Find the OCID of the compartment where we’ll be deploying. Run this to list all the compartments in your root compartment:

and find the compartment by the name or description in the JSON output. It should look like this:

Use the OCID from the id property; the compartment-id property is the parent compartment.

For convenience, save the compartment OCID as an environment variable. For Linux or Mac, run

or for Windows, if using cmd run

and if using PowerShell run

Choose a display name (1-100 characters) and a vault type, either DEFAULT or VIRTUAL_PRIVATE. We recommend that you choose DEFAULT to avoid the cost of a virtual private vault.

Run the create command with the compartment OCID, display name, and vault type substituted:

The jq utility will extract the vault OCID from the id property in the response; this is the unique identifier for your vault which you’ll need later. Store the value as the VAULT_ID environment variable:

The micronaut-oracle-cloud subproject provides integration between Micronaut apps and Oracle Cloud, including using Vault as a distributed configuration source. Add a dependency to your build for the micronaut-oraclecloud-vault library to add Vault support:

Create a bootstrap.yml file in the resources directory to enable distributed configuration. Add the following:

If application.yml sets micronaut.application.name, remove it. You moved it to bootstrap.yml.

To disable distributed configuration for tests, create a bootstrap-test.yml file:

Then create src/main/resources/bootstrap-oraclecloud.yml with the following content:

The first secret will be for the database username, so the secret name will be JDBC_USER.

Secret values must be Base64-encoded. You can encode the value programmatically, e.g., Base64.getEncoder().encodeToString("the value".getBytes()), or use an online tool such as https://www.base64encode.org/.

Run the create-base64 command with the compartment OCID, encryption key OCID, vault OCID, secret name, and Base64-encoded secret value substituted. If you use guide_user as the username, the Base64-encoded value will be Z3VpZGVfdXNlcg==

Note that running that command will leave the Base64-encoded value in your shell history. To avoid this, you can create a JSON file containing the parameters and pass that as an argument to the command.

To use this approach, create a file like this with values substituted, and save it as key.json:

and run this create-base64 command instead:

With either approach the response should look like this:

Create a second secret with the name JDBC_PASSWORD. The value will be the Base64-encoded database user password you chose earlier.

Create a third secret with the name JDBC_URL. The URL will be jdbc:mysql://<MySQL IP address>:3306/micronaut with the private IP address of your MySQL database substituted. Set the value of the secret as the Base64-encoded URL value.

Choose a group name, e.g., "mn-guide-dg", and a matching rule, i.e., the logic that will be used to determine group membership. We’ll make the rule fairly broad - use ALL {instance.compartment.id = 'ocid1.compartment.oc1..aaaaaaaarkh3s2wcxbbm…​'} replacing ocid1.compartment.oc1..aaaaaaaarkh3s2wcxbbm…​ with the compartment OCID:

Run the create command with the compartment OCID substituted:

The jq utility will extract the compartment-id value from the response. Store the ID (the tenancy ID) as the T environment variable:

See the Dynamic Group docs for more information.

Next, create the policy granting read access to Vault.

We’ll create the policy in the root compartment, i.e., the tenancy, so we’ll use the tenancy OCID saved from the dynamic group creation response.

Run the create command with the tenancy OCID substituted:

The jq utility will extract the policy OCID from the id property in the response. Store the value as the POLICY_ID environment variable: