hashicorp / hashicorp/packer-plugin-azure
Azure container application using managed Identities
- Dominant language
- Go
- Stars
- 63
- Forks
- 103
- PR merge metrics
- No merged PRs in 30d
Description
#### Overview of the Issue
Azure container application use a different URL to retrieve the managed identity than currently in the code.
A paragraph or two about the issue you're experiencing.
When running packer on azure container applications it will always fail because of the code: https://github.com/hashicorp/packer-plugin-azure/blob/516ae5e5d0caead4579f8216fd0f4bba80e1e39b/builder/azure/common/client/config.go#L257 and https://github.com/hashicorp/packer-plugin-azure/blob/516ae5e5d0caead4579f8216fd0f4bba80e1e39b/builder/azure/common/client/config_retriever.go#L18C11-L18C12 seem to have the default URL "http://169.254.169.254/metadata/instance/compute" This is not reachable and on azure container apps and possible other Azure container resources. Azure container application use: MSI_ENDPOINT=http://localhost:42356/msi/token to retrieve the Managed identifies. Can there be an if statement or check added if using Azure container application to use the alternative URL above?
#### Reproduction Steps
Steps to reproduce this issue:
Run packer build on a azure container application e..g.
packer build -var "image_version=XXXXXX" -var "client_id=XXXXXXXXX" -var "subscription_id=XXXXXXXXXX" -var "resource_group_location=XXXXXX" -var "location=XXXXXXX" -var "os_type=Windows" -var "image_publisher=XXXXXXXXX" -var "image_offer=XXXXXXXX" -var "image_sku=XXXXXX" -var "vm_size=XXXXXXXX" -var "gallery_name=XXXXX" -var "image_version=XXXXXX" -var "image_name=XXXXXXXXX" -var "resource_group_name=XXXXXXXX" -var-file "./variables.pkrvars.hcl" .
### Plugin and Packer version
plugin version: 2.1.2, packer version: 1.110.3
From `packer version`
### Simplified Packer Buildfile
build {
sources = [
"source.azure-arm.blah"
]
provisioner "windows-update" {
search_criteria = "IsInstalled=0"
}
source "azure-arm" "xxxxxx" {
image_offer = var.image_offer
image_publisher = var.image_publisher
image_sku = var.image_sku
location = var.location
managed_image_name = var.managed_image_name
managed_image_resource_group_name = var.managed_image_resource_group_name
os_type = var.os_type
vm_size = var.vm_size
subscription_id = var.subscription_id
managed_image_storage_account_type = var.managed_image_storage_account_type
private_virtual_network_with_public_ip = var.private_virtual_network_with_public_ip
shared_gallery_image_version_exclude_from_latest = var.shared_gallery_image_version_exclude_from_latest
shared_image_gallery_destination {
gallery_name = var.gallery_name
image_name = var.image_name
image_version = var.image_version
replication_regions = var.replication_regions
resource_group = var.resource_group_name
subscription = var.subscription_id
storage_account_type = var.storage_account_type
}
communicator = "winrm"
winrm_use_ssl = true
winrm_insecure= true
winrm_timeout= "20m"
winrm_username= "packer"
#async_resourcegroup_delete": "true",
}
}
### Log Fragments and crash.log files
Running builder ...
Build 'azure-arm.xxxxxx' errored after 30 seconds 1 millisecond: error fetching subscriptionID from VM metadata service for Managed Identity authentication: Get "http://169.254.169.254/metadata/instance/compute?api-version=2017-08-01&format=json": dial tcp 169.254.169.254:80: i/o timeout
Contributor guide
Research direction
Start in builder/azure/common/client/config.go around line 257 and builder/azure/common/client/config_retriever.go around line 18, then reproduce the managed-identity lookup from an Azure Container App. Check how MSI_ENDPOINT should be used instead of the metadata URL, and verify that Packer can retrieve the subscription ID without timing out at 169.254.169.254.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, go
- Domain
- authentication, cloud
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100