vscode-dev-containers icon indicating copy to clipboard operation
vscode-dev-containers copied to clipboard

Error x509: certificate signed by unknown authority - Azure key Vault with Terraform

Open Didjacome opened this issue 2 years ago • 4 comments

  • VSCode Version: 1.72.2
  • Local OS Version: 10.0.19044 N/A compilação 19044
  • Local chip architecture: <x86, arm64, Apple Silicon> x64-based
  • Reproduces in: <Codespaces | Remote - Containers | Both> Remote - Containers
  • Name of Dev Container Definition with Issue: Dev Container: Azure Terraform (COMMINITY)

Steps to Reproduce:

  1. Create folder for Dev Container image

  2. Created simple main.tf and opened in VS code image image

  3. Configuring main.tf file for execution image

provider "azurerm" {
  features {
    key_vault {
      purge_soft_delete_on_destroy = true
    }
  }
  subscription_id = "000000-000000-000000-000000-000000000"
  tenant_id       = "000000-000000-000000-000000-000000000"
  client_id       = "000000-000000-000000-000000-000000000"
  client_secret   = "000000-000000-000000-000000-000000000"
}

data "azurerm_client_config" "current" {}

resource "azurerm_resource_group" "example" {
  name     = "example-resources"
  location = "West Europe"
}

resource "random_string" "random" {
  length  = 4
  special = false
  numeric = false
}

resource "azurerm_key_vault" "example" {
  name                        = lower(join("", ["keyvault", random_string.random.result]))
  location                    = azurerm_resource_group.example.location
  resource_group_name         = azurerm_resource_group.example.name
  enabled_for_disk_encryption = true
  tenant_id                   = data.azurerm_client_config.current.tenant_id
  soft_delete_retention_days  = 7
  purge_protection_enabled    = false

  sku_name = "standard"

  access_policy {
    tenant_id = data.azurerm_client_config.current.tenant_id
    object_id = data.azurerm_client_config.current.object_id

    key_permissions = [
      "Get",
    ]

    secret_permissions = [
      "Get",
    ]

    storage_permissions = [
      "Get",
    ]
  }
}
  1. Creating dev container image image image image
  • Select features to install
Modules Version
Azure CLI latest
Git latest
Python latest
Terraform latest

image

  1. Select Reopen in Container

image

  1. Dev Container Created successfully image

  2. Terraform init image

  3. Terraform Plan image

  4. Terraform Apply image

Error x509: certificate signed by unknown authority

  • Error: waiting for Vault: (Name "xxxx" / Resource Group "xxxx") to become available: connecting to "https://xxxxxx.vault.azure.net/": Get "https://xxxxxx.vault.azure.net/": x509: certificate signed by unknown authority

image

Azure

  • Resource group was successfully created image
  • Azure Key Vault was even created, but did not assign any policies image image

Other tests done

  • Tested successfully on my local machine
  • Successfully tested on ubuntu 20.04.3 LTS server
  • Tested on another dev container ubuntu same Error
  • Tested on hashicorp/terraform container image same error
  • Tested successfully in Azure pipeline
  • Tested successfully in Git Hub Actions

Considerations

Everything leads me to think that something is missing inside the container but I could not identify it.

Link from some forums, but no solution found :

  • https://social.msdn.microsoft.com/Forums/azure/en-US/c144f70d-d589-4b0c-b97d-a94b2c92b229/error-creating-key-vault-x509-certificate-signed-by-unknown-authority?forum=AzureKeyVault

  • https://stackoverflow.com/questions/71838183/terraform-x509-certificate-signed-by-unknown-authority

  • https://support.hashicorp.com/hc/en-us/articles/360046090994-Terraform-runs-failing-with-x509-certificate-signed-by-unknown-authority-error

  • https://ubuntu.com/server/docs/security-trust-store

Didjacome avatar Oct 30 '22 19:10 Didjacome

problem is still occurring

Didjacome avatar Mar 22 '23 04:03 Didjacome

problem is still occurring

Didjacome avatar Apr 17 '23 17:04 Didjacome

problem is still occurring

Didjacome avatar Apr 29 '23 22:04 Didjacome

problem is still occurring

Didjacome avatar Jun 29 '23 02:06 Didjacome