Add automatic recovery of soft-deleted KeyVault secrets and keys #4450
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Implements automatic detection and recovery of soft-deleted secrets and keys in Azure KeyVault when attempting to create resources with the same name. This addresses the common workflow issue where: pulumi up -> pulumi destroy -> pulumi up previously failed due to soft-deleted resources blocking recreation. Changes: - Add custom CanCreate() to bypass default existence checks - Add custom Create() that: * Checks for soft-deleted secrets/keys using GetDeletedSecret/GetDeletedKey * Automatically recovers them using BeginRecoverDeletedSecret/BeginRecoverDeletedKey * Falls back to normal creation flow if no soft-deleted resource exists - Implements recovery for both azcore and autorest backends - Adds informative logging at appropriate verbosity levels This allows users to reuse secret/key names immediately after deletion without manual Azure Portal intervention or waiting for the 7-90 day retention period. Fixes pulumi#1174 Fixes pulumi#1211 Related to pulumi#2374, pulumi#3357 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <[email protected]>
The Azure SDK uses synchronous RecoverDeletedSecret/RecoverDeletedKey methods, not async pollers. Updated the recovery logic to use the correct API signatures. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <[email protected]>
|
Hi there 👋 Thank you for submitting a pull request. Acceptance tests must be run by a maintainer. If a maintainer hasn't picked this up after 7 days, please do reach out to a maintainer via our community Slack. Maintainers: Please review changes then run tests by adding the comment: |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Problem
When KeyVault secrets or keys are destroyed and then recreated with the same name, Pulumi fails with a conflict error because Azure keeps soft-deleted resources for 7-90 days. This common workflow breaks:
Users must manually purge secrets via Azure Portal or CLI before redeploying, which is error-prone and time-consuming. Also not a viable option when dealing with the industry standard of purge protections for secrets.
Solution
This PR adds custom
CreateandCanCreatefunctions for KeyVault secrets and keys that:GetDeletedSecret/GetDeletedKeyAPIsRecoverDeletedSecret/RecoverDeletedKeyThe implementation covers both:
azcoreSDK (primary implementation)autorestSDK (for backward compatibility)Changes
Modified Files
provider/pkg/resources/customresources/custom_keyvault.go(+104 lines)CanCreateandCreatefunctions for secrets and keysprovider/pkg/resources/customresources/custom_keyvault_autorest.go(+87 lines)Key Features
Testing
Tested with a KeyVault containing 4 secrets / 4Keys:
pulumi destroy && pulumi upfailed with conflict errorspulumi destroy && pulumi upsucceeds automaticallyRelated Issues
Fixes #1174
Fixes #1211
Related to #2374, #3357