data_source_ibm_is_instance.go

package ibm

import (
	"bytes"
	"crypto/rand"
	"crypto/rsa"
	"crypto/sha256"
	"crypto/x509"
	"encoding/base64"
	"encoding/pem"
	"errors"
	"fmt"
	"log"
	"strings"

	"github.com/IBM/vpc-go-sdk/vpcclassicv1"
	"github.com/IBM/vpc-go-sdk/vpcv1"
	"github.com/ScaleFT/sshkeys"
	"github.com/hashicorp/terraform-plugin-sdk/helper/schema"
	"golang.org/x/crypto/ssh"
)

const (
	isInstancePEM          = "private_key"
	isInstancePassphrase   = "passphrase"
	isInstanceInitPassword = "password"
	isInstanceInitKeys     = "keys"
)

func dataSourceIBMISInstance() *schema.Resource {
	return &schema.Resource{
		Read: dataSourceIBMISInstanceRead,

		Schema: map[string]*schema.Schema{

			isInstanceName: {
				Type:        schema.TypeString,
				Required:    true,
				Description: "Instance name",
			},

			isInstancePEM: {
				Type:        schema.TypeString,
				Optional:    true,
				Description: "Instance Private Key file",
			},

			isInstancePassphrase: {
				Type:        schema.TypeString,
				Optional:    true,
				Description: "Passphrase for Instance Private Key file",
			},

			isInstanceInitPassword: {
				Type:        schema.TypeString,
				Sensitive:   true,
				Computed:    true,
				Description: "password for Windows Instance",
			},

			isInstanceInitKeys: {
				Type:        schema.TypeList,
				Computed:    true,
				Description: "Instance keys",
				Elem: &schema.Resource{
					Schema: map[string]*schema.Schema{
						"id": {
							Type:        schema.TypeString,
							Computed:    true,
							Description: "Instance key id",
						},
						"name": {
							Type:        schema.TypeString,
							Computed:    true,
							Description: "Instance key name",
						},
					},
				},
			},

			isInstanceVPC: {
				Type:        schema.TypeString,
				Computed:    true,
				Description: "VPC id",
			},

			isInstanceZone: {
				Type:        schema.TypeString,
				Computed:    true,
				Description: "Zone name",
			},

			isInstanceProfile: {
				Type:        schema.TypeString,
				Computed:    true,
				Description: "Profile info",
			},

			isInstanceTags: {
				Type:        schema.TypeSet,
				Computed:    true,
				Elem:        &schema.Schema{Type: schema.TypeString},
				Set:         resourceIBMVPCHash,
				Description: "list of tags for the instance",
			},
			isInstanceBootVolume: {
				Type:        schema.TypeList,
				Computed:    true,
				Description: "Instance Boot Volume",
				Elem: &schema.Resource{
					Schema: map[string]*schema.Schema{
						"id": {
							Type:        schema.TypeString,
							Computed:    true,
							Description: "Instance Boot Volume id",
						},
						"name": {
							Type:        schema.TypeString,
							Computed:    true,
							Description: "Instance Boot Volume name",
						},
						"device": {
							Type:        schema.TypeString,
							Computed:    true,
							Description: "Instance Boot Volume device",
						},
						"volume_id": {
							Type:        schema.TypeString,
							Computed:    true,
							Description: "Instance Boot Volume's volume id",
						},
						"volume_name": {
							Type:        schema.TypeString,
							Computed:    true,
							Description: "Instance Boot Volume's volume name",
						},
						"volume_crn": {
							Type:        schema.TypeString,
							Computed:    true,
							Description: "Instance Boot Volume's volume CRN",
						},
					},
				},
			},

			isInstanceVolumeAttachments: {
				Type:        schema.TypeList,
				Computed:    true,
				Description: "Instance Volume Attachments",
				Elem: &schema.Resource{
					Schema: map[string]*schema.Schema{
						"id": {
							Type:        schema.TypeString,
							Computed:    true,
							Description: "Instance Volume Attachment id",
						},
						"name": {
							Type:        schema.TypeString,
							Computed:    true,
							Description: "Instance Volume Attachment name",
						},
						"volume_id": {
							Type:        schema.TypeString,
							Computed:    true,
							Description: "Instance Boot Volume's volume id",
						},
						"volume_name": {
							Type:        schema.TypeString,
							Computed:    true,
							Description: "Instance Boot Volume's volume name",
						},
						"volume_crn": {
							Type:        schema.TypeString,
							Computed:    true,
							Description: "Instance Boot Volume's volume CRN",
						},
					},
				},
			},

			isInstancePrimaryNetworkInterface: {
				Type:        schema.TypeList,
				Computed:    true,
				Description: "Primary Network interface info",
				Elem: &schema.Resource{
					Schema: map[string]*schema.Schema{
						"id": {
							Type:        schema.TypeString,
							Computed:    true,
							Description: "Instance Primary Network Interface id",
						},
						isInstanceNicName: {
							Type:        schema.TypeString,
							Computed:    true,
							Description: "Instance Primary Network Interface name",
						},
						isInstanceNicPortSpeed: {
							Type:        schema.TypeInt,
							Computed:    true,
							Description: "Instance Primary Network Interface port speed",
						},
						isInstanceNicPrimaryIpv4Address: {
							Type:        schema.TypeString,
							Computed:    true,
							Description: "Instance Primary Network Interface IPV4 Address",
						},
						isInstanceNicSecurityGroups: {
							Type:        schema.TypeSet,
							Computed:    true,
							Elem:        &schema.Schema{Type: schema.TypeString},
							Set:         schema.HashString,
							Description: "Instance Primary Network Interface Security groups",
						},
						isInstanceNicSubnet: {
							Type:        schema.TypeString,
							Computed:    true,
							Description: "Instance Primary Network Interface subnet",
						},
					},
				},
			},

			isInstanceNetworkInterfaces: {
				Type:        schema.TypeList,
				Computed:    true,
				Description: "Instance Network interface info",
				Elem: &schema.Resource{
					Schema: map[string]*schema.Schema{
						"id": {
							Type:        schema.TypeString,
							Computed:    true,
							Description: "Instance Network Interface id",
						},
						isInstanceNicName: {
							Type:        schema.TypeString,
							Computed:    true,
							Description: "Instance Network Interface name",
						},
						isInstanceNicPrimaryIpv4Address: {
							Type:        schema.TypeString,
							Computed:    true,
							Description: "Instance Network Interface IPV4 Address",
						},
						isInstanceNicSecurityGroups: {
							Type:        schema.TypeSet,
							Computed:    true,
							Elem:        &schema.Schema{Type: schema.TypeString},
							Set:         schema.HashString,
							Description: "Instance Network Interface Security Groups",
						},
						isInstanceNicSubnet: {
							Type:        schema.TypeString,
							Computed:    true,
							Description: "Instance Network Interface subnet",
						},
					},
				},
			},

			isInstanceImage: {
				Type:        schema.TypeString,
				Computed:    true,
				Description: "Instance Image",
			},

			isInstanceVolumes: {
				Type:        schema.TypeSet,
				Computed:    true,
				Elem:        &schema.Schema{Type: schema.TypeString},
				Set:         schema.HashString,
				Description: "List of volumes",
			},

			isInstanceResourceGroup: {
				Type:        schema.TypeString,
				Computed:    true,
				Description: "Instance resource group",
			},

			isInstanceCPU: {
				Type:        schema.TypeList,
				Computed:    true,
				Description: "Instance vCPU",
				Elem: &schema.Resource{
					Schema: map[string]*schema.Schema{
						isInstanceCPUArch: {
							Type:        schema.TypeString,
							Computed:    true,
							Description: "Instance vCPU Architecture",
						},
						isInstanceCPUCount: {
							Type:        schema.TypeInt,
							Computed:    true,
							Description: "Instance vCPU count",
						},
					},
				},
			},

			isInstanceGpu: {
				Type:        schema.TypeList,
				Computed:    true,
				Deprecated:  "This field is deprecated",
				Description: "Instance GPU",
				Elem: &schema.Resource{
					Schema: map[string]*schema.Schema{
						isInstanceGpuCores: {
							Type:        schema.TypeInt,
							Computed:    true,
							Description: "Instance GPU Cores",
						},
						isInstanceGpuCount: {
							Type:        schema.TypeInt,
							Computed:    true,
							Description: "Instance GPU Count",
						},
						isInstanceGpuMemory: {
							Type:        schema.TypeInt,
							Computed:    true,
							Description: "Instance GPU Memory",
						},
						isInstanceGpuManufacturer: {
							Type:        schema.TypeString,
							Computed:    true,
							Description: "Instance GPU Manufacturer",
						},
						isInstanceGpuModel: {
							Type:        schema.TypeString,
							Computed:    true,
							Description: "Instance GPU Model",
						},
					},
				},
			},

			isInstanceMemory: {
				Type:        schema.TypeInt,
				Computed:    true,
				Description: "Instance memory",
			},

			isInstanceStatus: {
				Type:        schema.TypeString,
				Computed:    true,
				Description: "instance status",
			},

			ResourceControllerURL: {
				Type:        schema.TypeString,
				Computed:    true,
				Description: "The URL of the IBM Cloud dashboard that can be used to explore and view details about this instance",
			},

			ResourceName: {
				Type:        schema.TypeString,
				Computed:    true,
				Description: "The name of the resource",
			},

			ResourceCRN: {
				Type:        schema.TypeString,
				Computed:    true,
				Description: "The crn of the resource",
			},

			ResourceStatus: {
				Type:        schema.TypeString,
				Computed:    true,
				Description: "The status of the resource",
			},

			ResourceGroupName: {
				Type:        schema.TypeString,
				Computed:    true,
				Description: "The resource group name in which resource is provisioned",
			},
		},
	}
}

func dataSourceIBMISInstanceRead(d *schema.ResourceData, meta interface{}) error {
	userDetails, err := meta.(ClientSession).BluemixUserDetails()
	if err != nil {
		return err
	}
	name := d.Get(isInstanceName).(string)
	if userDetails.generation == 1 {
		err := classicInstanceGetByName(d, meta, name)
		if err != nil {
			return err
		}
	} else {
		err := instanceGetByName(d, meta, name)
		if err != nil {
			return err
		}
	}
	return nil
}

func classicInstanceGetByName(d *schema.ResourceData, meta interface{}, name string) error {
	sess, err := classicVpcClient(meta)
	if err != nil {
		return err
	}
	start := ""
	allrecs := []vpcclassicv1.Instance{}
	for {
		listInstancesOptions := &vpcclassicv1.ListInstancesOptions{}
		if start != "" {
			listInstancesOptions.Start = &start
		}
		instances, response, err := sess.ListInstances(listInstancesOptions)
		if err != nil {
			return fmt.Errorf("Error Fetching Instances %s\n%s", err, response)
		}
		start = GetNext(instances.Next)
		allrecs = append(allrecs, instances.Instances...)
		if start == "" {
			break
		}
	}
	for _, instance := range allrecs {
		if *instance.Name == name {
			d.SetId(*instance.ID)
			id := *instance.ID
			d.Set("id", *instance.ID)
			d.Set(isInstanceName, *instance.Name)
			if instance.Profile != nil {
				d.Set(isInstanceProfile, *instance.Profile.Name)
			}
			cpuList := make([]map[string]interface{}, 0)
			if instance.Vcpu != nil {
				currentCPU := map[string]interface{}{}
				currentCPU[isInstanceCPUArch] = *instance.Vcpu.Architecture
				currentCPU[isInstanceCPUCount] = *instance.Vcpu.Count
				cpuList = append(cpuList, currentCPU)
			}
			d.Set(isInstanceCPU, cpuList)

			d.Set(isInstanceMemory, *instance.Memory)
			gpuList := make([]map[string]interface{}, 0)
			d.Set(isInstanceGpu, gpuList)

			if instance.PrimaryNetworkInterface != nil {
				primaryNicList := make([]map[string]interface{}, 0)
				currentPrimNic := map[string]interface{}{}
				currentPrimNic["id"] = *instance.PrimaryNetworkInterface.ID
				currentPrimNic[isInstanceNicName] = *instance.PrimaryNetworkInterface.Name
				currentPrimNic[isInstanceNicPrimaryIpv4Address] = *instance.PrimaryNetworkInterface.PrimaryIpv4Address
				getnicoptions := &vpcclassicv1.GetInstanceNetworkInterfaceOptions{
					InstanceID: &id,
					ID:         instance.PrimaryNetworkInterface.ID,
				}
				insnic, response, err := sess.GetInstanceNetworkInterface(getnicoptions)
				if err != nil {
					return fmt.Errorf("Error getting network interfaces attached to the instance %s\n%s", err, response)
				}
				currentPrimNic[isInstanceNicSubnet] = *insnic.Subnet.ID
				if len(insnic.SecurityGroups) != 0 {
					secgrpList := []string{}
					for i := 0; i < len(insnic.SecurityGroups); i++ {
						secgrpList = append(secgrpList, string(*(insnic.SecurityGroups[i].ID)))
					}
					currentPrimNic[isInstanceNicSecurityGroups] = newStringSet(schema.HashString, secgrpList)
				}

				primaryNicList = append(primaryNicList, currentPrimNic)
				d.Set(isInstancePrimaryNetworkInterface, primaryNicList)
			}

			if instance.NetworkInterfaces != nil {
				interfacesList := make([]map[string]interface{}, 0)
				for _, intfc := range instance.NetworkInterfaces {
					if *intfc.ID != *instance.PrimaryNetworkInterface.ID {
						currentNic := map[string]interface{}{}
						currentNic["id"] = *intfc.ID
						currentNic[isInstanceNicName] = *intfc.Name
						currentNic[isInstanceNicPrimaryIpv4Address] = *intfc.PrimaryIpv4Address
						getnicoptions := &vpcclassicv1.GetInstanceNetworkInterfaceOptions{
							InstanceID: &id,
							ID:         intfc.ID,
						}
						insnic, response, err := sess.GetInstanceNetworkInterface(getnicoptions)
						if err != nil {
							return fmt.Errorf("Error getting network interfaces attached to the instance %s\n%s", err, response)
						}
						currentNic[isInstanceNicSubnet] = *insnic.Subnet.ID
						if len(insnic.SecurityGroups) != 0 {
							secgrpList := []string{}
							for i := 0; i < len(insnic.SecurityGroups); i++ {
								secgrpList = append(secgrpList, string(*(insnic.SecurityGroups[i].ID)))
							}
							currentNic[isInstanceNicSecurityGroups] = newStringSet(schema.HashString, secgrpList)
						}
						interfacesList = append(interfacesList, currentNic)

					}
				}

				d.Set(isInstanceNetworkInterfaces, interfacesList)
			}

			var rsaKey *rsa.PrivateKey
			if instance.Image != nil {
				d.Set(isInstanceImage, *instance.Image.ID)
				image := *instance.Image.Name
				res := strings.Contains(image, "windows")
				if res {
					if privatekey, ok := d.GetOk(isInstancePEM); ok {
						keyFlag := privatekey.(string)
						keybytes := []byte(keyFlag)

						if keyFlag != "" {
							block, err := pem.Decode(keybytes)
							if block == nil {
								return fmt.Errorf("Failed to load the private key from the given key contents. Instead of the key file path, please make sure the private key is pem format")
							}
							isEncrypted := false
							switch block.Type {
							case "RSA PRIVATE KEY":
								isEncrypted = x509.IsEncryptedPEMBlock(block)
							case "OPENSSH PRIVATE KEY":
								var err error
								isEncrypted, err = isOpenSSHPrivKeyEncrypted(block.Bytes)
								if err != nil {
									return fmt.Errorf("Failed to check if the provided open ssh key is encrypted or not %s", err)
								}
							default:
								return fmt.Errorf("PEM and OpenSSH private key formats with RSA key type are supported, can not support this key file type: %s", err)
							}
							passphrase := ""
							var privateKey interface{}
							if isEncrypted {
								if pass, ok := d.GetOk(isInstancePassphrase); ok {
									passphrase = pass.(string)
								} else {
									return fmt.Errorf("Mandatory field 'passphrase' not provided")
								}
								var err error
								privateKey, err = sshkeys.ParseEncryptedRawPrivateKey(keybytes, []byte(passphrase))
								if err != nil {
									return fmt.Errorf("Fail to decrypting the private key: %s", err)
								}
							} else {
								var err error
								privateKey, err = sshkeys.ParseEncryptedRawPrivateKey(keybytes, nil)
								if err != nil {
									return fmt.Errorf("Fail to decrypting the private key: %s", err)
								}
							}
							var ok bool
							rsaKey, ok = privateKey.(*rsa.PrivateKey)
							if !ok {
								return fmt.Errorf("Failed to convert to RSA private key")
							}
						}
					}
				}
			}

			getInstanceInitializationOptions := &vpcclassicv1.GetInstanceInitializationOptions{
				ID: &id,
			}
			initParms, response, err := sess.GetInstanceInitialization(getInstanceInitializationOptions)
			if err != nil {
				return fmt.Errorf("Error Getting instance Initialization: %s\n%s", err, response)
			}
			if initParms.Keys != nil {
				initKeyList := make([]map[string]interface{}, 0)
				for _, key := range initParms.Keys {
					key := key.(*vpcclassicv1.KeyReferenceInstanceInitializationContext)
					initKey := map[string]interface{}{}
					id := ""
					if key.ID != nil {
						id = *key.ID
					}
					initKey["id"] = id
					name := ""
					if key.Name != nil {
						name = *key.Name
					}
					initKey["name"] = name
					initKeyList = append(initKeyList, initKey)
					break

				}
				d.Set(isInstanceInitKeys, initKeyList)
			}
			if initParms.Password != nil && initParms.Password.EncryptedPassword != nil {
				ciphertext := *initParms.Password.EncryptedPassword
				password := base64.StdEncoding.EncodeToString(ciphertext)
				if rsaKey != nil {
					rng := rand.Reader
					clearPassword, err := rsa.DecryptOAEP(sha256.New(), rng, rsaKey, ciphertext, nil)
					if err != nil {
						return fmt.Errorf("Can not decrypt the password with the given key, %s", err)
					}
					password = string(clearPassword)
				}
				d.Set(isInstanceInitPassword, password)
			}

			d.Set(isInstanceStatus, *instance.Status)
			d.Set(isInstanceVPC, *instance.VPC.ID)
			d.Set(isInstanceZone, *instance.Zone.Name)

			var volumes []string
			volumes = make([]string, 0)
			if instance.VolumeAttachments != nil {
				for _, volume := range instance.VolumeAttachments {
					if volume.Volume != nil && *volume.Volume.ID != *instance.BootVolumeAttachment.Volume.ID {
						volumes = append(volumes, *volume.Volume.ID)
					}
				}
			}
			d.Set(isInstanceVolumes, newStringSet(schema.HashString, volumes))
			if instance.VolumeAttachments != nil {
				volList := make([]map[string]interface{}, 0)
				for _, volume := range instance.VolumeAttachments {
					vol := map[string]interface{}{}
					if volume.Volume != nil {
						vol["id"] = *volume.ID
						vol["volume_id"] = *volume.Volume.ID
						vol["name"] = *volume.Name
						vol["volume_name"] = *volume.Volume.Name
						vol["volume_crn"] = *volume.Volume.CRN
						volList = append(volList, vol)
					}
				}
				d.Set(isInstanceVolumeAttachments, volList)
			}
			if instance.BootVolumeAttachment != nil {
				bootVolList := make([]map[string]interface{}, 0)
				bootVol := map[string]interface{}{}
				bootVol["id"] = *instance.BootVolumeAttachment.ID
				bootVol["name"] = *instance.BootVolumeAttachment.Name
				bootVol["device"] = *instance.BootVolumeAttachment.Device.ID
				if instance.BootVolumeAttachment.Volume != nil {
					bootVol["volume_name"] = *instance.BootVolumeAttachment.Volume.Name
					bootVol["volume_id"] = *instance.BootVolumeAttachment.Volume.ID
					bootVol["volume_crn"] = *instance.BootVolumeAttachment.Volume.CRN
				}
				bootVolList = append(bootVolList, bootVol)
				d.Set(isInstanceBootVolume, bootVolList)
			}
			tags, err := GetTagsUsingCRN(meta, *instance.CRN)
			if err != nil {
				log.Printf(
					"Error on get of resource vpc Instance (%s) tags: %s", d.Id(), err)
			}
			d.Set(isInstanceTags, tags)

			controller, err := getBaseController(meta)
			if err != nil {
				return err
			}
			d.Set(ResourceControllerURL, controller+"/vpc/compute/vs")
			d.Set(ResourceName, instance.Name)
			d.Set(ResourceCRN, instance.CRN)
			d.Set(ResourceStatus, instance.Status)
			if instance.ResourceGroup != nil {
				rsMangClient, err := meta.(ClientSession).ResourceManagementAPIv2()
				if err != nil {
					return err
				}
				grp, err := rsMangClient.ResourceGroup().Get(*instance.ResourceGroup.ID)
				if err != nil {
					return err
				}
				d.Set(ResourceGroupName, grp.Name)
				d.Set(isInstanceResourceGroup, instance.ResourceGroup.ID)
			}
			return nil
		}
	}
	return fmt.Errorf("No Instance found with name %s", name)
}

func instanceGetByName(d *schema.ResourceData, meta interface{}, name string) error {
	sess, err := vpcClient(meta)
	if err != nil {
		return err
	}
	start := ""
	allrecs := []vpcv1.Instance{}
	for {
		listInstancesOptions := &vpcv1.ListInstancesOptions{}
		if start != "" {
			listInstancesOptions.Start = &start
		}
		instances, response, err := sess.ListInstances(listInstancesOptions)
		if err != nil {
			return fmt.Errorf("Error Fetching Instances %s\n%s", err, response)
		}
		start = GetNext(instances.Next)
		allrecs = append(allrecs, instances.Instances...)
		if start == "" {
			break
		}
	}
	for _, instance := range allrecs {
		d.SetId(*instance.ID)
		id := *instance.ID
		d.Set("id", *instance.ID)
		d.Set(isInstanceName, *instance.Name)
		if instance.Profile != nil {
			d.Set(isInstanceProfile, *instance.Profile.Name)
		}
		cpuList := make([]map[string]interface{}, 0)
		if instance.Vcpu != nil {
			currentCPU := map[string]interface{}{}
			currentCPU[isInstanceCPUArch] = *instance.Vcpu.Architecture
			currentCPU[isInstanceCPUCount] = *instance.Vcpu.Count
			cpuList = append(cpuList, currentCPU)
		}
		d.Set(isInstanceCPU, cpuList)

		d.Set(isInstanceMemory, *instance.Memory)
		gpuList := make([]map[string]interface{}, 0)
		d.Set(isInstanceGpu, gpuList)

		if instance.PrimaryNetworkInterface != nil {
			primaryNicList := make([]map[string]interface{}, 0)
			currentPrimNic := map[string]interface{}{}
			currentPrimNic["id"] = *instance.PrimaryNetworkInterface.ID
			currentPrimNic[isInstanceNicName] = *instance.PrimaryNetworkInterface.Name
			currentPrimNic[isInstanceNicPrimaryIpv4Address] = *instance.PrimaryNetworkInterface.PrimaryIpv4Address
			getnicoptions := &vpcv1.GetInstanceNetworkInterfaceOptions{
				InstanceID: &id,
				ID:         instance.PrimaryNetworkInterface.ID,
			}
			insnic, response, err := sess.GetInstanceNetworkInterface(getnicoptions)
			if err != nil {
				return fmt.Errorf("Error getting network interfaces attached to the instance %s\n%s", err, response)
			}
			currentPrimNic[isInstanceNicSubnet] = *insnic.Subnet.ID
			if len(insnic.SecurityGroups) != 0 {
				secgrpList := []string{}
				for i := 0; i < len(insnic.SecurityGroups); i++ {
					secgrpList = append(secgrpList, string(*(insnic.SecurityGroups[i].ID)))
				}
				currentPrimNic[isInstanceNicSecurityGroups] = newStringSet(schema.HashString, secgrpList)
			}

			primaryNicList = append(primaryNicList, currentPrimNic)
			d.Set(isInstancePrimaryNetworkInterface, primaryNicList)
		}

		if instance.NetworkInterfaces != nil {
			interfacesList := make([]map[string]interface{}, 0)
			for _, intfc := range instance.NetworkInterfaces {
				if *intfc.ID != *instance.PrimaryNetworkInterface.ID {
					currentNic := map[string]interface{}{}
					currentNic["id"] = *intfc.ID
					currentNic[isInstanceNicName] = *intfc.Name
					currentNic[isInstanceNicPrimaryIpv4Address] = *intfc.PrimaryIpv4Address
					getnicoptions := &vpcv1.GetInstanceNetworkInterfaceOptions{
						InstanceID: &id,
						ID:         intfc.ID,
					}
					insnic, response, err := sess.GetInstanceNetworkInterface(getnicoptions)
					if err != nil {
						return fmt.Errorf("Error getting network interfaces attached to the instance %s\n%s", err, response)
					}
					currentNic[isInstanceNicSubnet] = *insnic.Subnet.ID
					if len(insnic.SecurityGroups) != 0 {
						secgrpList := []string{}
						for i := 0; i < len(insnic.SecurityGroups); i++ {
							secgrpList = append(secgrpList, string(*(insnic.SecurityGroups[i].ID)))
						}
						currentNic[isInstanceNicSecurityGroups] = newStringSet(schema.HashString, secgrpList)
					}
					interfacesList = append(interfacesList, currentNic)

				}
			}

			d.Set(isInstanceNetworkInterfaces, interfacesList)
		}

		var rsaKey *rsa.PrivateKey
		if instance.Image != nil {
			d.Set(isInstanceImage, *instance.Image.ID)
			image := *instance.Image.Name
			res := strings.Contains(image, "windows")
			if res {
				if privatekey, ok := d.GetOk(isInstancePEM); ok {
					keyFlag := privatekey.(string)
					keybytes := []byte(keyFlag)

					if keyFlag != "" {
						block, err := pem.Decode(keybytes)
						if block == nil {
							return fmt.Errorf("Failed to load the private key from the given key contents. Instead of the key file path, please make sure the private key is pem format")
						}
						isEncrypted := false
						switch block.Type {
						case "RSA PRIVATE KEY":
							isEncrypted = x509.IsEncryptedPEMBlock(block)
						case "OPENSSH PRIVATE KEY":
							var err error
							isEncrypted, err = isOpenSSHPrivKeyEncrypted(block.Bytes)
							if err != nil {
								return fmt.Errorf("Failed to check if the provided open ssh key is encrypted or not %s", err)
							}
						default:
							return fmt.Errorf("PEM and OpenSSH private key formats with RSA key type are supported, can not support this key file type: %s", err)
						}
						passphrase := ""
						var privateKey interface{}
						if isEncrypted {
							if pass, ok := d.GetOk(isInstancePassphrase); ok {
								passphrase = pass.(string)
							} else {
								return fmt.Errorf("Mandatory field 'passphrase' not provided")
							}
							var err error
							privateKey, err = sshkeys.ParseEncryptedRawPrivateKey(keybytes, []byte(passphrase))
							if err != nil {
								return fmt.Errorf("Fail to decrypting the private key: %s", err)
							}
						} else {
							var err error
							privateKey, err = sshkeys.ParseEncryptedRawPrivateKey(keybytes, nil)
							if err != nil {
								return fmt.Errorf("Fail to decrypting the private key: %s", err)
							}
						}
						var ok bool
						rsaKey, ok = privateKey.(*rsa.PrivateKey)
						if !ok {
							return fmt.Errorf("Failed to convert to RSA private key")
						}
					}
				}
			}
		}

		getInstanceInitializationOptions := &vpcv1.GetInstanceInitializationOptions{
			ID: &id,
		}
		initParms, response, err := sess.GetInstanceInitialization(getInstanceInitializationOptions)
		if err != nil {
			return fmt.Errorf("Error Getting instance Initialization: %s\n%s", err, response)
		}
		if initParms.Keys != nil {
			initKeyList := make([]map[string]interface{}, 0)
			for _, key := range initParms.Keys {
				key := key.(*vpcv1.KeyReferenceInstanceInitializationContext)
				initKey := map[string]interface{}{}
				id := ""
				if key.ID != nil {
					id = *key.ID
				}
				initKey["id"] = id
				name := ""
				if key.Name != nil {
					name = *key.Name
				}
				initKey["name"] = name
				initKeyList = append(initKeyList, initKey)
				break

			}
			d.Set(isInstanceInitKeys, initKeyList)
		}
		if initParms.Password != nil && initParms.Password.EncryptedPassword != nil {
			ciphertext := *initParms.Password.EncryptedPassword
			password := base64.StdEncoding.EncodeToString(ciphertext)
			if rsaKey != nil {
				rng := rand.Reader
				clearPassword, err := rsa.DecryptPKCS1v15(rng, rsaKey, ciphertext)
				if err != nil {
					return fmt.Errorf("Can not decrypt the password with the given key, %s", err)
				}
				password = string(clearPassword)
			}
			d.Set(isInstanceInitPassword, password)
		}

		d.Set(isInstanceStatus, *instance.Status)
		d.Set(isInstanceVPC, *instance.VPC.ID)
		d.Set(isInstanceZone, *instance.Zone.Name)

		var volumes []string
		volumes = make([]string, 0)
		if instance.VolumeAttachments != nil {
			for _, volume := range instance.VolumeAttachments {
				if volume.Volume != nil && *volume.Volume.ID != *instance.BootVolumeAttachment.Volume.ID {
					volumes = append(volumes, *volume.Volume.ID)
				}
			}
		}
		d.Set(isInstanceVolumes, newStringSet(schema.HashString, volumes))
		if instance.VolumeAttachments != nil {
			volList := make([]map[string]interface{}, 0)
			for _, volume := range instance.VolumeAttachments {
				vol := map[string]interface{}{}
				if volume.Volume != nil {
					vol["id"] = *volume.ID
					vol["volume_id"] = *volume.Volume.ID
					vol["name"] = *volume.Name
					vol["volume_name"] = *volume.Volume.Name
					vol["volume_crn"] = *volume.Volume.CRN
					volList = append(volList, vol)
				}
			}
			d.Set(isInstanceVolumeAttachments, volList)
		}
		if instance.BootVolumeAttachment != nil {
			bootVolList := make([]map[string]interface{}, 0)
			bootVol := map[string]interface{}{}
			bootVol["id"] = *instance.BootVolumeAttachment.ID
			bootVol["name"] = *instance.BootVolumeAttachment.Name
			bootVol["device"] = *instance.BootVolumeAttachment.Device.ID
			if instance.BootVolumeAttachment.Volume != nil {
				bootVol["volume_name"] = *instance.BootVolumeAttachment.Volume.Name
				bootVol["volume_id"] = *instance.BootVolumeAttachment.Volume.ID
				bootVol["volume_crn"] = *instance.BootVolumeAttachment.Volume.CRN
			}
			bootVolList = append(bootVolList, bootVol)
			d.Set(isInstanceBootVolume, bootVolList)
		}
		tags, err := GetTagsUsingCRN(meta, *instance.CRN)
		if err != nil {
			log.Printf(
				"Error on get of resource vpc Instance (%s) tags: %s", d.Id(), err)
		}
		d.Set(isInstanceTags, tags)

		controller, err := getBaseController(meta)
		if err != nil {
			return err
		}
		d.Set(ResourceControllerURL, controller+"/vpc-ext/compute/vs")
		d.Set(ResourceName, instance.Name)
		d.Set(ResourceCRN, instance.CRN)
		d.Set(ResourceStatus, instance.Status)
		if instance.ResourceGroup != nil {
			d.Set(isInstanceResourceGroup, instance.ResourceGroup.ID)
			d.Set(ResourceGroupName, instance.ResourceGroup.Name)
		}
		return nil
	}
	return fmt.Errorf("No Instance found with name %s", name)
}

const opensshv1Magic = "openssh-key-v1"

type opensshPrivateKey struct {
	CipherName   string
	KdfName      string
	KdfOpts      string
	NumKeys      uint32
	PubKey       string
	PrivKeyBlock string
}

func isOpenSSHPrivKeyEncrypted(data []byte) (bool, error) {
	magic := append([]byte(opensshv1Magic), 0)
	if !bytes.Equal(magic, data[0:len(magic)]) {
		return false, errors.New("Invalid openssh private key format")
	}
	content := data[len(magic):]

	privKey := opensshPrivateKey{}

	if err := ssh.Unmarshal(content, &privKey); err != nil {
		return false, err
	}

	if privKey.KdfName == "none" && privKey.CipherName == "none" {
		return false, nil
	}
	return true, nil
}