Oracle Cloud Infrastructure (OCI) Deployment Guide

Prerequisites

Before deploying to Oracle Container Engine for Kubernetes (OKE), ensure you have:

• OCI CLI installed and configured
• Kubernetes CLI (kubectl) installed
• Helm 3.x installed

Cluster Setup

1. Create an OKE cluster through OCI Console or CLI:

oci ce cluster create \
  --name prime-edm-cluster \
  --compartment-id ocid1.compartment.oc1.. \
  --vcn-id ocid1.vcn.oc1.. \
  --kubernetes-version v1.24.0

2. Get kubeconfig:

oci ce cluster create-kubeconfig \
  --cluster-id ocid1.cluster.oc1.. \
  --file ~/.kube/config \
  --region us-ashburn-1

Installing Prime EDM Charts

1. Add the Helm repository:

helm repo add prime-edm https://charts.acx-sandbox.net --username $USER --password $PASSWORD
helm repo update

2. Create OCI-specific values:

# oci-values.yaml
global:
  provider: oci
  region: us-ashburn-1

storage:
  class: oci-bv
  
serviceAccount:
  annotations:
    oci.oraclecloud.com/instance-principal: "true"

ingress:
  annotations:
    kubernetes.io/ingress.class: nginx

3. Install the chart:

helm install prime-edm prime-edm/prime-edm -f oci-values.yaml

OCI-Specific Configuration

Storage Classes

OCI provides several storage options:

storage:
  # Block Volume
  class: oci-bv
  
  # File Storage
  # class: oci-fss

Load Balancer

Using OCI Load Balancer:

service:
  type: LoadBalancer
  annotations:
    service.beta.kubernetes.io/oci-load-balancer-shape: flexible
    service.beta.kubernetes.io/oci-load-balancer-shape-flex-min: "10"
    service.beta.kubernetes.io/oci-load-balancer-shape-flex-max: "100"

Identity and Security

Configure instance principals:

serviceAccount:
  create: true
  annotations:
    oci.oraclecloud.com/instance-principal: "true"

Secrets Management

OCI Vault Setup

1. Create a Vault:

oci vault create \
  --compartment-id <compartment-id> \
  --display-name prime-edm-vault \
  --vault-type DEFAULT

2. Create a Key:

oci vault key create \
  --compartment-id <compartment-id> \
  --display-name prime-edm-key \
  --key-shape '{"algorithm":"AES","length":32}' \
  --vault-id <vault-id>

3. Install External Secrets Operator:

helm repo add external-secrets https://charts.external-secrets.io
helm repo update

helm install external-secrets \
  external-secrets/external-secrets \
  --namespace external-secrets \
  --create-namespace \
  --set installCRDs=true

4. Create SecretStore:

apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
  name: oci-backend
spec:
  provider:
    oracle:
      region: us-ashburn-1
      vault:
        vaultId: <vault-id>
      auth:
        user:
          tenancy: <tenancy-ocid>
          user: <user-ocid>
          key: |
            -----BEGIN PRIVATE KEY-----
            ...
            -----END PRIVATE KEY-----
          fingerprint: <key-fingerprint>

5. Create ExternalSecret:

apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: database-secret
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: oci-backend
    kind: SecretStore
  target:
    name: db-credentials
  data:
  - secretKey: username
    remoteRef:
      key: ocid1.vaultsecret.oc1...
  - secretKey: password
    remoteRef:
      key: ocid1.vaultsecret.oc1...

Monitoring

OCI Monitoring Integration

Enable OCI monitoring:

monitoring:
  ociMonitoring:
    enabled: true
    compartmentId: ocid1.compartment.oc1..

Best Practices

1. Use node selectors:

nodeSelector:
  oci.oraclecloud.com/fault-domain: "FAULT-DOMAIN-1"

2. Configure resource limits:

resources:
  requests:
    cpu: 250m
    memory: 512Mi
  limits:
    cpu: 500m
    memory: 1Gi

3. Enable auto-scaling:

autoscaling:
  enabled: true
  minReplicas: 2
  maxReplicas: 10
  targetCPUUtilizationPercentage: 80

Troubleshooting

Common issues and solutions:

1. Load balancer issues:

   • Check security lists
   • Verify subnet configuration
   • Validate health checks

2. Storage problems:

   • Confirm storage class exists
   • Check PVC status
   • Verify compartment permissions

3. Identity issues:

   • Check instance principal setup
   • Verify dynamic group rules
   • Validate IAM policies