can not get oke workload indentity based auth config provide

Error message

can not get oke workload indentity based auth config provider %v

What it means

Returned when auth.OkeWorkloadIdentityConfigurationProvider() fails to create a config provider for OKE (Oracle Kubernetes Engine) workload identity. This auth mode runs inside an OCI OKE pod and uses the Kubernetes service account token exchange to get OCI credentials. The wrapped error (note: 'indentity' is a typo in the source) provides the underlying cause.

Source

Thrown at internal/backend/remote-state/oci/auth.go:277

		logger.Info("Attempting to authenticate using resource principal credentials")
		var err error
		var resourcePrincipalAuthConfigProvider auth.ConfigurationProviderWithClaimAccess

		if p.region == "" {
			logger.Debug("did not get %s from Terraform configuration (ResourcePrincipal), falling back to environment variable", RegionAttrName)
			resourcePrincipalAuthConfigProvider, err = auth.ResourcePrincipalConfigurationProvider()
		} else {
			resourcePrincipalAuthConfigProvider, err = auth.ResourcePrincipalConfigurationProviderForRegion(common.StringToRegion(p.region))
		}
		if err != nil {
			return nil, err
		}
		configProviders = append(configProviders, resourcePrincipalAuthConfigProvider)
	case strings.ToLower(AuthOKEWorkloadIdentity):
		logger.Info("Attempting to authenticate using OKE workload identity")
		okeWorkloadIdentityConfigProvider, err := auth.OkeWorkloadIdentityConfigurationProvider()
		if err != nil {
			return nil, fmt.Errorf("can not get oke workload indentity based auth config provider %v", err)
		}
		configProviders = append(configProviders, okeWorkloadIdentityConfigProvider)
	default:
		return nil, fmt.Errorf("auth must be one of '%s' or '%s' or '%s' or '%s' or '%s' or '%s'", AuthAPIKeySetting, AuthInstancePrincipalSetting, AuthInstancePrincipalWithCertsSetting, AuthSecurityToken, ResourcePrincipal, AuthOKEWorkloadIdentity)
	}

	return configProviders, nil
}
func (p ociAuthConfigProvider) getSdkConfigProvider() (common.ConfigurationProvider, error) {

	configProviders, err := p.getConfigProviders()
	if err != nil {
		return nil, err
	}

	configProviders = append(configProviders, p)
	//In GoSDK, the first step is to check if AuthType exists,
	//for composite provider, we only check the first provider in the list for the AuthType.

View on GitHub (pinned to d32a084675)

Solutions

Verify terraform is actually running inside an OKE pod that has workload identity enabled on the cluster.
Check that the Kubernetes service account has the correct OCI workload identity annotation (e.g., oci.oracle.com/... ).
Ensure the required environment variables (OCI_RESOURCE_PRINCIPAL_*) are set by the OKE workload identity webhook.
Read the wrapped %v error to identify the specific missing prerequisite.
If not running in OKE, change auth to the appropriate method (InstancePrincipal, API key, etc.).

Example fix

// before
backend "oci" {
  auth = "OKEWorkloadIdentity"
}
// running outside OKE, or OKE workload identity not configured

// after (if running in OKE with workload identity):
backend "oci" {
  auth   = "OKEWorkloadIdentity"
  region = "us-phoenix-1"
}
// ensure service account has workload identity annotation and cluster supports it

Defensive patterns

Strategy: try-catch

Validate before calling

func validateOKEWorkloadIdentity() error {
    // Check if running inside OKE with workload identity
    // OKE sets specific env vars and mounts service account tokens
    if os.Getenv("OCI_RESOURCE_PRINCIPAL_VERSION") == "" && os.Getenv("OCI_RESOURCE_PRINCIPAL_RPST") == "" {
        // Check for OKE workload identity specific indicators
        tokenPath := "/var/run/secrets/openshift/serviceaccount/token"
        if _, err := os.Stat(tokenPath); err != nil {
            return fmt.Errorf("OKE workload identity environment not detected — ensure you are running inside an OKE pod with workload identity enabled")
        }
    }
    return nil
}

Try / catch

// Validate environment before init:
if strings.EqualFold(cfg.Auth, "OKEWorkloadIdentity") {
    if err := validateOKEWorkloadIdentity(); err != nil {
        log.Fatal(err)
    }
}

Prevention

Only use OKEWorkloadIdentity auth inside OKE pods configured for workload identity.
Verify the Kubernetes service account has OCI workload identity annotations.
Confirm the OKE cluster has workload identity enabled at the cluster level.

When it happens

Trigger: Backend block sets auth="OKEWorkloadIdentity" (case-insensitive) inside an OKE pod, but the workload identity configuration fails — typically because the necessary environment variables, volume-mounted service account token, or resource principal configuration is not available.

Common situations: Running terraform outside an OKE pod but auth is set to OKEWorkloadIdentity; the OKE pod lacks the workload identity configuration (cluster not configured for workload identity); service account annotations missing; the OCI CLI / SDK version doesn't support workload identity; running in a namespace without the workload identity binding.

Related errors

AI-assisted analysis of hashicorp/terraform@d32a084675 (2026-08-11). Data as JSON: /api/errors/55ef1354704b573e. Report an issue: GitHub.