diff --git a/.catalog-onboard-pipeline.yaml b/.catalog-onboard-pipeline.yaml index f1fbee85..3110933e 100644 --- a/.catalog-onboard-pipeline.yaml +++ b/.catalog-onboard-pipeline.yaml @@ -15,3 +15,6 @@ offerings: instance_id: 1c7d5f78-9262-44c3-b779-b28fe4d88c37 region: us-south scope_resource_group_var_name: existing_resource_group_name + - name: quickstart + mark_ready: true + install_type: fullstack diff --git a/.secrets.baseline b/.secrets.baseline index a262313b..04c997a1 100644 --- a/.secrets.baseline +++ b/.secrets.baseline @@ -3,7 +3,7 @@ "files": "go.sum|^.secrets.baseline$", "lines": null }, - "generated_at": "2025-05-14T17:28:16Z", + "generated_at": "2025-07-31T06:11:34Z", "plugins_used": [ { "name": "AWSKeyDetector" @@ -82,7 +82,7 @@ "hashed_secret": "8196b86ede820e665b2b8af9c648f4996be99838", "is_secret": false, "is_verified": false, - "line_number": 65, + "line_number": 89, "type": "Secret Keyword", "verified_result": null } diff --git a/ibm_catalog.json b/ibm_catalog.json index d9f8bdc7..aca1dac2 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -66,7 +66,7 @@ { "label": "Fully configurable", "name": "fully-configurable", - "index": 1, + "index": 2, "install_type": "fullstack", "working_directory": "solutions/fully-configurable", "compliance": { @@ -1007,6 +1007,217 @@ ], "dependency_version_2": true, "terraform_version": "1.10.5" + }, + { + "label": "QuickStart", + "name": "quickstart", + "index": 1, + "install_type": "fullstack", + "working_directory": "solutions/quickstart", + "iam_permissions": [ + { + "service_name": "containers-kubernetes", + "role_crns": [ + "crn:v1:bluemix:public:iam::::serviceRole:Manager", + "crn:v1:bluemix:public:iam::::role:Administrator" + ], + "notes": "Required to reset the cluster API key, create and edit the OpenShift cluster, and manage all related resources." + }, + { + "service_name": "iam-identity", + "role_crns": [ + "crn:v1:bluemix:public:iam::::role:Administrator", + "crn:v1:bluemix:public:iam-identity::::serviceRole:UserApiKeyCreator" + ], + "notes": "Required to create the cluster API key needed by the OpenShift cluster on IBM Cloud and for managing and operating resources within the IBM Cloud environment." + }, + { + "service_name": "is.vpc", + "role_crns": [ + "crn:v1:bluemix:public:iam::::role:Editor" + ], + "notes": "Required for creating Virtual Private Cloud (VPC)." + }, + { + "service_name": "cloud-object-storage", + "role_crns": [ + "crn:v1:bluemix:public:iam::::serviceRole:Manager", + "crn:v1:bluemix:public:iam::::role:Editor" + ], + "notes": "Required for creating the OpenShift cluster's internal registry storage bucket." + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::role:Viewer" + ], + "service_name": "Resource group only", + "notes":"Viewer access is required in the resource group you want to provision in." + } + ], + "architecture": { + "features": [ + { + "title": " ", + "description": "Configures QuickStart deployment of a Red Hat OpenShift cluster within an IBM Cloud VPC with limited options." + } + ], + "diagrams": [ + { + "diagram": { + "caption": "Red Hat OpenShift cluster topology - Quickstart", + "url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/refs/heads/main/reference-architecture/deployable-architecture-ocp-cluster-qs.svg", + "type": "image/svg+xml" + }, + "description": "This QuickStart variation of deployable architecture enables deployment of a Red Hat OpenShift cluster within an IBM Cloud Virtual Private Cloud (VPC). It provisions the OpenShift cluster and its foundational VPC infrastructure with a limited set of essential options for rapid and streamlined setup. Additionally, the deployment creates an Object Storage bucket that serves as the internal container image registry for the OpenShift cluster. Thus, it helps ensure seamless storage integration.

Users can select from predefined cluster sizes — mini (default), small, medium, and large. Each size determining the number of availability zones, worker nodes per zone, and the machine type (worker node flavor). [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/blob/main/solutions/quickstart/DA_docs.md).

By default, the architecture provisions a two-zone VPC, forming the foundation for the OpenShift cluster. The cluster comprises a single worker pool distributed across these zones, with two worker nodes per zone in the mini configuration.

This streamlined architecture balances ease of use with flexibility, enabling rapid OpenShift cluster deployments with the infrastructure, integrated storage services, and right-sized compute resources of IBM Cloud." + } + ] + }, + "configuration": [ + { + "key": "ibmcloud_api_key" + }, + { + "key": "existing_resource_group_name", + "display_name": "resource_group", + "custom_config": { + "type": "resource_group", + "grouping": "deployment", + "original_grouping": "deployment", + "config_constraints": { + "identifier": "rg_name" + } + } + }, + { + "key": "prefix", + "required": true + }, + { + "key": "region", + "required": true, + "type": "string", + "custom_config": { + "config_constraints": { + "generationType": "2" + }, + "grouping": "deployment", + "original_grouping": "deployment", + "type": "vpc_region" + } + }, + { + "key": "size", + "required": true, + "options": [ + { + "displayname": "mini", + "value": "mini" + }, + { + "displayname": "small", + "value": "small" + }, + { + "displayname": "medium", + "value": "medium" + }, + { + "displayname": "large", + "value": "large" + } + ] + }, + { + "key": "provider_visibility", + "options": [ + { + "displayname": "private", + "value": "private" + }, + { + "displayname": "public", + "value": "public" + }, + { + "displayname": "public-and-private", + "value": "public-and-private" + } + ], + "hidden": true + }, + { + "key": "cluster_name" + }, + { + "key": "ocp_version", + "default_value": "4.17", + "required": true, + "options": [ + { + "displayname": "4.18", + "value": "4.18" + }, + { + "displayname": "4.17", + "value": "4.17" + }, + { + "displayname": "4.16", + "value": "4.16" + }, + { + "displayname": "4.15", + "value": "4.15" + }, + { + "displayname": "4.14", + "value": "4.14" + } + ] + }, + { + "key": "default_worker_pool_operating_system", + "options": [ + { + "displayname": "RHEL 9", + "value": "RHEL_9_64" + }, + { + "displayname": "Red Hat CoreOS", + "value": "RHCOS" + }, + { + "displayname": "RHEL 8", + "value": "REDHAT_8_64" + } + ] + }, + { + "key": "address_prefix", + "hidden": true + }, + { + "key": "ocp_entitlement" + }, + { + "key": "access_tags", + "hidden":true, + "custom_config": { + "type": "array", + "grouping": "deployment", + "original_grouping": "deployment", + "config_constraints": { + "type": "string" + } + } + }, + { + "key": "disable_public_endpoint" + }, + { + "key": "disable_outbound_traffic_protection" + } + ] } ] } diff --git a/reference-architecture/deployable-architecture-ocp-cluster-qs.svg b/reference-architecture/deployable-architecture-ocp-cluster-qs.svg new file mode 100644 index 00000000..fdbad4f2 --- /dev/null +++ b/reference-architecture/deployable-architecture-ocp-cluster-qs.svg @@ -0,0 +1,4 @@ + + + +
ACL
locked
IBM Cloud
Region
Resource GroupVPC
Worker node
Openshift
Zone 3
Zone 2
Zone 1
Subnet
Worker Node
Worker Pool
Registry Bucket
           Cloud Object Storage 
 \ No newline at end of file diff --git a/solutions/quickstart/DA_docs.md b/solutions/quickstart/DA_docs.md new file mode 100644 index 00000000..b310b658 --- /dev/null +++ b/solutions/quickstart/DA_docs.md @@ -0,0 +1,12 @@ +# Cluster Size Configuration + +This document describes the cluster size options and their configuration details. This table determines the number of availability zones, worker nodes per zone, and the machine type used for the OpenShift cluster. + +## Cluster Table + +| Size | Number of Worker Nodes per zone | Total Number of Worker Nodes | Zones | vCPU per Node | Memory per Node (GB) | Disk per Node (GB) | Worker Node Flavor Name | HA Level | Notes | +|--------------|------------------------|------------------------------|--------|----------------|------------------------|----------------------|--------------------------|---------------------|--------------------------------------------------------| +| Mini | 1 | 2 | 2 | 4 | 16 | 100 | bx2.4x16 | Moderate (Basic) | Smallest possible; basic HA across 2 zones | +| Small | 1 | 3 | 3 | 8 | 32 | 200 | bx2.8x32 | High | Entry-level production HA | +| Medium | 2 | 6 | 3 | 8 | 32 | 200 | bx2.8x32 | High | Moderate workloads, better HA | +| Large | 3 | 9 | 3 | 16 | 64 | 400 | bx2.16x64 | High | Large-scale, robust HA | diff --git a/solutions/quickstart/README.md b/solutions/quickstart/README.md new file mode 100644 index 00000000..805492c0 --- /dev/null +++ b/solutions/quickstart/README.md @@ -0,0 +1,3 @@ +# Cloud automation for Red Hat OpenShift Container Platform on VPC (QuickStart) + +:exclamation: **Important:** This solution is not intended to be called by other modules because it contains a provider configuration and is not compatible with the `for_each`, `count`, and `depends_on` arguments. For more information, see [Providers Within Modules](https://developer.hashicorp.com/terraform/language/modules/develop/providers). diff --git a/solutions/quickstart/catalogValidationValues.json.template b/solutions/quickstart/catalogValidationValues.json.template new file mode 100644 index 00000000..d8e67ee3 --- /dev/null +++ b/solutions/quickstart/catalogValidationValues.json.template @@ -0,0 +1,6 @@ +{ + "ibmcloud_api_key": $VALIDATION_APIKEY, + "prefix": $PREFIX, + "size": "mini", + "existing_resource_group_name": "Default" +} diff --git a/solutions/quickstart/main.tf b/solutions/quickstart/main.tf new file mode 100644 index 00000000..745cde88 --- /dev/null +++ b/solutions/quickstart/main.tf @@ -0,0 +1,148 @@ +####################################################################################################################### +# Resource Group +####################################################################################################################### +module "resource_group" { + source = "terraform-ibm-modules/resource-group/ibm" + version = "1.3.0" + existing_resource_group_name = var.existing_resource_group_name +} + +locals { + prefix = var.prefix != null ? trimspace(var.prefix) != "" ? "${var.prefix}-" : "" : "" + cluster_name = "${local.prefix}${var.cluster_name}" +} + +######################################################################################################################## +# VPC + Subnet + Public Gateway +######################################################################################################################## +locals { + octets = split(".", split("/", var.address_prefix)[0]) + mask = split("/", var.address_prefix)[1] + + subnets = { + for count in range(1, 4) : + "zone-${count}" => count <= local.selected.zones ? [ + { + name = "${local.prefix}subnet-${count}" + cidr = format( + "%d.%d.%d.0/%s", + tonumber(local.octets[0]), + tonumber(local.octets[1]) + (count - 1) * 10, + tonumber(local.octets[2]), + local.mask + ) + public_gateway = true + acl_name = "${var.prefix}-acl" + } + ] : [] + } + + public_gateway = { + for count in range(1, 4) : + "zone-${count}" => count <= local.selected.zones + } + + network_acl = { + name = "${local.prefix}acl" + add_ibm_cloud_internal_rules = true + add_vpc_connectivity_rules = true + prepend_ibm_rules = true + rules = [{ + name = "${local.prefix}inbound" + action = "allow" + source = "0.0.0.0/0" + destination = "0.0.0.0/0" + direction = "inbound" + }, + { + name = "${local.prefix}outbound" + action = "allow" + source = "0.0.0.0/0" + destination = "0.0.0.0/0" + direction = "outbound" + } + ] + } +} + +module "vpc" { + source = "terraform-ibm-modules/landing-zone-vpc/ibm" + version = "7.25.10" + resource_group_id = module.resource_group.resource_group_id + region = var.region + name = "vpc" + prefix = var.prefix + subnets = local.subnets + network_acls = [local.network_acl] + use_public_gateways = local.public_gateway +} + +locals { + size_config = { + mini = { + flavor = "bx2.4x16" + workers_per_zone = 1 + zones = 2 + + } + small = { + flavor = "bx2.8x32" + workers_per_zone = 1 + zones = 3 + } + medium = { + flavor = "bx2.8x32" + workers_per_zone = 2 + zones = 3 + } + large = { + flavor = "bx2.16x64" + workers_per_zone = 3 + zones = 3 + } + } + + selected = lookup(local.size_config, var.size, local.size_config[var.size]) + + # Build the vpc_subnets for default pool + cluster_vpc_subnets = { + default = [ + for i in range(local.selected.zones) : { + id = module.vpc.subnet_zone_list[i].id + cidr_block = module.vpc.subnet_zone_list[i].cidr + zone = module.vpc.subnet_zone_list[i].zone + } + ] + } + + worker_pools = [ + { + pool_name = "default" + machine_type = local.selected.flavor + operating_system = var.default_worker_pool_operating_system + workers_per_zone = local.selected.workers_per_zone + vpc_subnets = local.cluster_vpc_subnets["default"] + + } + ] +} + +######################################################################################################################## +# OCP VPC cluster (single zone) +######################################################################################################################## +module "ocp_base" { + source = "../.." + cluster_name = local.cluster_name + resource_group_id = module.resource_group.resource_group_id + region = var.region + ocp_version = var.ocp_version + ocp_entitlement = var.ocp_entitlement + vpc_id = module.vpc.vpc_id + vpc_subnets = local.cluster_vpc_subnets + worker_pools = local.worker_pools + disable_outbound_traffic_protection = var.disable_outbound_traffic_protection + access_tags = var.access_tags + disable_public_endpoint = var.disable_public_endpoint + use_private_endpoint = true + cluster_config_endpoint_type = "default" +} diff --git a/solutions/quickstart/outputs.tf b/solutions/quickstart/outputs.tf new file mode 100644 index 00000000..1bf93ced --- /dev/null +++ b/solutions/quickstart/outputs.tf @@ -0,0 +1,58 @@ +######################################################################################################################## +# Outputs +######################################################################################################################## + +output "cluster_name" { + value = module.ocp_base.cluster_name + description = "The name of the provisioned OpenShift cluster." +} + +output "cluster_id" { + value = module.ocp_base.cluster_id + description = "The unique identifier assigned to the provisioned OpenShift cluster." +} + +output "cluster_crn" { + description = "The Cloud Resource Name (CRN) of the provisioned OpenShift cluster." + value = module.ocp_base.cluster_crn +} + +output "vpc_name" { + description = "The name of the Virtual Private Cloud (VPC) in which the cluster is deployed." + value = module.vpc.vpc_name +} + +output "vpc_id" { + description = "The ID of the Virtual Private Cloud (VPC) in which the cluster is deployed." + value = module.ocp_base.vpc_id +} + +output "region" { + description = "The IBM Cloud region where the cluster is deployed." + value = module.ocp_base.region +} + +output "cos_crn" { + description = "The Cloud Resource Name (CRN) of the Object Storage instance associated with the cluster." + value = module.ocp_base.cos_crn +} + +output "resource_group_id" { + description = "The ID of the resource group where the cluster is deployed." + value = module.ocp_base.resource_group_id +} + +output "public_service_endpoint_url" { + description = "The public service endpoint URL for accessing the cluster over the internet." + value = module.ocp_base.public_service_endpoint_url +} + +output "master_url" { + description = "The API endpoint URL for the Kubernetes master node of the cluster." + value = module.ocp_base.master_url +} + +output "master_status" { + description = "The current status of the Kubernetes master node in the cluster." + value = module.ocp_base.master_status +} diff --git a/solutions/quickstart/provider.tf b/solutions/quickstart/provider.tf new file mode 100644 index 00000000..146dea97 --- /dev/null +++ b/solutions/quickstart/provider.tf @@ -0,0 +1,6 @@ +provider "ibm" { + ibmcloud_api_key = var.ibmcloud_api_key + region = var.region + visibility = var.provider_visibility + private_endpoint_type = (var.provider_visibility == "private" && var.region == "ca-mon") ? "vpe" : null +} diff --git a/solutions/quickstart/variables.tf b/solutions/quickstart/variables.tf new file mode 100644 index 00000000..558c4fca --- /dev/null +++ b/solutions/quickstart/variables.tf @@ -0,0 +1,104 @@ + +variable "ibmcloud_api_key" { + type = string + description = "The IBM Cloud API key." + sensitive = true +} + +variable "existing_resource_group_name" { + type = string + description = "The name of an existing resource group to provision the resources. If not provided the default resource group will be used." + default = null +} + +variable "provider_visibility" { + description = "Set the visibility value for the IBM terraform provider. [Learn more](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/guides/custom-service-endpoints)." + type = string + default = "private" + + validation { + condition = contains(["public", "private", "public-and-private"], var.provider_visibility) + error_message = "Invalid visibility option. Allowed values are 'public', 'private', or 'public-and-private'." + } +} + +variable "prefix" { + type = string + description = "The prefix to be added to all resources created by this solution. To skip using a prefix, set this value to null or an empty string. The prefix must begin with a lowercase letter and may contain only lowercase letters, digits, and hyphens '-'. It should not exceed 16 characters, must not end with a hyphen('-'), and cannot contain consecutive hyphens ('--'). Example: `prod-0205-ocpqs`. [Learn more](https://terraform-ibm-modules.github.io/documentation/#/prefix.md)." + nullable = true + validation { + condition = (var.prefix == null || var.prefix == "" ? true : + alltrue([ + can(regex("^[a-z][-a-z0-9]*[a-z0-9]$", var.prefix)), + length(regexall("--", var.prefix)) == 0 + ]) + ) + error_message = "Prefix must begin with a lowercase letter and may contain only lowercase letters, digits, and hyphens '-'. It must not end with a hyphen('-'), and cannot contain consecutive hyphens ('--')." + } + validation { + condition = var.prefix == null || var.prefix == "" ? true : length(var.prefix) <= 16 + error_message = "Prefix must not exceed 16 characters." + } +} + +variable "region" { + type = string + description = "Region in which all the resources will be deployed. [Learn More](https://terraform-ibm-modules.github.io/documentation/#/region)." + default = "us-south" +} + +variable "ocp_version" { + type = string + description = "Version of the OpenShift cluster to provision." + default = null +} + +variable "cluster_name" { + type = string + description = "The name of the new IBM Cloud OpenShift Cluster. If a `prefix` input variable is specified, it is added to this name in the `-value` format." + default = "openshift-qs" +} + + +variable "address_prefix" { + description = "The IP range that defines a certain location for the VPC. Use only with manual address prefixes." + type = string + default = "10.10.10.0/24" +} + +variable "ocp_entitlement" { + type = string + description = "Value that is applied to the entitlements for OCP cluster provisioning." + default = null +} + + +variable "default_worker_pool_operating_system" { + type = string + description = "The operating system installed on the worker nodes. [Learn more](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-flavors)." + default = "RHEL_9_64" +} + +variable "access_tags" { + type = list(string) + description = "A list of access tags to apply to the resources created by the module." + default = [] +} + +variable "size" { + type = string + description = "Defines the cluster size configuration. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/blob/main/solutions/quickstart/DA_docs.md)." + default = "mini" +} + +variable "disable_public_endpoint" { + type = bool + description = "Disables the public endpoint, which allows internet access to the cluster, during creation only." + default = false +} + +variable "disable_outbound_traffic_protection" { + type = bool + description = "Whether to allow public outbound access from the cluster workers. This is only applicable for OCP 4.15 and later. [Learn more](https://cloud.ibm.com/docs/openshift?topic=openshift-sbd-allow-outbound)." + default = true +} diff --git a/solutions/quickstart/version.tf b/solutions/quickstart/version.tf new file mode 100644 index 00000000..deba0ac1 --- /dev/null +++ b/solutions/quickstart/version.tf @@ -0,0 +1,11 @@ +terraform { + required_version = ">=1.9.0" + + # Lock DA into an exact provider version - renovate automation will keep it updated + required_providers { + ibm = { + source = "IBM-Cloud/ibm" + version = "1.80.3" + } + } +} diff --git a/tests/other_test.go b/tests/other_test.go index 29f70bb9..7431e22f 100644 --- a/tests/other_test.go +++ b/tests/other_test.go @@ -10,7 +10,6 @@ import ( "github.com/terraform-ibm-modules/ibmcloud-terratest-wrapper/testschematic" ) -const resourceGroup = "geretain-test-base-ocp-vpc" const advancedExampleDir = "examples/advanced" const basicExampleDir = "examples/basic" const fscloudExampleDir = "examples/fscloud" diff --git a/tests/pr_test.go b/tests/pr_test.go index e547dd32..907aba76 100644 --- a/tests/pr_test.go +++ b/tests/pr_test.go @@ -23,6 +23,8 @@ import ( const fullyConfigurableTerraformDir = "solutions/fully-configurable" const customsgExampleDir = "examples/custom_sg" +const quickStartTerraformDir = "solutions/quickstart" +const resourceGroup = "geretain-test-base-ocp-vpc" // Define a struct with fields that match the structure of the YAML data const yamlLocation = "../common-dev-assets/common-go-assets/common-permanent-resources.yaml" @@ -83,6 +85,34 @@ func setupTerraform(t *testing.T, prefix, realTerraformDir string) *terraform.Op return existingTerraformOptions } +func setupQuickstartOptions(t *testing.T, prefix string) *testschematic.TestSchematicOptions { + apiKey := validateEnvVariable(t, "TF_VAR_ibmcloud_api_key") + region, err := testhelper.GetBestVpcRegion(apiKey, "../common-dev-assets/common-go-assets/cloudinfo-region-vpc-gen2-prefs.yaml", "eu-de") + require.NoError(t, err, "Failed to get best VPC region") + options := testschematic.TestSchematicOptionsDefault(&testschematic.TestSchematicOptions{ + Testing: t, + Prefix: prefix, + ResourceGroup: resourceGroup, + Region: region, + TarIncludePatterns: []string{ + "*.tf", + quickStartTerraformDir + "/*.tf", "scripts/*.sh", "kubeconfig/README.md", + }, + TemplateFolder: quickStartTerraformDir, + Tags: []string{"test-schematic"}, + DeleteWorkspaceOnFail: false, + WaitJobCompleteMinutes: 360, + }) + options.TerraformVars = []testschematic.TestSchematicTerraformVar{ + {Name: "ibmcloud_api_key", Value: options.RequiredEnvironmentVars["TF_VAR_ibmcloud_api_key"], DataType: "string", Secure: true}, + {Name: "prefix", Value: options.Prefix, DataType: "string"}, + {Name: "region", Value: region, DataType: "string"}, + {Name: "existing_resource_group_name", Value: resourceGroup, DataType: "string"}, + {Name: "size", Value: "mini", DataType: "string"}, + {Name: "ocp_entitlement", Value: "cloud_pak", DataType: "string"}, + } + return options +} func cleanupTerraform(t *testing.T, options *terraform.Options, prefix string) { if t.Failed() && strings.ToLower(os.Getenv("DO_NOT_DESTROY_ON_FAILURE")) == "true" { @@ -192,3 +222,25 @@ func TestRunCustomsgExample(t *testing.T) { assert.Nil(t, err, "This should not have errored") assert.NotNil(t, output, "Expected some output") } + +/******************************************************************* +* TESTS FOR THE TERRAFORM BASED QUICKSTART DEPLOYABLE ARCHITECTURE * +********************************************************************/ +func TestRunQuickstartSchematics(t *testing.T) { + t.Parallel() + + options := setupQuickstartOptions(t, "ocp-qs") + err := options.RunSchematicTest() + assert.Nil(t, err, "This should not have errored") +} + +// Upgrade test for the Quickstart DA +func TestRunQuickstartUpgradeSchematics(t *testing.T) { + t.Parallel() + + options := setupQuickstartOptions(t, "ocp-qs-upg") + err := options.RunSchematicUpgradeTest() + if !options.UpgradeTestSkipped { + assert.Nil(t, err, "This should not have errored") + } +}