Open blacksd opened 2 years ago
ravinitp
commented
2 years ago The fingerprint should match the API signing key. https://docs.us-phoenix-1.oraclecloud.com/Content/API/Concepts/apisigningkey.htm#How3 describes how to generate the API signing keys in the PEM format, and thereafter get the corresponding fingerprint.
blacksd
commented
2 years ago The fingerprint should match the API signing key. https://docs.us-phoenix-1.oraclecloud.com/Content/API/Concepts/apisigningkey.htm#How3 describes how to generate the API signing keys in the PEM format, and thereafter get the corresponding fingerprint.
I'm not sure about the point of your comment: the fingerprint does still match the key, I'm just changing its format - the key itself is the same. As a confirmation, I can just change the key path in the ~/.oci/config file to the PKCS#1 format and nothing else, and oci commands will still work + also the provider.
To the core matter - are you saying that the oci setup bootstrap generates an incompatible private key format (PKCS#8) by design? Forcing the user to create the key manually (when the oci client is supposed to ease the process) is unnecessary friction. Updating the provider to support both is the best way to provide a seamless experience.
ravinitp
commented
2 years ago Hi @blacksd ,
Can you please pass private key path into provider block .
provider "oci" { private_key_path = "key_file=/Users/marco/.oci/sessions/DEFAULT/oci_api_key.pem", pass_phrase = "<your_pass>" }
And let us know If issue still persist .
blacksd
commented
2 years ago @ravinitp I changed my provider config with:
provider "oci" {
private_key_path = "key_file=/Users/marco/.oci/sessions/DEFAULT/oci_api_key.pem"
private_key_password = "myencpass"
}but it's still failing with
╷
│ Error: can not create client, bad configuration: did not find a proper configuration for private key
│
│ with provider["registry.terraform.io/oracle/oci"],
│ on providers.tf line 11, in provider "oci":
│ 11: provider "oci" {
│
╵
kgrvamsi
commented
2 years ago +1
The issue is still there and the only way currently to make it running is by using "private_key" with the key value as string to it and run the terraform commands
winiz
commented
1 year ago I also encountered the same problem, this fix worked
+1
The issue is still there and the only way currently to make it running is by using "private_key" with the key value as string to it and run the terraform commands
blacksd
commented
1 year ago @ravinitp by the feedback here and in #512 it's pretty clear that there's something wrong with the provider. Are you going to schedule a fix for that? It's been broken for months, and this is not trivial - it's directly impacting users from day 1, a terrible user experience.
howsTricks
commented
1 year ago Echoing this, I've been using Terraform for many years and this provider authentication makes it unusable. I've spent countless hours trying to get this to run in terraform cloud with no success.
This seems to be related to https://github.com/oracle/terraform-provider-oci/issues/1584
ravinitp
commented
1 year ago Thank you for reporting the issue. We observed the affected resources are not provided in the description or it's incorrect. We request you to add it in issue description as mentioned in below format. Example: affected_resources = oci_core_instance , oci_core_instances
If it's not related to any particular resource then mention affected resource as terraform. Example: affected_resources = terraform
As this works through automation, request you to follow exact syntax.
zeusbaba
commented
1 year ago we faced similar issue, and we resolved it by regenerating keys with -aes256 --traditional 4096 type.
see snippet on how to generate those keys for use in OCI
mkdir -p ~/.oci
openssl genrsa -out ~/.oci/oci_api_key.pem -aes256 --traditional 4096
chmod go-rwx ~/.oci/oci_api_key.pem
openssl rsa -pubout -in ~/.oci/oci_api_key.pem -out ~/.oci/oci_api_key_public.pem@ravinitp I added the missing description. Can you please fix the labels? This is not answered. Thank you!
ncrystyan
commented
5 months ago +1 encountered same issue today. I have MacOS with Openssl 3.2.0 and spent few hours to discover this issue. Is not documented anywhere but here. OCI documentation https://docs.oracle.com/en-us/iaas/Content/API/Concepts/apisigningkey.htm#two is not mentioning anything about PKCS#1 mandatory key and by default Openssl 3.x.x will create PKCS#8. key see https://www.openssl.org/docs/man3.0/man7/migration_guide.html
It would be nice for customers not to have to troubleshoot this and just fix the compatibility issue.
Community Note
Terraform Version and Provider Version
Affected Resource(s)
affected_resources = terraform
Terraform Configuration Files
The content of the default
~/.oci/configafter theoci setup bootstrapisThe bootstrap phase creates a PKCS#8 key:
Expected Behavior
Actual Behavior
The provider isn't able to perform access with the default key.
Full
```sh ❯ TF_LOG=TRACE OCI_GO_SDK_DEBUG=1 terraform plan 2022-08-08T08:34:34.944+0200 [INFO] Terraform version: 1.1.1 2022-08-08T08:34:34.945+0200 [INFO] Go runtime version: go1.17.2 2022-08-08T08:34:34.945+0200 [INFO] CLI args: []string{"terraform", "plan"} 2022-08-08T08:34:34.945+0200 [TRACE] Stdout is a terminal of width 292 2022-08-08T08:34:34.945+0200 [TRACE] Stderr is a terminal of width 292 2022-08-08T08:34:34.945+0200 [TRACE] Stdin is a terminal 2022-08-08T08:34:34.945+0200 [DEBUG] Attempting to open CLI config file: /Users/marco/.terraformrc 2022-08-08T08:34:34.945+0200 [DEBUG] File doesn't exist, but doesn't need to. Ignoring. 2022-08-08T08:34:34.945+0200 [DEBUG] ignoring non-existing provider search directory terraform.d/plugins 2022-08-08T08:34:34.945+0200 [DEBUG] ignoring non-existing provider search directory /Users/marco/.terraform.d/plugins 2022-08-08T08:34:34.945+0200 [DEBUG] ignoring non-existing provider search directory /Users/marco/Library/Application Support/io.terraform/plugins 2022-08-08T08:34:34.945+0200 [DEBUG] ignoring non-existing provider search directory /Library/Application Support/io.terraform/plugins 2022-08-08T08:34:34.945+0200 [INFO] CLI command args: []string{"plan"} 2022-08-08T08:34:34.947+0200 [TRACE] Meta.Backend: no config given or present on disk, so returning nil config 2022-08-08T08:34:34.947+0200 [TRACE] Meta.Backend: backend has not previously been initialized in this working directory 2022-08-08T08:34:34.947+0200 [DEBUG] New state was assigned lineage "222769df-75a4-dcd4-d5bb-bd8aac1daafe" 2022-08-08T08:34:34.947+0200 [TRACE] Meta.Backend: using default local state only (no backend configuration, and no existing initialized backend) 2022-08-08T08:34:34.947+0200 [TRACE] Meta.Backend: instantiated backend of typeTRACElog:Steps to Reproduce
oci setup bootstrapterraform initterraform plan -var "compartment_id=ocid1.tenancy.oc1..<REDACTED>"Important Factoids
The issue goes away if you rewrite your RSA key to use PKCS#1:
Using that key in the
ociprovider does the trick:References
This is a continuation of #512 that was closed with the upstream SDK support to PKCS#8, but somehow the provider is still not accepting it.