Repository navigation
Add a native OCI Object Storage backend - #35
Merged
Merged
Conversation
OCI is reachable today only through s3.go as an S3-compatible endpoint, which signs with SigV4 against a static Customer Secret Key and cannot use an OKE workload principal. The native API can, so add a backend that speaks it directly. Credentials come from workload identity, explicit API-key fields, or the SDK's default chain, in that order. The flag defaults to off, so nothing changes for existing consumers. GeneratePresignedUrl maps onto a pre-authenticated request, which differs from an S3 presigned URL in ways the method documents.
boks1971
approved these changes
Sep 22, 2026
kyle-livekit
approved these changes
Sep 22, 2026
| PrivateKey string `yaml:"private_key,omitempty"` // PEM contents, not a path | ||
| PrivateKeyPassphrase string `yaml:"private_key_passphrase,omitempty"` | ||
|
|
||
| UseWorkloadIdentity bool `yaml:"use_workload_identity,omitempty"` |
There was a problem hiding this comment.
Might be worth dropping a comment here or elsewhere to remind people that using workload identity requires env vars such as OCI_RESOURCE_PRINCIPAL_VERSION and OCI_RESOURCE_PRINCIPAL_REGION. It's a pretty unintuitive design decision that has bitten me before.
The OCI SDK reads OCI_RESOURCE_PRINCIPAL_VERSION and OCI_RESOURCE_PRINCIPAL_REGION from the environment when resolving a workload identity principal, and fails construction if either is unset. Nothing in the config surface hints at that, so setting the flag alone looks sufficient and isn't.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
OCI is reachable today only through s3.go as an S3-compatible endpoint,
which signs with SigV4 against a static Customer Secret Key and cannot
use an OKE workload principal. The native API can, so add a backend that
speaks it directly.
Credentials come from workload identity, explicit API-key fields, or the
SDK's default chain, in that order. The flag defaults to off, so nothing
changes for existing consumers. GeneratePresignedUrl maps onto a
pre-authenticated request, which differs from an S3 presigned URL in ways
the method documents.