diff --git a/ibm_catalog.json b/ibm_catalog.json
index 74bf74db..a060b57f 100644
--- a/ibm_catalog.json
+++ b/ibm_catalog.json
@@ -16,7 +16,9 @@
"terraform",
"ocp",
"cluster",
- "red_hat_openshift"
+ "red_hat_openshift",
+ "redhat",
+ "ROKS"
],
"short_description": "Automates the deployment of Red Hat OpenShift container platform on IBM Cloud with optional integration of security and logging services.",
"long_description": "The Cloud automation for Red Hat OpenShift Container Platform on VPC enables a scalable and flexible cloud environment for containerized applications with seamless integration to other security and observability services. This architecture can be deployed independently while also serving as a foundational deployable architecture for other architectures like [Cloud automation for Red Hat OpenShift AI](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-ocp-ai-ba708aed-bb8a-4ac0-83a7-53a066701db5-global) to deploy mission critical applications and AI-driven initiatives to market quickly and securely with a managed OpenShift service.\n\nℹ️ This Terraform-based automation is part of a broader suite of IBM-maintained Infrastructure as Code (IaC) assets, each following the naming pattern \"Cloud automation for *servicename*\" and focusing on single IBM Cloud service. These single-service deployable architectures can be used on their own to streamline and automate service deployments through an [IaC approach](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-understanding-projects), or assembled together into a broader [automated IaC stack](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-config-stack) to automate the deployment of an end-to-end solution architecture.",
@@ -46,7 +48,7 @@
},
{
"title": "KMS Encryption",
- "description": "Optionally you can enable key management services(KMS) [encryption](https://cloud.ibm.com/docs/openshift?topic=openshift-encryption-secrets) of the Kubernetes Secrets and Object Storage bucket using either a newly created key or an existing one."
+ "description": "Optionally you can enable key management services(KMS) [encryption](https://cloud.ibm.com/docs/openshift?topic=openshift-encryption-setup&interface=ui) to encrypt the OpenShift cluster and its boot volumes. You can use either a newly created encryption key or an existing one."
},
{
"title": "Secrets Manager",
@@ -80,74 +82,110 @@
},
"iam_permissions": [
{
- "service_name": "containers-kubernetes",
"role_crns": [
- "crn:v1:bluemix:public:iam::::serviceRole:Manager",
+ "crn:v1:bluemix:public:iam::::role:Viewer"
+ ],
+ "service_name": "Resource group only",
+ "notes":"Viewer access is required in the resource group you want to provision in."
+ },
+ {
+ "role_crns": [
+ "crn:v1:bluemix:public:iam::::role:Administrator"
+ ],
+ "service_name": "All Account Management services",
+ "notes": "[Optional] Required to create new resource groups when enabling the Account Configuration integration."
+ },
+ {
+ "role_crns": [
+ "crn:v1:bluemix:public:iam::::role:Administrator"
+ ],
+ "service_name": "All Identity and Access enabled services",
+ "notes": "[Optional] Required to create new resource groups with account settings when enabling the Account Configuration integration."
+ },
+ {
+ "role_crns": [
"crn:v1:bluemix:public:iam::::role:Editor"
],
- "notes": "Required to create and edit OpenShift cluster and the related resources."
+ "service_name": "iam-access-groups",
+ "notes": "[Optional] Required for managing IAM access groups."
},
{
"service_name": "iam-identity",
"role_crns": [
- "crn:v1:bluemix:public:iam::::role:Administrator",
+ "crn:v1:bluemix:public:iam::::role:Operator",
"crn:v1:bluemix:public:iam-identity::::serviceRole:UserApiKeyCreator"
],
- "notes": "Required to create the containers-kubernetes-key needed by the OpenShift cluster on IBM Cloud."
+ "notes": "Required to create the containers-kubernetes-key for the OpenShift cluster."
},
{
- "service_name": "is.vpc",
"role_crns": [
- "crn:v1:bluemix:public:iam::::role:Administrator"
+ "crn:v1:bluemix:public:iam::::serviceRole:Manager",
+ "crn:v1:bluemix:public:iam::::role:Editor"
],
- "notes": "Required for creating Virtual Private Cloud(VPC)."
+ "service_name": "hs-crypto",
+ "notes": "[Optional] Required if Hyper Protect Crypto Service is used for encryption."
},
{
- "service_name": "cloud-object-storage",
"role_crns": [
"crn:v1:bluemix:public:iam::::serviceRole:Manager",
"crn:v1:bluemix:public:iam::::role:Editor"
],
- "notes": "Required to create Cloud Object Storage (COS) Instance."
+ "service_name": "kms",
+ "notes": "[Optional] [Optional] Required if Key Protect is used for encryption."
},
{
- "service_name": "hs-crypto",
"role_crns": [
"crn:v1:bluemix:public:iam::::serviceRole:Manager",
"crn:v1:bluemix:public:iam::::role:Editor"
],
- "notes": "[Optional] Required if KMS encryption is enabled and IBM Hyper Protect Crypto Services is used to encrypt the Kubernetes Secrets and Object Storage bucket."
+ "service_name": "cloud-object-storage",
+ "notes": "Required to manage Object storage bucket for the cluster internal registry."
},
{
- "service_name": "kms",
+ "service_name": "containers-kubernetes",
"role_crns": [
"crn:v1:bluemix:public:iam::::serviceRole:Manager",
+ "crn:v1:bluemix:public:iam::::role:Administrator"
+ ],
+ "notes": "Required to create and manage the Openshift cluster."
+ },
+ {
+ "service_name": "is.vpc",
+ "role_crns": [
"crn:v1:bluemix:public:iam::::role:Editor"
],
- "notes": "[Optional] Required if KMS encryption is enabled and Key protect is used for encryption of Kubernetes Secrets and Object Storage bucket."
+ "notes": "Required to create VPC."
+ },
+ {
+ "role_crns": [
+ "crn:v1:bluemix:public:iam::::role:Administrator",
+ "crn:v1:bluemix:public:iam::::serviceRole:Manager"
+ ],
+ "service_name": "secrets-manager",
+ "notes": "[Optional] Required when enabling the Secrets Manager integration."
},
{
- "service_name": "sysdig-monitor",
"role_crns": [
"crn:v1:bluemix:public:iam::::serviceRole:Manager",
- "crn:v1:bluemix:public:iam::::role:Editor"
+ "crn:v1:bluemix:public:iam::::role:Administrator"
],
- "notes": "[Optional] Required if you are consuming Observability deployable architecture which sets up Cloud monitoring."
+ "service_name": "sysdig-monitor",
+ "notes": "[Optional] Required to create an instance of Cloud Monitoring."
},
{
- "service_name": "logs",
"role_crns": [
"crn:v1:bluemix:public:iam::::serviceRole:Manager",
"crn:v1:bluemix:public:iam::::role:Editor"
],
- "notes": "[Optional] Required if you are consuming Observability deployable architecture which sets up Cloud logs."
+ "service_name": "logs",
+ "notes": "[Optional] Required to create an instance of Cloud logs."
},
{
"service_name": "logs-router",
"role_crns": [
"crn:v1:bluemix:public:iam::::serviceRole:Manager"
],
- "notes": "[Optional] Required if you are consuming Observability deployable architecture which sets up Logs Routing."
+ "notes": "[Optional] Required to create an instance of Logs Routing."
},
{
"service_name": "atracker",
@@ -155,15 +193,22 @@
"crn:v1:bluemix:public:iam::::serviceRole:Writer",
"crn:v1:bluemix:public:iam::::role:Editor"
],
- "notes": "[Optional] Required if you are consuming Observability deployable architecture which sets up Activity Tracker Event Routing."
+ "notes": "[Optional] Required when enabling the Activity Tracker Event Routing."
},
{
- "service_name": "secrets-manager",
+ "service_name": "metrics-router",
"role_crns": [
- "crn:v1:bluemix:public:iam::::role:Administrator",
- "crn:v1:bluemix:public:iam::::serviceRole:Manager"
+ "crn:v1:bluemix:public:iam::::role:Administrator"
],
- "notes": "[Optional] Required for creating an Secrets Manager instance. 'Manager' access required to create new secret groups."
+ "notes": "[Optional] Required to enable metrics routing to the Cloud Monitoring."
+ },
+ {
+ "role_crns": [
+ "crn:v1:bluemix:public:iam::::serviceRole:Manager",
+ "crn:v1:bluemix:public:iam::::role:Administrator"
+ ],
+ "service_name": "event-notifications",
+ "notes": "[Optional] Required when enabling the Event Notifications integration."
}
],
"architecture": {
@@ -180,7 +225,7 @@
"url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/refs/heads/main/reference-architecture/deployable-architecture-ocp-cluster.svg",
"type": "image/svg+xml"
},
- "description": "This architecture supports creation of Red Hat OpenShift cluster within a Virtual Private Cloud (VPC).
You can create a fully-configured VPC by selecting the [Cloud automation for VPC](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-vpc-2af61763-f8ef-4527-a815-b92166f29bc8-global) dependency or you can use an existing VPC if any. The VPC can be provisioned either in a single-zone or multi-zone configuration, depending on your availability requirements. By default, the VPC addon provisions a three-zone VPC, forming the foundation for your OpenShift cluster. This cluster includes a single worker pool distributed across all three zones, with two worker nodes per zone. If you need additional worker pools, you can easily configure them using the additional_worker_pools variable.
A Cloud Object Storage (COS) instance is required for this topology. Within this instance, an Object Storage bucket will be created, which serves as the internal registry storage for the OpenShift cluster. The [Cloud automation for Object Storage](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-cos-68921490-2778-4930-ac6d-bae7be6cd958-global) architecture supports the creation of COS instance. Additionally, the storage bucket can be encrypted using Key Management Services(KMS) to enhance security.
For logging and monitoring needs, you can enable Observability for your cluster. [Cloud automation for Observability](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-observability-a3137d28-79e0-479d-8a24-758ebd5a0eab-global) provides advanced monitoring, logging, and operational insights into the performance and health of your deployment.
Secrets Manager Integration can also be enabled using [Cloud automation for Secrets Manager](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/dep[…]bm-secrets-manager-6d6ebc76-7bbd-42f5-8bc7-78f4fabd5944-global) for centrally managing Ingress subdomain certificates, ensuring secure management of sensitive credentials.
This architecture provides a robust and secure foundation for deploying and managing your Red Hat OpenShift cluster, enabling seamless integration, enhanced security, and comprehensive monitoring for your cloud-native applications."
+ "description": "This architecture supports creation of Red Hat OpenShift cluster within a Virtual Private Cloud (VPC).
You can create a fully-configured VPC by selecting the [Cloud automation for VPC](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-vpc-2af61763-f8ef-4527-a815-b92166f29bc8-global) dependency or you can use an existing VPC if any. The VPC can be provisioned either in a single-zone or multi-zone configuration, depending on your availability requirements. By default, the VPC addon provisions a three-zone VPC, forming the foundation for your OpenShift cluster. This cluster includes a single worker pool distributed across all three zones, with two worker nodes per zone. If you need additional worker pools, you can easily configure them using the additional_worker_pools variable.
A Cloud Object Storage (COS) instance is required for this topology. Within this instance, an Object Storage bucket will be created, which serves as the internal registry storage for the OpenShift cluster. The [Cloud automation for Object Storage](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-cos-68921490-2778-4930-ac6d-bae7be6cd958-global) architecture supports the creation of COS instance. Additionally, Key Management Services(KMS) is used to encrypt the cluster and the boot volumes used by the cluster to enhance security.
For logging and monitoring needs, you can enable Observability for your cluster. [Cloud automation for Observability](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-observability-a3137d28-79e0-479d-8a24-758ebd5a0eab-global) provides advanced monitoring, logging, and operational insights into the performance and health of your deployment.
Secrets Manager Integration can also be enabled using [Cloud automation for Secrets Manager](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-secrets-manager-6d6ebc76-7bbd-42f5-8bc7-78f4fabd5944-global) for centrally managing Ingress subdomain certificates, ensuring secure management of sensitive credentials.
This architecture provides a robust and secure foundation for deploying and managing your Red Hat OpenShift cluster, enabling seamless integration, enhanced security, and comprehensive monitoring for your cloud-native applications."
}
]
},
@@ -807,14 +852,14 @@
"dependencies": [
{
"name": "deploy-arch-ibm-vpc",
- "description": "Configure the VPC instance and subnets where the OpenShift cluster will be deployed. ",
+ "description": "Configure the VPC and subnets to deploy the OpenShift cluster.",
"id": "2af61763-f8ef-4527-a815-b92166f29bc8-global",
"version": "v7.24.0",
"flavors": [
"fully-configurable"
],
"catalog_id": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3",
- "optional": true,
+ "optional": false,
"on_by_default": true,
"input_mapping": [
{
@@ -850,7 +895,7 @@
},
{
"name": "deploy-arch-ibm-account-infra-base",
- "description": "Cloud automation for Account Configuration organizes your IBM Cloud account with a ready-made set of resource groups by default and, when you enable the \"with Account Settings\" option, it also applies baseline security and governance settings. ",
+ "description": "Organize your IBM Cloud account with preconfigured resource groups. If not selected, the default resource group is used. Optionally, expand to apply recommended security controls via \"with Account Settings\" variation.",
"catalog_id": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3",
"flavors": [
"resource-group-only",
@@ -875,7 +920,7 @@
},
{
"name": "deploy-arch-ibm-kms",
- "description": "Enable Cloud Automation for Key Protect when you want services to use your own managed encryption keys. If disabled, it will fall back on IBM Cloud's default service-managed encryption. ",
+ "description": "Enables managed encryption with your own keys via IBM Cloud Key Protect. If disabled, services will default to IBM-managed encryption.",
"id": "2cad4789-fa90-4886-9c9e-857081c273ee-global",
"version": "v5.1.4",
"flavors": [
@@ -907,7 +952,7 @@
},
{
"name": "deploy-arch-ibm-cos",
- "description": "Set up a Cloud Object Storage (COS) instance, where an object storage bucket will be created and used as the internal registry storage for OpenShift cluster. ",
+ "description": "Sets up a Cloud Object Storage (COS) instance and bucket to serve as the internal registry storage for your OpenShift cluster.",
"id": "68921490-2778-4930-ac6d-bae7be6cd958-global",
"version": "v9.0.2",
"flavors": [
@@ -935,7 +980,7 @@
},
{
"name": "deploy-arch-ibm-observability",
- "description": "Configure IBM Cloud Logs, Cloud Monitoring and Activity Tracker event routing for analysing logs and metrics generated by the OpenShift cluster. ",
+ "description": "Sets up IBM Cloud Logs, Monitoring, and Activity Tracker routing to analyze metrics and logs from your OpenShift cluster.",
"id": "a3137d28-79e0-479d-8a24-758ebd5a0eab-global",
"version": "v3.0.3",
"flavors": [
@@ -964,7 +1009,7 @@
},
{
"name": "deploy-arch-ibm-secrets-manager",
- "description": "Configure Secrets Manager instance for centrally managing Ingress subdomain certificates and other secrets. ",
+ "description": "Provisions a Secrets Manager instance to centrally manage Ingress subdomain certificates and other sensitive credentials.",
"id": "6d6ebc76-7bbd-42f5-8bc7-78f4fabd5944-global",
"version": "v2.4.0",
"flavors": [
@@ -1068,7 +1113,7 @@
"url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/refs/heads/main/reference-architecture/deployable-architecture-ocp-cluster-qs.svg",
"type": "image/svg+xml"
},
- "description": "This QuickStart variation of deployable architecture enables deployment of a Red Hat OpenShift cluster within an IBM Cloud Virtual Private Cloud (VPC). It provisions the OpenShift cluster and its foundational VPC infrastructure with a limited set of essential options for rapid and streamlined setup. Additionally, the deployment creates an Object Storage bucket that serves as the internal container image registry for the OpenShift cluster. Thus, it helps ensure seamless storage integration.
Users can select from predefined cluster sizes — mini (default), small, medium, and large. Each size determining the number of availability zones, worker nodes per zone, and the machine type (worker node flavor). [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/blob/main/solutions/quickstart/DA_docs.md).
By default, the architecture provisions a two-zone VPC, forming the foundation for the OpenShift cluster. The cluster comprises a single worker pool distributed across these zones, with two worker nodes per zone in the mini configuration.
This streamlined architecture balances ease of use with flexibility, enabling rapid OpenShift cluster deployments with the infrastructure, integrated storage services, and right-sized compute resources of IBM Cloud."
+ "description": "This deployable architecture enables deployment of a Red Hat OpenShift cluster within an IBM Cloud Virtual Private Cloud (VPC). It provisions the OpenShift cluster and its foundational VPC infrastructure with a limited set of essential options for rapid and streamlined setup. Additionally, the deployment creates an Object Storage bucket that serves as the internal container image registry for the OpenShift cluster. Thus, it helps ensure seamless storage integration.
Users can select from predefined cluster sizes — mini (default), small, medium, and large. Each size determines the number of availability zones, worker nodes per zone, and the machine type (worker node flavor). [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/blob/main/solutions/quickstart/DA_docs.md).
By default, the architecture provisions a two-zone VPC, forming the foundation for the OpenShift cluster. The cluster comprises a single worker pool distributed across these zones, with two worker nodes per zone in the mini configuration.
This streamlined architecture balances ease of use with flexibility, enabling rapid OpenShift cluster deployments with the infrastructure, integrated storage services, and right-sized compute resources of IBM Cloud."
}
]
},
diff --git a/reference-architecture/deployable-architecture-ocp-cluster-qs.svg b/reference-architecture/deployable-architecture-ocp-cluster-qs.svg
index fdbad4f2..bdd6901b 100644
--- a/reference-architecture/deployable-architecture-ocp-cluster-qs.svg
+++ b/reference-architecture/deployable-architecture-ocp-cluster-qs.svg
@@ -1,4 +1,4 @@
-
\ No newline at end of file
+
\ No newline at end of file
diff --git a/reference-architecture/deployable-architecture-ocp-cluster.svg b/reference-architecture/deployable-architecture-ocp-cluster.svg
index 2c9a3c33..0ec70c90 100644
--- a/reference-architecture/deployable-architecture-ocp-cluster.svg
+++ b/reference-architecture/deployable-architecture-ocp-cluster.svg
@@ -1,4 +1,4 @@
-
\ No newline at end of file
+
\ No newline at end of file