Support for secret volumes in azurerm_container_group

[amasover]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

The provider should support secret volumes in Container Instances, as available through the CLI and as described here:

https://docs.microsoft.com/en-us/azure/container-instances/container-instances-volume-secret

New or Affected Resource(s)

• azurerm_container_group

Potential Terraform Configuration

resource "azurerm_container_group" "test" {
  container {
    name = "test"
    secret_volume {
      mount_path = "/mnt/secrets"
      secrets = {  # kind of like how resource tags work
        name_of_the_secret = "some password"
        another_secret = "some other super duper secret"
      }
    }
  }
}

References

• https://docs.microsoft.com/en-us/azure/container-instances/container-instances-volume-secret
• https://docs.microsoft.com/en-us/cli/azure/container?view=azure-cli-latest#az-container-create

[Sbou]

Hi,

I try to do this enhancement but I have an error in my acceptance test and I don't know why.
Can anyone help me ?

I guess is about sensitive datas, but I'm not sure.

In my test I put this sample:

resource "azurerm_container_group" "test" {
  name                = "acctestcontainergroup-%d"
  location            = "${azurerm_resource_group.test.location}"
  resource_group_name = "${azurerm_resource_group.test.name}"
  ip_address_type     = "public"
  os_type             = "Linux"

  container {
    name   = "hw"
    image  = "microsoft/aci-helloworld:latest"
    cpu    = "0.5"
    memory = "0.5"
    ports {
      port     = 80
      protocol = "TCP"
    }

    volume {
      name       = "config"
      mount_path = "/var/config"

      secret = {
        mysecret1 = "TXkgZmlyc3Qgc2VjcmV0IEZPTwo="
        mysecret2 = "TXkgc2Vjb25kIHNlY3JldCBCQVIK"
      }
    }
  }

  tags = {
    environment = "Testing"
  }
}

And in my test result I have this error:

DIFF:

        DESTROY/CREATE: azurerm_container_group.test
          container.#:                               "1" => "1"
          container.0.commands:                      "" => "<computed>"
          container.0.commands.#:                    "0" => ""
          container.0.cpu:                           "0.5" => "0.5"
          container.0.gpu.#:                         "0" => "0"
          container.0.image:                         "microsoft/aci-helloworld:latest" => "microsoft/aci-helloworld:latest"
          container.0.liveness_probe.#:              "0" => "0"
          container.0.memory:                        "0.5" => "0.5"
          container.0.name:                          "hw" => "hw"
          container.0.ports.#:                       "1" => "1"
          container.0.ports.0.port:                  "80" => "80"
          container.0.ports.0.protocol:              "TCP" => "TCP"
          container.0.readiness_probe.#:             "0" => "0"
          container.0.volume.#:                      "1" => "1"
          container.0.volume.0.git_repo.#:           "0" => "0"
          container.0.volume.0.mount_path:           "/var/config" => "/var/config"
          container.0.volume.0.name:                 "config" => "config"
          container.0.volume.0.read_only:            "false" => "false"
          container.0.volume.0.secret.mysecret1:     "" => "TXkgZmlyc3Qgc2VjcmV0IEZPTwo=" (forces new resource)
          container.0.volume.0.secret.mysecret2:     "" => "TXkgc2Vjb25kIHNlY3JldCBCQVIK" (forces new resource)
          container.0.volume.0.share_name:           "" => ""
          container.0.volume.0.storage_account_key:  "" => ""
          container.0.volume.0.storage_account_name: "" => ""
          diagnostics.#:                             "0" => "0"
          dns_config.#:                              "0" => "0"
          dns_name_label:                            "" => ""
          fqdn:                                      "" => "<computed>"
          id:                                        "/subscriptions/9e7dbf8b-6a82-4beb-9434-8313e1c7a0a4/resourceGroups/acctestRG-201028124150228750/providers/Microsoft.ContainerInstance/containerGroups/acctestcontainergroup-201028124150228750" => "<computed>"
          identity:                                  "" => "<computed>"
          identity.#:                                "0" => ""
          image_registry_credential.#:               "0" => "0"
          ip_address:                                "20.50.9.120" => "<computed>"
          ip_address_type:                           "Public" => "public"
          location:                                  "westeurope" => "westeurope"
          name:                                      "acctestcontainergroup-201028124150228750" => "acctestcontainergroup-201028124150228750"
          os_type:                                   "Linux" => "Linux"
          resource_group_name:                       "acctestRG-201028124150228750" => "acctestRG-201028124150228750"
          restart_policy:                            "Always" => "Always"
          tags.environment:                          "Testing" => "Testing"

My test function is very straight.

func TestAccAzureRMContainerGroup_secretVolume(t *testing.T) {
	data := acceptance.BuildTestData(t, "azurerm_container_group", "test")

	resource.ParallelTest(t, resource.TestCase{
		PreCheck:     func() { acceptance.PreCheck(t) },
		Providers:    acceptance.SupportedProviders,
		CheckDestroy: testCheckAzureRMContainerGroupDestroy,
		Steps: []resource.TestStep{
			{
				Config: testAccAzureRMContainerGroup_secretVolume(data),
				Check: resource.ComposeTestCheckFunc(
					testCheckAzureRMContainerGroupExists(data.ResourceName),
				),
			},
			data.ImportStep(
				"container.0.volume.0.secret.mysecret1",
				"container.0.volume.0.secret.mysecret2"),
		},
	})
}

Thanks,

[Sbou]

Hi, I fixed my acceptance test issue and I did a PR (#9117) for this ticket.

[Sbou]

Hello,

I really need this functionality.
Could it be part of the next release?

Thanks

[ghost]

This has been released in version 2.37.0 of the provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading. As an example:

provider "azurerm" {
    version = "~> 2.37.0"
}
# ... other configuration ...

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 hashibot-feedback@hashicorp.com. Thanks!