So I want to use terraform v0.12.0 for defining my azure infrastructure. Our company is heavy on placing restrictions on things to use, so I am a bit reluctant to use off the shelf build/release tasks from Azure DevOps Marketplace. So I downloaded the exe, added it to the code, I can also download it directly on the build/release agent.
So I used Azure DevOps Release pipelines built-in task Azure Cli (v1.151.1) with the following code
call az login --service-principal -u $(clientid) -p $(clientsecret) --tenant $(tenantid)
call cd $(System.DefaultWorkingDirectory)/_DevOps/drop/Terraform/
call set ARM_ACCESS_KEY=$(az keyvault secret show --name mybackendkey --vault-name mykeyvault --query value -o tsv)
call set ARM_CLIENT_ID="$(clientid)"
call set ARM_CLIENT_SECRET="$(clientsecret)"
call set ARM_SUBSCRIPTION_ID="$(subscriptionid)"
call set ARM_TENANT_ID="$(tenantid)"
call terraform init -backend-config="storage_account_name=mystorageaccount" -backend-config="container_name=terraform-state" -backend-config="key=terraform.tfstate"
call terraform plan -input=false
call terraform apply -input=false
with the following terraform.tf file
terraform {
backend "azurerm" {
storage_account_name = "mystorageaccount"
container_name = "terraform-state"
key = "terraform.tfstate"
resource_group_name = "myresourcegroup"
subscription_id = "00000000-0000-0000-0000-000000000000"
client_id = "00000000-0000-0000-0000-000000000000"
client_secret = "mysecret"
tenant_id = "00000000-0000-0000-0000-000000000000"
}
}
Now it is giving the the following error
2019-05-27T14:45:53.7470711Z D:\a\r1\a\_DevOps\drop\Terraform>call set ARM_ACCESS_KEY=$(az keyvault secret show --name mybackendkey --vault-name mykeyvault --query value -o tsv)
2019-05-27T14:45:53.7491727Z D:\a\r1\a\_DevOps\drop\Terraform>call set ARM_CLIENT_ID="***"
2019-05-27T14:45:53.7511373Z D:\a\r1\a\_DevOps\drop\Terraform>call set ARM_CLIENT_SECRET="***"
2019-05-27T14:45:53.7532794Z D:\a\r1\a\_DevOps\drop\Terraform>call set ARM_SUBSCRIPTION_ID="***"
2019-05-27T14:45:53.7554859Z D:\a\r1\a\_DevOps\drop\Terraform>call set ARM_TENANT_ID="***"
2019-05-27T14:45:53.7574875Z D:\a\r1\a\_DevOps\drop\Terraform>call terraform init -backend-config="storage_account_name=mystorageaccount" -backend-config="container_name=terraform-state" -backend-config="key=terraform.tfstate"
2019-05-27T14:45:53.9641074Z Initializing the backend...
2019-05-27T14:45:53.9721551Z Successfully configured the backend "azurerm"! Terraform will automatically
2019-05-27T14:45:53.9721831Z use this backend unless the backend configuration changes.
2019-05-27T14:45:53.9737291Z Error: Failed to get migrated workspaces: Error creating storage client for storage account "mystorageaccount": azure: malformed storage account key: illegal base64 data at input byte 0
2019-05-27T14:45:53.9856719Z D:\a\r1\a\_DevOps\drop\Terraform>call terraform plan -out=tfplan -input=false
2019-05-27T14:45:54.1177547Z Error: Error loading state: Error creating storage client for storage account "mystorageaccount": azure: malformed storage account key: illegal base64 data at input byte 0
2019-05-27T14:45:54.1302709Z D:\a\r1\a\_DevOps\drop\Terraform>call terraform apply -input=false tfplan
2019-05-27T14:45:54.2539375Z CreateFile tfplan: The system cannot find the file specified.
2019-05-27T14:45:54.2782991Z ##[error]Script failed with error: Error: D:\a\_temp\azureclitaskscript1558968322690.bat failed with return code: 1
2019-05-27T14:45:54.2899205Z [command]C:\windows\system32\cmd.exe /D /S /C ""C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\wbin\az.cmd" account clear"
It works if I move my backend to local, is there anyway I can make it work with Azure Backend? BTW I am getting the secrets and Ids from Azure Key Vault directly injected into the DevOps peipline
ARM_ACCESS_KEY=$(az keyvault secret show --name mybackendkey --vault-name mykeyvault --query value -o tsv)
? You can check it through output the variable ARM_ACCESS_KEY. – Charles Xu