Terraform: Chef Bootstrap from Terraform fails (Chef::Exceptions::InvalidPrivateKey)

[vkrishr]

Terrafrom Code Chef bootstrap windows

provisioner "chef" {
environment = "_default"
run_list = ["role[symantec]"]
node_name = "${var.vm_name}"
server_url = "https://9.109.100.60/organizations/cheficp"
recreate_client = true
user_name = "chefadmin"
user_key = "ftp://9.109.122.200/pub/chefadmin.pem"
version = "12.14"
# If you have a self signed cert on your chef server change this to :verify_none
ssl_verify_mode = ":verify_none"
os_type = "windows"
}
connection {
type = "winrm"
user = "Administrator"
password = "Welcome1@@"
insecure = "true"
https = "false"
timeout = "10m"
}

}

While deploying from Terrafrom Error

vsphere_virtual_machine.vm: Still creating... (6m30s elapsed)
vsphere_virtual_machine.vm (chef): Downloading Chef Client...
vsphere_virtual_machine.vm: Still creating... (6m40s elapsed)
vsphere_virtual_machine.vm (chef): Installing Chef Client...
vsphere_virtual_machine.vm: Still creating... (6m50s elapsed)
vsphere_virtual_machine.vm: Still creating... (7m0s elapsed)
vsphere_virtual_machine.vm: Still creating... (7m10s elapsed)
vsphere_virtual_machine.vm: Still creating... (7m20s elapsed)
vsphere_virtual_machine.vm: Still creating... (7m30s elapsed)
vsphere_virtual_machine.vm (chef): Creating configuration files...
vsphere_virtual_machine.vm: Still creating... (7m40s elapsed)
vsphere_virtual_machine.vm (chef): Generate the private key...
vsphere_virtual_machine.vm: Still creating... (7m50s elapsed)
vsphere_virtual_machine.vm: Still creating... (8m0s elapsed)
vsphere_virtual_machine.vm (chef): ERROR: Chef::Exceptions::InvalidPrivateKey: The file C:/chef/chefadmin.pem or :raw_key option does not contain a correctly formatted private key.
vsphere_virtual_machine.vm (chef): The key file should begin with '-----BEGIN RSA PRIVATE KEY-----' and end with '-----END RSA PRIVATE KEY-----'
vsphere_virtual_machine.vm (chef): Cleanup user key...

Error: Error applying plan:
1 error(s) occurred:

• vsphere_virtual_machine.vm: "cmd /c knife client create inmbz6212 -d -f C:/chef/client.pem -c C:/chef/client.rb -u chefadmin --key C:/chef/chefadmin.pem" exit status: 100
  Terraform does not automatically rollback in the face of errors.
  Instead, your Terraform state file has been partially updated with
  any resources that successfully completed. Please address the error

above and apply again to incrementally change your infrastructure.

My private key copied in FTP
Please advice

[stuartpreston]

The docs for the user_key property state that it's a string, the error message tells you clearly what the expected format is. However your string of "ftp://9.109.122.200/pub/chefadmin.pem" is being treated literally.

From the chef provider docs:
user_key (string) - (Required) The _contents_ of the user key that will be used to authenticate with the Chef Server. This can also be loaded from a file on disk using the file() interpolation function.

Also see the interpolation docs

[vkrishr]

Thanks,
Can we call (user_key = "${file("ftp://9.109.122.210/pub/chefadmin.pem")}" )

instead of $file do we have any provider on terraform because we have only FTP

Thanks

[stuartpreston]

If FTP is your only option then you should look at a module to retrieve the key first, then use the file() function to load the content into the property. One such module from a quick search would be https://registry.terraform.io/modules/plus3it/file-cache/external/1.2.0

[vkrishr]

Thanks, Have found where the Terraform running its on cloud container hence I copied my .pem file in container pv.

Is it mandatory to have runlist
can we empty the runlist on bootstrap code (run_list = ["role[symantec]"]) because chef client installation is enough

[FilBot3]

@stuartpreston to retrieve the key, does it need to be on the local node, or the remote-exec target? That's where I get a little confused.

[FilBot3]

It seems that the key needs to live on the local machine executing the terraform plan, and then point the file() resource to that local file. That got me past this issue.

[stuartpreston]

@radeksimko Please can you adjust the labels here, no bug has been reported.

[svanharmelen]

@vkrishr it's a bit unclear to me if you still have issues/question? So could you maybe repeat any questions you still have at this point?

As for the question about the run_list, please see the documentation for all the options and how they can be used: https://www.terraform.io/docs/provisioners/chef.html

You can see in the docs that setting a run_list is optional, so an empty list is valid to use. Yet even if the run_list is empty, it will still do a chef run and will need the user_key to be present. So not sure if that helps for your use case?

Maybe, if you only want to install the Chef client and not actually run or configure it, you can better use the remote-exec provisioner to install the client using a command like this: curl -L https://omnitruck.chef.io/install.sh | sudo bash (copied from the chef docs)?

[hashibot]

Hello! :robot:

We use GitHub issues for tracking bugs and enhancements rather than for questions. While we can sometimes help with certain simple problems here, it's better to use the community forum where there are more people ready to help. The GitHub issues here are monitored only by our few core maintainers.

Since this issue doesn't represent a specific bug or feature request, I'm going to close it. Please do feel free to ask your question in the community forum. Thanks!

[hashibot[bot]]

I'm going to lock this issue because it has been closed for _30 days_ ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.