Skip to content

Commit af0907e

Browse files
felixgaterufelixgateru
committed
refactor: add permissions for additional components
Signed-off-by: Felix Gateru <felix.gateru@gmail.com>
1 parent c491875 commit af0907e

3 files changed

Lines changed: 94 additions & 85 deletions

File tree

‎docs/components/OracleCloudInfrastructure.mdx‎

Lines changed: 32 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -27,45 +27,54 @@ SuperPlane authenticates to OCI using API Key authentication tied to a dedicated
2727
### Part 1 — Create a Dedicated Group and Service User
2828

2929
1. Open the [OCI Console](https://cloud.oracle.com/) and sign in.
30-
2. Go to **Identity & Security → Domains → Default → Groups**.
30+
2. Go to **Menu** → **Identity & Security → Domains → Default → User Management → Groups**.
3131
3. Click **Create Group**.
3232
4. Set the name to `SuperPlaneIntegration` and add a description, then click **Create**.
33-
5. In the same Domain, go to **Users → Create User**.
33+
5. In the same **User Management** tab, go to **Users → Create User**.
3434
6. Fill in the details:
35-
- **Username:** `superplane-integration`
36-
- **Email:** use integrations@superplane.com or any valid email (not used for authentication)
37-
- **Description:** SuperPlane integration user
38-
7. In the **Groups** section, assign them to the `SuperPlaneIntegration` group
35+
- **Lastname:** `superplane-integration`
36+
- **Email:** use any valid email (not used for authentication)
37+
7. In the **Groups** section, assign the user to the `SuperPlaneIntegration` group
3938
8. Click **Create**.
4039

4140
### Part 2 — Create an IAM Policy
4241

4342
1. Go to **Identity & Security → Policies**.
4443
2. Make sure you are in the **root compartment** (check the Compartment selector on the left).
45-
3. Click **Create Policy**, name it `SuperPlanePolicies`, and enable the **manual editor**.
46-
4. Paste in the following statements, replacing `<your-compartment>` with your target compartment name and Click **Create**.:
44+
3. Click **Create Policy**, name it `SuperPlanePolicies`, add a description and enable the **manual editor**.
45+
4. Paste in the following statements, replacing `<your-compartment>` with your target compartment name, and then Click **Create**.:
4746
```
48-
Allow group SuperPlaneIntegration to manage instances
49-
in compartment <your-compartment>
50-
51-
Allow group SuperPlaneIntegration to manage compute-images
52-
in compartment <your-compartment>
53-
54-
Allow group SuperPlaneIntegration to use virtual-network-family
55-
in compartment <your-compartment>
47+
Allow group SuperPlaneIntegration to manage instances in tenancy
48+
Allow group SuperPlaneIntegration to manage volumes in tenancy
49+
Allow group SuperPlaneIntegration to manage volume-attachments in tenancy
50+
Allow group SuperPlaneIntegration to manage virtual-network-family in tenancy
51+
Allow group SuperPlaneIntegration to manage buckets in tenancy
52+
Allow group SuperPlaneIntegration to manage objects in tenancy
53+
Allow group SuperPlaneIntegration to manage objectstorage-namespaces in tenancy
54+
Allow group SuperPlaneIntegration to manage fn-app in tenancy
55+
Allow group SuperPlaneIntegration to manage fn-function in tenancy
56+
Allow group SuperPlaneIntegration to manage fn-invocation in tenancy
57+
Allow group SuperPlaneIntegration to manage ons-topics in tenancy
58+
Allow group SuperPlaneIntegration to manage ons-subscriptions in tenancy
59+
Allow group SuperPlaneIntegration to inspect compartments in tenancy
60+
Allow group SuperPlaneIntegration to inspect all-resources in tenancy
61+
Allow group SuperPlaneIntegration to manage cloudevents-rules in tenancy
62+
Allow group SuperPlaneIntegration to manage autonomous-database-family in tenancy
63+
Allow service cloudEvents to use ons-topics in tenancy
5664
```
5765

58-
### Part 3 — Generate API Keys for the Service User and Connect to Superplane
66+
### Part 3 — Generate API Keys for the Service User and Connect to SuperPlane
5967

60-
1. While still on the service user's page, go to **API keys → Add API key**.
61-
2. Choose **Generate API Key Pair**, download the private key, and click **Add**.
62-
3. Copy the **Configuration File Preview** values that appear to the UI:
68+
1. Go to **Menu** → **Identity & Security → Domains → Default → User Management → Users**.
69+
2. Choose the service user you created, then go to **API Keys → Add API Key**.
70+
3. Select **Generate API key pair**, download the private key file and then click **Add**.
71+
4. Copy the **Configuration File Preview** values that appear to the UI:
6372
- **User OCID** (begins with `ocid1.user.`)
6473
- **Fingerprint** (e.g. `12:34:56:…`)
6574
- **Tenancy OCID** (begins with `ocid1.tenancy.`)
66-
4. Select the **Region** that matches your OCI tenancy's home region.
67-
5. Open the downloaded private key file and paste its full contents into the **Private Key** field.
68-
6. Click **Connect** to validate the credentials and save the integration.
75+
5. Select the **Region** that matches your OCI tenancy's home region.
76+
6. Open the downloaded private key file and paste its full contents into the **Private Key** field.
77+
7. Click **Connect** to validate the credentials and save the integration.
6978

7079
<a id="on-compute-instance-created"></a>
7180

‎pkg/integrations/oci/oci.go‎

Lines changed: 62 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -26,10 +26,11 @@ type Configuration struct {
2626

2727
// IntegrationMetadata holds resources created during integration setup.
2828
type IntegrationMetadata struct {
29-
TopicID string `json:"topicId" mapstructure:"topicId"`
30-
// CompartmentRules maps compartment OCID → Events rule OCID.
31-
// One shared rule is created per compartment, reused across all triggers.
32-
CompartmentRules map[string]string `json:"compartmentRules" mapstructure:"compartmentRules"`
29+
TopicID string `json:"topicId" mapstructure:"topicId"`
30+
EventsRuleID string `json:"eventsRuleId" mapstructure:"eventsRuleId"`
31+
// Deprecated: CompartmentRules was used in older versions to track per-compartment rules.
32+
// It is kept only for cleanup of legacy resources.
33+
CompartmentRules map[string]string `json:"compartmentRules,omitempty" mapstructure:"compartmentRules"`
3334
}
3435

3536
func (o *OCI) Name() string {
@@ -56,45 +57,54 @@ SuperPlane authenticates to OCI using API Key authentication tied to a dedicated
5657
### Part 1 — Create a Dedicated Group and Service User
5758
5859
1. Open the [OCI Console](https://cloud.oracle.com/) and sign in.
59-
2. Go to **Identity & Security → Domains → Default → Groups**.
60+
2. Go to **Menu** → **Identity & Security → Domains → Default → User Management → Groups**.
6061
3. Click **Create Group**.
6162
4. Set the name to ` + "`SuperPlaneIntegration`" + ` and add a description, then click **Create**.
62-
5. In the same Domain, go to **Users → Create User**.
63+
5. In the same **User Management** tab, go to **Users → Create User**.
6364
6. Fill in the details:
64-
- **Username:** ` + "`superplane-integration`" + `
65-
- **Email:** use integrations@superplane.com or any valid email (not used for authentication)
66-
- **Description:** SuperPlane integration user
67-
7. In the **Groups** section, assign them to the ` + "`SuperPlaneIntegration`" + ` group
65+
- **Lastname:** ` + "`superplane-integration`" + `
66+
- **Email:** use any valid email (not used for authentication)
67+
7. In the **Groups** section, assign the user to the ` + "`SuperPlaneIntegration`" + ` group
6868
8. Click **Create**.
6969
7070
### Part 2 — Create an IAM Policy
7171
7272
1. Go to **Identity & Security → Policies**.
7373
2. Make sure you are in the **root compartment** (check the Compartment selector on the left).
74-
3. Click **Create Policy**, name it ` + "`SuperPlanePolicies`" + `, and enable the **manual editor**.
75-
4. Paste in the following statements, replacing ` + "`<your-compartment>`" + ` with your target compartment name and Click **Create**.:
74+
3. Click **Create Policy**, name it ` + "`SuperPlanePolicies`" + `, add a description and enable the **manual editor**.
75+
4. Paste in the following statements, replacing ` + "`<your-compartment>`" + ` with your target compartment name, and then Click **Create**.:
7676
` + "```" + `
77-
Allow group SuperPlaneIntegration to manage instances
78-
in compartment <your-compartment>
79-
80-
Allow group SuperPlaneIntegration to manage compute-images
81-
in compartment <your-compartment>
82-
83-
Allow group SuperPlaneIntegration to use virtual-network-family
84-
in compartment <your-compartment>
77+
Allow group SuperPlaneIntegration to manage instances in tenancy
78+
Allow group SuperPlaneIntegration to manage volumes in tenancy
79+
Allow group SuperPlaneIntegration to manage volume-attachments in tenancy
80+
Allow group SuperPlaneIntegration to manage virtual-network-family in tenancy
81+
Allow group SuperPlaneIntegration to manage buckets in tenancy
82+
Allow group SuperPlaneIntegration to manage objects in tenancy
83+
Allow group SuperPlaneIntegration to manage objectstorage-namespaces in tenancy
84+
Allow group SuperPlaneIntegration to manage fn-app in tenancy
85+
Allow group SuperPlaneIntegration to manage fn-function in tenancy
86+
Allow group SuperPlaneIntegration to manage fn-invocation in tenancy
87+
Allow group SuperPlaneIntegration to manage ons-topics in tenancy
88+
Allow group SuperPlaneIntegration to manage ons-subscriptions in tenancy
89+
Allow group SuperPlaneIntegration to inspect compartments in tenancy
90+
Allow group SuperPlaneIntegration to inspect all-resources in tenancy
91+
Allow group SuperPlaneIntegration to manage cloudevents-rules in tenancy
92+
Allow group SuperPlaneIntegration to manage autonomous-database-family in tenancy
93+
Allow service cloudEvents to use ons-topics in tenancy
8594
` + "```" + `
8695
87-
### Part 3 — Generate API Keys for the Service User and Connect to Superplane
96+
### Part 3 — Generate API Keys for the Service User and Connect to SuperPlane
8897
89-
1. While still on the service user's page, go to **API keys → Add API key**.
90-
2. Choose **Generate API Key Pair**, download the private key, and click **Add**.
91-
3. Copy the **Configuration File Preview** values that appear to the UI:
98+
1. Go to **Menu** → **Identity & Security → Domains → Default → User Management → Users**.
99+
2. Choose the service user you created, then go to **API Keys → Add API Key**.
100+
3. Select **Generate API key pair**, download the private key file and then click **Add**.
101+
4. Copy the **Configuration File Preview** values that appear to the UI:
92102
- **User OCID** (begins with ` + "`ocid1.user.`" + `)
93103
- **Fingerprint** (e.g. ` + "`12:34:56:…`" + `)
94104
- **Tenancy OCID** (begins with ` + "`ocid1.tenancy.`" + `)
95-
4. Select the **Region** that matches your OCI tenancy's home region.
96-
5. Open the downloaded private key file and paste its full contents into the **Private Key** field.
97-
6. Click **Connect** to validate the credentials and save the integration.`
105+
5. Select the **Region** that matches your OCI tenancy's home region.
106+
6. Open the downloaded private key file and paste its full contents into the **Private Key** field.
107+
7. Click **Connect** to validate the credentials and save the integration.`
98108
}
99109

100110
func (o *OCI) Configuration() []configuration.Field {
@@ -196,6 +206,21 @@ func (o *OCI) Sync(ctx core.SyncContext) error {
196206
ctx.Integration.SetMetadata(metadata)
197207
}
198208

209+
// Create a single shared Events rule in the tenancy compartment, co-located with the topic.
210+
// The rule captures all compute launch events tenancy-wide; per-compartment filtering is
211+
// done server-side in the webhook handler. Creating the rule here (in the tenancy compartment)
212+
// avoids cross-compartment IAM issues that arise when the rule and topic are in different compartments.
213+
if metadata.EventsRuleID == "" {
214+
ruleName := fmt.Sprintf("superplane-%s", ctx.Integration.ID())
215+
condition := `{"eventType": ["com.oraclecloud.computeapi.launchinstance.end"]}`
216+
rule, err := client.CreateEventsRule(cfg.TenancyOCID, ruleName, condition, metadata.TopicID)
217+
if err != nil {
218+
return fmt.Errorf("failed to create Events rule: %w", err)
219+
}
220+
metadata.EventsRuleID = rule.ID
221+
ctx.Integration.SetMetadata(metadata)
222+
}
223+
199224
ctx.Integration.Ready()
200225
return nil
201226
}
@@ -207,7 +232,7 @@ func (o *OCI) Cleanup(ctx core.IntegrationCleanupContext) error {
207232
return nil
208233
}
209234

210-
if metadata.TopicID == "" && len(metadata.CompartmentRules) == 0 {
235+
if metadata.TopicID == "" && metadata.EventsRuleID == "" && len(metadata.CompartmentRules) == 0 {
211236
return nil
212237
}
213238

@@ -216,9 +241,17 @@ func (o *OCI) Cleanup(ctx core.IntegrationCleanupContext) error {
216241
return fmt.Errorf("failed to create OCI client during cleanup: %w", err)
217242
}
218243

244+
// Delete the single shared Events rule (current style).
245+
if metadata.EventsRuleID != "" {
246+
if err := client.DeleteEventsRule(metadata.EventsRuleID); err != nil {
247+
ctx.Logger.Warnf("failed to delete Events rule %q during cleanup: %v", metadata.EventsRuleID, err)
248+
}
249+
}
250+
251+
// Delete any legacy per-compartment rules created by older versions.
219252
for compartmentID, ruleID := range metadata.CompartmentRules {
220253
if err := client.DeleteEventsRule(ruleID); err != nil {
221-
ctx.Logger.Warnf("failed to delete Events rule %q (compartment %q) during cleanup: %v", ruleID, compartmentID, err)
254+
ctx.Logger.Warnf("failed to delete legacy Events rule %q (compartment %q) during cleanup: %v", ruleID, compartmentID, err)
222255
}
223256
}
224257

‎pkg/integrations/oci/on_compute_instance_created.go‎

Lines changed: 0 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -99,15 +99,6 @@ func (t *OnComputeInstanceCreated) Setup(ctx core.TriggerContext) error {
9999
return err
100100
}
101101

102-
client, err := NewClient(ctx.HTTP, ctx.Integration)
103-
if err != nil {
104-
return fmt.Errorf("failed to create OCI client: %w", err)
105-
}
106-
107-
if err := ensureSharedEventsRule(ctx, client, config.CompartmentID, &integrationMetadata); err != nil {
108-
return err
109-
}
110-
111102
if err := ctx.Metadata.Set(OnComputeInstanceCreatedMetadata{
112103
CompartmentID: config.CompartmentID,
113104
}); err != nil {
@@ -138,30 +129,6 @@ func decodeSetupInputs(ctx core.TriggerContext) (OnComputeInstanceCreatedConfigu
138129
return config, integrationMetadata, nil
139130
}
140131

141-
// ensureSharedEventsRule ensures one OCI Events rule exists for the given compartment,
142-
// shared across all triggers that use the same integration+compartment pair.
143-
// The rule OCID is stored in integration metadata (keyed by compartmentID) so that
144-
// subsequent trigger setups are idempotent and do not create duplicate rules.
145-
func ensureSharedEventsRule(ctx core.TriggerContext, client *Client, compartmentID string, integrationMetadata *IntegrationMetadata) error {
146-
if _, exists := integrationMetadata.CompartmentRules[compartmentID]; exists {
147-
return nil
148-
}
149-
150-
ruleName := fmt.Sprintf("superplane-%s", ctx.Integration.ID())
151-
condition := `{"eventType": ["com.oraclecloud.computeapi.launchinstance.end"]}`
152-
rule, err := client.CreateEventsRule(compartmentID, ruleName, condition, integrationMetadata.TopicID)
153-
if err != nil {
154-
return fmt.Errorf("failed to create shared Events rule: %w", err)
155-
}
156-
157-
if integrationMetadata.CompartmentRules == nil {
158-
integrationMetadata.CompartmentRules = make(map[string]string)
159-
}
160-
integrationMetadata.CompartmentRules[compartmentID] = rule.ID
161-
ctx.Integration.SetMetadata(*integrationMetadata)
162-
return nil
163-
}
164-
165132
// requestWebhook asks the integration to provision a per-trigger HTTPS
166133
// subscription to the shared ONS topic.
167134
func requestWebhook(ctx core.TriggerContext, compartmentID, topicID string) error {

0 commit comments

Comments
 (0)