Configure the OCI CLI for Oracle Private Cloud Appliance 3.x

The Compute Enclave of Private Cloud Appliance 3.x works with the same oci command-line tool used for Oracle Cloud Infrastructure. Two things differ from public OCI: the region is your appliance’s name and domain, and you must tell the CLI to trust the appliance’s own certificate authority (CA) chain. This guide follows the PCA User Guide.

What you need

• Your user OCID (ocid1.user....) and tenancy OCID (ocid1.tenancy....), shown in the Compute Web UI.
• The appliance name and domain, for example pca1.example.com. This is your region value.
• A Compute Enclave user account that can sign in to the Compute Web UI to upload an API key.

Step 1: install the OCI CLI

The PCA guide lists these methods. Use the one for your workstation.

# Oracle Linux 8
sudo dnf -y install oraclelinux-developer-release-el8
sudo dnf install python36-oci-cli

# macOS with Homebrew
brew update && brew install oci-cli

# Other systems: Oracle's install script
bash -c "$(curl -L https://raw.githubusercontent.com/oracle/oci-cli/master/scripts/install/install.sh)"

On Windows the guide uses the PowerShell installer install.ps1 from the same GitHub repository.

Step 2: create an API key and upload it

1. Generate a key pair: oci setup keys. It writes ~/.oci/oci_api_key.pem (private) and ~/.oci/oci_api_key_public.pem (public) and prints the fingerprint.
2. In the Compute Web UI, click your user name, then My Profile. Under Resources, click API Keys, then Add API Key.
3. Upload the public key file or paste its contents, then click Upload Key.

Step 3: write ~/.oci/config

Create the file by hand with a profile for the appliance. The region line is the appliance name and domain, not an OCI region.

[PCA1]
user=ocid1.user.unique_ID
key_file=/home/admin/.oci/oci_api_key.pem
tenancy=ocid1.tenancy.unique_ID
region=pca1.example.com
fingerprint=xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx

Alternatively, run oci setup config. When it asks for a region, the guide says to pick any value from the list because it is meaningless for PCA, then edit ~/.oci/config afterwards and set region= to your appliance name and domain.

Step 4: trust the appliance CA chain

The CLI will not connect until it trusts the appliance’s external silo CA chain. The docs give its location as https://iaas.system-name.domain-name/cachain. Save it, for example as ~/.oci/ca.crt, then reference it per profile in ~/.oci/oci_cli_rc.

[PCA1]
cert-bundle=/home/admin/.oci/ca.crt

The guide also says to set the environment variable to the same path:

export OCI_CLI_CERT_BUNDLE=/home/admin/.oci/ca.crt
export OCI_CLI_PROFILE=PCA1

Verify the CA file you saved before trusting it, for example by comparing it with what your appliance administrator provides.

Step 5: test

oci iam user list
oci --profile PCA1 iam compartment list

If the CLI warns that the config file permissions are too open, follow the instructions in the warning. This usually happens after manual configuration.

Several appliances or tenancies

Each profile in config points to one tenancy, and profiles can point to different appliances. Every profile in config needs a matching section in oci_cli_rc with its own cert-bundle. Choose a profile with --profile NAME or OCI_CLI_PROFILE. Without either, the CLI uses DEFAULT; if there is no DEFAULT profile you must pass --profile.

[DEFAULT]
cert-bundle=/home/admin/.oci/pca1/ca.crt
[PCA1]
cert-bundle=/home/admin/.oci/pca1/ca.crt
[PCA2]
cert-bundle=/home/admin/.oci/pca2/ca.crt

Official documentation

• Oracle PCA User Guide (3.0): Using the OCI CLI
• Oracle PCA: Obtaining the Certificate Authority Bundle