From 52175d62d9bb660b75f39c5579192a17ec517b78 Mon Sep 17 00:00:00 2001 From: Christof Graf Date: Wed, 24 Apr 2024 21:52:52 -0400 Subject: [PATCH 1/2] Remove the 'cannot remove secrets' check The underling [issue](https://github.com/microsoft/azure-container-apps/issues/395) has been fixed; hence the check is no longer needed. --- .../containerapps/container_app_resource.go | 26 ------------------- .../container_app_resource_test.go | 23 ---------------- website/docs/r/container_app.html.markdown | 2 -- 3 files changed, 51 deletions(-) diff --git a/internal/services/containerapps/container_app_resource.go b/internal/services/containerapps/container_app_resource.go index 8159e489b447..c283cad541e0 100644 --- a/internal/services/containerapps/container_app_resource.go +++ b/internal/services/containerapps/container_app_resource.go @@ -17,7 +17,6 @@ import ( "github.com/hashicorp/go-azure-helpers/resourcemanager/tags" "github.com/hashicorp/go-azure-sdk/resource-manager/containerapps/2023-05-01/containerapps" "github.com/hashicorp/go-azure-sdk/resource-manager/containerapps/2023-05-01/managedenvironments" - "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" "github.com/hashicorp/terraform-provider-azurerm/internal/sdk" "github.com/hashicorp/terraform-provider-azurerm/internal/services/containerapps/helpers" "github.com/hashicorp/terraform-provider-azurerm/internal/services/containerapps/validate" @@ -473,31 +472,6 @@ func (r ContainerAppResource) CustomizeDiff() sdk.ResourceFunc { } } - if metadata.ResourceDiff.HasChange("secret") { - stateSecretsRaw, configSecretsRaw := metadata.ResourceDiff.GetChange("secret") - stateSecrets := stateSecretsRaw.(*schema.Set).List() - configSecrets := configSecretsRaw.(*schema.Set).List() - // Check there's not less - if len(configSecrets) < len(stateSecrets) { - return fmt.Errorf("cannot remove secrets from Container Apps at this time due to a limitation in the Container Apps Service. Please see `https://github.com/microsoft/azure-container-apps/issues/395` for more details") - } - // Check secrets names in state are all present in config, the values don't matter - if len(stateSecrets) > 0 { - for _, s := range stateSecrets { - found := false - for _, c := range configSecrets { - if s.(map[string]interface{})["name"] == c.(map[string]interface{})["name"] { - found = true - break - } - } - if !found { - return fmt.Errorf("previously configured secret %q was removed. Removing secrets is not supported by the Container Apps Service at this time, see `https://github.com/microsoft/azure-container-apps/issues/395` for more details", s.(map[string]interface{})["name"]) - } - } - } - } - for _, s := range app.Secrets { if s.KeyVaultSecretId != "" && s.Identity == "" { return fmt.Errorf("secret %s must supply identity for key vault secret id", s.Name) diff --git a/internal/services/containerapps/container_app_resource_test.go b/internal/services/containerapps/container_app_resource_test.go index 94b1cda1da32..d22950a94f88 100644 --- a/internal/services/containerapps/container_app_resource_test.go +++ b/internal/services/containerapps/container_app_resource_test.go @@ -411,29 +411,6 @@ func TestAccContainerAppResource_removeDaprAppPort(t *testing.T) { }) } -func TestAccContainerAppResource_secretFail(t *testing.T) { - data := acceptance.BuildTestData(t, "azurerm_container_app", "test") - r := ContainerAppResource{} - - data.ResourceTest(t, r, []acceptance.TestStep{ - { - Config: r.secretBasic(data), - Check: acceptance.ComposeTestCheckFunc( - check.That(data.ResourceName).ExistsInAzure(r), - ), - }, - data.ImportStep(), - { - Config: r.secretRemove(data), - ExpectError: regexp.MustCompile("cannot remove secrets from Container Apps at this time"), - }, - { - Config: r.secretChangeName(data), - ExpectError: regexp.MustCompile("previously configured secret"), - }, - }) -} - func TestAccContainerAppResource_scaleRules(t *testing.T) { data := acceptance.BuildTestData(t, "azurerm_container_app", "test") r := ContainerAppResource{} diff --git a/website/docs/r/container_app.html.markdown b/website/docs/r/container_app.html.markdown index 348e965dbb0e..2ef4af53f63f 100644 --- a/website/docs/r/container_app.html.markdown +++ b/website/docs/r/container_app.html.markdown @@ -99,8 +99,6 @@ A `secret` block supports the following: !> **Note:** `value` will be ignored if `key_vault_secret_id` and `identity` are provided. -!> **Note:** Secrets cannot be removed from the service once added, attempting to do so will result in an error. Their values may be zeroed, i.e. set to `""`, but the named secret must persist. This is due to a technical limitation on the service which causes the service to become unmanageable. See [this issue](https://github.com/microsoft/azure-container-apps/issues/395) for more details. - --- A `template` block supports the following: From 501da2d9641b0355e252dde74e1cd500551998ca Mon Sep 17 00:00:00 2001 From: Christof Graf Date: Thu, 25 Apr 2024 15:17:38 -0400 Subject: [PATCH 2/2] Re-add updated tests for container app secrets --- .../container_app_resource_test.go | 44 +++++++++++++++++++ 1 file changed, 44 insertions(+) diff --git a/internal/services/containerapps/container_app_resource_test.go b/internal/services/containerapps/container_app_resource_test.go index d22950a94f88..8b332270c138 100644 --- a/internal/services/containerapps/container_app_resource_test.go +++ b/internal/services/containerapps/container_app_resource_test.go @@ -411,6 +411,50 @@ func TestAccContainerAppResource_removeDaprAppPort(t *testing.T) { }) } +func TestAccContainerAppResource_secretChangeName(t *testing.T) { + data := acceptance.BuildTestData(t, "azurerm_container_app", "test") + r := ContainerAppResource{} + + data.ResourceTest(t, r, []acceptance.TestStep{ + { + Config: r.secretBasic(data), + Check: acceptance.ComposeTestCheckFunc( + check.That(data.ResourceName).ExistsInAzure(r), + ), + }, + data.ImportStep(), + { + Config: r.secretChangeName(data), + Check: acceptance.ComposeTestCheckFunc( + check.That(data.ResourceName).ExistsInAzure(r), + ), + }, + data.ImportStep(), + }) +} + +func TestAccContainerAppResource_secretRemove(t *testing.T) { + data := acceptance.BuildTestData(t, "azurerm_container_app", "test") + r := ContainerAppResource{} + + data.ResourceTest(t, r, []acceptance.TestStep{ + { + Config: r.secretBasic(data), + Check: acceptance.ComposeTestCheckFunc( + check.That(data.ResourceName).ExistsInAzure(r), + ), + }, + data.ImportStep(), + { + Config: r.secretRemove(data), + Check: acceptance.ComposeTestCheckFunc( + check.That(data.ResourceName).ExistsInAzure(r), + ), + }, + data.ImportStep(), + }) +} + func TestAccContainerAppResource_scaleRules(t *testing.T) { data := acceptance.BuildTestData(t, "azurerm_container_app", "test") r := ContainerAppResource{}