OCI DevOps Platform

A full-stack DevOps portfolio project on Oracle Cloud Infrastructure (OCI): Terraform-provisioned OKE cluster, OCI DevOps CI/CD pipelines, Ansible instance automation, Helm deployments, OCI Vault secret management, and Prometheus/Grafana monitoring — with GitHub Actions CI pushing images to OCIR.

See docs/architecture.md for the full system diagram.

Stack

Layer	Tools
IaC	Terraform (OCI provider — VCN, OKE, Vault, OCIR, DevOps project)
Kubernetes	OKE (Oracle Kubernetes Engine)
Container Registry	OCIR (Oracle Container Registry)
CI/CD	OCI DevOps Pipelines + GitHub Actions
Secret Management	OCI Vault + KMS encryption keys
Config Management	Ansible (OCI instance provisioning + hardening)
Packaging	Helm (OCI Load Balancer annotations, HPA, security context)
Monitoring	Prometheus + Grafana + OCI Monitoring service
Security Scanning	Trivy (CRITICAL/HIGH CVE gate in CI)

OCI Services Covered

VCN · OKE · OCIR · OCI DevOps · OCI Vault · OCI KMS · OCI Load Balancer · OCI Object Storage · OCI Monitoring · OCI Compute

Repo Layout

terraform/
  main.tf                        # OCI provider, OKE, Vault, OCIR, DevOps project
  modules/
    vcn/                         # VCN, subnets, IGW, NAT, route tables, security lists
    oke/                         # OKE cluster + node pool (Flex shapes)
    vault/                       # OCI Vault + KMS key + secret
oci-devops/
  build-pipeline/build_spec.yaml # OCI DevOps build spec (build → Trivy scan → push to OCIR)
  deploy-pipeline/deploy_spec.yaml # OCI DevOps deploy spec (Vault secret pull → Helm deploy)
ansible/
  provision.yml                  # OCI instance provisioning + hardening
  roles/common/                  # SSH hardening, system updates, timezone
  roles/oci-instance/            # OCI CLI, Oracle Cloud Agent, instance metadata
helm/app-chart/                  # Helm chart with OCI LB annotations
monitoring/
  prometheus-values.yaml         # kube-prometheus-stack + OCI Monitoring integration
.github/workflows/ci.yml         # GitHub Actions: build → Trivy → push to OCIR → trigger OCI DevOps
docs/architecture.md             # System architecture diagram

Deploy

Prerequisites

• OCI account with required IAM policies
• OCI CLI configured (~/.oci/config)
• Terraform >= 1.5.0
• kubectl, helm installed

1. Provision OCI infrastructure

cd terraform
cp terraform.tfvars.example terraform.tfvars  # fill in your OCIDs
terraform init
terraform plan
terraform apply

2. Get OKE kubeconfig

oci ce cluster create-kubeconfig \
  --cluster-id <OKE_CLUSTER_ID> \
  --region us-ashburn-1 \
  --token-version 2.0.0
kubectl get nodes

3. Create OCIR image pull secret

kubectl create secret docker-registry ocir-secret \
  --docker-server=iad.ocir.io \
  --docker-username='<TENANCY_NAMESPACE>/<USERNAME>' \
  --docker-password='<AUTH_TOKEN>' \
  -n demo-app

4. Deploy monitoring stack

helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
helm install monitoring prometheus-community/kube-prometheus-stack \
  -n monitoring --create-namespace \
  -f monitoring/prometheus-values.yaml

5. Deploy app with Helm

helm upgrade --install demo-app ./helm/app-chart \
  --namespace demo-app --create-namespace \
  --set image.tag=<IMAGE_TAG>

6. Provision OCI compute instances with Ansible

cd ansible
cp inventory.ini.example inventory.ini  # fill in instance IPs
ansible-playbook -i inventory.ini provision.yml

7. Set up GitHub Actions secrets

Secret	Value
OCI_TENANCY_OCID	Your tenancy OCID
OCI_USER_OCID	Your user OCID
OCI_FINGERPRINT	API key fingerprint
OCI_PRIVATE_KEY	API private key content
OCI_AUTH_TOKEN	Auth token for OCIR login
OCI_TENANCY_NAMESPACE	Object storage namespace
OCI_USERNAME	OCI username
OCI_DEPLOY_PIPELINE_ID	OCI DevOps deploy pipeline OCID