Your key pair value is not find in ssh-agent

[AlexanderYastrebov]

% dda inv aws.create-vm    
Your key pair value 'alexander.yastrebov' is not find in ssh-agent. You may have issue to connect to the remote instance. Possible values are 
['alexander.yastrebov@datadoghq', 'alexander.yastrebov+git-commit-signing@datadoghq']. You can skip this check by setting `checkKeyPair: false` in the config

The code

test-infra-definitions/tasks/aws/deploy.py

Lines 103 to 121 in 929e070

	def _check_key_pair(key_pair_to_search: Optional[str]):
	if key_pair_to_search is None or key_pair_to_search == "":
	raise Exit("This scenario requires to define 'defaultKeyPairName' in the configuration file")
	output = subprocess.check_output(["ssh-add", "-L"])
	key_pairs: List[str] = []
	output = output.decode("utf-8")
	for line in output.splitlines():
	parts = line.split(" ")
	if parts:
	key_pair_path = os.path.basename(parts[-1])
	key_pair = os.path.splitext(key_pair_path)[0]
	key_pairs.append(key_pair)
	if key_pair_to_search not in key_pairs:
	raise Exit(
	f"Your key pair value '{key_pair_to_search}' is not find in ssh-agent. "
	+ f"You may have issue to connect to the remote instance. Possible values are \n{key_pairs}. "
	+ "You can skip this check by setting `checkKeyPair: false` in the config"
	)

assumes ssh-add -L outputs key filename which it does not:

% ssh-add -L
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBHPOdXDmhlVyiRrUkvNUFYBJ+vAqEN7k+Asg2Zm4fjF alexander.yastrebov@datadoghq.com
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK4qbmRV8rydgMCNPYfJuy5u6jbIVuPpmrTusg2Gm7oh alexander.yastrebov+git-commit-signing@datadoghq.com

The problem seems to be due to change of key storage format, see https://unix.stackexchange.com/a/566474

Surprisingly the MacOS version of ssh-add at some point stopped showing the filename's as with the Linux variant.

Workaround

Delete ~/.test_infra_config.yaml and re-run setup using alexander.yastrebov@datadoghq as keypair name:

% dda inv setup                                             

✅ gke-gcloud-auth-plugin is already installed
Pulumi is up to date: v3.207.0
Logged in to COMP-H3D9Y4H95P as alexander.yastrebov (file://~)
🤖 Let's configure your environment for e2e tests! Press ctrl+c to stop me
Which aws account do you want to create instances on? Default [agent-sandbox], available [agent-sandbox|sandbox|tse-playground]: 
Do you want to create a new key pair? [Y/N] Default [N]: N
Do you want to import an existing key pair? [Y/N] Default [N]: Y
🔑 Key pair name (default: alexander.yastrebov): alexander.yastrebov@datadoghq
🔑 Private key path (default: /Users/alexander.yastrebov/.ssh/id_rsa_e2e_agent_sandbox_alexander.yastrebov@datadoghq.pem): /Users/alexander.yastrebov/.ssh/id_ed25519
🔑 Public key path (default: /Users/alexander.yastrebov/.ssh/id_ed25519.pub): 
{
    "KeyFingerprint": "RnubobqpLWTSCa3U+bQKRz5jeWtz1vWl6qhU83aqvmE=",
    "KeyName": "alexander.yastrebov@datadoghq",
    "KeyPairId": "key-027f09746b0a32585"
}
Public key imported to AWS as key pair alexander.yastrebov@datadoghq
Do you want to check if the keypair is loaded in ssh agent when creating manual environments or running e2e tests [Y/N]? Default [N]: Y
🔖 What is your github team? This will tag all your resources by `team:<team>`. Use kebab-case format (example: agent-platform): container-autoscaling
Profile sso-agent-sandbox-account-admin already exists in /Users/alexander.yastrebov/.aws/config
🔑 Path to your Azure public ssh key: (default: [/Users/alexander.yastrebov/.ssh/id_ed25519.pub])
🔑 Default account to use, default [agent-sandbox]: 
🔑 Path to your GCP public ssh key: (default: [/Users/alexander.yastrebov/.ssh/id_ed25519.pub])
🔑 Default account to use, default [agent-sandbox]: 
🔑 Path to your OpenShift pull secret file (optional, can be set later): 
🐶 Datadog API key - default [00000000000000000000000000000000]: 
🐶 Datadog APP key - default [0000000000000000000000000000000000000000]: 
Pulumi emits logs at log levels between 1 and 11, with 11 being the most verbose. At log level 10 or below, Pulumi will avoid intentionally exposing any known credentials. At log level 11, Pulumi will intentionally expose some known credentials to aid with debugging, so these log levels should be used only when absolutely needed.
🔊 Pulumi log level (1-11) - empty defaults to [1]: 
Write pulumi logs to stderr - empty defaults to [False]: 
Configuration file saved at /Users/alexander.yastrebov/.test_infra_config.yaml

You can run the following command to print your configuration: `cat /Users/alexander.yastrebov/.test_infra_config.yaml`. This command was copied to the clipboard

Also delete previously created key with a default name to end up with a key named alexander.yastrebov@datadoghq:

Then edit ~/.test_infra_config.yaml to set key file paths to empty:

  aws:
    account: agent-sandbox
    keyPairName: alexander.yastrebov@datadoghq
    privateKeyPassword: null
    privateKeyPath: "" # /Users/alexander.yastrebov/.ssh/id_ed25519
    publicKeyPath: "" # /Users/alexander.yastrebov/.ssh/id_ed25519.pub
    teamTag: container-autoscaling

as per https://datadoghq.atlassian.net/wiki/spaces/ADX/pages/3492282982/Common+E2E+issues#error:-ssh:-this-private-key-is-passphrase-protected to rely on SSH agent.

Full config for the reference:

configParams:
  agent:
    apiKey: "00000000000000000000000000000000"
    appKey: "0000000000000000000000000000000000000000"
    verifyCodeSignature: true
  aws:
    account: agent-sandbox
    keyPairName: alexander.yastrebov@datadoghq
    privateKeyPassword: null
    privateKeyPath: "" # /Users/alexander.yastrebov/.ssh/id_ed25519
    publicKeyPath: "" # /Users/alexander.yastrebov/.ssh/id_ed25519.pub
    teamTag: container-autoscaling
  azure:
    account: agent-sandbox
    publicKeyPath: /Users/alexander.yastrebov/.ssh/id_ed25519.pub
  devMode: false
  gcp:
    account: agent-sandbox
    publicKeyPath: /Users/alexander.yastrebov/.ssh/id_ed25519.pub
    pullSecretPath: ""
  local: null
  pulumi:
    logLevel: 1
    logToStdErr: false
    verboseProgressStreams: null
options:
  checkKeyPair: true
stackParams: null