SSH authentication fails if constraints/compute.requireOsLogin is enforced

[tstaerk]

Following your guide, I get when I type terraform apply:

module.hana_node.null_resource.hana_node_provisioner[1]: Still creating... [5m0s elapsed]
╷
│ Error: file provisioner error
│
│ with module.hana_node.null_resource.hana_node_provisioner[1],
│ on modules/hana_node/salt_provisioner.tf line 23, in resource "null_resource" "hana_node_provisioner":
│ 23: provisioner "file" {
│
│ timeout - last error: SSH authentication failed (root@34.140.41.24:22): ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain

[petersatsuse]

Hi Thorsten, could you provide us a bit more information pls.

a) which guide: github or suse getting started docu
b) which CSP (guess gce)
c) your settings of the various ssh flags in tfvars:

• did you provide the values for the public_key/private_key via files, or in tfvars directly
• what is your setting of "pre_deployment"? If its false, did you provide the "cluster_ssh_xxx" settings?
  d) which version of the project

[ab-mohamed]

@petersatsuse, Thorsten uses the SBP guide I created for GCP.

@tstaerk, I would advise the following:

1. If you use an older GitHub version, please ensure that you use the most recent one. The current version is 8.1.0. You may execute the git pull command if you are in doubt before creating the environment.
2. Could you please share the terraform.tfvars file with us. It contains all the configuration files that you used for your environment.

Some other required information:

1. Used SLES4SAP version: Specify the used SLES4SAP version (SLES12SP4, SLES15SP2, etc.)
2. Used client machine OS: Specify the used machine OS to execute the project (Windows, any Linux distro, macOS).
   Even though terraform is multi-platform, some of the local actions are based on Linux distributions so some operations might fail for this reason.
3. Expected behaviour vs. observed behaviour: Was your deployment failed, or was it completed with an error message?
4. The provisioning_log_level = "info" option in the terraform.tfvars file is interesting to get more information during the execution of the terraform commands. So it is suggested to run the deployment with this option to see what happens before opening any ticket.
5. Logs: Upload the deployment logs to make the root cause finding easier.
   The logs might have sensitive secrets exposed. Remove them before uploading anything here. Otherwise, contact me to send the logs privately to the SUSE teams.

There is the list of the required logs (each of the deployed machines will have all of them):

• /var/log/salt-os-setup.log
• /var/log/salt-predeployment.log
• /var/log/salt-deployment.log
• /var/log/salt-result.log

[tstaerk]

just realized I did not define a VPC... if there is only one, can't it use this?

[tstaerk]

OK, I am using GCP and the following tfvars file:

project = "thorstenstaerk-suse-terraforms"
gcp_credentials_file = "sa.json"
region = "europe-west1"
os_image = "suse-sap-cloud/sles-15-sp2-sap"
public_key = "/home/admin_/.ssh/id_rsa.pub"
private_key = "/home/admin_/.ssh/id_rsa"
cluster_ssh_pub = "salt://sshkeys/cluster.id_rsa.pub"
cluster_ssh_key = "salt://sshkeys/cluster.id_rsa"
ha_sap_deployment_repo = "https://download.opensuse.org/repositories/network:/ha-clustering:/sap-deployments:/v8/"
provisioning_log_level = "info"
pre_deployment = true
bastion_enabled = false
machine_type = "n1-highmem-16"
hana_inst_master="thorstenstaerk-sap-media-extracted/"
hana_master_password = "SAP_Pass123"

[ab-mohamed]

@tstaerk:

I have just completed a successful deployment using the most recent version, 8.1.0, using the following terraform.tfvars file:

project = "<PROJECT ID>"
gcp_credentials_file = "sa-key.json"
region = "us-west1"
os_image = "suse-sap-cloud/sles-15-sp2-sap"
public_key  = "<PATH TO  THE SSH KEY>/gcp_key.pub"
private_key = "<PATH TO  THE SSH KEY>/gcp_key"
cluster_ssh_pub = "salt://sshkeys/cluster.id_rsa.pub"
cluster_ssh_key = "salt://sshkeys/cluster.id_rsa"
ha_sap_deployment_repo = "https://download.opensuse.org/repositories/network:ha-clustering:sap-deployments:v8/"
provisioning_log_level = "info"
pre_deployment = true
bastion_enabled = false
hana_inst_master = "<GCP BUCKET>/HANA/2.0/SPS05/51054623"
hana_master_password = "YourSAPPassword1234"
hana_primary_site = "NUE"
hana_secondary_site = "FRA"

I see that we use almost the same configurations. Please ensure that you use the most recent version, 8.1.0, the master branch?
I would suggest using a new clone to ensure no configuration conflicts, or at least execute the command git pull before starting your deployment?

[tstaerk]

git pull tells me "already up to date"

[ab-mohamed]

Can you please try a fresh clone before digging into the issue?

[tstaerk]

deleted and re-checked out

[tstaerk]

OK, your and my terraform.tfvars is identical with the exception of passwords, names and your two lines

hana_primary_site = "NUE"
hana_secondary_site = "FRA"

[tstaerk]

I repeated with my old terraform.tfvars and I get:

module.hana_node.module.hana-load-balancer[0].google_compute_health_check.health-check: Creating...
╷
│ Error: Error creating Network: googleapi: Error 409: The resource 'projects/thorstenstaerk-suse-terraforms/global/networks/demo-network' already exists, alreadyExists
│
│ with google_compute_network.ha_network[0],
│ on infrastructure.tf line 27, in resource "google_compute_network" "ha_network":
│ 27: resource "google_compute_network" "ha_network" {
│
╵
╷
│ Error: Error creating Disk: googleapi: Error 409: The resource 'projects/thorstenstaerk-suse-terraforms/zones/europe-west1-c/disks/demo-hana-data-1' already exists, alreadyExists
│
│ with module.hana_node.google_compute_disk.data[1],
│ on modules/hana_node/main.tf line 12, in resource "google_compute_disk" "data":
│ 12: resource "google_compute_disk" "data" {
│
╵
╷
│ Error: Error creating Disk: googleapi: Error 409: The resource 'projects/thorstenstaerk-suse-terraforms/zones/europe-west1-b/disks/demo-hana-data-0' already exists, alreadyExists
│
│ with module.hana_node.google_compute_disk.data[0],
│ on modules/hana_node/main.tf line 12, in resource "google_compute_disk" "data":
│ 12: resource "google_compute_disk" "data" {
│
╵
╷
│ Error: Error creating Disk: googleapi: Error 409: The resource 'projects/thorstenstaerk-suse-terraforms/zones/europe-west1-b/disks/demo-hana-backup-0' already exists, alreadyExists
│
│ with module.hana_node.google_compute_disk.backup[0],
│ on modules/hana_node/main.tf line 20, in resource "google_compute_disk" "backup":
│ 20: resource "google_compute_disk" "backup" {
│
╵
╷
│ Error: Error creating Disk: googleapi: Error 409: The resource 'projects/thorstenstaerk-suse-terraforms/zones/europe-west1-c/disks/demo-hana-backup-1' already exists, alreadyExists
│
│ with module.hana_node.google_compute_disk.backup[1],
│ on modules/hana_node/main.tf line 20, in resource "google_compute_disk" "backup":
│ 20: resource "google_compute_disk" "backup" {
│
╵
╷
│ Error: Error creating Disk: googleapi: Error 409: The resource 'projects/thorstenstaerk-suse-terraforms/zones/europe-west1-c/disks/demo-hana-software-1' already exists, alreadyExists
│
│ with module.hana_node.google_compute_disk.hana-software[1],
│ on modules/hana_node/main.tf line 28, in resource "google_compute_disk" "hana-software":
│ 28: resource "google_compute_disk" "hana-software" {
│
╵
╷
│ Error: Error creating Disk: googleapi: Error 409: The resource 'projects/thorstenstaerk-suse-terraforms/zones/europe-west1-b/disks/demo-hana-software-0' already exists, alreadyExists
│
│ with module.hana_node.google_compute_disk.hana-software[0],
│ on modules/hana_node/main.tf line 28, in resource "google_compute_disk" "hana-software":
│ 28: resource "google_compute_disk" "hana-software" {
│
╵
╷
│ Error: Error creating HealthCheck: googleapi: Error 409: The resource 'projects/thorstenstaerk-suse-terraforms/global/healthChecks/demo-hana-health-check' already exists, alreadyExists
│
│ with module.hana_node.module.hana-load-balancer[0].google_compute_health_check.health-check,
│ on modules/load_balancer/main.tf line 5, in resource "google_compute_health_check" "health-check":
│ 5: resource "google_compute_health_check" "health-check" {

[tstaerk]

after deleting all the stuff above and re-starting terraform apply, I now get:

│ Error: Error creating InstanceGroup: googleapi: Error 409: The resource 'projects/thorstenstaerk-suse-terraforms/zones/europe-west1-b/instanceGroups/demo-hana-primary-group' already exists, alreadyExists
│
│ with module.hana_node.google_compute_instance_group.hana-primary-group,
│ on modules/hana_node/main.tf line 60, in resource "google_compute_instance_group" "hana-primary-group":
│ 60: resource "google_compute_instance_group" "hana-primary-group" {
│
╵
╷
│ Error: Error creating InstanceGroup: googleapi: Error 409: The resource 'projects/thorstenstaerk-suse-terraforms/zones/europe-west1-c/instanceGroups/demo-hana-secondary-group' already exists, alreadyExists
│
│ with module.hana_node.google_compute_instance_group.hana-secondary-group,
│ on modules/hana_node/main.tf line 66, in resource "google_compute_instance_group" "hana-secondary-group":
│ 66: resource "google_compute_instance_group" "hana-secondary-group" {
│
╵
╷
│ Error: file provisioner error
│
│ with module.hana_node.null_resource.hana_node_provisioner[1],
│ on modules/hana_node/salt_provisioner.tf line 23, in resource "null_resource" "hana_node_provisioner":
│ 23: provisioner "file" {
│
│ timeout - last error: SSH authentication failed (root@35.187.176.254:22): ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no
│ supported methods remain
╵
╷
│ Error: file provisioner error
│
│ with module.hana_node.null_resource.hana_node_provisioner[0],
│ on modules/hana_node/salt_provisioner.tf line 23, in resource "null_resource" "hana_node_provisioner":
│ 23: provisioner "file" {
│
│ timeout - last error: SSH authentication failed (root@130.211.104.240:22): ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no
│ supported methods remain

[tstaerk]

ssh cannot work, as Cloud Shell does not have network connection to a host inside a GCP project

[tstaerk]

130.211.104.240 is demo-vmhana01

[ab-mohamed]

@tstaerk, please execute the terraform destroy command to destroy your environment and before any new attempts to create a new environment using the terraform apply command.

When you ssh to the HANA node using the public IP address, you need to use the used SSH in the terraform.tfvars file. Here is the command format:

ssh -i <SSH PRIVATE KEY> root@<HANA_NODE_PUBLIC_IP_ADDRESS>

[tstaerk]

Hi, I do not call ssh. I get an error that ssh is not possible and I think this is because of the isolation between cloud shell and VMs.