OCP module with set version for provider, module and terraform no longer working

[KKooli]

Affected modules

terraform-ibm-modules/base-ocp-vpc/ibm v3.38.0

Terraform CLI and Terraform provider versions

• Terraform version: 1.9.2
• Provider version: 1.76.1

Terraform output

2025/09/15 11:17:57 Terraform apply | module.ocp_base.null_resource.reset_api_key (local-exec): {"incidentID":"19d6f3f7-ef8a-aec9-ada6-28923a16df99","code":"A03e9b","description":"Failed to create an API key with IAM. Revise your request and try again.","type":"Authentication"}
2025/09/15 11:17:57 Terraform apply |
2025/09/15 11:17:57 Terraform apply | Error: local-exec provisioner error
2025/09/15 11:17:57 Terraform apply |
2025/09/15 11:17:57 Terraform apply | with module.ocp_base.null_resource.reset_api_key,
2025/09/15 11:17:57 Terraform apply | on .terraform/modules/ocp_base/main.tf line 288, in resource "null_resource" "reset_api_key":
2025/09/15 11:17:57 Terraform apply | 288: provisioner "local-exec" {
2025/09/15 11:17:57 Terraform apply |
2025/09/15 11:17:57 Terraform apply | Error running command
2025/09/15 11:17:57 Terraform apply | '.terraform/modules/ocp_base/scripts/reset_iks_api_key.sh eu-fr2
2025/09/15 11:17:57 Terraform apply | 97c6f6a87db64440bbe775d232a269fe false private': exit status 1. Output:
2025/09/15 11:17:57 Terraform apply | ERROR:: FAILED TO RESET THE IAM API KEY
2025/09/15 11:17:57 Terraform apply | HTTP/2 400
2025/09/15 11:17:57 Terraform apply | content-type: application/json; charset=utf-8
2025/09/15 11:17:57 Terraform apply | cross-origin-resource-policy: cross-origin
2025/09/15 11:17:57 Terraform apply | x-carrier: prodfr2-par04-carrier100
2025/09/15 11:17:57 Terraform apply | x-correlation-id: b4d91956-4fa7-457a-bcfa-b94072a69237
2025/09/15 11:17:57 Terraform apply | x-hostname: armada-global-api-587765db-7f65t
2025/09/15 11:17:57 Terraform apply | x-region: eu-fr2
2025/09/15 11:17:57 Terraform apply | x-request-id: 19d6f3f7-ef8a-4ec9-ada6-28923a16df99
2025/09/15 11:17:57 Terraform apply | content-length: 182
2025/09/15 11:17:57 Terraform apply | content-security-policy: default-src 'none'; script-src 'self'
2025/09/15 11:17:57 Terraform apply | 'unsafe-inline' 'unsafe-eval'; connect-src 'self'; img-src 'self' data:;
2025/09/15 11:17:57 Terraform apply | style-src 'self' 'unsafe-inline'; font-src 'self'
2025/09/15 11:17:57 Terraform apply | strict-transport-security: max-age=31536000; includeSubDomains
2025/09/15 11:17:57 Terraform apply | x-content-type-options: nosniff
2025/09/15 11:17:57 Terraform apply | x-frame-options: DENY
2025/09/15 11:17:57 Terraform apply | x-permitted-cross-domain-policies: master-only
2025/09/15 11:17:57 Terraform apply | x-xss-protection: 1; mode=block
2025/09/15 11:17:57 Terraform apply | expires: Mon, 15 Sep 2025 11:17:57 GMT
2025/09/15 11:17:57 Terraform apply | cache-control: max-age=0, no-cache, no-store
2025/09/15 11:17:57 Terraform apply | pragma: no-cache

2025/09/15 11:17:57 Terraform apply | {"incidentID":"19d6f3f7-ef8a-aec9-ada6-28923a16df99","code":"A03e9b","description":"Failed
2025/09/15 11:17:57 Terraform apply | to create an API key with IAM. Revise your request and try
2025/09/15 11:17:57 Terraform apply | again.","type":"Authentication"}
2025/09/15 11:17:57 Terraform

Expected behavior

Create an ocp cluster and configure it
This code have been tested multiple times to create OCPs on the eu-fr2 region

Actual behavior

The code no longer works

Steps to reproduce (including links and screen captures)

1. Run terraform apply

---

By submitting this issue, you agree to follow our Code of Conduct

[KKooli]

we have an ibm support case open for this issue CS4377399

[ocofaigh]

I am following up with IKS on this now.

On the side we will also look at migrating the module to use the ibm_container_api_key_reset provider resource instead of the local-exec script. The one drawback here is that the provider resource will not check if existing key which covers the resource group and region already exists and could potentially create a duplicate. But we will do some investigation here.

Its also worth noting that the error you are getting is coming from the backend, so even if module was using the provider resource, I suspect you would still get the error.

[ocofaigh]

@KKooli Did you get any update in the support case?

FYI, in v3.60.0 we removed the null resource script and replaced it with the ibm_container_api_key_reset provider resource instead. Might be worth trying that to see if you hit the same error?

[KKooli]

hello @ocofaigh
I tried the version V3.60.0 to create a new cluster but we are still running into the same error

2025/09/24 08:27:03 Terraform apply | module.ocp_base.ibm_container_api_key_reset.reset_api_key: Creating...
2025/09/24 08:27:04 Terraform apply |
2025/09/24 08:27:04 Terraform apply | Warning: Argument is deprecated
2025/09/24 08:27:04 Terraform apply |
2025/09/24 08:27:04 Terraform apply | with module.trusted_profile.ibm_iam_trusted_profile_policy.policy["toolchain-migr-ocp-prv-test-trusted-profile-0"],
2025/09/24 08:27:04 Terraform apply | on .terraform/modules/trusted_profile/main.tf line 58, in resource "ibm_iam_trusted_profile_policy" "policy":
2025/09/24 08:27:04 Terraform apply | 58: profile_id = ibm_iam_trusted_profile.profile.profile_id
2025/09/24 08:27:04 Terraform apply |
2025/09/24 08:27:04 Terraform apply | This field is deprecated and will be removed starting with this 1.82.0
2025/09/24 08:27:04 Terraform apply | release. Please use iam_id field instead.
2025/09/24 08:27:04 Terraform apply |
2025/09/24 08:27:04 Terraform apply | Error: Request failed with status code: 400, ServerErrorResponse: {"incidentID":"280c815d-7a44-a234-99b9-fa47fb0079ad","code":"A03e9b","description":"Failed to create an API key with IAM. Revise your request and try again.","type":"Authentication"}
2025/09/24 08:27:04 Terraform apply |
2025/09/24 08:27:04 Terraform apply | with module.ocp_base.ibm_container_api_key_reset.reset_api_key,
2025/09/24 08:27:04 Terraform apply | on .terraform/modules/ocp_base/main.tf line 289, in resource "ibm_container_api_key_reset" "reset_api_key":
2025/09/24 08:27:04 Terraform apply | 289: resource "ibm_container_api_key_reset" "reset_api_key" {
2025/09/24 08:27:04 Terraform apply |
2025/09/24 08:27:04 Terraform apply | ---
2025/09/24 08:27:04 Terraform apply | id: terraform-4417c780
2025/09/24 08:27:04 Terraform apply | summary: 'Request failed with status code: 400, ServerErrorResponse:
2025/09/24 08:27:04 Terraform apply | {"incidentID":"280c815d-7a44-a234-99b9-fa47fb0079ad","code":"A03e9b","description":"Failed
2025/09/24 08:27:04 Terraform apply | to create an API key with IAM. Revise your request and try again.","type":"Authentication"}'
2025/09/24 08:27:04 Terraform apply | severity: error
2025/09/24 08:27:04 Terraform apply | resource: ibm_container_api_key_reset
2025/09/24 08:27:04 Terraform apply | operation: create
2025/09/24 08:27:04 Terraform apply | component:
2025/09/24 08:27:04 Terraform apply | name: github.com/IBM-Cloud/terraform-provider-ibm
2025/09/24 08:27:04 Terraform apply | version: 1.81.1

[ocofaigh]

@KKooli Thanks for checking - this confirms the issue is on the IKS side. Please use the support case to escalate with them. I'll also try to get an update from them internally.

[ocofaigh]

@KKooli can you confirm you are using a real IBM Cloud user apikey (as opposed to a Service ID user) for the IBM terraform provider authentication? As per this doc, a real user must be used so just wanted to rule this out.

[vburckhardt]

I recommend using the following commands:

ibmcloud login —apikey <apikey used in terraform>
ibmcloud target -g <target resource group where the cluster is created>
ibmcloud ks api-key reset —region <region, e.g., eu-fr2>

This should produce the same authorization error as with the Terraform layer, which will help identify the root cause.

[ocofaigh]

This has been resolved by using existing Service ID when creating IAM Credential type secret instead of creating new Service ID from an access group every time (which gets locked automatically by Secrets Manager by design)