Terraform-provider-azuredevops: When provisioning a Variable Group from KeyVault all the keys are included as disabled.

[moredhel]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and Azure DevOps Provider) Version

Terraform v0.14.0

• provider registry.terraform.io/microsoft/azuredevops v0.1.0

Affected Resource(s)

• azuredevops_variable_group

Terraform Configuration Files

# Make sure to set the following environment variables:
#   AZDO_PERSONAL_ACCESS_TOKEN
#   AZDO_ORG_SERVICE_URL
terraform {
  required_providers {
    azuredevops = {
      source  = "microsoft/azuredevops"
      version = ">=0.1.0"
    }
  }
}

data "azuredevops_project" "project" {
  name = "LeanPos"
}

resource "azuredevops_serviceendpoint_azurerm" "endpointazure" {
  project_id            = data.azuredevops_project.project.id
  service_endpoint_name = "My Sample AzureRM"
  description           = "Managed by Terraform"
  credentials {
    serviceprincipalid  = var.service_principal_id
    serviceprincipalkey = var.service_principal_secret
  }
  azurerm_spn_tenantid      = var.tenant_id
  azurerm_subscription_id   = var.subscription_id
  azurerm_subscription_name = "My Sample Subscription"
}

resource "azuredevops_variable_group" "variable-group" {
  project_id   = data.azuredevops_project.project.id
  name         = "sample-vg"
  description  = "Variables for the environment"
  allow_access = true

  key_vault {
    name                = var.vault_name
    service_endpoint_id = azuredevops_serviceendpoint_azurerm.endpointazure.id
  }

  variable {
    name = "cloudflare-api-token"
  }
}

Debug Output

https://gist.github.com/moredhel/3ae3539e1aac23582020cc63cf2437d5

Expected Behavior

Actual Behavior

Steps to Reproduce

1. Create a Keyvault
2. Add a secret
3. Add Permissions for a service-principal
4. terraform apply

Important Factoids

I had a look through the documentation of the azure-devops api & could find no reference to the 'Status' of a secret. I also had a look through the source-code of the AzDo Go sdk & could find no reference either.

Documentation

• https://github.com/microsoft/terraform-provider-azuredevops/issues/8
• https://gist.github.com/straubt1/f631dde08d4e875b2f829d203a5a1f17 (the enabled key is no longer valid)

[CaptainStealthy]

@moredhel I see that the bug label was added to this issue. I assume that you haven't found a solution to this?

I haven't tried this myself, but I found this thread while searching for documentation on how to add a variable group referencing Key Vault secrets.

For now, I've assumed that doing this is impossible/broken, so I've worked around it by just creating a normal variable group with values marked as "secret", so the values don't appear in the DevOps UI.

[moredhel]

Yes,

I have also worked around the issue by using the key vault task which does a reasonable job.

On 21 Dec 2020, at 21:51, CaptainStealthy [e-mail] wrote:


@moredhel I see that the bug label was added to this issue. I assume that you haven't found a solution to this?

I haven't tried this myself, but I found this thread while searching for documentation on how to add a variable group referencing Key Vault secrets.

For now, I've assumed that doing this is impossible/broken, so I've worked around it by just creating a normal variable group with values marked as "secret", so the values don't appear in the DevOps UI.

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub, or unsubscribe.

[drdamour]

per #8 it's supposed to work...

[moredhel]

per #8 it's supposed to work...

Indeed, I linked to that issue in my initial issue as something I had tried (but hadn't worked).

[CaptainStealthy]

@xuzhang3 Can you provide an ETA as to when this bug might be fixed?

[xuzhang3]

Hi @CaptainStealthy The root issue is provider not check the Azure KV data and generate the data by ADO configuration which missed some meta data. An ETA for this issue will be 6th Feb.

[xuzhang3]

Hi @CaptainStealthy this issue has been fixed in v0.1.2

[CaptainStealthy]

Thanks!

cc @moredhel @drdamour

[xuzhang3]

Close this issue, feel free to open another issue if you have question.