View source for Fixing the 'Cannot show information Failed to get API session' error when using the OCI CLI network commands on OCI instances


Encountering the error '''"Cannot show information: Failed to get API session"''' when using OCI CLI network commands on Oracle Cloud Infrastructure (OCI) instances can be frustrating, especially when you're managing critical network configurations.

In this tutorial, we'll walk you through the common cause of this issue and provide clear, step-by-step instructions to resolve it. 

= Prerequisites =

* Oracle Linux Instance running inside OCI

[[File:f8659a9a324bb94d70006440a9c32075.png|800px]]

= The Issue =

The commands <code>sudo oci-network-config show</code> and <code>sudo oci-network-config configure</code> are part of the Oracle Cloud Infrastructure (OCI) networking utilities. These commands are used to manage and troubleshoot networking configurations in environments that interact with OCI.

Here’s a breakdown of each command:

<code>sudo oci-network-config show</code>

* '''Purpose''': This command is used to display the current networking configuration on an OCI instance.
* '''Key Use Cases''':
** Troubleshooting network issues.
** Verifying the current Virtual Network Interface Card (VNIC) configuration, such as private IPs, public IPs, subnet information, and VLANs.
** Ensuring that the instance has the correct IP and routing configurations in a multi-cloud or hybrid setup.

<code>sudo oci-network-config configure</code>

* '''Purpose''': This command is used to reconfigure the networking settings of an instance, typically to make changes or to restore network connectivity.
* '''Key Use Cases''':
** Attaching or detaching secondary VNICs.
** Configuring new IP addresses on existing VNICs.
** Dynamically modifying the network settings after updates to OCI resources like subnets or VLANs.
** Ensuring that instances comply with updated OCI network security rules or routing changes.

Below you will see an example where we will try to run the  <code>sudo oci-network-config show</code> command and we are getting the <code>Cannot show information: Failed to get API session.</code> error.

# Issue the command <code>sudo oci-network-config show</code> to retrieve all network configurations from the instance.
# Notice the error: <code>Cannot show information: Failed to get API session.</code> The information regarding the VNICS of the instance will not be provided on the Operating System Level and not on the OCI level.

[[File:bf0289e8c2203ff2e7c25a9bb20497ee.png|800px]]

This is not possible as we will get the same error when we issue the command <code>oci-network-config show</code> that is <code>Cannot show information: Failed to get API session.</code>

Why are we getting this error?

* A VCN is not an object owned by an instance, which means the instance cannot directly access VCN information without proper authentication.
* To enable the instance to fetch VCN details from the API, you must create a '''dynamic group''' that includes the instance and assign a '''policy''' granting the necessary permissions.

To enable an Oracle Cloud Infrastructure (OCI) instance to fetch Virtual Cloud Network (VCN) details via API, the following steps are typically required:

# '''Create a Dynamic Group''': This dynamic group includes the instance(s) that require access to the API. You define the group using rules based on attributes like instance OCID or compartment.

# '''Assign Permissions with a Policy''': You need to create an Identity and Access Management (IAM) policy that grants the dynamic group permission to read or manage VCN-related resources. For example:

{{console|body=

allow dynamic-group <dynamic-group-name> to read virtual-network-family in compartment <compartment-name>

}}

# '''Use Instance, Principals, for Authentication''': Instances in the dynamic group authenticate directly using their identity, allowing secure API access without embedding credentials in the application. This method simplifies security management while maintaining robust access control.

Let's try it out.

= The Fix =

# Click on the hamburger menu by navigating through '''Compute > Instance''' and click on the compute instance you want to issue the commands <code>sudo oci-network-config show</code> and <code>sudo oci-network-config configure</code> on.
# Click on Show to display the Instance OCID value.
# Click on copy to copy the Instance OCID value.

[[File:fce1b4c5f487448bca90fba88a4d3d88.png|800px]]

# Click on the hamburger menu by navigating through '''Identity > Domains > Default domain > Dynamic groups'''.
# Click on the '''Create dynamic group''' button.

[[File:4c90f08de9f643654acd72d5ca2fc303.png|800px]]

# Specify a '''name''' for the Dynamic group (we will use '''sriov-test-04''')
# Click on '''rule builder'''.

[[File:821cef75e4a9ad85b338d70be42146c2.png|800px]]

# Match instances with '''Instance OCID'''.
# Paste the OCID value of the instance (that we just copied)
# Click on the '''Add rule''' button.

[[File:add22ff2ef1a8af22c58af2f28badb7a.png|800px]]

# Notice that a new rule is added to the group.
# Click on the '''Create''' button.

[[File:ddd6a91a08163f7e9273bd0b755d06a6.png|800px]]

Now that we have the group where the instance is now part of, we need to create a policy inside the compartments where the Instance is part to allow instances in this group to perform operations on VCN objects (like subnets).
In our case, this is <code>oraseemeaocids4 > NETWORK > Iwan</code>

# Click on the hamburger menu by navigating through '''Identity > Compartments'''
# Click on the root compartment (in our case this is oraseemeaocids4).

[[File:8029ad696636e2bfa5d86911313dc79e.png|800px]]

# Notice that we are now in the child compartments.
# Click on the next child compartment (in our case this is NETWORK).

[[File:7a045daf6886a93ac557ca14ca409d61.png|800px]]

# Notice that we are now in the next child's compartments.
# Click on the next child compartment (in our case this is Iwan).

[[File:328a86e7298b2d6753b0d8d30e3faf6c.png|800px]]

# Make sure the right compartment is selected.
# Click on '''Policies'''.
# Click on the '''Create Policy''' button.

[[File:ebfaea69c19e9f8afe06de43aea39cee.png|800px]]

# Specify a '''name''' for the Policy (we will use '''allow-sriov-test-04-to-vcn''').
# Specify a '''description''' for the Policy (we will use '''allow-sriov-test-04-to-vcn''').
# Toggle the '''Show manual editor''' to on.
# Specify the following policy <code>allow dynamic-group sriov-test-04 to manage all resources in compartment Iwan</code>
# Click on the '''Create''' button.

[[File:54864ad428f8797a4a58b2b221979f90.png|800px]]

Notice the new Policy statement inside the newly created policy.

[[File:3ce8877a649e24b4084e11fce76a45ab.png|800px]]

Now that we have allowed the instance to perform API calls (through OCI CLI) to the VCN, let's jump back on the instance.

# Issue the command <code>sudo oci-network-config show</code> to retrieve all network configurations from the instance on the OCI level.
# Notice that the error is now gone and OCI-level network output is provided.
# Also notice that the Operating System level network output is also provided after the OCI level network output.

[[File:341763860f6b6b022c7e9447e2059bbd.png|800px]]

[[Category:Oracle Cloud]]