PBM-1727 Oracle Cloud Storage by rasika-chivate · Pull Request #377 · percona/pbm-docs

rasika-chivate · 2026-06-11T14:54:45Z

This PR contains documentation for the following:

Compatibility with Oracle Cloud Storage.
Compatibility with Oracle Cloud Storage using Workload Identity authentication

For details, see the following tickets:

https://perconadev.atlassian.net/browse/PBM-1727
https://perconadev.atlassian.net/browse/PBM-1728

Copilot

Pull request overview

Adds a new documentation page describing how to configure Percona Backup for MongoDB (PBM) to use Oracle Cloud Infrastructure (OCI) Object Storage as a remote backup destination, including both user principal and instance principal authentication flows.

Changes:

Introduces a new OCI Object Storage guide with CLI setup, IAM policy guidance, and example PBM configurations.
Documents both userPrincipal (API signing keys) and instancePrincipal (keyless, on-OCI) authentication options.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

…rcona/pbm-docs into PBM-1727-Oracle-Cloud-Storage

Copilot

Pull request overview

Copilot reviewed 5 out of 6 changed files in this pull request and generated 5 comments.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 5 out of 6 changed files in this pull request and generated 1 comment.

jcechace

Mostly looking good. We ought to reconsider what content goes under oci-storage.md and what goes under oci-wif.md.

Currently there are overlap (userPrinciapl and instancePrinciapl are in both, userPrinciapl is technically not wif).

Missing documentation for Server Side Encryption.

jcechace · 2026-06-15T09:24:15Z

+Before configuring PBM, ensure that you have:
+
+- An active OCI tenancy with at least one subscribed region
+- The OCI CLI installed and configured (`oci setup config`). 


This is not strictly required, all required steps can be equally performed via OCI web console

jcechace · 2026-06-15T09:25:23Z

+  for installation instructions
+- An OCI user with permission to create compartments, buckets, 
+  dynamic groups, and IAM policies in your tenancy
+- An OCI API signing key pair: private key on the host running 


Strictly speaking, for PBM runtime, private key does not have to be present "on the host running PBM". The key is stored within PBM configuration (same as other storages)

jcechace · 2026-06-15T09:27:00Z

+```sh
+export HOME_REGION=<your-home-region>     # e.g. us-ashburn-1
+export BUCKET_REGION=<your-bucket-region> # e.g. eu-frankfurt-1
+export COMPARTMENT_NAME=pbm-backup


Any name can be used for compartment

jcechace · 2026-06-15T09:29:03Z

+
+## Create a compartment
+
+Create a compartment for PBM backup resources:


While OCI resources always require a compartment, creating one is optional and using the root compartment is perfectly valid. It is however a good practice to use them

jcechace · 2026-06-15T09:33:03Z

+to manage objects in the PBM compartment. Replace 
+`<OCI_GROUP_NAME>` with the name of the group containing 
+your PBM user:
+
+```sh
+oci iam policy create \
+  --region "$HOME_REGION" \
+  --compartment-id "$TENANCY_OCID" \
+  --name pbm-user-access \
+  --description "Allow PBM user group to manage backup objects" \
+  --statements "[\"Allow group <OCI_GROUP_NAME> to manage object-family in compartment $COMPARTMENT_NAME\"]"


Where does this come from? Technically if the user owns the bucket, this is not required.

Not against it, but it might be slightly confusing since we haven't assigned the user to a group in any of the previous steps

jcechace · 2026-06-15T09:36:48Z

+You need:
+
+- An OCI user account with access to the target bucket
+- An [API signing key pair :octicons-link-external-16:](https://docs.oracle.com/en-us/iaas/Content/API/Concepts/apisigningkey.htm){:target="_blank"} (private key file and its fingerprint)


Again, this is required only for the setup using the CLI. Not for PBM runtime when using instancePrincipal or okeWorkloadIdentity

jcechace · 2026-06-15T09:38:32Z

+2. **Configure PBM authentication**
+
+    In your PBM configuration, set the storage type to `oci` and the credentials type to `userPrincipal`. Provide the API signing key private key in PEM format.
+
+    ```yaml
+    storage:
+      type: oci
+      oci:
+        region: <bucket_region>
+        namespace: <namespace>
+        bucket: <bucket_name>
+        prefix: <path_prefix>
+        credentials:
+          type: userPrincipal
+          userPrincipal:
+            tenancy: <tenancy_ocid>
+            user: <user_ocid>
+            fingerprint: <key_fingerprint>
+            privateKey: |
+              -----BEGIN PRIVATE KEY-----
+              ...
+              -----END PRIVATE KEY-----
+    ```


I'm a bit confused as why this is here, since userPrincipal is not classified as workload identity (an actual user identity is used, not the workload -- cluster / instance identity)

PBM-1727 Oracle Cloud Storage

218b613

rasika-chivate marked this pull request as draft June 11, 2026 14:54

rasika-chivate deployed to PBM-1727-Oracle-Cloud-Storage - pbm-release-branch-docs PR #377 June 11, 2026 14:56 — with Render View deployment

Update oci-storage.md

cb1ec3d

rasika-chivate deployed to PBM-1727-Oracle-Cloud-Storage - pbm-release-branch-docs PR #377 June 11, 2026 16:37 — with Render View deployment

rasika-chivate requested a review from Copilot June 11, 2026 16:37

Copilot started reviewing on behalf of rasika-chivate June 11, 2026 16:38 View session

Copilot AI reviewed Jun 11, 2026

View reviewed changes

Potential fix for pull request finding

6780b88

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

rasika-chivate temporarily deployed to PBM-1727-Oracle-Cloud-Storage - pbm-release-branch-docs PR #377 June 12, 2026 06:05 — with Render Destroyed

Potential fix for pull request finding

b6defbd

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

rasika-chivate temporarily deployed to PBM-1727-Oracle-Cloud-Storage - pbm-release-branch-docs PR #377 June 12, 2026 06:05 — with Render Destroyed

Potential fix for pull request finding

434ac3f

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

rasika-chivate temporarily deployed to PBM-1727-Oracle-Cloud-Storage - pbm-release-branch-docs PR #377 June 12, 2026 06:06 — with Render Destroyed

Potential fix for pull request finding

71732c0

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

rasika-chivate temporarily deployed to PBM-1727-Oracle-Cloud-Storage - pbm-release-branch-docs PR #377 June 12, 2026 06:07 — with Render Destroyed

Potential fix for pull request finding

47d828d

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

rasika-chivate requested a deployment to PBM-1727-Oracle-Cloud-Storage - pbm-release-branch-docs PR #377 June 12, 2026 06:07 — with Render In progress

Potential fix for pull request finding

826abd4

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

rasika-chivate temporarily deployed to PBM-1727-Oracle-Cloud-Storage - pbm-release-branch-docs PR #377 June 12, 2026 06:07 — with Render Destroyed

Potential fix for pull request finding

2bc680b

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

rasika-chivate temporarily deployed to PBM-1727-Oracle-Cloud-Storage - pbm-release-branch-docs PR #377 June 12, 2026 06:07 — with Render Destroyed

Potential fix for pull request finding

7b0c1f2

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

rasika-chivate temporarily deployed to PBM-1727-Oracle-Cloud-Storage - pbm-release-branch-docs PR #377 June 12, 2026 06:08 — with Render Destroyed

Potential fix for pull request finding

ecd613e

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

rasika-chivate temporarily deployed to PBM-1727-Oracle-Cloud-Storage - pbm-release-branch-docs PR #377 June 12, 2026 06:08 — with Render Destroyed

Potential fix for pull request finding

3a571ea

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

rasika-chivate deployed to PBM-1727-Oracle-Cloud-Storage - pbm-release-branch-docs PR #377 June 12, 2026 06:08 — with Render View deployment

rasika-chivate requested a review from Copilot June 12, 2026 06:08

Copilot started reviewing on behalf of rasika-chivate June 12, 2026 06:09 View session

Potential fix for pull request finding

c174fdf

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

rasika-chivate temporarily deployed to PBM-1727-Oracle-Cloud-Storage - pbm-release-branch-docs PR #377 June 12, 2026 09:32 — with Render Destroyed

Copilot AI and others added 14 commits June 12, 2026 09:34

docs: include okeWorkloadIdentity in OCI credentials type options

d051e2a

Rename OCI WIF doc filename to lowercase

799a81d

Update mkdocs-base.yml

61a5065

Merge branch 'PBM-1727-Oracle-Cloud-Storage' of https://github.com/pe…

46721d3

…rcona/pbm-docs into PBM-1727-Oracle-Cloud-Storage

Update oci-storage.md

33a709f

Update oci-storage.md

a054489

Update mkdocs-base.yml

6c49d62

Update oci-storage.md

cf2755e

Update oci-wif.md

ca57383

Update oci-wif.md

1e7ab2c

Update oci-storage.md

dede907

Update oci-storage.md

022a45b

Update oci-storage.md

c6322b8

Update oci-storage.md

96ba9e1

Copilot AI reviewed Jun 12, 2026

View reviewed changes

Comment thread docs/details/oci-storage.md

Comment thread docs/details/oci-storage.md Outdated

Comment thread docs/details/oci-storage.md Outdated

Comment thread docs/details/oci-wif.md Outdated

Comment thread mkdocs-base.yml Outdated

rasika-chivate and others added 5 commits June 12, 2026 16:08

Potential fix for pull request finding

bc0f74e

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Potential fix for pull request finding

3209746

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Potential fix for pull request finding

a8b30d7

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Potential fix for pull request finding

f0eb95f

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Potential fix for pull request finding

3484bf7

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot AI reviewed Jun 12, 2026

View reviewed changes

Comment thread docs/details/oci-wif.md

rasika-chivate added 5 commits June 12, 2026 16:17

Update oci-wif.md

0bae2c9

Update oci-wif.md

d58d307

Update oci-storage.md

5de65e6

Update oci-storage.md

c07cad8

Update oci-storage.md

eae84da

rasika-chivate mentioned this pull request Jun 12, 2026

PBM-1728-OCI-with-WIF #373

Closed

jcechace requested changes Jun 15, 2026

View reviewed changes


		## Create a compartment

		Create a compartment for PBM backup resources:

Conversation

rasika-chivate commented Jun 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

jcechace left a comment

Choose a reason for hiding this comment

Uh oh!

jcechace Jun 15, 2026

Choose a reason for hiding this comment

Uh oh!

jcechace Jun 15, 2026

Choose a reason for hiding this comment

Uh oh!

jcechace Jun 15, 2026

Choose a reason for hiding this comment

Uh oh!

jcechace Jun 15, 2026

Choose a reason for hiding this comment

Uh oh!

jcechace Jun 15, 2026

Choose a reason for hiding this comment

Uh oh!

jcechace Jun 15, 2026

Choose a reason for hiding this comment

Uh oh!

jcechace Jun 15, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

rasika-chivate commented Jun 11, 2026 •

edited

Loading