Support for OKE Infra and Service Log Collection #100
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
oracle-contributor-agreement
bot
added
the
OCA Verified
paliwalparitosh
force-pushed
the
oke-infra-discovery
branch
from
7b86cf2 to
a37c91b
Compare
| discovery_api = ["Allow dynamic-group ${local.dynamic_group_name} to {LOG_ANALYTICS_DISCOVERY_UPLOAD} in tenancy"], | ||
| tag_namespace = ["Allow dynamic-group ${local.dynamic_group_name} to use tag-namespaces in tenancy ${local.tags_policy_where_clause}"] | ||
| infra_discovery_stmt = [ | ||
| "Allow dynamic-group ${local.dynamic_group_name} to inspect compartments in tenancy", |
There was a problem hiding this comment.
We do not need this in the default mode, only when proble_all where customer have to manually create this statement. It should go into documentation.
| infra_discovery_stmt = [ | ||
| "Allow dynamic-group ${local.dynamic_group_name} to inspect compartments in tenancy", | ||
| # https://docs.oracle.com/en-us/iaas/Content/Identity/Reference/contengpolicyreference.htm | ||
| "Allow dynamic-group ${local.dynamic_group_name} to use clusters in tenancy where target.cluster.id=${var.oke_cluster_ocid}", |
There was a problem hiding this comment.
change it to exact permission string instead of use verb
| "Allow dynamic-group ${local.dynamic_group_name} to inspect compartments in tenancy", | ||
| # https://docs.oracle.com/en-us/iaas/Content/Identity/Reference/contengpolicyreference.htm | ||
| "Allow dynamic-group ${local.dynamic_group_name} to use clusters in tenancy where target.cluster.id=${var.oke_cluster_ocid}", | ||
| "Allow dynamic-group ${local.dynamic_group_name} to read cluster-node-pools in tenancy", |
There was a problem hiding this comment.
restrict it to one compartment.
| # Note: | ||
| # Customers will need to create additional policies to support VCN and subnets in non-OKE compartments | ||
| "Allow dynamic-group ${local.dynamic_group_name} to read vcns in ${local.oke_compartment_scope}", | ||
| "Allow dynamic-group ${local.dynamic_group_name} to use subnets in ${local.oke_compartment_scope}", |
There was a problem hiding this comment.
Can we try to find the permission strings if possible to replace the use verb
| # Compartment of Logging LogGroup is not known at the time of policy creation via stack | ||
| # We assume that Logging Log Groups are only created in either OKE or ONM compartments | ||
| service_discovery_stmt = var.create_service_discovery_policies ? distinct([ | ||
| "Allow dynamic-group ${local.dynamic_group_name} to manage log-groups in ${local.onm_compartment_scope}", |
There was a problem hiding this comment.
Validate the case/behaviour of Service Stack, when the underlying resource/corresponding log/logGroup deleted
| "Allow dynamic-group ${local.dynamic_group_name} to manage log-groups in ${local.onm_compartment_scope}", | ||
| "Allow dynamic-group ${local.dynamic_group_name} to manage log-groups in ${local.oke_compartment_scope}", | ||
|
|
||
| "Allow dynamic-group ${local.dynamic_group_name} to read log-content in ${local.onm_compartment_scope}", |
There was a problem hiding this comment.
lets put a where clause to restrict this policy to service connector resource if that is sufficient
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.