Skip to content

OCI: resolve availability domains from the configured compartment - #4309

Open
fede-kamel wants to merge 1 commit into
dstackai:masterfrom
fede-kamel:fix-oci-cross-tenancy-ads
Open

fede-kamel wants to merge 1 commit into
dstackai:masterfrom
fede-kamel:fix-oci-cross-tenancy-ads

Conversation

@fede-kamel

Copy link
Copy Markdown

Steps to reproduce

Configure the oci backend with a compartment_id that belongs to a different tenancy than the credentials, shared with the credentials' tenancy by a cross-tenancy policy:

- type: oci
  regions: [us-phoenix-1]
  compartment_id: <compartment in another tenancy>
  creds:
    type: default
    profile: <profile with cross-tenancy access>

Actual behaviour

The backend configures and creates its VCN and subnet, but dstack offer -b oci always reports no offers. The server log shows every shape lookup failing:

oci.exceptions.ServiceError: {'status': 404, 'code': 'NotAuthorizedOrNotFound',
 'operation_name': 'list_shapes',
 'message': 'Authorization failed or requested resource not found.'}

OCIRegionClient.availability_domains lists the availability domains of client_config["tenancy"], i.e. the tenancy in the credentials. Availability domain names are tenancy-specific, so list_shapes is then called with a domain name from one tenancy and a compartment in another, which OCI answers with 404.

Resolving the domains from the compartment instead returns the shapes as expected:

list_shapes(<creds tenancy AD>,      <compartment in another tenancy>)  -> 404
list_shapes(<compartment's own AD>,  <compartment in another tenancy>)  -> 49 shapes

Expected behaviour

Offers are returned for a compartment shared in from another tenancy.

Change

ListAvailabilityDomains accepts any compartment OCID and answers for the tenancy that owns it, so resolve the domains from the compartment dstack is configured with. availability_domains keeps its current meaning (the credentials' tenancy) for the lookups that are not compartment-scoped, and results are cached per compartment.

Tests

New src/tests/_internal/core/backends/oci/test_region.py covering resolution from the compartment, the credentials-tenancy default, and per-compartment caching. OCI backend suite 23 passed, whole backends suite 453 passed, ruff check and ruff format clean.

Verified end to end: with this change the backend returns offers for a cross-tenancy compartment, and runs provision on them.

`OCIRegionClient.availability_domains` lists the availability domains of the
tenancy in the credentials. The compartment dstack works in does not have to
belong to that tenancy: a compartment can be shared with the credentials'
tenancy by a cross-tenancy policy, and `compartment_id` in the backend config
then points into another tenancy.

Availability domain names are tenancy-specific, so in that setup every shape
lookup asks for a domain the compartment's tenancy does not have and OCI
answers 404 NotAuthorizedOrNotFound. The backend configures, but no offers are
ever returned:

    list_shapes(availability_domain="<creds tenancy AD>", compartment_id="<compartment in another tenancy>")
    -> ServiceError(status=404, code='NotAuthorizedOrNotFound', operation_name='list_shapes')

`ListAvailabilityDomains` accepts any compartment OCID and answers for the
tenancy owning it, so pass the compartment dstack was configured with. Lookups
that are not compartment-scoped keep using the credentials' tenancy.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant