Skip to content

Commit 3d83b09

Browse files
RahulMR42RahulMR42
authored
Merge pull request #8 from oracle-devrel/configs
Configs
2 parents d50d6c1 + ffa2742 commit 3d83b09

File tree

3 files changed

+213
-1
lines changed

3 files changed

+213
-1
lines changed

‎README.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ The service also provides private Git repositories to store your code and it sup
1515
- [OCI Devops Build service - samples](./oci-build-examples/README.md)
1616
- [OCI Devops Deployment service - samples](./oci-deployment-examples/README.md)
1717
- [OCI Source Code Management service - sample](./oci-coderepo-examples/README.md)
18+
- [OCI Devops Policies and Groups - sample](./oci-config-examples/README.md)
1819

1920
## Instruction to clone a specific example.
2021

@@ -60,4 +61,4 @@ Licensed under the Universal Permissive License (UPL), Version 1.0.
6061

6162
See [LICENSE](LICENSE) for more details.
6263

63-
ORACLE AND ITS AFFILIATES DO NOT PROVIDE ANY WARRANTY WHATSOEVER, EXPRESS OR IMPLIED, FOR ANY SOFTWARE, MATERIAL OR CONTENT OF ANY KIND CONTAINED OR PRODUCED WITHIN THIS REPOSITORY, AND IN PARTICULAR SPECIFICALLY DISCLAIM ANY AND ALL IMPLIED WARRANTIES OF TITLE, NON-INFRINGEMENT, MERCHANTABILITY, AND FITNESS FOR A PARTICULAR PURPOSE. FURTHERMORE, ORACLE AND ITS AFFILIATES DO NOT REPRESENT THAT ANY CUSTOMARY SECURITY REVIEW HAS BEEN PERFORMED WITH RESPECT TO ANY SOFTWARE, MATERIAL OR CONTENT CONTAINED OR PRODUCED WITHIN THIS REPOSITORY. IN ADDITION, AND WITHOUT LIMITING THE FOREGOING, THIRD PARTIES MAY HAVE POSTED SOFTWARE, MATERIAL OR CONTENT TO THIS REPOSITORY WITHOUT ANY REVIEW. USE AT YOUR OWN RISK.
64+
ORACLE AND ITS AFFILIATES DO NOT PROVIDE ANY WARRANTY WHATSOEVER, EXPRESS OR IMPLIED, FOR ANY SOFTWARE, MATERIAL OR CONTENT OF ANY KIND CONTAINED OR PRODUCED WITHIN THIS REPOSITORY, AND IN PARTICULAR SPECIFICALLY DISCLAIM ANY AND ALL IMPLIED WARRANTIES OF TITLE, NON-INFRINGEMENT, MERCHANTABILITY, AND FITNESS FOR A PARTICULAR PURPOSE. FURTHERMORE, ORACLE AND ITS AFFILIATES DO NOT REPRESENT THAT ANY CUSTOMARY SECURITY REVIEW HAS BEEN PERFORMED WITH RESPECT TO ANY SOFTWARE, MATERIAL OR CONTENT CONTAINED OR PRODUCED WITHIN THIS REPOSITORY. IN ADDITION, AND WITHOUT LIMITING THE FOREGOING, THIRD PARTIES MAY HAVE POSTED SOFTWARE, MATERIAL OR CONTENT TO THIS REPOSITORY WITHOUT ANY REVIEW. USE AT YOUR OWN RISK.

‎oci-config-examples/README.md

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
All about OCI devops deployment samples ..
2+
=======
3+
4+
<details>
5+
<summary>Policies & Groups - click to expand</summary>
6+
7+
* [Devops related policies and groups](./oci-devops-policies-groups/)
8+
9+
</details>
10+
11+
12+
### Back to examples.
13+
----
14+
15+
- 🏝️ [Back to OCI Devops sample](../README.md)

‎oci-config-examples/oci-devops-policies-groups/README.md

Lines changed: 196 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,196 @@
1+
Sample illustrations of `dynamic groups` and `policies` requirements for `OCI Devops` and few connected OCI services.
2+
3+
----------
4+
5+
### ❗ Attention please:
6+
7+
- All these samples are written with a sample dynamic groups,please change accordingly.
8+
- All the policies are using verbs * manage or use * which are powerfull , you may alter with other verbs( read,inspect) as accordingly.
9+
- Use the [References](https://github.com/oracle-devrel/oci-devops-examples/oci-config-examples/oci-devops-policies-groups#-references) section to read more about fine grain controls.
10+
11+
12+
* Specific instruction to clone only this example.
13+
14+
```
15+
$ git init oci-devops-policies-groups
16+
$ cd oci-devops-policies-groups
17+
$ git remote add origin https://github.com/oracle-devrel/oci-devops-examples
18+
$ git config core.sparsecheckout true
19+
$ echo "oci-config-examples/oci-devops-policies-groups/*">>.git/info/sparse-checkout
20+
$ git pull --depth=1 origin main
21+
22+
```
23+
24+
<!-- All about user groups -->
25+
26+
### ✔️ User Groups
27+
28+
<details>
29+
<summary>Devops Pipeline (OCI Repo + Build + Deploy) - Click to expand</summary>
30+
31+
- Create relevant users and all the devops users to the user group (One group is minimum).
32+
- You may use `Administrator` group for devops ,however better to create a specific user group to have better control.
33+
- For further controls ,you may create different user groups like `devops-admins`,`devops-users`,`devops-validators` etc.
34+
- Documentation
35+
- How to create user groups - https://docs.oracle.com/en-us/iaas/Content/Identity/Tasks/managinggroups.htm#three
36+
- How to add users to user groups - https://docs.oracle.com/en-us/iaas/Content/devops/using/getting_started.htm#prereq
37+
38+
</details>
39+
40+
<!-- All about dynamic groups -->
41+
42+
### ✔️ Dynamic Groups
43+
44+
<details>
45+
<summary>Devops Pipeline (OCI Repo + Build + Deploy) - Click to expand</summary>
46+
47+
- Create dynamic group (EG: dg-compartmentname-buildpipeline)for your build pipeline with below rule.
48+
49+
```
50+
ALL {resource.type = 'devopsbuildpipeline', resource.compartment.id = 'compartmentOCID'}
51+
52+
```
53+
- Create dynamic group (EG: dg-compartmentname-deploymentpipeline)for your deployment pipeline with below rule.
54+
55+
```
56+
All {resource.type = 'devopsdeploypipeline', resource.compartment.id = 'compartmentOCID'}
57+
```
58+
59+
- Create dynamic group (Ef: dg-compartmentname-coderepo) for your coderepo with below rule.
60+
61+
```
62+
ALL {resource.type = 'devopsrepository', resource.compartment.id = 'compartmentOCID'}
63+
```
64+
65+
</details>
66+
67+
<details>
68+
<summary>Devops deployment pipeline with OCI instances - Click to expand</summary>
69+
70+
- Create a dynamic group (Eg: dg-compartmentname-computeinstances) to group all the instances with below rule.
71+
72+
```
73+
All {instance.compartment.id = 'compartmentOCID'}
74+
```
75+
</details>
76+
77+
<details>
78+
<summary>Devops Connection - For external code repos (Github,Gitlab etc) - Click to expand</summary>
79+
80+
- Create a dynamic group (Eg: dg-compartmentname-devopsconnection) for devops connection with below rule.
81+
82+
```
83+
ALL {resource.type = 'devopsconnection', resource.compartment.id = 'compartmentOCID'}
84+
```
85+
86+
</details>
87+
88+
<details>
89+
<summary>Use OCI functions with other OCI services (like use vault from functions etc) - Click to expand</summary>
90+
91+
- Create a dynamic group (Eg: dg-compartmentname-functions) to group all the instances with below rule.
92+
93+
```
94+
ALL {resource.type = 'fnfunc', resource.compartment.id = 'compartmentOCID'}
95+
```
96+
97+
</details>
98+
99+
<details>
100+
<summary>Use OCI Gateway with other OCI services (Functions etc) - Click to expand</summary>
101+
102+
- Create a dynamic group (Eg: dg-compartmentname-gateways) to group all the gateways with below rule.
103+
104+
```
105+
ALL {resource.type = 'ApiGateway', resource.compartment.id = 'ocid1.compartment.oc1..xx'}
106+
```
107+
108+
</details>
109+
110+
111+
<!-- All about policies -->
112+
113+
### ✔️ Policies
114+
<details>
115+
<summary>OCI Users - Click to expand</summary>
116+
117+
| Use case | OCI Services | Statement |
118+
| :--- | :--- | :--- |
119+
|Allow a specifc user group to manage devops services |User groups,Devops|```Allow group devops-admins to manage devops-family ```|
120+
121+
</details>
122+
123+
<details>
124+
<summary>OCI Build pipeline - Click to expand</summary>
125+
126+
| Use case | OCI Services | Statement |
127+
| :--- | :--- | :--- |
128+
| Deliver artifacts with container registry from Build pipeline | Build pipeline , Container registry | ``` Allow dynamic-group dg-compartmentname-buildpipeline to manage repos in compartment <compartment_name> ``` |
129+
|Use Vault or Personal Access token (GITHUB/GITLAB etc) with Build piepline |Build pipeline,Vault,Connection|```Allow dynamic-group dg-compartmentname-buildpipeline to read secret-family in compartment <compartment_name> ```|
130+
|Use OCI Code repo or Invoke deployment from Build pipeline|Build pipeline,Cod repo,Deploy pipeline|```Allow dynamic-group dg-compartmentname-buildpipeline to manage devops-family in compartment <compartment_name> ```|
131+
|Use Artifact repo with buildpipeline|Buildpipeline,Artifact registry|``` Allow dynamic-group dg-compartmentname-buildpipeline to manage generic-artifacts in compartment <compartment_name>```|
132+
|Send notifications from buildpipeline|Build pipeline,Notification|```Allow dynamic-group dg-compartmentname-buildpipeline to use ons-topics in compartment <compartment_name> ```
133+
134+
</details>
135+
136+
<details>
137+
<summary>OCI Deployment pipeline - Click to expand</summary>
138+
139+
| Use case | OCI Services | Statement |
140+
| :--- | :--- | :--- |
141+
|Allow various resources (like VM/OKE etc) to use by deployment pipeline for deployments|Deployment pipeline,OCI resources|```Allow dynamic-group dg-compartmentname-deploymentpipeline to manage all-resources in compartment <compartment name> ```|
142+
|Deploy application to instances|Deploy pipeline,Compute,Compute agents|```Allow dynamic-group dg-compartmentname-computeinstances to use instance-agent-command-execution-family in compartment <compartment_name>```;```Allow dynamic-group dg-compartmentname-computeinstances to read generic-artifacts in compartment <compartment_name> ```|
143+
|Use artifacts from deployment pipeline|Deployment pipeline,Artifiact registry|```Allow dynamic-group dg-compartmentname-deploymentpipeline to read all-artifacts in compartment <compartment_name> ```
144+
145+
146+
</details>
147+
<details>
148+
<summary>OCI Code repo & External repos - Click to expand</summary>
149+
150+
| Use case | OCI Services | Statement |
151+
| :--- | :--- | :--- |
152+
|Use OCI code repo for oci devops|Code repo,Build pipeline|```Allow dynamic-group dg-compartmentname-coderepo to manage devops-family in compartment <compartment_name> ```|
153+
|OCI Code repo to access resources with in the compartment|Code repo,OCI Resources|```Allow dynamic-group dg-compartmentname-coderepo to manage all-resources in tenancy ```|
154+
|Allow external code repos(Github,Gitlab) connection via Personal Access Token(PAT)|Connection,Vault|```Allow dynamic-group dg-compartmentname-devopsconnection to read secret-family in compartment <compartment name>(Create this policy under tenancy's root) ```|
155+
156+
</details>
157+
158+
<details>
159+
<summary>OCI functions - Click to expand</summary>
160+
161+
| Use case | OCI Services | Statement |
162+
| :--- | :--- | :--- |
163+
|Use vault with OCI functions|Functions,Secrets|``` allow dynamic-group dg-compartmentname-functions to manage secret-family in compartment <compartment name>;allow dynamic-group dg-compartmentname-functions to manage vault in compartment <compartment name>;allow dynamic-group dg-compartmentname-functions to manage keys in compartment <compartment name> ```|
164+
|Function read from repos for deployment|Functions,Repos|```Allow service FaaS to read repos in compartment <compartment name> ```|
165+
|Function to manage resources|Function ,Resources|```Allo dynamic-group dg-compartmentname-functions to manage all-resources in compartment <compartment name> ```|
166+
</details>
167+
168+
<details>
169+
<summary>OCI gateway - Click to expand</summary>
170+
171+
| Use case | OCI Services | Statement |
172+
| :--- | :--- | :--- |
173+
|Use gateway with Functions|Function,Gateway|``` Allow dynamic-group dg-compartmentname-gateway to use functions-family in compartment <compartment name> ```|
174+
</details>
175+
176+
<!-- All about references -->
177+
178+
### 📕 References
179+
180+
- Devops policies - OCI Documentation - [link](https://docs.oracle.com/en-us/iaas/Content/devops/using/devops_iampolicies.htm#devops_iam_policies)
181+
182+
- Fine grained access to a specific component and actions - [link](https://docs.oracle.com/en-us/iaas/Content/devops/using/devops_iampolicies.htm#policy-details)
183+
184+
185+
Contributors
186+
===========
187+
188+
- Author : Rahul M R.
189+
- Collaborators : NA
190+
- Last release : Apr 2022
191+
192+
### Back to examples.
193+
----
194+
195+
- 🍿 [Back to OCI Devops Config sample](./../README.md)
196+
- 🏝️ [Back to OCI Devops sample](./../../README.md)

0 commit comments

Comments
 (0)