Working with Oracle Functions and tag defaults

June 11, 2021 | 5 minute read
Ed Shnekendorf
Distinguished Cloud Architect
Text Size 100%:

Oracle Functions are an important component in every cloud developer’s toolbox, but they require special handling in an environment where you also use tag defaults. In this blog post, I explain and demonstrate how to use these two capabilities in tandem to realize the benefits of serverless computing while also utilizing enterprise-grade governance practices.

The problem and our solution

Tag defaults are an important Oracle Cloud Infrastructure (OCI) feature that allow an administrator to require that any resource created within a compartment be annotated with one or more tags defined by a tag namespace. For example, imagine a compartment which requires every resource created to be tagged with a cost-center identifier, a project identifier, or an environment identifier. While some tag defaults allow a default value to be applied automatically, most cases require distinct user input for every resource created such as when 'User Applied Value' is selected.

A screenshot of the details for the tag namespace OracleInternalReserved.

The challenge arises with the need to use the Fn CLI when creating, deploying, and updating Oracle Functions. Fn is an open source project upon which Oracle Functions is built and because Fn is independent of OCI and can technically be run in other clouds or in an on-premises data center, it doesn’t recognize or accept OCI tag default identifiers.

So, if your tenancy has tag defaults in place, you run into a blocking CLI error that prevents either application or function creation because of the lack of one or more tags being defined. This error occurs regardless of whether you follow the Functions Getting Started guide in the OCI Console, documentation for creating an application or function through the CLI, or documentation for deploying third-party functions like the Datadog log ingester. You eventually run into an error that looks something like this:

A screenshot of the invalid parameter error.

How do you work around this limitation? The answer involves using a combination of the Fn CLI and the OCI CLI, both of which come conveniently preinstalled in your OCI Cloud Shell. We use the Fn CLI for a subset of operations and the OCI CLI for operations that require the injection of tag defaults.

The following example walks through using the Cloud Shell to create an application called helloworld-java-app and a function called helloworld-java-func in a compartment with a tag default of OracleInternalReserved.CostCenter.


Complete all the steps to prepare your tenancy for Functions and your Cloud Shell development environment. You can find these steps under sections A and C of the Functions on Cloud Shell Quick Start.

A screenshot of the section for setting up your tenancy in the Cloud Shell Quick StartA screenshot of the section for setting up your Cloud Shell dev environment.

Step 1: Create the Functions application

Using the ‘fn create app <app-name>’ syntax doesn’t work in a compartment with required tags. You can choose to create your application through the OCI Console and apply your tags there or use the OCI CLI.

When using the CLI to create your application, you need to replace the OCIDs for your compartment and for the subnet that your function resides in, which you have already created during the Prerequisite tasks.

oci fn application create -c ocid1.compartment.oc1..3nkmscz63iyndbvpdnl7bykk37jqmf43ahymba --display-name helloworld-java-app --subnet-ids '[""]' --defined-tags '{"OracleInternalReserved": {"CostCenter": "8675309"}}'

Check the resulting JSON and save the id of the application that you just created because you need it in future steps.

A screenshot of the resulting Hello World JSON output.

This example works with a single tag default drawn from a single namespace. What if you have multiple defaults coming from multiple namespaces? No problem, you can always learn the full syntax of the required by the CLI by issuing the following command:

oci fn application create --generate-full-command-json-input

This command includes a complete tagging definition covering the general case.

A screenshot of the results of the command.

Step 2: Create a sample function

You’re free to use the Fn CLI without modification for this step to scaffold a function directory using the runtime of your choice and navigate to that directory. This example uses Java.

Step 3: Deploy the function

At this point, the standard documentation directs you to use the Fn CLI to deploy the function, fn -v deploy -app <appname>. This step doesn’t work because the last step of the deployment attempts to create a Functions resource in OCI that requires tags. Luckily, we can decompose this operation into two Fn CLI calls (build and push) and one OCI CLI call (deploy).

First, issue the build command:

fn build

Then use the push command:

fn push

This combination compiles and dockerizes your function and pushes it to the OCI Registry which results in output similar to the following:

Write down the image tag (in this case, because you need it for the final deployment step.

Use the following OCI CLI command, inserting the proper image tag and the Function application OCID that you recorded from Step 1. Pass along the same format for defined tags and specify a memory target for your function.

oci fn function create --application-id --display-name helloworld-java-func --memory-in-mbs 1024 --image --defined-tags '{"OracleInternalReserved": {"CostCenter": "8675309"}}'

Step 4: Validate your deployment

Great job! You can now navigate to the OCI Console and verify that your application and function have been properly deployed and tagged.

A screenshot of the Applications details page of the example helloworld-java-app.

Finally, no “Hello world” demo is complete without seeing those satisfying words on your screen, so put the cherry on top by invoking your function to ensure that it all works!

A screenshot of a successful deployment output.


Oracle Functions are a powerful tool for every organization deploying workloads into OCI. Tag defaults are an important construct that allows enterprises to bring control and governance to their cloud deployments. I hope that this entry has demonstrated how you can use these capabilities together to advance your Oracle Cloud Infrastructure deployments.

Ed Shnekendorf

Distinguished Cloud Architect

Ed Shnekendorf is a Distinguished Cloud Architect with Oracle Cloud Infrastructure

Previous Post

Introducing Object Storage Auto Tiering

Jacky Liang | 3 min read

Next Post

Connect multiple Oracle Cloud Infrastructure VCNs with multiple Azure vNETs through a single OCI-Azure

Niranjan Mohapatra | 6 min read