You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Many OCI AI Blueprints users choose to give full admin access to OCI AI Blueprints when using it for the first time or developing a POC, and making the permissions more granular overtime. We provide you with two different variations of IAM Policies for you to choose from - depending on your situation.
4
4
5
-
## Step 1: Create Dynamic Group in Identity Domain
5
+
To learn more details about the policy breakdowns, see the relevant sections below in the [Detailed Policy Breakdown](#detailed-policy-breakdown):
### Step 1: Create Dynamic Group in Identity Domain
6
13
7
14
Inside the OCI console:
8
15
@@ -23,86 +30,195 @@ All {instance.compartment.id = '<oci-ai-blueprints_compartment_ocid>'}
23
30
24
31
More info on dynamic groups can be found here: https://docs.oracle.com/en-us/iaas/Content/Identity/dynamicgroups/To_create_a_dynamic_group.htm
25
32
26
-
## Step 2: Add IAM Policies To Root Compartment
33
+
###Step 2: Add IAM Policies To Root Compartment
27
34
28
-
-**Note:**`'IdentityDomainName'/'DynamicGroupName'` -> please modify this to match the dynamic group that you created in Step 1 above
35
+
The Quickstart takes the approach of giving Blueprints full admin policies. If you would like to narrow the policies down, visit the [detailed policy breakdown](#detailed-policy-breakdown) section below.
36
+
37
+
-**Note:**`'Default'/'DynamicGroupName'` -> please modify this to match the dynamic group that you created in Step 1 above
29
38
-**Note:** All these policies will be in the root compartment of your tenancy (NOT in the OCI AI Blueprints compartment itself)
30
39
-**Note:** If you are not an admin of your tenancy, then you will need to have an admin add the following policies for the dynamic group AND the user group that your user belongs if you are the one that will be deploying OCI AI Blueprints (aka you will have the admin create the policies below twice - once for the dynamic group you created in Step 1 and once for the user group that your user belongs to)
31
40
32
-
**Option #1: Full Admin Access:**
33
-
34
41
```
35
-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to inspect all-resources in tenancy
36
-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to manage all-resources in compartment {comparment_name}
37
-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to {CLUSTER_JOIN} in compartment {compartment_name}
38
-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to manage volumes in TENANCY where request.principal.type = 'cluster'
39
-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to manage volume-attachments in TENANCY where request.principal.type = 'cluster'
42
+
Allow dynamic-group 'Default'/'DynamicGroupName' to inspect all-resources in tenancy
43
+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage all-resources in compartment My-Compartment
44
+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage volumes in TENANCY where request.principal.type = 'cluster'
45
+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage volume-attachments in TENANCY where request.principal.type = 'cluster'
40
46
```
41
47
42
-
**Option #2: Fine-Grain Access:**
48
+
----
49
+
## Detailed Policy Breakdown
50
+
51
+
The detailed policy breakdown takes the approach of enabling you to provide exactly the policies you need for both stack creation and feature usage. Therefore, this section is split into two parts:
-`GetNodePoolOptions/all` - API used to determine images available for nodes, requires `inspect all-resources in tenancy`.
71
+
72
+
#### Bring your own network policies
73
+
Because we are not creating the virtual network, policy usage can be minimized to "read" permissions on several of the virtual network family members compared to the create policies. The required policies are:
74
+
75
+
**Note**: 'Default' is the "default" identity domain, and 'DynamicGroupName' is the name of your dynamic group. 'Dennis-Compartment' is an example compartment name. If using nested compartments, the syntax is: Dennis-Compartment:Dennis-ChildA:Dennis-ChildB
43
76
44
77
```
45
-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to inspect all-resources in tenancy
78
+
Allow dynamic-group 'Default'/'DynamicGroupName' to inspect all-resources in tenancy
79
+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage clusters in compartment Dennis-Compartment
80
+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage cluster-node-pools in compartment Dennis-Compartment
81
+
Allow dynamic-group 'Default'/'DynamicGroupName' to read virtual-network-family in compartment Dennis-Compartment
82
+
Allow dynamic-group 'Default'/'DynamicGroupName' to use subnets in compartment Dennis-Compartment
83
+
Allow dynamic-group 'Default'/'DynamicGroupName' to use vnics in compartment Dennis-Compartment
84
+
Allow dynamic-group 'Default'/'DynamicGroupName' to use network-security-groups in compartment Dennis-Compartment
85
+
Allow dynamic-group 'Default'/'DynamicGroupName' to use private-ips in compartment Dennis-Compartment
86
+
Allow dynamic-group 'Default'/'DynamicGroupName' to read cluster-work-requests in compartment Dennis-Compartment
87
+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage instance-family in compartment Dennis-Compartment
88
+
```
46
89
47
-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to manage compute-capacity-reports in tenancy
90
+
#### Create your network policies
91
+
To additionally create the virtual network the policies become a bit more open as the `manage` verb encompasses all of the `use` policies above, plus a few more permissions:
92
+
```
93
+
Allow dynamic-group 'Default'/'DynamicGroupName' to inspect all-resources in tenancy
94
+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage clusters in compartment Dennis-Compartment
95
+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage cluster-node-pools in compartment Dennis-Compartment
96
+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage virtual-network-family in compartment Dennis-Compartment
97
+
Allow dynamic-group 'Default'/'DynamicGroupName' to read cluster-work-requests in compartment Dennis-Compartment
98
+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage instance-family in compartment Dennis-Compartment
99
+
```
48
100
49
-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to manage instance-family in compartment {compartment_name}
101
+
### Blueprints App Stack Creation Policies
50
102
51
-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to use subnets in compartment {compartment_name}
103
+
Blueprints needs to use the cluster, the virtual network, inspect node pools, create and attachvolumes, and create a load balancer.
104
+
```
105
+
Allow dynamic-group 'Default'/'DynamicGroupName' to inspect all-resources in tenancy
106
+
Allow dynamic-group 'Default'/'DynamicGroupName' to use virtual-network-family in compartment Dennis-Compartment
107
+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage volumes in compartment Dennis-Compartment
108
+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage volume-attachments in compartment Dennis-Compartment
109
+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage load-balancers in compartment Dennis-Compartment
110
+
Allow dynamic-group 'Default'/'DynamicGroupName' to use clusters in compartment Dennis-Compartment
111
+
```
52
112
53
-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to manage virtual-network-family in compartment {compartment_name}
113
+
### Blueprints Feature Policies
54
114
55
-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to use vnics in compartment {compartment_name}
115
+
Feature policies describe the policies required to enable all of the Blueprints platform features. Combined policies will be shown first which are the minimum required policies to use all Blueprints features, and then feature specific policies follow with links to documentation. This way, users can selectively opt in or opt out of certain features if policies are prohibitive.
56
116
57
-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to use network-security-groups in compartment {compartment_name}
117
+
**Full Feature Policies**
58
118
59
-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to manage public-ips in compartment {compartment_name}
119
+
```
120
+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage clusters in compartment Dennis-Compartment
121
+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage cluster-node-pools in compartment Dennis-Compartment
122
+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage instance-family in compartment Dennis-Compartment
123
+
Allow dynamic-group 'Default'/'DynamicGroupName' to use vnics in compartment Dennis-Compartment
124
+
Allow dynamic-group 'Default'/'DynamicGroupName' to use subnets in compartment Dennis-Compartment
125
+
Allow dynamic-group 'Default'/'DynamicGroupName' to read instance-images in compartment Dennis-Compartment
126
+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage compute-capacity-reports in compartment Dennis-Compartment
127
+
Allow dynamic-group 'Default'/'DynamicGroupName' to read cluster-work-requests in compartment Dennis-Compartment
128
+
Allow dynamic-group 'Default'/'DynamicGroupName' to read file-systems in compartment Dennis-Compartment
129
+
Allow dynamic-group 'Default'/'DynamicGroupName' to read mount-targets in compartment Dennis-Compartment
130
+
Allow dynamic-group 'Default'/'DynamicGroupName' to read export-sets in compartment Dennis-Compartment
131
+
Allow dynamic-group 'Default'/'DynamicGroupName' to inspect private-ips in compartment Dennis-Compartment
132
+
Allow dynamic-group 'Default'/'DynamicGroupName' to read buckets in compartment Dennis-Compartment
133
+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage objects in compartment Dennis-Compartment
134
+
Allow dynamic-group 'Default'/'DynamicGroupName' to use volumes in compartment Dennis-Compartment
135
+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage instance-configurations in compartment Dennis-Compartment
136
+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage instance-pools in compartment Dennis-Compartment
137
+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage cluster-networks in compartment Dennis-Compartment
138
+
```
60
139
61
-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to manage cluster-family in compartment {compartment_name}
140
+
**Minimum policies for RDMA Enabled Cluster Networks**
62
141
63
-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to manage orm-stacks in compartment {compartment_name}
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to read virtual-network-family in compartment {compartment_name}
207
+
```
208
+
Allow dynamic-group 'Default'/'DynamicGroupName' to read file-systems in compartment Dennis-Compartment
209
+
Allow dynamic-group 'Default'/'DynamicGroupName' to read mount-targets in compartment Dennis-Compartment
210
+
Allow dynamic-group 'Default'/'DynamicGroupName' to read export-sets in compartment Dennis-Compartment
211
+
Allow dynamic-group 'Default'/'DynamicGroupName' to inspect private-ips in compartment Dennis-Compartment
212
+
```
98
213
99
-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to inspect compartments in compartment {compartment_name}
214
+
**Any blueprint to autoscale nodes (not pods)**
100
215
101
-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to manage cluster-node-pools in compartment {compartment_name}
216
+
To reiterate, if you only want to autoscale pods and not nodes, and full cluster`manage` is not required. `use cluster` with `{CLUSTER_JOIN}` can be used instead.
102
217
103
-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to {CLUSTER_JOIN} in compartment {compartment_name}
0 commit comments