Answers: <p>The solution was to declare the variables in the json template used by Packer build command. Like this:</p>
  <pre><code>{
    &quot;variables&quot;: {
      &quot;azure_cd&quot;:      &quot;{{env `azure_cd`}}&quot;,
      &quot;azure_ct&quot;:      &quot;{{env `azure_ct`}}&quot;,
      &quot;azure_td&quot;:      &quot;{{env `azure_td`}}&quot;,
      &quot;azure_sd&quot;:      &quot;{{env `azure_sd`}}&quot;
    },
  
    &quot;builders&quot;: [{
      &quot;type&quot;: &quot;azure-arm&quot;,
      &lt;etc..&gt;
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2021-12-17T14:21:46.123Z
Answers: Now I just need to convert from json to HCL
Answers: Pascal
Answers: CC BY-SA 4.0
Answers: 2021-12-16T12:58:52.213Z
Answers: 2021-12-16T12:58:52.213Z
Answers: Pascal
Body: <p>I use the following yml workflow in GitHub:</p>
  <pre><code>- name: Packer Build
    run: packer build -force -var 'client_id=${{ secrets.AZURE_CLIENT_ID }}' \
                             -var 'client_secret=${{ secrets.AZURE_CLIENT_SECRET }}' \
                             -var 'subscription_id=${{ secrets.AZURE_SUBSCRIPTION_ID }}' \
                             -var 'tenant_id=${{ secrets.AZURE_TENANT_ID }}' \
                             -on-error=abort ubuntu.json
  </code></pre>
  <p>The Azure service principal credentials are stored as GitHub repository secrets. I can successfully build the image from my local machine using the same credentials as zsh environment variables:</p>
  <pre><code>-&gt; % packer build -force foo.json
  azure-arm: output will be in this color.
  
  ==&gt; azure-arm: Running builder ...
  ==&gt; azure-arm: Getting tokens using client secret
  ==&gt; azure-arm: Getting tokens using client secret
      azure-arm: Creating Azure Resource Manager (ARM) client ...
  </code></pre>
  <p>However, in the GitHub workflow, Packer tries to use Managed Identity, instead of the service principal and fails with the following error message:</p>
  <pre><code>azure-arm: output will be in this color.
  ==&gt; azure-arm: Running builder ...
  ==&gt; azure-arm: Getting tokens using Managed Identity for Azure
  Build 'azure-arm' errored after 146 milliseconds 736 microseconds: adal: Refresh request failed. Status Code = '400'. Response body: {&quot;error&quot;:&quot;invalid_request&quot;,&quot;error_description&quot;:&quot;Identity not found&quot;} Endpoint http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&amp;resource=https%3A%2F%2Fmanagement.azure.com%2F
  </code></pre>
  
Comments: CC BY-SA 4.0
Comments: 2021-12-15T15:57:27.173Z
Comments: I think I need to declare the variables in the Packer template so I can set them using the -var argument when calling packer build.
Comments: Pascal
Tags: <azure><packer><github-actions>
Title: How do I force Packer to use Azure client secret in GitHub Actions workflow?
UserDisplayName: Pascal
ThreadText: # How do I force Packer to use Azure client secret in GitHub Actions workflow?
  
  (Asked by: username_0 on 2021-12-15)
  
  I use the following yml workflow in GitHub:
  
  ```
  - name: Packer Build
    run: packer build -force -var 'client_id=${{ secrets.AZURE_CLIENT_ID }}' \
                             -var 'client_secret=${{ secrets.AZURE_CLIENT_SECRET }}' \
                             -var 'subscription_id=${{ secrets.AZURE_SUBSCRIPTION_ID }}' \
                             -var 'tenant_id=${{ secrets.AZURE_TENANT_ID }}' \
                             -on-error=abort ubuntu.json
  
  ```
  
  The Azure service principal credentials are stored as GitHub repository secrets. I can successfully build the image from my local machine using the same credentials as zsh environment variables:
  
  ```
  -> % packer build -force foo.json
  azure-arm: output will be in this color.
  
  ==> azure-arm: Running builder ...
  ==> azure-arm: Getting tokens using client secret
  ==> azure-arm: Getting tokens using client secret
      azure-arm: Creating Azure Resource Manager (ARM) client ...
  
  ```
  
  However, in the GitHub workflow, Packer tries to use Managed Identity, instead of the service principal and fails with the following error message:
  
  ```
  azure-arm: output will be in this color.
  ==> azure-arm: Running builder ...
  ==> azure-arm: Getting tokens using Managed Identity for Azure
  Build 'azure-arm' errored after 146 milliseconds 736 microseconds: adal: Refresh request failed. Status Code = '400'. Response body: {"error":"invalid_request","error_description":"Identity not found"} Endpoint http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https%3A%2F%2Fmanagement.azure.com%2F
  
  ```
  
  **Tags:** azure, packer, github-actions
  
  > **Comments:**
  > **username_0**: I think I need to declare the variables in the Packer template so I can set them using the -var argument when calling packer build.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2021-12-16. Score: 1 | Accepted answer
  
  The solution was to declare the variables in the json template used by Packer build command. Like this:
  
  ```
  {
    "variables": {
      "azure_cd":      "{{env `azure_cd`}}",
      "azure_ct":      "{{env `azure_ct`}}",
      "azure_td":      "{{env `azure_td`}}",
      "azure_sd":      "{{env `azure_sd`}}"
    },
  
    "builders": [{
      "type": "azure-arm",
      <etc..>
  
  ```
  
  > **Comments:**
  > **username_0**: Now I just need to convert from json to HCL  
  
  ---
  
  