hashicorp / hashicorp/packer-plugin-oracle

limitation when using instance principal with Packer

Open
#127 1 comment 2 reactions 0 assignees View on GitHub
bug
Dominant language
Go
Stars
14
Forks
16
PR merge metrics
No merged PRs in 30d

Description

#### Overview of the Issue

Packer OCI plugin cuurently has a limitation when using instance principal. Specifically, the "region" parameter cannot be used in the source image block if the "use_instance_principals" key is set to true. This results in an error when attempting to bake an image in a region different from the one where the packer node instance is hosted.

e.g. if the packer node is hosted in the us-phoenix-1 (us-west) and the "use_instance_principals" key is set to true, then packer can only create a custom image in the us-phoenix-1 region. Despite the fact that the instance principal (dynamic group for the packer instance) has permissions to manage resources across regions, packer allows only to create the image in the region where instance is hosted. Specifically, the "region" parameter cannot be used in the source image block if the "use_instance_principals" key is set to true.

#### Reproduction Steps

In this case my instance is hosted in the phoenix region and dynamic group has permissions to manage all-resources across tenancy/regions subscribed.

````
source "oracle-oci" "base_image" {
#region = var.oci_region
base_image_ocid = var.base_image_ocid
compartment_ocid = var.compartment_ocid
image_name = "${local.oci_instance_name}"
instance_name = "${var.packer_image_name}-${lookup(local.custom_image_name, var.configured_setup, "")}"
shape = "VM.Standard.E3.Flex"
availability_domain = var.availability_domain
ssh_username = "opc"
subnet_ocid = var.subnet_ocid
shape_config {
ocpus = "1"
}
use_private_ip = true
skip_create_image = false
use_instance_principals = true

}

variable "oci_region" {
type = string
default = "us-ashburn-1"
}
`
```

This will result in an error as API endpoints will be called from phoenix region.

`
```
packer build ash.main.pkr.hcl
oracle-oci.base_image: output will be in this color.

==> oracle-oci.base_image: Creating temporary ssh key for instance...
==> oracle-oci.base_image: Creating instance...
==> oracle-oci.base_image: Problem creating instance: Error returned by Compute Service. Http Status Code: 400. Error Code : CannotParseRequest. Opc request id: 0da085447495601ae5df949de386fc8c/AEA47D44BA4866E99635DF9C61EDB77F/B5176C38E8B0326C20 AF621FD15D9E9B. Message: Incorrectly formatted request. Please refer to our documentation for help.
==> oracle-oci.base_image: Operation Name: LaunchInstance
==> oracle-oci.base_image: Timestamp: 2024-12-05 05:39:42 +0000 GMT
==> oracle-oci.base_image: Client Version: Oracle-GoSDK/65.4.0
==> oracle-oci.base_image: Request Endpoint: POST https://iaas.us-phoenix-1.oraclecloud.com/20160918/instances
==> oracle-oci.base_image: Troubleshooting Tips: See https://docs.oracle.com/iaas/Content/API/References/apierrors.htm#api errors_400__400_cannotparserequest for more information about resolving this error.
==> oracle-oci.base_image: Also see https://docs.oracle.com/iaas/api/#/en/iaas/20160918/Instance/LaunchInstance for detail s on this operation's requirements.
==> oracle-oci.base_image: To get more info on the failing request, you can set OCI_GO_SDK_DEBUG env var to info or higher level to log the request/response details.
==> oracle-oci.base_image: If you are unable to resolve this Compute issue, please contact Oracle support and provide them this full error message.
Build 'oracle-oci.base_image' errored after 224 milliseconds 38 microseconds: Problem creating instance: Error returned by Compute Service. Http Status Code: 400. Error Code: CannotParseRequest. Opc request id: 0da085447495601ae5df949de386fc8c/ AEA47D44BA4866E99635DF9C61EDB77F/B5176C38E8B0326C20AF621FD15D9E9B. Message: Incorrectly formatted request. Please refer to our documentation for help.
Operation Name: LaunchInstance
Timestamp: 2024-12-05 05:39:42 +0000 GMT
Client Version: Oracle-GoSDK/65.4.0
Request Endpoint: **POST https://iaas.us-phoenix-1.oraclecloud.com/20160918/instances**
Troubleshooting Tips: See https://docs.oracle.com/iaas/Content/API/References/apierrors.htm#apierrors_400__400_cannotparse request for more information about resolving this error.
Also see https://docs.oracle.com/iaas/api/#/en/iaas/20160918/Instance/LaunchInstance for details on this operation's requi rements.
To get more info on the failing request, you can set OCI_GO_SDK_DEBUG env var to info or higher level to log the request/r esponse details.
If you are unable to resolve this Compute issue, please contact Oracle support and provide them this full error message.

==> Wait completed after 224 milliseconds 84 microseconds

==> Some builds didn't complete successfully and had errors:
--> oracle-oci.base_image: Problem creating instance: Error returned by Compute Service. Http Status Code: 400. Error Code : CannotParseRequest. Opc request id: 0da085447495601ae5df949de386fc8c/AEA47D44BA4866E99635DF9C61EDB77F/B5176C38E8B0326C20 AF621FD15D9E9B. Message: Incorrectly formatted request. Please refer to our documentation for help.
Operation Name: LaunchInstance
Timestamp: 2024-12-05 05:39:42 +0000 GMT
Client Version: Oracle-GoSDK/65.4.0
Request Endpoint: POST https://iaas.us-phoenix-1.oraclecloud.com/20160918/instances
Troubleshooting Tips: See https://docs.oracle.com/iaas/Content/API/References/apierrors.htm#apierrors_400__400_cannotparse request for more information about resolving this error.
Also see https://docs.oracle.com/iaas/api/#/en/iaas/20160918/Instance/LaunchInstance for details on this operation's requi rements.
To get more info on the failing request, you can set OCI_GO_SDK_DEBUG env var to info or higher level to log the request/r esponse details.
If you are unable to resolve this Compute issue, please contact Oracle support and provide them this full error message.

==> Builds finished but no artifacts were created.
```
`

### Plugin and Packer version

Packer v1.11.2

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the failure with the `oracle-oci` source in `ash.main.pkr.hcl`, using `region` with `use_instance_principals = true`. Trace the Oracle builder's instance-creation path and how the source block region is applied; done means a cross-region build no longer sends the request to the packer node's region and the reported case succeeds.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cloud, devops
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.