hashicorp / hashicorp/packer-plugin-azure
Key Vault Soft Delete Issue
- Dominant language
- Go
- Stars
- 63
- Forks
- 103
- PR merge metrics
- No merged PRs in 30d
Description
_This issue was originally opened by @ShaneBala-keyvault as hashicorp/packer#10339. It was migrated here as a result of the [Packer plugin split](https://github.com/hashicorp/packer/issues/8610#issuecomment-770034737). The original body of the issue is below._
When filing a bug, please include the following headings if possible. Any
example text in this template can be deleted.
#### Overview of the Issue
Soft delete will eventually be turned on for all key vaults. This will affect the behavior of the packer tool.
Documented here: https://docs.microsoft.com/en-us/azure/key-vault/general/soft-delete-change
There needs to be a few changes to the packer tool in order to accommodate this change.
Packer today does not turn on soft delete on creation of key vaults. - There was a patch submitted to fix this issue in the latest version of the packer tool. In the latest version, packer will create key vaults with soft delete enabled.
When a VM is deleted, the packer tool performs a cleanup or delete of the connected key vault. This delete will no longer permanently delete the underlying key vault but will move the key vault to the soft deleted state. The default retention period of these key vaults is 90 days.
During the 90 days, if packer attempts to create another key vault with the same name as a key vault in the soft deleted state, the request will fail.
Remediation steps:
1) Immediate Mitigation - Set the retention period of key vaults with soft delete enabled to 7 days. This reduces the probability of a conflict occurring.
2) Update cleanup scripts to delete and purge key vaults with soft delete enabled.
3) Make tool more robust by checking if a key vault name is available before creating a key vault.
#### Reproduction Steps
Steps to reproduce this issue
### Packer version
From `packer version`
### Simplified Packer Buildfile
If the file is longer than a few dozen lines, please include the URL to the
[gist](https://gist.github.com/) of the log or use the [Github detailed
format](https://gist.github.com/ericclemmons/b146fe5da72ca1f706b2ef72a20ac39d)
instead of posting it directly in the issue.
### Operating system and Environment details
OS, Architecture, and any other information you can provide about the
environment.
### Log Fragments and crash.log files
Include appropriate log fragments. If the log is longer than a few dozen lines,
please include the URL to the [gist](https://gist.github.com/) of the log or
use the [Github detailed format](https://gist.github.com/ericclemmons/b146fe5da72ca1f706b2ef72a20ac39d) instead of posting it directly in the issue.
Set the env var `PACKER_LOG=1` for maximum log detail.
Contributor guide
Research direction
Review the Azure Key Vault creation and cleanup behavior against the linked soft-delete documentation; no source files, tests, or reproduction details are named. Done should cover the requested cleanup and purge behavior and prevent failures when a soft-deleted vault retains the requested name.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, go
- Domain
- cloud
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100