Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Unable to create ibm_container_vpc_cluster resources using a non-default Resource Group and Service ID API Key #5614

Closed
lantins opened this issue Sep 4, 2024 · 3 comments
Labels
service/Kubernetes Service Issues related to Kubernetes Service Issues service/Resource Management Issues related to Resource Manager or Resource controller Issues service/VPC Infrastructure Issues related to the VPC Infrastructure

Comments

@lantins
Copy link

lantins commented Sep 4, 2024

Community Note

  • Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
  • Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
  • If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform CLI and Terraform IBM Provider Version

$ terraform -v
Terraform v1.9.5
on darwin_amd64
+ provider registry.terraform.io/ibm-cloud/ibm v1.68.1

Affected Resource(s)

  • ibm_container_vpc_cluster

Terraform Configuration Files

Please include all Terraform configurations required to reproduce the bug. Bug reports without a functional reproduction may be closed without investigation.

# ------------------------------------------------------------------------------

terraform {
  required_version = "~> 1.9"

  required_providers {
    ibm = {
      source  = "IBM-Cloud/ibm"
      version = "1.68.1"
    }
  }
}

provider "ibm" {
  region = "us-east"
  # ibmcloud_api_key - set by environment variable `IBMCLOUD_API_KEY`
}

# --- Resource Group -----------------------------------------------------------

resource "ibm_resource_group" "env" {
  name = "chronicle - stage"
  tags = ["env:stage", "product:chronicle"]
}

# --- VPC & Networking ---------------------------------------------------------

resource "ibm_is_vpc" "env" {
  name           = "chronicle-stage"
  resource_group = ibm_resource_group.env.id
  classic_access = false
}

resource "ibm_is_public_gateway" "gw-1" {
  name           = "public-gateway-1"
  vpc            = ibm_is_vpc.env.id
  zone           = "us-east-1"
  resource_group = ibm_resource_group.env.id
}

resource "ibm_is_subnet" "us-east-1" {
  name                     = "chronicle-stage-us-east-1"
  vpc                      = ibm_is_vpc.env.id
  zone                     = "us-east-1"
  total_ipv4_address_count = 1024
  public_gateway           = ibm_is_public_gateway.gw-1.id
  resource_group           = ibm_resource_group.env.id
}

resource "ibm_is_public_gateway" "gw-2" {
  name           = "public-gateway-2"
  vpc            = ibm_is_vpc.env.id
  zone           = "us-east-2"
  resource_group = ibm_resource_group.env.id
}

resource "ibm_is_subnet" "us-east-2" {
  name                     = "chronicle-stage-us-east-2"
  vpc                      = ibm_is_vpc.env.id
  zone                     = "us-east-2"
  total_ipv4_address_count = 1024
  public_gateway           = ibm_is_public_gateway.gw-2.id
  resource_group           = ibm_resource_group.env.id
}

# --- K8S Cluster --------------------------------------------------------------

resource "ibm_container_vpc_cluster" "chronicle" {
  name              = "chronicle-stage"
  vpc_id            = ibm_is_vpc.env.id
  kube_version      = "1.30.4"
  resource_group_id = ibm_resource_group.env.id

  # default worker pool
  flavor       = "bx2.2x8"
  worker_count = "4"

  disable_public_service_endpoint = true

  zones {
    subnet_id = ibm_is_subnet.us-east-1.id
    name      = "us-east-1"
  }
  zones {
    subnet_id = ibm_is_subnet.us-east-2.id
    name      = "us-east-2"
  }
}

Debug Output

https://gist.github.com/lantins/584b988cf401de3be6ca60e502d648a2

Panic Output

n/a

Expected Behavior

The IKS cluster should be created without error.

Actual Behavior

IKS cluster fails to be created, this seems related to using a non-default Resource Group (i.e. setting resource_group_id). The error received is in relation to it trying to create a containers-kubernetes-key IAM User API Key and fails because I've used a Service ID API Key.

Steps to Reproduce

  1. Create a Service ID and create a API Key associated with it.
  2. Set the environment variable IBMCLOUD_API_KEY to use the Service ID API Key.
  3. terraform apply

Important Factoids

When creating a IKS cluster using the ibmcloud CLI using a Service ID API Key it is able to create the cluster without any issues. It does not result in a containers-kubernetes-key or similar being created/saved anywhere as far as I can tell.

References

  • #0000
@github-actions github-actions bot added service/Kubernetes Service Issues related to Kubernetes Service Issues service/Resource Management Issues related to Resource Manager or Resource controller Issues service/VPC Infrastructure Issues related to the VPC Infrastructure labels Sep 4, 2024
@lantins
Copy link
Author

lantins commented Sep 4, 2024

Some extra context, I've just tried the ibmcloud CLI with a Resource Group and it has the same error/issue.

I figured I could always call ibmcloud using a null_resource as a workaround for a short time, but it seems that isn't the case since I need the cluster to be part of a non-default Resource Group.


FAILS:

$ ibmcloud target -g "chronicle - stage"
$ ibmcloud ks cluster create vpc-gen2 --name created-with-service-id --zone us-east-1 --vpc-id r014-d69c0c97-e542-451b-84db-864d9ae32386 --subnet-id 0757-eddfd4cb-8643-4ffd-87b4-1901f6d6a389 --flavor bx2.2x8
Creating cluster...
FAILED
Failed to create an API key with IAM. Revise your request and try again. (A03e9b)

Incident ID: e8ccc832-bb53-4cc1-8293-0ee1260f20e5

WORKS:

$ ibmcloud target -g ""
$ ibmcloud ks cluster create vpc-gen2 --name created-with-service-id --zone us-east-1 --vpc-id r014-d69c0c97-e542-451b-84db-864d9ae32386 --subnet-id 0757-eddfd4cb-8643-4ffd-87b4-1901f6d6a389 --flavor bx2.2x8
Creating cluster...
OK
Cluster created with ID crcdlr8w0oetmlrvp7j0

@lantins
Copy link
Author

lantins commented Sep 5, 2024

After a bit more digging, I think the only difference in requests to the API is if the X-Auth-Resource-Group header is set.

So to me, this seems like its a IBM Cloud API 'backend' issue? rather than an issue with the Terraform Provider?

@lantins lantins changed the title Unable to create ibm_container_vpc_cluster resources using a Service ID API Key rather then a IAM User API Key Unable to create ibm_container_vpc_cluster resources using a non-default Resource Group Sep 5, 2024
@lantins lantins changed the title Unable to create ibm_container_vpc_cluster resources using a non-default Resource Group Unable to create ibm_container_vpc_cluster resources using a non-default Resource Group and Service ID API Key Sep 5, 2024
@lantins
Copy link
Author

lantins commented Oct 12, 2024

This issue is not related to the IBM Cloud Terraform Provider.

@lantins lantins closed this as completed Oct 12, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
service/Kubernetes Service Issues related to Kubernetes Service Issues service/Resource Management Issues related to Resource Manager or Resource controller Issues service/VPC Infrastructure Issues related to the VPC Infrastructure
Projects
None yet
Development

No branches or pull requests

1 participant