`vsphere_host` does not check thumbprint

luclis commented 2 years ago

Terraform Version

# terraform -v
Terraform v1.1.3
on linux_amd64
+ provider registry.terraform.io/hashicorp/vsphere v2.0.2

vSphere Provider Version

+ provider registry.terraform.io/hashicorp/vsphere v2.0.2

vSphere Version

vSphere 7.0 Update 2

Affected Resource(s)

vsphere_host

Terraform Configuration Files

provider "vsphere" {
  user           = "administrator@vsphere.local"
  password       = "password"
  vsphere_server = "192.168.1.1"

  # If you have a self-signed cert
  allow_unverified_ssl = true
}
data "vsphere_datacenter" "dc" {
  name = "DC1"
}

resource "vsphere_host" "esx1" {
  hostname   = "192.168.1.2"
  username   = "root"
  password   = "password"
#  license    = "00000-00000-00000-00000i-00000"
  datacenter = data.vsphere_datacenter.dc.id
  thumbprint = "AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA"
}

resource "vsphere_host" "esx2" {
  hostname   = "192.168.1.2"
  username   = "root"
  password   = "password"
#  license    = "00000-00000-00000-00000i-00000"
  datacenter = data.vsphere_datacenter.dc.id
  thumbprint = "AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA"
}

Debug Output

Panic Output

Expected Behavior

The hash should be check and I shouldn't be able to import 2 esx with same hash when they have differents certificates.

Actual Behavior

I can add multiples esx with the same hash

Steps to Reproduce

Create 2 esxi
Create 1 vCenter (not sur is usefull)
Run the terraform part above without changing the thumbprint.

Important Factoids

References

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.
If you are interested in working on this issue or have submitted a pull request, please leave a comment.

tenthirtyam commented 2 years ago

I believe the intend here is to use the vsphere_host_thumbprint thumbprint datasource, but there should be a validation for sure.

Ryan Johnson Staff II Solutions Architect | VMware, Inc.

sneal commented 2 years ago

On vSphere 7.0 Update 3 I tried hardcoding all my host's thumbprints to AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA and got the following error:

│ Error: host addition failed. Authenticity of the host's SSL certificate is not verified.
│ 
│   with vsphere_host.nested_esxi[0],
│   on esxi.tf line 119, in resource "vsphere_host" "nested_esxi":
│  119: resource "vsphere_host" "nested_esxi" {

If I replace the hardcoded thumbprint with a single valid vsphere_host_thumbprint data element then I can create ALL of the vsphere_hosts just fine - even though they don't match. This works, but probably shouldn't:

data "vsphere_host_thumbprint" "thumbprint" {
  insecure = true
  address  = cidrhost(var.nested_esxi_cidr, 8)
}

resource "vsphere_host" "nested_esxi" {
  count = var.esxi_host_count

  hostname   = cidrhost(var.nested_esxi_cidr, count.index + 8)
  username   = "root"
  password   = var.vsphere_password
  datacenter = data.vsphere_datacenter.datacenter.id
  thumbprint = data.vsphere_host_thumbprint.thumbprint.id

  cluster_managed = true
}

It appears the validation is done by vSphere and not this provider.

burnsjared0415 commented 1 month ago

@sneal can you send me example of the address = cidrhost(var.nested_esxi_cidr, 8) variable, i have a fix i believe but need to get that one last test done.

sneal commented 1 month ago

@burnsjared0415 are you asking what I might have used for var.nested_esxi_cidr? If so, something like cidrhost("10.0.0.0/24", 8) which just produces a single IP string 10.0.0.8. In the example I had previously I was creating multiple ESXi hosts using a single resource definition via the count param.

burnsjared0415 commented 1 month ago

@sneal thanks for the example let me test that use case, thanks so much

github-actions[bot] commented 1 month ago

This functionality has been released in v2.9.3 of the Terraform Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

github-actions[bot] commented 2 days ago

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.

hashicorp / terraform-provider-vsphere