Rack Configuration

oxide silo create --json-body silo.json

oxide silo idp saml create --silo $SILO_NAME --json-body idp.json --metadata-value $BASE64_ENCODED_METADATA_XML

oxide silo idp saml create --silo $SILO_NAME --json-body idp.json --metadata-url $IDP_METADATA_URL

{
  "name": "google",
  "description": "Corporate silo google SAML provider",
  "idp_entity_id": "https://accounts.google.com/o/saml2?idpid=D12wdrk34",
  "sp_client_id": "corp",
  "idp_metadata_source": {
     "type": "base64_encoded_xml",
     "data": ""
  },
  "acs_url": "https://corp.sys.oxide.acme.com/login/corp/saml/google",
  "slo_url": "https://corp.sys.oxide.acme.com/login/corp/saml/google",
  "technical_contact_email": "infra@acme.com",
  "signing_keypair": {
     "public_cert": "$base64EncodedDer",
     "private_key": "$base64EncodedDer"
  },
  "group_attribute_name": "admins"
}

# create user
oxide silo idp local user create --silo $siloName --json-body user.json

# grant silo admin role
oxide silo policy update --silo $siloName --json-body policy.json

# grant fleet admin role
oxide system policy update --json-body new-policy.json

{
  "external_id": "$siloUserUuid",
  "password": {
    "mode": "password",
    "value": "$passwordValue"
  }
}

{
  "role_assignments": [{
    "identity_id": "$siloUserUuid",
    "identity_type": "silo_user",
    "role_name": "admin"
  }]
}

{
  "role_assignments": [
    {
      "identity_id": "$siloUserUuid",
      "identity_type": "silo_user",
      "role_name": "admin"
    },
    {
      "identity_id": "$fleetUserUuid",
      "identity_type": "fleet_user",
      "role_name": "admin"
    }
  ]
}

# Get the current system policy object
oxide system policy view --json > current-policy.json

# Create the new role assignment to add (as a policy-like object)
echo '{
  "role_assignments": [{
    "identity_id": "$fleetUserUuid",
    "identity_type": "fleet_user",
    "role_name": "admin"
  }]
}' > new-role-to-add.json

# Combine the existing roles with the new role
jq -s '{role_assignments: (.[0].role_assignments + .[1].role_assignments)}' current-policy.json new-role-to-add.json > new-policy.json

# Apply the updated policy
oxide system policy update --json-body new-policy.json

oxide silo quotas update \
  --silo $SILO_NAME \
  --cpus $VCPU_COUNT \
  --memory $MEMORY_BYTES \
  --storage $STORAGE_BYTES

# create the IP pool
oxide system networking ip-pool create --name $POOL_NAME --description $POOL_DESCRIPTION

# insert an address range into the new IP pool
oxide system networking ip-pool range add --pool $POOL_NAME --first $FIRST_IP_IN_RANGE --last $LAST_IP_IN_RANGE

# link the pool to your new silo and make it the default
oxide system networking ip-pool silo link --pool $POOL_NAME --silo $SILO_NAME --is-default true

# Verify you can reach the rack's uplink gateway
ping $RACK_GATEWAY_IP

# Check if uplink ports are passing traffic (from a switch connected to the rack)
# Look for non-zero TX/RX counters on the uplink ports

# Verify the recovery silo resolves
dig recovery.sys.$OXIDE_DOMAIN_NAME

# Verify your new silo resolves
dig $SILO_NAME.sys.$OXIDE_DOMAIN_NAME