diff --git a/ibm_catalog.json b/ibm_catalog.json
index 022ca9c8..22515fe2 100644
--- a/ibm_catalog.json
+++ b/ibm_catalog.json
@@ -20,8 +20,8 @@
"redhat",
"ROKS"
],
- "short_description": "Automates the deployment of Red Hat OpenShift container platform on IBM Cloud with optional integration of security and logging services.",
- "long_description": "The Cloud automation for Red Hat OpenShift Container Platform on VPC enables a scalable and flexible cloud environment for containerized applications with seamless integration to other security and observability services. This architecture can be deployed independently while also serving as a foundational deployable architecture for other architectures like [Cloud automation for Red Hat OpenShift AI](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-ocp-ai-ba708aed-bb8a-4ac0-83a7-53a066701db5-global) to deploy mission critical applications and AI-driven initiatives to market quickly and securely with a managed OpenShift service.\n\nℹ️ This Terraform-based automation is part of a broader suite of IBM-maintained Infrastructure as Code (IaC) assets, each following the naming pattern \"Cloud automation for *servicename*\" and focusing on single IBM Cloud service. These single-service deployable architectures can be used on their own to streamline and automate service deployments through an [IaC approach](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-understanding-projects), or assembled together into a broader [automated IaC stack](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-config-stack) to automate the deployment of an end-to-end solution architecture.",
+ "short_description": "Automates the deployment of Red Hat OpenShift container platform on IBM Cloud with optional integration of security and logging services",
+ "long_description": "The [Cloud automation for Red Hat OpenShift Container Platform](https://www.ibm.com/products/openshift) on VPC enables a scalable and flexible cloud environment for containerized applications with seamless integration to other security and observability services. This architecture can be deployed independently while also serving as a foundational deployable architecture for other architectures like [Cloud automation for Red Hat OpenShift AI](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-ocp-ai-ba708aed-bb8a-4ac0-83a7-53a066701db5-global) to deploy mission critical applications and AI-driven initiatives to market quickly and securely with a managed OpenShift service.\n\nℹ️ This Terraform-based automation is part of a broader suite of IBM-maintained Infrastructure as Code (IaC) assets, each following the naming pattern \"Cloud automation for *servicename*\" and focusing on single IBM Cloud service. These single-service deployable architectures can be used on their own to streamline and automate service deployments through an [IaC approach](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-understanding-projects), or assembled together into a broader [automated IaC stack](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-config-stack) to automate the deployment of an end-to-end solution architecture.",
"offering_docs_url": "https://github.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/blob/main/README.md",
"offering_icon_url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/main/images/ocp_icon.svg",
"provider_name": "IBM",
@@ -68,7 +68,7 @@
{
"label": "Fully configurable",
"name": "fully-configurable",
- "index": 2,
+ "index": 1,
"install_type": "fullstack",
"working_directory": "solutions/fully-configurable",
"compliance": {
@@ -90,87 +90,73 @@
},
{
"role_crns": [
- "crn:v1:bluemix:public:iam::::role:Administrator"
+ "crn:v1:bluemix:public:iam::::role:Viewer"
],
- "service_name": "All Account Management services",
- "notes": "[Optional] Required to create new resource groups when enabling the Account Configuration integration."
+ "service_name": "All Identity and Access enabled services",
+ "notes": "[Optional] Required to view IAM-enabled resources across the account."
},
{
"role_crns": [
"crn:v1:bluemix:public:iam::::role:Administrator"
],
- "service_name": "All Identity and Access enabled services",
- "notes": "[Optional] Required to create new resource groups with account settings when enabling the Account Configuration integration."
+ "service_name": "All Account Management services",
+ "notes": "[Optional] Required to deploy Cloud automation for account configuration, which creates foundational IBM Cloud account resources, like IAM settings, trusted profiles, access groups, and resource groups."
},
{
"role_crns": [
- "crn:v1:bluemix:public:iam::::role:Editor"
+ "crn:v1:bluemix:public:iam::::serviceRole:Manager",
+ "crn:v1:bluemix:public:iam::::role:Administrator"
],
- "service_name": "iam-access-groups",
- "notes": "[Optional] Required for managing IAM access groups."
+ "service_name": "containers-kubernetes",
+ "notes": "Required to create and edit OpenShift cluster and the related resources."
},
{
- "service_name": "iam-identity",
"role_crns": [
"crn:v1:bluemix:public:iam::::role:Operator",
"crn:v1:bluemix:public:iam-identity::::serviceRole:UserApiKeyCreator"
],
- "notes": "Required to create the containers-kubernetes-key for the OpenShift cluster."
+ "service_name": "iam-identity",
+ "notes": "Required to create the containers-kubernetes-key needed by the OpenShift cluster on IBM Cloud."
},
{
"role_crns": [
- "crn:v1:bluemix:public:iam::::serviceRole:Manager",
- "crn:v1:bluemix:public:iam::::role:Editor"
+ "crn:v1:bluemix:public:iam::::role:Administrator",
+ "crn:v1:bluemix:public:iam::::serviceRole:Manager"
],
- "service_name": "hs-crypto",
- "notes": "[Optional] Required if Hyper Protect Crypto Service is used for encryption."
+ "service_name": "is.vpc",
+ "notes": "Required for creating Virtual Private Cloud(VPC)."
},
{
"role_crns": [
"crn:v1:bluemix:public:iam::::serviceRole:Manager",
"crn:v1:bluemix:public:iam::::role:Editor"
],
- "service_name": "kms",
- "notes": "[Optional] [Optional] Required if Key Protect is used for encryption."
+ "service_name": "cloud-object-storage",
+ "notes": "[Optional] Required to create Cloud Object Storage (COS) Instance."
},
{
"role_crns": [
"crn:v1:bluemix:public:iam::::serviceRole:Manager",
"crn:v1:bluemix:public:iam::::role:Editor"
],
- "service_name": "cloud-object-storage",
- "notes": "Required to manage Object storage bucket for the cluster internal registry."
+ "service_name": "hs-crypto",
+ "notes": "[Optional] Required if KMS encryption is enabled and IBM Hyper Protect Crypto Services is used to encrypt the Kubernetes Secrets and Object Storage bucket."
},
{
- "service_name": "containers-kubernetes",
"role_crns": [
"crn:v1:bluemix:public:iam::::serviceRole:Manager",
"crn:v1:bluemix:public:iam::::role:Administrator"
],
+ "service_name": "containers-kubernetes",
"notes": "Required to create and manage the Openshift cluster."
},
- {
- "service_name": "is.vpc",
- "role_crns": [
- "crn:v1:bluemix:public:iam::::role:Editor"
- ],
- "notes": "Required to create VPC."
- },
- {
- "role_crns": [
- "crn:v1:bluemix:public:iam::::role:Administrator",
- "crn:v1:bluemix:public:iam::::serviceRole:Manager"
- ],
- "service_name": "secrets-manager",
- "notes": "[Optional] Required when enabling the Secrets Manager integration."
- },
{
"role_crns": [
"crn:v1:bluemix:public:iam::::serviceRole:Manager",
"crn:v1:bluemix:public:iam::::role:Administrator"
],
"service_name": "sysdig-monitor",
- "notes": "[Optional] Required to create an instance of Cloud Monitoring."
+ "notes": "[Optional] Required for consuming Observability deployable architecture which sets up Cloud Monitoring."
},
{
"role_crns": [
@@ -178,44 +164,46 @@
"crn:v1:bluemix:public:iam::::role:Editor"
],
"service_name": "logs",
- "notes": "[Optional] Required to create an instance of Cloud logs."
- },
- {
- "service_name": "logs-router",
- "role_crns": [
- "crn:v1:bluemix:public:iam::::serviceRole:Manager"
- ],
- "notes": "[Optional] Required to create an instance of Logs Routing."
+ "notes": "[Optional] Required for consuming Observability deployable architecture which sets up Cloud Logs."
},
{
- "service_name": "atracker",
"role_crns": [
"crn:v1:bluemix:public:iam::::serviceRole:Writer",
"crn:v1:bluemix:public:iam::::role:Editor"
],
- "notes": "[Optional] Required when enabling the Activity Tracker Event Routing."
+ "service_name": "atracker",
+ "notes": "[Optional] Required for consuming Observability deployable architecture which sets up Activity Tracker Event Routing."
},
{
- "service_name": "metrics-router",
"role_crns": [
+ "crn:v1:bluemix:public:iam::::serviceRole:Manager",
"crn:v1:bluemix:public:iam::::role:Administrator"
],
- "notes": "[Optional] Required to enable metrics routing to the Cloud Monitoring."
+ "service_name": "secrets-manager",
+ "notes": "[Optional] Required for creating an Secrets Manager instance. 'Manager' access required to create new secret groups."
},
{
"role_crns": [
"crn:v1:bluemix:public:iam::::serviceRole:Manager",
- "crn:v1:bluemix:public:iam::::role:Administrator"
+ "crn:v1:bluemix:public:iam::::role:Editor"
],
"service_name": "event-notifications",
- "notes": "[Optional] Required when enabling the Event Notifications integration."
+ "notes": "[Optional] Required for creating an Event Notifications instance."
+ },
+ {
+ "role_crns": [
+ "crn:v1:bluemix:public:iam::::serviceRole:Manager",
+ "crn:v1:bluemix:public:iam::::role:Editor"
+ ],
+ "service_name": "kms",
+ "notes": "[Optional] Required if KMS encryption is enabled and Key protect is used for encryption of Kubernetes Secrets and Object Storage bucket."
}
],
"architecture": {
"features": [
{
"title": " ",
- "description": "Configured to use IBM secure by default standards, but can be edited to fit your use case."
+ "description": "Configured to use IBM secure-by-default standards, but can be edited to fit your use case."
}
],
"diagrams": [
@@ -502,36 +490,37 @@
},
{
"key": "enable_platform_metrics",
- "type": "string",
- "default_value": "true",
- "description": "When set to `true`, the IBM Cloud Monitoring instance will be configured to collect platform metrics from the provided region. ⚠️ You can configure 1 instance only of the IBM Cloud Monitoring service per region to collect platform metrics in that location. Check with the account or service administrator if another monitoring instance has already been configured. You may not have permissions to see all monitoring instances in the region. [Learn more](https://cloud.ibm.com/docs/monitoring?topic=monitoring-platform_metrics_enabling).",
+ "type": "boolean",
+ "default_value": false,
+ "description": "When set to `true`, the IBM Cloud Monitoring instance will be configured to collect platform metrics from the provided region. You can configure 1 instance only of the IBM Cloud Monitoring service per region to collect platform metrics in that location. Check with the account or service administrator if another monitoring instance has already been configured. You may not have permissions to see all monitoring instances in the region. [Learn more](https://cloud.ibm.com/docs/monitoring?topic=monitoring-platform_metrics_enabling).",
"required": true,
"virtual": true,
"options": [
{
"displayname": "true",
- "value": "true"
+ "value": true
},
{
"displayname": "false",
- "value": "false"
+ "value": false
}
]
},
{
"key": "logs_routing_tenant_regions",
- "type": "list(string)",
- "default_value": "[]",
- "description": "To manage platform logs that are generated by IBM Cloud services in a region of IBM Cloud, you must create a tenant in each region that you operate. Pass a list of regions to create a tenant in. For example: [\"us-south\", \"us-east\"]. [Learn more](https://cloud.ibm.com/docs/logs-router?topic=logs-router-about-platform-logs).",
+ "type": "array",
+ "default_value": [],
+ "description": "To manage platform logs that are generated by IBM Cloud services in a region of IBM Cloud, you must create a tenant in each region that you operate. Pass a list of regions to create a tenant in. [Learn more](https://cloud.ibm.com/docs/logs-router?topic=logs-router-about-platform-logs).",
"required": true,
- "virtual": true,
"custom_config": {
+ "type": "array",
"grouping": "deployment",
"original_grouping": "deployment",
"config_constraints": {
"type": "string"
}
- }
+ },
+ "virtual": true
},
{
"key": "existing_resource_group_name",
@@ -791,7 +780,7 @@
},
{
"key": "network_acls",
- "type": "list(object)",
+ "type": "array",
"default_value": "[\n {\n name = \"vpc-acl\"\n add_ibm_cloud_internal_rules = true\n add_vpc_connectivity_rules = true\n prepend_ibm_rules = true\n rules = [\n {\n name = \"allow-all-443-inbound\"\n action = \"allow\"\n direction = \"inbound\"\n tcp = {\n port_min = 443\n port_max = 443\n }\n destination = \"0.0.0.0/0\"\n source = \"0.0.0.0/0\"\n },\n {\n name = \"allow-all-80-inbound\"\n action = \"allow\"\n direction = \"inbound\"\n tcp = {\n port_min = 80\n port_max = 80\n source_port_min = 80\n source_port_max = 80\n }\n destination = \"0.0.0.0/0\"\n source = \"0.0.0.0/0\"\n },\n {\n name = \"allow-all-ingress-inbound\"\n action = \"allow\"\n direction = \"inbound\"\n tcp = {\n source_port_min = 30000\n source_port_max = 32767\n }\n destination = \"0.0.0.0/0\"\n source = \"0.0.0.0/0\"\n },\n {\n name = \"allow-all-443-outbound\"\n action = \"allow\"\n direction = \"outbound\"\n tcp = {\n source_port_min = 443\n source_port_max = 443\n }\n destination = \"0.0.0.0/0\"\n source = \"0.0.0.0/0\"\n },\n {\n name = \"allow-all-80-outbound\"\n action = \"allow\"\n direction = \"outbound\"\n tcp = {\n source_port_min = 80\n source_port_max = 80\n port_min = 80\n port_max = 80\n }\n destination = \"0.0.0.0/0\"\n source = \"0.0.0.0/0\"\n },\n {\n name = \"allow-all-ingress-outbound\"\n action = \"allow\"\n direction = \"outbound\"\n tcp = {\n port_min = 30000\n port_max = 32767\n }\n destination = \"0.0.0.0/0\"\n source = \"0.0.0.0/0\"\n }\n ]\n }\n]",
"description": "The list of ACLs to create. Provide at least one rule for each ACL. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/blob/main/solutions/fully-configurable/DA-types.md#network-acls-).",
"required": false,
@@ -806,15 +795,15 @@
"key": "provider_visibility",
"options": [
{
- "displayname": "private",
+ "displayname": "Private",
"value": "private"
},
{
- "displayname": "public",
+ "displayname": "Public",
"value": "public"
},
{
- "displayname": "public-and-private",
+ "displayname": "Public-and-Private",
"value": "public-and-private"
}
],
@@ -1056,7 +1045,7 @@
{
"label": "QuickStart",
"name": "quickstart",
- "index": 1,
+ "index": 2,
"install_type": "fullstack",
"working_directory": "solutions/quickstart",
"compliance": {
@@ -1070,42 +1059,129 @@
},
"iam_permissions": [
{
- "service_name": "containers-kubernetes",
+ "role_crns": [
+ "crn:v1:bluemix:public:iam::::role:Viewer"
+ ],
+ "service_name": "Resource group only",
+ "notes": "Viewer access is required in the resource group you want to provision in."
+ },
+ {
+ "role_crns": [
+ "crn:v1:bluemix:public:iam::::role:Viewer"
+ ],
+ "service_name": "All Identity and Access enabled services",
+ "notes": "[Optional] Required to view IAM-enabled resources across the account."
+ },
+ {
+ "role_crns": [
+ "crn:v1:bluemix:public:iam::::role:Administrator"
+ ],
+ "service_name": "All Account Management services",
+ "notes": "[Optional] Required to deploy Cloud automation for account configuration, which creates foundational IBM Cloud account resources, like IAM settings, trusted profiles, access groups, and resource groups."
+ },
+ {
"role_crns": [
"crn:v1:bluemix:public:iam::::serviceRole:Manager",
"crn:v1:bluemix:public:iam::::role:Administrator"
],
- "notes": "Required to reset the cluster API key, create and edit the OpenShift cluster, and manage all related resources."
+ "service_name": "containers-kubernetes",
+ "notes": "Required to create and edit OpenShift cluster and the related resources."
},
{
- "service_name": "iam-identity",
"role_crns": [
- "crn:v1:bluemix:public:iam::::role:Administrator",
+ "crn:v1:bluemix:public:iam::::role:Operator",
"crn:v1:bluemix:public:iam-identity::::serviceRole:UserApiKeyCreator"
],
- "notes": "Required to create the cluster API key needed by the OpenShift cluster on IBM Cloud and for managing and operating resources within the IBM Cloud environment."
+ "service_name": "iam-identity",
+ "notes": "Required to create the containers-kubernetes-key needed by the OpenShift cluster on IBM Cloud."
},
{
+ "role_crns": [
+ "crn:v1:bluemix:public:iam::::role:Administrator",
+ "crn:v1:bluemix:public:iam::::serviceRole:Manager"
+ ],
"service_name": "is.vpc",
+ "notes": "Required for creating Virtual Private Cloud(VPC)."
+ },
+ {
"role_crns": [
+ "crn:v1:bluemix:public:iam::::serviceRole:Manager",
"crn:v1:bluemix:public:iam::::role:Editor"
],
- "notes": "Required for creating Virtual Private Cloud (VPC)."
+ "service_name": "cloud-object-storage",
+ "notes": "[Optional] Required to create Cloud Object Storage (COS) Instance."
+ },
+ {
+ "role_crns": [
+ "crn:v1:bluemix:public:iam::::serviceRole:Manager",
+ "crn:v1:bluemix:public:iam::::role:Editor"
+ ],
+ "service_name": "hs-crypto",
+ "notes": "[Optional] Required if KMS encryption is enabled and IBM Hyper Protect Crypto Services is used to encrypt the Kubernetes Secrets and Object Storage bucket."
},
{
- "service_name": "cloud-object-storage",
"role_crns": [
"crn:v1:bluemix:public:iam::::serviceRole:Manager",
"crn:v1:bluemix:public:iam::::role:Editor"
],
+ "service_name": "cloud-object-storage",
"notes": "Required for creating the OpenShift cluster's internal registry storage bucket."
},
{
"role_crns": [
- "crn:v1:bluemix:public:iam::::role:Viewer"
+ "crn:v1:bluemix:public:iam::::serviceRole:Manager",
+ "crn:v1:bluemix:public:iam::::role:Administrator"
],
- "service_name": "Resource group only",
- "notes": "Viewer access is required in the resource group you want to provision in."
+ "service_name": "containers-kubernetes",
+ "notes": "Required to create and manage the Openshift cluster."
+ },
+ {
+ "role_crns": [
+ "crn:v1:bluemix:public:iam::::serviceRole:Manager",
+ "crn:v1:bluemix:public:iam::::role:Administrator"
+ ],
+ "service_name": "sysdig-monitor",
+ "notes": "[Optional] Required for consuming Observability deployable architecture which sets up Cloud Monitoring."
+ },
+ {
+ "role_crns": [
+ "crn:v1:bluemix:public:iam::::serviceRole:Manager",
+ "crn:v1:bluemix:public:iam::::role:Editor"
+ ],
+ "service_name": "logs",
+ "notes": "[Optional] Required for consuming Observability deployable architecture which sets up Cloud Logs."
+ },
+ {
+ "role_crns": [
+ "crn:v1:bluemix:public:iam::::serviceRole:Writer",
+ "crn:v1:bluemix:public:iam::::role:Editor"
+ ],
+ "service_name": "atracker",
+ "notes": "[Optional] Required for consuming Observability deployable architecture which sets up Activity Tracker Event Routing."
+ },
+ {
+ "role_crns": [
+ "crn:v1:bluemix:public:iam::::serviceRole:Manager",
+ "crn:v1:bluemix:public:iam::::role:Administrator"
+ ],
+ "service_name": "secrets-manager",
+ "notes": "[Optional] Required for creating an Secrets Manager instance. 'Manager' access required to create new secret groups."
+ },
+ {
+ "role_crns": [
+ "crn:v1:bluemix:public:iam::::serviceRole:Manager",
+ "crn:v1:bluemix:public:iam::::role:Editor"
+ ],
+ "service_name": "event-notifications",
+ "notes": "[Optional] Required for creating an Event Notifications instance."
+ },
+ {
+ "role_crns": [
+ "crn:v1:bluemix:public:iam::::serviceRole:Manager",
+ "crn:v1:bluemix:public:iam::::role:Editor"
+ ],
+ "service_name": "kms",
+ "notes": "[Optional] Required if KMS encryption is enabled and Key protect is used for encryption of Kubernetes Secrets and Object Storage bucket."
}
],
"architecture": {
diff --git a/reference-architecture/deployable-architecture-ocp-cluster-qs.svg b/reference-architecture/deployable-architecture-ocp-cluster-qs.svg
index bdd6901b..9dcfec92 100644
--- a/reference-architecture/deployable-architecture-ocp-cluster-qs.svg
+++ b/reference-architecture/deployable-architecture-ocp-cluster-qs.svg
@@ -1,4 +1,8 @@
-
\ No newline at end of file
+<<<<<<< HEAD
+
+=======
+
+>>>>>>> 78564aff5bd2218b36d01064389e3b4dff1b8d86
diff --git a/reference-architecture/deployable-architecture-ocp-cluster.svg b/reference-architecture/deployable-architecture-ocp-cluster.svg
index 0ec70c90..26294ea3 100644
--- a/reference-architecture/deployable-architecture-ocp-cluster.svg
+++ b/reference-architecture/deployable-architecture-ocp-cluster.svg
@@ -1,4 +1,8 @@
-
\ No newline at end of file
+<<<<<<< HEAD
+
+=======
+
+>>>>>>> 78564aff5bd2218b36d01064389e3b4dff1b8d86
diff --git a/solutions/fully-configurable/scripts/delete_secrets.sh b/solutions/fully-configurable/scripts/delete_secrets.sh
index bf0fc773..a4425da3 100755
--- a/solutions/fully-configurable/scripts/delete_secrets.sh
+++ b/solutions/fully-configurable/scripts/delete_secrets.sh
@@ -59,7 +59,7 @@ if [[ "$secrets_length" == 0 ]];then
fi
# delete the secrets inside the secret group
-# retrycount for deleting a particular secret incase curl command for delete command fails
+# retrycount for deleting a particular secret in case curl command for delete command fails
retryCount=2;
for ((i=0; i