Monday, 20 January 2020

OCI CLI Environment Variables

The OCI CLI client provides a number of arguments that are useful as you look up your components from the command line. As you build an internal tooling to query either your or your customers resources, it can start to get "interesting" if you need to start building a custom argument list.

Since version 2.6.9 of the client, a number of environment variables are supported that you can set rather than building a complex argument list. I think leveraging these variables makes for a cleaner code base in your bash scripts.

If you check the release notes from version 2.6.9, you will see they introduced they following variables:

  • OCI_CLI_PROFILE
  • OCI_CLI_REGION
  • OCI_CLI_USER
  • OCI_CLI_FINGERPRINT
  • OCI_CLI_KEY_FILE
  • OCI_CLI_TENANCY
  • OCI_CLI_ENDPOINT
  • OCI_CLI_CONFIG_FILE
  • OCI_CLI_RC_FILE
  • OCI_CLI_CERT_BUNDLE
  • OCI_CLI_AUTH
  • OCI_CLI_DELEGATION_TOKEN_FILE
  • OCI_CLI_SECURITY_TOKEN_FILE
For the most recent version of what's supported, you can review the code base where they define all the available environment variables that you can use:

https://github.com/oracle/oci-cli/blob/master/src/oci_cli/cli_constants.py


So, what are some examples I use in leveraging these variables?

I take an argument into my script to receive the profile. If this is set I set the variable OCI_CLI_PROFILE to whatever was passed in and unset the variable OCI_CLI_AUTH which I have pre-set to instance_principal.

if [[ "$ociProfile" != "" ]]
then
    export OCI_CLI_PROFILE=$ociProfile
    unset OCI_CLI_AUTH
fi

Another example. I have some scripts that are auditing the whole tenancy, and whenever you run an OCI command it is against a single region at a time. There is a command that lists any region you have a subscription to, so we can pull that list, run a loop and then export the relevant region in each iteration.

regions=$(oci iam region-subscription list)

for regionIdx in $(echo "$regions" | jq '.data | keys | .[]'); do
    regionName=$(echo "$regions" | jq -r ".data[$regionIdx].\"region-name\"")
    regionRequiresNotification=false

    export OCI_CLI_REGION="$regionName"
    echo "exported region $OCI_CLI_REGION"
done

Well - that's just a couple of examples. The names of the variables are pretty self explanatory for what they relate to.