From 93e8bdb54ceab1b140fe7cf75430f79337c059cb Mon Sep 17 00:00:00 2001 From: Arya Girish K Date: Tue, 12 Aug 2025 13:29:01 +0530 Subject: [PATCH 01/27] fix: Address ROKS DA E2E walkthrough feedback --- ibm_catalog.json | 13 +++++++------ .../deployable-architecture-ocp-cluster.svg | 2 +- 2 files changed, 8 insertions(+), 7 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index 74bf74db..048bc568 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -16,7 +16,8 @@ "terraform", "ocp", "cluster", - "red_hat_openshift" + "red_hat_openshift", + "ROKS" ], "short_description": "Automates the deployment of Red Hat OpenShift container platform on IBM Cloud with optional integration of security and logging services.", "long_description": "The Cloud automation for Red Hat OpenShift Container Platform on VPC enables a scalable and flexible cloud environment for containerized applications with seamless integration to other security and observability services. This architecture can be deployed independently while also serving as a foundational deployable architecture for other architectures like [Cloud automation for Red Hat OpenShift AI](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-ocp-ai-ba708aed-bb8a-4ac0-83a7-53a066701db5-global) to deploy mission critical applications and AI-driven initiatives to market quickly and securely with a managed OpenShift service.\n\nℹ️ This Terraform-based automation is part of a broader suite of IBM-maintained Infrastructure as Code (IaC) assets, each following the naming pattern \"Cloud automation for *servicename*\" and focusing on single IBM Cloud service. These single-service deployable architectures can be used on their own to streamline and automate service deployments through an [IaC approach](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-understanding-projects), or assembled together into a broader [automated IaC stack](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-config-stack) to automate the deployment of an end-to-end solution architecture.", @@ -807,7 +808,7 @@ "dependencies": [ { "name": "deploy-arch-ibm-vpc", - "description": "Configure the VPC instance and subnets where the OpenShift cluster will be deployed. ", + "description": "Configure the VPC instance and subnets where the OpenShift cluster will be deployed. If not enabled, you must provide an existing VPC, if any. ", "id": "2af61763-f8ef-4527-a815-b92166f29bc8-global", "version": "v7.24.0", "flavors": [ @@ -850,7 +851,7 @@ }, { "name": "deploy-arch-ibm-account-infra-base", - "description": "Cloud automation for Account Configuration organizes your IBM Cloud account with a ready-made set of resource groups by default and, when you enable the \"with Account Settings\" option, it also applies baseline security and governance settings. ", + "description": "Cloud automation for Account Configuration creates resource groups by default and, if \"with Account Settings\" is enabled, it applies baseline security and governance settings that impact cluster placement and access controls. ", "catalog_id": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3", "flavors": [ "resource-group-only", @@ -875,9 +876,9 @@ }, { "name": "deploy-arch-ibm-kms", - "description": "Enable Cloud Automation for Key Protect when you want services to use your own managed encryption keys. If disabled, it will fall back on IBM Cloud's default service-managed encryption. ", + "description": "Enable Cloud Automation for Key Protect when you want the cluster to use your own managed encryption keys. If disabled, it will fall back on IBM Cloud's default service-managed encryption. ", "id": "2cad4789-fa90-4886-9c9e-857081c273ee-global", - "version": "v5.1.4", + "version": "v5.1.19", "flavors": [ "fully-configurable" ], @@ -964,7 +965,7 @@ }, { "name": "deploy-arch-ibm-secrets-manager", - "description": "Configure Secrets Manager instance for centrally managing Ingress subdomain certificates and other secrets. ", + "description": "Configure Secrets Manager instance for centrally managing Ingress subdomain certificates and other secrets for the cluster. ", "id": "6d6ebc76-7bbd-42f5-8bc7-78f4fabd5944-global", "version": "v2.4.0", "flavors": [ diff --git a/reference-architecture/deployable-architecture-ocp-cluster.svg b/reference-architecture/deployable-architecture-ocp-cluster.svg index 2c9a3c33..53c44bbc 100644 --- a/reference-architecture/deployable-architecture-ocp-cluster.svg +++ b/reference-architecture/deployable-architecture-ocp-cluster.svg @@ -1,4 +1,4 @@ -
ACL
ACL
IBM Cloud
IBM Cloud
Region
RegionCloud logs
Observability
Observabil...
[Optional]
[Option...Cloud MonitoringSecrets ManagerRegistry Bucket
[Optional] Cloud Object Storage 
[Optional] Cloud Object Storage 
[Optional] KMS
[Optional] KMS
Key Ring
Key Ring   Key for Registry BucketResource GroupVPC
Zone 3
Zone 3OpenShift
Zone 2
Zone 2
Zone 1
Zone 1Worker NodeWorker Node
Worker Pool
Worker PoolText is not SVG - cannot display \ No newline at end of file +
ACL
locked
IBM Cloud
Region
Cloud logs
Observability
[Optional]
Cloud MonitoringSecrets ManagerRegistry Bucket
[Optional] Cloud Object Storage 
[Optional] Key Protect
Key Ring
   Key for Registry BucketResource GroupVPC
Zone 3
OpenShift
Zone 2
Zone 1
Worker NodeWorker Node
Worker Pool
 \ No newline at end of file From f44216078b4ac3b2cea7ac29f39e957d6ea3726d Mon Sep 17 00:00:00 2001 From: Arya Girish K Date: Tue, 12 Aug 2025 15:03:43 +0530 Subject: [PATCH 02/27] update version --- ibm_catalog.json | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index 048bc568..01c94954 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -9,8 +9,7 @@ "target_terraform", "terraform", "solution", - "containers", - "converged_infra" + "containers" ], "keywords": [ "terraform", @@ -872,7 +871,7 @@ ], "optional": true, "on_by_default": false, - "version": "v3.0.7" + "version": "v3.0.22" }, { "name": "deploy-arch-ibm-kms", @@ -910,7 +909,7 @@ "name": "deploy-arch-ibm-cos", "description": "Set up a Cloud Object Storage (COS) instance, where an object storage bucket will be created and used as the internal registry storage for OpenShift cluster. ", "id": "68921490-2778-4930-ac6d-bae7be6cd958-global", - "version": "v9.0.2", + "version": "v10.2.1", "flavors": [ "instance" ], @@ -938,7 +937,7 @@ "name": "deploy-arch-ibm-observability", "description": "Configure IBM Cloud Logs, Cloud Monitoring and Activity Tracker event routing for analysing logs and metrics generated by the OpenShift cluster. ", "id": "a3137d28-79e0-479d-8a24-758ebd5a0eab-global", - "version": "v3.0.3", + "version": "v3.1.3", "flavors": [ "instances" ], @@ -967,7 +966,7 @@ "name": "deploy-arch-ibm-secrets-manager", "description": "Configure Secrets Manager instance for centrally managing Ingress subdomain certificates and other secrets for the cluster. ", "id": "6d6ebc76-7bbd-42f5-8bc7-78f4fabd5944-global", - "version": "v2.4.0", + "version": "v2.7.5", "flavors": [ "fully-configurable" ], From bae4699f46422e2a96a1101ebd32d5ea3bdf967a Mon Sep 17 00:00:00 2001 From: Arya Girish K Date: Mon, 18 Aug 2025 18:25:13 +0530 Subject: [PATCH 03/27] Addressed review comments --- ibm_catalog.json | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index 01c94954..74a5a378 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -9,7 +9,8 @@ "target_terraform", "terraform", "solution", - "containers" + "containers", + "converged_infra" ], "keywords": [ "terraform", @@ -807,14 +808,14 @@ "dependencies": [ { "name": "deploy-arch-ibm-vpc", - "description": "Configure the VPC instance and subnets where the OpenShift cluster will be deployed. If not enabled, you must provide an existing VPC, if any. ", + "description": "Configure the VPC instance and subnets where the OpenShift cluster will be deployed.", "id": "2af61763-f8ef-4527-a815-b92166f29bc8-global", "version": "v7.24.0", "flavors": [ "fully-configurable" ], "catalog_id": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3", - "optional": true, + "optional": false, "on_by_default": true, "input_mapping": [ { @@ -850,7 +851,7 @@ }, { "name": "deploy-arch-ibm-account-infra-base", - "description": "Cloud automation for Account Configuration creates resource groups by default and, if \"with Account Settings\" is enabled, it applies baseline security and governance settings that impact cluster placement and access controls. ", + "description": "Creates default resource groups and applies security and governance settings that influence cluster placement and access controls.", "catalog_id": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3", "flavors": [ "resource-group-only", @@ -871,13 +872,13 @@ ], "optional": true, "on_by_default": false, - "version": "v3.0.22" + "version": "v3.0.7" }, { "name": "deploy-arch-ibm-kms", - "description": "Enable Cloud Automation for Key Protect when you want the cluster to use your own managed encryption keys. If disabled, it will fall back on IBM Cloud's default service-managed encryption. ", + "description": "Enables the cluster to use your own managed encryption keys. If disabled, it will fall back on IBM Cloud's default service-managed encryption. ", "id": "2cad4789-fa90-4886-9c9e-857081c273ee-global", - "version": "v5.1.19", + "version": "v5.1.4", "flavors": [ "fully-configurable" ], @@ -909,7 +910,7 @@ "name": "deploy-arch-ibm-cos", "description": "Set up a Cloud Object Storage (COS) instance, where an object storage bucket will be created and used as the internal registry storage for OpenShift cluster. ", "id": "68921490-2778-4930-ac6d-bae7be6cd958-global", - "version": "v10.2.1", + "version": "v9.0.2", "flavors": [ "instance" ], @@ -935,9 +936,9 @@ }, { "name": "deploy-arch-ibm-observability", - "description": "Configure IBM Cloud Logs, Cloud Monitoring and Activity Tracker event routing for analysing logs and metrics generated by the OpenShift cluster. ", + "description": "Enables provisioning and configuration of IBM Cloud Logs to collect, route, and analyze OpenShift cluster and platform logs and events—including those from Event Notifications—for enhanced visibility and troubleshooting.", "id": "a3137d28-79e0-479d-8a24-758ebd5a0eab-global", - "version": "v3.1.3", + "version": "v3.0.3", "flavors": [ "instances" ], From ab918825be1faca8768a913d0cbd251d8413a3c6 Mon Sep 17 00:00:00 2001 From: Arya Girish K Date: Mon, 18 Aug 2025 18:26:42 +0530 Subject: [PATCH 04/27] Reverted vversion --- ibm_catalog.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index 74a5a378..7fda9142 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -967,7 +967,7 @@ "name": "deploy-arch-ibm-secrets-manager", "description": "Configure Secrets Manager instance for centrally managing Ingress subdomain certificates and other secrets for the cluster. ", "id": "6d6ebc76-7bbd-42f5-8bc7-78f4fabd5944-global", - "version": "v2.7.5", + "version": "v2.4.0", "flavors": [ "fully-configurable" ], From 3c85667299b583ae400d8ac225dd060e51c960d0 Mon Sep 17 00:00:00 2001 From: Arya Girish K Date: Mon, 18 Aug 2025 22:10:12 +0530 Subject: [PATCH 05/27] Update ibm_catalog.json Co-authored-by: Shikha Maheshwari --- ibm_catalog.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index 7fda9142..d4575cfe 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -808,7 +808,7 @@ "dependencies": [ { "name": "deploy-arch-ibm-vpc", - "description": "Configure the VPC instance and subnets where the OpenShift cluster will be deployed.", + "description": "Configure the VPC and subnets to deploy the OpenShift cluster.", "id": "2af61763-f8ef-4527-a815-b92166f29bc8-global", "version": "v7.24.0", "flavors": [ From a83882f6ada4e45beeb75f54f0c0bba0f62eed51 Mon Sep 17 00:00:00 2001 From: Arya Girish K Date: Mon, 18 Aug 2025 22:12:31 +0530 Subject: [PATCH 06/27] Update ibm_catalog.json Co-authored-by: Shikha Maheshwari --- ibm_catalog.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index d4575cfe..b1beb011 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -851,7 +851,7 @@ }, { "name": "deploy-arch-ibm-account-infra-base", - "description": "Creates default resource groups and applies security and governance settings that influence cluster placement and access controls.", + "description": "Creates a set of resource groups and when \"with Account Settings\" variation is selected, it also applies baseline security and governance settings." "catalog_id": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3", "flavors": [ "resource-group-only", From 7aee5e24f444bf242c6c65291e12d741d7ca9f76 Mon Sep 17 00:00:00 2001 From: Arya Girish K Date: Mon, 18 Aug 2025 22:12:57 +0530 Subject: [PATCH 07/27] Update ibm_catalog.json Co-authored-by: Shikha Maheshwari --- ibm_catalog.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index b1beb011..481e7486 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -876,7 +876,7 @@ }, { "name": "deploy-arch-ibm-kms", - "description": "Enables the cluster to use your own managed encryption keys. If disabled, it will fall back on IBM Cloud's default service-managed encryption. ", + "description": "Configure Key Protect to use your own managed encryption keys for Object Storage bucket.", "id": "2cad4789-fa90-4886-9c9e-857081c273ee-global", "version": "v5.1.4", "flavors": [ From 12d4c1e3f9d89430f32df15b092d8d7eeefbc3f1 Mon Sep 17 00:00:00 2001 From: Arya Girish K Date: Tue, 19 Aug 2025 10:06:55 +0530 Subject: [PATCH 08/27] Addressing Review comments --- ibm_catalog.json | 101 +++++++++++++++++++++++++++++++++-------------- 1 file changed, 72 insertions(+), 29 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index 481e7486..3d54ef0d 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -81,74 +81,110 @@ }, "iam_permissions": [ { - "service_name": "containers-kubernetes", "role_crns": [ - "crn:v1:bluemix:public:iam::::serviceRole:Manager", + "crn:v1:bluemix:public:iam::::role:Viewer" + ], + "service_name": "Resource group only", + "notes":"Viewer access is required in the resource group you want to provision in." + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::role:Administrator" + ], + "service_name": "All Account Management services", + "notes": "[Optional] Required for consuming Account Configuration deployable architecture which creates resource group." + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::role:Administrator" + ], + "service_name": "All Identity and Access enabled services", + "notes": "[Optional] Required for consuming Account Configuration deployable architecture which creates resource group with account settings." + }, + { + "role_crns": [ "crn:v1:bluemix:public:iam::::role:Editor" ], - "notes": "Required to create and edit OpenShift cluster and the related resources." + "service_name": "iam-access-groups", + "notes": "[optional] Required for managing IAM access groups." }, { "service_name": "iam-identity", "role_crns": [ - "crn:v1:bluemix:public:iam::::role:Administrator", + "crn:v1:bluemix:public:iam::::role:Operator", "crn:v1:bluemix:public:iam-identity::::serviceRole:UserApiKeyCreator" ], - "notes": "Required to create the containers-kubernetes-key needed by the OpenShift cluster on IBM Cloud." + "notes": "Required to create the containers-kubernetes-key needed by the OpenShift cluster on IBM Cloud and for managing and operating resources within the IBM Cloud environment." }, { - "service_name": "is.vpc", "role_crns": [ - "crn:v1:bluemix:public:iam::::role:Administrator" + "crn:v1:bluemix:public:iam::::serviceRole:Manager", + "crn:v1:bluemix:public:iam::::role:Editor" ], - "notes": "Required for creating Virtual Private Cloud(VPC)." + "service_name": "hs-crypto", + "notes": "[Optional] Required if KMS encryption is enabled and Hyper Protect Crypto Service is used for encryption." }, { - "service_name": "cloud-object-storage", "role_crns": [ "crn:v1:bluemix:public:iam::::serviceRole:Manager", "crn:v1:bluemix:public:iam::::role:Editor" ], - "notes": "Required to create Cloud Object Storage (COS) Instance." + "service_name": "kms", + "notes": "[Optional] Required if KMS encryption is enabled and Key Protect Service is used for encryption." }, { - "service_name": "hs-crypto", "role_crns": [ "crn:v1:bluemix:public:iam::::serviceRole:Manager", "crn:v1:bluemix:public:iam::::role:Editor" ], - "notes": "[Optional] Required if KMS encryption is enabled and IBM Hyper Protect Crypto Services is used to encrypt the Kubernetes Secrets and Object Storage bucket." + "service_name": "cloud-object-storage", + "notes": "[Optional] Required to edit data and manage the OpenShift cluster's internal registry storage bucket." }, { - "service_name": "kms", + "service_name": "containers-kubernetes", "role_crns": [ "crn:v1:bluemix:public:iam::::serviceRole:Manager", + "crn:v1:bluemix:public:iam::::role:Administrator" + ], + "notes": "Required to reset API keys, create and edit the OpenShift cluster, and manage all related resources." + }, + { + "service_name": "is.vpc", + "role_crns": [ "crn:v1:bluemix:public:iam::::role:Editor" ], - "notes": "[Optional] Required if KMS encryption is enabled and Key protect is used for encryption of Kubernetes Secrets and Object Storage bucket." + "notes": "[Optional] Required for creating Virtual Private Cloud(VPC)." + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::role:Administrator", + "crn:v1:bluemix:public:iam::::serviceRole:Manager" + ], + "service_name": "secrets-manager", + "notes": "[Optional] Required for creating a Secrets Manager instance. 'Manager' access is required to create new secret groups." }, { - "service_name": "sysdig-monitor", "role_crns": [ "crn:v1:bluemix:public:iam::::serviceRole:Manager", - "crn:v1:bluemix:public:iam::::role:Editor" + "crn:v1:bluemix:public:iam::::role:Administrator" ], - "notes": "[Optional] Required if you are consuming Observability deployable architecture which sets up Cloud monitoring." + "service_name": "sysdig-monitor", + "notes": "[Optional] Required for consuming Observability deployable architecture, which sets up Cloud Monitoring." }, { - "service_name": "logs", "role_crns": [ "crn:v1:bluemix:public:iam::::serviceRole:Manager", "crn:v1:bluemix:public:iam::::role:Editor" ], - "notes": "[Optional] Required if you are consuming Observability deployable architecture which sets up Cloud logs." + "service_name": "logs", + "notes": "[Optional] Required for consuming Observability DA, which sets up Cloud logs." }, { "service_name": "logs-router", "role_crns": [ "crn:v1:bluemix:public:iam::::serviceRole:Manager" ], - "notes": "[Optional] Required if you are consuming Observability deployable architecture which sets up Logs Routing." + "notes": "[Optional] Required for consuming Observability deployable architecture, which sets up Logs Routing." }, { "service_name": "atracker", @@ -156,15 +192,22 @@ "crn:v1:bluemix:public:iam::::serviceRole:Writer", "crn:v1:bluemix:public:iam::::role:Editor" ], - "notes": "[Optional] Required if you are consuming Observability deployable architecture which sets up Activity Tracker Event Routing." + "notes": "[Optional] Required for consuming Observability deployable architecture, which sets up Activity Tracker Event Routing." }, { - "service_name": "secrets-manager", + "service_name": "metrics-router", "role_crns": [ - "crn:v1:bluemix:public:iam::::role:Administrator", - "crn:v1:bluemix:public:iam::::serviceRole:Manager" + "crn:v1:bluemix:public:iam::::role:Administrator" + ], + "notes": "[Optional] Required if metrics routing to cloud monitoring instance is enabled." + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::serviceRole:Manager", + "crn:v1:bluemix:public:iam::::role:Administrator" ], - "notes": "[Optional] Required for creating an Secrets Manager instance. 'Manager' access required to create new secret groups." + "service_name": "event-notifications", + "notes": "[Optional] Required if you are creating an Event Notifications Instance" } ], "architecture": { @@ -808,7 +851,7 @@ "dependencies": [ { "name": "deploy-arch-ibm-vpc", - "description": "Configure the VPC and subnets to deploy the OpenShift cluster.", + "description": "Configure the VPC and subnets to deploy the OpenShift cluster. ", "id": "2af61763-f8ef-4527-a815-b92166f29bc8-global", "version": "v7.24.0", "flavors": [ @@ -851,7 +894,7 @@ }, { "name": "deploy-arch-ibm-account-infra-base", - "description": "Creates a set of resource groups and when \"with Account Settings\" variation is selected, it also applies baseline security and governance settings." + "description": "Creates a set of resource groups and when \"with Account Settings\" variation is selected, it also applies baseline security and governance settings. ", "catalog_id": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3", "flavors": [ "resource-group-only", @@ -876,7 +919,7 @@ }, { "name": "deploy-arch-ibm-kms", - "description": "Configure Key Protect to use your own managed encryption keys for Object Storage bucket.", + "description": "Configure Key Protect to use your own managed encryption keys for Object Storage bucket. ", "id": "2cad4789-fa90-4886-9c9e-857081c273ee-global", "version": "v5.1.4", "flavors": [ @@ -936,7 +979,7 @@ }, { "name": "deploy-arch-ibm-observability", - "description": "Enables provisioning and configuration of IBM Cloud Logs to collect, route, and analyze OpenShift cluster and platform logs and events—including those from Event Notifications—for enhanced visibility and troubleshooting.", + "description": "Configure IBM Cloud Logs, Cloud Monitoring and Activity Tracker event routing for analysing logs and metrics generated by the OpenShift cluster. ", "id": "a3137d28-79e0-479d-8a24-758ebd5a0eab-global", "version": "v3.0.3", "flavors": [ From 8e80ae31204a9c345f6e40361b2313cf4946fa0a Mon Sep 17 00:00:00 2001 From: Arya Girish K Date: Tue, 19 Aug 2025 10:36:44 +0530 Subject: [PATCH 09/27] Updated description --- ibm_catalog.json | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index 3d54ef0d..860bb462 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -851,7 +851,7 @@ "dependencies": [ { "name": "deploy-arch-ibm-vpc", - "description": "Configure the VPC and subnets to deploy the OpenShift cluster. ", + "description": "Configure the VPC and subnets to deploy the OpenShift cluster.", "id": "2af61763-f8ef-4527-a815-b92166f29bc8-global", "version": "v7.24.0", "flavors": [ @@ -894,7 +894,7 @@ }, { "name": "deploy-arch-ibm-account-infra-base", - "description": "Creates a set of resource groups and when \"with Account Settings\" variation is selected, it also applies baseline security and governance settings. ", + "description": "Creates a set of resource groups and when \"with Account Settings\" variation is selected, it also applies baseline security and governance settings.", "catalog_id": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3", "flavors": [ "resource-group-only", @@ -919,7 +919,7 @@ }, { "name": "deploy-arch-ibm-kms", - "description": "Configure Key Protect to use your own managed encryption keys for Object Storage bucket. ", + "description": "Configure Key Protect to use your own managed encryption keys for Object Storage bucket.", "id": "2cad4789-fa90-4886-9c9e-857081c273ee-global", "version": "v5.1.4", "flavors": [ @@ -951,7 +951,7 @@ }, { "name": "deploy-arch-ibm-cos", - "description": "Set up a Cloud Object Storage (COS) instance, where an object storage bucket will be created and used as the internal registry storage for OpenShift cluster. ", + "description": "Set up a Cloud Object Storage (COS) instance, where an object storage bucket will be created and used as the internal registry storage for OpenShift cluster.", "id": "68921490-2778-4930-ac6d-bae7be6cd958-global", "version": "v9.0.2", "flavors": [ @@ -979,7 +979,7 @@ }, { "name": "deploy-arch-ibm-observability", - "description": "Configure IBM Cloud Logs, Cloud Monitoring and Activity Tracker event routing for analysing logs and metrics generated by the OpenShift cluster. ", + "description": "Configure IBM Cloud Logs, Cloud Monitoring and Activity Tracker event routing for analysing logs and metrics generated by the OpenShift cluster.", "id": "a3137d28-79e0-479d-8a24-758ebd5a0eab-global", "version": "v3.0.3", "flavors": [ @@ -1008,7 +1008,7 @@ }, { "name": "deploy-arch-ibm-secrets-manager", - "description": "Configure Secrets Manager instance for centrally managing Ingress subdomain certificates and other secrets for the cluster. ", + "description": "Configure Secrets Manager instance for centrally managing Ingress subdomain certificates and other secrets for the cluster.", "id": "6d6ebc76-7bbd-42f5-8bc7-78f4fabd5944-global", "version": "v2.4.0", "flavors": [ @@ -1112,7 +1112,7 @@ "url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/refs/heads/main/reference-architecture/deployable-architecture-ocp-cluster-qs.svg", "type": "image/svg+xml" }, - "description": "This QuickStart variation of deployable architecture enables deployment of a Red Hat OpenShift cluster within an IBM Cloud Virtual Private Cloud (VPC). It provisions the OpenShift cluster and its foundational VPC infrastructure with a limited set of essential options for rapid and streamlined setup. Additionally, the deployment creates an Object Storage bucket that serves as the internal container image registry for the OpenShift cluster. Thus, it helps ensure seamless storage integration.

Users can select from predefined cluster sizes — mini (default), small, medium, and large. Each size determining the number of availability zones, worker nodes per zone, and the machine type (worker node flavor). [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/blob/main/solutions/quickstart/DA_docs.md).

By default, the architecture provisions a two-zone VPC, forming the foundation for the OpenShift cluster. The cluster comprises a single worker pool distributed across these zones, with two worker nodes per zone in the mini configuration.

This streamlined architecture balances ease of use with flexibility, enabling rapid OpenShift cluster deployments with the infrastructure, integrated storage services, and right-sized compute resources of IBM Cloud." + "description": "This QuickStart variation of deployable architecture enables deployment of a Red Hat OpenShift cluster within an IBM Cloud Virtual Private Cloud (VPC). It provisions the OpenShift cluster and its foundational VPC infrastructure with a limited set of essential options for rapid and streamlined setup. Additionally, the deployment creates an Object Storage bucket that serves as the internal container image registry for the OpenShift cluster. Thus, it helps ensure seamless storage integration.

Users can select from predefined cluster sizes — mini (default), small, medium, and large. Each size determines the number of availability zones, worker nodes per zone, and the machine type (worker node flavor). [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/blob/main/solutions/quickstart/DA_docs.md).

By default, the architecture provisions a two-zone VPC, forming the foundation for the OpenShift cluster. The cluster comprises a single worker pool distributed across these zones, with two worker nodes per zone in the mini configuration.

This streamlined architecture balances ease of use with flexibility, enabling rapid OpenShift cluster deployments with the infrastructure, integrated storage services, and right-sized compute resources of IBM Cloud." } ] }, From 9f219001461415ebbac8d14cfc2dd7ba32d080ad Mon Sep 17 00:00:00 2001 From: Arya Girish K Date: Wed, 20 Aug 2025 09:46:15 +0530 Subject: [PATCH 10/27] Addressed Review comments --- ibm_catalog.json | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index 860bb462..e79b2ebe 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -894,7 +894,7 @@ }, { "name": "deploy-arch-ibm-account-infra-base", - "description": "Creates a set of resource groups and when \"with Account Settings\" variation is selected, it also applies baseline security and governance settings.", + "description": "Creates a set of pre-configured resource groups in your IBM Cloud account, when you enable \"with Account Settings\" option which applies baseline security and governance controls automatically.", "catalog_id": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3", "flavors": [ "resource-group-only", @@ -919,7 +919,7 @@ }, { "name": "deploy-arch-ibm-kms", - "description": "Configure Key Protect to use your own managed encryption keys for Object Storage bucket.", + "description": "Configures Key Protect to manage and use encryption keys for COS bucket.", "id": "2cad4789-fa90-4886-9c9e-857081c273ee-global", "version": "v5.1.4", "flavors": [ @@ -951,7 +951,7 @@ }, { "name": "deploy-arch-ibm-cos", - "description": "Set up a Cloud Object Storage (COS) instance, where an object storage bucket will be created and used as the internal registry storage for OpenShift cluster.", + "description": "Sets up a Cloud Object Storage (COS) instance by creating an object storage bucket which is used as and internal registry storage for the Red Hat OpenShift cluster.", "id": "68921490-2778-4930-ac6d-bae7be6cd958-global", "version": "v9.0.2", "flavors": [ @@ -979,7 +979,7 @@ }, { "name": "deploy-arch-ibm-observability", - "description": "Configure IBM Cloud Logs, Cloud Monitoring and Activity Tracker event routing for analysing logs and metrics generated by the OpenShift cluster.", + "description": "Configures IBM Cloud Logs, Cloud Monitoring and Activity Tracker event routing for analysing logs and metrics generated by the OpenShift cluster.", "id": "a3137d28-79e0-479d-8a24-758ebd5a0eab-global", "version": "v3.0.3", "flavors": [ @@ -1008,7 +1008,7 @@ }, { "name": "deploy-arch-ibm-secrets-manager", - "description": "Configure Secrets Manager instance for centrally managing Ingress subdomain certificates and other secrets for the cluster.", + "description": "Configures Secrets Manager instance for centrally managing Ingress subdomain certificates and other secrets for the cluster.", "id": "6d6ebc76-7bbd-42f5-8bc7-78f4fabd5944-global", "version": "v2.4.0", "flavors": [ From d4518c44612d69c6e72b65a792be180717a68865 Mon Sep 17 00:00:00 2001 From: Arya Girish K Date: Wed, 20 Aug 2025 12:33:07 +0530 Subject: [PATCH 11/27] Updated diagram --- .../deployable-architecture-ocp-cluster-qs.svg | 2 +- reference-architecture/deployable-architecture-ocp-cluster.svg | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/reference-architecture/deployable-architecture-ocp-cluster-qs.svg b/reference-architecture/deployable-architecture-ocp-cluster-qs.svg index fdbad4f2..d41b91e9 100644 --- a/reference-architecture/deployable-architecture-ocp-cluster-qs.svg +++ b/reference-architecture/deployable-architecture-ocp-cluster-qs.svg @@ -1,4 +1,4 @@ -
ACL
locked
IBM Cloud
Region
Resource GroupVPC
Worker node
Openshift
Zone 3
Zone 2
Zone 1
Subnet
Worker Node
Worker Pool
Registry Bucket
           Cloud Object Storage 
 \ No newline at end of file +
ACL
locked
IBM Cloud
Region
Resource GroupVPC
Worker node
Openshift
Zone 3
Zone 2
Zone 1
Subnet
Worker Node
Worker Pool
Registry Bucket
           Object Storage 
 \ No newline at end of file diff --git a/reference-architecture/deployable-architecture-ocp-cluster.svg b/reference-architecture/deployable-architecture-ocp-cluster.svg index 53c44bbc..004bcee1 100644 --- a/reference-architecture/deployable-architecture-ocp-cluster.svg +++ b/reference-architecture/deployable-architecture-ocp-cluster.svg @@ -1,4 +1,4 @@ -
ACL
locked
IBM Cloud
Region
Cloud logs
Observability
[Optional]
Cloud MonitoringSecrets ManagerRegistry Bucket
[Optional] Cloud Object Storage 
[Optional] Key Protect
Key Ring
   Key for Registry BucketResource GroupVPC
Zone 3
OpenShift
Zone 2
Zone 1
Worker NodeWorker Node
Worker Pool
 \ No newline at end of file +
ACL
locked
IBM Cloud
Region
Cloud logs
Observability
[Optional]
Cloud MonitoringSecrets ManagerRegistry Bucket
              [Optional] Object Storage 
[Optional] Key Protect
Key Ring
Encryption Key
Worker Node
VPC
Zone 3
Zone 2
Openshift
Zone 1
Worker Pool
Worker Node
Worker Node
Resource Group \ No newline at end of file From 3e8e6357042abfdb052c6585c88a7b6e460be76b Mon Sep 17 00:00:00 2001 From: Arya Girish K Date: Wed, 20 Aug 2025 13:10:05 +0530 Subject: [PATCH 12/27] Addressed review comments --- ibm_catalog.json | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index e79b2ebe..da61d405 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -224,7 +224,7 @@ "url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/refs/heads/main/reference-architecture/deployable-architecture-ocp-cluster.svg", "type": "image/svg+xml" }, - "description": "This architecture supports creation of Red Hat OpenShift cluster within a Virtual Private Cloud (VPC).

You can create a fully-configured VPC by selecting the [Cloud automation for VPC](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-vpc-2af61763-f8ef-4527-a815-b92166f29bc8-global) dependency or you can use an existing VPC if any. The VPC can be provisioned either in a single-zone or multi-zone configuration, depending on your availability requirements. By default, the VPC addon provisions a three-zone VPC, forming the foundation for your OpenShift cluster. This cluster includes a single worker pool distributed across all three zones, with two worker nodes per zone. If you need additional worker pools, you can easily configure them using the additional_worker_pools variable.

A Cloud Object Storage (COS) instance is required for this topology. Within this instance, an Object Storage bucket will be created, which serves as the internal registry storage for the OpenShift cluster. The [Cloud automation for Object Storage](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-cos-68921490-2778-4930-ac6d-bae7be6cd958-global) architecture supports the creation of COS instance. Additionally, the storage bucket can be encrypted using Key Management Services(KMS) to enhance security.

For logging and monitoring needs, you can enable Observability for your cluster. [Cloud automation for Observability](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-observability-a3137d28-79e0-479d-8a24-758ebd5a0eab-global) provides advanced monitoring, logging, and operational insights into the performance and health of your deployment.

Secrets Manager Integration can also be enabled using [Cloud automation for Secrets Manager](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/dep[…]bm-secrets-manager-6d6ebc76-7bbd-42f5-8bc7-78f4fabd5944-global) for centrally managing Ingress subdomain certificates, ensuring secure management of sensitive credentials.

This architecture provides a robust and secure foundation for deploying and managing your Red Hat OpenShift cluster, enabling seamless integration, enhanced security, and comprehensive monitoring for your cloud-native applications." + "description": "This architecture supports creation of Red Hat OpenShift cluster within a Virtual Private Cloud (VPC).

You can create a fully-configured VPC by selecting the [Cloud automation for VPC](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-vpc-2af61763-f8ef-4527-a815-b92166f29bc8-global) dependency or you can use an existing VPC if any. The VPC can be provisioned either in a single-zone or multi-zone configuration, depending on your availability requirements. By default, the VPC addon provisions a three-zone VPC, forming the foundation for your OpenShift cluster. This cluster includes a single worker pool distributed across all three zones, with two worker nodes per zone. If you need additional worker pools, you can easily configure them using the additional_worker_pools variable.

A Cloud Object Storage (COS) instance is required for this topology. Within this instance, an Object Storage bucket will be created, which serves as the internal registry storage for the OpenShift cluster. The [Cloud automation for Object Storage](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-cos-68921490-2778-4930-ac6d-bae7be6cd958-global) architecture supports the creation of COS instance. Additionally, Key Management Services(KMS) is used to encrypt the cluster and the boot volumes used by the cluster to enhance security.

For logging and monitoring needs, you can enable Observability for your cluster. [Cloud automation for Observability](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-observability-a3137d28-79e0-479d-8a24-758ebd5a0eab-global) provides advanced monitoring, logging, and operational insights into the performance and health of your deployment.

Secrets Manager Integration can also be enabled using [Cloud automation for Secrets Manager](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/dep[…]bm-secrets-manager-6d6ebc76-7bbd-42f5-8bc7-78f4fabd5944-global) for centrally managing Ingress subdomain certificates, ensuring secure management of sensitive credentials.

This architecture provides a robust and secure foundation for deploying and managing your Red Hat OpenShift cluster, enabling seamless integration, enhanced security, and comprehensive monitoring for your cloud-native applications." } ] }, @@ -894,7 +894,7 @@ }, { "name": "deploy-arch-ibm-account-infra-base", - "description": "Creates a set of pre-configured resource groups in your IBM Cloud account, when you enable \"with Account Settings\" option which applies baseline security and governance controls automatically.", + "description": "Creates a set of pre-configured resource groups in your IBM Cloud account. It applies baseline security and governance controls when you enable \"with Account Settings\" option.", "catalog_id": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3", "flavors": [ "resource-group-only", @@ -919,7 +919,7 @@ }, { "name": "deploy-arch-ibm-kms", - "description": "Configures Key Protect to manage and use encryption keys for COS bucket.", + "description": "Configures Key Protect to manage and use encryption keys to secure the cluster and its boot volumes.", "id": "2cad4789-fa90-4886-9c9e-857081c273ee-global", "version": "v5.1.4", "flavors": [ @@ -951,7 +951,7 @@ }, { "name": "deploy-arch-ibm-cos", - "description": "Sets up a Cloud Object Storage (COS) instance by creating an object storage bucket which is used as and internal registry storage for the Red Hat OpenShift cluster.", + "description": "Sets up a Cloud Object Storage (COS) instance which is used as and internal registry storage for the Red Hat OpenShift cluster.", "id": "68921490-2778-4930-ac6d-bae7be6cd958-global", "version": "v9.0.2", "flavors": [ @@ -1112,7 +1112,7 @@ "url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/refs/heads/main/reference-architecture/deployable-architecture-ocp-cluster-qs.svg", "type": "image/svg+xml" }, - "description": "This QuickStart variation of deployable architecture enables deployment of a Red Hat OpenShift cluster within an IBM Cloud Virtual Private Cloud (VPC). It provisions the OpenShift cluster and its foundational VPC infrastructure with a limited set of essential options for rapid and streamlined setup. Additionally, the deployment creates an Object Storage bucket that serves as the internal container image registry for the OpenShift cluster. Thus, it helps ensure seamless storage integration.

Users can select from predefined cluster sizes — mini (default), small, medium, and large. Each size determines the number of availability zones, worker nodes per zone, and the machine type (worker node flavor). [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/blob/main/solutions/quickstart/DA_docs.md).

By default, the architecture provisions a two-zone VPC, forming the foundation for the OpenShift cluster. The cluster comprises a single worker pool distributed across these zones, with two worker nodes per zone in the mini configuration.

This streamlined architecture balances ease of use with flexibility, enabling rapid OpenShift cluster deployments with the infrastructure, integrated storage services, and right-sized compute resources of IBM Cloud." + "description": "This deployable architecture enables deployment of a Red Hat OpenShift cluster within an IBM Cloud Virtual Private Cloud (VPC). It provisions the OpenShift cluster and its foundational VPC infrastructure with a limited set of essential options for rapid and streamlined setup. Additionally, the deployment creates an Object Storage bucket that serves as the internal container image registry for the OpenShift cluster. Thus, it helps ensure seamless storage integration.

Users can select from predefined cluster sizes — mini (default), small, medium, and large. Each size determines the number of availability zones, worker nodes per zone, and the machine type (worker node flavor). [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/blob/main/solutions/quickstart/DA_docs.md).

By default, the architecture provisions a two-zone VPC, forming the foundation for the OpenShift cluster. The cluster comprises a single worker pool distributed across these zones, with two worker nodes per zone in the mini configuration.

This streamlined architecture balances ease of use with flexibility, enabling rapid OpenShift cluster deployments with the infrastructure, integrated storage services, and right-sized compute resources of IBM Cloud." } ] }, From 24a3c844e830390834370550047efabe518d371e Mon Sep 17 00:00:00 2001 From: Arya Girish K Date: Wed, 20 Aug 2025 13:59:25 +0530 Subject: [PATCH 13/27] Updated catalog --- ibm_catalog.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index da61d405..ba80cb59 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -114,7 +114,7 @@ "crn:v1:bluemix:public:iam::::role:Operator", "crn:v1:bluemix:public:iam-identity::::serviceRole:UserApiKeyCreator" ], - "notes": "Required to create the containers-kubernetes-key needed by the OpenShift cluster on IBM Cloud and for managing and operating resources within the IBM Cloud environment." + "notes": "Required to create the containers-kubernetes-key for the OpenShift cluster and to manage resources within the IBM Cloud environment." }, { "role_crns": [ @@ -177,7 +177,7 @@ "crn:v1:bluemix:public:iam::::role:Editor" ], "service_name": "logs", - "notes": "[Optional] Required for consuming Observability DA, which sets up Cloud logs." + "notes": "[Optional] Required for consuming Observability deployable architecture, which sets up Cloud logs." }, { "service_name": "logs-router", @@ -207,7 +207,7 @@ "crn:v1:bluemix:public:iam::::role:Administrator" ], "service_name": "event-notifications", - "notes": "[Optional] Required if you are creating an Event Notifications Instance" + "notes": "[Optional] Required if you are creating an Event Notifications Instance." } ], "architecture": { From 9e63900911a9ce24c33d2a593733735080efcd31 Mon Sep 17 00:00:00 2001 From: Arya Girish K Date: Wed, 20 Aug 2025 15:10:20 +0530 Subject: [PATCH 14/27] Update ibm_catalog.json Co-authored-by: Shikha Maheshwari --- ibm_catalog.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index ba80cb59..5c11a48c 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -106,7 +106,7 @@ "crn:v1:bluemix:public:iam::::role:Editor" ], "service_name": "iam-access-groups", - "notes": "[optional] Required for managing IAM access groups." + "notes": "[Optional] Required for managing IAM access groups." }, { "service_name": "iam-identity", From 77346ebb9942b7ce9044d952707b804fe38a8e89 Mon Sep 17 00:00:00 2001 From: Arya Girish K Date: Wed, 20 Aug 2025 15:10:35 +0530 Subject: [PATCH 15/27] Update ibm_catalog.json Co-authored-by: Shikha Maheshwari --- ibm_catalog.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index 5c11a48c..6ecf66a2 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -207,7 +207,7 @@ "crn:v1:bluemix:public:iam::::role:Administrator" ], "service_name": "event-notifications", - "notes": "[Optional] Required if you are creating an Event Notifications Instance." + "notes": "[Optional] Required to create an instance of Event Notifications." } ], "architecture": { From d91e47d266d6699bcb9b5550cb30f93d11708cb8 Mon Sep 17 00:00:00 2001 From: Arya Girish K Date: Wed, 20 Aug 2025 15:10:45 +0530 Subject: [PATCH 16/27] Update ibm_catalog.json Co-authored-by: Shikha Maheshwari --- ibm_catalog.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index 6ecf66a2..bb174dcb 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -199,7 +199,7 @@ "role_crns": [ "crn:v1:bluemix:public:iam::::role:Administrator" ], - "notes": "[Optional] Required if metrics routing to cloud monitoring instance is enabled." + "notes": "[Optional] Required to enable metrics routing to the Cloud Monitoring." }, { "role_crns": [ From 4c66acf34d7794dda31327e161e40391b9a72187 Mon Sep 17 00:00:00 2001 From: Arya Girish K Date: Wed, 20 Aug 2025 15:10:55 +0530 Subject: [PATCH 17/27] Update ibm_catalog.json Co-authored-by: Shikha Maheshwari --- ibm_catalog.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index bb174dcb..e88ab661 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -153,7 +153,7 @@ "role_crns": [ "crn:v1:bluemix:public:iam::::role:Editor" ], - "notes": "[Optional] Required for creating Virtual Private Cloud(VPC)." + "notes": "Required to create Virtual Private Cloud (VPC)." }, { "role_crns": [ From 3a4aa66e58a8a6f8adb593ce6015f84e8b145ba4 Mon Sep 17 00:00:00 2001 From: Arya Girish K Date: Wed, 20 Aug 2025 15:11:03 +0530 Subject: [PATCH 18/27] Update ibm_catalog.json Co-authored-by: Shikha Maheshwari --- ibm_catalog.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index e88ab661..19388808 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -114,7 +114,7 @@ "crn:v1:bluemix:public:iam::::role:Operator", "crn:v1:bluemix:public:iam-identity::::serviceRole:UserApiKeyCreator" ], - "notes": "Required to create the containers-kubernetes-key for the OpenShift cluster and to manage resources within the IBM Cloud environment." + "notes": "Required to create the containers-kubernetes-key for the OpenShift cluster." }, { "role_crns": [ From 8e5c0b37fd23bb39abbdcd5937571ac56944262b Mon Sep 17 00:00:00 2001 From: Arya Girish K Date: Wed, 20 Aug 2025 15:27:16 +0530 Subject: [PATCH 19/27] updated catalog --- ibm_catalog.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index 19388808..85334426 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -221,7 +221,7 @@ { "diagram": { "caption": "Red Hat OpenShift cluster topology", - "url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/refs/heads/main/reference-architecture/deployable-architecture-ocp-cluster.svg", + "url": "https://github.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/blob/issue-15542/reference-architecture/deployable-architecture-ocp-cluster.svg", "type": "image/svg+xml" }, "description": "This architecture supports creation of Red Hat OpenShift cluster within a Virtual Private Cloud (VPC).

You can create a fully-configured VPC by selecting the [Cloud automation for VPC](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-vpc-2af61763-f8ef-4527-a815-b92166f29bc8-global) dependency or you can use an existing VPC if any. The VPC can be provisioned either in a single-zone or multi-zone configuration, depending on your availability requirements. By default, the VPC addon provisions a three-zone VPC, forming the foundation for your OpenShift cluster. This cluster includes a single worker pool distributed across all three zones, with two worker nodes per zone. If you need additional worker pools, you can easily configure them using the additional_worker_pools variable.

A Cloud Object Storage (COS) instance is required for this topology. Within this instance, an Object Storage bucket will be created, which serves as the internal registry storage for the OpenShift cluster. The [Cloud automation for Object Storage](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-cos-68921490-2778-4930-ac6d-bae7be6cd958-global) architecture supports the creation of COS instance. Additionally, Key Management Services(KMS) is used to encrypt the cluster and the boot volumes used by the cluster to enhance security.

For logging and monitoring needs, you can enable Observability for your cluster. [Cloud automation for Observability](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-observability-a3137d28-79e0-479d-8a24-758ebd5a0eab-global) provides advanced monitoring, logging, and operational insights into the performance and health of your deployment.

Secrets Manager Integration can also be enabled using [Cloud automation for Secrets Manager](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/dep[…]bm-secrets-manager-6d6ebc76-7bbd-42f5-8bc7-78f4fabd5944-global) for centrally managing Ingress subdomain certificates, ensuring secure management of sensitive credentials.

This architecture provides a robust and secure foundation for deploying and managing your Red Hat OpenShift cluster, enabling seamless integration, enhanced security, and comprehensive monitoring for your cloud-native applications." @@ -1109,7 +1109,7 @@ { "diagram": { "caption": "Red Hat OpenShift cluster topology - Quickstart", - "url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/refs/heads/main/reference-architecture/deployable-architecture-ocp-cluster-qs.svg", + "url": "https://github.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/blob/issue-15542/reference-architecture/deployable-architecture-ocp-cluster-qs.svg", "type": "image/svg+xml" }, "description": "This deployable architecture enables deployment of a Red Hat OpenShift cluster within an IBM Cloud Virtual Private Cloud (VPC). It provisions the OpenShift cluster and its foundational VPC infrastructure with a limited set of essential options for rapid and streamlined setup. Additionally, the deployment creates an Object Storage bucket that serves as the internal container image registry for the OpenShift cluster. Thus, it helps ensure seamless storage integration.

Users can select from predefined cluster sizes — mini (default), small, medium, and large. Each size determines the number of availability zones, worker nodes per zone, and the machine type (worker node flavor). [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/blob/main/solutions/quickstart/DA_docs.md).

By default, the architecture provisions a two-zone VPC, forming the foundation for the OpenShift cluster. The cluster comprises a single worker pool distributed across these zones, with two worker nodes per zone in the mini configuration.

This streamlined architecture balances ease of use with flexibility, enabling rapid OpenShift cluster deployments with the infrastructure, integrated storage services, and right-sized compute resources of IBM Cloud." From 016ce8a3eee90390d6cc8bb4c8a9720fc802832d Mon Sep 17 00:00:00 2001 From: Arya Girish K Date: Wed, 20 Aug 2025 23:10:40 +0530 Subject: [PATCH 20/27] Addressed Review comments --- ibm_catalog.json | 43 ++++++++++++++++++++++--------------------- 1 file changed, 22 insertions(+), 21 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index 85334426..ee7b3f13 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -10,7 +10,8 @@ "terraform", "solution", "containers", - "converged_infra" + "converged_infra", + "redhat" ], "keywords": [ "terraform", @@ -92,14 +93,14 @@ "crn:v1:bluemix:public:iam::::role:Administrator" ], "service_name": "All Account Management services", - "notes": "[Optional] Required for consuming Account Configuration deployable architecture which creates resource group." + "notes": "[Optional] Required to create new resource groups when enabling the Account Configuration setting." }, { "role_crns": [ "crn:v1:bluemix:public:iam::::role:Administrator" ], "service_name": "All Identity and Access enabled services", - "notes": "[Optional] Required for consuming Account Configuration deployable architecture which creates resource group with account settings." + "notes": "[Optional] Required to create new resource groups when enabling the Account Configuration setting." }, { "role_crns": [ @@ -122,7 +123,7 @@ "crn:v1:bluemix:public:iam::::role:Editor" ], "service_name": "hs-crypto", - "notes": "[Optional] Required if KMS encryption is enabled and Hyper Protect Crypto Service is used for encryption." + "notes": "[Optional] Required if Hyper Protect Crypto Service is used for encryption." }, { "role_crns": [ @@ -130,7 +131,7 @@ "crn:v1:bluemix:public:iam::::role:Editor" ], "service_name": "kms", - "notes": "[Optional] Required if KMS encryption is enabled and Key Protect Service is used for encryption." + "notes": "[Optional] [Optional] Required if Key Protect is used for encryption." }, { "role_crns": [ @@ -138,7 +139,7 @@ "crn:v1:bluemix:public:iam::::role:Editor" ], "service_name": "cloud-object-storage", - "notes": "[Optional] Required to edit data and manage the OpenShift cluster's internal registry storage bucket." + "notes": "Required to manage Object storage bucket for the cluster internal registry." }, { "service_name": "containers-kubernetes", @@ -146,14 +147,14 @@ "crn:v1:bluemix:public:iam::::serviceRole:Manager", "crn:v1:bluemix:public:iam::::role:Administrator" ], - "notes": "Required to reset API keys, create and edit the OpenShift cluster, and manage all related resources." + "notes": "Required to create and manage the Openshift cluster." }, { "service_name": "is.vpc", "role_crns": [ "crn:v1:bluemix:public:iam::::role:Editor" ], - "notes": "Required to create Virtual Private Cloud (VPC)." + "notes": "Required to create VPC." }, { "role_crns": [ @@ -161,7 +162,7 @@ "crn:v1:bluemix:public:iam::::serviceRole:Manager" ], "service_name": "secrets-manager", - "notes": "[Optional] Required for creating a Secrets Manager instance. 'Manager' access is required to create new secret groups." + "notes": "[Optional] Required when enabling the Secrets Manager integration." }, { "role_crns": [ @@ -169,7 +170,7 @@ "crn:v1:bluemix:public:iam::::role:Administrator" ], "service_name": "sysdig-monitor", - "notes": "[Optional] Required for consuming Observability deployable architecture, which sets up Cloud Monitoring." + "notes": "[Optional] Required to create an instance of Cloud Monitoring." }, { "role_crns": [ @@ -177,14 +178,14 @@ "crn:v1:bluemix:public:iam::::role:Editor" ], "service_name": "logs", - "notes": "[Optional] Required for consuming Observability deployable architecture, which sets up Cloud logs." + "notes": "[Optional] Required to create an instance of Cloud logs." }, { "service_name": "logs-router", "role_crns": [ "crn:v1:bluemix:public:iam::::serviceRole:Manager" ], - "notes": "[Optional] Required for consuming Observability deployable architecture, which sets up Logs Routing." + "notes": "[Optional] Required to create an instance of Logs Routing." }, { "service_name": "atracker", @@ -192,7 +193,7 @@ "crn:v1:bluemix:public:iam::::serviceRole:Writer", "crn:v1:bluemix:public:iam::::role:Editor" ], - "notes": "[Optional] Required for consuming Observability deployable architecture, which sets up Activity Tracker Event Routing." + "notes": "[Optional] Required when enabling the Activity Tracker Event Routing." }, { "service_name": "metrics-router", @@ -221,10 +222,10 @@ { "diagram": { "caption": "Red Hat OpenShift cluster topology", - "url": "https://github.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/blob/issue-15542/reference-architecture/deployable-architecture-ocp-cluster.svg", + "url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/refs/heads/main/reference-architecture/deployable-architecture-ocp-cluster.svg", "type": "image/svg+xml" }, - "description": "This architecture supports creation of Red Hat OpenShift cluster within a Virtual Private Cloud (VPC).

You can create a fully-configured VPC by selecting the [Cloud automation for VPC](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-vpc-2af61763-f8ef-4527-a815-b92166f29bc8-global) dependency or you can use an existing VPC if any. The VPC can be provisioned either in a single-zone or multi-zone configuration, depending on your availability requirements. By default, the VPC addon provisions a three-zone VPC, forming the foundation for your OpenShift cluster. This cluster includes a single worker pool distributed across all three zones, with two worker nodes per zone. If you need additional worker pools, you can easily configure them using the additional_worker_pools variable.

A Cloud Object Storage (COS) instance is required for this topology. Within this instance, an Object Storage bucket will be created, which serves as the internal registry storage for the OpenShift cluster. The [Cloud automation for Object Storage](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-cos-68921490-2778-4930-ac6d-bae7be6cd958-global) architecture supports the creation of COS instance. Additionally, Key Management Services(KMS) is used to encrypt the cluster and the boot volumes used by the cluster to enhance security.

For logging and monitoring needs, you can enable Observability for your cluster. [Cloud automation for Observability](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-observability-a3137d28-79e0-479d-8a24-758ebd5a0eab-global) provides advanced monitoring, logging, and operational insights into the performance and health of your deployment.

Secrets Manager Integration can also be enabled using [Cloud automation for Secrets Manager](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/dep[…]bm-secrets-manager-6d6ebc76-7bbd-42f5-8bc7-78f4fabd5944-global) for centrally managing Ingress subdomain certificates, ensuring secure management of sensitive credentials.

This architecture provides a robust and secure foundation for deploying and managing your Red Hat OpenShift cluster, enabling seamless integration, enhanced security, and comprehensive monitoring for your cloud-native applications." + "description": "This architecture supports creation of Red Hat OpenShift cluster within a Virtual Private Cloud (VPC).

You can create a fully-configured VPC by selecting the [Cloud automation for VPC](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-vpc-2af61763-f8ef-4527-a815-b92166f29bc8-global) dependency or you can use an existing VPC if any. The VPC can be provisioned either in a single-zone or multi-zone configuration, depending on your availability requirements. By default, the VPC addon provisions a three-zone VPC, forming the foundation for your OpenShift cluster. This cluster includes a single worker pool distributed across all three zones, with two worker nodes per zone. If you need additional worker pools, you can easily configure them using the additional_worker_pools variable.

A Cloud Object Storage (COS) instance is required for this topology. Within this instance, an Object Storage bucket will be created, which serves as the internal registry storage for the OpenShift cluster. The [Cloud automation for Object Storage](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-cos-68921490-2778-4930-ac6d-bae7be6cd958-global) architecture supports the creation of COS instance. Additionally, Key Management Services(KMS) is used to encrypt the cluster and the boot volumes used by the cluster to enhance security.

For logging and monitoring needs, you can enable Observability for your cluster. [Cloud automation for Observability](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-observability-a3137d28-79e0-479d-8a24-758ebd5a0eab-global) provides advanced monitoring, logging, and operational insights into the performance and health of your deployment.

Secrets Manager Integration can also be enabled using [Cloud automation for Secrets Manager](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-secrets-manager-6d6ebc76-7bbd-42f5-8bc7-78f4fabd5944-global) for centrally managing Ingress subdomain certificates, ensuring secure management of sensitive credentials.

This architecture provides a robust and secure foundation for deploying and managing your Red Hat OpenShift cluster, enabling seamless integration, enhanced security, and comprehensive monitoring for your cloud-native applications." } ] }, @@ -894,7 +895,7 @@ }, { "name": "deploy-arch-ibm-account-infra-base", - "description": "Creates a set of pre-configured resource groups in your IBM Cloud account. It applies baseline security and governance controls when you enable \"with Account Settings\" option.", + "description": "Organize your IBM Cloud account with preconfigured resource groups. If not selected, the default group is used. Optionally, expand to apply recommended security settings via \"with Account Settings\".", "catalog_id": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3", "flavors": [ "resource-group-only", @@ -919,7 +920,7 @@ }, { "name": "deploy-arch-ibm-kms", - "description": "Configures Key Protect to manage and use encryption keys to secure the cluster and its boot volumes.", + "description": "Enables managed encryption with your own keys via IBM Cloud Key Protect. If disabled, services will default to IBM-managed encryption.", "id": "2cad4789-fa90-4886-9c9e-857081c273ee-global", "version": "v5.1.4", "flavors": [ @@ -951,7 +952,7 @@ }, { "name": "deploy-arch-ibm-cos", - "description": "Sets up a Cloud Object Storage (COS) instance which is used as and internal registry storage for the Red Hat OpenShift cluster.", + "description": "Sets up a Cloud Object Storage (COS) instance and bucket to serve as the internal registry storage for your OpenShift cluster.", "id": "68921490-2778-4930-ac6d-bae7be6cd958-global", "version": "v9.0.2", "flavors": [ @@ -979,7 +980,7 @@ }, { "name": "deploy-arch-ibm-observability", - "description": "Configures IBM Cloud Logs, Cloud Monitoring and Activity Tracker event routing for analysing logs and metrics generated by the OpenShift cluster.", + "description": "Sets up IBM Cloud Logs, Monitoring, and Activity Tracker routing to analyze metrics and logs from your OpenShift cluster.", "id": "a3137d28-79e0-479d-8a24-758ebd5a0eab-global", "version": "v3.0.3", "flavors": [ @@ -1008,7 +1009,7 @@ }, { "name": "deploy-arch-ibm-secrets-manager", - "description": "Configures Secrets Manager instance for centrally managing Ingress subdomain certificates and other secrets for the cluster.", + "description": "Provisions a Secrets Manager instance to centrally manage Ingress subdomain certificates and other sensitive credentials.", "id": "6d6ebc76-7bbd-42f5-8bc7-78f4fabd5944-global", "version": "v2.4.0", "flavors": [ @@ -1109,7 +1110,7 @@ { "diagram": { "caption": "Red Hat OpenShift cluster topology - Quickstart", - "url": "https://github.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/blob/issue-15542/reference-architecture/deployable-architecture-ocp-cluster-qs.svg", + "url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/refs/heads/main/reference-architecture/deployable-architecture-ocp-cluster-qs.svg", "type": "image/svg+xml" }, "description": "This deployable architecture enables deployment of a Red Hat OpenShift cluster within an IBM Cloud Virtual Private Cloud (VPC). It provisions the OpenShift cluster and its foundational VPC infrastructure with a limited set of essential options for rapid and streamlined setup. Additionally, the deployment creates an Object Storage bucket that serves as the internal container image registry for the OpenShift cluster. Thus, it helps ensure seamless storage integration.

Users can select from predefined cluster sizes — mini (default), small, medium, and large. Each size determines the number of availability zones, worker nodes per zone, and the machine type (worker node flavor). [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/blob/main/solutions/quickstart/DA_docs.md).

By default, the architecture provisions a two-zone VPC, forming the foundation for the OpenShift cluster. The cluster comprises a single worker pool distributed across these zones, with two worker nodes per zone in the mini configuration.

This streamlined architecture balances ease of use with flexibility, enabling rapid OpenShift cluster deployments with the infrastructure, integrated storage services, and right-sized compute resources of IBM Cloud." From 0ad0ef49744428345240bc319867d39ca1f02279 Mon Sep 17 00:00:00 2001 From: Arya Girish K Date: Wed, 20 Aug 2025 23:43:16 +0530 Subject: [PATCH 21/27] Update diagram --- reference-architecture/deployable-architecture-ocp-cluster.svg | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/reference-architecture/deployable-architecture-ocp-cluster.svg b/reference-architecture/deployable-architecture-ocp-cluster.svg index 004bcee1..144eb74f 100644 --- a/reference-architecture/deployable-architecture-ocp-cluster.svg +++ b/reference-architecture/deployable-architecture-ocp-cluster.svg @@ -1,4 +1,4 @@ -
ACL
locked
IBM Cloud
Region
Cloud logs
Observability
[Optional]
Cloud MonitoringSecrets ManagerRegistry Bucket
              [Optional] Object Storage 
[Optional] Key Protect
Key Ring
Encryption Key
Worker Node
VPC
Zone 3
Zone 2
Openshift
Zone 1
Worker Pool
Worker Node
Worker Node
Resource Group \ No newline at end of file +
ACL
locked
IBM Cloud
Region
Cloud logs
 Observability
 [Optional]
Cloud MonitoringRegistry Bucket
            [Optional] Object Storage 
[Optional] Key Protect
Key Ring
Encryption Keys
Worker Node
VPC
Zone 3
Zone 2
Openshift
Zone 1
Worker Pool
Worker Node
Worker Node
Resource GroupActivity Tracker Event Routing   Event NotificationSecrets Manager \ No newline at end of file From 6ff98710f9461289ae407142ca6e27d1afa5e623 Mon Sep 17 00:00:00 2001 From: Arya Girish K Date: Wed, 20 Aug 2025 23:59:23 +0530 Subject: [PATCH 22/27] Addressed review comments --- ibm_catalog.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index ee7b3f13..27ba68b1 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -10,14 +10,14 @@ "terraform", "solution", "containers", - "converged_infra", - "redhat" + "converged_infra" ], "keywords": [ "terraform", "ocp", "cluster", "red_hat_openshift", + "redhat", "ROKS" ], "short_description": "Automates the deployment of Red Hat OpenShift container platform on IBM Cloud with optional integration of security and logging services.", @@ -208,7 +208,7 @@ "crn:v1:bluemix:public:iam::::role:Administrator" ], "service_name": "event-notifications", - "notes": "[Optional] Required to create an instance of Event Notifications." + "notes": "[Optional] Required when enabling event notification integration." } ], "architecture": { From 804b6dd3179cd5dd46103ec91b22dc293c5af317 Mon Sep 17 00:00:00 2001 From: Arya Girish K Date: Thu, 21 Aug 2025 10:51:16 +0530 Subject: [PATCH 23/27] Update ibm_catalog.json Co-authored-by: Shikha Maheshwari --- ibm_catalog.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index 27ba68b1..8f7e7e1d 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -93,7 +93,7 @@ "crn:v1:bluemix:public:iam::::role:Administrator" ], "service_name": "All Account Management services", - "notes": "[Optional] Required to create new resource groups when enabling the Account Configuration setting." + "notes": "[Optional] Required to create new resource groups when enabling the Account Configuration integration." }, { "role_crns": [ From 81a360a11679627e860c64060f4eff071f8af795 Mon Sep 17 00:00:00 2001 From: Arya Girish K Date: Thu, 21 Aug 2025 10:51:31 +0530 Subject: [PATCH 24/27] Update ibm_catalog.json Co-authored-by: Shikha Maheshwari --- ibm_catalog.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index 8f7e7e1d..774ec16c 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -100,7 +100,7 @@ "crn:v1:bluemix:public:iam::::role:Administrator" ], "service_name": "All Identity and Access enabled services", - "notes": "[Optional] Required to create new resource groups when enabling the Account Configuration setting." + "notes": "[Optional] Required to create new resource groups with account settings when enabling the Account Configuration integration." }, { "role_crns": [ From 13def3a4921c07944fc96a35bee5d748e0c4d9c7 Mon Sep 17 00:00:00 2001 From: Arya Girish K Date: Thu, 21 Aug 2025 10:51:51 +0530 Subject: [PATCH 25/27] Update ibm_catalog.json Co-authored-by: Shikha Maheshwari --- ibm_catalog.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index 774ec16c..945b989d 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -208,7 +208,7 @@ "crn:v1:bluemix:public:iam::::role:Administrator" ], "service_name": "event-notifications", - "notes": "[Optional] Required when enabling event notification integration." + "notes": "[Optional] Required when enabling the Event Notifications integration." } ], "architecture": { From 6ec7276dcff84c43fcdd5bf391a703af48757a70 Mon Sep 17 00:00:00 2001 From: Arya Girish K Date: Thu, 21 Aug 2025 11:38:15 +0530 Subject: [PATCH 26/27] Addressed review comments --- ibm_catalog.json | 4 ++-- .../deployable-architecture-ocp-cluster-qs.svg | 2 +- .../deployable-architecture-ocp-cluster.svg | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index 945b989d..19398837 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -48,7 +48,7 @@ }, { "title": "KMS Encryption", - "description": "Optionally you can enable key management services(KMS) [encryption](https://cloud.ibm.com/docs/openshift?topic=openshift-encryption-secrets) of the Kubernetes Secrets and Object Storage bucket using either a newly created key or an existing one." + "description": "Optionally you can enable key management services(KMS) [encryption](https://cloud.ibm.com/docs/openshift?topic=openshift-encryption-setup&interface=ui) to encrypt the OpenShift cluster and its boot volumes. You can use either a newly created encryption key or an existing one." }, { "title": "Secrets Manager", @@ -895,7 +895,7 @@ }, { "name": "deploy-arch-ibm-account-infra-base", - "description": "Organize your IBM Cloud account with preconfigured resource groups. If not selected, the default group is used. Optionally, expand to apply recommended security settings via \"with Account Settings\".", + "description": "Organize your IBM Cloud account with preconfigured resource groups. If not selected, the default group is used via \"with Account Settings\" variation. Optionally, expand to apply recommended security controls.", "catalog_id": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3", "flavors": [ "resource-group-only", diff --git a/reference-architecture/deployable-architecture-ocp-cluster-qs.svg b/reference-architecture/deployable-architecture-ocp-cluster-qs.svg index d41b91e9..11c9d464 100644 --- a/reference-architecture/deployable-architecture-ocp-cluster-qs.svg +++ b/reference-architecture/deployable-architecture-ocp-cluster-qs.svg @@ -1,4 +1,4 @@ -
ACL
locked
IBM Cloud
Region
Resource GroupVPC
Worker node
Openshift
Zone 3
Zone 2
Zone 1
Subnet
Worker Node
Worker Pool
Registry Bucket
           Object Storage 
 \ No newline at end of file +
ACL
locked
IBM Cloud
Region
Resource GroupVPC
Worker node
OpenShift
Zone 3
Zone 2
Zone 1
Subnet
Worker Node
Worker Pool
Registry Bucket
           Object Storage 
 \ No newline at end of file diff --git a/reference-architecture/deployable-architecture-ocp-cluster.svg b/reference-architecture/deployable-architecture-ocp-cluster.svg index 144eb74f..0ec70c90 100644 --- a/reference-architecture/deployable-architecture-ocp-cluster.svg +++ b/reference-architecture/deployable-architecture-ocp-cluster.svg @@ -1,4 +1,4 @@ -
ACL
locked
IBM Cloud
Region
Cloud logs
 Observability
 [Optional]
Cloud MonitoringRegistry Bucket
            [Optional] Object Storage 
[Optional] Key Protect
Key Ring
Encryption Keys
Worker Node
VPC
Zone 3
Zone 2
Openshift
Zone 1
Worker Pool
Worker Node
Worker Node
Resource GroupActivity Tracker Event Routing   Event NotificationSecrets Manager \ No newline at end of file +
ACL
locked
IBM Cloud
Region
Cloud Logs
 Observability
 [Optional]
Cloud MonitoringRegistry Bucket
            [Optional] Object Storage 
[Optional] Key Protect
Key Ring
Encryption Keys
Worker Node
VPC
Zone 3
Zone 2
OpenShift
Zone 1
Worker Pool
Worker Node
Worker Node
Resource GroupActivity Tracker Event Routing   Event NotificationsSecrets Manager \ No newline at end of file From 327194469c4e6c5be6751ede27732950a3e3d963 Mon Sep 17 00:00:00 2001 From: Arya Girish K Date: Thu, 21 Aug 2025 12:06:30 +0530 Subject: [PATCH 27/27] Updated catalog --- ibm_catalog.json | 2 +- .../deployable-architecture-ocp-cluster-qs.svg | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index 19398837..a060b57f 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -895,7 +895,7 @@ }, { "name": "deploy-arch-ibm-account-infra-base", - "description": "Organize your IBM Cloud account with preconfigured resource groups. If not selected, the default group is used via \"with Account Settings\" variation. Optionally, expand to apply recommended security controls.", + "description": "Organize your IBM Cloud account with preconfigured resource groups. If not selected, the default resource group is used. Optionally, expand to apply recommended security controls via \"with Account Settings\" variation.", "catalog_id": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3", "flavors": [ "resource-group-only", diff --git a/reference-architecture/deployable-architecture-ocp-cluster-qs.svg b/reference-architecture/deployable-architecture-ocp-cluster-qs.svg index 11c9d464..bdd6901b 100644 --- a/reference-architecture/deployable-architecture-ocp-cluster-qs.svg +++ b/reference-architecture/deployable-architecture-ocp-cluster-qs.svg @@ -1,4 +1,4 @@ -
ACL
locked
IBM Cloud
Region
Resource GroupVPC
Worker node
OpenShift
Zone 3
Zone 2
Zone 1
Subnet
Worker Node
Worker Pool
Registry Bucket
           Object Storage 
 \ No newline at end of file +
ACL
locked
IBM Cloud
Region
Resource GroupVPC
Worker node
OpenShift
Zone 3
Zone 2
Zone 1
Subnet
Worker Node
Worker Pool
Registry Bucket
           Object Storage 
 \ No newline at end of file