To deploy nodes

• On-premises
• AWS
• GCP
• Azure
• OCI
• Kubernetes

For YugabyteDB Anywhere (YBA) to be able to deploy and manage YugabyteDB universes using an OCI cloud provider configuration, you need to provide YBA with privileges on your cloud infrastructure to create, delete, and modify VMs, mount and unmount disk volumes, and so on. The more permissions that you can provide, the more YBA can automate.

OCI

The following policy statements are required in the compartment where you will deploy universes. Replace yba-admins with the group that the API-key user belongs to (or the dynamic group, if using instance principal), and <compartment> with the compartment name or OCID.

Allow group yba-admins to manage instance-family in compartment <compartment>
Allow group yba-admins to manage volume-family in compartment <compartment>
Allow group yba-admins to use virtual-network-family in compartment <compartment>
Allow group yba-admins to manage app-catalog-listing in tenancy
Allow group yba-admins to inspect compartments in tenancy

If you will use an Instance Configuration OCID when adding regions, also grant:

Allow group yba-admins to read instance-configurations in compartment <compartment>

If you will set a DNS Zone OCID on the provider, also grant the following in the compartment that contains the zone:

Allow group yba-admins to manage dns in compartment <compartment>

For more information on writing policies, see How Policies Work in the OCI documentation.

To grant the required access, you do one of the following:

• Create an API signing key for an OCI user in a group that has the policy. You'll later provide YBA with the Tenancy OCID, User OCID, fingerprint, and PEM private key when creating the OCI provider configuration.
• Assign the YugabyteDB Anywhere compute instance to a dynamic group that has the policy, and authenticate with instance principal.

API signing key

If using an API signing key, record the following information. You will need to provide this information later to YBA.

Generate an API signing key in the OCI Console under the user's API Keys, and download the PEM private key. For more information, see Required Keys and OCIDs in the OCI documentation.

If you are intending to back up to OCI Object Storage, the same user (or instance principal) can also be granted object-storage permissions; refer to Permissions to back up and restore.

Instance principal

If YugabyteDB Anywhere is running on an OCI compute instance, you can authenticate using instance principal instead of storing an API signing key.

1. Create a dynamic group whose matching rule includes the YBA instance. For example:

   ALL {instance.id = '<yba-instance-ocid>'}
   

   For more information, see Managing Dynamic Groups in the OCI documentation.

2. Create a policy that grants the dynamic group the same permissions listed above, replacing group yba-admins with dynamic-group <dynamic-group-name>.

3. When creating the OCI provider configuration, choose Instance Principal as the authentication type.

Provide access to compute images

In addition to OCI cloud permissions, to create VMs on OCI YBA needs access to the operating system disk images.

You must grant this access, and also accept any OS licensing terms manually before providing this access to YBA.

By default, YBA requires access to the AlmaLinux OS 9 x86_64 and AArch64 Partner Image Catalog listings.

Default case

If you plan to use YBA defaults, then, while logged into the OCI Console, go to Compute > Partner Images, subscribe to AlmaLinux OS 9 for both x86_64 and AArch64, and accept the terms.

If needed, be sure to do this in every region where you intend to deploy database clusters.

Custom disk image

If you plan to use a custom operating system and disk image, then verify that the API signing key user or instance principal that you provisioned earlier has access to the required OS disk image (that is, the specific image OCID) in every region where you intend to deploy database clusters.

Managing SSH keys for VMs

When creating VMs on the public cloud using a cloud provider configuration, YugabyteDB requires SSH keys to access the VM. You can manage the SSH keys for VMs in two ways:

• YBA managed keys. When YBA creates VMs, it will generate and manage the SSH key pair.
• Provide a custom key pair. Create your own custom SSH keys and upload the SSH keys when you create the provider.

YBA injects the public key into instance metadata (ssh_authorized_keys) when launching compute instances. The key pair authenticates as the image's default login user. For the user requirements, see Software requirements for cloud provider nodes.

If you will be using your own custom SSH keys, ensure they are authorized for that user and that you have them when installing YBA and creating your OCI cloud provider configuration.