[feature request] Support HTTP proxy for tls_certificate data source

[donovanmuller]

I am trying to retrieve a certificate via the tls_certificate data source as per the example in the docs. This is in context of an OIDC provider for an EKS cluster running in a private VPC (no public network connectivity).

Given an OIDC issuer URL such as https://oidc.eks.eu-west-1.amazonaws.com/id/838DB18FA8EC26D87848FDEC1D50CFDC the call evetually fails with:

Error: dial tcp 34.248.140.150:443: connect: connection timed out

This is because of the private VPC and the fact that the data source does not support a HTTP proxy (there are unfortunately no EKS VPC endpoints currently).

Terraform Version

0.14.4

Affected Data Source(s)

• tls_certificate

Terraform Configuration Files

data "tls_certificate" "eks_cluster_oidc_issuer" {
  // E.g. https://oidc.eks.eu-west-1.amazonaws.com/id/838DB18FA8EC26D87848FDEC1D50CFDC
  url = aws_eks_cluster.eks_cluster.identity[0].oidc[0].issuer
}

Expected Behavior

The url should support using a HTTP proxy. Currently

terraform-provider-tls/internal/provider/data_source_tls_certificate.go

Line 92 in 0fe77c5

conn, err := tls.Dial("tcp", u.Host, &tls.Config{InsecureSkipVerify: !verifyChain})

does not.

Actual Behavior

Connection eventually times out (connection timed out)

References

Perhaps adjusting/replacing the dialer with something similar to:

• https://github.com/mwitkow/go-http-dialer
• https://gist.github.com/jim3ma/3750675f141669ac4702bc9deaf31c6b

[rastakajakwanna]

Our team is trying to replace our custom data "external" containing shell script with this data source but we are blocked by exactly this issue. Proxy is a show stopper for this data source. I would expect every Terraform part to be following and supporting global proxy configuration which is not the case here.

Therefore, you have my +1, I was going to raise the same issue.

[trebuh]

I can not second that issue enough. I was struggling with that exact issue for a few days when a colleague pointed me here.
Glad it is now reported.

[alexmnyc]

same here. cannot be used for corporate networks

[guidoffm]

We also need this fix. Please implement it.

[guidoffm]

Is there someone who can approve #113

[liger1978]

If anyone else is having this issue, I have forked this repo, merged in the fix from @DanielRis and published a new version of the provider. You can use this until Hashicorp do the needful:

terraform {
  required_providers {
    tls = {
      source = "liger1978/tls"
      version = "3.1.1"
    }
  }
}

[guidoffm]

If anyone else is having this issue, I have forked this repo, merged in the fix from @DanielRis and published a new version of the provider. You can use this until Hashicorp do the needful:

terraform {
  required_providers {
    tls = {
      source = "liger1978/tls"
      version = "3.1.1"
    }
  }
}

Maybe you could submit a new PR for this.

[liger1978]

@guidoffm I don't see the point. @DanielRis's PR is still valid AFAICS.

[guidoffm]

@guidoffm I don't see the point. @DanielRis's PR is still valid AFAICS.

The problem, as far as I remember, is, that DanielRis missed to sign the licence agreement and so the PR will stuck forever.
Maybe you can sign it and I hope to see progress then.

[liger1978]

@guidoffm I don't think I can be bothered with all that.

[guidoffm]

@guidoffm I don't think I can be bothered with all that.

Don't you think it would work if you just create a new PR for your repo? Could you give it a try?

[DanielRis]

I will ping my HC account manager about this :) I signed the document multiple times, but something seems to be wrong.

[DanielRis]

Ok this has been fixed, sorry for that. I should have read better.