Oracle Cloud

FlexBlock drives OCI Object Storage through its native API. The grant names the namespace, bucket and prefix, so none of them is passed on the command line.

Credentials

Four principals are supported, selected by OCI_CLI_AUTH using four of the OCI CLI’s values:

OCI_CLI_AUTH	Principal
api_key	The profile in the OCI config file.
security_token	The profile in the OCI config file, which uses a session token when it names a security_token_file.
instance_principal	The compute instance’s own identity.
resource_principal	The resource principal the platform provides, for example in OCI Functions.

When OCI_CLI_AUTH is unset, flexBlock uses:

1. A resource principal, if OCI_RESOURCE_PRINCIPAL_VERSION is set.
2. Otherwise the profile in ~/.oci/config, if that file exists.
3. Otherwise an instance principal.

OCI_CLI_CONFIG_FILE and OCI_CLI_PROFILE choose the config file and profile; the profile defaults to DEFAULT.

Recommended setup: instance principal

On a compute instance the recommended setup is an instance principal. Nothing is installed on the host: the instance certificate that the metadata service issues is exchanged for a short-lived session token that flexBlock renews on its own.

Put the instances in a dynamic group and write a policy in the compartment that holds the bucket. Everything flexBlock does is covered by manage objects, which can be limited to the bucket.

Dynamic group matching rule:

ALL {instance.compartment.id = 'ocid1.compartment.oc1..aaaa'}

Policy statement:

Allow dynamic-group flexblock-hosts to manage objects in compartment data where target.bucket.name = 'acme-data'

Verify the grant and identity together before touching a device:

sudo -E flexblock show --remote

Workstations: API key or session token

A workstation uses an API key instead. oci setup config writes the profile and key pair, and the same policy statement with group in place of dynamic-group grants the user access.

oci session authenticate adds a security_token_file to the profile, which flexBlock honors for the life of the session.

OCI Functions

In OCI Functions the platform sets OCI_RESOURCE_PRINCIPAL_VERSION, OCI_RESOURCE_PRINCIPAL_RPST, OCI_RESOURCE_PRINCIPAL_PRIVATE_PEM and OCI_RESOURCE_PRINCIPAL_REGION. FlexBlock supports version 2.2 with an unencrypted key.

OKE

Caution

OKE workload identity is not supported. On OKE, use an instance principal for the worker nodes.

Region

The grant’s obj_region selects the Object Storage endpoint. When it is empty, the region comes from the profile, the resource principal environment or the instance metadata.

Encryption at rest

Server-side encryption on OCI Object Storage is provider managed. FlexBlock has no encryption setting for OCI; the --s3-sse and --s3-no-sse flags apply to S3 only.

Checksums

Every chunk object is uploaded with an MD5 checksum that Object Storage verifies, and verified again by flexBlock on download.

Related

• Credentials
• Licensing: the grant fields that address the bucket.