{"record":{"id":"55ef1354704b573e","repo":"hashicorp/terraform","slug":"can-not-get-oke-workload-indentity-based-auth-conf","errorCode":null,"errorMessage":"can not get oke workload indentity based auth config provider %v","messagePattern":"can not get oke workload indentity based auth config provider (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/oci/auth.go","lineNumber":277,"sourceCode":"\t\tlogger.Info(\"Attempting to authenticate using resource principal credentials\")\n\t\tvar err error\n\t\tvar resourcePrincipalAuthConfigProvider auth.ConfigurationProviderWithClaimAccess\n\n\t\tif p.region == \"\" {\n\t\t\tlogger.Debug(\"did not get %s from Terraform configuration (ResourcePrincipal), falling back to environment variable\", RegionAttrName)\n\t\t\tresourcePrincipalAuthConfigProvider, err = auth.ResourcePrincipalConfigurationProvider()\n\t\t} else {\n\t\t\tresourcePrincipalAuthConfigProvider, err = auth.ResourcePrincipalConfigurationProviderForRegion(common.StringToRegion(p.region))\n\t\t}\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tconfigProviders = append(configProviders, resourcePrincipalAuthConfigProvider)\n\tcase strings.ToLower(AuthOKEWorkloadIdentity):\n\t\tlogger.Info(\"Attempting to authenticate using OKE workload identity\")\n\t\tokeWorkloadIdentityConfigProvider, err := auth.OkeWorkloadIdentityConfigurationProvider()\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"can not get oke workload indentity based auth config provider %v\", err)\n\t\t}\n\t\tconfigProviders = append(configProviders, okeWorkloadIdentityConfigProvider)\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"auth must be one of '%s' or '%s' or '%s' or '%s' or '%s' or '%s'\", AuthAPIKeySetting, AuthInstancePrincipalSetting, AuthInstancePrincipalWithCertsSetting, AuthSecurityToken, ResourcePrincipal, AuthOKEWorkloadIdentity)\n\t}\n\n\treturn configProviders, nil\n}\nfunc (p ociAuthConfigProvider) getSdkConfigProvider() (common.ConfigurationProvider, error) {\n\n\tconfigProviders, err := p.getConfigProviders()\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tconfigProviders = append(configProviders, p)\n\t//In GoSDK, the first step is to check if AuthType exists,\n\t//for composite provider, we only check the first provider in the list for the AuthType.","sourceCodeStart":259,"sourceCodeEnd":295,"githubUrl":"https://github.com/hashicorp/terraform/blob/d32a084675427f5ac3f7d2868578ef8b2c1dc525/internal/backend/remote-state/oci/auth.go#L259-L295","documentation":"Returned when auth.OkeWorkloadIdentityConfigurationProvider() fails to create a config provider for OKE (Oracle Kubernetes Engine) workload identity. This auth mode runs inside an OCI OKE pod and uses the Kubernetes service account token exchange to get OCI credentials. The wrapped error (note: 'indentity' is a typo in the source) provides the underlying cause.","triggerScenarios":"Backend block sets auth=\"OKEWorkloadIdentity\" (case-insensitive) inside an OKE pod, but the workload identity configuration fails — typically because the necessary environment variables, volume-mounted service account token, or resource principal configuration is not available.","commonSituations":"Running terraform outside an OKE pod but auth is set to OKEWorkloadIdentity; the OKE pod lacks the workload identity configuration (cluster not configured for workload identity); service account annotations missing; the OCI CLI / SDK version doesn't support workload identity; running in a namespace without the workload identity binding.","solutions":["Verify terraform is actually running inside an OKE pod that has workload identity enabled on the cluster.","Check that the Kubernetes service account has the correct OCI workload identity annotation (e.g., oci.oracle.com/... ).","Ensure the required environment variables (OCI_RESOURCE_PRINCIPAL_*) are set by the OKE workload identity webhook.","Read the wrapped %v error to identify the specific missing prerequisite.","If not running in OKE, change auth to the appropriate method (InstancePrincipal, API key, etc.)."],"exampleFix":"// before\nbackend \"oci\" {\n  auth = \"OKEWorkloadIdentity\"\n}\n// running outside OKE, or OKE workload identity not configured\n\n// after (if running in OKE with workload identity):\nbackend \"oci\" {\n  auth   = \"OKEWorkloadIdentity\"\n  region = \"us-phoenix-1\"\n}\n// ensure service account has workload identity annotation and cluster supports it","handlingStrategy":"try-catch","validationCode":"func validateOKEWorkloadIdentity() error {\n    // Check if running inside OKE with workload identity\n    // OKE sets specific env vars and mounts service account tokens\n    if os.Getenv(\"OCI_RESOURCE_PRINCIPAL_VERSION\") == \"\" && os.Getenv(\"OCI_RESOURCE_PRINCIPAL_RPST\") == \"\" {\n        // Check for OKE workload identity specific indicators\n        tokenPath := \"/var/run/secrets/openshift/serviceaccount/token\"\n        if _, err := os.Stat(tokenPath); err != nil {\n            return fmt.Errorf(\"OKE workload identity environment not detected — ensure you are running inside an OKE pod with workload identity enabled\")\n        }\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"// Validate environment before init:\nif strings.EqualFold(cfg.Auth, \"OKEWorkloadIdentity\") {\n    if err := validateOKEWorkloadIdentity(); err != nil {\n        log.Fatal(err)\n    }\n}","preventionTips":["Only use OKEWorkloadIdentity auth inside OKE pods configured for workload identity.","Verify the Kubernetes service account has OCI workload identity annotations.","Confirm the OKE cluster has workload identity enabled at the cluster level."],"tags":["oci","authentication","oke","kubernetes","workload-identity","terraform-backend"],"backgroundTag":null,"analyzedSha":"d32a084675427f5ac3f7d2868578ef8b2c1dc525","analyzedAt":"2026-08-11T18:43:52.779Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}