Skip to content

Oracle Cloud (OCI) integration

Connect DXDT to Oracle Cloud Infrastructure (OCI) using an API signing key for a least-privilege user, so DXDT can run read-only oci CLI commands for SRE and FinOps insight.
Setup time ~20 minutes
Difficulty Advanced

Access required: OCI Identity administrator access to create/select a user, add an API key, and (recommended) place the user in a read-only group with an inspect/read policy.

Prerequisites

  • An OCI tenancy you want DXDT to observe.
  • A least-privilege IAM user with a read-only policy (for example Allow group <ro-group> to inspect all-resources in tenancy).
  • The ability to generate an API signing key pair (PEM).

Setup

1. Create or select a read-only OCI user

In the OCI Console → Identity & Security → Users, create (or pick) a dedicated user such as dxdt-readonly. Place it in a group whose policy grants only read/inspect access (for example inspect / read verbs). Copy the user's OCID for user_ocid.

2. Generate an API signing key

On the user's page, open API keys → Add API key. Let OCI generate a key pair (or upload your own public key). Download the private key PEM and note the generated fingerprint.

  • Download the private key PEM (keep it secret).
  • Copy the Fingerprint shown after upload → fingerprint.
  • Copy your Tenancy OCID from Tenancy details → tenancy_ocid.
  • Note your home/region identifier (for example us-ashburn-1) → region.

3. Enter the single-profile configuration in DXDT

Open the oraclecloud plugin and fill User OCID (user_ocid), Tenancy OCID (tenancy_ocid), API Key Fingerprint (fingerprint), and Region (region). Paste the whole PEM into API Private Key (PEM) (private_key) — this is a textarea, so paste the entire block including the -----BEGIN PRIVATE KEY----- / -----END PRIVATE KEY----- lines. If the key is encrypted, also enter its passphrase (passphrase).

Note

DXDT is stateless: it materialises a temp OCI config + key file per request, runs the oci command, then deletes it.

4. Optional: configure multiple profiles

For multiple tenancies or identities, use the profiles map: each named profile holds its own user_ocid, tenancy_ocid, fingerprint, region, and private_key (plus optional passphrase). Target a profile at query time with profile=NAME <cmd>; the synthetic list profiles command shows what is configured.

Configuration fields

Field Where to find it
Tenancy OCID (tenancy_ocid) Tenancy details page → OCID (ocid1.tenancy.oc1...).
User OCID (user_ocid) Identity → Users → (your read-only user) → OCID (ocid1.user.oc1...).
Profiles (multi-tenancy) (profiles) Optional map of name → {user_ocid, tenancy_ocid, fingerprint, region, private_key, passphrase}; used when observing multiple tenancies. Single-tenancy configs use the flat fields (fingerprint, region, private_key, optional passphrase) directly.

Verify the connection

After saving, open the plugin Status view (or run the synthetic list profiles / an oci os ns get auth-check). A healthy connection shows tenancy info and returns the object-storage namespace without a signing error.

Security

DXDT runs only read-only oci CLI commands and materialises the key to a temp file per request on a stateless service, deleting it immediately after. Use a least-privilege user restricted to inspect/read verbs — never grant manage or admin. The private_key (and passphrase) are pasted whole into secret/textarea fields and stored encrypted.

Troubleshooting

NotAuthenticated / 401 on every command

The fingerprint does not match the uploaded public key, or the private_key PEM is incomplete. Re-copy the fingerprint shown in API keys and paste the full PEM (all lines, no truncation) into the private_key textarea.

Can't decode private key or passphrase error

The PEM is passphrase-protected but no passphrase was supplied, or the wrong passphrase was entered. Enter the correct value in the passphrase field, or regenerate an unencrypted key.

Auth works but resource lists are empty / NotAuthorized

The user's group policy is too narrow. Grant a read/inspect policy (for example Allow group <ro-group> to inspect all-resources in tenancy) — read-only is sufficient.

Wrong-region errors or nothing returned

The region identifier is incorrect for the target resources. Set region to the correct OCI region key (for example us-ashburn-1); for multiple regions/tenancies use the profiles map.

Vendor documentation: https://docs.oracle.com/en-us/iaas/Content/API/Concepts/apisigningkey.htm