diff --git a/.secrets.baseline b/.secrets.baseline index 39425e73..4ad64b3e 100644 --- a/.secrets.baseline +++ b/.secrets.baseline @@ -3,7 +3,7 @@ "files": "go.sum|^.secrets.baseline$", "lines": null }, - "generated_at": "2025-10-04T13:14:02Z", + "generated_at": "2025-10-17T09:01:30Z", "plugins_used": [ { "name": "AWSKeyDetector" @@ -116,7 +116,7 @@ "hashed_secret": "9ceaacf8f9b3c35bd235b307d91a5bf7cff2c669", "is_secret": false, "is_verified": false, - "line_number": 81, + "line_number": 82, "type": "Secret Keyword", "verified_result": null } diff --git a/ibm_catalog.json b/ibm_catalog.json index 987c2dd1..360ba7e2 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -323,9 +323,6 @@ { "key": "enable_monitoring" }, - { - "key": "existing_monitoring_instance_crn" - }, { "key": "client_to_site_vpn", "custom_config": { @@ -505,7 +502,7 @@ { "diagram": { "caption": "Power Virtual Server with VPC landing zone 'Standard Landscape' variation", - "url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-powervs-infrastructure/refs/tags/v10.1.0/reference-architectures/standard/deploy-arch-ibm-pvs-inf-standard.svg", + "url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-powervs-infrastructure/refs/tags/v10.2.0/reference-architectures/standard/deploy-arch-ibm-pvs-inf-standard.svg", "type": "image/svg+xml" }, "description": "The Power Virtual Server with VPC landing zone as variation 'Create a new architecture' deploys VPC services and a Power Virtual Server workspace and interconnects them.\n \nRequired and optional management components are configured." @@ -972,9 +969,6 @@ { "key": "enable_monitoring" }, - { - "key": "existing_monitoring_instance_crn" - }, { "key": "client_to_site_vpn", "custom_config": { @@ -1154,7 +1148,7 @@ { "diagram": { "caption": "Power Virtual Server with VPC landing zone 'Quickstart' variation", - "url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-powervs-infrastructure/refs/tags/v10.1.0/reference-architectures/standard-plus-vsi/deploy-arch-ibm-pvs-inf-standard-plus-vsi.svg", + "url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-powervs-infrastructure/refs/tags/v10.2.0/reference-architectures/standard-plus-vsi/deploy-arch-ibm-pvs-inf-standard-plus-vsi.svg", "type": "image/svg+xml" }, "description": "The Power Virtual Server with VPC landing zone as 'Quickstart' variation of 'Create a new architecture' option deploys VPC services and a Power Virtual Server workspace and interconnects them. It also creates one Power virtual server instance of chosen t-shirt size or custom configuration.\n \nRequired and optional management components are configured." @@ -1375,9 +1369,6 @@ { "key": "enable_monitoring" }, - { - "key": "existing_monitoring_instance_crn" - }, { "key": "client_to_site_vpn", "custom_config": { @@ -1565,7 +1556,7 @@ { "diagram": { "caption": "Power Virtual Server with VPC landing zone 'Quickstart OpenShift' variation", - "url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-powervs-infrastructure/refs/tags/v10.1.0/reference-architectures/standard-openshift/deploy-arch-ibm-pvs-inf-standard-openshift.svg", + "url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-powervs-infrastructure/refs/tags/v10.2.0/reference-architectures/standard-openshift/deploy-arch-ibm-pvs-inf-standard-openshift.svg", "type": "image/svg+xml" }, "description": "The Power Virtual Server with VPC landing zone as variation 'Quickstart OpenShift' deploys VPC services and an Openshift Cluster on PowerVS and interconnects them.\n \nRequired and optional management components are configured." diff --git a/modules/powervs-vpc-landing-zone/README.md b/modules/powervs-vpc-landing-zone/README.md index e64e4cd8..037e097e 100644 --- a/modules/powervs-vpc-landing-zone/README.md +++ b/modules/powervs-vpc-landing-zone/README.md @@ -76,6 +76,7 @@ module "powervs-vpc-landing-zone" { existing_sm_instance_guid = var.existing_sm_instance_guid #(optional. default null) existing_sm_instance_region = var.existing_sm_instance_region #(optional. default null) enable_monitoring = var.enable_monitoring #(optional. default false) + enable_monitoring_host = var.enable_monitoring_host #(optional. default false) existing_monitoring_instance_crn = var.existing_monitoring_instance_crn #(optional. default null) enable_scc_wp = var.enable_scc_wp #(optional. default false) ansible_vault_password = var.ansible_vault_password #(optional. default null) @@ -147,9 +148,10 @@ Creates VPC Landing Zone | Performs VPC VSI OS Config | Creates PowerVS Infrastr | [configure\_nfs\_server](#input\_configure\_nfs\_server) | Specify if NFS server will be configured. This will allow you easily to share files between PowerVS instances (e.g., SAP installation files). [File storage share and mount target](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-create&interface=ui) in VPC will be created.. If yes, ensure 'nfs\_server\_config' optional variable is set properly below. Default value is '200GB' which will be mounted on specified directory in network-service vsi. | `bool` | `false` | no | | [configure\_ntp\_forwarder](#input\_configure\_ntp\_forwarder) | Specify if NTP forwarder will be configured. This will allow you to synchronize time between IBM PowerVS instances. NTP forwarder will be installed on the network-services vsi. | `bool` | `false` | no | | [dns\_forwarder\_config](#input\_dns\_forwarder\_config) | Configuration for the DNS forwarder to a DNS service that is not reachable directly from PowerVS. | 
object({
    dns_servers = string
  })
| 
{
  "dns_servers": "161.26.0.7; 161.26.0.8; 9.9.9.9;"
}
| no | -| [enable\_monitoring](#input\_enable\_monitoring) | Specify whether Monitoring will be enabled. This includes the creation of an IBM Cloud Monitoring Instance and an Intel Monitoring Instance to host the services. If you already have an existing monitoring instance then specify in optional parameter 'existing\_monitoring\_instance\_crn'. | `bool` | `false` | no | +| [enable\_monitoring](#input\_enable\_monitoring) | Specify whether Monitoring will be enabled. This includes the creation of an IBM Cloud Monitoring Instance. If you already have an existing monitoring instance, set this to true and specify in optional parameter 'existing\_monitoring\_instance\_crn'. | `bool` | `false` | no | +| [enable\_monitoring\_host](#input\_enable\_monitoring\_host) | Specify whether to create an additional Intel Instance that can be used to configure additional monitoring services. | `bool` | `false` | no | | [enable\_scc\_wp](#input\_enable\_scc\_wp) | Set to true to enable SCC Workload Protection and install and configure the SCC Workload Protection agent on all VSIs and PowerVS instances in this deployment. | `bool` | `false` | no | -| [existing\_monitoring\_instance\_crn](#input\_existing\_monitoring\_instance\_crn) | Existing CRN of IBM Cloud Monitoring Instance. If value is null, then an IBM Cloud Monitoring Instance will not be created but an intel VSI instance will be created if 'enable\_monitoring' is true. | `string` | `null` | no | +| [existing\_monitoring\_instance\_crn](#input\_existing\_monitoring\_instance\_crn) | Existing CRN of IBM Cloud Monitoring Instance. If value is null, then an IBM Cloud Monitoring Instance will not be created but an intel VSI instance will be created if 'enable\_monitoring\_host' is true. | `string` | `null` | no | | [existing\_sm\_instance\_guid](#input\_existing\_sm\_instance\_guid) | An existing Secrets Manager GUID. If not provided a new instance will be provisioned. | `string` | `null` | no | | [existing\_sm\_instance\_region](#input\_existing\_sm\_instance\_region) | Required if value is passed into `var.existing_sm_instance_guid`. | `string` | `null` | no | | [external\_access\_ip](#input\_external\_access\_ip) | Specify the source IP address or CIDR for login through SSH to the environment after deployment. Access to the environment will be allowed only from this IP address. Can be set to 'null' if you choose to use client to site vpn. | `string` | n/a | yes | @@ -181,7 +183,7 @@ Creates VPC Landing Zone | Performs VPC VSI OS Config | Creates PowerVS Infrastr | [ansible\_host\_or\_ip](#output\_ansible\_host\_or\_ip) | Central Ansible node private IP address. | | [dns\_host\_or\_ip](#output\_dns\_host\_or\_ip) | DNS forwarder host for created PowerVS infrastructure. | | [kms\_key\_map](#output\_kms\_key\_map) | Map of ids and keys for KMS keys created | -| [monitoring\_instance](#output\_monitoring\_instance) | Details of the IBM Cloud Monitoring Instance: CRN, location, guid, monitoring\_host\_ip. | +| [monitoring\_instance](#output\_monitoring\_instance) | Details of the IBM Cloud Monitoring Instance: CRN, location, guid, monitoring\_host\_ip. monitoring\_host\_ip is an empty string if enable\_monitoring\_host is disabled. | | [network\_load\_balancer](#output\_network\_load\_balancer) | Details of network load balancer. | | [network\_services\_config](#output\_network\_services\_config) | Complete configuration of network management services. | | [nfs\_host\_or\_ip\_path](#output\_nfs\_host\_or\_ip\_path) | NFS host for created PowerVS infrastructure. | diff --git a/modules/powervs-vpc-landing-zone/main.tf b/modules/powervs-vpc-landing-zone/main.tf index a982f5fe..71de003a 100644 --- a/modules/powervs-vpc-landing-zone/main.tf +++ b/modules/powervs-vpc-landing-zone/main.tf @@ -13,7 +13,7 @@ locals { network_services_vsi_profile = var.network_services_vsi_profile, user_data = var.user_data != null ? replace(var.user_data, "\n", "\\n") : null transit_gateway_global = var.transit_gateway_global, - enable_monitoring = var.enable_monitoring, + enable_monitoring_host = var.enable_monitoring_host, sles_image = var.vpc_intel_images.sles_image, second_rg_name = local.second_rg_name, tgw_rg_name = local.tgw_rg_name diff --git a/modules/powervs-vpc-landing-zone/monitoring.tf b/modules/powervs-vpc-landing-zone/monitoring.tf index 2afe6ae5..d6de121e 100644 --- a/modules/powervs-vpc-landing-zone/monitoring.tf +++ b/modules/powervs-vpc-landing-zone/monitoring.tf @@ -19,7 +19,7 @@ locals { crn = var.enable_monitoring && var.existing_monitoring_instance_crn == null ? resource.ibm_resource_instance.monitoring_instance[0].crn : var.existing_monitoring_instance_crn != null ? var.existing_monitoring_instance_crn : "" location = var.enable_monitoring && var.existing_monitoring_instance_crn == null ? resource.ibm_resource_instance.monitoring_instance[0].location : var.existing_monitoring_instance_crn != null ? split(":", var.existing_monitoring_instance_crn)[5] : "" guid = var.enable_monitoring && var.existing_monitoring_instance_crn == null ? resource.ibm_resource_instance.monitoring_instance[0].guid : var.existing_monitoring_instance_crn != null ? split(":", var.existing_monitoring_instance_crn)[7] : "" - monitoring_host_ip = local.monitoring_vsi_ip + monitoring_host_ip = var.enable_monitoring_host ? local.monitoring_vsi_ip : "" } } @@ -32,7 +32,7 @@ module "configure_monitoring_host" { source = "./submodules/ansible" depends_on = [module.configure_network_services] - count = var.enable_monitoring ? 1 : 0 + count = var.enable_monitoring_host ? 1 : 0 bastion_host_ip = local.access_host_or_ip ansible_host_or_ip = local.network_services_vsi_ip diff --git a/modules/powervs-vpc-landing-zone/outputs.tf b/modules/powervs-vpc-landing-zone/outputs.tf index d65edcdb..06a0a26f 100644 --- a/modules/powervs-vpc-landing-zone/outputs.tf +++ b/modules/powervs-vpc-landing-zone/outputs.tf @@ -156,7 +156,7 @@ output "powervs_images" { ######################################################################## output "monitoring_instance" { - description = "Details of the IBM Cloud Monitoring Instance: CRN, location, guid, monitoring_host_ip." + description = "Details of the IBM Cloud Monitoring Instance: CRN, location, guid, monitoring_host_ip. monitoring_host_ip is an empty string if enable_monitoring_host is disabled." value = local.monitoring_instance } diff --git a/modules/powervs-vpc-landing-zone/presets/slz-preset.json.tftpl b/modules/powervs-vpc-landing-zone/presets/slz-preset.json.tftpl index a05f03fe..c0bb4a2e 100644 --- a/modules/powervs-vpc-landing-zone/presets/slz-preset.json.tftpl +++ b/modules/powervs-vpc-landing-zone/presets/slz-preset.json.tftpl @@ -836,7 +836,7 @@ "user_data" : "${user_data}" %{ endif } } - %{ if "${enable_monitoring}" == true } + %{ if "${enable_monitoring_host}" == true } , { "name": "monitoring", diff --git a/modules/powervs-vpc-landing-zone/variables.tf b/modules/powervs-vpc-landing-zone/variables.tf index b7d79630..e45bd7d5 100644 --- a/modules/powervs-vpc-landing-zone/variables.tf +++ b/modules/powervs-vpc-landing-zone/variables.tf @@ -29,8 +29,8 @@ variable "vpc_intel_images" { error_message = "The rhel_image attribute of vpc_intel_images must not be empty. Please specify an OS image name to be used for creating management and network services VSI instances." } validation { - condition = var.enable_monitoring ? (var.vpc_intel_images.sles_image != "" ? true : false) : true - error_message = "The sles_image attribute of var.vpc_intel_images cannot be empty when enable_monitoring is set to true. Please provide a valid SLES OS stock image name to create monitoring VSI." + condition = var.enable_monitoring_host ? (var.vpc_intel_images.sles_image != "" ? true : false) : true + error_message = "The sles_image attribute of var.vpc_intel_images cannot be empty when enable_monitoring_host is set to true. Please provide a valid SLES OS stock image name to create monitoring VSI." } } @@ -321,13 +321,24 @@ variable "existing_sm_instance_region" { ##################################################### variable "enable_monitoring" { - description = "Specify whether Monitoring will be enabled. This includes the creation of an IBM Cloud Monitoring Instance and an Intel Monitoring Instance to host the services. If you already have an existing monitoring instance then specify in optional parameter 'existing_monitoring_instance_crn'." + description = "Specify whether Monitoring will be enabled. This includes the creation of an IBM Cloud Monitoring Instance. If you already have an existing monitoring instance, set this to true and specify in optional parameter 'existing_monitoring_instance_crn'." type = bool default = false } +variable "enable_monitoring_host" { + description = "Specify whether to create an additional Intel Instance that can be used to configure additional monitoring services." + type = bool + default = false + + validation { + condition = var.enable_monitoring_host ? var.enable_monitoring && var.enable_monitoring_host : true + error_message = "enable_monitoring must be set to true to set enable_monitoring_host to true." + } +} + variable "existing_monitoring_instance_crn" { - description = "Existing CRN of IBM Cloud Monitoring Instance. If value is null, then an IBM Cloud Monitoring Instance will not be created but an intel VSI instance will be created if 'enable_monitoring' is true. " + description = "Existing CRN of IBM Cloud Monitoring Instance. If value is null, then an IBM Cloud Monitoring Instance will not be created but an intel VSI instance will be created if 'enable_monitoring_host' is true. " type = string default = null } diff --git a/reference-architectures/standard-openshift/deploy-arch-ibm-pvs-inf-standard-openshift.md b/reference-architectures/standard-openshift/deploy-arch-ibm-pvs-inf-standard-openshift.md index 1c5dbc65..05fb9618 100644 --- a/reference-architectures/standard-openshift/deploy-arch-ibm-pvs-inf-standard-openshift.md +++ b/reference-architectures/standard-openshift/deploy-arch-ibm-pvs-inf-standard-openshift.md @@ -1,7 +1,7 @@ --- copyright: years: 2024, 2025 -lastupdated: "2025-10-09" +lastupdated: "2025-10-17" keywords: subcollection: deployable-reference-architectures authors: @@ -15,7 +15,7 @@ image_source: https://github.com/terraform-ibm-modules/terraform-ibm-powervs-inf use-case: ITServiceManagement industry: Technology content-type: reference-architecture -version: v10.1.0 +version: v10.2.0 compliance: --- @@ -27,7 +27,7 @@ compliance: {: toc-content-type="reference-architecture"} {: toc-industry="Technology"} {: toc-use-case="ITServiceManagement"} -{: toc-version="v10.1.0"} +{: toc-version="v10.2.0"} The Quickstart OpenShift deployment on Power Virtual Server with a VPC landing zone uses the Red Hat IPI installer to set up an OpenShift cluster. Before the deployment begins, it provisions VPC services and creates a Power Virtual Server workspace, which together form the landing zone used to access and manage the cluster. @@ -64,8 +64,8 @@ IBM Cloud® Power Virtual Servers (PowerVS) is a public cloud offering that an e |* Create a virtual server instance that can act as an internet proxy server |Network services VPC instance|Create a Linux VPC instance that can host management components. Preconfigure ACL and security group rules to allow traffic over private networks only.|Configure application load balancer to act as proxy server manually, Modify number of virtual server instances and allowed ports in preset or perform the modifications manually| |* Create DNS Service instance as pre-requisite for IPI installer | DNS Service Instance | Create a DNS Service instance and a custom resolver to internally resolve the cluster domain. | | |* Ensure financial services compliancy for VPC services \n * Perform network setup of all created services \n * Perform network isolation of all created services \n * Ensure all created services are interconnected |Secure landing zone components|Create a minimum set of required components for a secure landing zone|Create a modified set of required components for a secure landing zone in preset| -|* Allow customer to optionally enable monitoring in the deployment|IBM Cloud® monitoring instance and Monitoring Host VPC Instance|Optionally, create or import an existing IBM Cloud® monitoring instance (customer provided details) and create and pre-configure the Monitoring Host VPC instance to collect information and send it to the IBM Cloud® monitoring instance.| | -|* Allow customer to optionally enable [Security and Compliance Center Workload Protection](/docs/workload-protection) in the deployment \n * Collect posture management information, enable vulnerability scanning and threat detection|IBM Cloud® Security and Compliance Center Workload Protection and SCC Workload Protection agent on all VPC instances in the deployment.|Optionally, create an IBM Cloud® Security and Compliance Center Workload Protection instance and install and setup the SCC Workload Protection agent on all VPC instances in the deployment (bastion, network services, monitoring hosts).| | +|* Allow customer to optionally enable monitoring in the deployment|IBM Cloud® monitoring instance|Optionally, create or import an existing IBM Cloud® monitoring instance (customer provided details).| | +|* Allow customer to optionally enable [Security and Compliance Center Workload Protection](/docs/workload-protection) in the deployment \n * Collect posture management information, enable vulnerability scanning and threat detection|IBM Cloud® Security and Compliance Center Workload Protection and SCC Workload Protection agent on all VPC instances in the deployment.|Optionally, create an IBM Cloud® Security and Compliance Center Workload Protection instance and install and setup the SCC Workload Protection agent on all VPC instances in the deployment (bastion, network services).| | {: caption="Table 1. VPC architecture decisions" caption-side="bottom"} ### PowerVS workspace architecture decisions diff --git a/reference-architectures/standard-openshift/deploy-arch-ibm-pvs-inf-standard-openshift.svg b/reference-architectures/standard-openshift/deploy-arch-ibm-pvs-inf-standard-openshift.svg index c1bdfb1d..b0df5681 100644 --- a/reference-architectures/standard-openshift/deploy-arch-ibm-pvs-inf-standard-openshift.svg +++ b/reference-architectures/standard-openshift/deploy-arch-ibm-pvs-inf-standard-openshift.svg @@ -1,4 +1,4 @@ -
IBM Cloud
Zone 1
TransitGateway
PowerVS Resource Group
Secure PowerVS Workspace
SSH Public Key
10.72.0.0/24: Machine Subnet with DHCP Server
virtual-machinevirtual-machine
Power Virtual Server Instance
Worker Nodes
virtual-machineBlock Storageveth: DHCP Machine Subnet
Worker Node
virtual-machinevirtual-machine
Power Virtual Server Instance
Master Nodes
virtual-machineBlock Storageveth: DHCP Machine Subnet
Master Node
Power Virtual Server Instance
Bootstrap Instance (temporary)
virtual-machineBlock Storageveth: DHCP Machine Subnet
Cloud Services
Edge VPC Flow Log CollectorSecretsManagerObject  StorageInstallation filesObject  StorageActivity tracker MonitoringKey ProtectAcitivity Tracker Event RoutingActivity TrackerSCC WorkloadProtection dns-services DNS Service
Services Resource Group
Edge Resource Group
Edge VPC (Default ACL)
Management SG
10.30.20.0/24: 
Mgmt VSI Subnet
Virtual Server
virtual-machineFloatingIPBastionHost
Network-services SG
10.30.40.0/24: Edge VSI Subnet
Virtual Server
virtual-machineProxy ServerAnsible NodePublicGateway
Virtual Server
virtual-machineMonitoring Host
Default SG
10.30.10.0/24: 
VPN Subnet
Client to site VPN serverApplicationLoad BalancerPublic APIApplicationLoad BalancerInternal APIApplicationLoad BalancerCluster Applications
10.30.30.0/24: 
VPE Subnet
COS VPE
VPE SG
Consumer
UserInternet \ No newline at end of file +
IBM Cloud
IBM Cloud
Zone 1
Zone 1TransitGateway
PowerVS Resource Group
PowerVS Resource Group
Secure PowerVS Workspace
Secure PowerVS WorkspaceSSH Public Key
10.72.0.0/24: Machine Subnet with DHCP Server
10.72.0.0/24: Machine Subnet with DHCP Server
Power Virtual Server Instance
Worker Nodes
Power Virtual Server Instance...Block Storageveth: DHCP Machine Subnet
Worker Node
Worker N...
Power Virtual Server Instance
Master Nodes
Power Virtual Server Instanc...Block Storageveth: DHCP Machine Subnet
Master Node
Master N...
Power Virtual Server Instance
Bootstrap Instance (temporary)
Power Virtual Server Instanc...Block Storageveth: DHCP Machine Subnet
Cloud Services
Cloud ServicesEdge VPC Flow Log CollectorSecretsManagerObject  StorageInstallation filesObject  StorageActivity tracker MonitoringKey ProtectAcitivity Tracker Event RoutingActivity TrackerSCC WorkloadProtectionDNS Service
Services Resource Group
Services Resource Group
Edge Resource Group
Edge Resource Group
Edge VPC (Default ACL)
Edge VPC (Default ACL)
Management SG
Management SG
10.30.20.0/24: 
Mgmt VSI Subnet
10.30.20.0/24:...
Virtual Server
Virtual ServerFloatingIPBastionHost
Network-services SG
Network-services SG
10.30.40.0/24: Edge VSI Subnet
10.30.40.0/24: Edge VSI Subnet
Virtual Server
Virtual ServerProxy ServerAnsible NodePublicGateway
Default SG
Default SG
10.30.10.0/24: 
VPN Subnet
10.30.10.0/24:...Client to site VPN serverApplicationLoad BalancerPublic APIApplicationLoad BalancerInternal APIApplicationLoad BalancerCluster Applications
10.30.30.0/24: 
VPE Subnet
10.30.30.0/24:...COS VPE
VPE SG
VPE SG
Consumer
ConsumerUserInternetText is not SVG - cannot display \ No newline at end of file diff --git a/reference-architectures/standard-plus-vsi/deploy-arch-ibm-pvs-inf-standard-plus-vsi.md b/reference-architectures/standard-plus-vsi/deploy-arch-ibm-pvs-inf-standard-plus-vsi.md index 3dec8771..53525d9b 100644 --- a/reference-architectures/standard-plus-vsi/deploy-arch-ibm-pvs-inf-standard-plus-vsi.md +++ b/reference-architectures/standard-plus-vsi/deploy-arch-ibm-pvs-inf-standard-plus-vsi.md @@ -1,7 +1,7 @@ --- copyright: years: 2024, 2025 -lastupdated: "2025-10-09" +lastupdated: "2025-10-17" keywords: subcollection: deployable-reference-architectures authors: @@ -16,7 +16,7 @@ image_source: https://github.com/terraform-ibm-modules/terraform-ibm-powervs-inf use-case: ITServiceManagement industry: Technology content-type: reference-architecture -version: v10.1.0 +version: v10.2.0 compliance: --- @@ -28,7 +28,7 @@ compliance: {: toc-content-type="reference-architecture"} {: toc-industry="Technology"} {: toc-use-case="ITServiceManagement"} -{: toc-version="v10.1.0"} +{: toc-version="v10.2.0"} Quickstart deployment of the Power Virtual Server with VPC landing zone creates VPC services, a Power Virtual Server workspace, and interconnects them. It also deploys a Power Virtual Server of chosen T-shirt size or custom configuration. Supported Os are Aix, IBM i, and Linux images. @@ -61,8 +61,8 @@ IBM Cloud® Power Virtual Servers (PowerVS) is a public cloud offering that an e |* Create a virtual server instance as the only management access point to the landscape|Bastion host VPC instance|Create a Linux VPC instance that acts as a bastion host. Configure ACL and security group rules to allow SSH connectivity (port 22). Add a public IP address to the VPC instance. Allow connectivity from a restricted and limited number of public IP addresses. Allow connectivity from IP addresses of the Schematics engine nodes| | |* Create a virtual server instance that can act as an internet proxy server and to host basic management services like DNS, NTP, NFS|Network services VPC instance|Create a Linux VPC instance that can host management components. Preconfigure ACL and security group rules to allow traffic over private networks only.|Configure application load balancer to act as proxy server manually, Modify number of virtual server instances and allowed ports in preset or perform the modifications manually| |* Ensure financial services compliancy for VPC services \n * Perform network setup of all created services \n * Perform network isolation of all created services \n * Ensure all created services are interconnected |Secure landing zone components|Create a minimum set of required components for a secure landing zone|Create a modified set of required components for a secure landing zone in preset| -|* Allow customer to optionally enable monitoring in the deployment|IBM Cloud® monitoring instance and Monitoring Host VPC Instance|Optionally, create or import an existing IBM Cloud® monitoring instance (customer provided details) and create and pre-configure the Monitoring Host VPC instance to collect information and send it to the IBM Cloud® monitoring instance.| | -|* Allow customer to optionally enable [Security and Compliance Center Workload Protection](/docs/workload-protection) in the deployment \n * Collect posture management information, enable vulnerability scanning and threat detection|IBM Cloud® Security and Compliance Center Workload Protection and SCC Workload Protection agent on all VPC instances in the deployment.|Optionally, create an IBM Cloud® Security and Compliance Center Workload Protection instance and install and setup the SCC Workload Protection agent on all VPC instances in the deployment (bastion, network services, monitoring hosts).| | +|* Allow customer to optionally enable monitoring in the deployment|IBM Cloud® monitoring instance|Optionally, create or import an existing IBM Cloud® monitoring instance (customer provided details).| | +|* Allow customer to optionally enable [Security and Compliance Center Workload Protection](/docs/workload-protection) in the deployment \n * Collect posture management information, enable vulnerability scanning and threat detection|IBM Cloud® Security and Compliance Center Workload Protection and SCC Workload Protection agent on all VPC instances in the deployment.|Optionally, create an IBM Cloud® Security and Compliance Center Workload Protection instance and install and setup the SCC Workload Protection agent on all VPC instances in the deployment (bastion, network services).| | {: caption="Table 1. VPC architecture decisions" caption-side="bottom"} ### PowerVS workspace architecture decisions diff --git a/reference-architectures/standard-plus-vsi/deploy-arch-ibm-pvs-inf-standard-plus-vsi.svg b/reference-architectures/standard-plus-vsi/deploy-arch-ibm-pvs-inf-standard-plus-vsi.svg index 12d3c760..3cdd4604 100644 --- a/reference-architectures/standard-plus-vsi/deploy-arch-ibm-pvs-inf-standard-plus-vsi.svg +++ b/reference-architectures/standard-plus-vsi/deploy-arch-ibm-pvs-inf-standard-plus-vsi.svg @@ -1,4 +1,4 @@ -
IBM Cloud
IBM Cloud
Zone 1
Zone 1TransitGateway
PowerVS Resource Group
PowerVS Resource Group
Secure PowerVS Workspace
Secure PowerVS WorkspaceSSH Public Key
10.51.0.0/24: Management Subnet
10.51.0.0/24: Management Subnet
10.52.0.0/24: Backup Subnet
10.52.0.0/24: Backup Subnet
Power Virtual Server Instance
Power Virtual Server In...Block Storageveth: Management Networkveth: Backup Network
Cloud Services
Cloud ServicesEdge VPC Flow Log CollectorSecretsManagerObject  StorageInstallation filesObject  StorageActivity tracker MonitoringKey ProtectAcitivity Tracker Event RoutingActivity TrackerSCC WorkloadProtection
Services Resource Group
Services Resource Group
Edge Resource Group
Edge Resource Group
10.30.30.0/24: 
VPE Subnet
10.30.30.0/24:...COS VPE
VPE SG
VPE SG
Edge VPC (Default ACL)
Edge VPC (Default ACL)UserOpenVPN Client/SSH over bastion floating IP 
Management SG
Management SG
10.30.20.0/24: 
Mgmt VSI Subnet
10.30.20.0/24:...
Virtual Server
Virtual ServerFloatingIPBastionHost
Network-services SG
Network-services SG
10.30.40.0/24: Edge VSI Subnet
10.30.40.0/24: Edge VSI Subnet
Virtual Server
Virtual ServerProxy ServerDNSForwarderNTP ForwarderAnsible NodePublicGatewayNetworkLoadBalancerFileStorage
Virtual Server
Virtual ServerMonitoring Host
Default SG
Default SG
10.30.10.0/24: 
VPN Subnet
10.30.10.0/24:...Client to site VPN server
Consumer
ConsumerUserInternetText is not SVG - cannot display \ No newline at end of file +
IBM Cloud
IBM Cloud
Zone 1
Zone 1TransitGateway
PowerVS Resource Group
PowerVS Resource Group
Secure PowerVS Workspace
Secure PowerVS WorkspaceSSH Public Key
10.51.0.0/24: Management Subnet
10.51.0.0/24: Management Subnet
10.52.0.0/24: Backup Subnet
10.52.0.0/24: Backup Subnet
Power Virtual Server Instance
Power Virtual Server In...Block Storageveth: Management Networkveth: Backup Network
Cloud Services
Cloud ServicesEdge VPC Flow Log CollectorSecretsManagerObject  StorageInstallation filesObject  StorageActivity tracker MonitoringKey ProtectAcitivity Tracker Event RoutingActivity TrackerSCC WorkloadProtection
Services Resource Group
Services Resource Group
Edge Resource Group
Edge Resource Group
10.30.30.0/24: 
VPE Subnet
10.30.30.0/24:...COS VPE
VPE SG
VPE SG
Edge VPC (Default ACL)
Edge VPC (Default ACL)UserOpenVPN Client/SSH over bastion floating IP 
Management SG
Management SG
10.30.20.0/24: 
Mgmt VSI Subnet
10.30.20.0/24:...
Virtual Server
Virtual ServerFloatingIPBastionHost
Network-services SG
Network-services SG
10.30.40.0/24: Edge VSI Subnet
10.30.40.0/24: Edge VSI Subnet
Virtual Server
Virtual ServerProxy ServerDNSForwarderNTP ForwarderAnsible NodePublicGatewayNetworkLoadBalancerFileStorage
Default SG
Default SG
10.30.10.0/24: 
VPN Subnet
10.30.10.0/24:...Client to site VPN server
Consumer
ConsumerUserInternetText is not SVG - cannot display \ No newline at end of file diff --git a/reference-architectures/standard/deploy-arch-ibm-pvs-inf-standard.md b/reference-architectures/standard/deploy-arch-ibm-pvs-inf-standard.md index 07c7d075..3ecc058f 100644 --- a/reference-architectures/standard/deploy-arch-ibm-pvs-inf-standard.md +++ b/reference-architectures/standard/deploy-arch-ibm-pvs-inf-standard.md @@ -1,7 +1,7 @@ --- copyright: years: 2024, 2025 -lastupdated: "2025-10-09" +lastupdated: "2025-10-17" keywords: subcollection: deployable-reference-architectures authors: @@ -15,7 +15,7 @@ image_source: https://github.com/terraform-ibm-modules/terraform-ibm-powervs-inf use-case: ITServiceManagement industry: Technology content-type: reference-architecture -version: v10.1.0 +version: v10.2.0 compliance: SAPCertified --- @@ -28,7 +28,7 @@ compliance: SAPCertified {: toc-industry="Technology"} {: toc-use-case="ITServiceManagement"} {: toc-compliance="SAPCertified"} -{: toc-version="v10.1.0"} +{: toc-version="v10.2.0"} The Standard deployment of the Power Virtual Server with VPC landing zone creates VPC services and a Power Virtual Server workspace and interconnects them. @@ -61,8 +61,8 @@ IBM Cloud® Power Virtual Servers (PowerVS) is a public cloud offering that an e |* Create a virtual server instance as the only management access point to the landscape|Bastion host VPC instance|Create a Linux VPC instance that acts as a bastion host. Configure ACL and security group rules to allow SSH connectivity (port 22). Add a public IP address to the VPC instance. Allow connectivity from a restricted and limited number of public IP addresses. Allow connectivity from IP addresses of the Schematics engine nodes| | |* Create a virtual server instance that can act as an internet proxy server and to host basic management services like DNS, NTP, NFS|Network services VPC instance|Create a Linux VPC instance that can host management components. Preconfigure ACL and security group rules to allow traffic over private networks only.|Configure application load balancer to act as proxy server manually, Modify number of virtual server instances and allowed ports in preset or perform the modifications manually| |* Ensure financial services compliancy for VPC services \n * Perform network setup of all created services \n * Perform network isolation of all created services \n * Ensure all created services are interconnected |Secure landing zone components|Create a minimum set of required components for a secure landing zone|Create a modified set of required components for a secure landing zone in preset| -|* Allow customer to optionally enable monitoring in the deployment|IBM Cloud® monitoring instance and Monitoring Host VPC Instance|Optionally, create or import an existing IBM Cloud® monitoring instance (customer provided details) and create and pre-configure the Monitoring Host VPC instance to collect information and send it to the IBM Cloud® monitoring instance.| | -|* Allow customer to optionally enable [Security and Compliance Center Workload Protection](/docs/workload-protection) in the deployment \n * Collect posture management information, enable vulnerability scanning and threat detection|IBM Cloud® Security and Compliance Center Workload Protection and SCC Workload Protection agent on all VPC instances in the deployment.|Optionally, create an IBM Cloud® Security and Compliance Center Workload Protection instance and install and setup the SCC Workload Protection agent on all VPC instances in the deployment (bastion, network services, monitoring hosts).| | +|* Allow customer to optionally enable monitoring in the deployment|IBM Cloud® monitoring instance |Optionally, create or import an existing IBM Cloud® monitoring instance (customer provided details). | | +|* Allow customer to optionally enable [Security and Compliance Center Workload Protection](/docs/workload-protection) in the deployment \n * Collect posture management information, enable vulnerability scanning and threat detection|IBM Cloud® Security and Compliance Center Workload Protection and SCC Workload Protection agent on all VPC instances in the deployment.|Optionally, create an IBM Cloud® Security and Compliance Center Workload Protection instance and install and setup the SCC Workload Protection agent on all VPC instances in the deployment (bastion, network services).| | {: caption="Table 1. VPC architecture decisions" caption-side="bottom"} ### PowerVS workspace architecture decisions diff --git a/reference-architectures/standard/deploy-arch-ibm-pvs-inf-standard.svg b/reference-architectures/standard/deploy-arch-ibm-pvs-inf-standard.svg index 886b5137..5d7ef3b3 100644 --- a/reference-architectures/standard/deploy-arch-ibm-pvs-inf-standard.svg +++ b/reference-architectures/standard/deploy-arch-ibm-pvs-inf-standard.svg @@ -1,4 +1,4 @@ -
IBM Cloud
IBM Cloud
Zone 1
Zone 1TransitGateway
PowerVS Resource Group
PowerVS Resource Group
Secure PowerVS Workspace
Secure PowerVS WorkspaceSSH Public Key
10.51.0.0/24: Management Subnet
10.51.0.0/24: Management Subnet
10.52.0.0/24: Backup Subnet
10.52.0.0/24: Backup SubnetCOS Custom Images
Cloud Services
Cloud ServicesEdge VPC Flow Log CollectorSecretsManagerObject  StorageInstallation filesObject  StorageActivity tracker MonitoringKey ProtectAcitivity Tracker Event RoutingActivity TrackerSCC Workload Protection
Services Resource Group
Services Resource Group
Edge Resource Group
Edge Resource Group
10.30.30.0/24: 
VPE Subnet
10.30.30.0/24:...COS VPE
VPE SG
VPE SG
Edge VPC (Default ACL)
Edge VPC (Default ACL)UserOpenVPN Client/SSH over bastion floating IP 
Management SG
Management SG
10.30.20.0/24: 
Mgmt VSI Subnet
10.30.20.0/24:...
Virtual Server
Virtual ServerFloatingIPBastionHost
Network-services SG
Network-services SG
10.30.40.0/24: Edge VSI Subnet
10.30.40.0/24: Edge VSI Subnet
Virtual Server
Virtual ServerProxy ServerDNSForwarderNTP ForwarderAnsible NodePublicGatewayNetworkLoadBalancerFileStorage
Virtual Server
Virtual ServerMonitoring Host
Default SG
Default SG
10.30.10.0/24: 
VPN Subnet
10.30.10.0/24:...Client to site VPN server
Consumer
ConsumerUserInternetText is not SVG - cannot display \ No newline at end of file +
IBM Cloud
IBM Cloud
Zone 1
Zone 1TransitGateway
PowerVS Resource Group
PowerVS Resource Group
Secure PowerVS Workspace
Secure PowerVS WorkspaceSSH Public Key
10.51.0.0/24: Management Subnet
10.51.0.0/24: Management Subnet
10.52.0.0/24: Backup Subnet
10.52.0.0/24: Backup SubnetCOS Custom Images
Cloud Services
Cloud ServicesEdge VPC Flow Log CollectorSecretsManagerObject  StorageInstallation filesObject  StorageActivity tracker MonitoringKey ProtectAcitivity Tracker Event RoutingActivity TrackerSCC Workload Protection
Services Resource Group
Services Resource Group
Edge Resource Group
Edge Resource Group
10.30.30.0/24: 
VPE Subnet
10.30.30.0/24:...COS VPE
VPE SG
VPE SG
Edge VPC (Default ACL)
Edge VPC (Default ACL)UserOpenVPN Client/SSH over bastion floating IP 
Management SG
Management SG
10.30.20.0/24: 
Mgmt VSI Subnet
10.30.20.0/24:...
Virtual Server
Virtual ServerFloatingIPBastionHost
Network-services SG
Network-services SG
10.30.40.0/24: Edge VSI Subnet
10.30.40.0/24: Edge VSI Subnet
Virtual Server
Virtual ServerProxy ServerDNSForwarderNTP ForwarderAnsible NodePublicGatewayNetworkLoadBalancerFileStorage
Default SG
Default SG
10.30.10.0/24: 
VPN Subnet
10.30.10.0/24:...Client to site VPN server
Consumer
ConsumerUserInternetText is not SVG - cannot display \ No newline at end of file diff --git a/solutions/standard-openshift/README.md b/solutions/standard-openshift/README.md index 3bb569d3..cc2c2a9d 100644 --- a/solutions/standard-openshift/README.md +++ b/solutions/standard-openshift/README.md @@ -80,9 +80,8 @@ Due to technical limitations, the cost estimate Projects gives does not include | [cluster\_name](#input\_cluster\_name) | The name of the cluster and a unique identifier used as prefix for resources. Must begin with a lowercase letter and end with a lowercase letter or number. Must contain only lowercase letters, numbers, and - characters. This prefix will be prepended to any resources provisioned by this template. Prefixes must be 16 or fewer characters. | `string` | n/a | yes | | [cluster\_network\_config](#input\_cluster\_network\_config) | Configuration object for the OpenShift cluster and service network CIDRs. | 
object({
    cluster_network_cidr         = string
    cluster_service_network_cidr = string
    cluster_machine_network_cidr = string
  })
| 
{
  "cluster_machine_network_cidr": "10.72.0.0/24",
  "cluster_network_cidr": "10.128.0.0/14",
  "cluster_service_network_cidr": "10.67.0.0/16"
}
| no | | [cluster\_worker\_node\_config](#input\_cluster\_worker\_node\_config) | Configuration for the worker nodes of the OpenShift cluster, including CPU, system type, processor type, and replica count. If system\_type is null, it's chosen based on whether it's supported in the region. This can be overwritten by passing a value, e.g. 's1022' or 's922'. Memory is in GB. | 
object({
    processors  = number
    memory      = number
    system_type = string
    proc_type   = string
    replicas    = number
  })
| 
{
  "memory": "32",
  "proc_type": "Shared",
  "processors": "4",
  "replicas": "3",
  "system_type": null
}
| no | -| [enable\_monitoring](#input\_enable\_monitoring) | Specify whether Monitoring will be enabled. This includes the creation of an IBM Cloud Monitoring Instance and an Intel Monitoring Instance to host the services. If you already have an existing monitoring instance then specify in optional parameter 'existing\_monitoring\_instance\_crn' and setting this parameter to true. | `bool` | `false` | no | +| [enable\_monitoring](#input\_enable\_monitoring) | Specify whether Monitoring will be enabled. This creates a new IBM Cloud Monitoring Instance. | `bool` | `false` | no | | [enable\_scc\_wp](#input\_enable\_scc\_wp) | Enable SCC Workload Protection and install and configure the SCC Workload Protection agent on all intel VSIs in this deployment. | `bool` | `true` | no | -| [existing\_monitoring\_instance\_crn](#input\_existing\_monitoring\_instance\_crn) | Existing CRN of IBM Cloud Monitoring Instance. If value is null, then an IBM Cloud Monitoring Instance will not be created but an intel VSI instance will be created if 'enable\_monitoring' is true. | `string` | `null` | no | | [existing\_sm\_instance\_guid](#input\_existing\_sm\_instance\_guid) | An existing Secrets Manager GUID. If not provided a new instance will be provisioned. | `string` | `null` | no | | [existing\_sm\_instance\_region](#input\_existing\_sm\_instance\_region) | Required if value is passed into `var.existing_sm_instance_guid`. | `string` | `null` | no | | [external\_access\_ip](#input\_external\_access\_ip) | Specify the source IP address or CIDR for login through SSH to the environment after deployment. Access to the environment will be allowed only from this IP address. Can be set to 'null' if you choose to use client to site vpn. | `string` | `"0.0.0.0/0"` | no | @@ -110,7 +109,7 @@ Due to technical limitations, the cost estimate Projects gives does not include | [cluster\_name](#output\_cluster\_name) | The name of the cluster and the prefix that is associated with all resources. | | [cluster\_resource\_group](#output\_cluster\_resource\_group) | The resource group where all cluster resources, Transit Gateway, VPC, and PowerVS resources reside. | | [kms\_key\_map](#output\_kms\_key\_map) | Map of ids and keys for KMS keys created | -| [monitoring\_instance](#output\_monitoring\_instance) | Details of the IBM Cloud Monitoring Instance: CRN, location, guid. | +| [monitoring\_instance](#output\_monitoring\_instance) | Details of the IBM Cloud Monitoring Instance: CRN, location, guid, monitoring\_host\_ip. monitoring\_host\_ip is an empty string since no additional host is needed for this variation. | | [network\_load\_balancer](#output\_network\_load\_balancer) | Details of network load balancer. | | [network\_services\_config](#output\_network\_services\_config) | Complete configuration of network management services. | | [powervs\_ssh\_public\_key](#output\_powervs\_ssh\_public\_key) | SSH public key name and value in created PowerVS infrastructure. | diff --git a/solutions/standard-openshift/main.tf b/solutions/standard-openshift/main.tf index 07e38748..deb57980 100644 --- a/solutions/standard-openshift/main.tf +++ b/solutions/standard-openshift/main.tf @@ -31,27 +31,26 @@ module "standard" { providers = { ibm.ibm-is = ibm.ibm-is, ibm.ibm-pi = ibm.ibm-pi, ibm.ibm-sm = ibm.ibm-sm } - powervs_zone = var.powervs_zone - prefix = var.cluster_name - external_access_ip = var.external_access_ip - ssh_public_key = var.ssh_public_key - ssh_private_key = var.ssh_private_key - client_to_site_vpn = local.client_to_site_vpn - vpc_intel_images = var.vpc_intel_images - user_data = var.intel_user_data - powervs_resource_group_name = null - powervs_management_network = null - powervs_backup_network = null - tags = var.tags - sm_service_plan = var.sm_service_plan - existing_sm_instance_guid = var.existing_sm_instance_guid - existing_sm_instance_region = var.existing_sm_instance_region - network_services_vsi_profile = var.network_services_vsi_profile - enable_monitoring = var.enable_monitoring - existing_monitoring_instance_crn = var.existing_monitoring_instance_crn - enable_scc_wp = var.enable_scc_wp - ansible_vault_password = var.ansible_vault_password - ibm_dns_service = { enable = true, name = "${var.cluster_name}-dns", base_domain = var.cluster_base_domain, label = var.cluster_name } + powervs_zone = var.powervs_zone + prefix = var.cluster_name + external_access_ip = var.external_access_ip + ssh_public_key = var.ssh_public_key + ssh_private_key = var.ssh_private_key + client_to_site_vpn = local.client_to_site_vpn + vpc_intel_images = var.vpc_intel_images + user_data = var.intel_user_data + powervs_resource_group_name = null + powervs_management_network = null + powervs_backup_network = null + tags = var.tags + sm_service_plan = var.sm_service_plan + existing_sm_instance_guid = var.existing_sm_instance_guid + existing_sm_instance_region = var.existing_sm_instance_region + network_services_vsi_profile = var.network_services_vsi_profile + enable_monitoring = var.enable_monitoring + enable_scc_wp = var.enable_scc_wp + ansible_vault_password = var.ansible_vault_password + ibm_dns_service = { enable = true, name = "${var.cluster_name}-dns", base_domain = var.cluster_base_domain, label = var.cluster_name } } ##################################################### diff --git a/solutions/standard-openshift/outputs.tf b/solutions/standard-openshift/outputs.tf index 2ff8306d..d04535b0 100644 --- a/solutions/standard-openshift/outputs.tf +++ b/solutions/standard-openshift/outputs.tf @@ -106,7 +106,7 @@ output "network_services_config" { ######################################################################## output "monitoring_instance" { - description = "Details of the IBM Cloud Monitoring Instance: CRN, location, guid." + description = "Details of the IBM Cloud Monitoring Instance: CRN, location, guid, monitoring_host_ip. monitoring_host_ip is an empty string since no additional host is needed for this variation." value = module.standard.monitoring_instance } diff --git a/solutions/standard-openshift/variables.tf b/solutions/standard-openshift/variables.tf index 4fd52774..4a5e4a79 100644 --- a/solutions/standard-openshift/variables.tf +++ b/solutions/standard-openshift/variables.tf @@ -215,17 +215,11 @@ variable "enable_scc_wp" { } variable "enable_monitoring" { - description = "Specify whether Monitoring will be enabled. This includes the creation of an IBM Cloud Monitoring Instance and an Intel Monitoring Instance to host the services. If you already have an existing monitoring instance then specify in optional parameter 'existing_monitoring_instance_crn' and setting this parameter to true." + description = "Specify whether Monitoring will be enabled. This creates a new IBM Cloud Monitoring Instance." type = bool default = false } -variable "existing_monitoring_instance_crn" { - description = "Existing CRN of IBM Cloud Monitoring Instance. If value is null, then an IBM Cloud Monitoring Instance will not be created but an intel VSI instance will be created if 'enable_monitoring' is true. " - type = string - default = null -} - ########################################################### # Optional Parameters Secret Manager for client to site VPN ########################################################### diff --git a/solutions/standard-plus-vsi/README.md b/solutions/standard-plus-vsi/README.md index aabc5563..e052ba34 100644 --- a/solutions/standard-plus-vsi/README.md +++ b/solutions/standard-plus-vsi/README.md @@ -79,9 +79,8 @@ This example sets up the following infrastructure: | [custom\_profile](#input\_custom\_profile) | Overrides t-shirt profile: Custom PowerVS instance. Specify 'sap\_profile\_id' [here](https://cloud.ibm.com/docs/sap?topic=sap-hana-iaas-offerings-profiles-power-vs) or combination of 'cores' & 'memory'. Optionally volumes can be created. | 
object({
    sap_profile_id = string
    cores          = string
    memory         = string
    server_type    = string
    proc_type      = string
    storage = object({
      size = string
      tier = string
    })
  })
| 
{
  "cores": "",
  "memory": "",
  "proc_type": "",
  "sap_profile_id": null,
  "server_type": "",
  "storage": {
    "size": "",
    "tier": ""
  }
}
| no | | [custom\_profile\_instance\_boot\_image](#input\_custom\_profile\_instance\_boot\_image) | Override the t-shirt size specs of PowerVS Workspace instance by selecting an image name and providing valid 'custom\_profile' optional parameter. | `string` | `"none"` | no | | [dns\_forwarder\_config](#input\_dns\_forwarder\_config) | Configuration for the DNS forwarder to a DNS service that is not reachable directly from PowerVS. | 
object({
    dns_servers = string
  })
| 
{
  "dns_servers": "161.26.0.7; 161.26.0.8; 9.9.9.9;"
}
| no | -| [enable\_monitoring](#input\_enable\_monitoring) | Specify whether Monitoring will be enabled. This includes the creation of an IBM Cloud Monitoring Instance and an Intel Monitoring Instance to host the services. If you already have an existing monitoring instance then specify in optional parameter 'existing\_monitoring\_instance\_crn' and setting this parameter to true. | `bool` | `false` | no | +| [enable\_monitoring](#input\_enable\_monitoring) | Specify whether Monitoring will be enabled. This creates a new IBM Cloud Monitoring Instance. | `bool` | `true` | no | | [enable\_scc\_wp](#input\_enable\_scc\_wp) | Enable SCC Workload Protection and install and configure the SCC Workload Protection agent on all intel VSIs in this deployment. If set to true, then value for 'ansible\_vault\_password' in optional parameter must be set. | `bool` | `true` | no | -| [existing\_monitoring\_instance\_crn](#input\_existing\_monitoring\_instance\_crn) | Existing CRN of IBM Cloud Monitoring Instance. If value is null, then an IBM Cloud Monitoring Instance will not be created but an intel VSI instance will be created if 'enable\_monitoring' is true. | `string` | `null` | no | | [existing\_sm\_instance\_guid](#input\_existing\_sm\_instance\_guid) | An existing Secrets Manager GUID. If not provided a new instance will be provisioned. | `string` | `null` | no | | [existing\_sm\_instance\_region](#input\_existing\_sm\_instance\_region) | Required if value is passed into `var.existing_sm_instance_guid`. | `string` | `null` | no | | [external\_access\_ip](#input\_external\_access\_ip) | Specify the source IP address or CIDR for login through SSH to the environment after deployment. Access to the environment will be allowed only from this IP address. Can be set to 'null' if you choose to use client to site vpn. | `string` | `"0.0.0.0/0"` | no | @@ -109,7 +108,7 @@ This example sets up the following infrastructure: | [ansible\_host\_or\_ip](#output\_ansible\_host\_or\_ip) | Central Ansible node private IP address. | | [dns\_host\_or\_ip](#output\_dns\_host\_or\_ip) | DNS forwarder host for created PowerVS infrastructure. | | [kms\_key\_map](#output\_kms\_key\_map) | Map of ids and keys for KMS keys created | -| [monitoring\_instance](#output\_monitoring\_instance) | Details of the IBM Cloud Monitoring Instance: CRN, location, guid. | +| [monitoring\_instance](#output\_monitoring\_instance) | Details of the IBM Cloud Monitoring Instance: CRN, location, guid, monitoring\_host\_ip. monitoring\_host\_ip is an empty string if enable\_monitoring\_host is disabled. | | [network\_load\_balancer](#output\_network\_load\_balancer) | Details of network load balancer. | | [network\_services\_config](#output\_network\_services\_config) | Complete configuration of network management services. | | [nfs\_host\_or\_ip\_path](#output\_nfs\_host\_or\_ip\_path) | NFS host for created PowerVS infrastructure. | diff --git a/solutions/standard-plus-vsi/main.tf b/solutions/standard-plus-vsi/main.tf index 8be1e687..4b0f6bea 100644 --- a/solutions/standard-plus-vsi/main.tf +++ b/solutions/standard-plus-vsi/main.tf @@ -7,31 +7,30 @@ module "standard" { providers = { ibm.ibm-is = ibm.ibm-is, ibm.ibm-pi = ibm.ibm-pi, ibm.ibm-sm = ibm.ibm-sm } - powervs_zone = var.powervs_zone - prefix = var.prefix - external_access_ip = var.external_access_ip - ssh_public_key = var.ssh_public_key - ssh_private_key = var.ssh_private_key - client_to_site_vpn = var.client_to_site_vpn - vpc_subnet_cidrs = var.vpc_subnet_cidrs - vpc_intel_images = var.vpc_intel_images - configure_dns_forwarder = var.configure_dns_forwarder - configure_ntp_forwarder = var.configure_ntp_forwarder - configure_nfs_server = var.configure_nfs_server - dns_forwarder_config = var.dns_forwarder_config - nfs_server_config = var.nfs_server_config - powervs_resource_group_name = var.powervs_resource_group_name - powervs_management_network = var.powervs_management_network - powervs_backup_network = var.powervs_backup_network - tags = var.tags - sm_service_plan = var.sm_service_plan - existing_sm_instance_guid = var.existing_sm_instance_guid - existing_sm_instance_region = var.existing_sm_instance_region - network_services_vsi_profile = var.network_services_vsi_profile - enable_monitoring = var.enable_monitoring - existing_monitoring_instance_crn = var.existing_monitoring_instance_crn - enable_scc_wp = var.enable_scc_wp - ansible_vault_password = var.ansible_vault_password + powervs_zone = var.powervs_zone + prefix = var.prefix + external_access_ip = var.external_access_ip + ssh_public_key = var.ssh_public_key + ssh_private_key = var.ssh_private_key + client_to_site_vpn = var.client_to_site_vpn + vpc_subnet_cidrs = var.vpc_subnet_cidrs + vpc_intel_images = var.vpc_intel_images + configure_dns_forwarder = var.configure_dns_forwarder + configure_ntp_forwarder = var.configure_ntp_forwarder + configure_nfs_server = var.configure_nfs_server + dns_forwarder_config = var.dns_forwarder_config + nfs_server_config = var.nfs_server_config + powervs_resource_group_name = var.powervs_resource_group_name + powervs_management_network = var.powervs_management_network + powervs_backup_network = var.powervs_backup_network + tags = var.tags + sm_service_plan = var.sm_service_plan + existing_sm_instance_guid = var.existing_sm_instance_guid + existing_sm_instance_region = var.existing_sm_instance_region + network_services_vsi_profile = var.network_services_vsi_profile + enable_monitoring = var.enable_monitoring + enable_scc_wp = var.enable_scc_wp + ansible_vault_password = var.ansible_vault_password } ##################################################### diff --git a/solutions/standard-plus-vsi/outputs.tf b/solutions/standard-plus-vsi/outputs.tf index 7ea56c2c..dfea8f8d 100644 --- a/solutions/standard-plus-vsi/outputs.tf +++ b/solutions/standard-plus-vsi/outputs.tf @@ -102,7 +102,7 @@ output "network_services_config" { ######################################################################## output "monitoring_instance" { - description = "Details of the IBM Cloud Monitoring Instance: CRN, location, guid." + description = "Details of the IBM Cloud Monitoring Instance: CRN, location, guid, monitoring_host_ip. monitoring_host_ip is an empty string if enable_monitoring_host is disabled." value = module.standard.monitoring_instance } diff --git a/solutions/standard-plus-vsi/variables.tf b/solutions/standard-plus-vsi/variables.tf index 892a93bf..4b5a39bd 100644 --- a/solutions/standard-plus-vsi/variables.tf +++ b/solutions/standard-plus-vsi/variables.tf @@ -242,15 +242,9 @@ variable "enable_scc_wp" { } variable "enable_monitoring" { - description = "Specify whether Monitoring will be enabled. This includes the creation of an IBM Cloud Monitoring Instance and an Intel Monitoring Instance to host the services. If you already have an existing monitoring instance then specify in optional parameter 'existing_monitoring_instance_crn' and setting this parameter to true." + description = "Specify whether Monitoring will be enabled. This creates a new IBM Cloud Monitoring Instance." type = bool - default = false -} - -variable "existing_monitoring_instance_crn" { - description = "Existing CRN of IBM Cloud Monitoring Instance. If value is null, then an IBM Cloud Monitoring Instance will not be created but an intel VSI instance will be created if 'enable_monitoring' is true. " - type = string - default = null + default = true } ########################################################### diff --git a/solutions/standard/README.md b/solutions/standard/README.md index f889a44c..f6a4fde2 100644 --- a/solutions/standard/README.md +++ b/solutions/standard/README.md @@ -73,9 +73,8 @@ This example sets up the following infrastructure: | [configure\_nfs\_server](#input\_configure\_nfs\_server) | Specify if NFS server will be configured. This will allow you easily to share files between PowerVS instances (e.g., SAP installation files). [File storage share and mount target](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-create&interface=ui) in VPC will be created.. If yes, ensure 'nfs\_server\_config' optional variable is set properly below. Default value is '200GB' which will be mounted on specified directory in network-service vsi. | `bool` | `true` | no | | [configure\_ntp\_forwarder](#input\_configure\_ntp\_forwarder) | Specify if NTP forwarder will be configured. This will allow you to synchronize time between IBM PowerVS instances. NTP forwarder will be installed on the network-services vsi. | `bool` | `true` | no | | [dns\_forwarder\_config](#input\_dns\_forwarder\_config) | Configuration for the DNS forwarder to a DNS service that is not reachable directly from PowerVS. | 
object({
    dns_servers = string
  })
| 
{
  "dns_servers": "161.26.0.7; 161.26.0.8; 9.9.9.9;"
}
| no | -| [enable\_monitoring](#input\_enable\_monitoring) | Specify whether Monitoring will be enabled. This includes the creation of an IBM Cloud Monitoring Instance and an Intel Monitoring Instance to host the services. If you already have an existing monitoring instance then specify in optional parameter 'existing\_monitoring\_instance\_crn' and setting this parameter to true. | `bool` | `false` | no | +| [enable\_monitoring](#input\_enable\_monitoring) | Specify whether Monitoring will be enabled. This creates a new IBM Cloud Monitoring Instance. | `bool` | `false` | no | | [enable\_scc\_wp](#input\_enable\_scc\_wp) | Enable SCC Workload Protection and install and configure the SCC Workload Protection agent on all intel VSIs in this deployment. If set to true, then value for 'ansible\_vault\_password' in optional parameter must be set. | `bool` | `false` | no | -| [existing\_monitoring\_instance\_crn](#input\_existing\_monitoring\_instance\_crn) | Existing CRN of IBM Cloud Monitoring Instance. If value is null, then an IBM Cloud Monitoring Instance will not be created but an intel VSI instance will be created if 'enable\_monitoring' is true. | `string` | `null` | no | | [existing\_sm\_instance\_guid](#input\_existing\_sm\_instance\_guid) | An existing Secrets Manager GUID. If not provided a new instance will be provisioned. | `string` | `null` | no | | [existing\_sm\_instance\_region](#input\_existing\_sm\_instance\_region) | Required if value is passed into `var.existing_sm_instance_guid`. | `string` | `null` | no | | [external\_access\_ip](#input\_external\_access\_ip) | Specify the source IP address or CIDR for login through SSH to the environment after deployment. Access to the environment will be allowed only from this IP address. Can be set to 'null' if you choose to use client to site vpn. | `string` | n/a | yes | @@ -106,7 +105,7 @@ This example sets up the following infrastructure: | [ansible\_host\_or\_ip](#output\_ansible\_host\_or\_ip) | Central Ansible node private IP address. | | [dns\_host\_or\_ip](#output\_dns\_host\_or\_ip) | DNS forwarder host for created PowerVS infrastructure. | | [kms\_key\_map](#output\_kms\_key\_map) | Map of ids and keys for KMS keys created | -| [monitoring\_instance](#output\_monitoring\_instance) | Details of the IBM Cloud Monitoring Instance: CRN, location, guid. | +| [monitoring\_instance](#output\_monitoring\_instance) | Details of the IBM Cloud Monitoring Instance: CRN, location, guid, monitoring\_host\_ip. monitoring\_host\_ip is an empty string if enable\_monitoring\_host is disabled. | | [network\_load\_balancer](#output\_network\_load\_balancer) | Details of network load balancer. | | [network\_services\_config](#output\_network\_services\_config) | Complete configuration of network management services. | | [nfs\_host\_or\_ip\_path](#output\_nfs\_host\_or\_ip\_path) | NFS host for created PowerVS infrastructure. | diff --git a/solutions/standard/main.tf b/solutions/standard/main.tf index 9314c5ac..3152e7a0 100644 --- a/solutions/standard/main.tf +++ b/solutions/standard/main.tf @@ -33,7 +33,6 @@ module "standard" { existing_sm_instance_region = var.existing_sm_instance_region network_services_vsi_profile = var.network_services_vsi_profile enable_monitoring = var.enable_monitoring - existing_monitoring_instance_crn = var.existing_monitoring_instance_crn enable_scc_wp = var.enable_scc_wp ansible_vault_password = var.ansible_vault_password } diff --git a/solutions/standard/outputs.tf b/solutions/standard/outputs.tf index 7f8956d9..be41f0f3 100644 --- a/solutions/standard/outputs.tf +++ b/solutions/standard/outputs.tf @@ -107,7 +107,7 @@ output "network_services_config" { ######################################################################## output "monitoring_instance" { - description = "Details of the IBM Cloud Monitoring Instance: CRN, location, guid." + description = "Details of the IBM Cloud Monitoring Instance: CRN, location, guid, monitoring_host_ip. monitoring_host_ip is an empty string if enable_monitoring_host is disabled." value = module.standard.monitoring_instance } diff --git a/solutions/standard/variables.tf b/solutions/standard/variables.tf index 62323cf7..c2ba2cb6 100644 --- a/solutions/standard/variables.tf +++ b/solutions/standard/variables.tf @@ -268,18 +268,11 @@ variable "ansible_vault_password" { ################################################# variable "enable_monitoring" { - description = "Specify whether Monitoring will be enabled. This includes the creation of an IBM Cloud Monitoring Instance and an Intel Monitoring Instance to host the services. If you already have an existing monitoring instance then specify in optional parameter 'existing_monitoring_instance_crn' and setting this parameter to true." + description = "Specify whether Monitoring will be enabled. This creates a new IBM Cloud Monitoring Instance." type = bool default = false } -variable "existing_monitoring_instance_crn" { - description = "Existing CRN of IBM Cloud Monitoring Instance. If value is null, then an IBM Cloud Monitoring Instance will not be created but an intel VSI instance will be created if 'enable_monitoring' is true." - type = string - default = null -} - - ##################################################### # Optional Parameters Secret Manager