Open blacksd opened 2 years ago
The fingerprint should match the API signing key. https://docs.us-phoenix-1.oraclecloud.com/Content/API/Concepts/apisigningkey.htm#How3 describes how to generate the API signing keys in the PEM format, and thereafter get the corresponding fingerprint.
The fingerprint should match the API signing key. https://docs.us-phoenix-1.oraclecloud.com/Content/API/Concepts/apisigningkey.htm#How3 describes how to generate the API signing keys in the PEM format, and thereafter get the corresponding fingerprint.
I'm not sure about the point of your comment: the fingerprint does still match the key, I'm just changing its format - the key itself is the same. As a confirmation, I can just change the key path in the ~/.oci/config
file to the PKCS#1 format and nothing else, and oci
commands will still work + also the provider.
To the core matter - are you saying that the oci setup bootstrap
generates an incompatible private key format (PKCS#8) by design? Forcing the user to create the key manually (when the oci
client is supposed to ease the process) is unnecessary friction. Updating the provider to support both is the best way to provide a seamless experience.
Hi @blacksd ,
Can you please pass private key path into provider block .
provider "oci" { private_key_path = "key_file=/Users/marco/.oci/sessions/DEFAULT/oci_api_key.pem", pass_phrase = "<your_pass>" }
And let us know If issue still persist .
@ravinitp I changed my provider config with:
provider "oci" {
private_key_path = "key_file=/Users/marco/.oci/sessions/DEFAULT/oci_api_key.pem"
private_key_password = "myencpass"
}
but it's still failing with
β·
β Error: can not create client, bad configuration: did not find a proper configuration for private key
β
β with provider["registry.terraform.io/oracle/oci"],
β on providers.tf line 11, in provider "oci":
β 11: provider "oci" {
β
β΅
+1
The issue is still there and the only way currently to make it running is by using "private_key" with the key value as string to it and run the terraform commands
I also encountered the same problem, this fix worked
+1
The issue is still there and the only way currently to make it running is by using "private_key" with the key value as string to it and run the terraform commands
@ravinitp by the feedback here and in #512 it's pretty clear that there's something wrong with the provider. Are you going to schedule a fix for that? It's been broken for months, and this is not trivial - it's directly impacting users from day 1, a terrible user experience.
Echoing this, I've been using Terraform for many years and this provider authentication makes it unusable. I've spent countless hours trying to get this to run in terraform cloud with no success.
This seems to be related to https://github.com/oracle/terraform-provider-oci/issues/1584
Thank you for reporting the issue. We observed the affected resources are not provided in the description or it's incorrect. We request you to add it in issue description as mentioned in below format. Example: affected_resources = oci_core_instance , oci_core_instances
If it's not related to any particular resource then mention affected resource as terraform. Example: affected_resources = terraform
As this works through automation, request you to follow exact syntax.
we faced similar issue, and we resolved it by regenerating keys with -aes256 --traditional 4096
type.
see snippet on how to generate those keys for use in OCI
mkdir -p ~/.oci
openssl genrsa -out ~/.oci/oci_api_key.pem -aes256 --traditional 4096
chmod go-rwx ~/.oci/oci_api_key.pem
openssl rsa -pubout -in ~/.oci/oci_api_key.pem -out ~/.oci/oci_api_key_public.pem
@ravinitp I added the missing description. Can you please fix the labels? This is not answered
. Thank you!
+1 encountered same issue today. I have MacOS with Openssl 3.2.0 and spent few hours to discover this issue. Is not documented anywhere but here. OCI documentation https://docs.oracle.com/en-us/iaas/Content/API/Concepts/apisigningkey.htm#two is not mentioning anything about PKCS#1 mandatory key and by default Openssl 3.x.x will create PKCS#8. key see https://www.openssl.org/docs/man3.0/man7/migration_guide.html
It would be nice for customers not to have to troubleshoot this and just fix the compatibility issue.
Community Note
Terraform Version and Provider Version
Affected Resource(s)
affected_resources = terraform
Terraform Configuration Files
The content of the default
~/.oci/config
after theoci setup bootstrap
isThe bootstrap phase creates a PKCS#8 key:
Expected Behavior
Actual Behavior
The provider isn't able to perform access with the default key.
Full
```sh β― TF_LOG=TRACE OCI_GO_SDK_DEBUG=1 terraform plan 2022-08-08T08:34:34.944+0200 [INFO] Terraform version: 1.1.1 2022-08-08T08:34:34.945+0200 [INFO] Go runtime version: go1.17.2 2022-08-08T08:34:34.945+0200 [INFO] CLI args: []string{"terraform", "plan"} 2022-08-08T08:34:34.945+0200 [TRACE] Stdout is a terminal of width 292 2022-08-08T08:34:34.945+0200 [TRACE] Stderr is a terminal of width 292 2022-08-08T08:34:34.945+0200 [TRACE] Stdin is a terminal 2022-08-08T08:34:34.945+0200 [DEBUG] Attempting to open CLI config file: /Users/marco/.terraformrc 2022-08-08T08:34:34.945+0200 [DEBUG] File doesn't exist, but doesn't need to. Ignoring. 2022-08-08T08:34:34.945+0200 [DEBUG] ignoring non-existing provider search directory terraform.d/plugins 2022-08-08T08:34:34.945+0200 [DEBUG] ignoring non-existing provider search directory /Users/marco/.terraform.d/plugins 2022-08-08T08:34:34.945+0200 [DEBUG] ignoring non-existing provider search directory /Users/marco/Library/Application Support/io.terraform/plugins 2022-08-08T08:34:34.945+0200 [DEBUG] ignoring non-existing provider search directory /Library/Application Support/io.terraform/plugins 2022-08-08T08:34:34.945+0200 [INFO] CLI command args: []string{"plan"} 2022-08-08T08:34:34.947+0200 [TRACE] Meta.Backend: no config given or present on disk, so returning nil config 2022-08-08T08:34:34.947+0200 [TRACE] Meta.Backend: backend has not previously been initialized in this working directory 2022-08-08T08:34:34.947+0200 [DEBUG] New state was assigned lineage "222769df-75a4-dcd4-d5bb-bd8aac1daafe" 2022-08-08T08:34:34.947+0200 [TRACE] Meta.Backend: using default local state only (no backend configuration, and no existing initialized backend) 2022-08-08T08:34:34.947+0200 [TRACE] Meta.Backend: instantiated backend of typeTRACE
log:Steps to Reproduce
oci setup bootstrap
terraform init
terraform plan -var "compartment_id=ocid1.tenancy.oc1..<REDACTED>"
Important Factoids
The issue goes away if you rewrite your RSA key to use PKCS#1:
Using that key in the
oci
provider does the trick:References
This is a continuation of #512 that was closed with the upstream SDK support to PKCS#8, but somehow the provider is still not accepting it.