A Terraform configuration for creating an IBM Cloud SSH Key (ibmcloud_infra_ssh_key). This will create a SSH key in the specified IBM cloud account.
This is not a module, it is a terraform configuration that can be cloned or forked to be used and/or modified with the IBM Cloud terraform binary locally, or it can be used with the IBM Cloud Schematics service.
You will need to Setup up IBM Cloud provider credentials, please see the section titled "Setting up Provider Credentials" for help.
Additionally you will need the IBM Terraform binary. You can obtain this binary by visiting github.com/IBM-Bluemix/schematics-onboarding.
To run this project execute the following steps:
- Supply
datacenter,public_key,key_label, andkey_notevariable values interraform.tfvars, see https://www.terraform.io/intro/getting-started/variables.html#from-a-file for instructions.- Alternatively these values can be supplied via the command line or environment variables, see https://www.terraform.io/intro/getting-started/variables.html.
- Specifically for
public_keymaterial see "Generating a new SSH key and adding it to the ssh-agent") so that your workstation will use the key. terraform plan: this will perform a dry run to show what infrastructure terraform intends to createterraform apply: this will create actual infrastructure- Infrastructure can be seen in IBM Bluemix under the following URLs:
terraform destroy: this will destroy all infrastructure which has been created
Any of these values is valid for use with the datacenter variable:
ams01: Amsterdam 1ams03: Amsterdam 3che01: Chennai 1dal01: Dallas 1dal10: Dallas 10dal12: Dallas 12dal02: Dallas 2dal05: Dallas 5dal06: Dallas 6dal07: Dallas 7dal09: Dallas 9fra02: Frankfurt 2hkg02: Hong Kong 2hou02: Houston 2lon02: London 2mel01: Melbourne 1mex01: Mexico 1mil01: Milan 1mon01: Montreal 1osl01: Oslo 1par01: Paris 1sjc01: San Jose 1sjc03: San Jose 3sao01: Sao Paulo 1sea01: Seattle 1seo01: Seoul 1sng01: Singapore 1syd01: Sydney 1syd04: Sydney 4tok02: Tokyo 2tor01: Toronto 1wdc01: Washington 1wdc04: Washington 4
Simply run terraform plan -var 'datacenter=lon02' -state=lon02.tfstate or whatever your preferred datacenter is (replace lon02 for both arguments), and repeat for terraform apply with the same arguments.
To setup the IBM Cloud provider to work with this example there are a few options for managing credentials safely; here we'll cover the preferred method using environment variables. Other methods can be used, please see the Terraform Getting Started Variable documentation for further details.
You'll need to export the following environment variables:
TF_VAR_ibmid- your IBMid loginTF_VAR_ibmidpw- your IBMid passwordTF_VAR_slaccountnum- the target softlayer account number (while optional, it is REQUIRED if you have multiple accounts associated with your ID; otherwise you will recieve an error similar to* ibmcloud_infra_virtual_guest.debian_small_virtual_guest: Error ordering virtual guest: SoftLayer_Exception_Public: You do not have permission to verify server orders. (HTTP 500))
On OS X this is achieved by entering the following into your terminal, replacing the <value> characters with the actual values (remove the <>:
export TF_VAR_ibmid=<value>export TF_VAR_ibmidpw=<value>export TF_VAR_slaccountnum=<value>
However this is only temporary to your current terminal session, to make this permanent add these export statements to your ~/.profile, ~/.bashrc, ~/.bash_profile or preferred terminal configuration file. If you go this route without running export ... in your command prompt, you'll need to source your terminal configuration file from the command prompt like so: source ~/.bashrc (or your preferred config file).
If you happen to get the error provider.ibmcloud: Client request to fetch IMS token failed with response code 401 you are likely passing the wrong credentials for IBMid (this is different than IBM w3id).
One way to be certain if your credentials are good or not is to test them with the test-credentials.sh script in this repo. Simply execute the following:
bash test-credentials.sh <ibmid> <password> <account-number>
Replacing <ibmid>, <password>, and <account-number> for real values. Where <account-number> is your Softlayer account number, which can found at https://control.bluemix.net/account/user/profile under the "API Access Information" section prepended to your "API Username" (or in the upper right it is displayed as part of your account information in parenthesis).
Alternatively you can run the following command:
curl -s -u 'bx:bx' -k -X POST --header \
'Content-Type: application/x-www-form-urlencoded' \
--header 'Accept: application/json' -d \ "grant_type=password&response_type=cloud_iam,ims_portal \
&username=${1}&password=${2}&ims_account=${3}" https://iam.ng.bluemix.net/oidc/tokenReplacing ${1} with your IBMid, ${2} with your IBMid password, and ${3} with you Softlayer account number.
When you run either of the above methods, a successful response (meaning the credentials are good) looks like (trimmed for brevity):
{
"access_token":"eyJraWQiOiIyMDE…a72w",
"refresh_token":"BTJ8…KLaBJ",
"ims_token":"e56350224c...1d3d3",
"ims_user_id":6525897,
"token_type":"Bearer",
"expires_in":3600,
"expiration":1489623909
}And if your credentials are wrong, you will get a different response:
{
"errorCode":"BXNIM0602E",
"errorMessage":"The credentials you provided are incorrect",
"errorDetails":"The credentials you entered for the user '[email protected]' are incorrect",
"context":{
"requestId":"2512082279",
"requestType":"incoming.OIDC_Token",
"startTime":"15.03.2017 22:50:39:925 UTC",
"endTime":"15.03.2017 22:50:40:224 UTC",
"elapsedTime":"299",
"instanceId":"tokenservice/1",
"host":"localhost",
"threadId":"8791",
"clientIp":"73.82.211.28",
"userAgent":"curl/7.43.0",
"locale":"en_US"
}
}If you run into this error, you should reset your IBMid password by navigating to https://www.ibm.com/account/profile/us and clicking on "Reset password"
MIT; see LICENSE for details.