authentification always fails if user is not to subscribed to us-phoenix-1 region

[chris93111]

Hi

i try to deploy oke with rancher but i have always error 401 in authentification

i have try with many user

my credential work correctly with sdk

the parameter set in ui:
tenancyid
userocid
fingerprint
compartiementocid
private_key

Service error:NotAuthenticated. The required information to complete authentication was not provided or was incorrect.. http status code: 401. Opc request id: XXXXXXXXXX

[chris93111]

Hi it's work with rancher 2.4.8 , i think region parameter is missing
rancher 2.5.1

[jlamillan]

Thanks for the report, we'll check it out

[jlamillan]

@jrosinsk 

[jlamillan]

@chris93111 - I have not been able to reproduce this issue on Rancher v2.5.1 (using the v1.4.2 OKE driver which is installed by default).

Is there anything else specific to your environment that I should be trying? For example, is your OCI API password protected? Are you using a different OKE driver version? etc.

Also, please confirm you are talking about the OKE Cluster driver for hosted Kubernetes (rather than the OCI node driver for the OCI infrastructure provider).

[chris93111]

Hi i don't have the parameter region with 2.5.2 and oci 1.4.2 , work with 2.4.8 because parameter "region" is available

[jlamillan]

I believe its choosing us-phoenix-1 by default, which should be ok for basic authentication purposes.

Is the admin in the User OCID field typo? Note that it is expecting a user OCID i.e. ocid1.user.oc1..aaaaaaaa....

[chris93111]

yes my ocid is ok because i can use with sdk of oci and api with no problem

but my region is in frankfurt, so maybe the region phoenix is not same authentification and i can't change this parameter with 2.5.2

[jlamillan]

Ok. Using the console, you should be able to check whether you're "subscribed" to the Phoenix region

[jlamillan]

What you're describing does sound like a bug. But we have a bit of a "chicken and egg" problem in that we need to authenticate to retrieve the region list.

The region list that was there before was static and often out of date since we're adding new regions so frequently.

[chris93111]

I don't have subscription with phoenix region
Ok i inderstand region is recover dynamically but with 2.4.8 the region parameter is set by the user , maybe you can let the user overload region in 2.5.1 and with empty param use dynamic search region

[jlamillan]

@jrosinsk

[jlamillan]

While we are sorting this issue out, you should be able to work around your authentication issue by subscribing to the "US West (Phoenix)" region:

OCI Console=> Administration => Region Management=> US West (Phoenix) => Subscribe

[jlamillan]

Upstream PR to add the list of regions back to the authentication pane.

2.4 back-port PR