Oracle Cloud Infrastructure

An OCI resource handler connects to a single Oracle Cloud region and manages its servers and images

  4 minute read  

Cloud Management Platform (CMP) authenticates to OCI with an API signing key rather than a password, so set the key up in Oracle Cloud before adding the handler. Oracle Linux images also disable password-based authentication, so plan to use SSH keys to access provisioned servers.

Before you begin

Collect the following from Oracle Cloud. The credentials dialog needs all of it, so keep it to hand:

  • The region to connect to.
  • Your user OCID and tenancy OCID, and the compartment OCID if you want the handler scoped to one compartment and its sub-compartments.
  • An API signing key in PEM format, its fingerprint, and its passphrase if set. Manage an OCI server with SSH keys below generates a key pair you can use for this.

Add an OCI resource handler

  1. Go to Admin > Resource Handlers, select Add, then select Oracle Cloud Infrastructure, under Public Cloud.
  2. Fill in the credentials dialog and select Continue.
  3. Enter a name and an optional description, then select Done.
Field Description
Region Required. The OCI region this handler connects to.
User OCID Required. The OCID of the user the API signing key belongs to.
Certificate Fingerprint Required. The fingerprint OCI shows after you upload the public key.
Key File Required. Paste the private key in PEM format.
Passphrase The passphrase protecting the private key. Leave it empty if the key has none.
Tenancy OCID Required. The OCID of your tenancy.
Compartment OCID Optional. Scopes the handler to this compartment and its sub-compartments: environments offer only those compartments, and VM, image, and network discovery follow them. If empty, CMP uses the tenancy.

OCI parameters

The following parameters are imported and may appear on the order form:

Parameter Description
Compartment Required. The compartment to provision into.
Shape Required. The instance shape, which sets the server’s size. The list narrows to the shapes the selected OS build’s image supports.
Availability Domain Required. The availability domain to deploy into. The list narrows to the domains available for the selected network.
Fault Domain The fault domain within the availability domain. The list narrows once an availability domain is chosen.
Network Security Groups The network security groups to apply. More than one can be selected, and the list narrows to the groups available for the selected network.
Assign Public IP Gives the instance a public IP address.
OCPUs The number of OCPUs, which only flexible shapes use. The field appears on the order form only when the selected shape is flexible.
Memory (GB) The memory in GB, which only flexible shapes use. The field appears on the order form only when the selected shape is flexible.

Manage an OCI server with SSH keys

OCI Oracle Linux images disable password authentication, so give CMP an SSH key to place on the servers it builds. There are five steps: generate a key pair, add the public key to OCI, add the private key to CMP, create an OS build for your image, then point the image at the key.

1. Generate a key pair in PEM format

From your terminal, run the following. CMP cannot read a passphrase-protected SSH key, so generate the key without one.

openssl genrsa -out oci_api_key.pem 2048
openssl rsa -pubout -in oci_api_key.pem -out oci_api_key_public.pem
cat oci_api_key_public.pem

The last command prints the public key, which you need in the next step. You add the private key, oci_api_key.pem, to CMP in step 3.

2. Add the public key to OCI

  1. Log in to the OCI portal at cloud.oracle.com.
  2. Open User Settings from the profile menu at the top right.
  3. Select Add Public Key and paste in the public key.
  4. Keep the key fingerprint and the user OCID as shown by OCI. Both are required for the credentials dialog.

3. Add the private key to CMP

  1. Go to Admin > SSH Keys and select New SSH Key.
  2. Enter a Global Key Name, and paste the contents of oci_api_key.pem from step 1 into Key material. CMP requires PEM format.

4. Create an OS build for your OCI image

  1. Go to Admin > OS Builds and select Add.
  2. Give it a name, a description, and an OS family if applicable, then select Add. CMP opens the new OS build.
  3. On the Overview tab, select Edit, choose your OCI environment under Environments, and select Save changes.
  4. Open the Images tab and add your image.

5. Specify the image user and SSH key

  1. Open your OCI resource handler and select the Images tab.
  2. Select the edit icon under Credentials for your image.
  3. Set the username to opc, the default user on Oracle Linux images.
  4. In Key name, select the key you added in step 3, then select Save.
  • Resource handlers: the technologies CMP connects to, and how to add one.
  • SSH keys: how CMP stores key material and which handlers use it.
  • OS Builds: how an OS build maps an image to an environment.