMS-enabled clusters

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 13 comments.

Show a summary per file

File	Description
modules/terraform/azure/variables.tf	Added key_vault_kms_config variable with validation, and kms_key_name/key_vault_network_access parameters to AKS configs
modules/terraform/azure/main.tf	Integrated key_vault module, updated provider with Key Vault features, passed KMS config to AKS/AKS-CLI modules
modules/terraform/azure/key-vault/versions.tf	New module: defined Terraform and azurerm provider version requirements
modules/terraform/azure/key-vault/variables.tf	New module: defined variables for Key Vault configuration with validation
modules/terraform/azure/key-vault/outputs.tf	New module: exposed Key Vault ID and key mappings for use by AKS modules
modules/terraform/azure/key-vault/main.tf	New module: implemented Key Vault creation, key generation, and RBAC role assignments
modules/terraform/azure/aks/variables.tf	Added key_management_service variable with Key Vault configuration object
modules/terraform/azure/aks/main.tf	Added user-assigned identity creation, KMS configuration block, and Key Vault role assignments
modules/terraform/azure/aks-cli/variables.tf	Added key_management_service variable for CLI-based AKS clusters
modules/terraform/azure/aks-cli/main.tf	Added KMS parameters to CLI command and Key Vault role assignments (has critical bug)
modules/terraform/azure/tests/test_aks_aad.tftest.hcl	Changed test commands from plan to apply (unnecessary and inconsistent with repo patterns)