OCI tech-specific script execution

Run ad hoc scripts on OCI instances using OCI’s native command execution mechanism

3 minute read

In Cloud Management Platform (CMP), this is an alternative to SSH, controlled by a server parameter. When enabled, ad hoc scripts are executed by the Oracle Cloud Agent running on the instance rather than over an SSH connection.

This method provides additional security; however, due to the Oracle Cloud Agent’s polling interval, it is slower than SSH.

How it works

The Oracle Cloud Agent polls for queued commands approximately every 90 seconds. When CMP submits a script to run on an OCI server with tech-specific script execution enabled, the command is added to the Oracle Cloud Agent’s queue. The agent picks up the command on its next poll, executes the script, and returns the output.

Prerequisites

Before using tech-specific script execution, ensure the following are in place:

SSH key

An SSH key must be associated with the image used to provision the server. Servers provisioned from that image inherit the key.

Create an SSH key

Open a terminal and run:

ssh-keygen -t rsa -b 4096 -m PEM -f ~/.ssh/cloudbolt_oci -C "cloudbolt-oci"

Display and copy the private key value:
```
cat ~/.ssh/cloudbolt_oci
```

Add the private key to CMP

Go to Admin > SSH Keys.
Select New SSH Key.
Provide a name and paste the key material.
Select Add.

Associate the key with the image

Go to the OCI resource handler.
Open the Images tab.
Under Credentials for an image, select to add or edit credentials.
Provide the Username.

CMP will attempt to use this username when performing actions on servers provisioned using this image.
Leave the Password field empty.
Under Key name, select the SSH key.
Select Save.

Public IP address

A public IP address is required on the instance to install the Oracle Cloud Agent.

Server compartment

OCI does not allow tech-specific script execution on instances in the root compartment.

To use OCI’s native command execution mechanism, instances must be in a sub-compartment. Running scripts via SSH will still work at the root level.

Oracle Cloud Agent

For existing servers provisioned without an SSH key, you must have an alternative means of SSH access before installing the Oracle Cloud Agent.

The instance must have the Oracle Cloud Agent installed and running. SSH into the instance using the key pair assigned to its image, then run the following:

# Install the agent
sudo yum install -y oracle-cloud-agent

# Enable and start
sudo systemctl enable oracle-cloud-agent
sudo systemctl start oracle-cloud-agent

# Verify
sudo systemctl status oracle-cloud-agent

Enable tech-specific script execution

Enable the Use Tech-Specific Script Execution parameter at the server or environment level.

Server level

Enable the parameter on existing servers.

Locate the server in CMP.
Open the Parameters tab.
Select Add.
Locate the Use Tech-Specific Script Execution parameter.
Select the parameter, then select Next.
Set the value to True and select Save.

Environment level

Enable the parameter at the environment level to automatically apply it to new servers provisioned in that environment.

Go to Admin > Environments.
Select the environment.
Open the Parameters tab.
Select Add.
Locate and select the Use Tech-Specific Script Execution parameter.
Select Add.
Under Options, select to edit the parameter options.
Select True from the dropdown, then select Add option.
Select Save.

Run an ad hoc script

Go to the server in CMP.
Select Ad Hoc Script.
Enter your script (for example, whoami or date).
Select Run.

CMP checks the job state every 10 seconds. Expect up to 3 minutes for the job to complete. States progress from Visible → Accepted → Acknowledged → Succeeded / Failed. Script output is available once the job reaches Succeeded.