Skip to content

Commit 1f67919

Browse files
imprateekshimprateeksh
authored
feat: added the ability to optionally set the operating_system value inside the worker_pools input variable list object. Validation has also been added to ensure only the following allowed values are passed: REDHAT_8_64, RHCOS (only allowed in OCP version 4.15 or later) (#466)
1 parent 4fd4bd4 commit 1f67919

File tree

7 files changed

+93
-27
lines changed

7 files changed

+93
-27
lines changed

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -269,7 +269,7 @@ Optionally, you need the following permissions to attach Access Management tags
269269
| <a name="input_verify_worker_network_readiness"></a> [verify\_worker\_network\_readiness](#input\_verify\_worker\_network\_readiness) | By setting this to true, a script will run kubectl commands to verify that all worker nodes can communicate successfully with the master. If the runtime does not have access to the kube cluster to run kubectl commands, this should be set to false. | `bool` | `true` | no |
270270
| <a name="input_vpc_id"></a> [vpc\_id](#input\_vpc\_id) | Id of the VPC instance where this cluster will be provisioned | `string` | n/a | yes |
271271
| <a name="input_vpc_subnets"></a> [vpc\_subnets](#input\_vpc\_subnets) | Metadata that describes the VPC's subnets. Obtain this information from the VPC where this cluster will be created | <pre>map(list(object({<br> id = string<br> zone = string<br> cidr_block = string<br> })))</pre> | n/a | yes |
272-
| <a name="input_worker_pools"></a> [worker\_pools](#input\_worker\_pools) | List of worker pools | <pre>list(object({<br> subnet_prefix = optional(string)<br> vpc_subnets = optional(list(object({<br> id = string<br> zone = string<br> cidr_block = string<br> })))<br> pool_name = string<br> machine_type = string<br> workers_per_zone = number<br> resource_group_id = optional(string)<br> labels = optional(map(string))<br> minSize = optional(number)<br> maxSize = optional(number)<br> enableAutoscaling = optional(bool)<br> boot_volume_encryption_kms_config = optional(object({<br> crk = string<br> kms_instance_id = string<br> kms_account_id = optional(string)<br> }))<br> additional_security_group_ids = optional(list(string))<br> }))</pre> | n/a | yes |
272+
| <a name="input_worker_pools"></a> [worker\_pools](#input\_worker\_pools) | List of worker pools | <pre>list(object({<br> subnet_prefix = optional(string)<br> vpc_subnets = optional(list(object({<br> id = string<br> zone = string<br> cidr_block = string<br> })))<br> pool_name = string<br> machine_type = string<br> workers_per_zone = number<br> resource_group_id = optional(string)<br> operating_system = optional(string)<br> labels = optional(map(string))<br> minSize = optional(number)<br> maxSize = optional(number)<br> enableAutoscaling = optional(bool)<br> boot_volume_encryption_kms_config = optional(object({<br> crk = string<br> kms_instance_id = string<br> kms_account_id = optional(string)<br> }))<br> additional_security_group_ids = optional(list(string))<br> }))</pre> | n/a | yes |
273273
| <a name="input_worker_pools_taints"></a> [worker\_pools\_taints](#input\_worker\_pools\_taints) | Optional, Map of lists containing node taints by node-pool name | `map(list(object({ key = string, value = string, effect = string })))` | `null` | no |
274274
275275
### Outputs

‎common-dev-assets‎

‎examples/multiple_mzr_clusters/main.tf‎

Lines changed: 36 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,12 @@ resource "ibm_is_subnet" "subnet_cluster_2" {
6262
########################################################################################################################
6363

6464
locals {
65+
66+
# Choosing RHEL for the default worker pool will limit all additional worker pools to RHEL.
67+
# If we plan to use RHCOS with the cluster, we should create the default worker pool with RHCOS.
68+
69+
os_rhcos = "RHCOS"
70+
os_rhel = "REDHAT_8_64"
6571
cluster_1_vpc_subnets = {
6672
default = [
6773
for subnet in ibm_is_subnet.subnet_cluster_1 :
@@ -90,13 +96,15 @@ locals {
9096
pool_name = "default" # ibm_container_vpc_cluster automatically names standard pool "standard" (See https://github.com/IBM-Cloud/terraform-provider-ibm/issues/2849)
9197
machine_type = "bx2.4x16"
9298
workers_per_zone = 2
99+
operating_system = local.os_rhcos
93100
},
94101
{
95102
subnet_prefix = "default"
96103
pool_name = "logging-worker-pool"
97104
machine_type = "bx2.4x16"
98105
workers_per_zone = 2
99106
labels = { "dedicated" : "logging-worker-pool" }
107+
operating_system = local.os_rhel
100108
}
101109
]
102110

@@ -112,33 +120,37 @@ locals {
112120
}
113121

114122
module "ocp_base_cluster_1" {
115-
source = "../.."
116-
cluster_name = "${var.prefix}-cluster-1"
117-
resource_group_id = module.resource_group.resource_group_id
118-
region = var.region
119-
force_delete_storage = true
120-
vpc_id = ibm_is_vpc.vpc.id
121-
vpc_subnets = local.cluster_1_vpc_subnets
122-
worker_pools = local.worker_pools
123-
worker_pools_taints = local.worker_pool_taints
124-
ocp_version = var.ocp_version
125-
tags = var.resource_tags
126-
ocp_entitlement = var.ocp_entitlement
123+
source = "../.."
124+
cluster_name = "${var.prefix}-cluster-1"
125+
resource_group_id = module.resource_group.resource_group_id
126+
region = var.region
127+
force_delete_storage = true
128+
vpc_id = ibm_is_vpc.vpc.id
129+
vpc_subnets = local.cluster_1_vpc_subnets
130+
disable_outbound_traffic_protection = true
131+
worker_pools = local.worker_pools
132+
operating_system = local.os_rhcos
133+
worker_pools_taints = local.worker_pool_taints
134+
ocp_version = var.ocp_version
135+
tags = var.resource_tags
136+
ocp_entitlement = var.ocp_entitlement
127137
}
128138

129139
module "ocp_base_cluster_2" {
130-
source = "../.."
131-
cluster_name = "${var.prefix}-cluster-2"
132-
resource_group_id = module.resource_group.resource_group_id
133-
region = var.region
134-
force_delete_storage = true
135-
vpc_id = ibm_is_vpc.vpc.id
136-
vpc_subnets = local.cluster_2_vpc_subnets
137-
worker_pools = local.worker_pools
138-
worker_pools_taints = local.worker_pool_taints
139-
ocp_version = var.ocp_version
140-
tags = var.resource_tags
141-
ocp_entitlement = var.ocp_entitlement
140+
source = "../.."
141+
cluster_name = "${var.prefix}-cluster-2"
142+
resource_group_id = module.resource_group.resource_group_id
143+
region = var.region
144+
force_delete_storage = true
145+
vpc_id = ibm_is_vpc.vpc.id
146+
disable_outbound_traffic_protection = true
147+
vpc_subnets = local.cluster_2_vpc_subnets
148+
worker_pools = local.worker_pools
149+
operating_system = local.os_rhcos
150+
worker_pools_taints = local.worker_pool_taints
151+
ocp_version = var.ocp_version
152+
tags = var.resource_tags
153+
ocp_entitlement = var.ocp_entitlement
142154
}
143155

144156
########################################################################################################################

‎main.tf‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,36 @@ locals {
5353
disable_outbound_traffic_protection = startswith(local.ocp_version, "4.12") || startswith(local.ocp_version, "4.13") || startswith(local.ocp_version, "4.14") ? null : var.disable_outbound_traffic_protection
5454
}
5555

56+
# Separate local block to handle os validations
57+
locals {
58+
os_rhel = "REDHAT_8_64"
59+
os_rhcos = "RHCOS"
60+
61+
# Strip OCP VERSION and use this ocp version in logic
62+
ocp_version_num = regex("^([0-9]+\\.[0-9]+)", local.ocp_version)[0]
63+
is_valid_version = local.ocp_version_num != null ? tonumber(local.ocp_version_num) >= 4.15 : false
64+
rhcos_allowed_ocp_version = var.operating_system == local.os_rhcos && local.is_valid_version
65+
worker_pool_rhcos_entry = [for worker in var.worker_pools : (worker.operating_system == null || worker.operating_system == local.os_rhel || (worker.operating_system == local.os_rhcos && local.is_valid_version) ? true : false)]
66+
67+
# To verify rhcos operating system exists only for OCP versions >=4.15
68+
# tflint-ignore: terraform_unused_declarations
69+
cluster_rhcos_validation = var.operating_system == null || var.operating_system == local.os_rhel || local.rhcos_allowed_ocp_version ? true : tobool("RHCOS requires VPC clusters created from 4.15 onwards. Upgraded clusters from 4.14 cannot use RHCOS")
70+
71+
# tflint-ignore: terraform_unused_declarations
72+
worker_pool_rhcos_validation = alltrue(local.worker_pool_rhcos_entry) ? true : tobool("RHCOS requires VPC clusters created from 4.15 onwards. Upgraded clusters from 4.14 cannot use RHCOS")
73+
74+
# Validate if default worker pool's operating system is RHEL, all pools' operating system must be RHEL
75+
check_other_os = local.default_pool.operating_system == null || local.default_pool.operating_system == local.os_rhcos
76+
rhel_check_for_other_pools = [for pool in var.worker_pools : pool.pool_name != "default" && pool.operating_system == local.os_rhel ? true : false]
77+
# tflint-ignore: terraform_unused_declarations
78+
valid_rhel_worker_pools = local.check_other_os || (local.default_pool.operating_system == local.os_rhel && alltrue(local.rhel_check_for_other_pools)) == true ? true : tobool("Choosing RHEL for the default worker pool will limit all additional worker pools to RHEL.")
79+
80+
# Validate if RHCOS is used as operating system for the cluster then the default worker pool must be created with RHCOS
81+
rhcos_check = var.operating_system == null || var.operating_system == local.os_rhel || (var.operating_system == local.os_rhcos && local.default_pool.operating_system == local.os_rhcos)
82+
# tflint-ignore: terraform_unused_declarations
83+
default_wp_validation = local.rhcos_check == true ? true : tobool("If RHCOS is used with this cluster, the default worker pool should be created with RHCOS.")
84+
}
85+
5686
# Lookup the current default kube version
5787
data "ibm_container_cluster_versions" "cluster_versions" {
5888
resource_group_id = var.resource_group_id
@@ -298,6 +328,7 @@ resource "ibm_container_vpc_worker_pool" "pool" {
298328
cluster = local.cluster_id
299329
worker_pool_name = each.value.pool_name
300330
flavor = each.value.machine_type
331+
operating_system = each.value.operating_system
301332
worker_count = each.value.workers_per_zone
302333
labels = each.value.labels
303334
crk = each.value.boot_volume_encryption_kms_config == null ? null : each.value.boot_volume_encryption_kms_config.crk
@@ -340,6 +371,7 @@ resource "ibm_container_vpc_worker_pool" "autoscaling_pool" {
340371
cluster = local.cluster_id
341372
worker_pool_name = each.value.pool_name
342373
flavor = each.value.machine_type
374+
operating_system = each.value.operating_system
343375
worker_count = each.value.workers_per_zone
344376
labels = each.value.labels
345377
crk = each.value.boot_volume_encryption_kms_config == null ? null : each.value.boot_volume_encryption_kms_config.crk

‎modules/fscloud/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ No resources.
5656
| <a name="input_verify_worker_network_readiness"></a> [verify\_worker\_network\_readiness](#input\_verify\_worker\_network\_readiness) | By setting this to true, a script will run kubectl commands to verify that all worker nodes can communicate successfully with the master. If the runtime does not have access to the kube cluster to run kubectl commands, this should be set to false. | `bool` | `true` | no |
5757
| <a name="input_vpc_id"></a> [vpc\_id](#input\_vpc\_id) | ID of the VPC instance where this cluster will be provisioned | `string` | n/a | yes |
5858
| <a name="input_vpc_subnets"></a> [vpc\_subnets](#input\_vpc\_subnets) | Metadata that describes the VPC's subnets. Obtain this information from the VPC where this cluster will be created | <pre>map(list(object({<br> id = string<br> zone = string<br> cidr_block = string<br> })))</pre> | n/a | yes |
59-
| <a name="input_worker_pools"></a> [worker\_pools](#input\_worker\_pools) | List of worker pools | <pre>list(object({<br> subnet_prefix = string<br> pool_name = string<br> machine_type = string<br> workers_per_zone = number<br> resource_group_id = optional(string)<br> labels = optional(map(string))<br> boot_volume_encryption_kms_config = optional(object({<br> crk = string<br> kms_instance_id = string<br> kms_account_id = optional(string)<br> }))<br> additional_security_group_ids = optional(list(string))<br> }))</pre> | n/a | yes |
59+
| <a name="input_worker_pools"></a> [worker\_pools](#input\_worker\_pools) | List of worker pools | <pre>list(object({<br> subnet_prefix = string<br> pool_name = string<br> machine_type = string<br> workers_per_zone = number<br> resource_group_id = optional(string)<br> operating_system = optional(string)<br> labels = optional(map(string))<br> boot_volume_encryption_kms_config = optional(object({<br> crk = string<br> kms_instance_id = string<br> kms_account_id = optional(string)<br> }))<br> additional_security_group_ids = optional(list(string))<br> }))</pre> | n/a | yes |
6060
| <a name="input_worker_pools_taints"></a> [worker\_pools\_taints](#input\_worker\_pools\_taints) | Optional, Map of lists containing node taints by node-pool name | `map(list(object({ key = string, value = string, effect = string })))` | `null` | no |
6161

6262
### Outputs

‎modules/fscloud/variables.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@ variable "worker_pools" {
4747
machine_type = string
4848
workers_per_zone = number
4949
resource_group_id = optional(string)
50+
operating_system = optional(string)
5051
labels = optional(map(string))
5152
boot_volume_encryption_kms_config = optional(object({
5253
crk = string
@@ -203,6 +204,11 @@ variable "operating_system" {
203204
type = string
204205
description = "The operating system of the workers in the default worker pool. If no value is specified, the current default version OS will be used. See https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_versions#openshift_versions_available ."
205206
default = null
207+
validation {
208+
error_message = "RHEL 8 (REDHAT_8_64) or Red Hat Enterprise Linux CoreOS (RHCOS) are the allowed OS values. RHCOS requires VPC clusters created from 4.15 onwards. Upgraded clusters from 4.14 cannot use RHCOS."
209+
condition = var.operating_system == null || var.operating_system == "REDHAT_8_64" || var.operating_system == "RHCOS"
210+
}
211+
206212
}
207213

208214
##############################################################################

‎variables.tf‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,7 @@ variable "worker_pools" {
5252
machine_type = string
5353
workers_per_zone = number
5454
resource_group_id = optional(string)
55+
operating_system = optional(string)
5556
labels = optional(map(string))
5657
minSize = optional(number)
5758
maxSize = optional(number)
@@ -86,6 +87,17 @@ variable "worker_pools" {
8687
condition = length([for worker_pool in var.worker_pools : worker_pool if(worker_pool.subnet_prefix == null && worker_pool.vpc_subnets == null) || (worker_pool.subnet_prefix != null && worker_pool.vpc_subnets != null)]) == 0
8788
error_message = "Please provide exactly one of subnet_prefix or vpc_subnets. Passing neither or both is invalid."
8889
}
90+
validation {
91+
condition = alltrue([
92+
for worker_pool in var.worker_pools :
93+
anytrue([
94+
worker_pool.operating_system == null,
95+
worker_pool.operating_system == "REDHAT_8_64",
96+
worker_pool.operating_system == "RHCOS"
97+
])
98+
])
99+
error_message = "RHEL 8 (REDHAT_8_64) or Red Hat Enterprise Linux CoreOS (RHCOS) are the allowed OS values. RHCOS requires VPC clusters created from 4.15 onwards. Upgraded clusters from 4.14 cannot use RHCOS."
100+
}
89101
}
90102

91103
variable "worker_pools_taints" {
@@ -253,6 +265,10 @@ variable "operating_system" {
253265
type = string
254266
description = "The operating system of the workers in the default worker pool. If no value is specified, the current default version OS will be used. See https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_versions#openshift_versions_available ."
255267
default = null
268+
validation {
269+
error_message = "RHEL 8 (REDHAT_8_64) or Red Hat Enterprise Linux CoreOS (RHCOS) are the allowed OS values. RHCOS requires VPC clusters created from 4.15 onwards. Upgraded clusters from 4.14 cannot use RHCOS."
270+
condition = var.operating_system == null || var.operating_system == "REDHAT_8_64" || var.operating_system == "RHCOS"
271+
}
256272
}
257273

258274
# VPC Variables

0 commit comments

Comments
 (0)