You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Terraform fails to create the resource with the following error:
Error: Expanding variable group resource data: Failed to get the Azure Key value. Error: ( code: badRequest, messge: Failed to generate an OIDC token for service principal d404bcdc-3806-4a3a-8966-e15378a322f7 )
Steps to Reproduce
Clone repository to an Azure VM to uses a user-assigned managed identity.
terraform plan -out=tfplan
terraform apply tfplan
terraform apply
Important Factoids
Works perfectly fine if I use a PAT for the Azure Devops provider.
I face the same issue. Creating the variable group by hand on AzureDevops portal doesn't seem to work either. @digorgonzola, is creating the very same variable group through the portal is working on your side?
@digorgonzola, I made it work. The issue on my side was that my keyvault is behind private endpoint but Azure DevOps tries to list the secret from its public IP. I whitelisted Azure Devops public IP on keyvault firewall and it works like a charm!
We do face the same issue in a similar configuration. The same error message is generated 'Failed to generate an OIDC token' while trying to update a variable group backed by a key vault.
The error is generated when the devops provider uses a service principal secret authentication.
It works and update the group if we switch to PAT authentication.
Creating a var group manually with the involved service connection works without any warning.
Our devops organization is not connected to the same tenant than our azure key vault. When using the service principal secret auth, the service principal belongs to the devops org's AD and has not permission on the target azure subscription.
Community Note
Terraform (and Azure DevOps Provider) Version
Terraform v1.8.5
AzureDevops provider v1.1.1
Affected Resource(s)
azuredevops_variable_group
Terraform Configuration Files
Debug Output
debug logs
Panic Output
Expected Behavior
The key vault linked variable is created
Actual Behavior
Terraform fails to create the resource with the following error:
Steps to Reproduce
terraform plan -out=tfplan
terraform apply tfplan
terraform apply
Important Factoids
Works perfectly fine if I use a PAT for the Azure Devops provider.
Provider config using managed identity:
References
The text was updated successfully, but these errors were encountered: