Skip to content

Add OCI detection via IMDS metadata server - #30

Merged
kshivakumar merged 1 commit into
dgzlopes:masterfrom
shimonelfassy-lang:add-oci-imds-detection
Jul 19, 2026
Merged

Add OCI detection via IMDS metadata server#30
kshivakumar merged 1 commit into
dgzlopes:masterfrom
shimonelfassy-lang:add-oci-imds-detection

Conversation

@shimonelfassy-lang

@shimonelfassy-lang shimonelfassy-lang commented Jul 2, 2026

Copy link
Copy Markdown
Contributor

Add OCI detection via IMDS metadata server

OCIProvider previously only detected Oracle Cloud via the DMI vendor file
(/sys/class/dmi/id/chassis_asset_tag) and raised NotImplementedError for the
metadata server. This adds metadata-server detection so OCI is identified the
same way as the AWS/GCP/Alibaba providers.

What it does

  • identify() now runs check_vendor_file() or await check_metadata_server().
  • Queries the OCI instance metadata service (IMDS)
    _get_metadata / _get_metadata_v2 structure:
    • _get_metadata() — GETs the v1 endpoint (http://169.254.169.254/opc/v1/instance/).
    • _get_metadata_v2() — delegates to _get_metadata against the v2 endpoint
      (.../opc/v2/instance/) with the required Authorization: Bearer Oracle header.
    • Both run concurrently via asyncio.gather; check_metadata_server() returns any(...).
  • Confirms it's really OCI (not just any host on the shared 169.254.169.254
    link-local IP) by checking the returned instance id starts with ocid1.instance..

Tests

  • Added test_valid_metadata_server_check and test_invalid_metadata_server_check
    using aresponses, mirroring the AWS metadata tests.
  • Full suite: 36 passed. flake8 --max-line-length 100 clean.

Comment thread cloud_detect/providers/oci_provider.py
@shimonelfassy-lang

Copy link
Copy Markdown
Contributor Author

Hi @dgzlopes 👋

Just a heads-up on the red CI here — the failures don't seem related to this change:

  • Python 3.9 / 3.10 / 3.11: pytest itself is green (36 passed), but the subsequent pre-commit install step crashes with ModuleNotFoundError: No module named 'pkg_resources'. The pinned pre-commit==1.11.2 imports pkg_resources, which was removed in newer setuptools (the runners now get setuptools 83). So any PR would hit this.
  • Python 3.7: actions/setup-python@v2 can no longer provision 3.7 on current GitHub runners (Version 3.7 with arch x64 not found).
  • Python 3.6: the job hangs until the 24h timeout for the same reason.
  • Python 3.8 passes end-to-end, and DCO is green.

Is there anything blocking this from being merged? Glad to address any feedback.

@kshivakumar

Copy link
Copy Markdown
Collaborator

@shimonelfassy-lang I will set the minimum Python version as 3.9 since older versions are way past EOL. I will raise a PR in a day or two and rebase yours.

@kshivakumar

Copy link
Copy Markdown
Collaborator

@shimonelfassy-lang I can't rebase since the branch doesn't exist in this repo. Please rebase your PR (there will be small conflicts)

OCIProvider now queries the OCI instance metadata service in addition to
the DMI vendor file, mirroring the AWS/GCP/Alibaba providers. It GETs the
IMDS endpoint (v2 with the `Authorization: Bearer Oracle` header, and the
v1 fallback) and confirms the instance `id` starts with `ocid1.instance.`.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Shimon Elfassy <shimon.elfassy@sweet.security>
@shimonelfassy-lang

shimonelfassy-lang commented Jul 19, 2026 via email

Copy link
Copy Markdown
Contributor Author

@kshivakumar
kshivakumar merged commit 1012a1d into dgzlopes:master Jul 19, 2026
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants