Skip to content

Conversation

mikhailshilkov
Copy link
Member

Update gocloud.dev to the latest version.

This version has some breaking changes. Notably:

  • secrets/azurekeyvault: Constructor changed, and URLs are now azurekeyvault://mykevaultname.vault.azure.net/keys/mykeyname/mykeyversion instead of azurekeyvault://mykeyvaultname/mykeyname/mykeyversion.

See the full list here.

Fixes #3359.

@mikhailshilkov mikhailshilkov added the impact/breaking Fixing this issue will require a breaking change label Oct 17, 2019
@lukehoban
Copy link
Contributor

some breaking changes

Can we pre-process the inputs to still support the old format? It would be very nice to not have a breaking change here.

@jen20
Copy link
Contributor

jen20 commented Nov 18, 2019

The old input format does not work in any case with CLI 1.5.2, so I think we should expedite this and get a release out. Using CLI 1.5.2, and the docs I get this (names redacted):

  1. Try as per docs
$ pulumi stack init --secrets-provider "azurekeyvault://myvault.vault.azure.net/keys/mykey" dev

error: open keeper azurekeyvault://myvault.vault.azure.net/keys/mykey: algorithm is required
  1. Add algorithm as suggested by CLI
$ pulumi stack init --secrets-provider "azurekeyvault://myvault.vault.azure.net/keys/mykey?algorithm=algorithm=RSA-OAEP-256" dev

... (snipped)
dial tcp: lookup myvault.vault.azure.net.vault.azure.net: no such host
  1. Remove duplicate hostname
$ pulumi stack init --secrets-provider "azurekeyvault://myvault/mykey?algorithm=RSA-OAEP-256" dev

error: secrets (code=PermissionDenied): keyvault.BaseClient#Encrypt: Failure responding to request: StatusCode=401 -- Original Error: autorest/azure: Service returned an error. Status=401 Code="Unauthorized" Message="AKV10022: Invalid audience. Expected https://vault.azure.net, found: https://management.azure.com/."

Setting export AZURE_AD_RESOURCE=https://vault.azure.net makes this work as expected.

@jen20 jen20 mentioned this pull request Nov 18, 2019
@pgavlin
Copy link
Member

pgavlin commented Nov 20, 2019

I believe this has been obviated by #3522.

@pgavlin pgavlin closed this Nov 20, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
impact/breaking Fixing this issue will require a breaking change
Projects
None yet
Development

Successfully merging this pull request may close these issues.

"Algorithm is required" when initializing stack with Azure Key Vault encryption provider
4 participants