Job Failed #6091

Job #6091 failed for afb05132:

I tried manually using the RW token and it works as expected:

 curl \
        -X POST \
        -H "Authorization: Bearer XXXXXXXX" \
        -H "Content-Type: application/json" \
        -d '{"name":"My ssh key","public_key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDG6KCXcL6bgJKD/ZbzLDeZms6TJwUz7K0yf+KCvfjxV dummy-key","labels":{}}' \
        'https://api.hetzner.cloud/v1/ssh_keys'

So my guess is that
TF_COMMON_ARGS: "-var hcloud_token=${HCLOUD_RW_TOKEN:=$HCLOUD_RO_TOKEN} -var theo_token=${THEO_TOKEN}"
is not correctly expanded

created merge request !2 (closed) to address this issue

mentioned in merge request !2 (closed)

The underlying reason is probably that hashicorp/terraform:light image is an alpine derivative and this variable assignment might not be supported by its default shell ash... Still I'm not 100% convinced having different token brings any extra security here.

$ docker run --rm -it alpine
/ # test=${HCLOUD_RW_TOKEN:=$HCLOUD_RO_TOKEN}
/ # echo $test

/ # HCLOUD_RO_TOKEN=ro
/ # test=${HCLOUD_RW_TOKEN:=$HCLOUD_RO_TOKEN}
/ # echo $test
ro
/ # HCLOUD_RW_TOKEN=rw
/ # test=${HCLOUD_RW_TOKEN:=$HCLOUD_RO_TOKEN}
/ # echo $test
rw
/ # HCLOUD_RW_TOKEN=""
/ # test=${HCLOUD_RW_TOKEN:=$HCLOUD_RO_TOKEN}
/ # echo $test
ro
/ #

After further investigation it turned out this is not limited by the image being used but more generally due to how variable expansion (carried out by Ruby itself and not by the shell) works in variable: constructs. Only "simple" expansion seems to be supported a.t.m. Even referencing elsewhere defined variables from gitlab-ci.yml itself is not yet supported: effort to improve this behaviour is tracked here. See its related issues for a more exhaustive list of the limitations of the current implementation.

created merge request !3 (merged) to address this issue

mentioned in merge request !3 (merged)

closed with merge request !3 (merged)