OCI: resolve availability domains from the configured compartment - #4309
Open
fede-kamel wants to merge 1 commit into
Open
fede-kamel wants to merge 1 commit into
fede-kamel wants to merge 1 commit into
Conversation
`OCIRegionClient.availability_domains` lists the availability domains of the
tenancy in the credentials. The compartment dstack works in does not have to
belong to that tenancy: a compartment can be shared with the credentials'
tenancy by a cross-tenancy policy, and `compartment_id` in the backend config
then points into another tenancy.
Availability domain names are tenancy-specific, so in that setup every shape
lookup asks for a domain the compartment's tenancy does not have and OCI
answers 404 NotAuthorizedOrNotFound. The backend configures, but no offers are
ever returned:
list_shapes(availability_domain="<creds tenancy AD>", compartment_id="<compartment in another tenancy>")
-> ServiceError(status=404, code='NotAuthorizedOrNotFound', operation_name='list_shapes')
`ListAvailabilityDomains` accepts any compartment OCID and answers for the
tenancy owning it, so pass the compartment dstack was configured with. Lookups
that are not compartment-scoped keep using the credentials' tenancy.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Steps to reproduce
Configure the
ocibackend with acompartment_idthat belongs to a different tenancy than the credentials, shared with the credentials' tenancy by a cross-tenancy policy:Actual behaviour
The backend configures and creates its VCN and subnet, but
dstack offer -b ocialways reports no offers. The server log shows every shape lookup failing:OCIRegionClient.availability_domainslists the availability domains ofclient_config["tenancy"], i.e. the tenancy in the credentials. Availability domain names are tenancy-specific, solist_shapesis then called with a domain name from one tenancy and a compartment in another, which OCI answers with 404.Resolving the domains from the compartment instead returns the shapes as expected:
Expected behaviour
Offers are returned for a compartment shared in from another tenancy.
Change
ListAvailabilityDomainsaccepts any compartment OCID and answers for the tenancy that owns it, so resolve the domains from the compartment dstack is configured with.availability_domainskeeps its current meaning (the credentials' tenancy) for the lookups that are not compartment-scoped, and results are cached per compartment.Tests
New
src/tests/_internal/core/backends/oci/test_region.pycovering resolution from the compartment, the credentials-tenancy default, and per-compartment caching. OCI backend suite 23 passed, whole backends suite 453 passed,ruff checkandruff formatclean.Verified end to end: with this change the backend returns offers for a cross-tenancy compartment, and runs provision on them.