Issue Connecting Custom Worker to JFrog Artifactory Repository from TFE Instance

Problem

When using a custom worker with Terraform Enterprise (TFE), the worker fails to connect to a JFrog Artifactory repository for provider installation. This occurs even after using a hook script to generate a Terraform CLI configuration file (cli.tfrc) that defines a network mirror.

Prerequisites

• A working Terraform Enterprise instance.
• A private provider registry configured in JFrog Artifactory.
• A custom worker image for Terraform Enterprise.

Cause

The Terraform CLI process running inside the custom worker is unaware of the dynamically generated configuration file. Although the hook script successfully creates the file (e.g., at /tmp/cli.tfrc), Terraform does not automatically detect it. By default, Terraform only searches for the configuration file in specific locations, and the environment is not configured to point to the custom path.

The following example shows a hook script that creates the configuration file but is missing the corresponding environment variable to make Terraform aware of it.

Example Dockerfile instruction:

ADD --chown=tfc-agent:tfc-agent hooks /home/tfc-agent/.tfc-agent/hooks

Example hook script (terraform-pre-plan or terraform-pre-apply):

#!/bin/bash
cat >> /tmp/cli.tfrc <<EOF
provider_installation {
  direct {
    exclude = ["registry.terraform.io/*/*"]
  }
  network_mirror {
    url = "https://providers.tfe-example.com/artifactory/terraform-providers/"
  }
}
EOF

Solution

To resolve this issue, you must set the TF_CLI_CONFIG_FILE environment variable in your custom worker's environment. This variable explicitly tells the Terraform CLI which configuration file to use, overriding its default search paths.

1. Modify the Dockerfile: In the Dockerfile for your custom worker image, add an ENV instruction to set the TF_CLI_CONFIG_FILE variable. The path must match the location where your hook script creates the configuration file.

   ## Set the path to the Terraform CLI configuration file
   ENV TF_CLI_CONFIG_FILE="/tmp/cli.tfrc"

2. Rebuild and Deploy: Rebuild your custom worker image and update your Terraform Enterprise configuration to use the new image.

By setting this environment variable, you ensure that every Terraform operation (plan or apply) running on the custom worker will use the provider installation settings defined in your hook script, allowing it to connect to your JFrog Artifactory repository.

Additional Information

• For more details on the Terraform CLI configuration file, refer to the Provider Installation documentation.
• To configure a Terraform provider mirror in JFrog Artifactory, please refer to the JFrog Artifactory documentation for Terraform Registries.