azuredevops_variable_group crashes when an extra variable is added outside of terraform.

[jameswestall]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and Azure DevOps Provider) Version

Terraform v0.12.29

• provider.azuredevops v0.0.1

Affected Resource(s)

• `azuredevops_variable_group

Terraform Configuration Files

resource "azuredevops_variable_group" "variablegroup" {
  project_id = azuredevops_project.foundry-base-project.id
  name         = "Azure - Terraform State Variables"
  description  = "Holds configuration relevant to the execution & storage of terraform state"
  allow_access = true

  variable {
    name  = "backend_storage_account_name"
    value = var.backend_storage_account_name
  }

  variable {
    name  = "backend_container_name"
    value = var.backend_container_name
  }

  variable {
    name  = "backend_key"
    value = var.backend_key
  }
}

Debug Output

panic output in gist below.

Panic Output

https://gist.github.com/jameswestall/d4fb531a05362284406a80f16d9ab672

Expected Behavior

Terraform either detects the extra variable in the group and removes the change, or ignores the change completely (better)

Actual Behavior

Terraform crashed.

Steps to Reproduce

1. terraform apply
2. Add new variable to the group outside of terraform, GUI or REST API
3. terraform plan OR terraform apply

Important Factoids

None

References

N/A

• #0000

[jameswestall]

Probably worthwhile having a conversation on how to handle variable addition to various groups. Perhaps a flag such as "ignore_update". The driver here is to avoid secrets in state; I've attempted to use this to create a variable group containing some storage account details, however I don't want my keys to show up in the state, so manually added this leading to the crash.

[xuzhang3]

Hi @jameswestall Thanks for opening this issue. Service will return secret values as null, they cannot be imported by service design.

[jameswestall]

@xuzhang3 - I'll have to retest then, from my initial setup using remote state they definitely showed in the clear.

[xuzhang3]

@jameswestall You can use azure keyvault for secret values. ADO provider will support this feature soon. We have working on it.

[Marcus-James-Adams]

@jameswestall This ties in with my request #231 , if variable groups were treated like keyvaults with the variables allowed to be set as a seperate reource you coudl easily mix TF and non TF variables in the same group.