Skip to content

Commit 5119f27

Browse files
mukulpalit-ibmmukulpalit-ibm
committed
PR changes
1 parent 092fc2c commit 5119f27

File tree

10 files changed

+649
-843
lines changed

10 files changed

+649
-843
lines changed

‎examples/monolith/README.md‎

Lines changed: 2 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -2,25 +2,8 @@
22

33
A simple example that shows how to provision a multi zone OCP VPC cluster as well as all foundational infrastructure and supporting services required for a secure and compliant OpenShift (OCP) cluster deployment on IBM Cloud VPC.
44

5-
The following resources are provisioned by this example:
6-
- A new resource group, if an existing one is not passed in.
7-
- A Key Protect instance with 2 root keys, one for cluster encryption, and one for worker boot volume encryption.
8-
- A VPC with subnets across 3 zones.
9-
- A public gateway for all the three zones.
10-
- A multi-zone (3 zone) KMS encrypted OCP VPC cluster, with worker pools in each zone.
11-
- An additional worker pool named workerpool is created and attached to the cluster using the worker-pool submodule.
12-
- Auto scaling enabled for the default worker pool.
13-
- Taints against the workers in zone-2 and zone-3.
14-
- Enable Kubernetes API server audit logs.
15-
- A Cloud logs instance.
16-
- A Cloud monitoring instance.
17-
- An activity tracker event routing instance.
18-
- A secrets manager instance.
19-
- A COS instance along with 3 buckets for VPC flow logs, metrics/data bucket and activity tracker bucket.
20-
- A SCC-WP instance.
21-
- A VPC instance.
22-
- An event notifications instance.
23-
- An app configuration service with aggregator enabled.
5+
- Refer [here](../../modules/monolith/README.md) to check all the resources are provisioned by this example by calling the monolith module.
6+
- A new resource group if an existing resource group is not passed.
247
- Monitoring agent.
258
- A Trusted Profile with Sender role to logs service.
269
- Logs agent.

‎examples/monolith/main.tf‎

Lines changed: 27 additions & 193 deletions
Original file line numberDiff line numberDiff line change
@@ -12,209 +12,43 @@ module "resource_group" {
1212
# Add-ons
1313
########################################################################################################################
1414

15-
module "monolith_add_ons" {
15+
module "ocp_cluster_with_add_ons" {
1616
source = "../../modules/monolith"
1717
prefix = var.prefix
1818
region = var.region
19+
ibmcloud_api_key = var.ibmcloud_api_key
20+
provider_visibility = var.provider_visibility
1921
resource_group_id = module.resource_group.resource_group_id
20-
kms_encryption_enabled_cluster = var.kms_encryption_enabled_cluster
22+
kms_encryption_enabled_cluster = true
2123
existing_kms_instance_crn = var.existing_kms_instance_crn
2224
existing_cluster_kms_key_crn = var.existing_cluster_kms_key_crn
23-
kms_endpoint_type = var.kms_endpoint_type
24-
key_protect_allowed_network = var.key_protect_allowed_network
25-
kms_encryption_enabled_boot_volume = var.kms_encryption_enabled_boot_volume
25+
kms_endpoint_type = "private"
26+
key_protect_allowed_network = "private-only"
27+
kms_encryption_enabled_boot_volume = true
2628
existing_boot_volume_kms_key_crn = var.existing_boot_volume_kms_key_crn
27-
kms_plan = var.kms_plan
28-
en_service_plan = var.en_service_plan
29-
en_service_endpoints = var.en_service_endpoints
29+
kms_plan = "tiered-pricing"
30+
en_service_plan = "standard"
31+
en_service_endpoints = "public-and-private"
3032
existing_secrets_manager_crn = var.existing_secrets_manager_crn
31-
secrets_manager_service_plan = var.secrets_manager_service_plan
32-
secrets_manager_endpoint_type = var.secrets_manager_endpoint_type
33-
secrets_manager_allowed_network = var.secrets_manager_allowed_network
33+
secrets_manager_service_plan = "standard"
34+
secrets_manager_endpoint_type = "private"
3435
existing_event_notifications_instance_crn = var.existing_event_notifications_instance_crn
3536
existing_cos_instance_crn = var.existing_cos_instance_crn
36-
cos_instance_plan = var.cos_instance_plan
37-
management_endpoint_type_for_buckets = var.management_endpoint_type_for_buckets
37+
cos_instance_plan = "standard"
38+
management_endpoint_type_for_buckets = "direct"
3839
existing_cloud_monitoring_crn = var.existing_cloud_monitoring_crn
39-
cloud_monitoring_plan = var.cloud_monitoring_plan
40+
cloud_monitoring_plan = "graduated-tier"
4041
existing_cloud_logs_crn = var.existing_cloud_logs_crn
41-
scc_workload_protection_service_plan = var.scc_workload_protection_service_plan
42-
enable_vpc_flow_logs = var.enable_vpc_flow_logs
43-
app_config_plan = var.app_config_plan
44-
app_config_service_endpoints = var.app_config_service_endpoints
45-
}
46-
47-
########################################################################################################################
48-
# OCP VPC cluster
49-
########################################################################################################################
50-
51-
locals {
52-
vpc_subnets = {
53-
# The default behavior is to deploy the worker pool across all subnets within the VPC.
54-
"default" = [
55-
for subnet in module.monolith_add_ons.subnet_zone_list :
56-
{
57-
id = subnet.id
58-
zone = subnet.zone
59-
cidr_block = subnet.cidr
60-
}
61-
]
62-
}
63-
64-
worker_pools = concat([
65-
{
66-
subnet_prefix = "default"
67-
pool_name = "default"
68-
machine_type = var.default_worker_pool_machine_type
69-
workers_per_zone = var.default_worker_pool_workers_per_zone
70-
resource_group_id = module.resource_group.resource_group_id
71-
operating_system = var.default_worker_pool_operating_system
72-
labels = var.default_worker_pool_labels
73-
minSize = var.default_pool_minimum_number_of_nodes
74-
maxSize = var.default_pool_maximum_number_of_nodes
75-
enableAutoscaling = var.enable_autoscaling_for_default_pool
76-
boot_volume_encryption_kms_config = {
77-
crk = module.monolith_add_ons.boot_volume_kms_key_id
78-
kms_instance_id = module.monolith_add_ons.boot_volume_existing_kms_guid
79-
kms_account_id = module.monolith_add_ons.boot_volume_kms_account_id
80-
}
81-
additional_security_group_ids = var.additional_security_group_ids
82-
}
83-
], [for pool in var.additional_worker_pools : merge(pool, { resource_group_id = module.resource_group.resource_group_id
84-
boot_volume_encryption_kms_config = {
85-
crk = module.monolith_add_ons.boot_volume_kms_key_id
86-
kms_instance_id = module.monolith_add_ons.boot_volume_existing_kms_guid
87-
kms_account_id = module.monolith_add_ons.boot_volume_kms_account_id
88-
} }) if length(pool.vpc_subnets) > 0],
89-
[for pool in var.additional_worker_pools : {
90-
pool_name = pool.pool_name
91-
machine_type = pool.machine_type
92-
workers_per_zone = pool.workers_per_zone
93-
resource_group_id = module.resource_group.resource_group_id
94-
operating_system = pool.operating_system
95-
labels = pool.labels
96-
minSize = pool.minSize
97-
secondary_storage = pool.secondary_storage
98-
maxSize = pool.maxSize
99-
enableAutoscaling = pool.enableAutoscaling
100-
boot_volume_encryption_kms_config = {
101-
crk = module.monolith_add_ons.boot_volume_kms_key_id
102-
kms_instance_id = module.monolith_add_ons.boot_volume_existing_kms_guid
103-
kms_account_id = module.monolith_add_ons.boot_volume_kms_account_id
104-
}
105-
additional_security_group_ids = pool.additional_security_group_ids
106-
subnet_prefix = "default"
107-
} if length(pool.vpc_subnets) == 0])
108-
109-
# Managing the ODF version accordingly, as it changes with each OCP version.
110-
addons = lookup(var.addons, "openshift-data-foundation", null) != null ? lookup(var.addons["openshift-data-foundation"], "version", null) == null ? { for key, value in var.addons :
111-
key => value != null ? {
112-
version = lookup(value, "version", null) == null && key == "openshift-data-foundation" ? "${var.openshift_version}.0" : lookup(value, "version", null)
113-
parameters_json = lookup(value, "parameters_json", null)
114-
} : null } : var.addons : var.addons
115-
}
116-
117-
module "ocp_base" {
118-
depends_on = [module.monolith_add_ons]
119-
source = "../.."
120-
resource_group_id = module.resource_group.resource_group_id
121-
region = var.region
122-
tags = var.cluster_resource_tags
123-
cluster_name = "${var.prefix}-${var.cluster_name}"
124-
force_delete_storage = true
125-
use_existing_cos = true
126-
existing_cos_id = module.monolith_add_ons.cos_instance_id
127-
vpc_id = module.monolith_add_ons.vpc_id
128-
vpc_subnets = local.vpc_subnets
129-
ocp_version = var.openshift_version
130-
worker_pools = local.worker_pools
131-
access_tags = var.access_tags
132-
ocp_entitlement = var.ocp_entitlement
133-
additional_lb_security_group_ids = var.additional_lb_security_group_ids
134-
additional_vpe_security_group_ids = var.additional_vpe_security_group_ids
135-
addons = local.addons
136-
allow_default_worker_pool_replacement = var.allow_default_worker_pool_replacement
137-
attach_ibm_managed_security_group = var.attach_ibm_managed_security_group
138-
cluster_config_endpoint_type = var.cluster_config_endpoint_type
139-
cbr_rules = var.ocp_cbr_rules
140-
cluster_ready_when = var.cluster_ready_when
141-
custom_security_group_ids = var.custom_security_group_ids
142-
disable_outbound_traffic_protection = var.allow_outbound_traffic
143-
disable_public_endpoint = !var.allow_public_access_to_cluster_management
144-
enable_ocp_console = var.enable_ocp_console
145-
ignore_worker_pool_size_changes = var.ignore_worker_pool_size_changes
146-
kms_config = module.monolith_add_ons.kms_config
147-
manage_all_addons = var.manage_all_addons
148-
number_of_lbs = var.number_of_lbs
149-
pod_subnet_cidr = var.pod_subnet_cidr
150-
service_subnet_cidr = var.service_subnet_cidr
151-
verify_worker_network_readiness = var.verify_worker_network_readiness
152-
worker_pools_taints = var.worker_pools_taints
153-
enable_secrets_manager_integration = var.enable_secrets_manager_integration
154-
existing_secrets_manager_instance_crn = module.monolith_add_ons.secrets_manager_crn
155-
secrets_manager_secret_group_id = var.secrets_manager_secret_group_id != null ? var.secrets_manager_secret_group_id : (var.enable_secrets_manager_integration ? module.secret_group[0].secret_group_id : null)
156-
skip_ocp_secrets_manager_iam_auth_policy = var.skip_ocp_secrets_manager_iam_auth_policy
157-
}
158-
159-
resource "terraform_data" "delete_secrets" {
160-
depends_on = [module.monolith_add_ons]
161-
count = var.enable_secrets_manager_integration && var.secrets_manager_secret_group_id == null ? 1 : 0
162-
input = {
163-
secret_id = module.secret_group[0].secret_group_id
164-
provider_visibility = var.provider_visibility
165-
secrets_manager_instance_id = module.monolith_add_ons.secrets_manager_guid
166-
secrets_manager_region = module.monolith_add_ons.secrets_manager_region
167-
secrets_manager_endpoint = var.secrets_manager_endpoint_type
168-
}
169-
# api key in triggers_replace to avoid it to be printed out in clear text in terraform_data output
170-
triggers_replace = {
171-
api_key = var.ibmcloud_api_key
172-
}
173-
provisioner "local-exec" {
174-
when = destroy
175-
command = "${path.module}/../../solutions/fully-configurable/scripts/delete_secrets.sh ${self.input.secret_id} ${self.input.provider_visibility} ${self.input.secrets_manager_instance_id} ${self.input.secrets_manager_region} ${self.input.secrets_manager_endpoint}"
176-
interpreter = ["/bin/bash", "-c"]
177-
178-
environment = {
179-
API_KEY = self.triggers_replace.api_key
180-
}
181-
}
182-
}
183-
184-
module "secret_group" {
185-
count = var.enable_secrets_manager_integration && var.secrets_manager_secret_group_id == null ? 1 : 0
186-
source = "terraform-ibm-modules/secrets-manager-secret-group/ibm"
187-
version = "1.3.15"
188-
region = module.monolith_add_ons.secrets_manager_region
189-
secrets_manager_guid = module.monolith_add_ons.secrets_manager_guid
190-
secret_group_name = module.ocp_base.cluster_id
191-
secret_group_description = "Secret group for storing ingress certificates for cluster ${var.cluster_name} with id: ${module.ocp_base.cluster_id}"
192-
endpoint_type = var.secrets_manager_endpoint_type
42+
scc_workload_protection_service_plan = "graduated-tier"
43+
enable_vpc_flow_logs = true
44+
app_config_plan = "enterprise"
45+
app_config_service_endpoints = "public-and-private"
19346
}
19447

19548
data "ibm_container_cluster_config" "cluster_config" {
196-
count = var.enable_kube_audit ? 1 : 0
197-
cluster_name_id = module.ocp_base.cluster_id
49+
cluster_name_id = module.ocp_cluster_with_add_ons.cluster_id
50+
resource_group_id = module.resource_group.resource_group_id
19851
config_dir = "${path.module}/../../kubeconfig"
199-
admin = true
200-
resource_group_id = module.ocp_base.resource_group_id
201-
endpoint_type = var.cluster_config_endpoint_type != "default" ? var.cluster_config_endpoint_type : null
202-
}
203-
204-
module "kube_audit" {
205-
count = var.enable_kube_audit ? 1 : 0
206-
ibmcloud_api_key = var.ibmcloud_api_key
207-
source = "../../modules/kube-audit"
208-
cluster_id = module.ocp_base.cluster_id
209-
cluster_resource_group_id = module.ocp_base.resource_group_id
210-
region = module.ocp_base.region
211-
use_private_endpoint = var.use_private_endpoint
212-
cluster_config_endpoint_type = var.cluster_config_endpoint_type
213-
audit_log_policy = var.audit_log_policy
214-
audit_namespace = var.audit_namespace
215-
audit_deployment_name = var.audit_deployment_name
216-
audit_webhook_listener_image = var.audit_webhook_listener_image
217-
audit_webhook_listener_image_tag_digest = var.audit_webhook_listener_image_tag_digest
21852
}
21953

22054
##############################################################################
@@ -224,10 +58,10 @@ module "kube_audit" {
22458
module "monitoring_agent" {
22559
source = "terraform-ibm-modules/monitoring-agent/ibm"
22660
version = "1.19.0"
227-
cluster_id = module.ocp_base.cluster_id
61+
cluster_id = module.ocp_cluster_with_add_ons.cluster_id
22862
cluster_resource_group_id = module.resource_group.resource_group_id
22963
is_vpc_cluster = true
230-
access_key = module.monolith_add_ons.cloud_monitoring_access_key
64+
access_key = module.ocp_cluster_with_add_ons.cloud_monitoring_access_key
23165
instance_region = var.region
23266
metrics_filter = [{ exclude = "metricA.*" }, { include = "metricB.*" }]
23367
container_filter = [{ type = "exclude", parameter = "kubernetes.namespace.name", name = "kube-system" }]
@@ -263,7 +97,7 @@ module "trusted_profile" {
26397
cr_type = "ROKS_SA"
26498
unique_identifier = "logs-agent-link"
26599
links = [{
266-
crn = module.ocp_base.cluster_crn
100+
crn = module.ocp_cluster_with_add_ons.cluster_crn
267101
namespace = local.logs_agent_namespace
268102
name = local.logs_agent_name
269103
}]
@@ -274,18 +108,18 @@ module "trusted_profile" {
274108
module "logs_agent" {
275109
source = "terraform-ibm-modules/logs-agent/ibm"
276110
version = "1.10.0"
277-
cluster_id = module.ocp_base.cluster_id
111+
cluster_id = module.ocp_cluster_with_add_ons.cluster_id
278112
cluster_resource_group_id = module.resource_group.resource_group_id
279113
# Logs agent
280114
logs_agent_trusted_profile_id = module.trusted_profile.trusted_profile.id
281115
logs_agent_namespace = local.logs_agent_namespace
282116
logs_agent_name = local.logs_agent_name
283-
cloud_logs_ingress_endpoint = module.monolith_add_ons.cloud_logs_ingress_private_endpoint
117+
cloud_logs_ingress_endpoint = module.ocp_cluster_with_add_ons.cloud_logs_ingress_private_endpoint
284118
cloud_logs_ingress_port = 3443
285119
# example of how to add additional metadata to the logs agent
286120
logs_agent_additional_metadata = [{
287121
key = "cluster_id"
288-
value = module.ocp_base.cluster_id
122+
value = module.ocp_cluster_with_add_ons.cluster_id
289123
}]
290124
logs_agent_resources = {
291125
limits = {

0 commit comments

Comments
 (0)