kitchen-oci 2.1.0 → 3.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 106a6d1ccf47752842daaddc79bc644b71bb5ff27da42f1bf30e4271aa2fb946
-  data.tar.gz: 50d21fcc7ab88eb9af0546f3d97c62798621967b96c3190b5ceceee3548c1923
+  metadata.gz: 5bfc39bf616e0eefecc820abb06a06b61ed2b90e96e90434c73be1d6604c7372
+  data.tar.gz: df5a102d375fa58f09e7083957deb3e97ef6ded000d305b7eae03e868a968280
 SHA512:
-  metadata.gz: cbd4b274c32c38bdb2203fc53ca2218aad402c917c969343bfe05d27436d13be6195399469b30163c3127fe343f4f43d29a6fe2b87f20f233f639dc5b5a0c20c
-  data.tar.gz: 4405307075b1181534c5f55630fd48b76f05ec0c920b8366049c57c71ec4be2e264956a70b274490e1c3b3dc5de38f81f59c739b7526e213ef67bedb5746c77f
+  metadata.gz: 6841666c45f23dce74e419dd4eb14bf28b9964988d37addb43db84b1a41483b01c16f5601c04d8b86ae83f15e0ebc3b8da62ffc642b17f1b986921a5d1325b37
+  data.tar.gz: 5d2269712aa89d1be30882cbd2087ab7fcca506bde7433c2fef949ef6d2867dc4bf17f214073a344ac1a652b6a8e0bba41caefd14964b1d631dc83223555861d

data/lib/kitchen/driver/oci/api.rb

@@ -92,15 +92,28 @@ module Kitchen
 
         # Determines the signing method if one is specified.
         #
+        # Security token (session) authentication is used when <b>use_token_auth</b> is set explicitly or
+        # when the selected OCI profile contains a <b>security_token_file</b>. The latter allows sessions
+        # created by <tt>oci session authenticate</tt> (RPST) to be detected automatically.
+        #
         # @return [OCI::Auth::Signers::InstancePrincipalsSecurityTokenSigner, OCI::Auth::Signers::SecurityTokenSigner] an instance of the specified token signer.
         def signer
           if config[:use_instance_principals]
             OCI::Auth::Signers::InstancePrincipalsSecurityTokenSigner.new
-          elsif config[:use_token_auth]
+          elsif config[:use_token_auth] || security_token_file?
             token_signer
           end
         end
 
+        # Whether the loaded OCI config contains a security_token_file pointing at an existing token.
+        #
+        # @return [Boolean]
+        def security_token_file?
+          oci_config.respond_to?(:security_token_file) &&
+            !oci_config.security_token_file.to_s.empty? &&
+            File.exist?(oci_config.security_token_file)
+        end
+
         # Creates the token signer with a provided key.
         #
         # @return [OCI::Auth::Signers::SecurityTokenSigner]

data/lib/kitchen/driver/oci/config.rb

@@ -40,8 +40,10 @@ module Kitchen
         #
         # @return [OCI::Config]
         def oci_config
-          # OCI::Config is missing this
-          OCI::Config.class_eval { attr_accessor :security_token_file } if @driver_config[:use_token_auth]
+          # OCI::Config is missing this attribute. It is always added so that a security_token_file
+          # present in the selected profile is loaded, which enables auto-detection of session
+          # (RPST) token authentication even when use_token_auth is not explicitly set.
+          OCI::Config.class_eval { attr_accessor :security_token_file } unless OCI::Config.instance_methods.include?(:security_token_file)
           conf = config_loader(config_file_location: @driver_config[:oci_config_file], profile_name: @driver_config[:oci_profile_name])
           @driver_config[:oci_config].each do |key, value|
             conf.send("#{key}=", value) unless value.nil? || value.empty?

data/lib/kitchen/driver/oci/instance/compute.rb

@@ -71,13 +71,16 @@ module Kitchen
           end
 
           # Adds the source_details property to the launch_details for an instance that is being created from an image.
+          # When <b>kms_key_id</b> is specified the boot volume is encrypted with the provided customer-managed key,
+          # which is required by compartments governed by a Security Zone that mandates customer-managed encryption.
           def instance_source_via_image
             return if config[:boot_volume_id]
 
             launch_details.source_details = OCI::Core::Models::InstanceSourceViaImageDetails.new(
               sourceType: "image",
               imageId: image_id,
-              bootVolumeSizeInGBs: config[:boot_volume_size_in_gbs]
+              bootVolumeSizeInGBs: config[:boot_volume_size_in_gbs],
+              kmsKeyId: config[:kms_key_id]
             )
           end
 
@@ -95,6 +98,17 @@ module Kitchen
           def instance_metadata
             launch_details.metadata = metadata
           end
+
+          # Adds the instance_options property to the launch_details to disable legacy IMDS endpoints at launch time.
+          # This ensures IMDSv2 is enabled from instance creation, which is required by OCI security policies
+          # that deny instance creation when areLegacyEndpointsDisabled='false'.
+          def launch_instance_options
+            opts = config[:instance_options].dup
+            return if opts.delete(:post_create)
+
+            opts[:are_legacy_imds_endpoints_disabled] = true unless opts.key?(:are_legacy_imds_endpoints_disabled)
+            launch_details.instance_options = OCI::Core::Models::InstanceOptions.new(opts)
+          end
         end
       end
     end

data/lib/kitchen/driver/oci/mixin/actions.rb

@@ -97,10 +97,12 @@ module Kitchen
           # Acts as a guard for setting instance options.
           def instance_options?
             return false unless config[:instance_type] == "compute"
+            return false unless config[:instance_options].delete(:post_create)
 
-            config[:instance_options].merge!(are_legacy_imds_endpoints_disabled: true) unless config[:instance_options].key?(:are_legacy_imds_endpoints_disabled)
+            opts = config[:instance_options]
+            opts.merge!(are_legacy_imds_endpoints_disabled: true) unless opts.key?(:are_legacy_imds_endpoints_disabled)
             # Basically tell me if there's more stuff in there than `are_legacy_imds_endpoints_disabled: false`. If so, then proceed to setting it.
-            config[:instance_options].reject { |o, v| o == :are_legacy_imds_endpoints_disabled && !v }.any?
+            opts.reject { |o, v| o == :are_legacy_imds_endpoints_disabled && !v }.any?
           end
 
           # Checks if legacy metadata is disabled.

data/lib/kitchen/driver/oci.rb

@@ -96,6 +96,7 @@ module Kitchen
       default_config :preemptible_instance, false
       default_config :boot_volume_size_in_gbs, nil
       default_config :use_private_ip, false
+      default_config :kms_key_id, nil
       default_config :volumes, {}
 
       # dbaas configs

data/lib/kitchen/driver/oci_version.rb

@@ -22,6 +22,6 @@ module Kitchen
     # Version string for Oracle OCI Kitchen driver
     #
     # @author Stephen Pearson (<stephen.pearson@oracle.com>)
-    OCI_VERSION = "2.1.0"
+    OCI_VERSION = "3.1.0"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kitchen-oci
 version: !ruby/object:Gem::Version
-  version: 2.1.0
+  version: 3.1.0
 platform: ruby
 authors:
 - Stephen Pearson
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2025-10-20 00:00:00.000000000 Z
+date: 2026-06-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: oci