Container Groups (ACI) - added secure environment variables

[neilpeterson]

This PR adds Azure Container Instances secure environment variables.

Fundamentally the only difference between an environment variable and a secured variable is the value property name (Value vs. SecureValue), however for ease of use I am treating them as separate properties (seen in the below sample).

resource "azurerm_container_group" "both" {
  name                = "both"
  location            = "${azurerm_resource_group.vote-resource-group.location}"
  resource_group_name = "${azurerm_resource_group.vote-resource-group.name}"
  ip_address_type     = "public"
  os_type             = "linux"

  container {
    name   = "both"
    image  = "neilpeterson/nepetersv1"
    cpu    = "0.5"
    memory = "1.5"
    port   = "80"

    environment_variables {
      "NON_SECURE"  = "This is exposed in the portal and logs etc..."
    }

    secure_environment_variables {
      "SECURE"  = "This is not exposed in the portal and logs etc..."
    }

  }
}

I have limited experience with Go, and this is my first PR to this project. Any critique / coaching would be appreciated.

[neilpeterson]

@metacpp @tombuildsstuff - I see that this PR has gone conflicted. I going to hold off on fixing the conflict until some interest / traction / feedback has been given to the PR. Let me know and I will fix it up.

Thanks

[metacpp]

Please use the 2018-09-01 in v21.1.0

[neilpeterson]

@metacpp, per our email conversation, I will keep this one at 2018-06-01 due to significant refactor in 2018-09-01. Once the secure environment variables PR has been merged, I will create a new PR to refactor the provider to use ACI 2018-09-01.

[metacpp]

Since this newly added schema, can you also update the documentation for ACI resource?

[metacpp]

Allocation for too many times, change it to:

evar = &append(*evar, *secevar...)

[metacpp]

envVars and secEnvVars

[neilpeterson]

Done

[metacpp]

@neilpeterson Please address the comments in the PR.

[metacpp]

Isn't the re-allocation happening too frequently?

[neilpeterson]

@metacpp - I am struggling with this one, most likely a misunderstanding on my part about how this should work in Go.

Basically an environment variable and secure environment variable are the same type, with the only difference being the name of the value property (Value vs. SecureValue). That said, rather then having a single Terraform argument for environment_variables with a flag for secure, I think it works better to have two, one for environment_variables and another for secure_environment_variables. This makes for a nicer Terraform configuration.

So, for each argument, I pass the list of environment variables to the expand function.

// Expand environment variables, produces a slice of env (envVars)
if v, ok := data["environment_variables"]; ok {
  envVars = expandContainerEnvironmentVariables(v, false)
}

// Expand environment variables, produces a slice of env (secEnvVars)
if v, ok := data["secure_environment_variables"]; ok {
  secEnvVars = expandContainerEnvironmentVariables(v, true)
}

The expand function is called at max twice and returns a []containerinstance.EnvironmentVariable for each type of environment variable.

func expandContainerEnvironmentVariables(input interface{}, secure bool) *[]containerinstance.EnvironmentVariable {

	envVars := input.(map[string]interface{})
	output := make([]containerinstance.EnvironmentVariable, 0)

	// For each secure environment variable, build the instance and add to output (slice)
	if secure == true {
		for k, v := range envVars {
			ev := containerinstance.EnvironmentVariable{
				Name:        utils.String(k),
				SecureValue: utils.String(v.(string)),
			}
			output = append(output, ev)
		}

	} else {
		for k, v := range envVars {
			ev := containerinstance.EnvironmentVariable{
				Name:  utils.String(k),
				Value: utils.String(v.(string)),
			}
			output = append(output, ev)
		}
	}
	return &output
}

These are then combined and set.

// Combine envVars and secEnvVars
*envVars = append(*envVars, *secEnvVars...)

container.EnvironmentVariables = envVars

[metacpp]

Isn't re-allocation happening too frequently?

[metacpp]

"secureFoo" = "secureBar"

[neilpeterson]

Done

[metacpp]

same as above.

[neilpeterson]

Done

[metacpp]

@neilpeterson I did some cleanup work on your branch and hope you don't mind.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 hashibot-feedback@hashicorp.com. Thanks!