metadata: add Oracle Cloud IMDSv2 service#205
Open
chl117 wants to merge 1 commit into
Open
Conversation
OCI IMDSv2 exposes instance metadata under /opc/v2 and requires an Authorization: Bearer Oracle header on every request [1]. Cloudbase-Init does not have an OCI-specific metadata provider, so it cannot use the OCI IMDSv2 endpoints when legacy IMDSv1 access is disabled. Add OracleCloudService to retrieve the instance ID, hostname, and base64-encoded user data. Add the required authorization header through the service's HTTP request override, following the existing GCE and MaaS patterns. Register the related oraclecloud configuration options and add unit-test coverage for service loading, request headers, and metadata retrieval. [1] https://docs.oracle.com/en-us/iaas/Content/Compute/Tasks/gettingmetadata.htm AI-assisted contribution: I reviewed the change and submit it under the DCO terms at https://github.com/cloudbase/cloudbase-init/blob/master/DCO#L16 (clause (a) — the contribution is mine). Signed-off-by: Lucas Quinney <lucas.quinney@oracle.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Cloudbase-Init did not have a native Oracle Cloud Infrastructure metadata service. OCI Instance Metadata Service v2 exposes metadata under
/opc/v2/and requires every request to include:Without an OCI-specific provider, Cloudbase-Init cannot retrieve OCI metadata through IMDSv2 when legacy IMDSv1 access is disabled. Metadata-dependent operations such as retrieving the instance ID, configuring the hostname, and processing user data are therefore unavailable.
This PR adds
OracleCloudService, which:oraclecloudconfiguration group.The authorization header is added by overriding the service’s HTTP request method, following the existing GCE and MaaS provider patterns. No shared metadata base-class changes are required.
How to reproduce
Launch a Windows instance in OCI with legacy IMDSv1 access disabled.
Configure Cloudbase-Init to use:
An unauthenticated request to the following IMDSv2 endpoint is rejected:
The same request succeeds when it includes:
OCI documents the IMDSv2 endpoints and authorization requirement here:
https://docs.oracle.com/en-us/iaas/Content/Compute/Tasks/gettingmetadata.htm
Test plan
New unit tests cover:
Oracle service tests:
Full Python test suite:
Repository-wide lint:
flake8 # PassedDCO sign-off on the commit.
Related