Skip to content

Commit 596675a

Browse files
NicolaCimitileNicolaCimitile
committed
LZsteps
LZ steps
1 parent 302de5e commit 596675a

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

80 files changed

+1580
-0
lines changed

‎manageability-and-operations/observability-and-manageability/database-management/LZ-autonomous-databases/Implementation_addon_steps.md‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# STEP2. ORM OBS ADD-ON Deployment Steps <!-- omit from toc -->
2+
3+
4+
Go to the orchestrator [github page](https://github.com/oci-landing-zones/terraform-oci-modules-orchestrator).
5+
6+
At the beginning of the README page, select 'Deploy to Oracle Cloud'. When you click the provided magic button, a new ORM stack will be created. Follow these steps:
7+
8+
1. Accept terms, wait for the configuration to load.
9+
2. Set the working directory to “rms-facade”.
10+
3. Set the stack name you prefer.
11+
4. Set the terraform version to 1.5.x. Click Next.
12+
5. Create you own bucket and upload the JSON files provided in this asset:
13+
14+
* [oci_open_lz_addon_mon_iam_atp.auto.tfvars.json](oci_open_lz_addon_mon_iam_atp.auto.tfvars.json)
15+
* [oci_open_lz_addon_mon_network_atp.auto.tfvars.json](oci_open_lz_addon_mon_network_atp.auto.tfvars.json)
16+
17+
6. Add the files generated as output in the ONE-OE deployment as dependencies.
18+
7. Un-check run apply. Click Create.
19+
8. First, execute a plan job to review all the resources that Terraform will create. Once verified, proceed to run the apply job to initiate the deployment.
20+
21+
22+
# License <!-- omit from toc -->
23+
24+
Copyright (c) 2025 Oracle and/or its affiliates.
25+
26+
Licensed under the Universal Permissive License (UPL), Version 1.0.
27+
28+
See [LICENSE](/LICENSE) for more details.

‎manageability-and-operations/observability-and-manageability/database-management/LZ-autonomous-databases/oci_open_lz_addon_mon_iam.auto.tfvars.json‎

Lines changed: 193 additions & 0 deletions
Large diffs are not rendered by default.

‎manageability-and-operations/observability-and-manageability/database-management/LZ-autonomous-databases/oci_open_lz_addon_mon_network.auto.tfvars.json‎

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
{
2+
"network_configuration": {
3+
"default_enable_cis_checks": false,
4+
"network_configuration_categories": {
5+
"Add_DM_NSGs": {
6+
"inject_into_existing_vcns": {
7+
"VCN-FRA-LZP-HUB-01-KEY": {
8+
"vcn_id": "VCN-FRA-LZP-HUB-KEY",
9+
"network_security_groups": {
10+
"NSG-FRA-LZP-HUB-PE-KEY": {
11+
"display_name": "nsg-fra-lzp-hub-global-mon-pe",
12+
"compartment_id": "CMP-LZP-NETWORK-KEY",
13+
"egress_rules": {
14+
"anywhere": {
15+
"description": "egress to 0.0.0.0/0 over ALL protocols",
16+
"dst": "0.0.0.0/0",
17+
"dst_type": "CIDR_BLOCK",
18+
"protocol": "ALL",
19+
"stateless": true
20+
}
21+
},
22+
"ingress_rules": {
23+
"ingress_database": {
24+
"description": "ingress to Allow communication between global PEs DM/OPSI and PE ATP, in db subnet",
25+
"dst_port_max": 1521,
26+
"dst_port_min": 1521,
27+
"protocol": "TCP",
28+
"src": "10.0.66.0/24",
29+
"src_type": "CIDR_BLOCK",
30+
"stateless": false
31+
}
32+
}
33+
}
34+
}
35+
},
36+
"VCN-FRA-LZP-P-PROJECTS-01-KEY": {
37+
"vcn_id": "VCN-FRA-LZP-P-PROJECTS-KEY",
38+
"network_security_groups": {
39+
"NSG-LZP-P-PROJECTS-PE-DB1-KEY": {
40+
"compartment_id": "CMP-LZP-P-PROJ1-DB-KEY",
41+
"display_name": "nsg-lzp-p-projects-mon-pe-db1",
42+
"egress_rules": {
43+
"anywhere": {
44+
"description": "egress to 0.0.0.0/0 over TCP",
45+
"dst": "0.0.0.0/0",
46+
"dst_type": "CIDR_BLOCK",
47+
"protocol": "TCP",
48+
"stateless": false
49+
}
50+
},
51+
"ingress_rules": {
52+
"ingress_pe_database_sn": {
53+
"description": "ingress to Allow communication between PE DM/OPSI and PE ATP, in Prod db subnet",
54+
"dst_port_max": 1521,
55+
"dst_port_min": 1521,
56+
"protocol": "TCP",
57+
"src": "10.0.66.0/24",
58+
"src_type": "CIDR_BLOCK",
59+
"stateless": false
60+
},
61+
"ingress_logs_sn_database_sn": {
62+
"description": "ingress from global DM/OPSI PE, in logs subnet",
63+
"dst_port_max": 1521,
64+
"dst_port_min": 1521,
65+
"protocol": "TCP",
66+
"src": "10.0.4.0/24",
67+
"src_type": "CIDR_BLOCK",
68+
"stateless": false
69+
}
70+
}
71+
}
72+
}
73+
},
74+
"VCN-FRA-LZP-PP-PROJECTS-01-KEY": {
75+
"vcn_id": "VCN-FRA-LZP-PP-PROJECTS-KEY",
76+
"network_security_groups": {
77+
"NSG-LZP-PP-PROJECTS-PE-DB1-KEY": {
78+
"compartment_id": "CMP-LZP-PP-PROJ1-DB-KEY",
79+
"display_name": "nsg-lzp-pp-projects-mon-pe-db1",
80+
"egress_rules": {
81+
"anywhere": {
82+
"description": "egress to 0.0.0.0/0 over TCP",
83+
"dst": "0.0.0.0/0",
84+
"dst_type": "CIDR_BLOCK",
85+
"protocol": "TCP",
86+
"stateless": false
87+
}
88+
},
89+
"ingress_rules": {
90+
"ingress_pe_database_sn": {
91+
"description": "ingress to Allow communication between PEs DM/OPSI and PE ATP, in Preprod db subnet",
92+
"dst_port_max": 1521,
93+
"dst_port_min": 1521,
94+
"protocol": "TCP",
95+
"src": "10.0.130.0/24",
96+
"src_type": "CIDR_BLOCK",
97+
"stateless": false
98+
},
99+
"ingress_logs_sn_database_sn": {
100+
"description": "ingress from global DM/OPSI PEs, in logs subnet",
101+
"dst_port_max": 1521,
102+
"dst_port_min": 1521,
103+
"protocol": "TCP",
104+
"src": "10.0.4.0/24",
105+
"src_type": "CIDR_BLOCK",
106+
"stateless": false
107+
}
108+
}
109+
}
110+
}
111+
}
112+
}
113+
}
114+
}
115+
}
116+
}

‎manageability-and-operations/observability-and-manageability/database-management/LZ-autonomous-databases/oci_open_lz_addon_mon_security.auto.tfvars.json‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
{
2+
3+
"vaults_configuration": {
4+
"default_compartment_id": "CMP-LZP-SECURITY-KEY",
5+
"vaults": {
6+
"VLT-LZP-SHARED-MON-KEY": {
7+
"name": "vlt-lzp-shared-mon-security"
8+
}
9+
},
10+
"keys": {
11+
"KEY-LZP-MON-KEY": {
12+
"name": "key-lzp-mon-bkt",
13+
"protection_mode": "SOFTWARE",
14+
"vault_key": "VLT-LZP-SHARED-MON-KEY",
15+
"service_grantees": ["objectstorage-eu-frankfurt-1"],
16+
"group_grantees": ["grp-lzp-mon-admins"],
17+
"versions": ["1","2"]
18+
}
19+
}
20+
}
21+
}

‎manageability-and-operations/observability-and-manageability/database-management/LZ-autonomous-databases/readme.md‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
# **[Autonomous Databases ](#)**
2+
## **An OCI Open LZ Addon to help you enable Database Management & Operation Insights for Autonomous Databases**
3+
4+
## Design
5+
6+
To enable **Database Management** or **Operational Insights** for Autonomous Databases, you must deploy Private Endpoints that have access to the database you wish to configure. A Private Endpoint acts as a representation of OCI O&M Services within the VCN.
7+
8+
Both DMA Private Endpoints and OPSI Private Endpoints need visibility into the ATP Private Endpoint. To enable this, the add-on includes Network Security Groups (NSGs).
9+
10+
To check the documentation you can use these links: [DMA PE](https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/privateaccess.htm#private-endpoints) (Database Management Private Endpoint). or [OPSI PE](https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/privateaccess.htm#private-endpoints) (Operation Insights Private Endpoint).
11+
12+
13+
**GLOBAL APPROACH**
14+
15+
For customers with multiple OEs and environments, it's crucial to consider the service limits for Private Endpoints. In such cases, we recommend a shared approach using global Private Endpoints, which should be deployed in the HUB VCN and considered shared resources.
16+
17+
In this **global approach**, PEs will be placed in the monitoring subnet (sn-fra-lzp-hub-mon) in the hub vcn and should be assigned to the PE NSGs (nsg-fra-lzp-hub-global-mon-pe). In the other hand the database will be placed in cmp-lzp-p-proj1-db compartment using the database subnet (ssn-fra-lzp-p-db) and assigned to the DB NSGs (nsg-lzp-p-projects-mon-pe-db1).
18+
19+
In this add-on, we will deploy a Shared Observability Platform compartment, a dedicated Observability Vault, and include the necessary groups and policies to manage native observability, along with the previously mentioned NSGs
20+
21+
<img src="../images/ATP_GLOBAL.png" height="300" align="center">
22+
23+
&nbsp;
24+
25+
**LOCAL APPROACH**
26+
27+
Customers with simpler infrastructures, using a single OE and fewer environments, may choose to deploy dedicated Private Endpoints (PEs) for each environment. This approach is often preferred when there is a dedicated monitoring team for each environment.
28+
29+
In a **local approach**, DMA/OPS PEs and the ATP PE will reside in the same database subnet (ssn-fra-lzp-p-db), and the nsg-lzp-p-projects-mon-pe-db1 NSGs will allow communication between them.
30+
31+
In this case, a dedicated Environment Observability platform compartment, a dedicated Observability Vault, along with the necessary groups and policies to manage native observability, will be included, in addition to the previously mentioned NSGs.
32+
33+
<img src="../images/ATP_LOCAL.png" height="300" align="center">
34+
35+
Private endpoints will be placed in the observability compartments, accessing the required subnets.
36+
37+
During the process of enabling Database Management or Operation Insights in an Autonomous Database, the user and password will be required. These credentials must be stored as secrets in a dedicated Vault within the shared security compartment. All necessary policies to access the secret are already included in the add-on.
38+
39+
> [!WARNING]
40+
> You can create the Private Endpoint in the same VCN or a different VCN. Please disregard the information stated in the [Database Management documentation](https://docs.oracle.com/en-us/iaas/database-management/doc/create-database-management-private-endpoint-adb.html#GUID-EBA1A30F-96E9-412D-836F-5ED57FC74D99) or [Operations Insights documentation](https://docs.oracle.com/en-us/iaas/operations-insights/doc/create-private-endpoint.html).
41+
>
42+
> There is a limitation: only one Private Endpoint can be created per VCN.
43+
&nbsp;
44+
45+
46+
## Implementation
47+
48+
Our add-on template includes all the necessary components, such as CMP, groups, a dedicated monitoring Vault, policies, and NSGs, to enable Database Management and Operations Insights.
49+
50+
Follow these steps to extend your Landing zone:
51+
52+
**Step 1**.
53+
54+
(Prerequisite) Deploy ONE-OE landing Zone. You can follow next [steps](https://github.com/oci-landing-zones/oci-landing-zone-operating-entities/tree/master/blueprints/one-oe/runtime/one-stack).
55+
56+
<img src="../images/ONE-OE.png" height="850" align="center">
57+
58+
&nbsp;
59+
60+
**Step 2**.
61+
62+
Enable Observability adding this Add-on, use the ATP JSONs files provided in this asset. To check step by step how to do it check [here](./Implementation_addon_steps.md).
63+
64+
<img src="../images/OBS_ADDON.png" height="600" align="center">
65+
66+
&nbsp;
67+
68+
Now, the landing zone is ready to proceed with the necessary steps to enable the observability services. Follow these [steps](./steps_to_enable_DMA_OPSI.md).
69+
70+
&nbsp;
71+
72+
# License
73+
74+
Copyright (c) 2025 Oracle and/or its affiliates.
75+
76+
Licensed under the Universal Permissive License (UPL), Version 1.0.
77+
78+
See [LICENSE](/LICENSE.txt) for more details.

0 commit comments

Comments
 (0)