Skip to content

Commit 3b7ef29

Browse files
gdbrancogdbranco
committed
OCM-13095 | feat: include zero egress vpc support
1 parent 71a7adc commit 3b7ef29

File tree

27 files changed

+537
-69
lines changed

27 files changed

+537
-69
lines changed

‎README.md

-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,6 @@ This module serves as a comprehensive solution for deploying, configuring and ma
1010
```
1111
module "hcp" {
1212
source = "terraform-redhat/rosa-hcp/rhcs"
13-
version = "1.6.2"
1413
1514
cluster_name = "my-cluster"
1615
openshift_version = "4.14.24"

‎examples/rosa-hcp-private-zero-egress/README.md

+162
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,162 @@
1+
# Private Zero Egress ROSA HCP
2+
3+
## Introduction
4+
5+
This is a Terraform manifest example for creating a Red Hat OpenShift Service on AWS (ROSA) Hosted Control Plane (HCP) cluster. This example provides a structured configuration template that demonstrates how to deploy a ROSA cluster within your AWS environment by using Terraform.
6+
7+
This example includes:
8+
- A Zero Egress ROSA cluster with private access.
9+
- All AWS resources (IAM and networking) that are created as part of the ROSA cluster module execution.
10+
- A bastion host EC2 instance that allows to reach the private cluster.
11+
12+
## Example Usage
13+
14+
```
15+
############################
16+
# Cluster
17+
############################
18+
module "hcp" {
19+
source = "terraform-redhat/rosa-hcp/rhcs"
20+
21+
cluster_name = "my-cluster"
22+
openshift_version = "4.14.24"
23+
machine_cidr = module.vpc.cidr_block
24+
aws_subnet_ids = module.vpc.private_subnets
25+
aws_availability_zones = module.vpc.availability_zones
26+
replicas = length(module.vpc.availability_zones)
27+
private = true
28+
29+
// STS configuration
30+
create_account_roles = true
31+
account_role_prefix = "my-cluster-account"
32+
create_oidc = true
33+
create_operator_roles = true
34+
operator_role_prefix = "my-cluster-operator"
35+
}
36+
37+
############################
38+
# HTPASSWD IDP
39+
############################
40+
module "htpasswd_idp" {
41+
source = "terraform-redhat/rosa-hcp/rhcs//modules/idp"
42+
43+
cluster_id = module.hcp.cluster_id
44+
name = "htpasswd-idp"
45+
idp_type = "htpasswd"
46+
htpasswd_idp_users = [{ username = "test-user", password = random_password.password.result }]
47+
}
48+
49+
resource "random_password" "password" {
50+
length = 14
51+
special = true
52+
min_lower = 1
53+
min_numeric = 1
54+
min_special = 1
55+
min_upper = 1
56+
}
57+
58+
############################
59+
# VPC
60+
############################
61+
module "vpc" {
62+
source = "terraform-redhat/rosa-hcp/rhcs//modules/vpc"
63+
64+
name_prefix = "my-vpc"
65+
availability_zones_count = 3
66+
}
67+
68+
############################
69+
# Bastion instance for connection to the cluster
70+
############################
71+
data "aws_ami" "rhel9" {
72+
most_recent = true
73+
74+
filter {
75+
name = "platform-details"
76+
values = ["Red Hat Enterprise Linux"]
77+
}
78+
79+
filter {
80+
name = "architecture"
81+
values = ["x86_64"]
82+
}
83+
84+
filter {
85+
name = "root-device-type"
86+
values = ["ebs"]
87+
}
88+
89+
filter {
90+
name = "manifest-location"
91+
values = ["amazon/RHEL-9.*_HVM-*-x86_64-*-Hourly2-GP2"]
92+
}
93+
94+
owners = ["309956199498"] # Amazon's "Official Red Hat" account
95+
}
96+
module "bastion_host" {
97+
source = "../../modules/bastion-host"
98+
prefix = "my-host"
99+
vpc_id = module.vpc.vpc_id
100+
subnet_ids = [module.vpc.public_subnets[0]]
101+
ami_id = aws_ami.rhel9.id
102+
user_data_file = file("bastion-host-user-data.yaml")
103+
}
104+
```
105+
106+
107+
<!-- BEGIN_AUTOMATED_TF_DOCS_BLOCK -->
108+
## Requirements
109+
110+
| Name | Version |
111+
| ------------------------------------------------------------------------- | --------- |
112+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
113+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.35.0 |
114+
| <a name="requirement_random"></a> [random](#requirement\_random) | >= 2.0 |
115+
| <a name="requirement_rhcs"></a> [rhcs](#requirement\_rhcs) | >= 1.6.2 |
116+
117+
## Providers
118+
119+
| Name | Version |
120+
| ---------------------------------------------------------- | --------- |
121+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.35.0 |
122+
| <a name="provider_random"></a> [random](#provider\_random) | >= 2.0 |
123+
124+
## Modules
125+
126+
| Name | Source | Version |
127+
| -------------------------------------------------------------------------- | -------------------------- | ------- |
128+
| <a name="module_bastion_host"></a> [bastion\_host](#module\_bastion\_host) | ../../modules/bastion-host | n/a |
129+
| <a name="module_hcp"></a> [hcp](#module\_hcp) | ../../ | n/a |
130+
| <a name="module_vpc"></a> [vpc](#module\_vpc) | ../../modules/vpc | n/a |
131+
132+
## Resources
133+
134+
| Name | Type |
135+
| ------------------------------------------------------------------------------------------------------------------- | ----------- |
136+
| [random_password.password](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password) | resource |
137+
| [aws_ami.rhel9](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ami) | data source |
138+
139+
## Inputs
140+
141+
| Name | Description | Type | Default | Required |
142+
| --------------------------------------------------------------------------------------- | ----------- | -------- | ---------- | :------: |
143+
| <a name="input_cluster_name"></a> [cluster\_name](#input\_cluster\_name) | n/a | `string` | n/a | yes |
144+
| <a name="input_openshift_version"></a> [openshift\_version](#input\_openshift\_version) | n/a | `string` | `"4.16.3"` | no |
145+
146+
## Outputs
147+
148+
| Name | Description |
149+
| ------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
150+
| <a name="output_account_role_prefix"></a> [account\_role\_prefix](#output\_account\_role\_prefix) | The prefix used for all generated AWS resources. |
151+
| <a name="output_account_roles_arn"></a> [account\_roles\_arn](#output\_account\_roles\_arn) | A map of Amazon Resource Names (ARNs) associated with the AWS IAM roles created. The key in the map represents the name of an AWS IAM role, while the corresponding value represents the associated Amazon Resource Name (ARN) of that role. |
152+
| <a name="output_bastion_host_public_ip"></a> [bastion\_host\_public\_ip](#output\_bastion\_host\_public\_ip) | Bastion Host Public IP |
153+
| <a name="output_cluster_api_url"></a> [cluster\_api\_url](#output\_cluster\_api\_url) | The URL of the API server. |
154+
| <a name="output_cluster_console_url"></a> [cluster\_console\_url](#output\_cluster\_console\_url) | The URL of the console. |
155+
| <a name="output_cluster_id"></a> [cluster\_id](#output\_cluster\_id) | Unique identifier of the cluster. |
156+
| <a name="output_oidc_config_id"></a> [oidc\_config\_id](#output\_oidc\_config\_id) | The unique identifier associated with users authenticated through OpenID Connect (OIDC) generated by this OIDC config. |
157+
| <a name="output_oidc_endpoint_url"></a> [oidc\_endpoint\_url](#output\_oidc\_endpoint\_url) | Registered OIDC configuration issuer URL, generated by this OIDC config. |
158+
| <a name="output_operator_role_prefix"></a> [operator\_role\_prefix](#output\_operator\_role\_prefix) | Prefix used for generated AWS operator policies. |
159+
| <a name="output_operator_roles_arn"></a> [operator\_roles\_arn](#output\_operator\_roles\_arn) | List of Amazon Resource Names (ARNs) for all operator roles created. |
160+
| <a name="output_password"></a> [password](#output\_password) | n/a |
161+
| <a name="output_path"></a> [path](#output\_path) | The arn path for the account/operator roles as well as their policies. |
162+
<!-- END_AUTOMATED_TF_DOCS_BLOCK -->

‎examples/rosa-hcp-private-zero-egress/main.tf

+87
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
locals {
2+
account_role_prefix = "${var.cluster_name}-account"
3+
operator_role_prefix = "${var.cluster_name}-operator"
4+
}
5+
6+
############################
7+
# Cluster
8+
############################
9+
module "hcp" {
10+
source = "../../"
11+
12+
cluster_name = var.cluster_name
13+
openshift_version = var.openshift_version
14+
machine_cidr = module.vpc.cidr_block
15+
aws_subnet_ids = module.vpc.private_subnets
16+
replicas = 2
17+
private = true
18+
create_admin_user = true
19+
admin_credentials_username = "admin"
20+
admin_credentials_password = random_password.password.result
21+
ec2_metadata_http_tokens = "required"
22+
23+
// STS configuration
24+
create_account_roles = true
25+
account_role_prefix = local.account_role_prefix
26+
create_oidc = true
27+
create_operator_roles = true
28+
operator_role_prefix = local.operator_role_prefix
29+
is_zero_ingress = true
30+
}
31+
32+
resource "random_password" "password" {
33+
length = 14
34+
special = true
35+
min_lower = 1
36+
min_numeric = 1
37+
min_special = 1
38+
min_upper = 1
39+
}
40+
41+
############################
42+
# VPC
43+
############################
44+
module "vpc" {
45+
source = "../../modules/vpc"
46+
47+
name_prefix = var.cluster_name
48+
availability_zones_count = 1
49+
is_zero_egress = true
50+
}
51+
52+
############################
53+
# Bastion instance for connection to the cluster
54+
############################
55+
data "aws_ami" "rhel9" {
56+
most_recent = true
57+
58+
filter {
59+
name = "platform-details"
60+
values = ["Red Hat Enterprise Linux"]
61+
}
62+
63+
filter {
64+
name = "architecture"
65+
values = ["x86_64"]
66+
}
67+
68+
filter {
69+
name = "root-device-type"
70+
values = ["ebs"]
71+
}
72+
73+
filter {
74+
name = "manifest-location"
75+
values = ["amazon/RHEL-9.*_HVM-*-x86_64-*-Hourly2-GP2"]
76+
}
77+
78+
owners = ["309956199498"] # Amazon's "Official Red Hat" account
79+
}
80+
module "bastion_host" {
81+
source = "../../modules/bastion-host"
82+
prefix = var.cluster_name
83+
vpc_id = module.vpc.vpc_id
84+
subnet_ids = [module.vpc.public_subnets[0]]
85+
ami_id = data.aws_ami.rhel9.id
86+
user_data_file = file("../../assets/bastion-host-user-data.yaml")
87+
}

‎examples/rosa-hcp-private-zero-egress/outputs.tf

+59
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
output "bastion_host_public_ip" {
2+
value = module.bastion_host.bastion_host_public_ip
3+
description = "Bastion Host Public IP"
4+
}
5+
6+
output "cluster_id" {
7+
value = module.hcp.cluster_id
8+
description = "Unique identifier of the cluster."
9+
}
10+
11+
output "cluster_api_url" {
12+
value = module.hcp.cluster_api_url
13+
description = "The URL of the API server."
14+
}
15+
16+
output "cluster_console_url" {
17+
value = module.hcp.cluster_console_url
18+
description = "The URL of the console."
19+
}
20+
21+
output "account_role_prefix" {
22+
value = module.hcp.account_role_prefix
23+
description = "The prefix used for all generated AWS resources."
24+
}
25+
26+
output "account_roles_arn" {
27+
value = module.hcp.account_roles_arn
28+
description = "A map of Amazon Resource Names (ARNs) associated with the AWS IAM roles created. The key in the map represents the name of an AWS IAM role, while the corresponding value represents the associated Amazon Resource Name (ARN) of that role."
29+
}
30+
31+
output "path" {
32+
value = module.hcp.path
33+
description = "The arn path for the account/operator roles as well as their policies."
34+
}
35+
36+
output "oidc_config_id" {
37+
value = module.hcp.oidc_config_id
38+
description = "The unique identifier associated with users authenticated through OpenID Connect (OIDC) generated by this OIDC config."
39+
}
40+
41+
output "oidc_endpoint_url" {
42+
value = module.hcp.oidc_endpoint_url
43+
description = "Registered OIDC configuration issuer URL, generated by this OIDC config."
44+
}
45+
46+
output "operator_role_prefix" {
47+
value = module.hcp.operator_role_prefix
48+
description = "Prefix used for generated AWS operator policies."
49+
}
50+
51+
output "operator_roles_arn" {
52+
value = module.hcp.operator_roles_arn
53+
description = "List of Amazon Resource Names (ARNs) for all operator roles created."
54+
}
55+
56+
output "password" {
57+
value = resource.random_password.password
58+
sensitive = true
59+
}

‎examples/rosa-hcp-private-zero-egress/variables.tf

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
variable "openshift_version" {
2+
type = string
3+
default = "4.16.3"
4+
validation {
5+
condition = can(regex("^[0-9]*[0-9]+.[0-9]*[0-9]+.[0-9]*[0-9]+$", var.openshift_version))
6+
error_message = "openshift_version must be with structure <major>.<minor>.<patch> (for example 4.13.6)."
7+
}
8+
}
9+
10+
variable "cluster_name" {
11+
type = string
12+
}

‎examples/rosa-hcp-private-zero-egress/versions.tf

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
terraform {
2+
required_version = ">= 1.0"
3+
4+
required_providers {
5+
aws = {
6+
source = "hashicorp/aws"
7+
version = ">= 5.35.0"
8+
}
9+
rhcs = {
10+
version = ">= 1.6.2"
11+
source = "terraform-redhat/rhcs"
12+
}
13+
random = {
14+
source = "hashicorp/random"
15+
version = ">= 2.0"
16+
}
17+
}
18+
}

‎examples/rosa-hcp-private/README.md

-1
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,6 @@ This example includes:
1717
############################
1818
module "hcp" {
1919
source = "terraform-redhat/rosa-hcp/rhcs"
20-
version = "1.6.2"
2120
2221
cluster_name = "my-cluster"
2322
openshift_version = "4.14.24"

‎examples/rosa-hcp-public-unmanaged-oidc/README.md

-1
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,6 @@ This example includes:
1616
############################
1717
module "hcp" {
1818
source = "terraform-redhat/rosa-hcp/rhcs"
19-
version = "1.6.2"
2019
2120
cluster_name = "my-cluster"
2221
openshift_version = "4.14.24"

‎examples/rosa-hcp-public/README.md

-1
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,6 @@ This example includes:
1616
############################
1717
module "hcp" {
1818
source = "terraform-redhat/rosa-hcp/rhcs"
19-
version = "1.6.2"
2019
2120
cluster_name = "my-cluster"
2221
openshift_version = "4.14.24"

0 commit comments

Comments
 (0)