hashicorp / hashicorp/packer-plugin-azure

Azure container application using managed Identities

Open
#411 6 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Go
Stars
63
Forks
103
PR merge metrics
No merged PRs in 30d

Description

#### Overview of the Issue

Azure container application use a different URL to retrieve the managed identity than currently in the code.

A paragraph or two about the issue you're experiencing.

When running packer on azure container applications it will always fail because of the code: https://github.com/hashicorp/packer-plugin-azure/blob/516ae5e5d0caead4579f8216fd0f4bba80e1e39b/builder/azure/common/client/config.go#L257 and https://github.com/hashicorp/packer-plugin-azure/blob/516ae5e5d0caead4579f8216fd0f4bba80e1e39b/builder/azure/common/client/config_retriever.go#L18C11-L18C12 seem to have the default URL "http://169.254.169.254/metadata/instance/compute" This is not reachable and on azure container apps and possible other Azure container resources. Azure container application use: MSI_ENDPOINT=http://localhost:42356/msi/token to retrieve the Managed identifies. Can there be an if statement or check added if using Azure container application to use the alternative URL above?

#### Reproduction Steps

Steps to reproduce this issue:
Run packer build on a azure container application e..g.
packer build -var "image_version=XXXXXX" -var "client_id=XXXXXXXXX" -var "subscription_id=XXXXXXXXXX" -var "resource_group_location=XXXXXX" -var "location=XXXXXXX" -var "os_type=Windows" -var "image_publisher=XXXXXXXXX" -var "image_offer=XXXXXXXX" -var "image_sku=XXXXXX" -var "vm_size=XXXXXXXX" -var "gallery_name=XXXXX" -var "image_version=XXXXXX" -var "image_name=XXXXXXXXX" -var "resource_group_name=XXXXXXXX" -var-file "./variables.pkrvars.hcl" .

### Plugin and Packer version
plugin version: 2.1.2, packer version: 1.110.3

From `packer version`

### Simplified Packer Buildfile

build {
sources = [
"source.azure-arm.blah"
]

provisioner "windows-update" {
search_criteria = "IsInstalled=0"
}

source "azure-arm" "xxxxxx" {
image_offer = var.image_offer
image_publisher = var.image_publisher
image_sku = var.image_sku
location = var.location
managed_image_name = var.managed_image_name
managed_image_resource_group_name = var.managed_image_resource_group_name
os_type = var.os_type
vm_size = var.vm_size
subscription_id = var.subscription_id
managed_image_storage_account_type = var.managed_image_storage_account_type
private_virtual_network_with_public_ip = var.private_virtual_network_with_public_ip
shared_gallery_image_version_exclude_from_latest = var.shared_gallery_image_version_exclude_from_latest

shared_image_gallery_destination {
gallery_name = var.gallery_name
image_name = var.image_name
image_version = var.image_version
replication_regions = var.replication_regions
resource_group = var.resource_group_name
subscription = var.subscription_id
storage_account_type = var.storage_account_type
}
communicator = "winrm"
winrm_use_ssl = true
winrm_insecure= true
winrm_timeout= "20m"
winrm_username= "packer"
#async_resourcegroup_delete": "true",
}
}

### Log Fragments and crash.log files
Running builder ...
Build 'azure-arm.xxxxxx' errored after 30 seconds 1 millisecond: error fetching subscriptionID from VM metadata service for Managed Identity authentication: Get "http://169.254.169.254/metadata/instance/compute?api-version=2017-08-01&format=json": dial tcp 169.254.169.254:80: i/o timeout

Contributor guide

Open the contributing guide

Research direction

Start in builder/azure/common/client/config.go around line 257 and builder/azure/common/client/config_retriever.go around line 18, then reproduce the managed-identity lookup from an Azure Container App. Check how MSI_ENDPOINT should be used instead of the metadata URL, and verify that Packer can retrieve the subscription ID without timing out at 169.254.169.254.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, go
Domain
authentication, cloud
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.