Unexpected error while passing variable group variables (Azure DevOps) to YAML pipeline

user_11870492 0
Viewed 216

I'm a newbie to both Azure DevOps and Terraform but, I'm trying to deploy a pipeline using a YAML file.

I have tried to run a terraform plan using a YAML file and passing variables (from AZ DevOps) but, I got the following error:

 
2021-11-24T18:39:46.4604561Z Error: "name" may only contain alphanumeric characters, dash, underscores, parentheses and periods
2021-11-24T18:39:46.4604832Z 
2021-11-24T18:39:46.4605940Z   on modules/aks/main.tf line 2, in resource "azurerm_resource_group" "aks-resource-group":
2021-11-24T18:39:46.4606436Z    2:   name     = var.resource_group_name
2021-11-24T18:39:46.4606609Z 
2021-11-24T18:39:46.4606722Z 
2021-11-24T18:39:46.4606818Z 
2021-11-24T18:39:46.4607525Z Error: Error: Subnet: (Name "#{vnet_subnet_name}#" / Virtual Network Name "#{vnet_name}#" / Resource Group "RG-XX-XXXX-XXXXX-001") was not found
2021-11-24T18:39:46.4608006Z 
2021-11-24T18:39:46.4608580Z   on modules/aks/main.tf line 16, in data "azurerm_subnet" "subnet-project":
2021-11-24T18:39:46.4609335Z   16: data "azurerm_subnet" "subnet-project" {

The 'name' has the following format at the Variable group in the Azure DevOps UI:

RG-XX-XXXX-XXXXX-001

This is the snippet of where I included the replace token at the YAML file:

          displayName: 'Replace Secrets'
          inputs:
            targetFiles: |
              variables.tfvars
              encoding: 'utf-8'
            actionOnMissing: fail
            tokenPattern: #{MyVar}#

And this is a sample of the variables I have in a variable group: variable-group-sample

Also, I replace the terraform.tfvars file with something like this:

resource_group_name   = "#{resource_group_name}#"

I have checked the name inserted at the UI several times but I feel the error is pointing to something else I cannot see.

Have anyone experienced something related to this error?

Thank you in advance!

azure-pipelines-yaml azure-pipelines terraform-provider-azure terraform azure-devops
1 Answers
tokenPattern: #{MyVar}#

It is looking for the pattern #{MyVar}# to replace. Not "something contained between #{ and }#, but the actual value #{MyVar}#. I'm guessing it's expecting a regular expression, but I'm not familiar with that task.

So the end result is that your #{token values}# aren't getting replaced.

Assuming you're using https://marketplace.visualstudio.com/items?itemName=qetza.replacetokens, you probably want to specify tokenPrefix: #{ and tokenSuffix: }# instead of using tokenPattern.

Now, having said that...

There is no reason for you to be using token replacement on a tfvars file. You should create different tfvars files for each environment, then pass in a tfvars file via the -var-file argument to Terraform. Secrets can be passed in on the command line via -var 'foo=bar'

Storing variables that represent application or deployment configuration in Azure DevOps (or GitHub, or any other CI system) is a big, big anti-pattern, because it's tightly coupling your deployment process to a particular platform. If you're sourcing all of your variables from Azure DevOps, you can't easily test locally or migrate to a different CI/CD provider like GitHub Actions in the future.

For values that shouldn't be in source control, such a secrets, you should use a secret provider like Azure KeyVault and integrate it with your application (or, in this case, use a data resource in Terraform to pull the necessary secrets automatically at deployment time).

user_7817540
Related