Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

azurerm_container_registry: support for versionless encryption keys for ACR #11856

Merged
merged 5 commits into from
May 27, 2021

Conversation

tjcorr
Copy link
Contributor

@tjcorr tjcorr commented May 25, 2021

Closes #11774

This allows for the use of versionless keys in ACR. I also included a small fix that allows for the upgrading of encryption keys.

@ghost ghost added the size/XS label May 25, 2021
Copy link
Member

@mbfrahry mbfrahry left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey @tj-corrigan! This fix looks great but I do want to ask for two tests here. One for checking that a versionless key works and another to confirm that we can update encryption

@ghost ghost added size/M and removed size/XS labels May 25, 2021
@tjcorr
Copy link
Contributor Author

tjcorr commented May 25, 2021

@mbfrahry I went ahead and added a test that creates an encrypted ACR with a specific version and then updates it to use the versionless key. Tests works fine on my machine but it is failing to properly cleanup since the keyvault is required to have purge_protection turned on:

Error: Error purging of Key "key-acr" (Key Vault "https://testkv210525173542901084.vault.azure.net/") : keyvault.BaseClient#PurgeDeletedKey: Failure responding to request: StatusCode=403 -- Original Error: autorest/azure: Service returned an error. Status=403 Code="Forbidden" Message="The user, group or application 'appid=642777f6-b38a-4f1d-88b4-4d7fe42927de;oid=a7bd45ed-2bf6-4d3f-9604-2930fa4f7c94;iss=https://sts.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/' does not have keys purge permission on key vault 'testkv210525173542901084;location=eastus'. For help resolving this issue, please see https://go.microsoft.com/fwlink/?linkid=2125287" InnerError={"code":"ForbiddenByPolicy"}

It looks like the tests for DiskEncryptionSet have the same issue but I'm not sure how the CI/CD tools handle that situation.

@mbfrahry
Copy link
Member

Not a problem! That'll work for us! Thanks for taking the time to get that test added

Copy link
Member

@mbfrahry mbfrahry left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@mbfrahry mbfrahry changed the title Enable versionless encryption keys for ACR azurerm_container_registry: support for versionless encryption keys for ACR May 27, 2021
@mbfrahry mbfrahry added this to the v2.61.0 milestone May 27, 2021
@mbfrahry mbfrahry merged commit f0b3eae into hashicorp:master May 27, 2021
@mbfrahry mbfrahry modified the milestones: v2.61.0, v2.62.0 May 27, 2021
mbfrahry added a commit that referenced this pull request May 27, 2021
@ghost
Copy link

ghost commented Jun 4, 2021

This has been released in version 2.62.0 of the provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading. As an example:

provider "azurerm" {
    version = "~> 2.62.0"
}
# ... other configuration ...

@github-actions
Copy link

github-actions bot commented Jul 5, 2021

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active contributions.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.

@github-actions github-actions bot locked as resolved and limited conversation to collaborators Jul 5, 2021
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

ACR Encryption block doesn't allow for versionless keys
2 participants