Support OCI Vault integration using Instance Principals

[anilmoris]

I’m trying to configure the Oracle DB Observability Exporter (v1.6.0) to retrieve the database password from OCI Vault using Instance Principals.

I am passing
OCI_VAULT_ID
OCI_VAULT_SECRET_NAME

I am seeing this error

time=2025-05-02T11:13:16.538Z level=INFO  source=main.go:75 msg="OCI_VAULT_ID env var is present so using OCI Vault" vaultOCID=ocid1.vault.oc1.phx...
2025/05/02 11:13:16 can not create client, bad configuration: did not find a proper configuration for tenancy

Expected behavior:
The exporter should detect and use the instance principal (no local config file), retrieve the secret from OCI Vault, and connect to the database without requiring a wallet or ~/.oci/config.

Actual current behavior:
It fails with did not find a proper configuration for tenancy even though instance principal is enabled.

a local ~/.oci/config is not needed when using Instance Principals.

[markxnelson]

Hi @anilmoris - thanks for your suggestion, we will add this to the roadmap.

[anders-swanson]

As part of this fix, I'm going to add workload identity (OKE) as well 👍

[andycoates]

Could you ensure the updated Vault auth support also works with the new multi-db config? Assuming similar config, I'd picture something like

vault_auth:
  oci:
    type: instance_principal
  azure: ...
  gcp: ....
  aws: ....

(Edit: I saw the new config for Vault is actually in the multi-db config - just not in the example file)

Also something to think about - I think wallets are also a pain to manage - could there be an option to fetch the wallet from Vault too?

[anders-swanson]

Hi @andycoates OCI Vault and AZ Vault are currently supported in multi-database:
https://github.com/oracle/oracle-db-appdev-monitoring?tab=readme-ov-file#using-oci-vault

You can connect each database to a different vault. We've yet to implement additional auth mechanisms like instance principal, or support for GCP/AWS, but these are on our roadmap.

[markxnelson]

fyi @anders-swanson the AZ vault impl does work with their equivalent of instance principal already