Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

azurerm_container_app - Remove 'cannot remove secrets' check #25743

Merged
merged 2 commits into from May 6, 2024
Merged

azurerm_container_app - Remove 'cannot remove secrets' check #25743

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
52175d6
Remove the 'cannot remove secrets' check
cgraf-spiria Apr 25, 2024
501da2d
Re-add updated tests for container app secrets
cgraf-spiria Apr 25, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
26 changes: 0 additions & 26 deletions internal/services/containerapps/container_app_resource.go
View file
Open in desktop
Expand Up @@ -17,7 +17,6 @@ import (
"github.com/hashicorp/go-azure-helpers/resourcemanager/tags"
"github.com/hashicorp/go-azure-sdk/resource-manager/containerapps/2023-05-01/containerapps"
"github.com/hashicorp/go-azure-sdk/resource-manager/containerapps/2023-05-01/managedenvironments"
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
"github.com/hashicorp/terraform-provider-azurerm/internal/sdk"
"github.com/hashicorp/terraform-provider-azurerm/internal/services/containerapps/helpers"
"github.com/hashicorp/terraform-provider-azurerm/internal/services/containerapps/validate"
Expand Down Expand Up @@ -473,31 +472,6 @@ func (r ContainerAppResource) CustomizeDiff() sdk.ResourceFunc {
}
}

if metadata.ResourceDiff.HasChange("secret") {
stateSecretsRaw, configSecretsRaw := metadata.ResourceDiff.GetChange("secret")
stateSecrets := stateSecretsRaw.(*schema.Set).List()
configSecrets := configSecretsRaw.(*schema.Set).List()
// Check there's not less
if len(configSecrets) < len(stateSecrets) {
return fmt.Errorf("cannot remove secrets from Container Apps at this time due to a limitation in the Container Apps Service. Please see `https://github.com/microsoft/azure-container-apps/issues/395` for more details")
}
// Check secrets names in state are all present in config, the values don't matter
if len(stateSecrets) > 0 {
for _, s := range stateSecrets {
found := false
for _, c := range configSecrets {
if s.(map[string]interface{})["name"] == c.(map[string]interface{})["name"] {
found = true
break
}
}
if !found {
return fmt.Errorf("previously configured secret %q was removed. Removing secrets is not supported by the Container Apps Service at this time, see `https://github.com/microsoft/azure-container-apps/issues/395` for more details", s.(map[string]interface{})["name"])
}
}
}
}

for _, s := range app.Secrets {
if s.KeyVaultSecretId != "" && s.Identity == "" {
return fmt.Errorf("secret %s must supply identity for key vault secret id", s.Name)
Expand Down
31 changes: 26 additions & 5 deletions internal/services/containerapps/container_app_resource_test.go
View file
Open in desktop
Expand Up @@ -411,7 +411,7 @@ func TestAccContainerAppResource_removeDaprAppPort(t *testing.T) {
})
}

func TestAccContainerAppResource_secretFail(t *testing.T) {
func TestAccContainerAppResource_secretChangeName(t *testing.T) {
data := acceptance.BuildTestData(t, "azurerm_container_app", "test")
r := ContainerAppResource{}

Expand All @@ -424,13 +424,34 @@ func TestAccContainerAppResource_secretFail(t *testing.T) {
},
data.ImportStep(),
{
Config: r.secretRemove(data),
ExpectError: regexp.MustCompile("cannot remove secrets from Container Apps at this time"),
Config: r.secretChangeName(data),
Check: acceptance.ComposeTestCheckFunc(
check.That(data.ResourceName).ExistsInAzure(r),
),
},
data.ImportStep(),
})
}

func TestAccContainerAppResource_secretRemove(t *testing.T) {
data := acceptance.BuildTestData(t, "azurerm_container_app", "test")
r := ContainerAppResource{}

data.ResourceTest(t, r, []acceptance.TestStep{
{
Config: r.secretBasic(data),
Check: acceptance.ComposeTestCheckFunc(
check.That(data.ResourceName).ExistsInAzure(r),
),
},
data.ImportStep(),
{
Config: r.secretChangeName(data),
ExpectError: regexp.MustCompile("previously configured secret"),
Config: r.secretRemove(data),
Check: acceptance.ComposeTestCheckFunc(
check.That(data.ResourceName).ExistsInAzure(r),
),
},
data.ImportStep(),
})
}

Expand Down
2 changes: 0 additions & 2 deletions website/docs/r/container_app.html.markdown
View file
Open in desktop
Expand Up @@ -99,8 +99,6 @@ A `secret` block supports the following:

!> **Note:** `value` will be ignored if `key_vault_secret_id` and `identity` are provided.

!> **Note:** Secrets cannot be removed from the service once added, attempting to do so will result in an error. Their values may be zeroed, i.e. set to `""`, but the named secret must persist. This is due to a technical limitation on the service which causes the service to become unmanageable. See [this issue](https://github.com/microsoft/azure-container-apps/issues/395) for more details.

---

A `template` block supports the following:
Expand Down