Error: retrieving contact for Keyvault: Keyvault. BaseClient#getcertificateContacts : failure sending request: Original error: context deadline exceeded

[reshmav18]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

N/A

AzureRM Provider Version

N/A

Affected Resource(s)/Data Source(s)

azurerm/keyvault

Terraform Configuration Files

resource "arurerm_key_vault" "keyvault"{
name = local.keyvault.name
location = var.deployment.target.location
resource_group_name =var.deployment.target.resource_group
enabled_for_disk_encryption= true
purge_protection_enabled = true
tenant_id= lookup(var.tenat_id, var.deployment.tenant)

sku_name ="premuim"

network_acls {
bypass= "Azureservices"
default_action= "deny"
virtual_network_subnet_ids =[]
ip_rules = var.allowed_ips
}

tags= local.tags_full

lifecycle{
ignore_changes =[
tags["created"]
]
}
}

Debug Output/Panic Output

Error: retrieving contact for Keyvault: Keyvault. BaseClient#getcertificateContacts : failure sending request: Statuscode=0 -- Original error: context deadline exceeded

Expected Behaviour

No response

Actual Behaviour

The customer is running a terraform script to re-create a AKS cluster which creates a PEP in Key Vault. The terraform script is listing the changes made, checking the KV config as below and then create a cluster associated with PEP.

resource "arurerm_key_vault" "keyvault"{
name = local.keyvault.name
location = var.deployment.target.location
resource_group_name =var.deployment.target.resource_group
enabled_for_disk_encryption= true
purge_protection_enabled = true
tenant_id= lookup(var.tenat_id, var.deployment.tenant)

sku_name ="premuim"

network_acls {
bypass= "Azureservices"
default_action= "deny"
virtual_network_subnet_ids =[]
ip_rules = var.allowed_ips
}

tags= local.tags_full

lifecycle{
ignore_changes =[
tags["created"]
]
}
}

It is able to list the changes but when tries to check KV config failing with below error

Error: retrieving contact for Keyvault: Keyvault. BaseClient#getcertificateContacts : failure sending request: Statuscode=0 -- Original error: context deadline exceeded

Able to see list changes in Azure activity logs,

Steps to Reproduce
The customer is running a terraform script to re-create a AKS cluster which creates a PEP in Key Vault. The terraform script is listing the changes made, checking the KV config as below and then create a cluster associated with PEP.

resource "arurerm_key_vault" "keyvault"{
name = local.keyvault.name
location = var.deployment.target.location
resource_group_name =var.deployment.target.resource_group
enabled_for_disk_encryption= true
purge_protection_enabled = true
tenant_id= lookup(var.tenat_id, var.deployment.tenant)

sku_name ="premuim"

network_acls {
bypass= "Azureservices"
default_action= "deny"
virtual_network_subnet_ids =[]
ip_rules = var.allowed_ips
}

tags= local.tags_full

lifecycle{
ignore_changes =[
tags["created"]
]
}
}

It is able to list the changes but when tries to check KV config failing with below error

Error: retrieving contact for Keyvault: Keyvault. BaseClient#getcertificateContacts : failure sending request: Statuscode=0 -- Original error: context deadline exceeded

Able to see list changes in Azure activity logs,

Screenshot available

Reached out to Azure KeyVault team and suggestion was to reach out to Terreform Team

Steps to Reproduce

The customer is running a terraform script to re-create a AKS cluster which creates a PEP in Key Vault. The terraform script is listing the changes made, checking the KV config as below and then create a cluster associated with PEP.

resource "arurerm_key_vault" "keyvault"{
name = local.keyvault.name
location = var.deployment.target.location
resource_group_name =var.deployment.target.resource_group
enabled_for_disk_encryption= true
purge_protection_enabled = true
tenant_id= lookup(var.tenat_id, var.deployment.tenant)

sku_name ="premuim"

network_acls {
bypass= "Azureservices"
default_action= "deny"
virtual_network_subnet_ids =[]
ip_rules = var.allowed_ips
}

tags= local.tags_full

lifecycle{
ignore_changes =[
tags["created"]
]
}
}

It is able to list the changes but when tries to check KV config failing with below error

Error: retrieving contact for Keyvault: Keyvault. BaseClient#getcertificateContacts : failure sending request: Statuscode=0 -- Original error: context deadline exceeded

Able to see list changes in Azure activity logs,

Steps to Reproduce
The customer is running a terraform script to re-create a AKS cluster which creates a PEP in Key Vault. The terraform script is listing the changes made, checking the KV config as below and then create a cluster associated with PEP.

resource "arurerm_key_vault" "keyvault"{
name = local.keyvault.name
location = var.deployment.target.location
resource_group_name =var.deployment.target.resource_group
enabled_for_disk_encryption= true
purge_protection_enabled = true
tenant_id= lookup(var.tenat_id, var.deployment.tenant)

sku_name ="premuim"

network_acls {
bypass= "Azureservices"
default_action= "deny"
virtual_network_subnet_ids =[]
ip_rules = var.allowed_ips
}

tags= local.tags_full

lifecycle{
ignore_changes =[
tags["created"]
]
}
}

It is able to list the changes but when tries to check KV config failing with below error

Error: retrieving contact for Keyvault: Keyvault. BaseClient#getcertificateContacts : failure sending request: Statuscode=0 -- Original error: context deadline exceeded

Able to see list changes in Azure activity logs,

Screenshot available

Reached out to Azure KeyVault team and suggestion was to reach out to Terreform Team

Important Factoids

No response

References

No response

[tombuildsstuff]

Duplicate of #9738, please subscribe to that issue for updates - ultimately this is an API limitation since the API doesn't expose this information via the Resource Manager API, so we need to use the Data Plane API here - you can fix this by updating the default_action of the network_acl block, or adding the IP Address of where Terraform is being run to the allow-list.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.