<p>The solution was to declare the variables in the json template used by Packer build command. Like this:</p>
<pre><code>{
  &quot;variables&quot;: {
    &quot;azure_cd&quot;:      &quot;{{env `azure_cd`}}&quot;,
    &quot;azure_ct&quot;:      &quot;{{env `azure_ct`}}&quot;,
    &quot;azure_td&quot;:      &quot;{{env `azure_td`}}&quot;,
    &quot;azure_sd&quot;:      &quot;{{env `azure_sd`}}&quot;
  },

  &quot;builders&quot;: [{
    &quot;type&quot;: &quot;azure-arm&quot;,
    &lt;etc..&gt;
</code></pre>

CC BY-SA 4.0
2021-12-17T14:21:46.123Z
Now I just need to convert from json to HCL
Pascal
CC BY-SA 4.0
2021-12-16T12:58:52.213Z
2021-12-16T12:58:52.213Z
Pascal
<p>I use the following yml workflow in GitHub:</p>
<pre><code>- name: Packer Build
  run: packer build -force -var 'client_id=${{ secrets.AZURE_CLIENT_ID }}' \
                           -var 'client_secret=${{ secrets.AZURE_CLIENT_SECRET }}' \
                           -var 'subscription_id=${{ secrets.AZURE_SUBSCRIPTION_ID }}' \
                           -var 'tenant_id=${{ secrets.AZURE_TENANT_ID }}' \
                           -on-error=abort ubuntu.json
</code></pre>
<p>The Azure service principal credentials are stored as GitHub repository secrets. I can successfully build the image from my local machine using the same credentials as zsh environment variables:</p>
<pre><code>-&gt; % packer build -force foo.json
azure-arm: output will be in this color.

==&gt; azure-arm: Running builder ...
==&gt; azure-arm: Getting tokens using client secret
==&gt; azure-arm: Getting tokens using client secret
    azure-arm: Creating Azure Resource Manager (ARM) client ...
</code></pre>
<p>However, in the GitHub workflow, Packer tries to use Managed Identity, instead of the service principal and fails with the following error message:</p>
<pre><code>azure-arm: output will be in this color.
==&gt; azure-arm: Running builder ...
==&gt; azure-arm: Getting tokens using Managed Identity for Azure
Build 'azure-arm' errored after 146 milliseconds 736 microseconds: adal: Refresh request failed. Status Code = '400'. Response body: {&quot;error&quot;:&quot;invalid_request&quot;,&quot;error_description&quot;:&quot;Identity not found&quot;} Endpoint http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&amp;resource=https%3A%2F%2Fmanagement.azure.com%2F
</code></pre>

CC BY-SA 4.0
2021-12-15T15:57:27.173Z
I think I need to declare the variables in the Packer template so I can set them using the -var argument when calling packer build.
Pascal
<azure><packer><github-actions>
How do I force Packer to use Azure client secret in GitHub Actions workflow?
Pascal
# How do I force Packer to use Azure client secret in GitHub Actions workflow?

(Asked by: username_0 on 2021-12-15)

I use the following yml workflow in GitHub:
- name: Packer Build
  run: packer build -force -var 'client_id=${{ secrets.AZURE_CLIENT_ID }}' \
                           -var 'client_secret=${{ secrets.AZURE_CLIENT_SECRET }}' \
                           -var 'subscription_id=${{ secrets.AZURE_SUBSCRIPTION_ID }}' \
                           -var 'tenant_id=${{ secrets.AZURE_TENANT_ID }}' \
                           -on-error=abort ubuntu.json

The Azure service principal credentials are stored as GitHub repository secrets. I can successfully build the image from my local machine using the same credentials as zsh environment variables:
-> % packer build -force foo.json
azure-arm: output will be in this color.

==> azure-arm: Running builder ...
==> azure-arm: Getting tokens using client secret
==> azure-arm: Getting tokens using client secret
    azure-arm: Creating Azure Resource Manager (ARM) client ...

However, in the GitHub workflow, Packer tries to use Managed Identity, instead of the service principal and fails with the following error message:
azure-arm: output will be in this color.
==> azure-arm: Running builder ...
==> azure-arm: Getting tokens using Managed Identity for Azure
Build 'azure-arm' errored after 146 milliseconds 736 microseconds: adal: Refresh request failed. Status Code = '400'. Response body: {"error":"invalid_request","error_description":"Identity not found"} Endpoint http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https%3A%2F%2Fmanagement.azure.com%2F

**Tags:** azure, packer, github-actions

> **Comments:**
> **username_0**: I think I need to declare the variables in the Packer template so I can set them using the -var argument when calling packer build.  

---

## 1 answers

### Answer by username_0 on 2021-12-16. Score: 1 | Accepted answer

The solution was to declare the variables in the json template used by Packer build command. Like this:
{
  "variables": {
    "azure_cd":      "{{env `azure_cd`}}",
    "azure_ct":      "{{env `azure_ct`}}",
    "azure_td":      "{{env `azure_td`}}",
    "azure_sd":      "{{env `azure_sd`}}"
  },

  "builders": [{
    "type": "azure-arm",

> **Comments:**
> **username_0**: Now I just need to convert from json to HCL  

---

