Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

docs: Updated documentation for OCI Object Storage, added link to blog post #5928

Merged
merged 1 commit into from
Nov 30, 2022
Merged

docs: Updated documentation for OCI Object Storage, added link to blog post #5928

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/getting-started.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -102,7 +102,7 @@ See up to date [jsonnet mixins](https://github.com/thanos-io/thanos/tree/main/mi
## Blog posts

* 2022:

* [Deploy Thanos Receive with native OCI Object Storage on Oracle Kubernetes Engine](https://medium.com/@lmukadam/deploy-thanos-receive-with-native-oci-object-storage-on-kubernetes-829326ea0bc6)
* [Leveraging Consul for Thanos Query Discovery](https://nicolastakashi.medium.com/leveraging-consul-for-thanos-query-discovery-34212d496c88)

* 2021:
Expand Down
26 changes: 22 additions & 4 deletions docs/storage.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -513,11 +513,11 @@ config:
prefix: ""
```

### Oracle Cloud Infrastructure Object Storage
#### Oracle Cloud Infrastructure Object Storage

To configure Oracle Cloud Infrastructure (OCI) Object Storage as Thanos Object Store, you need to provide appropriate authentication credentials to your OCI tenancy. The OCI object storage client implementation for Thanos supports either the default keypair or instance principal authentication.

#### API Signing Key
##### API Signing Key

The default API signing key authentication provider leverages same [configuration as the OCI CLI](https://docs.oracle.com/en-us/iaas/Content/API/Concepts/cliconcepts.htm) which is usually stored in at `$HOME/.oci/config` or via variable names starting with the string `OCI_CLI`. If the same configuration is found in multiple places the provider will prefer the first one.

Expand Down Expand Up @@ -545,7 +545,7 @@ config:
client_timeout: 90s // Optional time limit for requests made by the HTTP Client.
```

#### Instance Principal Provider
##### Instance Principal Provider

For Example:

Expand All @@ -559,7 +559,7 @@ config:

You can also include any of the optional configuration just like the example in `Default Provider`.

#### Raw Provider
##### Raw Provider

For Example:

Expand All @@ -579,6 +579,24 @@ config:

You can also include any of the optional configuration just like the example in `Default Provider`.

##### OCI Policies

Regardless of the method you use for authentication (raw, instance-principal), you need the following 2 policies in order for Thanos (sidecar or receive) to be able to write TSDB to OCI object storage. The difference lies in whom you are giving the permissions.

For using instance-principal and dynamic group:

```
Allow dynamic-group thanos to read buckets in compartment id ocid1.compartment.oc1..a
Allow dynamic-group thanos to manage objects in compartment id ocid1.compartment.oc1..a
```

For using raw provider and an IAM group:

```
Allow group thanos to read buckets in compartment id ocid1.compartment.oc1..a
Allow group thanos to manage objects in compartment id ocid1.compartment.oc1..a
```

### How to add a new client to Thanos?

objstore.go
Expand Down