Skip to content

Commit 790ab8c

Browse files
alcampagalcampag
committed
oke-rm-1.1.2
1 parent a0e8070 commit 790ab8c

File tree

11 files changed

+90
-84
lines changed

11 files changed

+90
-84
lines changed

‎app-dev/devops-and-containers/oke/oke-rm/README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,13 +16,13 @@ This stack is used to create the initial network infrastructure for OKE. When co
1616
* By default, everything is private, but there is the possibility to create public subnets
1717
* Be careful when modifying the default values, as inputs are not validated
1818

19-
[![Deploy to Oracle Cloud](https://oci-resourcemanager-plugin.plugins.oci.oraclecloud.com/latest/deploy-to-oracle-cloud.svg)](https://cloud.oracle.com/resourcemanager/stacks/create?zipUrl=https://github.com/oracle-devrel/technology-engineering/releases/download/oke-rm-1.1.1/infra.zip)
19+
[![Deploy to Oracle Cloud](https://oci-resourcemanager-plugin.plugins.oci.oraclecloud.com/latest/deploy-to-oracle-cloud.svg)](https://cloud.oracle.com/resourcemanager/stacks/create?zipUrl=https://github.com/oracle-devrel/technology-engineering/releases/download/oke-rm-1.1.2/infra.zip)
2020

2121
## Step 2: Create the OKE control plane
2222

2323
This stack is used to create the OKE control plane ONLY.
2424

25-
[![Deploy to Oracle Cloud](https://oci-resourcemanager-plugin.plugins.oci.oraclecloud.com/latest/deploy-to-oracle-cloud.svg)](https://cloud.oracle.com/resourcemanager/stacks/create?zipUrl=https://github.com/oracle-devrel/technology-engineering/releases/download/oke-rm-1.1.1/oke.zip)
25+
[![Deploy to Oracle Cloud](https://oci-resourcemanager-plugin.plugins.oci.oraclecloud.com/latest/deploy-to-oracle-cloud.svg)](https://cloud.oracle.com/resourcemanager/stacks/create?zipUrl=https://github.com/oracle-devrel/technology-engineering/releases/download/oke-rm-1.1.2/oke.zip)
2626

2727
Also note that if the network infrastructure is located in a different compartment than the OKE cluster AND you are planning to use the OCI_VCN_NATIVE CNI,
2828
you must add these policies:

‎app-dev/devops-and-containers/oke/oke-rm/infra/infra.zip‎

95 Bytes
Binary file not shown.

‎app-dev/devops-and-containers/oke/oke-rm/infra/modules/network/bastion-sl.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ resource "oci_core_security_list" "bastion_security_list" {
33
vcn_id = local.vcn_id
44
display_name = "bastion-sec-list"
55
ingress_security_rules {
6-
protocol = "6"
6+
protocol = local.tcp_protocol
77
source_type = "CIDR_BLOCK"
88
source = "0.0.0.0/0"
99
description = "Allow SSH connections to the subnet. Can be deleted if only using OCI Bastion subnet"

‎app-dev/devops-and-containers/oke/oke-rm/infra/modules/network/cp-nsg.tf‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ resource "oci_core_network_security_group" "cp_nsg" {
77
resource "oci_core_network_security_group_security_rule" "oke_cp_nsg_ingress_1" {
88
direction = "INGRESS"
99
network_security_group_id = oci_core_network_security_group.cp_nsg.id
10-
protocol = "6"
10+
protocol = local.tcp_protocol
1111
source_type = "NETWORK_SECURITY_GROUP"
1212
source = oci_core_network_security_group.worker_nsg.id
1313
stateless = false
@@ -23,7 +23,7 @@ resource "oci_core_network_security_group_security_rule" "oke_cp_nsg_ingress_1"
2323
resource "oci_core_network_security_group_security_rule" "oke_cp_nsg_ingress_2" {
2424
direction = "INGRESS"
2525
network_security_group_id = oci_core_network_security_group.cp_nsg.id
26-
protocol = "6"
26+
protocol = local.tcp_protocol
2727
source_type = "NETWORK_SECURITY_GROUP"
2828
source = oci_core_network_security_group.cp_nsg.id
2929
stateless = false
@@ -39,7 +39,7 @@ resource "oci_core_network_security_group_security_rule" "oke_cp_nsg_ingress_2"
3939
resource "oci_core_network_security_group_security_rule" "oke_cp_nsg_ingress_3" {
4040
direction = "INGRESS"
4141
network_security_group_id = oci_core_network_security_group.cp_nsg.id
42-
protocol = "6"
42+
protocol = local.tcp_protocol
4343
source_type = "CIDR_BLOCK"
4444
source = var.bastion_subnet_cidr
4545
stateless = false
@@ -57,7 +57,7 @@ resource "oci_core_network_security_group_security_rule" "oke_cp_nsg_ingress_3"
5757
resource "oci_core_network_security_group_security_rule" "oke_cp_nsg_ingress_4" {
5858
direction = "INGRESS"
5959
network_security_group_id = oci_core_network_security_group.cp_nsg.id
60-
protocol = "6"
60+
protocol = local.tcp_protocol
6161
source_type = "NETWORK_SECURITY_GROUP"
6262
source = oci_core_network_security_group.pod_nsg.0.id
6363
stateless = false
@@ -74,7 +74,7 @@ resource "oci_core_network_security_group_security_rule" "oke_cp_nsg_ingress_4"
7474
resource "oci_core_network_security_group_security_rule" "oke_cp_nsg_ingress_5" {
7575
direction = "INGRESS"
7676
network_security_group_id = oci_core_network_security_group.cp_nsg.id
77-
protocol = "6"
77+
protocol = local.tcp_protocol
7878
source_type = "NETWORK_SECURITY_GROUP"
7979
source = oci_core_network_security_group.pod_nsg.0.id
8080
stateless = false
@@ -91,7 +91,7 @@ resource "oci_core_network_security_group_security_rule" "oke_cp_nsg_ingress_5"
9191
resource "oci_core_network_security_group_security_rule" "oke_cp_nsg_ingress_6" {
9292
direction = "INGRESS"
9393
network_security_group_id = oci_core_network_security_group.cp_nsg.id
94-
protocol = "6"
94+
protocol = local.tcp_protocol
9595
source_type = "NETWORK_SECURITY_GROUP"
9696
source = oci_core_network_security_group.worker_nsg.id
9797
stateless = false
@@ -107,7 +107,7 @@ resource "oci_core_network_security_group_security_rule" "oke_cp_nsg_ingress_6"
107107
resource "oci_core_network_security_group_security_rule" "oke_cp_nsg_ingress_7" {
108108
direction = "INGRESS"
109109
network_security_group_id = oci_core_network_security_group.cp_nsg.id
110-
protocol = "1"
110+
protocol = local.icmp_protocol
111111
source_type = "NETWORK_SECURITY_GROUP"
112112
source = oci_core_network_security_group.worker_nsg.id
113113
stateless = false
@@ -121,7 +121,7 @@ resource "oci_core_network_security_group_security_rule" "oke_cp_nsg_ingress_7"
121121
resource "oci_core_network_security_group_security_rule" "oke_cp_nsg_ingress_8" {
122122
direction = "INGRESS"
123123
network_security_group_id = oci_core_network_security_group.cp_nsg.id
124-
protocol = "6"
124+
protocol = local.tcp_protocol
125125
source_type = "CIDR_BLOCK"
126126
source = var.cp_allowed_source_cidr
127127
stateless = false
@@ -137,7 +137,7 @@ resource "oci_core_network_security_group_security_rule" "oke_cp_nsg_ingress_8"
137137
resource "oci_core_network_security_group_security_rule" "oke_cp_nsg_egress_1" {
138138
direction = "EGRESS"
139139
network_security_group_id = oci_core_network_security_group.cp_nsg.id
140-
protocol = "6"
140+
protocol = local.tcp_protocol
141141
destination_type = "NETWORK_SECURITY_GROUP"
142142
destination = oci_core_network_security_group.worker_nsg.id
143143
stateless = false
@@ -153,7 +153,7 @@ resource "oci_core_network_security_group_security_rule" "oke_cp_nsg_egress_1" {
153153
resource "oci_core_network_security_group_security_rule" "oke_cp_nsg_egress_2" {
154154
direction = "EGRESS"
155155
network_security_group_id = oci_core_network_security_group.cp_nsg.id
156-
protocol = "6"
156+
protocol = local.tcp_protocol
157157
destination_type = "NETWORK_SECURITY_GROUP"
158158
destination = oci_core_network_security_group.pod_nsg.0.id
159159
stateless = false
@@ -165,7 +165,7 @@ resource "oci_core_network_security_group_security_rule" "oke_cp_nsg_egress_2" {
165165
resource "oci_core_network_security_group_security_rule" "oke_cp_nsg_egress_3" {
166166
direction = "EGRESS"
167167
network_security_group_id = oci_core_network_security_group.cp_nsg.id
168-
protocol = "6"
168+
protocol = local.tcp_protocol
169169
destination_type = "SERVICE_CIDR_BLOCK"
170170
destination = lookup(data.oci_core_services.all_oci_services.services[0], "cidr_block")
171171
stateless = false
@@ -176,7 +176,7 @@ resource "oci_core_network_security_group_security_rule" "oke_cp_nsg_egress_3" {
176176
resource "oci_core_network_security_group_security_rule" "oke_cp_nsg_egress_4" {
177177
direction = "EGRESS"
178178
network_security_group_id = oci_core_network_security_group.cp_nsg.id
179-
protocol = "6"
179+
protocol = local.tcp_protocol
180180
destination_type = "NETWORK_SECURITY_GROUP"
181181
destination = oci_core_network_security_group.worker_nsg.id
182182
stateless = false
@@ -193,7 +193,7 @@ resource "oci_core_network_security_group_security_rule" "oke_cp_nsg_egress_4" {
193193
resource "oci_core_network_security_group_security_rule" "oke_cp_nsg_egress_5" {
194194
direction = "EGRESS"
195195
network_security_group_id = oci_core_network_security_group.cp_nsg.id
196-
protocol = "6"
196+
protocol = local.tcp_protocol
197197
destination_type = "NETWORK_SECURITY_GROUP"
198198
destination = oci_core_network_security_group.cp_nsg.id
199199
stateless = false
@@ -209,7 +209,7 @@ resource "oci_core_network_security_group_security_rule" "oke_cp_nsg_egress_5" {
209209
resource "oci_core_network_security_group_security_rule" "oke_cp_nsg_egress_6" {
210210
direction = "EGRESS"
211211
network_security_group_id = oci_core_network_security_group.cp_nsg.id
212-
protocol = "1"
212+
protocol = local.icmp_protocol
213213
destination_type = "NETWORK_SECURITY_GROUP"
214214
destination = oci_core_network_security_group.worker_nsg.id
215215
stateless = false
@@ -223,7 +223,7 @@ resource "oci_core_network_security_group_security_rule" "oke_cp_nsg_egress_6" {
223223
resource "oci_core_network_security_group_security_rule" "oke_cp_nsg_egress_7" {
224224
direction = "EGRESS"
225225
network_security_group_id = oci_core_network_security_group.cp_nsg.id
226-
protocol = "6"
226+
protocol = local.tcp_protocol
227227
destination_type = "CIDR_BLOCK"
228228
destination = var.cp_egress_cidr
229229
stateless = false

‎app-dev/devops-and-containers/oke/oke-rm/infra/modules/network/fss-nsg.tf‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ resource "oci_core_network_security_group" "fss_nsg" {
77
resource "oci_core_network_security_group_security_rule" "fss_ingress_rule_1" {
88
direction = "INGRESS"
99
network_security_group_id = oci_core_network_security_group.fss_nsg.id
10-
protocol = "17" # UDP
10+
protocol = local.udp_protocol
1111
source_type = "NETWORK_SECURITY_GROUP"
1212
source = oci_core_network_security_group.worker_nsg.id
1313
stateless = false
@@ -23,7 +23,7 @@ resource "oci_core_network_security_group_security_rule" "fss_ingress_rule_1" {
2323
resource "oci_core_network_security_group_security_rule" "fss_ingress_rule_2" {
2424
direction = "INGRESS"
2525
network_security_group_id = oci_core_network_security_group.fss_nsg.id
26-
protocol = "6"
26+
protocol = local.tcp_protocol
2727
source_type = "NETWORK_SECURITY_GROUP"
2828
source = oci_core_network_security_group.worker_nsg.id
2929
stateless = false
@@ -39,7 +39,7 @@ resource "oci_core_network_security_group_security_rule" "fss_ingress_rule_2" {
3939
resource "oci_core_network_security_group_security_rule" "fss_ingress_rule_3" {
4040
direction = "INGRESS"
4141
network_security_group_id = oci_core_network_security_group.fss_nsg.id
42-
protocol = "17" # UDP
42+
protocol = local.udp_protocol
4343
source_type = "NETWORK_SECURITY_GROUP"
4444
source = oci_core_network_security_group.worker_nsg.id
4545
stateless = false
@@ -55,7 +55,7 @@ resource "oci_core_network_security_group_security_rule" "fss_ingress_rule_3" {
5555
resource "oci_core_network_security_group_security_rule" "fss_ingress_rule_4" {
5656
direction = "INGRESS"
5757
network_security_group_id = oci_core_network_security_group.fss_nsg.id
58-
protocol = "6"
58+
protocol = local.tcp_protocol
5959
source_type = "NETWORK_SECURITY_GROUP"
6060
source = oci_core_network_security_group.worker_nsg.id
6161
stateless = false
@@ -71,7 +71,7 @@ resource "oci_core_network_security_group_security_rule" "fss_ingress_rule_4" {
7171
resource "oci_core_network_security_group_security_rule" "fss_ingress_rule_5" {
7272
direction = "INGRESS"
7373
network_security_group_id = oci_core_network_security_group.fss_nsg.id
74-
protocol = "6"
74+
protocol = local.tcp_protocol
7575
source_type = "NETWORK_SECURITY_GROUP"
7676
source = oci_core_network_security_group.worker_nsg.id
7777
stateless = false

‎app-dev/devops-and-containers/oke/oke-rm/infra/modules/network/lb-nsg.tf‎

Lines changed: 20 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -7,11 +7,11 @@ resource "oci_core_network_security_group" "oke_lb_nsg" {
77
resource "oci_core_network_security_group_security_rule" "oke_lb_nsg_rule_workers_egress" {
88
direction = "EGRESS"
99
network_security_group_id = oci_core_network_security_group.oke_lb_nsg.id
10-
protocol = "6"
10+
protocol = local.tcp_protocol
1111
destination_type = "NETWORK_SECURITY_GROUP"
1212
destination = oci_core_network_security_group.worker_nsg.id
13-
stateless = true
14-
description = "Allow TCP traffic from load balancer to worker nodes for services of type NodePort - stateless Egress"
13+
stateless = false
14+
description = "Allow TCP traffic from load balancer to worker nodes for services of type NodePort"
1515
tcp_options {
1616
destination_port_range {
1717
max = 32767
@@ -20,16 +20,17 @@ resource "oci_core_network_security_group_security_rule" "oke_lb_nsg_rule_worker
2020
}
2121
}
2222

23-
resource "oci_core_network_security_group_security_rule" "oke_lb_nsg_rule_workers_ingress" {
24-
direction = "INGRESS"
23+
24+
resource "oci_core_network_security_group_security_rule" "oke_lb_nsg_rule_workers_egress_udp" {
25+
direction = "EGRESS"
2526
network_security_group_id = oci_core_network_security_group.oke_lb_nsg.id
26-
protocol = "6"
27-
source_type = "NETWORK_SECURITY_GROUP"
28-
source = oci_core_network_security_group.worker_nsg.id
29-
stateless = true
30-
description = "Allow TCP traffic from worker nodes to load balancer for services of type NodePort - stateless Ingress"
31-
tcp_options {
32-
source_port_range {
27+
protocol = local.udp_protocol
28+
destination_type = "NETWORK_SECURITY_GROUP"
29+
destination = oci_core_network_security_group.worker_nsg.id
30+
stateless = false
31+
description = "Allow UDP traffic from load balancer to worker nodes for services of type NodePort"
32+
udp_options {
33+
destination_port_range {
3334
max = 32767
3435
min = 30000
3536
}
@@ -39,7 +40,7 @@ resource "oci_core_network_security_group_security_rule" "oke_lb_nsg_rule_worker
3940
resource "oci_core_network_security_group_security_rule" "oke_lb_nsg_rule_workers_healthcheck_egress" {
4041
direction = "EGRESS"
4142
network_security_group_id = oci_core_network_security_group.oke_lb_nsg.id
42-
protocol = "6"
43+
protocol = local.tcp_protocol
4344
destination_type = "NETWORK_SECURITY_GROUP"
4445
destination = oci_core_network_security_group.worker_nsg.id
4546
stateless = false
@@ -52,32 +53,23 @@ resource "oci_core_network_security_group_security_rule" "oke_lb_nsg_rule_worker
5253
}
5354
}
5455

56+
57+
# OCI Native Ingress does not support UDP, hence no UDP egress rule
5558
resource "oci_core_network_security_group_security_rule" "oke_lb_nsg_rule_pods_egress" {
5659
direction = "EGRESS"
5760
network_security_group_id = oci_core_network_security_group.oke_lb_nsg.id
58-
protocol = "6"
61+
protocol = local.tcp_protocol
5962
destination_type = "NETWORK_SECURITY_GROUP"
6063
destination = oci_core_network_security_group.pod_nsg.0.id
61-
stateless = true
62-
description = "LB to pods, OCI Native Ingress - stateless egress"
63-
count = local.is_npn ? 1 : 0
64-
}
65-
66-
resource "oci_core_network_security_group_security_rule" "oke_lb_nsg_rule_pods_ingress" {
67-
direction = "INGRESS"
68-
network_security_group_id = oci_core_network_security_group.oke_lb_nsg.id
69-
protocol = "6"
70-
source_type = "NETWORK_SECURITY_GROUP"
71-
source = oci_core_network_security_group.pod_nsg.0.id
72-
stateless = true
73-
description = "LB to pods, OCI Native Ingress - stateless ingress"
64+
stateless = false
65+
description = "LB to pods, OCI Native Ingress"
7466
count = local.is_npn ? 1 : 0
7567
}
7668

7769
resource "oci_core_network_security_group_security_rule" "oke_lb_nsg_rule_worker_discovery_egress" {
7870
direction = "EGRESS"
7971
network_security_group_id = oci_core_network_security_group.oke_lb_nsg.id
80-
protocol = "1"
72+
protocol = local.icmp_protocol
8173
destination_type = "NETWORK_SECURITY_GROUP"
8274
destination = oci_core_network_security_group.worker_nsg.id
8375
stateless = false

‎app-dev/devops-and-containers/oke/oke-rm/infra/modules/network/local.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,4 +10,9 @@ locals {
1010
nat_gateway_id = var.create_gateways ? oci_core_nat_gateway.nat_gateway.0.id : var.nat_gateway_id
1111
cp_nat_mode = local.create_cp_subnet && var.cp_subnet_private && var.cp_external_nat
1212
create_cp_external_traffic_rule = var.allow_external_cp_traffic && (! var.create_cp_subnet || (! var.cp_subnet_private || var.cp_external_nat))
13+
14+
15+
tcp_protocol = "6"
16+
icmp_protocol = "1"
17+
udp_protocol = "17"
1318
}

‎app-dev/devops-and-containers/oke/oke-rm/infra/modules/network/pod-nsg.tf‎

Lines changed: 7 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ resource "oci_core_network_security_group_security_rule" "oke_pod_nsg_ingress_3"
4141
resource "oci_core_network_security_group_security_rule" "oke_pod_nsg_ingress_4" {
4242
direction = "INGRESS"
4343
network_security_group_id = oci_core_network_security_group.pod_nsg.0.id
44-
protocol = "1"
44+
protocol = local.icmp_protocol
4545
source_type = "CIDR_BLOCK"
4646
source = "0.0.0.0/0"
4747
stateless = false
@@ -56,11 +56,11 @@ resource "oci_core_network_security_group_security_rule" "oke_pod_nsg_ingress_4"
5656
resource "oci_core_network_security_group_security_rule" "pods_nsg_rule_lb_ingress" {
5757
direction = "INGRESS"
5858
network_security_group_id = oci_core_network_security_group.pod_nsg.0.id
59-
protocol = "6"
59+
protocol = local.tcp_protocol
6060
source_type = "NETWORK_SECURITY_GROUP"
6161
source = oci_core_network_security_group.oke_lb_nsg.id
62-
stateless = true
63-
description = "LBs to pods, - stateless ingress"
62+
stateless = false
63+
description = "LBs to pods"
6464
count = local.is_npn ? 1 : 0
6565
}
6666

@@ -101,7 +101,7 @@ resource "oci_core_network_security_group_security_rule" "oke_pod_nsg_egress_3"
101101
resource "oci_core_network_security_group_security_rule" "oke_pod_nsg_egress_4" {
102102
direction = "EGRESS"
103103
network_security_group_id = oci_core_network_security_group.pod_nsg.0.id
104-
protocol = "6"
104+
protocol = local.tcp_protocol
105105
destination_type = "NETWORK_SECURITY_GROUP"
106106
destination = oci_core_network_security_group.cp_nsg.id
107107
stateless = false
@@ -118,7 +118,7 @@ resource "oci_core_network_security_group_security_rule" "oke_pod_nsg_egress_4"
118118
resource "oci_core_network_security_group_security_rule" "oke_pod_nsg_egress_5" {
119119
direction = "EGRESS"
120120
network_security_group_id = oci_core_network_security_group.pod_nsg.0.id
121-
protocol = "6"
121+
protocol = local.tcp_protocol
122122
destination_type = "SERVICE_CIDR_BLOCK"
123123
destination = lookup(data.oci_core_services.all_oci_services.services[0], "cidr_block")
124124
stateless = false
@@ -129,7 +129,7 @@ resource "oci_core_network_security_group_security_rule" "oke_pod_nsg_egress_5"
129129
resource "oci_core_network_security_group_security_rule" "oke_pod_nsg_egress_6" {
130130
direction = "EGRESS"
131131
network_security_group_id = oci_core_network_security_group.pod_nsg.0.id
132-
protocol = "1"
132+
protocol = local.icmp_protocol
133133
destination_type = "CIDR_BLOCK"
134134
destination = "0.0.0.0/0"
135135
stateless = false
@@ -139,15 +139,4 @@ resource "oci_core_network_security_group_security_rule" "oke_pod_nsg_egress_6"
139139
code = 4
140140
}
141141
count = local.is_npn ? 1 : 0
142-
}
143-
144-
resource "oci_core_network_security_group_security_rule" "pods_nsg_rule_lb_egress" {
145-
direction = "EGRESS"
146-
network_security_group_id = oci_core_network_security_group.pod_nsg.0.id
147-
protocol = "6"
148-
destination_type = "NETWORK_SECURITY_GROUP"
149-
destination = oci_core_network_security_group.oke_lb_nsg.id
150-
stateless = true
151-
description = "Pods to LBs, - stateless egress"
152-
count = local.is_npn ? 1 : 0
153142
}

0 commit comments

Comments
 (0)