PureError('Could not read private key file')

[nitreddy21]

While running pure1 ansible playbooks with the following modules purestorage.pure1.pure1_info or purestorage.pure1.pure1_info encountering the following error "Could not read private key file".

verified private key file permissions and its accessible through python env.

The full traceback is:
File "/var/folders/r7/1y7l6xyn1kld815g1wj1brj80000gp/T/ansible_purestorage.pure1.pure1_info_payload_pjai6z3n/ansible_purestorage.pure1.pure1_info_payload.zip/ansible_collections/purestorage/pure1/plugins/module_utils/pure1.py", line 69, in get_pure1
pure_1 = pure1.Client(
File "///.pyenv/versions/3.10.4/envs/ntn-ansible/lib/python3.10/site-packages/pypureclient/pure1/client.py", line 45, in Client
client = pure1_module.Client(**kwargs)
File "///.pyenv/versions/3.10.4/envs/ntn-ansible/lib/python3.10/site-packages/pypureclient/pure1/Pure1_1_3/client.py", line 73, in init
self._token_man = TokenManager(self.TOKEN_ENDPOINT,
File "///.pyenv/versions/3.10.4/envs/ntn-ansible/lib/python3.10/site-packages/pypureclient/token_manager.py", line 58, in init
private_key = self._get_private_key(private_key_file, private_key_password)
File "///.pyenv/versions/3.10.4/envs/ntn-ansible/lib/python3.10/site-packages/pypureclient/token_manager.py", line 72, in _get_private_key
raise PureError('Could not read private key file')
fatal: [localhost]: FAILED! => {
"changed": false,
"invocation": {
"module_args": {
"app_id": "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER",
"gather_subset": [
"minimum"
],
"key_file": "/Users///*/private_key.pem",
"password": null
}
},
"msg": "Unknown failure. Please contact Pure Support"
}

• name: Test connectivity to Pure1
  hosts: localhost
  gather_facts: no
  tasks:

  • name: Get Pure1 Info
    purestorage.pure1.pure1_info:
    app_id: "{{ pure1_app_id }}"
    key_file: "{{ pure1_key_file }}"
    register: pure1_info

  • name: Display Pure1 Connection Info
    debug:
    var: pure1_info

[mtillajev]

code which is reading rsa file

    def _get_private_key(self, private_key_file, private_key_password):
        try:
            rsa_key = RSAKey.from_private_key_file(private_key_file, private_key_password)
        except:
            raise PureError('Could not read private key file').  <---- raised error
        with StringIO() as buf:
            rsa_key.write_private_key(buf)
            private_key = buf.getvalue()
        return private_key

so there is something with the provided file.

I think sdk could do better job here, either by not wrapping RSA errors at all, or at least include some details into raise PureError('Could not read private key file').

[mtillajev]

from different thread, problem was with the key file which had -----BEGIN PRIVATE KEY----- instead of -----BEGIN RSA PRIVATE KEY-----, but regardless _get_private_key should be more informative when raising error

[juangre]

I have the same problem, but changing the private key banner from -----BEGIN PRIVATE KEY----- to -----BEGIN RSA PRIVATE KEY----- didn't solve the problem.
I'm using py_pure_client version 1.70.2 and ansible collection 1.4.0

[mtillajev]

I have the same problem, but changing the private key banner from -----BEGIN PRIVATE KEY----- to -----BEGIN RSA PRIVATE KEY----- didn't solve the problem. I'm using py_pure_client version 1.70.2 and ansible collection 1.4.0

@juangre did you updated both BEGIN and END part of the private key?

Could you try if openssl rsa -in <PATH_TO_THE_PEM> -outform PEM -pubout -out <PATH_TO_THE_UPDATED_PEM> works for you?

[juangre]

@mtillajev Yes, I changed both BEGIN and END.

I tried openssl rsa -in private.pem.orig -outform PEM -out private.pem and it didn't work, I changed again both banners and the same result

[juangre]

Looking at verbose mode I can see the error is different.

When the banner is PRIVATE KEY

    private_key = self._get_private_key(private_key_file, private_key_password)
                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/juangre/ansible-pure1/venv/lib/python3.12/site-packages/pypureclient/token_manager.py", line 73, in _get_private_key
    raise PureError('Could not read private key file')

And when the banner is RSA PRIVATE KEY:

    self._access_token = self._request_access_token()
                         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/juangre/ansible-pure1/venv/lib/python3.12/site-packages/pypureclient/token_manager.py", line 177, in _request_access_token
    raise PureError('Could not retrieve a new access token')

Maybe I had to move to the next error and the part of the file is solved with your trick

[juangre]

Solved, the problem was the app_id.

Then the solution is generate the private key with PEM format and change the banners.

Also I notice that if you use encrypted key with password (at least with aes256 as recommended in https://blog.purestorage.com/products/introducing-the-pure1-rest-api/) it doesn't work

[mtillajev]

Also I notice that if you use encrypted key with password (at least with aes256 as recommended in https://blog.purestorage.com/products/introducing-the-pure1-rest-api/) it doesn't work

We'll look into this