Re: [RFC PATCH] terraform/OCI: Grab secrets from ~/.oci/config

[Chuck Lever <chuck.lever@oracle.com>]

On 4/4/25 2:28 PM, Luis Chamberlain wrote:
> On Fri, Apr 04, 2025 at 02:24:37PM -0400, Chuck Lever wrote:
>> On 4/4/25 2:06 PM, Luis Chamberlain wrote:
>>> On Fri, Apr 04, 2025 at 12:10:49PM -0400, Chuck Lever wrote:
>>>> On a related topic, if we ever want to fully support running the kdevops
>>>> /control host/ in the cloud, terraform supports an authentication
>>>> mechanism that just uses the local instance's service principal, so
>>>> no extra authentication material is needed for provisioning the test
>>>> runners as separate cloud instances. Interesting to consider.
>>>
>>> Sorry I failed to understand this, what is mean by separate cloud
>>> instances?
>>
>> The usual situation is the control host (where terraform runs) is
>> outside the cloud. Like, on your workstation. I'm talking about a
>> scenario where kdevops and terraform are running on an instance in the
>> same cloud as where your target nodes are going to run.
>>
>> In that case, terraform can scoop up the service principal for that
>> instance, and use it in place of dot file authentication parameters.
>> So you don't have to maintain the dot file on the instance that is
>> running terraform, if it is already in the cloud.
> 
> I see, so you first bring that cloud instance, and then use that as
> your command and control for test nodes. Does that first cloud instance
> need to be instantiated through another kdevops setup?

No, you can create it with terraform or from the cloud console. Start it
up when you want, or leave it running.

I'm wondering if we can get a cloud devops pipeline to trigger it when
it sees a PR against a watched repo. Haven't really thought that
through.


-- 
Chuck Lever