hashicorp / hashicorp/packer-plugin-azure

Key Vault Soft Delete Issue

Open
#59 1 comment 0 reactions 0 assignees View on GitHub
bug builder/azure
Dominant language
Go
Stars
63
Forks
103
PR merge metrics
No merged PRs in 30d

Description

_This issue was originally opened by @ShaneBala-keyvault as hashicorp/packer#10339. It was migrated here as a result of the [Packer plugin split](https://github.com/hashicorp/packer/issues/8610#issuecomment-770034737). The original body of the issue is below._


When filing a bug, please include the following headings if possible. Any
example text in this template can be deleted.

#### Overview of the Issue

Soft delete will eventually be turned on for all key vaults. This will affect the behavior of the packer tool.

Documented here: https://docs.microsoft.com/en-us/azure/key-vault/general/soft-delete-change

There needs to be a few changes to the packer tool in order to accommodate this change.

Packer today does not turn on soft delete on creation of key vaults. - There was a patch submitted to fix this issue in the latest version of the packer tool. In the latest version, packer will create key vaults with soft delete enabled.

When a VM is deleted, the packer tool performs a cleanup or delete of the connected key vault. This delete will no longer permanently delete the underlying key vault but will move the key vault to the soft deleted state. The default retention period of these key vaults is 90 days.

During the 90 days, if packer attempts to create another key vault with the same name as a key vault in the soft deleted state, the request will fail.

Remediation steps:

1) Immediate Mitigation - Set the retention period of key vaults with soft delete enabled to 7 days. This reduces the probability of a conflict occurring.

2) Update cleanup scripts to delete and purge key vaults with soft delete enabled.

3) Make tool more robust by checking if a key vault name is available before creating a key vault.

#### Reproduction Steps

Steps to reproduce this issue

### Packer version

From `packer version`

### Simplified Packer Buildfile

If the file is longer than a few dozen lines, please include the URL to the
[gist](https://gist.github.com/) of the log or use the [Github detailed
format](https://gist.github.com/ericclemmons/b146fe5da72ca1f706b2ef72a20ac39d)
instead of posting it directly in the issue.

### Operating system and Environment details

OS, Architecture, and any other information you can provide about the
environment.

### Log Fragments and crash.log files

Include appropriate log fragments. If the log is longer than a few dozen lines,
please include the URL to the [gist](https://gist.github.com/) of the log or
use the [Github detailed format](https://gist.github.com/ericclemmons/b146fe5da72ca1f706b2ef72a20ac39d) instead of posting it directly in the issue.

Set the env var `PACKER_LOG=1` for maximum log detail.

Contributor guide

Open the contributing guide

Research direction

Review the Azure Key Vault creation and cleanup behavior against the linked soft-delete documentation; no source files, tests, or reproduction details are named. Done should cover the requested cleanup and purge behavior and prevent failures when a soft-deleted vault retains the requested name.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, go
Domain
cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.