[RFC PATCH] terraform/OCI: Grab secrets from ~/.oci/config

[cel@kernel.org]

From: Chuck Lever <chuck.lever@oracle.com>

Instead of storing authentication secrets in the kdevops .config
file, pull them from the authentication profiles already set up
in ~/.oci/config. This arrangement is more secure.

terraform's API authentication is now managed outside of Kconfig,
as is done with AWS. An update to docs/kdevops-terraform.md to
follow.

Suggested-by: Luis Chamberlain <mcgrof@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
---
 .../templates/oci/terraform.tfvars.j2         |  5 +---
 scripts/terraform.Makefile                    |  4 ---
 terraform/oci/kconfigs/Kconfig.identity       | 27 +++++++------------
 terraform/oci/provider.tf                     |  7 ++---
 terraform/oci/vars.tf                         | 25 ++++-------------
 5 files changed, 17 insertions(+), 51 deletions(-)

The tenancy OCID, user OCID, fingerprint, and private key path
Kconfig settings would no longer be needed. This patch fits
somewhere in the middle of the 00/31 series, replacing several of
those patches.


diff --git a/playbooks/roles/gen_tfvars/templates/oci/terraform.tfvars.j2 b/playbooks/roles/gen_tfvars/templates/oci/terraform.tfvars.j2
index f7b9ffb48c64..73b963230882 100644
--- a/playbooks/roles/gen_tfvars/templates/oci/terraform.tfvars.j2
+++ b/playbooks/roles/gen_tfvars/templates/oci/terraform.tfvars.j2
@@ -1,8 +1,5 @@
 oci_region = "{{ terraform_oci_region }}"
-oci_tenancy_ocid = "{{ terraform_oci_tenancy_ocid }}"
-oci_user_ocid = "{{ terraform_oci_user_ocid }}"
-oci_user_private_key_path = "{{ terraform_oci_user_private_key_path }}"
-oci_user_fingerprint = "{{ terraform_oci_user_fingerprint }}"
+oci_config_file_profile = "{{ terraform_oci_config_file_profile }}"
 oci_availablity_domain = "{{ terraform_oci_availablity_domain }}"
 oci_compartment_ocid = "{{ terraform_oci_compartment_ocid }}"
 oci_shape = "{{ terraform_oci_shape }}"
diff --git a/scripts/terraform.Makefile b/scripts/terraform.Makefile
index 3235c1af84b9..75ba9b97b518 100644
--- a/scripts/terraform.Makefile
+++ b/scripts/terraform.Makefile
@@ -96,10 +96,6 @@ endif
 
 ifeq (y,$(CONFIG_TERRAFORM_OCI))
 TERRAFORM_EXTRA_VARS += terraform_oci_region=$(subst ",,$(CONFIG_TERRAFORM_OCI_REGION))
-TERRAFORM_EXTRA_VARS += terraform_oci_tenancy_ocid=$(subst ",,$(CONFIG_TERRAFORM_OCI_TENANCY_OCID))
-TERRAFORM_EXTRA_VARS += terraform_oci_user_ocid=$(subst ",,$(CONFIG_TERRAFORM_OCI_USER_OCID))
-TERRAFORM_EXTRA_VARS += terraform_oci_user_private_key_path=$(subst ",,$(CONFIG_TERRAFORM_OCI_USER_PRIVATE_KEY_PATH))
-TERRAFORM_EXTRA_VARS += terraform_oci_user_fingerprint=$(subst ",,$(CONFIG_TERRAFORM_OCI_USER_FINGERPRINT))
 TERRAFORM_EXTRA_VARS += terraform_oci_availablity_domain=$(subst ",,$(CONFIG_TERRAFORM_OCI_AVAILABLITY_DOMAIN))
 TERRAFORM_EXTRA_VARS += terraform_oci_compartment_ocid=$(subst ",,$(CONFIG_TERRAFORM_OCI_COMPARTMENT_OCID))
 TERRAFORM_EXTRA_VARS += terraform_oci_shape=$(subst ",,$(CONFIG_TERRAFORM_OCI_SHAPE))
diff --git a/terraform/oci/kconfigs/Kconfig.identity b/terraform/oci/kconfigs/Kconfig.identity
index 928c700d9bd4..dce8f3bb54d9 100644
--- a/terraform/oci/kconfigs/Kconfig.identity
+++ b/terraform/oci/kconfigs/Kconfig.identity
@@ -5,23 +5,14 @@ config TERRAFORM_OCI_TENANCY_OCID
 	  Read this:
 	  https://docs.oracle.com/en-us/iaas/Content/API/SDKDocs/terraformproviderconfiguration.htm
 
-config TERRAFORM_OCI_USER_OCID
-	string "OCI user OCID"
+config TERRAFORM_OCI_CONFIG_FILE_PROFILE
+	string "Authentication profile entry"
+	output yaml
+	default "DEFAULT"
 	help
-	  The OCI ID of the user to use.
-	  Read this:
-	  https://docs.oracle.com/en-us/iaas/Content/API/SDKDocs/terraformproviderconfiguration.htm
+	  Authentication secrets are stored in ~/.oci/config. That
+	  file may contain more than one entry/identity. Select the
+	  entry in ~/.oci/config that kdevops uses to
+	  authenticate to OCI. Examples:
 
-config TERRAFORM_OCI_USER_PRIVATE_KEY_PATH
-	string "OCI user private key path"
-	help
-	  Path to the file containing the private key of the user.
-	  Read this:
-	  https://docs.oracle.com/en-us/iaas/Content/API/SDKDocs/terraformproviderconfiguration.htm
-
-config TERRAFORM_OCI_USER_FINGERPRINT
-	string "OCI user fingerprint"
-	help
-	  Fingerprint for the key pair being used.
-	  Read this:
-	  https://docs.oracle.com/en-us/iaas/Content/API/SDKDocs/terraformproviderconfiguration.htm
+	  https://docs.oracle.com/en-us/iaas/Content/API/Concepts/sdkconfig.htm
diff --git a/terraform/oci/provider.tf b/terraform/oci/provider.tf
index 80361d3ac562..c4619e244d73 100644
--- a/terraform/oci/provider.tf
+++ b/terraform/oci/provider.tf
@@ -2,9 +2,6 @@ terraform {
 }
 
 provider "oci" {
-  tenancy_ocid			= var.oci_tenancy_ocid
-  user_ocid			= var.oci_user_ocid
-  private_key_path		= var.oci_user_private_key_path
-  fingerprint			= var.oci_user_fingerprint
-  region			= var.oci_region
+  config_file_profile = var.oci_config_file_profile
+  region              = var.oci_region
 }
diff --git a/terraform/oci/vars.tf b/terraform/oci/vars.tf
index 4c6383d9b231..9e67ee9a8959 100644
--- a/terraform/oci/vars.tf
+++ b/terraform/oci/vars.tf
@@ -1,28 +1,13 @@
+variable "oci_config_file_profile" {
+  description = "Entry in ~/.oci/config to use for API authentication"
+  type        = string
+}
+
 variable "oci_region" {
   description = "An OCI region"
   type        = string
 }
 
-variable "oci_tenancy_ocid" {
-  description = "OCID of your tenancy"
-  type        = string
-}
-
-variable "oci_user_ocid" {
-  description = "OCID of the user calling the API"
-  type        = string
-}
-
-variable "oci_user_private_key_path" {
-  description = "The path of the private key stored on your computer"
-  type        = string
-}
-
-variable "oci_user_fingerprint" {
-  description = "Fingerprint for the key pair being used"
-  type        = string
-}
-
 variable "oci_availablity_domain" {
   description = "Name of availability domain"
   type        = string
-- 
2.48.1