Docker容器中Terragrunt安装Cloudflare Provider遇x509证书错误求助

环境与配置 #

1. Terraform Provider配置 #

terraform {
  required_providers {
    azurerm = {
      source = "hashicorp/azurerm"
      version = "~> 3.41"
    }
    cloudflare = {
      source = "cloudflare/cloudflare"
      version = "~> 3.32"
    }
  }
}

2. Docker容器启动命令 #

$path = 'C:\git\'
docker run --rm -it `
    -e ARM_CLIENT_ID=$appid `
    -e ARM_CLIENT_SECRET=$password `
    -e ARM_TENANT_ID=$tenant `
    -e ARM_SUBSCRIPTION_ID=$subscription `
    -v ${path}:/terragrunt-folder terragrunt:1.0 sh

问题现象 #

执行terragrunt init时出现x509证书未知权威错误，无法自动安装cloudflare/cloudflare v3.34.0。手动复制Provider二进制文件到Terragrunt缓存目录可解决，但多模块场景下手动操作效率极低。

补充信息 #

1. Dockerfile内容 #

FROM alpine:3.16 as builder

# Install build dependencies
RUN set -eux \
    && apk --no-cache add \
    coreutils \
    curl \
    dpkg \
    git \
    unzip

# Get Terraform
ARG VERSION=1.3.7
RUN set -eux \
    && if [ "$(dpkg --print-architecture | awk -F'-' '{print $NF}' )" = "i386" ]; then\
    ARCH=386; \
    elif [ "$(uname -m)" = "x86_64" ]; then \
    ARCH=amd64; \
    elif [ "$(uname -m)" = "aarch64" ]; then \
    ARCH=arm64; \
    elif [ "$(uname -m)" = "armv7l" ]; then \
    ARCH=arm; \
    fi \
    \
    && curl --fail -sS -L -O \
    https://releases.hashicorp.com/terraform/${VERSION}/terraform_${VERSION}_linux_${ARCH}.zip \
    && unzip terraform_${VERSION}_linux_${ARCH}.zip \
    && mv terraform /usr/bin/terraform \
    && chmod +x /usr/bin/terraform

# Get Terragrunt
ARG TG_VERSION=latest
RUN set -eux \
    && git clone https://github.com/gruntwork-io/terragrunt /terragrunt \
    && cd /terragrunt \
    && if [ "${TG_VERSION}" = "latest" ]; then \
    VERSION="$( git describe --abbrev=0 --tags )"; \
    else \
    VERSION="$( git tag | grep -E "v${TG_VERSION}\.[.0-9]+" | sort -Vu | tail -1 )" ;\
    fi \
    # Get correct architecture
    && if [ "$(dpkg --print-architecture | awk -F'-' '{print $NF}' )" = "i386" ]; then\
    ARCH=386; \
    elif [ "$(uname -m)" = "x86_64" ]; then \
    ARCH=amd64; \
    elif [ "$(uname -m)" = "aarch64" ]; then \
    ARCH=arm64; \
    elif [ "$(uname -m)" = "armv7l" ]; then \
    ARCH=arm; \
    fi \
    \
    && curl --insecure --fail -sS -L \
    https://github.com/gruntwork-io/terragrunt/releases/download/${VERSION}/terragrunt_linux_${ARCH} \
    -o /usr/bin/terragrunt \
    && chmod +x /usr/bin/terragrunt \
    \
    && terraform --version \
    && terragrunt --version
FROM mcr.microsoft.com/azure-cli
RUN set -eux \
    && apk --no-cache add \
    coreutils \
    curl \
    dpkg \
    git \
    unzip
COPY --from=builder /usr/bin/terraform /usr/bin/terraform
COPY --from=builder /usr/bin/terragrunt /usr/bin/terragrunt

2. 容器内curl测试结果 #

直接执行curl请求会触发SSL证书错误，添加--insecure参数后可正常获取内容，说明容器缺少可信根证书。

批量解决方案 #

方案1：补充容器内可信根证书（推荐，安全） #

容器基础镜像（alpine/azure-cli）缺少验证Provider下载地址所需的根证书，修改Dockerfile安装并更新证书：

1. 修改builder阶段的依赖安装命令，添加ca-certificates并更新证书：

FROM alpine:3.16 as builder

# Install build dependencies
RUN set -eux \
    && apk --no-cache add \
    coreutils \
    curl \
    dpkg \
    git \
    unzip \
    ca-certificates \
    && update-ca-certificates

2. 修改最终阶段（azure-cli镜像）的依赖安装命令，同样添加证书包：

FROM mcr.microsoft.com/azure-cli
RUN set -eux \
    && apk --no-cache add \
    coreutils \
    curl \
    dpkg \
    git \
    unzip \
    ca-certificates \
    && update-ca-certificates
COPY --from=builder /usr/bin/terraform /usr/bin/terraform
COPY --from=builder /usr/bin/terragrunt /usr/bin/terragrunt

重新构建镜像后，容器内的curl和Terraform即可正常验证SSL证书，自动下载Provider。

方案2：跳过Terraform证书验证（临时测试用，不安全） #

通过设置环境变量TF_INSECURE_SKIP_VERIFY=true让Terraform跳过证书验证，修改容器启动命令：

$path = 'C:\git\'
docker run --rm -it `
    -e ARM_CLIENT_ID=$appid `
    -e ARM_CLIENT_SECRET=$password `
    -e ARM_TENANT_ID=$tenant `
    -e ARM_SUBSCRIPTION_ID=$subscription `
    -e TF_INSECURE_SKIP_VERIFY=true `
    -v ${path}:/terragrunt-folder terragrunt:1.0 sh

该方法会禁用证书验证，存在中间人攻击风险，仅适合测试环境临时使用。

方案3：预下载Provider到镜像中 #

在Dockerfile中提前下载所需版本的Provider二进制文件，放到Terraform默认插件目录，避免初始化时重复下载：

FROM mcr.microsoft.com/azure-cli
RUN set -eux \
    && apk --no-cache add \
    coreutils \
    curl \
    dpkg \
    git \
    unzip \
    ca-certificates \
    && update-ca-certificates

# 预下载Cloudflare Provider v3.34.0（根据架构调整路径）
RUN set -eux \
    && mkdir -p /root/.terraform.d/plugins/registry.terraform.io/cloudflare/cloudflare/3.34.0/linux_amd64 \
    && curl -sSL https://releases.hashicorp.com/terraform-provider-cloudflare/3.34.0/terraform-provider-cloudflare_3.34.0_linux_amd64.zip \
    | unzip -d /root/.terraform.d/plugins/registry.terraform.io/cloudflare/cloudflare/3.34.0/linux_amd64 -

COPY --from=builder /usr/bin/terraform /usr/bin/terraform
COPY --from=builder /usr/bin/terragrunt /usr/bin/terragrunt

该方法适合固定Provider版本的场景，需手动维护Provider版本和架构。

内容的提问来源于stack exchange，提问作者Alexey Auslender