Packer HCP Packer "HCP_CLIENT_ID" credentials missing in CI

By Daniel Zoghalchali·Latchkey

When a template registers image metadata with the HCP Packer registry, Packer authenticates using HCP_CLIENT_ID and HCP_CLIENT_SECRET. Missing service principal credentials fail the registry push.

What this error means

packer build fails registering to HCP Packer with a message that HCP_CLIENT_ID / HCP_CLIENT_SECRET are required or that authentication to the HCP registry failed.

Error: failed to authenticate to HCP: HCP_CLIENT_ID and HCP_CLIENT_SECRET must be
set to push metadata to the HCP Packer registry.

Common causes

HCP service principal credentials not injected

The workflow enabled HCP Packer registration but never set HCP_CLIENT_ID and HCP_CLIENT_SECRET from secrets.

A missing or wrong bucket / channel

The hcp_packer_registry block names a bucket or channel the principal cannot access, so registration is rejected.

How to fix it

Set the HCP service principal credentials

1. Create an HCP service principal with access to the bucket.
2. Set HCP_CLIENT_ID and HCP_CLIENT_SECRET from CI secrets.
3. Run packer build so registration authenticates.

env:
  HCP_CLIENT_ID: ${{ secrets.HCP_CLIENT_ID }}
  HCP_CLIENT_SECRET: ${{ secrets.HCP_CLIENT_SECRET }}
steps:
  - run: packer build .

Confirm the bucket and channel

Set the hcp_packer_registry bucket name and ensure the principal can write to that channel.

build {
  hcp_packer_registry {
    bucket_name = "app-base-image"
    description = "Base image for app runners"
  }
}

How to prevent it

• Store HCP client id and secret in CI secrets and export them.
• Grant the service principal access to the target bucket.
• Name the bucket and channel explicitly in the registry block.

Frequently asked questions

Related guides

References

• Terraform documentation
• GitHub Actions documentation