Skip to content

Commit 28d9158

Browse files
toddgiguerevburckhardtocofaigh
authored
feat: added ROKS Quickstart pattern (#716)
--------- Co-authored-by: Vincent Burckhardt <[email protected]> Co-authored-by: Conall Ó Cofaigh <[email protected]>
1 parent f74a3ec commit 28d9158

File tree

10 files changed

+410
-18
lines changed

10 files changed

+410
-18
lines changed

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -901,7 +901,7 @@ module "cluster_pattern" {
901901
|------|-------------|------|---------|:--------:|
902902
| <a name="input_appid"></a> [appid](#input\_appid) | The App ID instance to be used for the teleport vsi deployments | <pre>object({<br> name = optional(string)<br> resource_group = optional(string)<br> use_data = optional(bool)<br> keys = optional(list(string))<br> use_appid = bool<br> })</pre> | <pre>{<br> "use_appid": false<br>}</pre> | no |
903903
| <a name="input_atracker"></a> [atracker](#input\_atracker) | atracker variables | <pre>object({<br> resource_group = string<br> receive_global_events = bool<br> collector_bucket_name = string<br> add_route = bool<br> })</pre> | n/a | yes |
904-
| <a name="input_clusters"></a> [clusters](#input\_clusters) | A list describing clusters workloads to create | <pre>list(<br> object({<br> name = string # Name of Cluster<br> vpc_name = string # Name of VPC<br> subnet_names = list(string) # List of vpc subnets for cluster<br> workers_per_subnet = number # Worker nodes per subnet.<br> machine_type = string # Worker node flavor<br> kube_type = string # iks or openshift<br> kube_version = optional(string) # Can be a version from `ibmcloud ks versions` or `default`<br> entitlement = optional(string) # entitlement option for openshift<br> secondary_storage = optional(string) # Secondary storage type<br> pod_subnet = optional(string) # Portable subnet for pods<br> service_subnet = optional(string) # Portable subnet for services<br> resource_group = string # Resource Group used for cluster<br> cos_name = optional(string) # Name of COS instance Required only for OpenShift clusters<br> access_tags = optional(list(string), [])<br> boot_volume_crk_name = optional(string) # Boot volume encryption key name<br> kms_config = optional(<br> object({<br> crk_name = string # Name of key<br> private_endpoint = optional(bool) # Private endpoint<br> })<br> )<br> worker_pools = optional(<br> list(<br> object({<br> name = string # Worker pool name<br> vpc_name = string # VPC name<br> workers_per_subnet = number # Worker nodes per subnet<br> flavor = string # Worker node flavor<br> subnet_names = list(string) # List of vpc subnets for worker pool<br> entitlement = optional(string) # entitlement option for openshift<br> secondary_storage = optional(string) # Secondary storage type<br> boot_volume_crk_name = optional(string) # Boot volume encryption key name<br> })<br> )<br> )<br> })<br> )</pre> | n/a | yes |
904+
| <a name="input_clusters"></a> [clusters](#input\_clusters) | A list describing clusters workloads to create | <pre>list(<br> object({<br> name = string # Name of Cluster<br> vpc_name = string # Name of VPC<br> subnet_names = list(string) # List of vpc subnets for cluster<br> workers_per_subnet = number # Worker nodes per subnet.<br> machine_type = string # Worker node flavor<br> kube_type = string # iks or openshift<br> kube_version = optional(string) # Can be a version from `ibmcloud ks versions` or `default`<br> entitlement = optional(string) # entitlement option for openshift<br> secondary_storage = optional(string) # Secondary storage type<br> pod_subnet = optional(string) # Portable subnet for pods<br> service_subnet = optional(string) # Portable subnet for services<br> resource_group = string # Resource Group used for cluster<br> cos_name = optional(string) # Name of COS instance Required only for OpenShift clusters<br> access_tags = optional(list(string), [])<br> boot_volume_crk_name = optional(string) # Boot volume encryption key name<br> disable_public_endpoint = optional(bool, true) # disable cluster public, leaving only private endpoint<br> kms_config = optional(<br> object({<br> crk_name = string # Name of key<br> private_endpoint = optional(bool) # Private endpoint<br> })<br> )<br> worker_pools = optional(<br> list(<br> object({<br> name = string # Worker pool name<br> vpc_name = string # VPC name<br> workers_per_subnet = number # Worker nodes per subnet<br> flavor = string # Worker node flavor<br> subnet_names = list(string) # List of vpc subnets for worker pool<br> entitlement = optional(string) # entitlement option for openshift<br> secondary_storage = optional(string) # Secondary storage type<br> boot_volume_crk_name = optional(string) # Boot volume encryption key name<br> })<br> )<br> )<br> })<br> )</pre> | n/a | yes |
905905
| <a name="input_cos"></a> [cos](#input\_cos) | Object describing the cloud object storage instance, buckets, and keys. Set `use_data` to false to create instance | <pre>list(<br> object({<br> name = string<br> use_data = optional(bool)<br> resource_group = string<br> plan = optional(string)<br> random_suffix = optional(bool) # Use a random suffix for COS instance<br> access_tags = optional(list(string), [])<br> buckets = list(object({<br> name = string<br> storage_class = string<br> endpoint_type = string<br> force_delete = bool<br> single_site_location = optional(string)<br> region_location = optional(string)<br> cross_region_location = optional(string)<br> kms_key = optional(string)<br> access_tags = optional(list(string), [])<br> allowed_ip = optional(list(string))<br> hard_quota = optional(number)<br> archive_rule = optional(object({<br> days = number<br> enable = bool<br> rule_id = optional(string)<br> type = string<br> }))<br> expire_rule = optional(object({<br> days = optional(number)<br> date = optional(string)<br> enable = bool<br> expired_object_delete_marker = optional(string)<br> prefix = optional(string)<br> rule_id = optional(string)<br> }))<br> activity_tracking = optional(object({<br> activity_tracker_crn = string<br> read_data_events = bool<br> write_data_events = bool<br> }))<br> metrics_monitoring = optional(object({<br> metrics_monitoring_crn = string<br> request_metrics_enabled = optional(bool)<br> usage_metrics_enabled = optional(bool)<br> }))<br> }))<br> keys = optional(<br> list(object({<br> name = string<br> role = string<br> enable_HMAC = bool<br> }))<br> )<br><br> })<br> )</pre> | n/a | yes |
906906
| <a name="input_enable_transit_gateway"></a> [enable\_transit\_gateway](#input\_enable\_transit\_gateway) | Create transit gateway | `bool` | `true` | no |
907907
| <a name="input_f5_template_data"></a> [f5\_template\_data](#input\_f5\_template\_data) | Data for all f5 templates | <pre>object({<br> tmos_admin_password = optional(string)<br> license_type = optional(string)<br> byol_license_basekey = optional(string)<br> license_host = optional(string)<br> license_username = optional(string)<br> license_password = optional(string)<br> license_pool = optional(string)<br> license_sku_keyword_1 = optional(string)<br> license_sku_keyword_2 = optional(string)<br> license_unit_of_measure = optional(string)<br> do_declaration_url = optional(string)<br> as3_declaration_url = optional(string)<br> ts_declaration_url = optional(string)<br> phone_home_url = optional(string)<br> template_source = optional(string)<br> template_version = optional(string)<br> app_id = optional(string)<br> tgactive_url = optional(string)<br> tgstandby_url = optional(string)<br> tgrefresh_url = optional(string)<br> })</pre> | <pre>{<br> "license_type": "none"<br>}</pre> | no |

‎cluster.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,7 @@ resource "ibm_container_vpc_cluster" "cluster" {
8080
}
8181
}
8282

83-
disable_public_service_endpoint = true
83+
disable_public_service_endpoint = coalesce(each.value.disable_public_endpoint, true) # disable if not set or null
8484

8585
timeouts {
8686
create = "3h"

‎patterns/roks-quickstart/README.md‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# Red Hat OpenShift Container Platform on VPC landing zone (QuickStart pattern)
2+
3+
This pattern deploys the following infrastructure:
4+
5+
- Management VPC with one subnet, allow-all ACL and Security Group
6+
- Workload VPC with two subnets, in two zones, allow-all ACL and Security Group
7+
- Transit Gateway connecting VPCs
8+
- One ROKS cluster in workload VPC with two worker nodes, public endpoint enabled
9+
- Key Protect for cluster encryption keys
10+
- Cloud Object Storage instance (required for cluster)
11+
12+
**Important:** This pattern helps you get started quickly, but is not highly available or validated for the IBM Cloud Framework for Financial Services.

‎patterns/roks-quickstart/main.tf‎

Lines changed: 255 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,255 @@
1+
##############################################################################
2+
# QuickStart VSI Landing Zone
3+
##############################################################################
4+
5+
locals {
6+
default_ocp_version = "${data.ibm_container_cluster_versions.cluster_versions.default_openshift_version}_openshift"
7+
ocp_version = var.kube_version == null || var.kube_version == "default" ? local.default_ocp_version : "${var.kube_version}_openshift"
8+
}
9+
10+
data "ibm_container_cluster_versions" "cluster_versions" {
11+
}
12+
13+
module "landing_zone" {
14+
source = "../roks/module"
15+
prefix = var.prefix
16+
region = var.region
17+
override_json_string = local.override_string
18+
tags = var.resource_tags
19+
}
20+
21+
locals {
22+
override_string = <<EOF
23+
{
24+
"atracker": {
25+
"collector_bucket_name": "",
26+
"receive_global_events": false,
27+
"resource_group": "",
28+
"add_route": false
29+
},
30+
"clusters": [
31+
{
32+
"boot_volume_crk_name": "slz-vsi-volume-key",
33+
"cos_name": "cos",
34+
"kms_config": null,
35+
"kube_type": "openshift",
36+
"kube_version": "${local.ocp_version}",
37+
"machine_type": "${var.flavor}",
38+
"name": "workload-cluster",
39+
"resource_group": "workload-rg",
40+
"kms_config": {
41+
"crk_name": "roks-key",
42+
"private_endpoint": true
43+
},
44+
"subnet_names": [
45+
"vsi-zone-1",
46+
"vsi-zone-2"
47+
],
48+
"vpc_name": "workload",
49+
"worker_pools": [],
50+
"workers_per_subnet": 1,
51+
"entitlement": "cloud_pak",
52+
"disable_public_endpoint": false
53+
}
54+
],
55+
"cos": [
56+
{
57+
"access_tags": [],
58+
"buckets": [],
59+
"keys": [],
60+
"name": "cos",
61+
"plan": "standard",
62+
"random_suffix": true,
63+
"resource_group": "service-rg",
64+
"use_data": false
65+
}
66+
],
67+
"enable_transit_gateway": true,
68+
"transit_gateway_global": false,
69+
"key_management": {
70+
"keys": [
71+
{
72+
"key_ring": "slz-ring",
73+
"name": "slz-vsi-volume-key",
74+
"root_key": true,
75+
"policies": {
76+
"rotation": {
77+
"interval_month": 12
78+
}
79+
}
80+
},
81+
{
82+
"key_ring": "slz-ring",
83+
"name": "roks-key",
84+
"policies": {
85+
"rotation": {
86+
"interval_month": 12
87+
}
88+
},
89+
"root_key": true
90+
}
91+
],
92+
"name": "slz-kms",
93+
"resource_group": "service-rg",
94+
"use_hs_crypto": false,
95+
"use_data": false
96+
},
97+
"network_cidr": "10.0.0.0/8",
98+
"resource_groups": [
99+
{
100+
"create": true,
101+
"name": "service-rg",
102+
"use_prefix": true
103+
},
104+
{
105+
"create": true,
106+
"name": "management-rg",
107+
"use_prefix": true
108+
},
109+
{
110+
"create": true,
111+
"name": "workload-rg",
112+
"use_prefix": true
113+
}
114+
],
115+
"security_groups": [],
116+
"transit_gateway_connections": [
117+
"management",
118+
"workload"
119+
],
120+
"transit_gateway_resource_group": "service-rg",
121+
"virtual_private_endpoints": [],
122+
"vpcs": [
123+
{
124+
"default_security_group_rules": [],
125+
"clean_default_sg_acl": false,
126+
"flow_logs_bucket_name": null,
127+
"network_acls": [
128+
{
129+
"add_cluster_rules": false,
130+
"name": "management-acl",
131+
"rules": [
132+
{
133+
"name": "allow-ssh-inbound",
134+
"action": "allow",
135+
"direction": "inbound",
136+
"tcp": {
137+
"port_min": 22,
138+
"port_max": 22
139+
},
140+
"source": "0.0.0.0/0",
141+
"destination": "10.0.0.0/8"
142+
},
143+
{
144+
"action": "allow",
145+
"destination": "10.0.0.0/8",
146+
"direction": "inbound",
147+
"name": "allow-ibm-inbound",
148+
"source": "161.26.0.0/16"
149+
},
150+
{
151+
"action": "allow",
152+
"destination": "10.0.0.0/8",
153+
"direction": "inbound",
154+
"name": "allow-all-network-inbound",
155+
"source": "10.0.0.0/8"
156+
},
157+
{
158+
"action": "allow",
159+
"destination": "0.0.0.0/0",
160+
"direction": "outbound",
161+
"name": "allow-all-outbound",
162+
"source": "0.0.0.0/0"
163+
}
164+
]
165+
}
166+
],
167+
"prefix": "management",
168+
"resource_group": "management-rg",
169+
"subnets": {
170+
"zone-1": [
171+
{
172+
"acl_name": "management-acl",
173+
"cidr": "10.10.10.0/24",
174+
"name": "vsi-zone-1",
175+
"public_gateway": false
176+
}
177+
],
178+
"zone-2": [],
179+
"zone-3": []
180+
},
181+
"use_public_gateways": {
182+
"zone-1": false,
183+
"zone-2": false,
184+
"zone-3": false
185+
},
186+
"address_prefixes": {
187+
"zone-1": [],
188+
"zone-2": [],
189+
"zone-3": []
190+
}
191+
},
192+
{
193+
"default_security_group_rules": [],
194+
"clean_default_sg_acl": false,
195+
"flow_logs_bucket_name": null,
196+
"network_acls": [
197+
{
198+
"add_cluster_rules": false,
199+
"name": "workload-acl",
200+
"rules": [
201+
{
202+
"action": "allow",
203+
"destination": "0.0.0.0/0",
204+
"direction": "inbound",
205+
"name": "allow-all-network-inbound",
206+
"source": "0.0.0.0/0"
207+
},
208+
{
209+
"action": "allow",
210+
"destination": "0.0.0.0/0",
211+
"direction": "outbound",
212+
"name": "allow-all-outbound",
213+
"source": "0.0.0.0/0"
214+
}
215+
]
216+
}
217+
],
218+
"prefix": "workload",
219+
"resource_group": "workload-rg",
220+
"subnets": {
221+
"zone-1": [
222+
{
223+
"acl_name": "workload-acl",
224+
"cidr": "10.40.10.0/24",
225+
"name": "vsi-zone-1",
226+
"public_gateway": true
227+
}
228+
],
229+
"zone-2": [
230+
{
231+
"acl_name": "workload-acl",
232+
"cidr": "10.50.10.0/24",
233+
"name": "vsi-zone-2",
234+
"public_gateway": true
235+
}
236+
],
237+
"zone-3": []
238+
},
239+
"use_public_gateways": {
240+
"zone-1": true,
241+
"zone-2": true,
242+
"zone-3": false
243+
},
244+
"address_prefixes": {
245+
"zone-1": [],
246+
"zone-2": [],
247+
"zone-3": []
248+
}
249+
}
250+
],
251+
"vpn_gateways": []
252+
}
253+
EOF
254+
255+
}

‎patterns/roks-quickstart/outputs.tf‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
##############################################################################
2+
# Output Variables
3+
##############################################################################
4+
5+
output "config" {
6+
description = "Output configuration as encoded JSON"
7+
value = module.landing_zone.config
8+
}

‎patterns/roks-quickstart/provider.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
provider "ibm" {
2+
ibmcloud_api_key = var.ibmcloud_api_key
3+
region = var.region
4+
}

‎patterns/roks-quickstart/variables.tf‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
##############################################################################
2+
# Account Variables
3+
##############################################################################
4+
5+
variable "ibmcloud_api_key" {
6+
description = "The IBM Cloud platform API key needed to deploy IAM enabled resources."
7+
type = string
8+
sensitive = true
9+
}
10+
11+
variable "prefix" {
12+
description = "A unique identifier for resources. Must begin with a lowercase letter and end with a lowercase letter or number. This prefix will be prepended to any resources provisioned by this template. Prefixes must be 13 or fewer characters."
13+
type = string
14+
default = "land-zone-roks-qs"
15+
16+
validation {
17+
error_message = "Prefix must begin with a letter and contain only lowercase letters, numbers, and - characters. Prefixes must end with a lowercase letter or number and be 13 or fewer characters."
18+
condition = can(regex("^([a-z]|[a-z][-a-z0-9]*[a-z0-9])$", var.prefix)) && length(var.prefix) <= 13
19+
}
20+
}
21+
22+
variable "region" {
23+
description = "Region where VPC will be created. To find your VPC region, use `ibmcloud is regions` command to find available regions."
24+
type = string
25+
default = "us-south"
26+
}
27+
28+
variable "resource_tags" {
29+
type = list(string)
30+
description = "Optional list of tags to be added to created resources"
31+
default = []
32+
}
33+
34+
variable "kube_version" {
35+
description = "Kubernetes version to use for cluster. To get available versions, use the IBM Cloud CLI command `ibmcloud ks versions`. Also supports passing the string 'default' (current IKS default recommended version)."
36+
type = string
37+
default = "default"
38+
}
39+
40+
variable "flavor" {
41+
description = "Machine type for cluster. Use the IBM Cloud CLI command `ibmcloud ks flavors` to find valid machine types"
42+
type = string
43+
default = "bx2.4x16"
44+
}

‎patterns/roks-quickstart/version.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
terraform {
2+
required_version = ">= 1.3, < 1.6"
3+
required_providers {
4+
# renovate is set up to keep provider version at the latest for all DA solutions
5+
ibm = {
6+
source = "IBM-Cloud/ibm"
7+
version = "1.62.0"
8+
}
9+
}
10+
}

0 commit comments

Comments
 (0)