From 5a764579435bdf8d46873d229ea7165e5ac0fcc7 Mon Sep 17 00:00:00 2001 From: Prateek-Sharma13 Date: Thu, 4 Sep 2025 11:38:29 +0530 Subject: [PATCH 01/13] doc: updated help docs --- .../deploy-arch-ibm-ocp-fully-configurable.md | 94 +++++++++++++++++++ .../deploy-arch-ibm-ocp-quickstart.md | 89 ++++++++++++++++++ ...map-deploy-arch-ocp-fully-configurable.svg | 4 + .../heat-map-deploy-arch-ocp-quickstart.svg | 4 + 4 files changed, 191 insertions(+) create mode 100644 reference-architecture/deploy-arch-ibm-ocp-fully-configurable.md create mode 100644 reference-architecture/deploy-arch-ibm-ocp-quickstart.md create mode 100644 reference-architecture/heat-map-deploy-arch-ocp-fully-configurable.svg create mode 100644 reference-architecture/heat-map-deploy-arch-ocp-quickstart.svg diff --git a/reference-architecture/deploy-arch-ibm-ocp-fully-configurable.md b/reference-architecture/deploy-arch-ibm-ocp-fully-configurable.md new file mode 100644 index 00000000..837bcfd0 --- /dev/null +++ b/reference-architecture/deploy-arch-ibm-ocp-fully-configurable.md @@ -0,0 +1,94 @@ +--- + +copyright: + years: 2025 +lastupdated: "2025-09-03" + +keywords: + +subcollection: deployable-reference-architectures + +authors: + - name: "Prateek Sharma" + +# The release that the reference architecture describes +version: 3.55.6 + +# Whether the reference architecture is published to Cloud Docs production. +# When set to false, the file is available only in staging. Default is false. +production: true + +# Use if the reference architecture has deployable code. +# Value is the URL to land the user in the IBM Cloud catalog details page for the deployable architecture. +# See https://test.cloud.ibm.com/docs/get-coding?topic=get-coding-deploy-button +deployment-url: https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-ocp-vpc-1728a4fd-f561-4cf9-82ef-2b1eeb5da1a8-global + +docs: https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone/blob/main/reference-architectures/deploy-arch-ibm-ocp-fully-configurable.md + +image_source: https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone/blob/main/reference-architectures/deployable-architecture-ocp-cluster.svg + +related_links: + - title: "Cloud automation for Red Hat OpenShift Container Platform on VPC" + url: "https://cloud.ibm.com/docs/deployable-reference-architectures?topic=deployable-reference-architectures-ocp-fully-configurable" + description: "A deployable architecture that delivers a scalable and flexible Red Hat OpenShift environment on IBM Cloud Virtual Private Cloud (VPC), with seamless integration to security, observability, and other foundational services for containerized workloads." + +use-case: Cybersecurity +industry: Banking,FinancialSector +compliance: FedRAMP + +content-type: reference-architecture + +--- + +{{site.data.keyword.attribute-definition-list}} + +# Cloud automation for Red Hat OpenShift Container Platform on VPC - Standard - Integrated setup with configurable services +{: #ocp-fully-configurable} +{: toc-content-type="reference-architecture"} +{: toc-industry="Banking,FinancialSector"} +{: toc-use-case="Cybersecurity"} +{: toc-compliance="FedRAMP"} +{: toc-version="1.1.0"} + +The Cloud Automation for Red Hat OpenShift Container Platform on Virtual Private Cloud (VPC) offers a scalable and flexible foundation for deploying containerized applications in the IBM cloud. It provides seamless integration with key services such as observability, security, and secrets management, supporting a secure and production-ready OpenShift environment. While it can operate independently, this deployable architecture is also designed to serve as a base for more advanced deployments, including AI-driven workloads using Cloud Automation for Red Hat OpenShift AI, allowing enterprises to accelerate time-to-market for critical applications in a secure and managed OpenShift ecosystem. + +This solution provisions a Red Hat OpenShift cluster within a highly configurable Virtual Private Cloud (VPC) environment. Users can opt to use an existing Virtual Private Cloud (VPC) or create a new one using the Cloud foundation for VPC module, which supports both single-zone and multi-zone configurations. By default, a three-zone setup is provisioned to ensure high availability, with a single worker pool spanning all zones and two worker nodes per zone. Additional worker pools can be added easily via configurable variables. The cluster requires a Cloud Object Storage (COS) instance, where a dedicated object storage bucket is used as the internal registry. Cluster and boot volume encryption is enforced using Key Management Services (KMS), enhancing data security. + +To support operational visibility and compliance, optional services such as Cloud Automation for Observability and Secrets Manager can be enabled. These provide centralized logging, monitoring, and certificate management, ensuring better control over system health and sensitive credentials. This deployable architecture delivers a secure, resilient, and extensible platform for deploying enterprise-grade Red Hat OpenShift workloads in IBM Cloud. + +## Architecture diagram +{: #ra-ocp-fully-configurable-architecture-diagram} + +![Architecture diagram for the Fully configurable variation of Cloud automation for Red Hat OpenShift Container Platform on VPC](deployable-architecture-ocp-cluster.svg "Architecture diagram of Fully configurable variation of Cloud automation for Red Hat OpenShift Container Platform on VPC deployable architecture"){: caption="Figure 1. Fully configurable variation of Cloud automation for Red Hat OpenShift Container Platform on VPC" caption-side="bottom"}{: external download="deployable-architecture-ocp-cluster.svg"} + +## Design concepts +{: #ra-ocp-fully-configurable-design-concepts} + +![Design requirements for Red Hat OpenShift Container Platform on VPC landing zone](heat-map-deploy-arch-ocp-fully-configurable.svg "Design concepts"){: caption="Figure 2. Scope of the design concepts" caption-side="bottom"} + +## Requirements +{: #ra-ocp-fully-configurable-requirements} + +The following table outlines the requirements that are addressed in this architecture. + +| Aspect | Requirements | +|---|---| +| Compute | Kubernetes cluster with minimal machine size and nodes, suitable for low-cost demonstration and development | +| Storage | Kubernetes cluster registry backup (required) | +| Networking | * Multiple VPCs for network isolation. \n * All public inbound and outbound traffic allowed to VPCs. \n * Administration of cluster allowed from public endpoint and web console. \n * Load balancer for cluster workload services. \n * Outbound internet access from cluster. \n * Private network connection between VPCs. | +| Security | * Encryption of all application data in transit and at rest to protect it from unauthorized disclosure. \n * Storage and management of all encryption keys. \n * Protect cluster administration access through IBM Cloud security protocols. | +| Service Management | Automated deployment of infrastructure with IBM Cloud catalog | +{: caption="Table 1. Requirements" caption-side="bottom"} + +## Components +{: #ra-ocp-fully-configurable-components} + +The following table outlines the products or services used in the architecture for each aspect. + +| Aspects | Architecture components | How the component is used | +|---|---|---| +| Compute | Red Hat OpenShift Container Platform | Container execution | +| Storage | IBM Cloud Object Storage | Registry backup for Red Hat OpenShift | +| Networking | * VPC Load Balancer \n * Public Gateway \n * Transit Gateway | * Application load balancing for cluster workloads (automatically created by Red Hat OpenShift service for multi-zone cluster) \n * Cluster access to the internet \n * Private network connectivity between management and workload VPCs | +| Security | * IAM \n * Key Protect | * IBM Cloud Identity and Access Management \n * Management of encryption keys used by Red Hat OpenShift Container Platform | +{: caption="Table 2. Components" caption-side="bottom"} diff --git a/reference-architecture/deploy-arch-ibm-ocp-quickstart.md b/reference-architecture/deploy-arch-ibm-ocp-quickstart.md new file mode 100644 index 00000000..9dd94005 --- /dev/null +++ b/reference-architecture/deploy-arch-ibm-ocp-quickstart.md @@ -0,0 +1,89 @@ +--- + +copyright: + years: 2025 +lastupdated: "2025-09-03" + +keywords: + +subcollection: deployable-reference-architectures + +authors: + - name: "Prateek Sharma" + +# The release that the reference architecture describes +version: 3.55.6 + +# Whether the reference architecture is published to Cloud Docs production. +# When set to false, the file is available only in staging. Default is false. +production: true + +# Use if the reference architecture has deployable code. +# Value is the URL to land the user in the IBM Cloud catalog details page +# for the deployable architecture. +# See https://test.cloud.ibm.com/docs/get-coding?topic=get-coding-deploy-button +deployment-url: https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-ocp-vpc-1728a4fd-f561-4cf9-82ef-2b1eeb5da1a8-global + +docs: https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone/blob/main/reference-architectures/deploy-arch-ibm-ocp-quickstart.md + +image_source: https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone/blob/main/reference-architectures/deployable-architecture-ocp-cluster-qs.svg + +related_links: + - title: "Cloud automation for Red Hat OpenShift Container Platform on VPC" + url: "https://cloud.ibm.com/docs/secure-infrastructure-vpc?topic=secure-infrastructure-vpc-ocp-ra" + description: "A deployable architecture solution that is based on the IBM Cloud for Financial Services reference architecture. This solution delivers a scalable and flexible Red Hat OpenShift environment on IBM Cloud Virtual Private Cloud (VPC), with seamless integration to security, observability, and other foundational services for containerized workloads." + +use-case: Cybersecurity +industry: Banking,FinancialSector + +content-type: reference-architecture + +--- + +{{site.data.keyword.attribute-definition-list}} + +# Cloud automation for Red Hat OpenShift Container Platform on VPC - QuickStart variation +{: #roks-ra-qs} +{: toc-content-type="reference-architecture"} +{: toc-industry="Banking,FinancialSector"} +{: toc-use-case="Cybersecurity"} +{: toc-version="6.6.0"} + +The QuickStart variation of the Cloud automation for Red Hat OpenShift Container Platform on VPC deployable architecture creates a fully customizable Virtual Private Cloud (VPC) environment in a single region. The solution provides a single Red Hat OpenShift cluster in a secure VPC for your workloads. The QuickStart variation is designed to deploy quickly for demonstration and development. + +## Architecture diagram +{: #ra-ocp-qs-architecture-diagram} + +![Architecture diagram for the QuickStart variation of Cloud automation for Red Hat OpenShift Container Platform on VPC](deployable-architecture-ocp-cluster-qs.svg "Architecture diagram of QuickStart variation of Cloud automation for Red Hat OpenShift Container Platform on VPC deployable architecture"){: caption="Figure 1. QuickStart variation of Cloud automation for Red Hat OpenShift Container Platform on VPC" caption-side="bottom"}{: external download="deployable-architecture-ocp-cluster-qs.svg"} + +## Design concepts +{: #ra-ocp-qs-design-concepts} + +![Design requirements for Cloud automation for Red Hat OpenShift Container Platform on VPC](heat-map-deploy-arch-ocp-quickstart.svg "Design concepts"){: caption="Figure 2. Scope of the design concepts" caption-side="bottom"} + +## Requirements +{: #ra-ocp-qs-requirements} + +The following table outlines the requirements that are addressed in this architecture. + +| Aspect | Requirements | +|---|---| +| Compute | Kubernetes cluster with minimal machine size and nodes, suitable for low-cost demonstration and development | +| Storage | Kubernetes cluster registry backup (required) | +| Networking | * Multiple VPCs for network isolation. \n * All public inbound and outbound traffic allowed to VPCs. \n * Administration of cluster allowed from public endpoint and web console. \n * Load balancer for cluster workload services. \n * Outbound internet access from cluster. \n * Private network connection between VPCs. | +| Security | * Encryption of all application data in transit and at rest to protect it from unauthorized disclosure. \n * Storage and management of all encryption keys. \n * Protect cluster administration access through IBM Cloud security protocols. | +| Service Management | Automated deployment of infrastructure with IBM Cloud catalog | +{: caption="Table 1. Requirements" caption-side="bottom"} + +## Components +{: #ra-ocp-qs-components} + +The following table outlines the products or services used in the architecture for each aspect. + +| Aspects | Architecture components | How the component is used | +|---|---|---| +| Compute | Red Hat OpenShift Container Platform | Container execution | +| Storage | IBM Cloud Object Storage | Registry backup for Red Hat OpenShift | +| Networking | * VPC Load Balancer \n * Public Gateway \n * Transit Gateway | * Application load balancing for cluster workloads (automatically created by Red Hat OpenShift service for multi-zone cluster) \n * Cluster access to the internet \n * Private network connectivity between management and workload VPCs | +| Security | * IAM \n * Key Protect | * IBM Cloud Identity and Access Management \n * Management of encryption keys used by Red Hat OpenShift Container Platform | +{: caption="Table 2. Components" caption-side="bottom"} diff --git a/reference-architecture/heat-map-deploy-arch-ocp-fully-configurable.svg b/reference-architecture/heat-map-deploy-arch-ocp-fully-configurable.svg new file mode 100644 index 00000000..015b3bcb --- /dev/null +++ b/reference-architecture/heat-map-deploy-arch-ocp-fully-configurable.svg @@ -0,0 +1,4 @@ + + + +
Application
integration
Application...
Mobile
Mobile
Bare metal servers
Bare metal servers
Primary storage
Primary storage
Enterprise
connectivity
Enterprise...
Build & test
Build & test
Data security
Data security
Backup & restore
Backup & restore
Monitoring
Monitoring
Edge
Edge
Blockchain
Blockchain
Enterprise
applications
Enterprise...
Data Ops
Data Ops
Data analytics
Data analytics
Data storage
Data storage
Business intelligence
Business intelligence
Virtual servers
Virtual servers
Virtualization
Virtualization
Containers
Containers
Cloud Foundry
Cloud Foundry
Serverless
Serverless
Backup
Backup
Archive
Archive
Data migration
Data migration
BYOIP/Edge gateways
BYOIP/Edge gateways
Load balancing
Load balancing
Cloud native connectivity
Cloud native connecti...
Isolation
Isolation
Content delivery network
Content delivery netw...
Domain name service
Domain name service
Identity & access
Identity & access
Application security
Application security
Infrastructure & endpoints
Infrastructure & endp...
Threat detection & response
Threat detection & re...
Governance, risk & compliance
Governance, risk & co...
Delivery pipeline
Delivery pipeline
Code repository
Code repository
Disaster recovery
Disaster recovery
High availability
High availability
Logging
Logging
Auditing/tracking
Auditing/tracking
Alerting
Alerting
Event management
Event management
Automated deployment
Automated deployment
Management/
orchestration
Management/...
Domain
Domain
Aspect
Aspect
Application
platforms
Application...
Data
Data
Compute
Compute
Storage
Storage
Networking
Networking
Security
Security
DevOps
DevOps
Resiliency
Resiliency
Service
management
Service...
Included in this architecture
Included in this...
Artificial intelligence
Artificial intelligen...Text is not SVG - cannot display \ No newline at end of file diff --git a/reference-architecture/heat-map-deploy-arch-ocp-quickstart.svg b/reference-architecture/heat-map-deploy-arch-ocp-quickstart.svg new file mode 100644 index 00000000..015b3bcb --- /dev/null +++ b/reference-architecture/heat-map-deploy-arch-ocp-quickstart.svg @@ -0,0 +1,4 @@ + + + +
Application
integration
Application...
Mobile
Mobile
Bare metal servers
Bare metal servers
Primary storage
Primary storage
Enterprise
connectivity
Enterprise...
Build & test
Build & test
Data security
Data security
Backup & restore
Backup & restore
Monitoring
Monitoring
Edge
Edge
Blockchain
Blockchain
Enterprise
applications
Enterprise...
Data Ops
Data Ops
Data analytics
Data analytics
Data storage
Data storage
Business intelligence
Business intelligence
Virtual servers
Virtual servers
Virtualization
Virtualization
Containers
Containers
Cloud Foundry
Cloud Foundry
Serverless
Serverless
Backup
Backup
Archive
Archive
Data migration
Data migration
BYOIP/Edge gateways
BYOIP/Edge gateways
Load balancing
Load balancing
Cloud native connectivity
Cloud native connecti...
Isolation
Isolation
Content delivery network
Content delivery netw...
Domain name service
Domain name service
Identity & access
Identity & access
Application security
Application security
Infrastructure & endpoints
Infrastructure & endp...
Threat detection & response
Threat detection & re...
Governance, risk & compliance
Governance, risk & co...
Delivery pipeline
Delivery pipeline
Code repository
Code repository
Disaster recovery
Disaster recovery
High availability
High availability
Logging
Logging
Auditing/tracking
Auditing/tracking
Alerting
Alerting
Event management
Event management
Automated deployment
Automated deployment
Management/
orchestration
Management/...
Domain
Domain
Aspect
Aspect
Application
platforms
Application...
Data
Data
Compute
Compute
Storage
Storage
Networking
Networking
Security
Security
DevOps
DevOps
Resiliency
Resiliency
Service
management
Service...
Included in this architecture
Included in this...
Artificial intelligence
Artificial intelligen...Text is not SVG - cannot display \ No newline at end of file From a5845bc8e0fb914d5d73bcb7677484040609c29a Mon Sep 17 00:00:00 2001 From: Prateek-Sharma13 Date: Thu, 4 Sep 2025 11:47:12 +0530 Subject: [PATCH 02/13] updated ref path --- .../deploy-arch-ibm-ocp-fully-configurable.md | 6 +++--- reference-architecture/deploy-arch-ibm-ocp-quickstart.md | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/reference-architecture/deploy-arch-ibm-ocp-fully-configurable.md b/reference-architecture/deploy-arch-ibm-ocp-fully-configurable.md index 837bcfd0..b8418c34 100644 --- a/reference-architecture/deploy-arch-ibm-ocp-fully-configurable.md +++ b/reference-architecture/deploy-arch-ibm-ocp-fully-configurable.md @@ -23,9 +23,9 @@ production: true # See https://test.cloud.ibm.com/docs/get-coding?topic=get-coding-deploy-button deployment-url: https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-ocp-vpc-1728a4fd-f561-4cf9-82ef-2b1eeb5da1a8-global -docs: https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone/blob/main/reference-architectures/deploy-arch-ibm-ocp-fully-configurable.md +docs: https://github.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/blob/main/reference-architecture/deploy-arch-ibm-ocp-fully-configurable.md -image_source: https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone/blob/main/reference-architectures/deployable-architecture-ocp-cluster.svg +image_source: https://github.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/blob/main/reference-architecture/deployable-architecture-ocp-cluster.svg related_links: - title: "Cloud automation for Red Hat OpenShift Container Platform on VPC" @@ -64,7 +64,7 @@ To support operational visibility and compliance, optional services such as Clou ## Design concepts {: #ra-ocp-fully-configurable-design-concepts} -![Design requirements for Red Hat OpenShift Container Platform on VPC landing zone](heat-map-deploy-arch-ocp-fully-configurable.svg "Design concepts"){: caption="Figure 2. Scope of the design concepts" caption-side="bottom"} +![Design requirements for Red Hat OpenShift Container Platform on VPC](heat-map-deploy-arch-ocp-fully-configurable.svg "Design concepts"){: caption="Figure 2. Scope of the design concepts" caption-side="bottom"} ## Requirements {: #ra-ocp-fully-configurable-requirements} diff --git a/reference-architecture/deploy-arch-ibm-ocp-quickstart.md b/reference-architecture/deploy-arch-ibm-ocp-quickstart.md index 9dd94005..f8659eba 100644 --- a/reference-architecture/deploy-arch-ibm-ocp-quickstart.md +++ b/reference-architecture/deploy-arch-ibm-ocp-quickstart.md @@ -24,9 +24,9 @@ production: true # See https://test.cloud.ibm.com/docs/get-coding?topic=get-coding-deploy-button deployment-url: https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-ocp-vpc-1728a4fd-f561-4cf9-82ef-2b1eeb5da1a8-global -docs: https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone/blob/main/reference-architectures/deploy-arch-ibm-ocp-quickstart.md +docs: https://github.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/blob/main/reference-architecture/deploy-arch-ibm-ocp-quickstart.md -image_source: https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone/blob/main/reference-architectures/deployable-architecture-ocp-cluster-qs.svg +image_source: https://github.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/blob/main/reference-architecture/deployable-architecture-ocp-cluster-qs.svg related_links: - title: "Cloud automation for Red Hat OpenShift Container Platform on VPC" From 5e20ed764cb6a60ac8f2825264ac870dfa33272f Mon Sep 17 00:00:00 2001 From: Prateek-Sharma13 Date: Thu, 4 Sep 2025 12:16:18 +0530 Subject: [PATCH 03/13] updated heatmap --- .../heat-map-deploy-arch-ocp-fully-configurable.svg | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/reference-architecture/heat-map-deploy-arch-ocp-fully-configurable.svg b/reference-architecture/heat-map-deploy-arch-ocp-fully-configurable.svg index 015b3bcb..ae70b7c8 100644 --- a/reference-architecture/heat-map-deploy-arch-ocp-fully-configurable.svg +++ b/reference-architecture/heat-map-deploy-arch-ocp-fully-configurable.svg @@ -1,4 +1 @@ - - - -
Application
integration
Application...
Mobile
Mobile
Bare metal servers
Bare metal servers
Primary storage
Primary storage
Enterprise
connectivity
Enterprise...
Build & test
Build & test
Data security
Data security
Backup & restore
Backup & restore
Monitoring
Monitoring
Edge
Edge
Blockchain
Blockchain
Enterprise
applications
Enterprise...
Data Ops
Data Ops
Data analytics
Data analytics
Data storage
Data storage
Business intelligence
Business intelligence
Virtual servers
Virtual servers
Virtualization
Virtualization
Containers
Containers
Cloud Foundry
Cloud Foundry
Serverless
Serverless
Backup
Backup
Archive
Archive
Data migration
Data migration
BYOIP/Edge gateways
BYOIP/Edge gateways
Load balancing
Load balancing
Cloud native connectivity
Cloud native connecti...
Isolation
Isolation
Content delivery network
Content delivery netw...
Domain name service
Domain name service
Identity & access
Identity & access
Application security
Application security
Infrastructure & endpoints
Infrastructure & endp...
Threat detection & response
Threat detection & re...
Governance, risk & compliance
Governance, risk & co...
Delivery pipeline
Delivery pipeline
Code repository
Code repository
Disaster recovery
Disaster recovery
High availability
High availability
Logging
Logging
Auditing/tracking
Auditing/tracking
Alerting
Alerting
Event management
Event management
Automated deployment
Automated deployment
Management/
orchestration
Management/...
Domain
Domain
Aspect
Aspect
Application
platforms
Application...
Data
Data
Compute
Compute
Storage
Storage
Networking
Networking
Security
Security
DevOps
DevOps
Resiliency
Resiliency
Service
management
Service...
Included in this architecture
Included in this...
Artificial intelligence
Artificial intelligen...Text is not SVG - cannot display \ No newline at end of file +
Application
integration
Application...
Mobile
Mobile
Bare metal servers
Bare metal servers
Primary storage
Primary storage
Enterprise
connectivity
Enterprise...
Build & test
Build & test
Data security
Data security
Backup & restore
Backup & restore
Monitoring
Monitoring
Edge
Edge
Blockchain
Blockchain
Enterprise
applications
Enterprise...
Data Ops
Data Ops
Data analytics
Data analytics
Data storage
Data storage
Business intelligence
Business intelligence
Virtual servers
Virtual servers
Virtualization
Virtualization
Containers
Containers
Cloud Foundry
Cloud Foundry
Serverless
Serverless
Backup
Backup
Archive
Archive
Data migration
Data migration
BYOIP/Edge gateways
BYOIP/Edge gateways
Load balancing
Load balancing
Cloud native connectivity
Cloud native connecti...
Isolation
Isolation
Content delivery network
Content delivery netw...
Domain name service
Domain name service
Identity & access
Identity & access
Application security
Application security
Infrastructure & endpoints
Infrastructure & endp...
Threat detection & response
Threat detection & re...
Governance, risk & compliance
Governance, risk & co...
Delivery pipeline
Delivery pipeline
Code repository
Code repository
Disaster recovery
Disaster recovery
High availability
High availability
Logging
Logging
Auditing/tracking
Auditing/tracking
Alerting
Alerting
Event management
Event management
Automated deployment
Automated deployment
Management/
orchestration
Management/...
Domain
Domain
Aspect
Aspect
Application
platforms
Application...
Data
Data
Compute
Compute
Storage
Storage
Networking
Networking
Security
Security
DevOps
DevOps
Resiliency
Resiliency
Service
management
Service...
Included in this architecture
Included in this...
Artificial intelligence
Artificial intelligen...Text is not SVG - cannot display \ No newline at end of file From 9e5dc3aaf1fb86e554d0d58aa1ab10b4c8f80648 Mon Sep 17 00:00:00 2001 From: Prateek-Sharma13 Date: Fri, 5 Sep 2025 12:17:30 +0530 Subject: [PATCH 04/13] updated description to include default addon -sm --- .../deploy-arch-ibm-ocp-fully-configurable.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/reference-architecture/deploy-arch-ibm-ocp-fully-configurable.md b/reference-architecture/deploy-arch-ibm-ocp-fully-configurable.md index b8418c34..6a757552 100644 --- a/reference-architecture/deploy-arch-ibm-ocp-fully-configurable.md +++ b/reference-architecture/deploy-arch-ibm-ocp-fully-configurable.md @@ -50,11 +50,11 @@ content-type: reference-architecture {: toc-compliance="FedRAMP"} {: toc-version="1.1.0"} -The Cloud Automation for Red Hat OpenShift Container Platform on Virtual Private Cloud (VPC) offers a scalable and flexible foundation for deploying containerized applications in the IBM cloud. It provides seamless integration with key services such as observability, security, and secrets management, supporting a secure and production-ready OpenShift environment. While it can operate independently, this deployable architecture is also designed to serve as a base for more advanced deployments, including AI-driven workloads using Cloud Automation for Red Hat OpenShift AI, allowing enterprises to accelerate time-to-market for critical applications in a secure and managed OpenShift ecosystem. +Cloud Automation for Red Hat OpenShift on Virtual Private Cloud (VPC) provides a scalable, secure, and production-ready foundation for deploying containerized applications on IBM Cloud. It comes integrated by default with several IBM Cloud services to enhance security, observability, and compliance. Data encryption is enforced using Key Protect and Key Management Services (KMS), while Cloud Object Storage (COS) supports persistent storage and acts as the internal image registry. Secrets Manager is used to securely manage sensitive credentials and certificates, ensuring tighter control over access and authentication. Observability is delivered through Cloud Monitoring, Cloud Logs, and Activity Tracker, while regulatory compliance is supported via Security and Compliance Center and Workload Protection. These integrated capabilities work together to deliver a resilient and well-governed OpenShift environment. -This solution provisions a Red Hat OpenShift cluster within a highly configurable Virtual Private Cloud (VPC) environment. Users can opt to use an existing Virtual Private Cloud (VPC) or create a new one using the Cloud foundation for VPC module, which supports both single-zone and multi-zone configurations. By default, a three-zone setup is provisioned to ensure high availability, with a single worker pool spanning all zones and two worker nodes per zone. Additional worker pools can be added easily via configurable variables. The cluster requires a Cloud Object Storage (COS) instance, where a dedicated object storage bucket is used as the internal registry. Cluster and boot volume encryption is enforced using Key Management Services (KMS), enhancing data security. +The solution provisions a Red Hat OpenShift cluster within an IBM Cloud VPC, using a default three-zone configuration for high availability. It deploys a single worker pool across all zones, with two worker nodes per zone by default, and allows easy scaling through configurable variables. Cluster and boot volume encryption are enforced, and a dedicated object storage bucket is required to host the internal image registry. This setup ensures strong data protection and infrastructure reliability from the start. -To support operational visibility and compliance, optional services such as Cloud Automation for Observability and Secrets Manager can be enabled. These provide centralized logging, monitoring, and certificate management, ensuring better control over system health and sensitive credentials. This deployable architecture delivers a secure, resilient, and extensible platform for deploying enterprise-grade Red Hat OpenShift workloads in IBM Cloud. +While this architecture is designed to function independently, it also serves as a flexible foundation for more advanced use cases. It supports seamless integration with Cloud Automation for Red Hat OpenShift AI, enabling organizations to deploy AI-driven workloads and accelerate innovation. With its secure, extensible design and managed cloud services, the solution helps enterprises reduce operational complexity and deliver critical applications faster within a governed Red Hat OpenShift ecosystem. ## Architecture diagram {: #ra-ocp-fully-configurable-architecture-diagram} From eac738b7794ae6c0e6e1cd4f6d3cd4bae3afd743 Mon Sep 17 00:00:00 2001 From: Prateek-Sharma13 Date: Fri, 5 Sep 2025 15:28:27 +0530 Subject: [PATCH 05/13] addressed review comments and updated text for fc variation --- .../deploy-arch-ibm-ocp-fully-configurable.md | 117 ++++++++++++++++-- 1 file changed, 110 insertions(+), 7 deletions(-) diff --git a/reference-architecture/deploy-arch-ibm-ocp-fully-configurable.md b/reference-architecture/deploy-arch-ibm-ocp-fully-configurable.md index 6a757552..044bcd72 100644 --- a/reference-architecture/deploy-arch-ibm-ocp-fully-configurable.md +++ b/reference-architecture/deploy-arch-ibm-ocp-fully-configurable.md @@ -28,7 +28,7 @@ docs: https://github.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/blob/m image_source: https://github.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/blob/main/reference-architecture/deployable-architecture-ocp-cluster.svg related_links: - - title: "Cloud automation for Red Hat OpenShift Container Platform on VPC" + - title: "Landing zone for containerized applications with OpenShift" url: "https://cloud.ibm.com/docs/deployable-reference-architectures?topic=deployable-reference-architectures-ocp-fully-configurable" description: "A deployable architecture that delivers a scalable and flexible Red Hat OpenShift environment on IBM Cloud Virtual Private Cloud (VPC), with seamless integration to security, observability, and other foundational services for containerized workloads." @@ -42,7 +42,7 @@ content-type: reference-architecture {{site.data.keyword.attribute-definition-list}} -# Cloud automation for Red Hat OpenShift Container Platform on VPC - Standard - Integrated setup with configurable services +# Landing zone for containerized applications with OpenShift - Standard - Integrated setup with configurable services {: #ocp-fully-configurable} {: toc-content-type="reference-architecture"} {: toc-industry="Banking,FinancialSector"} @@ -50,7 +50,7 @@ content-type: reference-architecture {: toc-compliance="FedRAMP"} {: toc-version="1.1.0"} -Cloud Automation for Red Hat OpenShift on Virtual Private Cloud (VPC) provides a scalable, secure, and production-ready foundation for deploying containerized applications on IBM Cloud. It comes integrated by default with several IBM Cloud services to enhance security, observability, and compliance. Data encryption is enforced using Key Protect and Key Management Services (KMS), while Cloud Object Storage (COS) supports persistent storage and acts as the internal image registry. Secrets Manager is used to securely manage sensitive credentials and certificates, ensuring tighter control over access and authentication. Observability is delivered through Cloud Monitoring, Cloud Logs, and Activity Tracker, while regulatory compliance is supported via Security and Compliance Center and Workload Protection. These integrated capabilities work together to deliver a resilient and well-governed OpenShift environment. +Landing zone for containerized applications with OpenShift provides a scalable, secure, and production-ready foundation for deploying containerized applications on IBM Cloud. It comes integrated by default with several IBM Cloud services to enhance security, observability, and compliance. Data encryption is enforced using Key Protect and Key Management Services (KMS), while Cloud Object Storage (COS) supports persistent storage and acts as the internal image registry. Secrets Manager is used to securely manage sensitive credentials and certificates, ensuring tighter control over access and authentication. Observability is delivered through Cloud Monitoring, Cloud Logs, and Activity Tracker, while regulatory compliance is supported via Security and Compliance Center and Workload Protection. These integrated capabilities work together to deliver a resilient and well-governed OpenShift environment. The solution provisions a Red Hat OpenShift cluster within an IBM Cloud VPC, using a default three-zone configuration for high availability. It deploys a single worker pool across all zones, with two worker nodes per zone by default, and allows easy scaling through configurable variables. Cluster and boot volume encryption are enforced, and a dedicated object storage bucket is required to host the internal image registry. This setup ensures strong data protection and infrastructure reliability from the start. @@ -59,12 +59,12 @@ While this architecture is designed to function independently, it also serves as ## Architecture diagram {: #ra-ocp-fully-configurable-architecture-diagram} -![Architecture diagram for the Fully configurable variation of Cloud automation for Red Hat OpenShift Container Platform on VPC](deployable-architecture-ocp-cluster.svg "Architecture diagram of Fully configurable variation of Cloud automation for Red Hat OpenShift Container Platform on VPC deployable architecture"){: caption="Figure 1. Fully configurable variation of Cloud automation for Red Hat OpenShift Container Platform on VPC" caption-side="bottom"}{: external download="deployable-architecture-ocp-cluster.svg"} +![Architecture diagram for the Standard - Integrated setup with configurable services variation of Landing zone for containerized applications with OpenShift](deployable-architecture-ocp-cluster.svg "Architecture diagram of Standard - Integrated setup with configurable services variation of Landing zone for containerized applications with OpenShift deployable architecture"){: caption="Figure 1. Standard - Integrated setup with configurable services variation of Landing zone for containerized applications with OpenShift" caption-side="bottom"}{: external download="deployable-architecture-ocp-cluster.svg"} ## Design concepts {: #ra-ocp-fully-configurable-design-concepts} -![Design requirements for Red Hat OpenShift Container Platform on VPC](heat-map-deploy-arch-ocp-fully-configurable.svg "Design concepts"){: caption="Figure 2. Scope of the design concepts" caption-side="bottom"} +![Design requirements for Landing zone for containerized applications with OpenShift](heat-map-deploy-arch-ocp-fully-configurable.svg "Design concepts"){: caption="Figure 2. Scope of the design concepts" caption-side="bottom"} ## Requirements {: #ra-ocp-fully-configurable-requirements} @@ -73,8 +73,8 @@ The following table outlines the requirements that are addressed in this archite | Aspect | Requirements | |---|---| -| Compute | Kubernetes cluster with minimal machine size and nodes, suitable for low-cost demonstration and development | -| Storage | Kubernetes cluster registry backup (required) | +| Compute | Openshift cluster with minimal machine size and nodes, suitable for low-cost demonstration and development | +| Storage | Openshift cluster registry backup (required) | | Networking | * Multiple VPCs for network isolation. \n * All public inbound and outbound traffic allowed to VPCs. \n * Administration of cluster allowed from public endpoint and web console. \n * Load balancer for cluster workload services. \n * Outbound internet access from cluster. \n * Private network connection between VPCs. | | Security | * Encryption of all application data in transit and at rest to protect it from unauthorized disclosure. \n * Storage and management of all encryption keys. \n * Protect cluster administration access through IBM Cloud security protocols. | | Service Management | Automated deployment of infrastructure with IBM Cloud catalog | @@ -92,3 +92,106 @@ The following table outlines the products or services used in the architecture f | Networking | * VPC Load Balancer \n * Public Gateway \n * Transit Gateway | * Application load balancing for cluster workloads (automatically created by Red Hat OpenShift service for multi-zone cluster) \n * Cluster access to the internet \n * Private network connectivity between management and workload VPCs | | Security | * IAM \n * Key Protect | * IBM Cloud Identity and Access Management \n * Management of encryption keys used by Red Hat OpenShift Container Platform | {: caption="Table 2. Components" caption-side="bottom"} + +### Cluster architecture decisions +{: #ra-ocp-fully-configurable-components-cluster} + +| Requirement | Component | Reasons for choice | Alternative choice | +|-------------|-----------|--------------------|--------------------| +| * High availability across zones \n * Fault tolerance for workloads | Multi-zone Red Hat OpenShift cluster | Provides built-in resiliency by distributing worker nodes across three zones | Deploy single-zone clusters with lower availability | +| * Scalable worker infrastructure \n * Cost optimization | Worker pools with configurable node counts | Flexibility to scale nodes horizontally and vertically | Fixed-size clusters with no scaling options | +| * Persistent storage for internal registry | Cloud Object Storage | Highly durable, encrypted, and cost-efficient storage | File or block storage solutions with higher cost | + +{: caption="Cluster architecture decisions" caption-side="bottom"} + +### Networking architecture decisions +{: #ra-ocp-fully-configurable-components-networking} + +| Requirement | Component | Reasons for choice | Alternative choice | +|-------------|-----------|--------------------|--------------------| +| * Enable application traffic distribution \n * Support external workloads | VPC Load Balancer | Provides managed ingress and load balancing | Third-party ingress controllers | +| * Secure connectivity to the internet | Public gateways | Allow outbound connectivity for cluster nodes | Private-only clusters with no internet access | +| * Multi-VPC communication \n * Hub-and-spoke models | Transit Gateway | Provides secure, private connectivity across VPCs | Use VPN gateways or Direct Link | + +{: caption="Networking architecture decisions" caption-side="bottom"} + +### Security and compliance architecture decisions +{: #ra-ocp-fully-configurable-components-security} + +| Requirement | Component | Reasons for choice | Alternative choice | +|-------------|-----------|--------------------|--------------------| +| * Encryption of data at rest \n * Key lifecycle management | Key Protect | Centralized management of encryption keys | Bring Your Own Key (BYOK) solutions | +| * Secure secrets and credentials management | Secrets Manager | Centralized storage and rotation of sensitive credentials | Store secrets directly in OpenShift etcd | +| * Strong authentication and authorization | IAM | Fine-grained access control across users and services | Local OpenShift RBAC only | + +{: caption="Security and compliance architecture decisions" caption-side="bottom"} + +### Flexibility and customization architecture decisions +{: #ra-ocp-fully-configurable-components-flexibility} + +| Requirement | Component | Reasons for choice | Alternative choice | +|-------------|-----------|--------------------|--------------------| +| * Support scaling workloads \n * Enable hybrid deployments | Configurable worker pools | Scale worker nodes to match workload demand | Static cluster sizes | +| * Meet diverse compliance requirements \n * Enable observability integration | Cloud Monitoring, Cloud Logs, Activity Tracker | Provides enterprise-grade visibility and compliance reporting | Third-party monitoring tools | +| * Enable AI-ready workloads | Integration with Cloud Automation for Red Hat OpenShift AI | Prepares foundation for AI/ML use cases | Manual setup of AI services | + +{: caption="Flexibility and customization architecture decisions" caption-side="bottom"} + +## Key features +{: #ra-ocp-fully-configurable-features} + +The Standard - Integrated setup with configurable services variation of Landing zone for containerized applications with OpenShift provides comprehensive capabilities across: + +## Red Hat OpenShift Cluster + +- **Cluster creation and configuration**: Creates a Red Hat OpenShift cluster on IBM Cloud to manage containerized applications at scale. +- **Enterprise-grade features**: Integrated security, scalability, automation, and compliance-ready capabilities. +- **Multi-zone deployment**: By default, deployed across three zones for high availability. + +## Worker pools + +- **Customizable worker pools**: Group and manage worker nodes with similar compute configurations. +- **Scalability**: Supports horizontal scaling of worker pools and adjustment of machine profiles. +- **High availability**: Worker nodes can be distributed across multiple zones for resilience. + +## Access endpoints + +- **Public and Private connectivity**: Offers private and public service endpoints. +- **Enhanced security**: Private-only endpoints can be enabled to restrict access to trusted networks. +- **Administrative flexibility**: Secure cluster management via CLI, API, or web console. + +## Ingress controller + +- **Traffic management**: Deploys ingress controllers to route external traffic to the correct workloads. +- **TLS termination**: Supports secure HTTPS traffic termination at ingress. +- **Extensibility**: Configurable for custom ingress domains and certificates. + +## Object Storage + +- **Cluster registry storage**: Configures IBM Cloud Object Storage buckets for OpenShift’s internal image registry. +- **Flexible provisioning**: Use an existing COS instance or create a new one automatically. +- **Resilience**: Supports durable storage with regional resiliency. + +## KMS encryption + +- **Boot volume and cluster encryption**: Optionally integrates with Key Protect or Hyper Protect Crypto Services. +- **Flexible key options**: Supports creating new encryption keys or using existing ones. +- **Compliance support**: Ensures data at rest is protected in line with regulatory standards. + +## Secrets Manager + +- **Centralized credential management**: Optionally integrates with IBM Cloud Secrets Manager. +- **Certificate lifecycle management**: Store and manage ingress subdomain TLS certificates. +- **Enhanced governance**: Fine-grained access controls for secret usage. + +## Observability + +- **Integrated logging and monitoring**: Optional setup with Cloud Monitoring, Cloud Logs, and Activity Tracker. +- **Event routing**: Centralize cluster and workload events for compliance and operations. +- **Scalable telemetry**: Ready to integrate with enterprise observability stacks. + +### Kube Audit + +- **API activity monitoring**: Captures Kubernetes API server events such as user actions and configuration changes. +- Compliance assurance: Provides audit trails aligned with FedRAMP and enterprise security requirements. +- Centralized visibility: Events routed to observability and SIEM platforms for investigation. From a82e6d49bde8f38090fe5122cb2ed19c12690076 Mon Sep 17 00:00:00 2001 From: Prateek-Sharma13 Date: Fri, 5 Sep 2025 15:37:48 +0530 Subject: [PATCH 06/13] updated heatmap --- .../heat-map-deploy-arch-ocp-fully-configurable.svg | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/reference-architecture/heat-map-deploy-arch-ocp-fully-configurable.svg b/reference-architecture/heat-map-deploy-arch-ocp-fully-configurable.svg index ae70b7c8..54232063 100644 --- a/reference-architecture/heat-map-deploy-arch-ocp-fully-configurable.svg +++ b/reference-architecture/heat-map-deploy-arch-ocp-fully-configurable.svg @@ -1 +1,4 @@ -
Application
integration
Application...
Mobile
Mobile
Bare metal servers
Bare metal servers
Primary storage
Primary storage
Enterprise
connectivity
Enterprise...
Build & test
Build & test
Data security
Data security
Backup & restore
Backup & restore
Monitoring
Monitoring
Edge
Edge
Blockchain
Blockchain
Enterprise
applications
Enterprise...
Data Ops
Data Ops
Data analytics
Data analytics
Data storage
Data storage
Business intelligence
Business intelligence
Virtual servers
Virtual servers
Virtualization
Virtualization
Containers
Containers
Cloud Foundry
Cloud Foundry
Serverless
Serverless
Backup
Backup
Archive
Archive
Data migration
Data migration
BYOIP/Edge gateways
BYOIP/Edge gateways
Load balancing
Load balancing
Cloud native connectivity
Cloud native connecti...
Isolation
Isolation
Content delivery network
Content delivery netw...
Domain name service
Domain name service
Identity & access
Identity & access
Application security
Application security
Infrastructure & endpoints
Infrastructure & endp...
Threat detection & response
Threat detection & re...
Governance, risk & compliance
Governance, risk & co...
Delivery pipeline
Delivery pipeline
Code repository
Code repository
Disaster recovery
Disaster recovery
High availability
High availability
Logging
Logging
Auditing/tracking
Auditing/tracking
Alerting
Alerting
Event management
Event management
Automated deployment
Automated deployment
Management/
orchestration
Management/...
Domain
Domain
Aspect
Aspect
Application
platforms
Application...
Data
Data
Compute
Compute
Storage
Storage
Networking
Networking
Security
Security
DevOps
DevOps
Resiliency
Resiliency
Service
management
Service...
Included in this architecture
Included in this...
Artificial intelligence
Artificial intelligen...Text is not SVG - cannot display \ No newline at end of file + + + +
Application
integration
Mobile
Bare metal servers
Primary storage
Enterprise
connectivity
Build & test
Data security
Backup & restore
Monitoring
Edge
Blockchain
Enterprise
applications
Data Ops
Data analytics
Data storage
Business intelligence
Virtual servers
Virtualization
Containers
Cloud Foundry
Serverless
Backup
Archive
Data migration
BYOIP/Edge gateways
Load balancing
Cloud native connectivity
Isolation
Content delivery network
Domain name service
Identity & access
Application security
Infrastructure & endpoints
Threat detection & response
Governance, risk & compliance
Delivery pipeline
Code repository
Disaster recovery
High availability
Logging
Auditing/tracking
Alerting
Event management
Automated deployment
Management/
orchestration
Domain
Aspect
Application
platforms
Data
Compute
Storage
Networking
Security
DevOps
Resiliency
Service
management
Included in this architecture
Artificial intelligence
 \ No newline at end of file From cfa374a91c767421458f6ce0a7b6e0f4b00856f2 Mon Sep 17 00:00:00 2001 From: Prateek-Sharma13 Date: Fri, 5 Sep 2025 15:47:06 +0530 Subject: [PATCH 07/13] renamed directory to reference-architectures --- ibm_catalog.json | 4 ++-- .../deploy-arch-ibm-ocp-fully-configurable.md | 4 ++-- .../deploy-arch-ibm-ocp-quickstart.md | 4 ++-- .../deployable-architecture-ocp-cluster-qs.svg | 0 .../deployable-architecture-ocp-cluster.svg | 0 .../heat-map-deploy-arch-ocp-fully-configurable.svg | 0 .../heat-map-deploy-arch-ocp-quickstart.svg | 0 7 files changed, 6 insertions(+), 6 deletions(-) rename {reference-architecture => reference-architectures}/deploy-arch-ibm-ocp-fully-configurable.md (98%) rename {reference-architecture => reference-architectures}/deploy-arch-ibm-ocp-quickstart.md (96%) rename {reference-architecture => reference-architectures}/deployable-architecture-ocp-cluster-qs.svg (100%) rename {reference-architecture => reference-architectures}/deployable-architecture-ocp-cluster.svg (100%) rename {reference-architecture => reference-architectures}/heat-map-deploy-arch-ocp-fully-configurable.svg (100%) rename {reference-architecture => reference-architectures}/heat-map-deploy-arch-ocp-quickstart.svg (100%) diff --git a/ibm_catalog.json b/ibm_catalog.json index 343d9ac9..27b4a879 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -222,7 +222,7 @@ { "diagram": { "caption": "Red Hat OpenShift cluster topology", - "url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/refs/heads/main/reference-architecture/deployable-architecture-ocp-cluster.svg", + "url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/refs/heads/main/reference-architectures/deployable-architecture-ocp-cluster.svg", "type": "image/svg+xml" }, "description": "This architecture supports creation of Red Hat OpenShift cluster within a Virtual Private Cloud (VPC).

You can create a fully-configured VPC by selecting the [Cloud automation for VPC](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-vpc-2af61763-f8ef-4527-a815-b92166f29bc8-global) dependency or you can use an existing VPC if any. The VPC can be provisioned either in a single-zone or multi-zone configuration, depending on your availability requirements. By default, the VPC addon provisions a three-zone VPC, forming the foundation for your OpenShift cluster. This cluster includes a single worker pool distributed across all three zones, with two worker nodes per zone. If you need additional worker pools, you can easily configure them using the additional_worker_pools variable.

A Cloud Object Storage (COS) instance is required for this topology. Within this instance, an Object Storage bucket will be created, which serves as the internal registry storage for the OpenShift cluster. The [Cloud automation for Object Storage](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-cos-68921490-2778-4930-ac6d-bae7be6cd958-global) architecture supports the creation of COS instance. Additionally, Key Management Services(KMS) is used to encrypt the cluster and the boot volumes used by the cluster to enhance security.

For logging and monitoring needs, you can enable Observability for your cluster. [Cloud automation for Observability](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-observability-a3137d28-79e0-479d-8a24-758ebd5a0eab-global) provides advanced monitoring, logging, and operational insights into the performance and health of your deployment.

Secrets Manager Integration can also be enabled using [Cloud automation for Secrets Manager](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-secrets-manager-6d6ebc76-7bbd-42f5-8bc7-78f4fabd5944-global) for centrally managing Ingress subdomain certificates, ensuring secure management of sensitive credentials.

This architecture provides a robust and secure foundation for deploying and managing your Red Hat OpenShift cluster, enabling seamless integration, enhanced security, and comprehensive monitoring for your cloud-native applications." @@ -1175,7 +1175,7 @@ { "diagram": { "caption": "Red Hat OpenShift cluster topology - Quickstart", - "url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/refs/heads/main/reference-architecture/deployable-architecture-ocp-cluster-qs.svg", + "url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/refs/heads/main/reference-architectures/deployable-architecture-ocp-cluster-qs.svg", "type": "image/svg+xml" }, "description": "This deployable architecture enables deployment of a Red Hat OpenShift cluster within an IBM Cloud Virtual Private Cloud (VPC). It provisions the OpenShift cluster and its foundational VPC infrastructure with a limited set of essential options for rapid and streamlined setup. Additionally, the deployment creates an Object Storage bucket that serves as the internal container image registry for the OpenShift cluster. Thus, it helps ensure seamless storage integration.

Users can select from predefined cluster sizes — mini (default), small, medium, and large. Each size determines the number of availability zones, worker nodes per zone, and the machine type (worker node flavor). [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/blob/main/solutions/quickstart/DA_docs.md).

By default, the architecture provisions a two-zone VPC, forming the foundation for the OpenShift cluster. The cluster comprises a single worker pool distributed across these zones, with two worker nodes per zone in the mini configuration.

This streamlined architecture balances ease of use with flexibility, enabling rapid OpenShift cluster deployments with the infrastructure, integrated storage services, and right-sized compute resources of IBM Cloud." diff --git a/reference-architecture/deploy-arch-ibm-ocp-fully-configurable.md b/reference-architectures/deploy-arch-ibm-ocp-fully-configurable.md similarity index 98% rename from reference-architecture/deploy-arch-ibm-ocp-fully-configurable.md rename to reference-architectures/deploy-arch-ibm-ocp-fully-configurable.md index 044bcd72..98ca2572 100644 --- a/reference-architecture/deploy-arch-ibm-ocp-fully-configurable.md +++ b/reference-architectures/deploy-arch-ibm-ocp-fully-configurable.md @@ -23,9 +23,9 @@ production: true # See https://test.cloud.ibm.com/docs/get-coding?topic=get-coding-deploy-button deployment-url: https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-ocp-vpc-1728a4fd-f561-4cf9-82ef-2b1eeb5da1a8-global -docs: https://github.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/blob/main/reference-architecture/deploy-arch-ibm-ocp-fully-configurable.md +docs: https://github.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/blob/main/reference-architectures/deploy-arch-ibm-ocp-fully-configurable.md -image_source: https://github.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/blob/main/reference-architecture/deployable-architecture-ocp-cluster.svg +image_source: https://github.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/blob/main/reference-architectures/deployable-architecture-ocp-cluster.svg related_links: - title: "Landing zone for containerized applications with OpenShift" diff --git a/reference-architecture/deploy-arch-ibm-ocp-quickstart.md b/reference-architectures/deploy-arch-ibm-ocp-quickstart.md similarity index 96% rename from reference-architecture/deploy-arch-ibm-ocp-quickstart.md rename to reference-architectures/deploy-arch-ibm-ocp-quickstart.md index f8659eba..e4796e82 100644 --- a/reference-architecture/deploy-arch-ibm-ocp-quickstart.md +++ b/reference-architectures/deploy-arch-ibm-ocp-quickstart.md @@ -24,9 +24,9 @@ production: true # See https://test.cloud.ibm.com/docs/get-coding?topic=get-coding-deploy-button deployment-url: https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-ocp-vpc-1728a4fd-f561-4cf9-82ef-2b1eeb5da1a8-global -docs: https://github.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/blob/main/reference-architecture/deploy-arch-ibm-ocp-quickstart.md +docs: https://github.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/blob/main/reference-architectures/deploy-arch-ibm-ocp-quickstart.md -image_source: https://github.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/blob/main/reference-architecture/deployable-architecture-ocp-cluster-qs.svg +image_source: https://github.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/blob/main/reference-architectures/deployable-architecture-ocp-cluster-qs.svg related_links: - title: "Cloud automation for Red Hat OpenShift Container Platform on VPC" diff --git a/reference-architecture/deployable-architecture-ocp-cluster-qs.svg b/reference-architectures/deployable-architecture-ocp-cluster-qs.svg similarity index 100% rename from reference-architecture/deployable-architecture-ocp-cluster-qs.svg rename to reference-architectures/deployable-architecture-ocp-cluster-qs.svg diff --git a/reference-architecture/deployable-architecture-ocp-cluster.svg b/reference-architectures/deployable-architecture-ocp-cluster.svg similarity index 100% rename from reference-architecture/deployable-architecture-ocp-cluster.svg rename to reference-architectures/deployable-architecture-ocp-cluster.svg diff --git a/reference-architecture/heat-map-deploy-arch-ocp-fully-configurable.svg b/reference-architectures/heat-map-deploy-arch-ocp-fully-configurable.svg similarity index 100% rename from reference-architecture/heat-map-deploy-arch-ocp-fully-configurable.svg rename to reference-architectures/heat-map-deploy-arch-ocp-fully-configurable.svg diff --git a/reference-architecture/heat-map-deploy-arch-ocp-quickstart.svg b/reference-architectures/heat-map-deploy-arch-ocp-quickstart.svg similarity index 100% rename from reference-architecture/heat-map-deploy-arch-ocp-quickstart.svg rename to reference-architectures/heat-map-deploy-arch-ocp-quickstart.svg From 11cd2d4cf12f399e818bf0fd068076d26e71af7d Mon Sep 17 00:00:00 2001 From: Prateek-Sharma13 Date: Fri, 5 Sep 2025 15:53:29 +0530 Subject: [PATCH 08/13] fixed image issue --- .../heat-map-deploy-arch-ocp-fully-configurable.svg | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/reference-architectures/heat-map-deploy-arch-ocp-fully-configurable.svg b/reference-architectures/heat-map-deploy-arch-ocp-fully-configurable.svg index 54232063..ae70b7c8 100644 --- a/reference-architectures/heat-map-deploy-arch-ocp-fully-configurable.svg +++ b/reference-architectures/heat-map-deploy-arch-ocp-fully-configurable.svg @@ -1,4 +1 @@ - - - -
Application
integration
Mobile
Bare metal servers
Primary storage
Enterprise
connectivity
Build & test
Data security
Backup & restore
Monitoring
Edge
Blockchain
Enterprise
applications
Data Ops
Data analytics
Data storage
Business intelligence
Virtual servers
Virtualization
Containers
Cloud Foundry
Serverless
Backup
Archive
Data migration
BYOIP/Edge gateways
Load balancing
Cloud native connectivity
Isolation
Content delivery network
Domain name service
Identity & access
Application security
Infrastructure & endpoints
Threat detection & response
Governance, risk & compliance
Delivery pipeline
Code repository
Disaster recovery
High availability
Logging
Auditing/tracking
Alerting
Event management
Automated deployment
Management/
orchestration
Domain
Aspect
Application
platforms
Data
Compute
Storage
Networking
Security
DevOps
Resiliency
Service
management
Included in this architecture
Artificial intelligence
 \ No newline at end of file +
Application
integration
Application...
Mobile
Mobile
Bare metal servers
Bare metal servers
Primary storage
Primary storage
Enterprise
connectivity
Enterprise...
Build & test
Build & test
Data security
Data security
Backup & restore
Backup & restore
Monitoring
Monitoring
Edge
Edge
Blockchain
Blockchain
Enterprise
applications
Enterprise...
Data Ops
Data Ops
Data analytics
Data analytics
Data storage
Data storage
Business intelligence
Business intelligence
Virtual servers
Virtual servers
Virtualization
Virtualization
Containers
Containers
Cloud Foundry
Cloud Foundry
Serverless
Serverless
Backup
Backup
Archive
Archive
Data migration
Data migration
BYOIP/Edge gateways
BYOIP/Edge gateways
Load balancing
Load balancing
Cloud native connectivity
Cloud native connecti...
Isolation
Isolation
Content delivery network
Content delivery netw...
Domain name service
Domain name service
Identity & access
Identity & access
Application security
Application security
Infrastructure & endpoints
Infrastructure & endp...
Threat detection & response
Threat detection & re...
Governance, risk & compliance
Governance, risk & co...
Delivery pipeline
Delivery pipeline
Code repository
Code repository
Disaster recovery
Disaster recovery
High availability
High availability
Logging
Logging
Auditing/tracking
Auditing/tracking
Alerting
Alerting
Event management
Event management
Automated deployment
Automated deployment
Management/
orchestration
Management/...
Domain
Domain
Aspect
Aspect
Application
platforms
Application...
Data
Data
Compute
Compute
Storage
Storage
Networking
Networking
Security
Security
DevOps
DevOps
Resiliency
Resiliency
Service
management
Service...
Included in this architecture
Included in this...
Artificial intelligence
Artificial intelligen...Text is not SVG - cannot display \ No newline at end of file From 0905d6409e2a613569cd45f0684403d582f0ca7a Mon Sep 17 00:00:00 2001 From: Prateek-Sharma13 Date: Sat, 6 Sep 2025 18:44:38 +0530 Subject: [PATCH 09/13] addressed issue comments --- .../deploy-arch-ibm-ocp-fully-configurable.md | 6 +++--- .../deploy-arch-ibm-ocp-quickstart.md | 18 +++++++++--------- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/reference-architectures/deploy-arch-ibm-ocp-fully-configurable.md b/reference-architectures/deploy-arch-ibm-ocp-fully-configurable.md index 98ca2572..1ebba8f6 100644 --- a/reference-architectures/deploy-arch-ibm-ocp-fully-configurable.md +++ b/reference-architectures/deploy-arch-ibm-ocp-fully-configurable.md @@ -12,7 +12,7 @@ authors: - name: "Prateek Sharma" # The release that the reference architecture describes -version: 3.55.6 +version: 3.57.0 # Whether the reference architecture is published to Cloud Docs production. # When set to false, the file is available only in staging. Default is false. @@ -23,7 +23,7 @@ production: true # See https://test.cloud.ibm.com/docs/get-coding?topic=get-coding-deploy-button deployment-url: https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-ocp-vpc-1728a4fd-f561-4cf9-82ef-2b1eeb5da1a8-global -docs: https://github.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/blob/main/reference-architectures/deploy-arch-ibm-ocp-fully-configurable.md +docs: https://cloud.ibm.com/docs/secure-infrastructure-vpc image_source: https://github.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/blob/main/reference-architectures/deployable-architecture-ocp-cluster.svg @@ -48,7 +48,7 @@ content-type: reference-architecture {: toc-industry="Banking,FinancialSector"} {: toc-use-case="Cybersecurity"} {: toc-compliance="FedRAMP"} -{: toc-version="1.1.0"} +{: toc-version="3.57.0"} Landing zone for containerized applications with OpenShift provides a scalable, secure, and production-ready foundation for deploying containerized applications on IBM Cloud. It comes integrated by default with several IBM Cloud services to enhance security, observability, and compliance. Data encryption is enforced using Key Protect and Key Management Services (KMS), while Cloud Object Storage (COS) supports persistent storage and acts as the internal image registry. Secrets Manager is used to securely manage sensitive credentials and certificates, ensuring tighter control over access and authentication. Observability is delivered through Cloud Monitoring, Cloud Logs, and Activity Tracker, while regulatory compliance is supported via Security and Compliance Center and Workload Protection. These integrated capabilities work together to deliver a resilient and well-governed OpenShift environment. diff --git a/reference-architectures/deploy-arch-ibm-ocp-quickstart.md b/reference-architectures/deploy-arch-ibm-ocp-quickstart.md index e4796e82..18e06c85 100644 --- a/reference-architectures/deploy-arch-ibm-ocp-quickstart.md +++ b/reference-architectures/deploy-arch-ibm-ocp-quickstart.md @@ -12,7 +12,7 @@ authors: - name: "Prateek Sharma" # The release that the reference architecture describes -version: 3.55.6 +version: 3.57.0 # Whether the reference architecture is published to Cloud Docs production. # When set to false, the file is available only in staging. Default is false. @@ -24,12 +24,12 @@ production: true # See https://test.cloud.ibm.com/docs/get-coding?topic=get-coding-deploy-button deployment-url: https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-ocp-vpc-1728a4fd-f561-4cf9-82ef-2b1eeb5da1a8-global -docs: https://github.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/blob/main/reference-architectures/deploy-arch-ibm-ocp-quickstart.md +docs: https://cloud.ibm.com/docs/secure-infrastructure-vpc image_source: https://github.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/blob/main/reference-architectures/deployable-architecture-ocp-cluster-qs.svg related_links: - - title: "Cloud automation for Red Hat OpenShift Container Platform on VPC" + - title: "Landing zone for containerized applications with OpenShift" url: "https://cloud.ibm.com/docs/secure-infrastructure-vpc?topic=secure-infrastructure-vpc-ocp-ra" description: "A deployable architecture solution that is based on the IBM Cloud for Financial Services reference architecture. This solution delivers a scalable and flexible Red Hat OpenShift environment on IBM Cloud Virtual Private Cloud (VPC), with seamless integration to security, observability, and other foundational services for containerized workloads." @@ -42,24 +42,24 @@ content-type: reference-architecture {{site.data.keyword.attribute-definition-list}} -# Cloud automation for Red Hat OpenShift Container Platform on VPC - QuickStart variation -{: #roks-ra-qs} +# Landing zone for containerized applications with OpenShift - QuickStart variation +{: #ocp-ra-qs} {: toc-content-type="reference-architecture"} {: toc-industry="Banking,FinancialSector"} {: toc-use-case="Cybersecurity"} -{: toc-version="6.6.0"} +{: toc-version="3.57.0"} -The QuickStart variation of the Cloud automation for Red Hat OpenShift Container Platform on VPC deployable architecture creates a fully customizable Virtual Private Cloud (VPC) environment in a single region. The solution provides a single Red Hat OpenShift cluster in a secure VPC for your workloads. The QuickStart variation is designed to deploy quickly for demonstration and development. +The QuickStart variation of the Landing zone for containerized applications with OpenShift deployable architecture creates a fully customizable Virtual Private Cloud (VPC) environment in a single region. The solution provides a single Red Hat OpenShift cluster in a secure VPC for your workloads. The QuickStart variation is designed to deploy quickly for demonstration and development. ## Architecture diagram {: #ra-ocp-qs-architecture-diagram} -![Architecture diagram for the QuickStart variation of Cloud automation for Red Hat OpenShift Container Platform on VPC](deployable-architecture-ocp-cluster-qs.svg "Architecture diagram of QuickStart variation of Cloud automation for Red Hat OpenShift Container Platform on VPC deployable architecture"){: caption="Figure 1. QuickStart variation of Cloud automation for Red Hat OpenShift Container Platform on VPC" caption-side="bottom"}{: external download="deployable-architecture-ocp-cluster-qs.svg"} +![Architecture diagram for the QuickStart variation of Landing zone for containerized applications with OpenShift](deployable-architecture-ocp-cluster-qs.svg "Architecture diagram of QuickStart variation of Landing zone for containerized applications with OpenShift deployable architecture"){: caption="Figure 1. QuickStart variation of Landing zone for containerized applications with OpenShift" caption-side="bottom"}{: external download="deployable-architecture-ocp-cluster-qs.svg"} ## Design concepts {: #ra-ocp-qs-design-concepts} -![Design requirements for Cloud automation for Red Hat OpenShift Container Platform on VPC](heat-map-deploy-arch-ocp-quickstart.svg "Design concepts"){: caption="Figure 2. Scope of the design concepts" caption-side="bottom"} +![Design requirements for Landing zone for containerized applications with OpenShift](heat-map-deploy-arch-ocp-quickstart.svg "Design concepts"){: caption="Figure 2. Scope of the design concepts" caption-side="bottom"} ## Requirements {: #ra-ocp-qs-requirements} From 79bc523b31aac3501f911505193f881f2de5e2a7 Mon Sep 17 00:00:00 2001 From: Prateek-Sharma13 Date: Mon, 8 Sep 2025 12:29:18 +0530 Subject: [PATCH 10/13] doc: updated related_links in both variations --- .../deploy-arch-ibm-ocp-fully-configurable.md | 13 +++++++++++-- .../deploy-arch-ibm-ocp-quickstart.md | 15 ++++++++++++--- 2 files changed, 23 insertions(+), 5 deletions(-) diff --git a/reference-architectures/deploy-arch-ibm-ocp-fully-configurable.md b/reference-architectures/deploy-arch-ibm-ocp-fully-configurable.md index 1ebba8f6..4bb353b4 100644 --- a/reference-architectures/deploy-arch-ibm-ocp-fully-configurable.md +++ b/reference-architectures/deploy-arch-ibm-ocp-fully-configurable.md @@ -28,9 +28,18 @@ docs: https://cloud.ibm.com/docs/secure-infrastructure-vpc image_source: https://github.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/blob/main/reference-architectures/deployable-architecture-ocp-cluster.svg related_links: - - title: "Landing zone for containerized applications with OpenShift" + - title: "Landing zone for containerized applications with OpenShift (Standard - Integrated setup with configurable services)" url: "https://cloud.ibm.com/docs/deployable-reference-architectures?topic=deployable-reference-architectures-ocp-fully-configurable" description: "A deployable architecture that delivers a scalable and flexible Red Hat OpenShift environment on IBM Cloud Virtual Private Cloud (VPC), with seamless integration to security, observability, and other foundational services for containerized workloads." + - title: "Landing zone for containerized applications with OpenShift (QuickStart - Basic and simple)" + url: "https://cloud.ibm.com/docs/secure-infrastructure-vpc?topic=secure-infrastructure-ocp-ra-qs" + description: "A deployable architecture solution that is based on the IBM Cloud for Financial Services reference architecture. This solution delivers a scalable and flexible Red Hat OpenShift environment on IBM Cloud Virtual Private Cloud (VPC), with seamless integration to security, observability, and other foundational services for containerized workloads." + - title: "Landing zone for containerized applications with OpenShift (Standard - Financial Services edition)" + url: "https://cloud.ibm.com/docs/deployable-reference-architectures?topic=deployable-reference-architectures-ocp-ra" + description: "A deployable architecture that creates a secure and compliant Red Hat OpenShift Container Platform workload clusters on a Virtual Private Cloud (VPC) network based on the IBM Cloud for Financial Services reference architecture." + - title: "Landing zone for containerized applications with OpenShift (QuickStart - Financial Services edition)" + url: "https://cloud.ibm.com/docs/deployable-reference-architectures?topic=deployable-reference-architectures-roks-ra-qs" + description: "An introductory, non-certified deployment aligned with the Financial Services Cloud VPCs topology. Not suitable for production workloads or upgrade paths." use-case: Cybersecurity industry: Banking,FinancialSector @@ -42,7 +51,7 @@ content-type: reference-architecture {{site.data.keyword.attribute-definition-list}} -# Landing zone for containerized applications with OpenShift - Standard - Integrated setup with configurable services +# Landing zone for containerized applications with OpenShift - Standard (Integrated setup with configurable services) variation {: #ocp-fully-configurable} {: toc-content-type="reference-architecture"} {: toc-industry="Banking,FinancialSector"} diff --git a/reference-architectures/deploy-arch-ibm-ocp-quickstart.md b/reference-architectures/deploy-arch-ibm-ocp-quickstart.md index 18e06c85..c2d4dcee 100644 --- a/reference-architectures/deploy-arch-ibm-ocp-quickstart.md +++ b/reference-architectures/deploy-arch-ibm-ocp-quickstart.md @@ -29,9 +29,18 @@ docs: https://cloud.ibm.com/docs/secure-infrastructure-vpc image_source: https://github.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/blob/main/reference-architectures/deployable-architecture-ocp-cluster-qs.svg related_links: - - title: "Landing zone for containerized applications with OpenShift" - url: "https://cloud.ibm.com/docs/secure-infrastructure-vpc?topic=secure-infrastructure-vpc-ocp-ra" + - title: "Landing zone for containerized applications with OpenShift (Standard - Integrated setup with configurable services)" + url: "https://cloud.ibm.com/docs/deployable-reference-architectures?topic=deployable-reference-architectures-ocp-fully-configurable" + description: "A deployable architecture that delivers a scalable and flexible Red Hat OpenShift environment on IBM Cloud Virtual Private Cloud (VPC), with seamless integration to security, observability, and other foundational services for containerized workloads." + - title: "Landing zone for containerized applications with OpenShift (QuickStart - Basic and simple)" + url: "https://cloud.ibm.com/docs/secure-infrastructure-vpc?topic=secure-infrastructure-ocp-ra-qs" description: "A deployable architecture solution that is based on the IBM Cloud for Financial Services reference architecture. This solution delivers a scalable and flexible Red Hat OpenShift environment on IBM Cloud Virtual Private Cloud (VPC), with seamless integration to security, observability, and other foundational services for containerized workloads." + - title: "Landing zone for containerized applications with OpenShift (Standard - Financial Services edition)" + url: "https://cloud.ibm.com/docs/deployable-reference-architectures?topic=deployable-reference-architectures-ocp-ra" + description: "A deployable architecture that creates a secure and compliant Red Hat OpenShift Container Platform workload clusters on a Virtual Private Cloud (VPC) network based on the IBM Cloud for Financial Services reference architecture." + - title: "Landing zone for containerized applications with OpenShift (QuickStart - Financial Services edition)" + url: "https://cloud.ibm.com/docs/deployable-reference-architectures?topic=deployable-reference-architectures-roks-ra-qs" + description: "An introductory, non-certified deployment aligned with the Financial Services Cloud VPCs topology. Not suitable for production workloads or upgrade paths." use-case: Cybersecurity industry: Banking,FinancialSector @@ -42,7 +51,7 @@ content-type: reference-architecture {{site.data.keyword.attribute-definition-list}} -# Landing zone for containerized applications with OpenShift - QuickStart variation +# Landing zone for containerized applications with OpenShift - QuickStart (Basic and simple) variation {: #ocp-ra-qs} {: toc-content-type="reference-architecture"} {: toc-industry="Banking,FinancialSector"} From 066b7d1de81ff20c01dfca1e175d05d321f697e0 Mon Sep 17 00:00:00 2001 From: Prateek-Sharma13 Date: Wed, 10 Sep 2025 16:44:50 +0530 Subject: [PATCH 11/13] refactor: resolved review comments --- ibm_catalog.json | 2 +- .../deploy-arch-ibm-ocp-fully-configurable.md | 12 ++++++------ .../deploy-arch-ibm-ocp-quickstart.md | 12 ++++++------ 3 files changed, 13 insertions(+), 13 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index 302e819f..953fe0bb 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -239,7 +239,7 @@ "url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/refs/heads/main/reference-architectures/deployable-architecture-ocp-cluster.svg", "type": "image/svg+xml" }, - "description": "This architecture supports creation of Red Hat OpenShift cluster within a Virtual Private Cloud (VPC).

You can create a fully-configured VPC by selecting the [Cloud automation for VPC](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-vpc-2af61763-f8ef-4527-a815-b92166f29bc8-global) dependency or you can use an existing VPC if any. The VPC can be provisioned either in a single-zone or multi-zone configuration, depending on your availability requirements. By default, the VPC addon provisions a three-zone VPC, forming the foundation for your OpenShift cluster. This cluster includes a single worker pool distributed across all three zones, with two worker nodes per zone. If you need additional worker pools, you can easily configure them using the additional_worker_pools variable.

A Cloud Object Storage (COS) instance is required for this topology. Within this instance, an Object Storage bucket will be created, which serves as the internal registry storage for the OpenShift cluster. The [Cloud automation for Object Storage](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-cos-68921490-2778-4930-ac6d-bae7be6cd958-global) architecture supports the creation of COS instance. Additionally, Key Management Services(KMS) is used to encrypt the cluster and the boot volumes used by the cluster to enhance security. In addition, you have an option to integrate with Observability services such as [Cloud automation for Cloud Monitoring](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-cloud-monitoring-73debdbf-894f-4c14-81c7-5ece3a70b67d-global) which provides robust monitoring capabilities and captures essential metrics such as CPU and memory utilization, helping you proactively monitor system performance and resource consumption, [Cloud automation for Activity Tracker Event Routing](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-activity-tracker-918453c3-4f97-4583-8c4a-83ef12fc7916-global) to monitor how users and applications interact with the cluster, supporting compliance and auditability, [Cloud automation for Cloud Logs](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-cloud-logs-63d8ae58-fbf3-41ce-b844-0fb5b85882ab-global) can be enabled to collect, view, and analyze platform logs related to the cluster and logs generated by applications deployed on the cluster.

Secrets Manager Integration can also be enabled using [Cloud automation for Secrets Manager](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-secrets-manager-6d6ebc76-7bbd-42f5-8bc7-78f4fabd5944-global) for centrally managing Ingress subdomain certificates, ensuring secure management of sensitive credentials.

This architecture provides a robust and secure foundation for deploying and managing your Red Hat OpenShift cluster, enabling seamless integration, enhanced security, and comprehensive monitoring for your cloud-native applications." + "description": "This architecture supports creation of Red Hat OpenShift cluster within a Virtual Private Cloud (VPC).

You can create a fully-configured VPC by selecting the [Cloud foundation for VPC](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-vpc-2af61763-f8ef-4527-a815-b92166f29bc8-global) as a dependency or you can use an existing VPC if any. You can set up a single zone or multi-zone VPC environment. You can configure the default number of worker pools to cater to worker nodes spread across different zones in this VPC cluster.

This architecture creates a Cloud Object Storage (COS) instance and an Object Storage bucket within this instance, to serve as the internal registry storage for the OpenShift cluster. The [Cloud automation for Object Storage](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-cos-68921490-2778-4930-ac6d-bae7be6cd958-global) architecture supports the creation of COS instance. Additionally, you can opt the following services to create a robust and secure foundation to deploy and manage your Red Hat OpenShift cluster.
- Key Management Services(KMS) is used to encrypt the cluster and the boot volumes used by the cluster to enhance security.
- Observability services such as [Cloud automation for Cloud Monitoring](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-cloud-monitoring-73debdbf-894f-4c14-81c7-5ece3a70b67d-global) to provide robust monitoring capabilities and capture essential metrics such as CPU and memory utilization, to help you proactively monitor system performance and resource consumption, [Cloud automation for Activity Tracker Event Routing](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-activity-tracker-918453c3-4f97-4583-8c4a-83ef12fc7916-global) to monitor how users and applications interact with the cluster, to support compliance and auditability, [Cloud automation for Cloud Logs](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-cloud-logs-63d8ae58-fbf3-41ce-b844-0fb5b85882ab-global) to collect, view, and analyze platform logs related to the cluster and logs generated by applications deployed on the cluster.
- [Secrets Manager](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-secrets-manager-6d6ebc76-7bbd-42f5-8bc7-78f4fabd5944-global) to centrally manage Ingress subdomain certificates, ensuring secure management of sensitive credentials.

Thus this architecture enables seamless integration, enhanced security, and comprehensive monitoring for your cloud-native applications." } ] }, diff --git a/reference-architectures/deploy-arch-ibm-ocp-fully-configurable.md b/reference-architectures/deploy-arch-ibm-ocp-fully-configurable.md index 4bb353b4..fdefb727 100644 --- a/reference-architectures/deploy-arch-ibm-ocp-fully-configurable.md +++ b/reference-architectures/deploy-arch-ibm-ocp-fully-configurable.md @@ -12,7 +12,7 @@ authors: - name: "Prateek Sharma" # The release that the reference architecture describes -version: 3.57.0 +version: 3.58.1 # Whether the reference architecture is published to Cloud Docs production. # When set to false, the file is available only in staging. Default is false. @@ -57,7 +57,7 @@ content-type: reference-architecture {: toc-industry="Banking,FinancialSector"} {: toc-use-case="Cybersecurity"} {: toc-compliance="FedRAMP"} -{: toc-version="3.57.0"} +{: toc-version="3.58.1 "} Landing zone for containerized applications with OpenShift provides a scalable, secure, and production-ready foundation for deploying containerized applications on IBM Cloud. It comes integrated by default with several IBM Cloud services to enhance security, observability, and compliance. Data encryption is enforced using Key Protect and Key Management Services (KMS), while Cloud Object Storage (COS) supports persistent storage and acts as the internal image registry. Secrets Manager is used to securely manage sensitive credentials and certificates, ensuring tighter control over access and authentication. Observability is delivered through Cloud Monitoring, Cloud Logs, and Activity Tracker, while regulatory compliance is supported via Security and Compliance Center and Workload Protection. These integrated capabilities work together to deliver a resilient and well-governed OpenShift environment. @@ -68,12 +68,12 @@ While this architecture is designed to function independently, it also serves as ## Architecture diagram {: #ra-ocp-fully-configurable-architecture-diagram} -![Architecture diagram for the Standard - Integrated setup with configurable services variation of Landing zone for containerized applications with OpenShift](deployable-architecture-ocp-cluster.svg "Architecture diagram of Standard - Integrated setup with configurable services variation of Landing zone for containerized applications with OpenShift deployable architecture"){: caption="Figure 1. Standard - Integrated setup with configurable services variation of Landing zone for containerized applications with OpenShift" caption-side="bottom"}{: external download="deployable-architecture-ocp-cluster.svg"} +![Architecture diagram for the Standard - Integrated setup with configurable services variation of Landing zone for containerized applications with OpenShift](deployable-architecture-ocp-cluster.svg "Architecture diagram of Standard - Integrated setup with configurable services variation of Landing zone for containerized applications with OpenShift deployable architecture"){: caption="Standard - Integrated setup with configurable services variation of Landing zone for containerized applications with OpenShift" caption-side="bottom"}{: external download="deployable-architecture-ocp-cluster.svg"} ## Design concepts {: #ra-ocp-fully-configurable-design-concepts} -![Design requirements for Landing zone for containerized applications with OpenShift](heat-map-deploy-arch-ocp-fully-configurable.svg "Design concepts"){: caption="Figure 2. Scope of the design concepts" caption-side="bottom"} +![Design requirements for Landing zone for containerized applications with OpenShift](heat-map-deploy-arch-ocp-fully-configurable.svg "Design concepts"){: caption="Scope of the design concepts" caption-side="bottom"} ## Requirements {: #ra-ocp-fully-configurable-requirements} @@ -87,7 +87,7 @@ The following table outlines the requirements that are addressed in this archite | Networking | * Multiple VPCs for network isolation. \n * All public inbound and outbound traffic allowed to VPCs. \n * Administration of cluster allowed from public endpoint and web console. \n * Load balancer for cluster workload services. \n * Outbound internet access from cluster. \n * Private network connection between VPCs. | | Security | * Encryption of all application data in transit and at rest to protect it from unauthorized disclosure. \n * Storage and management of all encryption keys. \n * Protect cluster administration access through IBM Cloud security protocols. | | Service Management | Automated deployment of infrastructure with IBM Cloud catalog | -{: caption="Table 1. Requirements" caption-side="bottom"} +{: caption="Requirements" caption-side="bottom"} ## Components {: #ra-ocp-fully-configurable-components} @@ -100,7 +100,7 @@ The following table outlines the products or services used in the architecture f | Storage | IBM Cloud Object Storage | Registry backup for Red Hat OpenShift | | Networking | * VPC Load Balancer \n * Public Gateway \n * Transit Gateway | * Application load balancing for cluster workloads (automatically created by Red Hat OpenShift service for multi-zone cluster) \n * Cluster access to the internet \n * Private network connectivity between management and workload VPCs | | Security | * IAM \n * Key Protect | * IBM Cloud Identity and Access Management \n * Management of encryption keys used by Red Hat OpenShift Container Platform | -{: caption="Table 2. Components" caption-side="bottom"} +{: caption="Components" caption-side="bottom"} ### Cluster architecture decisions {: #ra-ocp-fully-configurable-components-cluster} diff --git a/reference-architectures/deploy-arch-ibm-ocp-quickstart.md b/reference-architectures/deploy-arch-ibm-ocp-quickstart.md index c2d4dcee..409c63bc 100644 --- a/reference-architectures/deploy-arch-ibm-ocp-quickstart.md +++ b/reference-architectures/deploy-arch-ibm-ocp-quickstart.md @@ -12,7 +12,7 @@ authors: - name: "Prateek Sharma" # The release that the reference architecture describes -version: 3.57.0 +version: 3.58.1 # Whether the reference architecture is published to Cloud Docs production. # When set to false, the file is available only in staging. Default is false. @@ -56,19 +56,19 @@ content-type: reference-architecture {: toc-content-type="reference-architecture"} {: toc-industry="Banking,FinancialSector"} {: toc-use-case="Cybersecurity"} -{: toc-version="3.57.0"} +{: toc-version="3.58.1"} The QuickStart variation of the Landing zone for containerized applications with OpenShift deployable architecture creates a fully customizable Virtual Private Cloud (VPC) environment in a single region. The solution provides a single Red Hat OpenShift cluster in a secure VPC for your workloads. The QuickStart variation is designed to deploy quickly for demonstration and development. ## Architecture diagram {: #ra-ocp-qs-architecture-diagram} -![Architecture diagram for the QuickStart variation of Landing zone for containerized applications with OpenShift](deployable-architecture-ocp-cluster-qs.svg "Architecture diagram of QuickStart variation of Landing zone for containerized applications with OpenShift deployable architecture"){: caption="Figure 1. QuickStart variation of Landing zone for containerized applications with OpenShift" caption-side="bottom"}{: external download="deployable-architecture-ocp-cluster-qs.svg"} +![Architecture diagram for the QuickStart variation of Landing zone for containerized applications with OpenShift](deployable-architecture-ocp-cluster-qs.svg "Architecture diagram of QuickStart variation of Landing zone for containerized applications with OpenShift deployable architecture"){: caption="QuickStart variation of Landing zone for containerized applications with OpenShift" caption-side="bottom"}{: external download="deployable-architecture-ocp-cluster-qs.svg"} ## Design concepts {: #ra-ocp-qs-design-concepts} -![Design requirements for Landing zone for containerized applications with OpenShift](heat-map-deploy-arch-ocp-quickstart.svg "Design concepts"){: caption="Figure 2. Scope of the design concepts" caption-side="bottom"} +![Design requirements for Landing zone for containerized applications with OpenShift](heat-map-deploy-arch-ocp-quickstart.svg "Design concepts"){: caption="Scope of the design concepts" caption-side="bottom"} ## Requirements {: #ra-ocp-qs-requirements} @@ -82,7 +82,7 @@ The following table outlines the requirements that are addressed in this archite | Networking | * Multiple VPCs for network isolation. \n * All public inbound and outbound traffic allowed to VPCs. \n * Administration of cluster allowed from public endpoint and web console. \n * Load balancer for cluster workload services. \n * Outbound internet access from cluster. \n * Private network connection between VPCs. | | Security | * Encryption of all application data in transit and at rest to protect it from unauthorized disclosure. \n * Storage and management of all encryption keys. \n * Protect cluster administration access through IBM Cloud security protocols. | | Service Management | Automated deployment of infrastructure with IBM Cloud catalog | -{: caption="Table 1. Requirements" caption-side="bottom"} +{: caption="Requirements" caption-side="bottom"} ## Components {: #ra-ocp-qs-components} @@ -95,4 +95,4 @@ The following table outlines the products or services used in the architecture f | Storage | IBM Cloud Object Storage | Registry backup for Red Hat OpenShift | | Networking | * VPC Load Balancer \n * Public Gateway \n * Transit Gateway | * Application load balancing for cluster workloads (automatically created by Red Hat OpenShift service for multi-zone cluster) \n * Cluster access to the internet \n * Private network connectivity between management and workload VPCs | | Security | * IAM \n * Key Protect | * IBM Cloud Identity and Access Management \n * Management of encryption keys used by Red Hat OpenShift Container Platform | -{: caption="Table 2. Components" caption-side="bottom"} +{: caption="Components" caption-side="bottom"} From 548333c15241c510b54fe694842cdf84a31e2e34 Mon Sep 17 00:00:00 2001 From: Prateek-Sharma13 Date: Wed, 10 Sep 2025 18:28:04 +0530 Subject: [PATCH 12/13] updated version --- .../deploy-arch-ibm-ocp-fully-configurable.md | 4 ++-- reference-architectures/deploy-arch-ibm-ocp-quickstart.md | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/reference-architectures/deploy-arch-ibm-ocp-fully-configurable.md b/reference-architectures/deploy-arch-ibm-ocp-fully-configurable.md index fdefb727..ed2beb45 100644 --- a/reference-architectures/deploy-arch-ibm-ocp-fully-configurable.md +++ b/reference-architectures/deploy-arch-ibm-ocp-fully-configurable.md @@ -12,7 +12,7 @@ authors: - name: "Prateek Sharma" # The release that the reference architecture describes -version: 3.58.1 +version: 3.58.2 # Whether the reference architecture is published to Cloud Docs production. # When set to false, the file is available only in staging. Default is false. @@ -57,7 +57,7 @@ content-type: reference-architecture {: toc-industry="Banking,FinancialSector"} {: toc-use-case="Cybersecurity"} {: toc-compliance="FedRAMP"} -{: toc-version="3.58.1 "} +{: toc-version="3.58.2 "} Landing zone for containerized applications with OpenShift provides a scalable, secure, and production-ready foundation for deploying containerized applications on IBM Cloud. It comes integrated by default with several IBM Cloud services to enhance security, observability, and compliance. Data encryption is enforced using Key Protect and Key Management Services (KMS), while Cloud Object Storage (COS) supports persistent storage and acts as the internal image registry. Secrets Manager is used to securely manage sensitive credentials and certificates, ensuring tighter control over access and authentication. Observability is delivered through Cloud Monitoring, Cloud Logs, and Activity Tracker, while regulatory compliance is supported via Security and Compliance Center and Workload Protection. These integrated capabilities work together to deliver a resilient and well-governed OpenShift environment. diff --git a/reference-architectures/deploy-arch-ibm-ocp-quickstart.md b/reference-architectures/deploy-arch-ibm-ocp-quickstart.md index 409c63bc..1d24450f 100644 --- a/reference-architectures/deploy-arch-ibm-ocp-quickstart.md +++ b/reference-architectures/deploy-arch-ibm-ocp-quickstart.md @@ -12,7 +12,7 @@ authors: - name: "Prateek Sharma" # The release that the reference architecture describes -version: 3.58.1 +version: 3.58.2 # Whether the reference architecture is published to Cloud Docs production. # When set to false, the file is available only in staging. Default is false. @@ -56,7 +56,7 @@ content-type: reference-architecture {: toc-content-type="reference-architecture"} {: toc-industry="Banking,FinancialSector"} {: toc-use-case="Cybersecurity"} -{: toc-version="3.58.1"} +{: toc-version="3.58.2"} The QuickStart variation of the Landing zone for containerized applications with OpenShift deployable architecture creates a fully customizable Virtual Private Cloud (VPC) environment in a single region. The solution provides a single Red Hat OpenShift cluster in a secure VPC for your workloads. The QuickStart variation is designed to deploy quickly for demonstration and development. From 86b75370b933cef972f3d04ea2c2c87bf56a430c Mon Sep 17 00:00:00 2001 From: Prateek-Sharma13 Date: Wed, 10 Sep 2025 19:29:14 +0530 Subject: [PATCH 13/13] updated tables --- .../deploy-arch-ibm-ocp-fully-configurable.md | 42 ++++++++++++------- .../deploy-arch-ibm-ocp-quickstart.md | 14 +++---- 2 files changed, 33 insertions(+), 23 deletions(-) diff --git a/reference-architectures/deploy-arch-ibm-ocp-fully-configurable.md b/reference-architectures/deploy-arch-ibm-ocp-fully-configurable.md index ed2beb45..e3b389ce 100644 --- a/reference-architectures/deploy-arch-ibm-ocp-fully-configurable.md +++ b/reference-architectures/deploy-arch-ibm-ocp-fully-configurable.md @@ -52,6 +52,7 @@ content-type: reference-architecture {{site.data.keyword.attribute-definition-list}} # Landing zone for containerized applications with OpenShift - Standard (Integrated setup with configurable services) variation + {: #ocp-fully-configurable} {: toc-content-type="reference-architecture"} {: toc-industry="Banking,FinancialSector"} @@ -66,16 +67,19 @@ The solution provisions a Red Hat OpenShift cluster within an IBM Cloud VPC, usi While this architecture is designed to function independently, it also serves as a flexible foundation for more advanced use cases. It supports seamless integration with Cloud Automation for Red Hat OpenShift AI, enabling organizations to deploy AI-driven workloads and accelerate innovation. With its secure, extensible design and managed cloud services, the solution helps enterprises reduce operational complexity and deliver critical applications faster within a governed Red Hat OpenShift ecosystem. ## Architecture diagram + {: #ra-ocp-fully-configurable-architecture-diagram} ![Architecture diagram for the Standard - Integrated setup with configurable services variation of Landing zone for containerized applications with OpenShift](deployable-architecture-ocp-cluster.svg "Architecture diagram of Standard - Integrated setup with configurable services variation of Landing zone for containerized applications with OpenShift deployable architecture"){: caption="Standard - Integrated setup with configurable services variation of Landing zone for containerized applications with OpenShift" caption-side="bottom"}{: external download="deployable-architecture-ocp-cluster.svg"} ## Design concepts + {: #ra-ocp-fully-configurable-design-concepts} ![Design requirements for Landing zone for containerized applications with OpenShift](heat-map-deploy-arch-ocp-fully-configurable.svg "Design concepts"){: caption="Scope of the design concepts" caption-side="bottom"} ## Requirements + {: #ra-ocp-fully-configurable-requirements} The following table outlines the requirements that are addressed in this architecture. @@ -84,69 +88,75 @@ The following table outlines the requirements that are addressed in this archite |---|---| | Compute | Openshift cluster with minimal machine size and nodes, suitable for low-cost demonstration and development | | Storage | Openshift cluster registry backup (required) | -| Networking | * Multiple VPCs for network isolation. \n * All public inbound and outbound traffic allowed to VPCs. \n * Administration of cluster allowed from public endpoint and web console. \n * Load balancer for cluster workload services. \n * Outbound internet access from cluster. \n * Private network connection between VPCs. | -| Security | * Encryption of all application data in transit and at rest to protect it from unauthorized disclosure. \n * Storage and management of all encryption keys. \n * Protect cluster administration access through IBM Cloud security protocols. | +| Networking | *Multiple VPCs for network isolation. \n* All public inbound and outbound traffic allowed to VPCs. \n *Administration of cluster allowed from public endpoint and web console. \n* Load balancer for cluster workload services. \n *Outbound internet access from cluster. \n* Private network connection between VPCs. | +| Security | *Encryption of all application data in transit and at rest to protect it from unauthorized disclosure. \n* Storage and management of all encryption keys. \n * Protect cluster administration access through IBM Cloud security protocols. | | Service Management | Automated deployment of infrastructure with IBM Cloud catalog | {: caption="Requirements" caption-side="bottom"} ## Components + {: #ra-ocp-fully-configurable-components} -The following table outlines the products or services used in the architecture for each aspect. +### OpenShift Container Platform (OCP) architecture decisions -| Aspects | Architecture components | How the component is used | -|---|---|---| -| Compute | Red Hat OpenShift Container Platform | Container execution | -| Storage | IBM Cloud Object Storage | Registry backup for Red Hat OpenShift | -| Networking | * VPC Load Balancer \n * Public Gateway \n * Transit Gateway | * Application load balancing for cluster workloads (automatically created by Red Hat OpenShift service for multi-zone cluster) \n * Cluster access to the internet \n * Private network connectivity between management and workload VPCs | -| Security | * IAM \n * Key Protect | * IBM Cloud Identity and Access Management \n * Management of encryption keys used by Red Hat OpenShift Container Platform | +| Requirement | Component | Reasons for choice | Alternative choice | +|-------------|-----------|--------------------|--------------------| +| * Provide compute platform for running containers | Red Hat OpenShift Container Platform | Used for container execution and orchestration | Use unmanaged Kubernetes (IKS or self-managed) | +| * Enable persistent and reliable storage for OpenShift needs | IBM Cloud Object Storage | Used for registry backup for Red Hat OpenShift | Use File Storage or Block Storage depending on workload requirements | +| * Support application connectivity and routing
* Provide internet access
* Enable private connectivity across VPCs | VPC Load Balancer, Public Gateway, Transit Gateway | *Application load balancing for cluster workloads (automatically created by Red Hat OpenShift service for multi-zone cluster)
* Cluster access to the internet
* Private network connectivity between management and workload VPCs | Use classic load balancer or VPN-based connectivity | +| * Secure access and key management for OpenShift | IBM Cloud IAM, Key Protect | *IBM Cloud Identity and Access Management
* Management of encryption keys used by Red Hat OpenShift Container Platform | Use Secrets Manager or OS-level access controls | {: caption="Components" caption-side="bottom"} ### Cluster architecture decisions + {: #ra-ocp-fully-configurable-components-cluster} | Requirement | Component | Reasons for choice | Alternative choice | |-------------|-----------|--------------------|--------------------| -| * High availability across zones \n * Fault tolerance for workloads | Multi-zone Red Hat OpenShift cluster | Provides built-in resiliency by distributing worker nodes across three zones | Deploy single-zone clusters with lower availability | -| * Scalable worker infrastructure \n * Cost optimization | Worker pools with configurable node counts | Flexibility to scale nodes horizontally and vertically | Fixed-size clusters with no scaling options | +| *High availability across zones \n* Fault tolerance for workloads | Multi-zone Red Hat OpenShift cluster | Provides built-in resiliency by distributing worker nodes across three zones | Deploy single-zone clusters with lower availability | +| *Scalable worker infrastructure \n* Cost optimization | Worker pools with configurable node counts | Flexibility to scale nodes horizontally and vertically | Fixed-size clusters with no scaling options | | * Persistent storage for internal registry | Cloud Object Storage | Highly durable, encrypted, and cost-efficient storage | File or block storage solutions with higher cost | {: caption="Cluster architecture decisions" caption-side="bottom"} ### Networking architecture decisions + {: #ra-ocp-fully-configurable-components-networking} | Requirement | Component | Reasons for choice | Alternative choice | |-------------|-----------|--------------------|--------------------| -| * Enable application traffic distribution \n * Support external workloads | VPC Load Balancer | Provides managed ingress and load balancing | Third-party ingress controllers | +| *Enable application traffic distribution \n* Support external workloads | VPC Load Balancer | Provides managed ingress and load balancing | Third-party ingress controllers | | * Secure connectivity to the internet | Public gateways | Allow outbound connectivity for cluster nodes | Private-only clusters with no internet access | -| * Multi-VPC communication \n * Hub-and-spoke models | Transit Gateway | Provides secure, private connectivity across VPCs | Use VPN gateways or Direct Link | +| *Multi-VPC communication \n* Hub-and-spoke models | Transit Gateway | Provides secure, private connectivity across VPCs | Use VPN gateways or Direct Link | {: caption="Networking architecture decisions" caption-side="bottom"} ### Security and compliance architecture decisions + {: #ra-ocp-fully-configurable-components-security} | Requirement | Component | Reasons for choice | Alternative choice | |-------------|-----------|--------------------|--------------------| -| * Encryption of data at rest \n * Key lifecycle management | Key Protect | Centralized management of encryption keys | Bring Your Own Key (BYOK) solutions | +| *Encryption of data at rest \n* Key lifecycle management | Key Protect | Centralized management of encryption keys | Bring Your Own Key (BYOK) solutions | | * Secure secrets and credentials management | Secrets Manager | Centralized storage and rotation of sensitive credentials | Store secrets directly in OpenShift etcd | | * Strong authentication and authorization | IAM | Fine-grained access control across users and services | Local OpenShift RBAC only | {: caption="Security and compliance architecture decisions" caption-side="bottom"} ### Flexibility and customization architecture decisions + {: #ra-ocp-fully-configurable-components-flexibility} | Requirement | Component | Reasons for choice | Alternative choice | |-------------|-----------|--------------------|--------------------| -| * Support scaling workloads \n * Enable hybrid deployments | Configurable worker pools | Scale worker nodes to match workload demand | Static cluster sizes | -| * Meet diverse compliance requirements \n * Enable observability integration | Cloud Monitoring, Cloud Logs, Activity Tracker | Provides enterprise-grade visibility and compliance reporting | Third-party monitoring tools | +| *Support scaling workloads \n* Enable hybrid deployments | Configurable worker pools | Scale worker nodes to match workload demand | Static cluster sizes | +| *Meet diverse compliance requirements \n* Enable observability integration | Cloud Monitoring, Cloud Logs, Activity Tracker | Provides enterprise-grade visibility and compliance reporting | Third-party monitoring tools | | * Enable AI-ready workloads | Integration with Cloud Automation for Red Hat OpenShift AI | Prepares foundation for AI/ML use cases | Manual setup of AI services | {: caption="Flexibility and customization architecture decisions" caption-side="bottom"} ## Key features + {: #ra-ocp-fully-configurable-features} The Standard - Integrated setup with configurable services variation of Landing zone for containerized applications with OpenShift provides comprehensive capabilities across: diff --git a/reference-architectures/deploy-arch-ibm-ocp-quickstart.md b/reference-architectures/deploy-arch-ibm-ocp-quickstart.md index 1d24450f..8bb70d82 100644 --- a/reference-architectures/deploy-arch-ibm-ocp-quickstart.md +++ b/reference-architectures/deploy-arch-ibm-ocp-quickstart.md @@ -75,13 +75,13 @@ The QuickStart variation of the Landing zone for containerized applications with The following table outlines the requirements that are addressed in this architecture. -| Aspect | Requirements | -|---|---| -| Compute | Kubernetes cluster with minimal machine size and nodes, suitable for low-cost demonstration and development | -| Storage | Kubernetes cluster registry backup (required) | -| Networking | * Multiple VPCs for network isolation. \n * All public inbound and outbound traffic allowed to VPCs. \n * Administration of cluster allowed from public endpoint and web console. \n * Load balancer for cluster workload services. \n * Outbound internet access from cluster. \n * Private network connection between VPCs. | -| Security | * Encryption of all application data in transit and at rest to protect it from unauthorized disclosure. \n * Storage and management of all encryption keys. \n * Protect cluster administration access through IBM Cloud security protocols. | -| Service Management | Automated deployment of infrastructure with IBM Cloud catalog | +| Requirement | Component | Reasons for choice | Alternative choice | +|-------------|-----------|--------------------|--------------------| +| * Provide low-cost compute for demonstration and development workloads | Kubernetes cluster with minimal machine size and nodes | Keeps cost low while still supporting containerized workloads | Use a larger production-grade cluster configuration | +| * Ensure registry backup is available for the cluster | Kubernetes cluster registry backup | Provides backup of images and configurations required by Red Hat OpenShift | Use external object storage for registry backup | +| * Support network isolation with multiple VPCs
* Allow inbound and outbound traffic
* Enable cluster administration from public endpoints
* Provide load balancing for workloads
* Enable outbound internet access
* Allow private connectivity between VPCs | Multiple VPCs, Public Gateway, Load Balancer, VPC peering | Delivers connectivity, isolation, and access for cluster workloads and administration | Use a single VPC with simplified connectivity and no private interconnect | +| * Encrypt application data in transit and at rest
* Manage encryption keys securely
* Protect cluster administration access | IBM Cloud IAM, Key Protect | Ensures security of data, keys, and cluster access through IBM Cloud protocols | Use Secrets Manager or OS-level access controls | +| * Automate infrastructure provisioning | IBM Cloud Catalog | Provides automated deployment of infrastructure services | Manual configuration of infrastructure components | {: caption="Requirements" caption-side="bottom"} ## Components