Root: infrastructure/environments/dev/session
Command: terraform plan -input=false -no-color -lock=false
Terraform 1.14.5 and azurerm 5.12.0, run from a copy of the root without backend.tf and with local state. Not applied.
Input: api_authorized_ip_ranges = ["203.0.113.10/32"] (a documentation address, not a real range)
Includes network_policy = azure and the web_app_routing block (ADR 0015 and ADR 0016).
GUIDs are masked as xxxx.


Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # azurerm_kubernetes_cluster.main will be created
  + resource "azurerm_kubernetes_cluster" "main" {
      + ai_toolchain_operator_enabled       = false
      + current_kubernetes_version          = (known after apply)
      + dns_prefix                          = "pp-dev-aks"
      + fqdn                                = (known after apply)
      + http_application_routing_zone_name  = (known after apply)
      + id                                  = (known after apply)
      + kube_admin_config                   = (sensitive value)
      + kube_admin_config_raw               = (sensitive value)
      + kube_config                         = (sensitive value)
      + kube_config_raw                     = (sensitive value)
      + kubernetes_version                  = "1.36.5"
      + location                            = "swedencentral"
      + name                                = "pp-dev-aks"
      + node_os_upgrade_channel             = "None"
      + node_resource_group                 = "pp-dev-aks-nodes-rg"
      + node_resource_group_id              = (known after apply)
      + oidc_issuer_enabled                 = true
      + oidc_issuer_url                     = (known after apply)
      + portal_fqdn                         = (known after apply)
      + private_cluster_enabled             = false
      + private_cluster_public_fqdn_enabled = false
      + private_dns_zone_id                 = (known after apply)
      + private_fqdn                        = (known after apply)
      + resource_group_name                 = "pp-dev-session-rg"
      + role_based_access_control_enabled   = true
      + run_command_enabled                 = true
      + sku_tier                            = "Free"
      + support_plan                        = "KubernetesOfficial"
      + tags                                = {
          + "env"        = "dev"
          + "managed-by" = "terraform"
          + "project"    = "production-platform-azure"
        }
      + workload_identity_enabled           = false

      + api_server_access_profile {
          + authorized_ip_ranges                = [
              + "203.0.113.10/32",
            ]
          + virtual_network_integration_enabled = false
        }

      + auto_scaler_profile (known after apply)

      + bootstrap_profile (known after apply)

      + default_node_pool {
          + auto_scaling_enabled = false
          + kubelet_disk_type    = (known after apply)
          + max_pods             = (known after apply)
          + name                 = "system"
          + node_count           = 2
          + node_labels          = (known after apply)
          + orchestrator_version = (known after apply)
          + os_disk_size_gb      = 32
          + os_disk_type         = "Managed"
          + os_sku               = (known after apply)
          + scale_down_mode      = "Delete"
          + type                 = "VirtualMachineScaleSets"
          + ultra_ssd_enabled    = false
          + vm_size              = "Standard_D2s_v5"
          + vnet_subnet_id       = (known after apply)
          + workload_runtime     = (known after apply)

          + upgrade_settings {
              + max_surge = "1"
            }
        }

      + identity {
          + principal_id = (known after apply)
          + tenant_id    = (known after apply)
          + type         = "SystemAssigned"
        }

      + kubelet_identity (known after apply)

      + network_profile {
          + dns_service_ip      = "10.96.0.10"
          + ip_versions         = (known after apply)
          + load_balancer_sku   = "standard"
          + network_data_plane  = "azure"
          + network_mode        = (known after apply)
          + network_plugin      = "azure"
          + network_plugin_mode = "overlay"
          + network_policy      = "azure"
          + outbound_type       = "loadBalancer"
          + pod_cidr            = "10.244.0.0/16"
          + pod_cidrs           = (known after apply)
          + service_cidr        = "10.96.0.0/16"
          + service_cidrs       = (known after apply)

          + load_balancer_profile (known after apply)

          + nat_gateway_profile (known after apply)
        }

      + node_provisioning_profile {
          + default_node_pools = "None"
          + mode               = "Manual"
        }

      + web_app_routing {
          + default_nginx_controller = "External"
          + dns_zone_ids             = []
          + web_app_routing_identity = (known after apply)
        }

      + windows_profile (known after apply)
    }

  # azurerm_resource_group.session will be created
  + resource "azurerm_resource_group" "session" {
      + id       = (known after apply)
      + location = "swedencentral"
      + name     = "pp-dev-session-rg"
      + tags     = {
          + "env"        = "dev"
          + "managed-by" = "terraform"
          + "project"    = "production-platform-azure"
        }
    }

  # azurerm_subnet.aks_nodes will be created
  + resource "azurerm_subnet" "aks_nodes" {
      + address_prefixes                              = [
          + "10.10.0.0/24",
        ]
      + default_outbound_access_enabled               = true
      + id                                            = (known after apply)
      + name                                          = "pp-dev-aks-nodes-snet"
      + network_security_group_id                     = (known after apply)
      + network_security_group_id_wo                  = (write-only attribute)
      + private_endpoint_network_policies             = "Disabled"
      + private_link_service_network_policies_enabled = true
      + resource_group_name                           = "pp-dev-session-rg"
      + route_table_id                                = (known after apply)
      + route_table_id_wo                             = (write-only attribute)
      + virtual_network_name                          = "pp-dev-vnet"
    }

  # azurerm_virtual_network.main will be created
  + resource "azurerm_virtual_network" "main" {
      + address_space                  = [
          + "10.10.0.0/16",
        ]
      + dns_servers                    = (known after apply)
      + guid                           = (known after apply)
      + id                             = (known after apply)
      + location                       = "swedencentral"
      + name                           = "pp-dev-vnet"
      + private_endpoint_vnet_policies = "Disabled"
      + resource_group_name            = "pp-dev-session-rg"
      + subnet                         = (known after apply)
      + tags                           = {
          + "env"        = "dev"
          + "managed-by" = "terraform"
          + "project"    = "production-platform-azure"
        }
    }

Plan: 4 to add, 0 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.