Repository navigation
ops(cluster): OCI tenancy access + Always Free fleet provisioning (child of #1091) #4904
Description
Child of #1091 (cloud extension epic). Absorbs the still-live work from #1816, which was closed as superseded by the epic — this issue is the home it was missing.
Goal
Get an OCI tenancy usable and provision the technical maximum of the Always Free tier in us-ashburn-1 alongside the home cluster, with guardrails in place before anything billable can run.
Current blocker (human, not code)
Tenancy signup for drewrypope@gmail.com is still stuck "in progress". Support refs: CPCOE-29381 (internal, not customer-visible), follow-ups 261024-000583 / 261026-001280. Cloud Account Name given as "on" (agent-confirmed, not sign-in-verified). Only channel is a support chat citing both references. Signup must happen in Drew's own browser (no virtual/prepaid cards, no VPN/proxy). Nothing in this issue can be automated until sign-in works.
Verified Always Free terms (checked 2026-10-20 against Oracle docs — re-verify at signup; terms changed once already in 2026)
- Ampere A1 Flex: 2 OCPU / 12 GB total (1,500 OCPU-hours + 9,000 GB-hours/month) — the body's original "4 OCPU / 24 GB" belief is retired.
- AMD: up to 2 × VM.Standard.E2.1.Micro (1/8 OCPU, 1 GB each), one availability domain only.
- Block storage: 200 GB total including boot volumes, 47 GB minimum boot volume — storage, not compute, is the binding constraint.
- Also free: 10 TB/month outbound egress, 20 GB object storage, 2 × Autonomous Database, 1 × flexible load balancer (10 Mbps). Idle reclamation: 7 days at 95th-percentile CPU/network < 20% (and memory < 20% for A1) makes an instance reclaimable.
- Home region is permanent and Always Free compute only exists there:
us-ashburn-1(decided 2026-10-21, superseding Chicago). - PAYG decided 2026-10-22: upgrade as soon as login works — Always Free resources survive on PAYG, A1 capacity priority improves, idle reclamation ends.
Guardrails required before provisioning (PAYG)
Compartment quotas + a low-amount budget alert must exist before the first non-free shape is creatable.
Work order once access lands
- Sign in, confirm tenancy, create API keys/CLI config (credentials to Bitwarden under
oci.*). - PAYG upgrade + quotas + budget alert.
- Provision per the plan's Option A: 1 × A1 (2 OCPU/12 GB) as the real server + 2 × E2.1.Micro; try all three ADs, start at 1 OCPU/6 GB and scale, retry off-peak.
- Always Free Autonomous DB test #1 — 26ai, Transaction Processing, 20 GB (26ai is offered in Ashburn); keep a heartbeat workload touching it (free DBs auto-stop after 7 days idle, may be deleted after 90, no backups).
- Record the provisioned inventory and the re-verified quota numbers back on this issue.
Acceptance
- Tenancy signs in and API access works; guardrails (quotas + budget alert) exist.
- Free fleet provisioned as above, or the blocker escalated with the exact next support step.
- Re-verified current terms recorded here with the date.
References
#1091 (parent epic) · #1816 (closed, content absorbed here) · dezren39/darwin-nix#507 · dezren39/darwin-nix#508 (program epic) · plan doc oci-free-plan-2026-10-20.md in the lab-cluster goal workspace.
Activity
dezren39 commentedon Nov 3, 2026
agent-note:v1
state: reviewed (coverage loop-back)
Coverage pass 2026-11-03, loop-back review: this issue was re-reviewed (drift / overlap / already-handled / stale / blockers / ordering) so every open issue in the four repos is reviewed and in the system. Verdict: still live; in the system as task 7875 (triage, queued, priority 30) in repo-health-code-pilot. Labels audited and synced. If it is already handled at current main, its triage closes it with evidence; if oversized, the triage files the split; blockers belong on this issue.
Found via: coverage loop-back 2026-11-03
dezren39 commentedon Nov 3, 2026
Triage (queue task 7875,
repo-health-code-pilot) — live, and genuinely human-blocked. No code action is possible until OCI sign-in works.Verified 2026-11-03T13:50Z, fresh:
GET /issues/1091/sub_issues→ 4904 only) — nothing has superseded it.repos/.../branchesgrep foroci|4904→ none; PR search for OCI → only unrelated merged docs/pm-apps PRs). No competing owner.dezren39/nix#505,#507,#508are all CLOSED. There is no other home for this work.infra/holds onlydns/andtalos/), so there is nothing to reproduce or fix at current main. This is greenfield provisioning gated on tenancy access, not a code defect.Blocker (unchanged, human-only). OCI tenancy signup for
drewrypope@gmail.comis still "in progress". Support refs: CPCOE-29381, follow-ups 261024-000583 / 261026-001280. The only channel is the support chat; signup must happen in Drew's own browser (no virtual/prepaid cards, no VPN/proxy). Nothing downstream is automatable — not the API keys, not the CLI config, not the PAYG upgrade.Exact next support step. Re-open the support chat citing CPCOE-29381 plus both follow-up refs and ask for: (a) confirmation of the tenancy OCID and the Cloud Account Name (the "on" name is agent-confirmed but never sign-in verified), and (b) an ETA; if the request is still stuck, ask for it to be re-queued or the pending account reset so a clean signup can be attempted on the same address.
Ordering. #4904 gates all Always Free fleet work and the OCI half of #1091; the epic's egress-offload half is independent and can proceed in parallel. Once sign-in lands, the work order already in the body (API keys → PAYG + compartment quotas + budget alert → 1 × A1 2 OCPU/12 GB + 2 × E2.1.Micro across ADs → Always Free Autonomous DB #1 with a heartbeat workload → record inventory + re-verified quota terms here) is the plan; it does not need rewriting.
Routing. Labels set to
status/blocked+user/escalated— this is a Drew-only action, not a worker task. Queue task 7875 completes astriaged; a fresh work task should be filed the moment sign-in succeeds.