Mastering the OCI CLI: What It Does, Tips, Tricks, and Gotchas

The Oracle Cloud Infrastructure (OCI) Command Line Interface (CLI) is a powerful tool for managing OCI resources programmatically. It allows developers, DevOps engineers, and administrators to interact with Oracle Cloud services using scripts or direct commands, streamlining tasks like provisioning compute instances, managing storage, or configuring Kubernetes clusters. This blog post explores what the OCI CLI does, along with essential tips, tricks, and common gotchas to help you use it effectively.

What Does the OCI CLI Do?

The OCI CLI is a Python-based command-line tool that provides a programmatic interface to Oracle Cloud Infrastructure services. It allows you to:

Manage Resources: Create, update, and delete resources such as virtual machines, block volumes, object storage, and Kubernetes clusters.
Automate Tasks: Integrate OCI operations into CI/CD pipelines, scripts, or automation workflows.
Access Advanced Features: Perform operations not always available in the OCI Console, such as fine-grained control over resources or bulk operations.
Debug and Monitor: Use the --debug flag to troubleshoot issues or inspect API calls.

The CLI supports a wide range of OCI services, including Compute, Networking, Storage, Identity, and Container Engine for Kubernetes (OKE). It’s particularly useful for automating repetitive tasks, managing large-scale deployments, or accessing features programmatically.

Tips and Tricks for Using the OCI CLI

1. Simplify Installation with the Right Python Version

The OCI CLI requires Python 3.11 to function correctly. Using Python 3.10, 3.12, or 3.13 will result in installation failures due to compatibility issues (more on this in the “Gotchas” section). Ensure you have Python 3.11 installed before proceeding.

Tip: Use a version manager like pyenv to manage multiple Python versions and avoid conflicts:

pyenv install 3.11.0
pyenv global 3.11.0

2. Quick Setup with Config File

After installing the OCI CLI, configure it using:

oci setup config

This command generates a configuration file at ~/.oci/config and prompts you for details like user OCID, tenancy OCID, region, and API key. You can also create the file manually for scripted setups.

Tip: Use multiple profiles in the config file to manage different OCI accounts:

[DEFAULT]
user=ocid1.user.oc1..<user-ocid>
fingerprint=<fingerprint>
key_file=~/.oci/oci_api_key.pem
tenancy=ocid1.tenancy.oc1..<tenancy-ocid>
region=us-phoenix-1

[SECOND_PROFILE]
user=ocid1.user.oc1..<another-user-ocid>
fingerprint=<another-fingerprint>
key_file=~/.oci/another_oci_api_key.pem
tenancy=ocid1.tenancy.oc1..<another-tenancy-ocid>
region=us-ashburn-1

Switch profiles with the --profile flag:

oci compute instance list --profile SECOND_PROFILE

3. Leverage JSON Output for Automation

The OCI CLI outputs results in JSON by default, making it ideal for scripting. Parse outputs with tools like jq:

oci compute instance list --compartment-id <compartment-ocid> | jq '.data[].id'

Tip: Use --output table for human-readable output during manual exploration:

oci compute instance list --output table

4. Use Environment Variables for Sensitive Data

Avoid hardcoding sensitive information in scripts. Set environment variables for credentials:

export OCI_CLI_USER=ocid1.user.oc1..<user-ocid>
export OCI_CLI_FINGERPRINT=<fingerprint>
export OCI_CLI_KEY_FILE=~/.oci/oci_api_key.pem
export OCI_CLI_TENANCY=ocid1.tenancy.oc1..<tenancy-ocid>
export OCI_CLI_REGION=us-phoenix-1

The CLI will automatically use these variables, reducing the risk of exposing credentials.

5. Debug with the `--debug` Flag

If a command fails, use the --debug flag to get detailed logs, including HTTP requests and responses:

oci ce cluster create-kubeconfig --cluster-id <cluster-ocid> --debug

This is invaluable for troubleshooting authentication or resource issues.

Gotchas to Watch Out For

1. Python Version Compatibility

The OCI CLI is strict about Python versions. Only Python 3.11 is supported. Using other versions results in errors:

- Python 3.10 fails with a SameFileError during installation:

shutil.SameFileError: 'C:\\Program Files (x86)\\Oracle\\oci_cli\\Scripts\\create_backup_from_onprem.exe' and 'C:\\Program Files (x86)\\Oracle\\oci_cli\\scripts\\create_backup_from_onprem.exe' are the same file

- Python 3.12 and 3.13 fail due to the removal of the distutils module:

ModuleNotFoundError: No module named 'distutils'

This issue has been reported to Oracle (see GitHub issue #968).

Workaround: Install Python 3.11 explicitly and verify the version:

python --version

2. Switching OCI Accounts

When switching between OCI accounts, the .oci directory in your home folder (~/.oci on Linux/Mac or C:\Users\<username>\.oci on Windows) can cause conflicts. If not updated, you may encounter 404 NotAuthorizedOrNotFound errors:

ServiceError: {"code": "NotAuthorizedOrNotFound", "message": "Authorization failed or requested resource not found."}

Workaround: Rename or remove the .oci directory before re-running oci setup config:

mv ~/.oci ~/.oci_backup
oci setup config

3. Cygwin Hangs with `oci ce cluster create-kubeconfig`

Running the oci ce cluster create-kubeconfig command in Cygwin can cause the command to hang after entering the passphrase:

Enter a passphrase for your private key ("N/A" for no passphrase): "N/A"

Workaround: Use PowerShell instead of Cygwin for this command:

oci ce cluster create-kubeconfig --cluster-id <cluster-ocid> --file $HOME/.kube/config --region us-phoenix-1 --token-version 2.0.0 --kube-endpoint PUBLIC_ENDPOINT

4. API Key Quota Limits

OCI imposes a limit of 3 API keys per user. Exceeding this limit results in an IdcsConversionError:

ServiceError: {"code": "IdcsConversionError", "message": "You can not create ApiKey as maximum quota limit of 3 has been reached.", "status": "400"}

Workaround: Remove unused API keys via the OCI Console:

Navigate to Identity & Security > Users.
Select your user and go to the API Keys section.
Delete unnecessary keys to free up quota.

5. Config File Not Found in Cygwin

In Cygwin, you might see:

ERROR: Could not find config file at C:\Users\<username>\.oci\config

This happens because Cygwin uses a different home directory (/home/<username>). The CLI expects the config file in the Windows home directory.

Workaround: Copy the .oci directory to the Windows home directory or specify the config file explicitly:

oci --config-file /cygdrive/c/Users/<username>/.oci/config ...

Bonus: Advanced Tricks

1. Batch Operations with Scripts

Use loops in Bash or PowerShell to perform bulk operations. For example, to terminate multiple instances:

for instance in $(oci compute instance list --compartment-id <compartment-ocid> | jq -r '.data[].id'); do
    oci compute instance action --instance-id $instance --action TERMINATE
done

2. Use Aliases for Common Commands

Save time by creating aliases for frequently used commands:

alias oci-instances='oci compute instance list --compartment-id <compartment-ocid>'

Add this to your ~/.bashrc or ~/.zshrc for persistence.

3. Validate Inputs with `--dry-run`

Some OCI CLI commands support a --dry-run flag to simulate operations without making changes. Use it to verify your command before execution:

oci compute instance launch --dry-run --compartment-id <compartment-ocid> ...

Conclusion

The OCI CLI is a versatile tool for managing Oracle Cloud Infrastructure resources, but it comes with its share of nuances. By sticking to Python 3.11, managing your .oci directory carefully, and using PowerShell for specific commands like create-kubeconfig, you can avoid common pitfalls. Leverage tips like JSON parsing, environment variables, and debug mode to enhance your workflows. With these insights, you’ll be well-equipped to harness the full power of the OCI CLI for automation and resource management.

For more details, check the OCI CLI documentation or report issues on the OCI CLI GitHub.

Why I’m Rolling Back Security Patch 16.5.1 (c) on iPhone

UPDATE: I’ve since upgraded iOS to 18.3. After removing the device from Bluetooth and adding it back, the notifications worked again.

I seldom roll back patches. Especially security patches. I work in security. It’s essential to stay up-to-date with the latest security patches to protect our devices from potential threats. However, sometimes these patches can inadvertently introduce new issues, affecting the overall user experience. In this blog post, we’ll explore the reasons behind the decision to roll back the security patch 16.5.1 (c) on the iPhone, focusing on the specific issues it caused: the breakdown of Bluetooth texting with Microsoft Windows phone link and Tesla’s voice texting functionality.

The Importance of Security Patches:

Before we delve into the reasons for rolling back the security patch, let’s acknowledge the significance of timely updates. Security patches play a crucial role in safeguarding our devices against potential vulnerabilities, malware, and other cyber threats. They are essential for maintaining a secure and stable environment for users.

The Problematic Patch:

While patch 16.5.1 (c) aimed to improve the security of iPhones, it unintentionally disrupted certain functionalities, leading to frustration for many users. Two of the prominent issues experienced were the inability to use Microsoft Windows phone link for texting and a failure of voice texting in Tesla vehicles.

Bluetooth Texting with Microsoft Windows Phone Link:
Many iPhone users rely on Bluetooth connectivity to stay connected while on the move. The Microsoft Windows phone link provides seamless integration between iPhones and Windows PCs, allowing users to send and receive text messages directly from their computers. However, after applying security patch 16.5.1 (c), users noticed that this feature ceased to function as expected.

Rolling back the patch is essential to restore this valuable functionality, enabling users to stay productive and connected regardless of the device they are using.

Texting with Voice from Tesla Vehicles:
Voice-activated features have become increasingly popular in modern vehicles, enhancing convenience and safety while driving. Tesla’s voice texting functionality enabled iPhone users to send and receive texts hands-free, contributing to a safer driving experience. Unfortunately, after applying the security patch, this feature stopped working in Tesla vehicles.

With safety being a top priority, it’s crucial to resolve this issue promptly. By rolling back the patch, iPhone users can once again enjoy the convenience and safety of voice texting in their Tesla vehicles.

The Decision to Roll Back:

The decision to roll back the security patch was not taken lightly, considering the importance of maintaining a secure device. However, the issues faced by users with Bluetooth texting and voice texting in Tesla vehicles were significant enough to warrant action. The lack of these essential functionalities could hinder productivity, communication, and safety, potentially outweighing the security benefits of the patch.

Apple’s Commitment to Users:

As a tech giant, Apple is known for its dedication to providing a seamless user experience. In light of the reported issues, it is reasonable to expect that Apple will address the problems promptly and release a revised security patch that addresses the concerns without compromising on security.

Conclusion:

Staying on top of security updates is crucial in today’s digital landscape, but sometimes unforeseen issues can arise. The decision to roll back the security patch 16.5.1 (c) on the iPhone, which caused Bluetooth texting problems with Microsoft Windows phone link and disabled Tesla’s voice texting functionality, aims to prioritize user convenience and safety. Apple’s commitment to its users should lead to a swift resolution of the problems faced, ensuring a harmonious balance between security and seamless connectivity in future updates.

Navigating Cellular Roaming: Overcoming Signal Challenges and Troubleshooting Tips

Cellular roaming has revolutionized the way we stay connected while traveling abroad. However, even with advancements in technology, occasional hiccups can occur. We’ll delve into a personal experience with cellular roaming in Japan, where signal fluctuations and unexpected network transitions left me without data service. We’ll explore the potential causes of the issue, including multiple SIM cards, and discuss the simple yet effective troubleshooting technique that saved the day.

The Roaming Experience in Japan:
During my recent visit to Japan, I had the opportunity to experience cellular roaming firsthand. I was using SoftBank as my service provider, while my daughter’s phone was on Docomo. Initially, both phones provided seamless connectivity. However, I encountered an unexpected obstacle when I lost signal inside a train station, and my phone switched over to the AU network. To my dismay, despite having full signal bars, I found myself without data service or any functionality.

Two SIM Cards, One Phone: Unraveling the Mystery
Initially, I suspected that the presence of two SIM cards in my phone—a physical SIM card and an e-SIM—might have caused the connectivity issue. With this theory in mind, I promptly removed the physical SIM card, leaving only the e-SIM active. However, to my surprise, this did not resolve the problem. Even with the e-SIM as the sole active SIM, my phone remained unable to establish a connection on the AU network.

Exploring Cellular Options: Undeterred, I delved into my phone’s cellular options, hoping to find a resolution there. I experimented with different roaming providers listed in the settings, including unfamiliar names like KDDI and NT Docomo. Despite my attempts, none of these changes had any positive impact on my connectivity. The frustration of being unable to establish a data connection persisted.

Rebooting: The Troubleshooting Hero
Frustrated by the lack of connectivity, I decided to reboot the phone. To my relief, this simple action proved to be the solution. After restarting the device, it automatically reconnected to the available network, and I was once again able to access data services. It’s important to note that rebooting your device can often resolve various software-related issues, including those affecting cellular connectivity.

Understanding Signal Strength and Network Transitions:
The scenario described above highlights the importance of signal strength and network transitions in cellular roaming. While my phone displayed full signal bars on the AU network, the lack of data service indicated a weak or unstable signal. Network transitions occur when your phone automatically switches between different cellular networks to maintain connectivity. These transitions depend on factors such as signal strength, network availability, and agreements between your home network provider and the roaming network. In this case, the network transition to AU resulted in a temporary loss of service until the device was rebooted.

INTERESTING UPDATE: I noticed the phone roam into AU again during the day and it worked just fine. I’m guessing that I could’ve probably just rebooted at the time and it would’ve fixed it also.

Tips for a Smooth Roaming Experience:

Research and Preparation: Before traveling, research the available network providers in your destination, their coverage areas, and the agreements your home network provider has with them. This information will help you select the most suitable network option for your needs.

Enable Roaming and Check Settings: Ensure that your phone’s roaming settings are enabled before your departure. Additionally, periodically review and verify your network settings to ensure they are correctly configured for roaming.

Network Selection: Some phones allow you to manually select a preferred network. If you encounter connectivity issues or wish to prioritize a specific network, exploring this option might provide a solution.

Troubleshooting Techniques: In cases of connectivity issues, try simple troubleshooting techniques such as rebooting your device. Restarting can often resolve software-related problems and restore connectivity.

Conclusion:
Cellular roaming offers incredible convenience, allowing us to stay connected when traveling abroad. However, occasional signal challenges and network transitions can disrupt our connectivity. By understanding the factors influencing cellular roaming and employing effective troubleshooting techniques like rebooting, we can overcome these obstacles and enjoy a seamless roaming experience. So, stay informed, be prepared, and roam the world with confidence!

Troubleshooting a Mysterious Networking Issue in Windows 11 (NOT!)

Networking issues can be frustrating and time-consuming to troubleshoot. This was just one of my many experiences troubleshooting an interesting network issue that took me a while to solve.

The Problem: One day, I noticed that my computer’s network connection was acting up. The network interface card (NIC) was sending packets just fine, but it was receiving very few packets, and eventually, it would stop receiving packets altogether. At first, I suspected that the issue happened after I installed the Insider Preview of Windows 11, so I reset Windows. I updated the Realtek NIC driver to the latest version, hoping that it might help. The problem persisted.

The Troubleshooting: Next, I decided to reinstall Windows 11 from scratch, thinking that it might fix the issue. The problem still persisted even after the fresh install. Now I knew that the issue was likely to be hardware.

I boot into Linux from a USB drive. To my surprise, the issue persisted even in Linux. This ruled out any software or driver issues with Windows.

The Solution: I started to suspect that the issue might be with my Wi-Fi access point. I have a TP-Link Deco 6E mesh Wi-Fi system, and one of the access points acts as the main router. I decided to swap the problematic access point with another one, and to my relief, the issue disappeared instantly. My NIC was now sending and receiving packets normally, and I was back online.

Conclusion: Networking issues can be tricky to troubleshoot, and it’s easy to get lost in a sea of software and driver issues. Sometimes, the problem might not even be with your computer at all, but with your network equipment. If you’re experiencing a similar networking issue, try ruling out all software and driver issues first, and then focus on your network equipment. Hopefully, my experience will save you some time and frustration.

Watch out for Apparmor!

I’ve been hit by Apparmor a couple of times now. First with Samba, then with Openldap. AppArmor is a mandatory access control (MAC) system that restricts the capabilities of applications on a Linux system. While it can enhance the security of a Linux system, it can also cause issues with certain applications. Here are some apps that AppArmor can break and workarounds for each.

Docker

Docker is a popular containerization technology that allows users to package and run applications in isolated environments. AppArmor can cause issues with Docker by blocking access to certain system resources required by Docker containers. To work around this issue, you can create a custom AppArmor profile for Docker that allows it to access the necessary resources.

To create a custom AppArmor profile for Docker, you can create a new profile file in the /etc/apparmor.d/ directory with the following contents:

# Profile for Docker
profile docker-container {
  # Allow access to necessary system resources
  /var/lib/docker/** rw,
  /var/run/docker.sock rw,
  /sys/fs/cgroup/** rw,
  /proc/sys/** rw,
  /etc/hostname r,
  /etc/hosts r,
  /etc/resolv.conf r,
  /etc/passwd r,
  /etc/group r,
  /etc/shadow r,
  /etc/gshadow r,
}

After creating the profile file, you can load it into the AppArmor kernel by running the following command:

sudo apparmor_parser -r /etc/apparmor.d/docker-container

Apache

Apache is a widely used web server that can also be affected by AppArmor. If Apache is running in a restricted environment, it may not be able to access certain files or directories. To resolve this issue, you can modify the AppArmor profile for Apache to allow access to the necessary resources.

To modify the AppArmor profile for Apache, you can edit the existing profile file located in /etc/apparmor.d/usr.sbin.apache2 and add the necessary permissions. For example, to allow Apache to access the /var/www/html/ directory, you can add the following line to the profile:

/var/www/html/** r,