feat: oracle join tokens scoped to specific instance IDs#60888
feat: oracle join tokens scoped to specific instance IDs#60888
Conversation
nklaassen
temporarily deployed
to
docs-amplify
GitHub Actions
Inactive
|
Amplify deployment status
|
nklaassen
temporarily deployed
to
docs-amplify
GitHub Actions
Inactive
| repeated string Regions = 3 [(gogoproto.jsontag) = "regions,omitempty"]; | ||
| // Instances is a list of the OCIDs of specific instances that are allowed | ||
| // to join. If empty, any instance matching the other fields in the rule is allowed. | ||
| repeated string Instances = 4 [(gogoproto.jsontag) = "instances,omitempty"]; |
There was a problem hiding this comment.
Is there an upper bound that we will enforce?
There was a problem hiding this comment.
on the length of this list? I haven't put an explicit upper bound. This field is also within a list of oracle allow rules with no explicit length limit. I'm not sure a list is even the best option tbh, I think this would mostly be useful for
a) automation that creates a token for a specific instance
b) some sort of discover flow for a adding a single oci instance
@rosstimothy what do you think, I could make it a single string per oracle allow rule? or add some arbitrary upper bound like 100
There was a problem hiding this comment.
Hrm good question. From a UX perspective it seems like a single rule which limits N instances in the same compartment, regions, etc would be less work than a new rule per instance.
If we don't enforce any limitations here, gRPC will eventually do that for us.
There was a problem hiding this comment.
added an explicit cap of 100 instance IDs per rule
nklaassen
force-pushed
the
nklaassen/oracle-cache
branch
from
79fb7ee to
9cfd08f
Compare
nklaassen
force-pushed
the
nklaassen/oracle-instance
branch
from
fd35ac3 to
8c6fe5d
Compare
nklaassen
temporarily deployed
to
docs-amplify
GitHub Actions
Inactive
nklaassen
temporarily deployed
to
docs-amplify
GitHub Actions
Inactive
nklaassen
temporarily deployed
to
docs-amplify
GitHub Actions
Inactive
nklaassen
force-pushed
the
nklaassen/oracle-instance
branch
from
703be6e to
ebab773
Compare
nklaassen
temporarily deployed
to
docs-amplify
GitHub Actions
Inactive
Backport #60888 to branch/v18
Backport #60888 to branch/v18
Backport #60888 to branch/v18
* feat: oracle join tokens scoped to specific instance IDs * validate instance ID and cap at 100 per rule
* feat: oracle join tokens scoped to specific instance IDs * validate instance ID and cap at 100 per rule
3 participants
This PR enables oracle join tokens to specify exact instance IDs that should be allowed to join. This gets feature parity with our IAM join method, which allows specifying the exact ARN of the IAM identities allowed to join.
I'll add docs in a following PR.
changelog: Added an option to restrict Oracle join tokens to specific instance IDs