Allow setting key vault secret name & Unify API versions (#335)

* Unified the api-versions to use the latest version globally and remove individual settings; Add key vault secret parameter to allow setting the secret name during deployment.

* Remove unneeded temp value

builder/azure/arm/builder.go

@@ -488,12 +488,16 @@ func (b *Builder) configureStateBag(stateBag multistep.StateBag) {
 	}
 
 	stateBag.Put(constants.ArmKeyVaultName, b.config.tmpKeyVaultName)
+	stateBag.Put(constants.ArmKeyVaultSecretName, DefaultSecretName)
 	stateBag.Put(constants.ArmIsExistingKeyVault, false)
 	if b.config.BuildKeyVaultName != "" {
 		stateBag.Put(constants.ArmKeyVaultName, b.config.BuildKeyVaultName)
 		b.config.tmpKeyVaultName = b.config.BuildKeyVaultName
 		stateBag.Put(constants.ArmIsExistingKeyVault, true)
 	}
+	if b.config.BuildKeyVaultSecretName != "" {
+		stateBag.Put(constants.ArmKeyVaultSecretName, b.config.BuildKeyVaultSecretName)
+	}
 
 	stateBag.Put(constants.ArmNicName, b.config.tmpNicName)
 	stateBag.Put(constants.ArmPublicIPAddressName, b.config.tmpPublicIPAddressName)

builder/azure/arm/config.go

@@ -363,9 +363,11 @@ type Config struct {
 	TempResourceGroupName string `mapstructure:"temp_resource_group_name"`
 	// Specify an existing resource group to run the build in.
 	BuildResourceGroupName string `mapstructure:"build_resource_group_name"`
-	// Specify an existing key vault to use for uploading certificates to the
+	// Specify an existing key vault to use for uploading the certificate for the
 	// instance to connect.
 	BuildKeyVaultName string `mapstructure:"build_key_vault_name"`
+	// Specify the secret name to use for the certificate created in the key vault.
+	BuildKeyVaultSecretName string `mapstructure:"build_key_vault_secret_name"`
 	// Specify the KeyVault SKU to create during the build. Valid values are
 	// standard or premium. The default value is standard.
 	BuildKeyVaultSKU string `mapstructure:"build_key_vault_sku"`
@@ -1005,6 +1007,10 @@ func provideDefaultValues(c *Config) {
 		c.BuildKeyVaultSKU = DefaultKeyVaultSKU
 	}
 
+	if c.BuildKeyVaultSecretName == "" {
+		c.BuildKeyVaultSecretName = DefaultSecretName
+	}
+
 	_ = c.ClientConfig.SetDefaultValues()
 }
 

builder/azure/arm/step_certificate_in_keyvault.go

@@ -61,7 +61,8 @@ func (s *StepCertificateInKeyVault) Run(ctx context.Context, state multistep.Sta
 	var keyVaultName = state.Get(constants.ArmKeyVaultName).(string)
 	var subscriptionId = state.Get(constants.ArmSubscription).(string)
 	var resourceGroupName = state.Get(constants.ArmResourceGroupName).(string)
-	id := secrets.NewSecretID(subscriptionId, resourceGroupName, keyVaultName, DefaultSecretName)
+	var keyVaultSecretName = state.Get(constants.ArmKeyVaultSecretName).(string)
+	id := secrets.NewSecretID(subscriptionId, resourceGroupName, keyVaultName, keyVaultSecretName)
 	err := s.set(ctx, id)
 	if err != nil {
 		s.error(fmt.Errorf("Error setting winrm cert in custom keyvault: %s", err))

builder/azure/arm/step_certificate_in_keyvault_test.go

@@ -19,6 +19,7 @@ func TestNewStepCertificateInKeyVault(t *testing.T) {
 	state.Put(constants.ArmKeyVaultName, "testKeyVaultName")
 	state.Put(constants.ArmSubscription, "testSubscription")
 	state.Put(constants.ArmResourceGroupName, "testResourceGroupName")
+	state.Put(constants.ArmKeyVaultSecretName, "testKeyVaultSecretName")
 
 	config := &Config{
 		winrmCertificate: "testCertificateString",
@@ -44,6 +45,7 @@ func TestNewStepCertificateInKeyVault_error(t *testing.T) {
 	state.Put(constants.ArmKeyVaultName, "testKeyVaultName")
 	state.Put(constants.ArmSubscription, "testSubscription")
 	state.Put(constants.ArmResourceGroupName, "testResourceGroupName")
+	state.Put(constants.ArmKeyVaultSecretName, "testKeyVaultSecretName")
 
 	config := &Config{
 		winrmCertificate: "testCertificateString",

builder/azure/arm/step_get_certificate.go

@@ -56,14 +56,15 @@ func (s *StepGetCertificate) Run(ctx context.Context, state multistep.StateBag)
 	var keyVaultName = state.Get(constants.ArmKeyVaultName).(string)
 	var resourceGroupName = state.Get(constants.ArmResourceGroupName).(string)
 	var subscriptionId = state.Get(constants.ArmSubscription).(string)
+	var keyVaultSecretName = state.Get(constants.ArmKeyVaultSecretName).(string)
 
 	s.say(fmt.Sprintf(" -> Key Vault Name        : '%s'", keyVaultName))
-	s.say(fmt.Sprintf(" -> Key Vault Secret Name : '%s'", DefaultSecretName))
+	s.say(fmt.Sprintf(" -> Key Vault Secret Name : '%s'", keyVaultSecretName))
 
 	var err error
 	var url string
 	for i := 0; i < 5; i++ {
-		url, err = s.get(ctx, subscriptionId, resourceGroupName, keyVaultName, DefaultSecretName)
+		url, err = s.get(ctx, subscriptionId, resourceGroupName, keyVaultName, keyVaultSecretName)
 		if err == nil {
 			break
 		}

builder/azure/arm/step_get_certificate_test.go

@@ -82,7 +82,10 @@ func TestStepGetCertificateShouldTakeStepArgumentsFromStateBag(t *testing.T) {
 	if actualKeyVaultName != expectedKeyVaultName {
 		t.Fatal("Expected StepGetCertificate to source 'constants.ArmKeyVaultName' from the state bag, but it did not.")
 	}
-	if actualSecretName != DefaultSecretName {
+
+	var expectedKeyVaultSecretName = stateBag.Get(constants.ArmKeyVaultSecretName).(string)
+
+	if actualSecretName != expectedKeyVaultSecretName {
 		t.Fatal("Expected StepGetCertificate to use default value for secret, but it did not.")
 	}
 
@@ -101,5 +104,6 @@ func createTestStateBagStepGetCertificate() multistep.StateBag {
 	stateBag.Put(constants.ArmKeyVaultName, "Unit Test: KeyVaultName")
 	stateBag.Put(constants.ArmSubscription, "testSubscription")
 	stateBag.Put(constants.ArmResourceGroupName, "testResourceGroupName")
+	stateBag.Put(constants.ArmKeyVaultSecretName, "testKeyVaultSecretName")
 	return stateBag
 }

builder/azure/arm/template_factory.go

@@ -49,6 +49,7 @@ func GetKeyVaultDeployment(config *Config, secretValue string, exp *int64) (*dep
 	params := &template.TemplateParameters{
 		KeyVaultName:        &template.TemplateParameter{Value: config.tmpKeyVaultName},
 		KeyVaultSKU:         &template.TemplateParameter{Value: config.BuildKeyVaultSKU},
+		KeyVaultSecretName:  &template.TemplateParameter{Value: config.BuildKeyVaultSecretName},
 		KeyVaultSecretValue: &template.TemplateParameter{Value: secretValue},
 		ObjectId:            &template.TemplateParameter{Value: config.ClientConfig.ObjectID},
 		TenantId:            &template.TemplateParameter{Value: config.ClientConfig.TenantID},

builder/azure/arm/template_factory_test.TestKeyVaultDeployment03.approved.json

@@ -1,5 +1,5 @@
 {
-  "$schema": "http://schema.management.azure.com/schemas/2014-04-01-preview/deploymentTemplate.json",
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
   "contentVersion": "1.0.0.0",
   "parameters": {
     "keyVaultName": {
@@ -8,6 +8,9 @@
     "keyVaultSKU": {
       "type": "string"
     },
+    "keyVaultSecretName": {
+      "type": "string"
+    },
     "keyVaultSecretValue": {
       "type": "securestring"
     },
@@ -47,30 +50,32 @@
         },
         "tenantId": "[parameters('tenantId')]"
       },
-      "resources": [
-        {
-          "apiVersion": "[variables('apiVersion')]",
-          "dependsOn": [
-            "[concat('Microsoft.KeyVault/vaults/', parameters('keyVaultName'))]"
-          ],
-          "name": "[variables('keyVaultSecretName')]",
-          "properties": {
-            "value": "[parameters('keyVaultSecretValue')]"
-          },
-          "type": "secrets"
-        }
-      ],
       "tags": {
         "tag01": "value01",
         "tag02": "value02",
         "tag03": "value03"
       },
       "type": "Microsoft.KeyVault/vaults"
+    },
+    {
+      "apiVersion": "[variables('apiVersion')]",
+      "dependsOn": [
+        "[resourceId('Microsoft.KeyVault/vaults/', parameters('keyVaultName'))]"
+      ],
+      "name": "[format('{0}/{1}', parameters('keyVaultName'), parameters('keyVaultSecretName'))]",
+      "properties": {
+        "value": "[parameters('keyVaultSecretValue')]"
+      },
+      "tags": {
+        "tag01": "value01",
+        "tag02": "value02",
+        "tag03": "value03"
+      },
+      "type": "Microsoft.KeyVault/vaults/secrets"
     }
   ],
   "variables": {
-    "apiVersion": "2015-06-01",
-    "keyVaultSecretName": "packerKeyVaultSecret",
+    "apiVersion": "2022-07-01",
     "location": "[resourceGroup().location]"
   }
 }

builder/azure/arm/template_factory_test.TestKeyVaultDeployment04.approved.json

@@ -1,5 +1,5 @@
 {
-  "$schema": "http://schema.management.azure.com/schemas/2014-04-01-preview/deploymentTemplate.json",
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
   "contentVersion": "1.0.0.0",
   "parameters": {
     "keyVaultName": {
@@ -8,6 +8,9 @@
     "keyVaultSKU": {
       "type": "string"
     },
+    "keyVaultSecretName": {
+      "type": "string"
+    },
     "keyVaultSecretValue": {
       "type": "securestring"
     },
@@ -47,28 +50,25 @@
         },
         "tenantId": "[parameters('tenantId')]"
       },
-      "resources": [
-        {
-          "apiVersion": "[variables('apiVersion')]",
-          "dependsOn": [
-            "[concat('Microsoft.KeyVault/vaults/', parameters('keyVaultName'))]"
-          ],
-          "name": "[variables('keyVaultSecretName')]",
-          "properties": {
-            "attributes": {
-              "exp": 4102444800
-            },
-            "value": "[parameters('keyVaultSecretValue')]"
-          },
-          "type": "secrets"
-        }
-      ],
       "type": "Microsoft.KeyVault/vaults"
+    },
+    {
+      "apiVersion": "[variables('apiVersion')]",
+      "dependsOn": [
+        "[resourceId('Microsoft.KeyVault/vaults/', parameters('keyVaultName'))]"
+      ],
+      "name": "[format('{0}/{1}', parameters('keyVaultName'), parameters('keyVaultSecretName'))]",
+      "properties": {
+        "attributes": {
+          "exp": 4102444800
+        },
+        "value": "[parameters('keyVaultSecretValue')]"
+      },
+      "type": "Microsoft.KeyVault/vaults/secrets"
     }
   ],
   "variables": {
-    "apiVersion": "2015-06-01",
-    "keyVaultSecretName": "packerKeyVaultSecret",
+    "apiVersion": "2022-07-01",
     "location": "[resourceGroup().location]"
   }
 }