Skip to content

Commit b29ef31

Browse files
iamar7iamar7
authored
Merge branch 'main' into renovate/dependencies
2 parents 3677de9 + 9cbc797 commit b29ef31

File tree

14 files changed

+413
-147
lines changed

14 files changed

+413
-147
lines changed

‎README.md‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ Optionally, the module supports advanced security group management for the worke
2828
* [Submodules](./modules)
2929
* [fscloud](./modules/fscloud)
3030
* [kube-audit](./modules/kube-audit)
31+
* [worker-pool](./modules/worker-pool)
3132
* [Examples](./examples)
3233
* [2 MZR clusters in same VPC example](./examples/multiple_mzr_clusters)
3334
* [Advanced example (mzr, auto-scale, kms, taints)](./examples/advanced)
@@ -296,6 +297,7 @@ Optionally, you need the following permissions to attach Access Management tags
296297
| <a name="module_cbr_rule"></a> [cbr\_rule](#module\_cbr\_rule) | terraform-ibm-modules/cbr/ibm//modules/cbr-rule-module | 1.33.7 |
297298
| <a name="module_cos_instance"></a> [cos\_instance](#module\_cos\_instance) | terraform-ibm-modules/cos/ibm | 10.5.2 |
298299
| <a name="module_existing_secrets_manager_instance_parser"></a> [existing\_secrets\_manager\_instance\_parser](#module\_existing\_secrets\_manager\_instance\_parser) | terraform-ibm-modules/common-utilities/ibm//modules/crn-parser | 1.2.0 |
300+
| <a name="module_worker_pools"></a> [worker\_pools](#module\_worker\_pools) | ./modules/worker-pool | n/a |
299301
300302
### Resources
301303
@@ -308,8 +310,6 @@ Optionally, you need the following permissions to attach Access Management tags
308310
| [ibm_container_vpc_cluster.autoscaling_cluster_with_upgrade](https://registry.terraform.io/providers/ibm-cloud/ibm/latest/docs/resources/container_vpc_cluster) | resource |
309311
| [ibm_container_vpc_cluster.cluster](https://registry.terraform.io/providers/ibm-cloud/ibm/latest/docs/resources/container_vpc_cluster) | resource |
310312
| [ibm_container_vpc_cluster.cluster_with_upgrade](https://registry.terraform.io/providers/ibm-cloud/ibm/latest/docs/resources/container_vpc_cluster) | resource |
311-
| [ibm_container_vpc_worker_pool.autoscaling_pool](https://registry.terraform.io/providers/ibm-cloud/ibm/latest/docs/resources/container_vpc_worker_pool) | resource |
312-
| [ibm_container_vpc_worker_pool.pool](https://registry.terraform.io/providers/ibm-cloud/ibm/latest/docs/resources/container_vpc_worker_pool) | resource |
313313
| [ibm_iam_authorization_policy.ocp_secrets_manager_iam_auth_policy](https://registry.terraform.io/providers/ibm-cloud/ibm/latest/docs/resources/iam_authorization_policy) | resource |
314314
| [ibm_resource_tag.cluster_access_tag](https://registry.terraform.io/providers/ibm-cloud/ibm/latest/docs/resources/resource_tag) | resource |
315315
| [ibm_resource_tag.cos_access_tag](https://registry.terraform.io/providers/ibm-cloud/ibm/latest/docs/resources/resource_tag) | resource |
@@ -322,7 +322,6 @@ Optionally, you need the following permissions to attach Access Management tags
322322
| [ibm_container_addons.existing_addons](https://registry.terraform.io/providers/ibm-cloud/ibm/latest/docs/data-sources/container_addons) | data source |
323323
| [ibm_container_cluster_config.cluster_config](https://registry.terraform.io/providers/ibm-cloud/ibm/latest/docs/data-sources/container_cluster_config) | data source |
324324
| [ibm_container_cluster_versions.cluster_versions](https://registry.terraform.io/providers/ibm-cloud/ibm/latest/docs/data-sources/container_cluster_versions) | data source |
325-
| [ibm_container_vpc_worker_pool.all_pools](https://registry.terraform.io/providers/ibm-cloud/ibm/latest/docs/data-sources/container_vpc_worker_pool) | data source |
326325
| [ibm_is_lbs.all_lbs](https://registry.terraform.io/providers/ibm-cloud/ibm/latest/docs/data-sources/is_lbs) | data source |
327326
| [ibm_is_virtual_endpoint_gateway.api_vpe](https://registry.terraform.io/providers/ibm-cloud/ibm/latest/docs/data-sources/is_virtual_endpoint_gateway) | data source |
328327
| [ibm_is_virtual_endpoint_gateway.master_vpe](https://registry.terraform.io/providers/ibm-cloud/ibm/latest/docs/data-sources/is_virtual_endpoint_gateway) | data source |
@@ -338,7 +337,7 @@ Optionally, you need the following permissions to attach Access Management tags
338337
| <a name="input_addons"></a> [addons](#input\_addons) | Map of OCP cluster add-on versions to install (NOTE: The 'vpc-block-csi-driver' add-on is installed by default for VPC clusters and 'ibm-storage-operator' is installed by default in OCP 4.15 and later, however you can explicitly specify it here if you wish to choose a later version than the default one). For full list of all supported add-ons and versions, see https://cloud.ibm.com/docs/containers?topic=containers-supported-cluster-addon-versions | <pre>object({<br/> debug-tool = optional(object({<br/> version = optional(string)<br/> parameters_json = optional(string)<br/> }))<br/> image-key-synchronizer = optional(object({<br/> version = optional(string)<br/> parameters_json = optional(string)<br/> }))<br/> openshift-data-foundation = optional(object({<br/> version = optional(string)<br/> parameters_json = optional(string)<br/> }))<br/> vpc-file-csi-driver = optional(object({<br/> version = optional(string)<br/> parameters_json = optional(string)<br/> }))<br/> static-route = optional(object({<br/> version = optional(string)<br/> parameters_json = optional(string)<br/> }))<br/> cluster-autoscaler = optional(object({<br/> version = optional(string)<br/> parameters_json = optional(string)<br/> }))<br/> vpc-block-csi-driver = optional(object({<br/> version = optional(string)<br/> parameters_json = optional(string)<br/> }))<br/> ibm-storage-operator = optional(object({<br/> version = optional(string)<br/> parameters_json = optional(string)<br/> }))<br/> openshift-ai = optional(object({<br/> version = optional(string)<br/> parameters_json = optional(string)<br/> }))<br/> })</pre> | `{}` | no |
339338
| <a name="input_allow_default_worker_pool_replacement"></a> [allow\_default\_worker\_pool\_replacement](#input\_allow\_default\_worker\_pool\_replacement) | (Advanced users) Set to true to allow the module to recreate a default worker pool. If you wish to make any change to the default worker pool which requires the re-creation of the default pool follow these [steps](https://github.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc?tab=readme-ov-file#important-considerations-for-terraform-and-default-worker-pool). | `bool` | `false` | no |
340339
| <a name="input_attach_ibm_managed_security_group"></a> [attach\_ibm\_managed\_security\_group](#input\_attach\_ibm\_managed\_security\_group) | Specify whether to attach the IBM-defined default security group (whose name is kube-<clusterid>) to all worker nodes. Only applicable if `custom_security_group_ids` is set. | `bool` | `true` | no |
341-
| <a name="input_cbr_rules"></a> [cbr\_rules](#input\_cbr\_rules) | The list of context-based restriction rules to create. | <pre>list(object({<br/> description = string<br/> account_id = string<br/> rule_contexts = list(object({<br/> attributes = optional(list(object({<br/> name = string<br/> value = string<br/> }))) }))<br/> enforcement_mode = string<br/> tags = optional(list(object({<br/> name = string<br/> value = string<br/> })), [])<br/> operations = optional(list(object({<br/> api_types = list(object({<br/> api_type_id = string<br/> }))<br/> })))<br/> }))</pre> | `[]` | no |
340+
| <a name="input_cbr_rules"></a> [cbr\_rules](#input\_cbr\_rules) | The context-based restrictions rule to create. Only one rule is allowed. | <pre>list(object({<br/> description = string<br/> account_id = string<br/> rule_contexts = list(object({<br/> attributes = optional(list(object({<br/> name = string<br/> value = string<br/> }))) }))<br/> enforcement_mode = string<br/> tags = optional(list(object({<br/> name = string<br/> value = string<br/> })), [])<br/> operations = optional(list(object({<br/> api_types = list(object({<br/> api_type_id = string<br/> }))<br/> })))<br/> }))</pre> | `[]` | no |
342341
| <a name="input_cluster_config_endpoint_type"></a> [cluster\_config\_endpoint\_type](#input\_cluster\_config\_endpoint\_type) | Specify which type of endpoint to use for cluster config access: 'default', 'private', 'vpe', 'link'. A 'default' value uses the default endpoint of the cluster. | `string` | `"default"` | no |
343342
| <a name="input_cluster_name"></a> [cluster\_name](#input\_cluster\_name) | The name that is assigned to the provisioned cluster. | `string` | n/a | yes |
344343
| <a name="input_cluster_ready_when"></a> [cluster\_ready\_when](#input\_cluster\_ready\_when) | The cluster is ready based on one of the following:: MasterNodeReady (not recommended), OneWorkerNodeReady, Normal, IngressReady | `string` | `"IngressReady"` | no |

‎examples/advanced/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ The following resources are provisioned by this example:
88
- A VPC with subnets across 3 zones.
99
- A public gateway for all the three zones
1010
- A multi-zone (3 zone) KMS encrypted OCP VPC cluster, with worker pools in each zone.
11+
- An additional worker pool named `workerpool` is created and attached to the cluster using the `worker-pool` submodule.
1112
- Auto scaling enabled for the default worker pool.
1213
- Taints against the workers in zone-2 and zone-3.
1314
- Enable Kubernetes API server audit logs.

‎examples/advanced/main.tf‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -152,6 +152,15 @@ locals {
152152
effect = "NoExecute"
153153
}]
154154
}
155+
worker_pool = [
156+
{
157+
subnet_prefix = "zone-1"
158+
pool_name = "workerpool"
159+
machine_type = "bx2.4x16"
160+
operating_system = "REDHAT_8_64"
161+
workers_per_zone = 2
162+
}
163+
]
155164
}
156165

157166
module "ocp_base" {
@@ -186,6 +195,19 @@ data "ibm_container_cluster_config" "cluster_config" {
186195
config_dir = "${path.module}/../../kubeconfig"
187196
}
188197

198+
########################################################################################################################
199+
# Worker Pool
200+
########################################################################################################################
201+
202+
module "worker_pool" {
203+
source = "../../modules/worker-pool"
204+
resource_group_id = module.resource_group.resource_group_id
205+
vpc_id = ibm_is_vpc.vpc.id
206+
cluster_id = module.ocp_base.cluster_id
207+
vpc_subnets = local.cluster_vpc_subnets
208+
worker_pools = local.worker_pool
209+
}
210+
189211
########################################################################################################################
190212
# Kube Audit
191213
########################################################################################################################

‎ibm_catalog.json‎

Lines changed: 15 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -76,15 +76,6 @@
7676
"install_type": "fullstack",
7777
"working_directory": "solutions/fully-configurable",
7878
"release_notes_url": "https://cloud.ibm.com/docs/secure-infrastructure-vpc?topic=secure-infrastructure-vpc-secure-infrastructure-vpc-relnotes",
79-
"compliance": {
80-
"authority": "scc-v3",
81-
"profiles": [
82-
{
83-
"profile_name": "IBM Cloud Framework for Financial Services",
84-
"profile_version": "1.7.0"
85-
}
86-
]
87-
},
8879
"iam_permissions": [
8980
{
9081
"role_crns": [
@@ -266,8 +257,12 @@
266257
{
267258
"key": "openshift_version",
268259
"required": true,
269-
"default_value": "4.18",
260+
"default_value": "4.19",
270261
"options": [
262+
{
263+
"displayname": "4.19",
264+
"value": "4.19"
265+
},
271266
{
272267
"displayname": "4.18",
273268
"value": "4.18"
@@ -947,7 +942,7 @@
947942
{
948943
"key": "network_acls",
949944
"type": "list(object)",
950-
"default_value": "[\n { name = \"vpc-acl\"\n add_ibm_cloud_internal_rules = true\n add_vpc_connectivity_rules = true\n prepend_ibm_rules = true\n rules = [\n {\n name = \"allow-all-443-inbound\"\n action = \"allow\"\n direction = \"inbound\"\n tcp = {\n source_port_min = 443\n source_port_max = 443\n }\n destination = \"0.0.0.0/0\"\n source = \"0.0.0.0/0\"\n },\n {\n name = \"allow-all-80-inbound\"\n action = \"allow\"\n direction = \"inbound\"\n tcp = {\n source_port_min = 80\n source_port_max = 80\n }\n destination = \"0.0.0.0/0\"\n source = \"0.0.0.0/0\"\n },\n {\n name = \"allow-all-ingress-inbound\"\n action = \"allow\"\n direction = \"inbound\"\n tcp = {\n source_port_min = 30000\n source_port_max = 32767\n }\n destination = \"0.0.0.0/0\"\n source = \"0.0.0.0/0\"\n },\n {\n name = \"allow-all-443-outbound\"\n action = \"allow\"\n direction = \"outbound\"\n tcp = {\n port_max = 443\n port_min = 443\n }\n destination = \"0.0.0.0/0\"\n source = \"0.0.0.0/0\"\n },\n {\n name = \"allow-all-80-outbound\"\n action = \"allow\"\n direction = \"outbound\"\n tcp = {\n port_min = 80\n port_max = 80\n }\n destination = \"0.0.0.0/0\"\n source = \"0.0.0.0/0\"\n },\n {\n name = \"allow-all-ingress-outbound\"\n action = \"allow\"\n direction = \"outbound\"\n tcp = {\n port_min = 30000\n port_max = 32767\n }\n destination = \"0.0.0.0/0\"\n source = \"0.0.0.0/0\"\n }\n ]\n }\n]",
945+
"default_value": "[\n { name = \"vpc-acl\"\n add_ibm_cloud_internal_rules = true\n add_vpc_connectivity_rules = true\n prepend_ibm_rules = true\n rules = [\n {\n name = \"allow-443-inbound-source\"\n action = \"allow\"\n direction = \"inbound\"\n tcp = {\n source_port_min = 443\n source_port_max = 443\n }\n destination = \"0.0.0.0/0\"\n source = \"0.0.0.0/0\"\n },\n {\n name = \"allow-443-inbound-dest\"\n action = \"allow\"\n direction = \"inbound\"\n tcp = {\n port_max = 443\n port_min = 443\n }\n destination = \"0.0.0.0/0\"\n source = \"0.0.0.0/0\"\n },\n {\n name = \"allow-all-80-inbound\"\n action = \"allow\"\n direction = \"inbound\"\n tcp = {\n source_port_min = 80\n source_port_max = 80\n }\n destination = \"0.0.0.0/0\"\n source = \"0.0.0.0/0\"\n },\n {\n name = \"allow-all-ingress-inbound\"\n action = \"allow\"\n direction = \"inbound\"\n tcp = {\n source_port_min = 30000\n source_port_max = 32767\n }\n destination = \"0.0.0.0/0\"\n source = \"0.0.0.0/0\"\n },\n {\n name = \"allow-443-outbound-source\"\n action = \"allow\"\n direction = \"outbound\"\n tcp = {\n source_port_min = 443\n source_port_max = 443\n }\n destination = \"0.0.0.0/0\"\n source = \"0.0.0.0/0\"\n },\n {\n name = \"allow-443-outbound-dest\"\n action = \"allow\"\n direction = \"outbound\"\n tcp = {\n port_min = 443\n port_max = 443\n }\n destination = \"0.0.0.0/0\"\n source = \"0.0.0.0/0\"\n },\n {\n name = \"allow-all-80-outbound\"\n action = \"allow\"\n direction = \"outbound\"\n tcp = {\n port_min = 80\n port_max = 80\n }\n destination = \"0.0.0.0/0\"\n source = \"0.0.0.0/0\"\n },\n {\n name = \"allow-all-ingress-outbound\"\n action = \"allow\"\n direction = \"outbound\"\n tcp = {\n port_min = 30000\n port_max = 32767\n }\n destination = \"0.0.0.0/0\"\n source = \"0.0.0.0/0\"\n }\n ]\n }\n]",
951946
"description": "The list of ACLs to create. Provide at least one rule for each ACL. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/blob/main/solutions/fully-configurable/DA-types.md#network-acls-).",
952947
"required": false,
953948
"virtual": true,
@@ -1315,7 +1310,8 @@
13151310
}
13161311
],
13171312
"dependency_version_2": true,
1318-
"terraform_version": "1.10.5"
1313+
"terraform_version": "1.10.5",
1314+
"ignore_readme": true
13191315
},
13201316
{
13211317
"label": "QuickStart - Basic and simple",
@@ -1475,9 +1471,13 @@
14751471
},
14761472
{
14771473
"key": "openshift_version",
1478-
"default_value": "4.18",
1474+
"default_value": "4.19",
14791475
"required": true,
14801476
"options": [
1477+
{
1478+
"displayname": "4.19",
1479+
"value": "4.19"
1480+
},
14811481
{
14821482
"displayname": "4.18",
14831483
"value": "4.18"
@@ -1548,7 +1548,8 @@
15481548
}
15491549
],
15501550
"dependency_version_2": true,
1551-
"terraform_version": "1.10.5"
1551+
"terraform_version": "1.10.5",
1552+
"ignore_readme": true
15521553
}
15531554
]
15541555
}

0 commit comments

Comments
 (0)