Skip to content

Commit 9a2f374

Browse files
gdbrancogdbranco
committed
OCM-13095 | feat: include zero egress vpc support
1 parent 71a7adc commit 9a2f374

File tree

28 files changed

+538
-71
lines changed

28 files changed

+538
-71
lines changed

‎README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,6 @@ This module serves as a comprehensive solution for deploying, configuring and ma
1010
```
1111
module "hcp" {
1212
source = "terraform-redhat/rosa-hcp/rhcs"
13-
version = "1.6.2"
1413
1514
cluster_name = "my-cluster"
1615
openshift_version = "4.14.24"
@@ -125,6 +124,7 @@ We recommend you install the following CLI tools:
125124
| <a name="input_https_proxy"></a> [https\_proxy](#input\_https\_proxy) | A proxy URL to use for creating HTTPS connections outside the cluster. | `string` | `null` | no |
126125
| <a name="input_identity_providers"></a> [identity\_providers](#input\_identity\_providers) | Provides a generic approach to add multiple identity providers after the creation of the cluster. This variable allows users to specify configurations for multiple identity providers in a flexible and customizable manner, facilitating the management of resources post-cluster deployment. For additional details regarding the variables utilized, refer to the [idp sub-module](./modules/idp). For non-primitive variables (such as maps, lists, and objects), supply the JSON-encoded string. | `map(any)` | `{}` | no |
127126
| <a name="input_ignore_machine_pools_deletion_error"></a> [ignore\_machine\_pools\_deletion\_error](#input\_ignore\_machine\_pools\_deletion\_error) | Ignore machine pool deletion error. Assists when cluster resource is managed within the same file for the destroy use case | `bool` | `false` | no |
127+
| <a name="input_is_zero_ingress"></a> [is\_zero\_ingress](#input\_is\_zero\_ingress) | Indicates use of zero ingress resources | `bool` | `false` | no |
128128
| <a name="input_kms_key_arn"></a> [kms\_key\_arn](#input\_kms\_key\_arn) | The key ARN is the Amazon Resource Name (ARN) of a CMK. It is a unique, fully qualified identifier for the CMK. A key ARN includes the AWS account, Region, and the key ID. | `string` | `null` | no |
129129
| <a name="input_kubelet_configs"></a> [kubelet\_configs](#input\_kubelet\_configs) | Provides a generic approach to add multiple kubelet configs after the creation of the cluster. This variable allows users to specify configurations for multiple kubelet configs in a flexible and customizable manner, facilitating the management of resources post-cluster deployment. For additional details regarding the variables utilized, refer to the [idp sub-module](./modules/kubelet-configs). For non-primitive variables (such as maps, lists, and objects), supply the JSON-encoded string. | `map(any)` | `{}` | no |
130130
| <a name="input_machine_cidr"></a> [machine\_cidr](#input\_machine\_cidr) | Block of IP addresses used by OpenShift while installing the cluster, for example "10.0.0.0/16". | `string` | `null` | no |

‎examples/rosa-hcp-private-zero-egress/README.md

+155
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,155 @@
1+
# Private Zero Egress ROSA HCP
2+
3+
## Introduction
4+
5+
This is a Terraform manifest example for creating a Red Hat OpenShift Service on AWS (ROSA) Hosted Control Plane (HCP) cluster. This example provides a structured configuration template that demonstrates how to deploy a ROSA cluster within your AWS environment by using Terraform.
6+
7+
This example includes:
8+
- A Zero Egress ROSA cluster with private access.
9+
- All AWS resources (IAM and networking) that are created as part of the ROSA cluster module execution.
10+
- A bastion host EC2 instance that allows to reach the private cluster.
11+
12+
## Example Usage
13+
14+
```
15+
############################
16+
# Cluster
17+
############################
18+
module "hcp" {
19+
source = "terraform-redhat/rosa-hcp/rhcs"
20+
21+
cluster_name = "my-cluster"
22+
openshift_version = "4.14.24"
23+
machine_cidr = module.vpc.cidr_block
24+
aws_subnet_ids = module.vpc.private_subnets
25+
aws_availability_zones = module.vpc.availability_zones
26+
replicas = 2
27+
private = true
28+
create_admin_user = true
29+
admin_credentials_username = "admin"
30+
admin_credentials_password = random_password.password.result
31+
32+
// STS configuration
33+
create_account_roles = true
34+
account_role_prefix = "my-cluster-account"
35+
create_oidc = true
36+
create_operator_roles = true
37+
operator_role_prefix = "my-cluster-operator"
38+
is_zero_ingress = true
39+
}
40+
41+
resource "random_password" "password" {
42+
length = 14
43+
special = true
44+
min_lower = 1
45+
min_numeric = 1
46+
min_special = 1
47+
min_upper = 1
48+
}
49+
50+
############################
51+
# VPC
52+
############################
53+
module "vpc" {
54+
source = "terraform-redhat/rosa-hcp/rhcs//modules/vpc"
55+
56+
name_prefix = "my-vpc"
57+
availability_zones_count = 1
58+
is_zero_ingress = true
59+
}
60+
61+
############################
62+
# Bastion instance for connection to the cluster
63+
############################
64+
data "aws_ami" "rhel9" {
65+
most_recent = true
66+
67+
filter {
68+
name = "platform-details"
69+
values = ["Red Hat Enterprise Linux"]
70+
}
71+
72+
filter {
73+
name = "architecture"
74+
values = ["x86_64"]
75+
}
76+
77+
filter {
78+
name = "root-device-type"
79+
values = ["ebs"]
80+
}
81+
82+
filter {
83+
name = "manifest-location"
84+
values = ["amazon/RHEL-9.*_HVM-*-x86_64-*-Hourly2-GP2"]
85+
}
86+
87+
owners = ["309956199498"] # Amazon's "Official Red Hat" account
88+
}
89+
module "bastion_host" {
90+
source = "../../modules/bastion-host"
91+
prefix = "my-host"
92+
vpc_id = module.vpc.vpc_id
93+
subnet_ids = [module.vpc.public_subnets[0]]
94+
ami_id = aws_ami.rhel9.id
95+
user_data_file = file("bastion-host-user-data.yaml")
96+
}
97+
```
98+
99+
100+
<!-- BEGIN_AUTOMATED_TF_DOCS_BLOCK -->
101+
## Requirements
102+
103+
| Name | Version |
104+
|------|---------|
105+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
106+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.35.0 |
107+
| <a name="requirement_random"></a> [random](#requirement\_random) | >= 2.0 |
108+
| <a name="requirement_rhcs"></a> [rhcs](#requirement\_rhcs) | >= 1.6.2 |
109+
110+
## Providers
111+
112+
| Name | Version |
113+
|------|---------|
114+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.35.0 |
115+
| <a name="provider_random"></a> [random](#provider\_random) | >= 2.0 |
116+
117+
## Modules
118+
119+
| Name | Source | Version |
120+
|------|--------|---------|
121+
| <a name="module_bastion_host"></a> [bastion\_host](#module\_bastion\_host) | ../../modules/bastion-host | n/a |
122+
| <a name="module_hcp"></a> [hcp](#module\_hcp) | ../../ | n/a |
123+
| <a name="module_vpc"></a> [vpc](#module\_vpc) | ../../modules/vpc | n/a |
124+
125+
## Resources
126+
127+
| Name | Type |
128+
|------|------|
129+
| [random_password.password](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password) | resource |
130+
| [aws_ami.rhel9](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ami) | data source |
131+
132+
## Inputs
133+
134+
| Name | Description | Type | Default | Required |
135+
|------|-------------|------|---------|:--------:|
136+
| <a name="input_cluster_name"></a> [cluster\_name](#input\_cluster\_name) | n/a | `string` | n/a | yes |
137+
| <a name="input_openshift_version"></a> [openshift\_version](#input\_openshift\_version) | n/a | `string` | `"4.16.3"` | no |
138+
139+
## Outputs
140+
141+
| Name | Description |
142+
|------|-------------|
143+
| <a name="output_account_role_prefix"></a> [account\_role\_prefix](#output\_account\_role\_prefix) | The prefix used for all generated AWS resources. |
144+
| <a name="output_account_roles_arn"></a> [account\_roles\_arn](#output\_account\_roles\_arn) | A map of Amazon Resource Names (ARNs) associated with the AWS IAM roles created. The key in the map represents the name of an AWS IAM role, while the corresponding value represents the associated Amazon Resource Name (ARN) of that role. |
145+
| <a name="output_bastion_host_public_ip"></a> [bastion\_host\_public\_ip](#output\_bastion\_host\_public\_ip) | Bastion Host Public IP |
146+
| <a name="output_cluster_api_url"></a> [cluster\_api\_url](#output\_cluster\_api\_url) | The URL of the API server. |
147+
| <a name="output_cluster_console_url"></a> [cluster\_console\_url](#output\_cluster\_console\_url) | The URL of the console. |
148+
| <a name="output_cluster_id"></a> [cluster\_id](#output\_cluster\_id) | Unique identifier of the cluster. |
149+
| <a name="output_oidc_config_id"></a> [oidc\_config\_id](#output\_oidc\_config\_id) | The unique identifier associated with users authenticated through OpenID Connect (OIDC) generated by this OIDC config. |
150+
| <a name="output_oidc_endpoint_url"></a> [oidc\_endpoint\_url](#output\_oidc\_endpoint\_url) | Registered OIDC configuration issuer URL, generated by this OIDC config. |
151+
| <a name="output_operator_role_prefix"></a> [operator\_role\_prefix](#output\_operator\_role\_prefix) | Prefix used for generated AWS operator policies. |
152+
| <a name="output_operator_roles_arn"></a> [operator\_roles\_arn](#output\_operator\_roles\_arn) | List of Amazon Resource Names (ARNs) for all operator roles created. |
153+
| <a name="output_password"></a> [password](#output\_password) | n/a |
154+
| <a name="output_path"></a> [path](#output\_path) | The arn path for the account/operator roles as well as their policies. |
155+
<!-- END_AUTOMATED_TF_DOCS_BLOCK -->

‎examples/rosa-hcp-private-zero-egress/main.tf

+87
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
locals {
2+
account_role_prefix = "${var.cluster_name}-account"
3+
operator_role_prefix = "${var.cluster_name}-operator"
4+
}
5+
6+
############################
7+
# Cluster
8+
############################
9+
module "hcp" {
10+
source = "../../"
11+
12+
cluster_name = var.cluster_name
13+
openshift_version = var.openshift_version
14+
machine_cidr = module.vpc.cidr_block
15+
aws_subnet_ids = module.vpc.private_subnets
16+
replicas = 2
17+
private = true
18+
create_admin_user = true
19+
admin_credentials_username = "admin"
20+
admin_credentials_password = random_password.password.result
21+
ec2_metadata_http_tokens = "required"
22+
23+
// STS configuration
24+
create_account_roles = true
25+
account_role_prefix = local.account_role_prefix
26+
create_oidc = true
27+
create_operator_roles = true
28+
operator_role_prefix = local.operator_role_prefix
29+
is_zero_ingress = true
30+
}
31+
32+
resource "random_password" "password" {
33+
length = 14
34+
special = true
35+
min_lower = 1
36+
min_numeric = 1
37+
min_special = 1
38+
min_upper = 1
39+
}
40+
41+
############################
42+
# VPC
43+
############################
44+
module "vpc" {
45+
source = "../../modules/vpc"
46+
47+
name_prefix = var.cluster_name
48+
availability_zones_count = 1
49+
is_zero_egress = true
50+
}
51+
52+
############################
53+
# Bastion instance for connection to the cluster
54+
############################
55+
data "aws_ami" "rhel9" {
56+
most_recent = true
57+
58+
filter {
59+
name = "platform-details"
60+
values = ["Red Hat Enterprise Linux"]
61+
}
62+
63+
filter {
64+
name = "architecture"
65+
values = ["x86_64"]
66+
}
67+
68+
filter {
69+
name = "root-device-type"
70+
values = ["ebs"]
71+
}
72+
73+
filter {
74+
name = "manifest-location"
75+
values = ["amazon/RHEL-9.*_HVM-*-x86_64-*-Hourly2-GP2"]
76+
}
77+
78+
owners = ["309956199498"] # Amazon's "Official Red Hat" account
79+
}
80+
module "bastion_host" {
81+
source = "../../modules/bastion-host"
82+
prefix = var.cluster_name
83+
vpc_id = module.vpc.vpc_id
84+
subnet_ids = [module.vpc.public_subnets[0]]
85+
ami_id = data.aws_ami.rhel9.id
86+
user_data_file = file("../../assets/bastion-host-user-data.yaml")
87+
}

‎examples/rosa-hcp-private-zero-egress/outputs.tf

+59
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
output "bastion_host_public_ip" {
2+
value = module.bastion_host.bastion_host_public_ip
3+
description = "Bastion Host Public IP"
4+
}
5+
6+
output "cluster_id" {
7+
value = module.hcp.cluster_id
8+
description = "Unique identifier of the cluster."
9+
}
10+
11+
output "cluster_api_url" {
12+
value = module.hcp.cluster_api_url
13+
description = "The URL of the API server."
14+
}
15+
16+
output "cluster_console_url" {
17+
value = module.hcp.cluster_console_url
18+
description = "The URL of the console."
19+
}
20+
21+
output "account_role_prefix" {
22+
value = module.hcp.account_role_prefix
23+
description = "The prefix used for all generated AWS resources."
24+
}
25+
26+
output "account_roles_arn" {
27+
value = module.hcp.account_roles_arn
28+
description = "A map of Amazon Resource Names (ARNs) associated with the AWS IAM roles created. The key in the map represents the name of an AWS IAM role, while the corresponding value represents the associated Amazon Resource Name (ARN) of that role."
29+
}
30+
31+
output "path" {
32+
value = module.hcp.path
33+
description = "The arn path for the account/operator roles as well as their policies."
34+
}
35+
36+
output "oidc_config_id" {
37+
value = module.hcp.oidc_config_id
38+
description = "The unique identifier associated with users authenticated through OpenID Connect (OIDC) generated by this OIDC config."
39+
}
40+
41+
output "oidc_endpoint_url" {
42+
value = module.hcp.oidc_endpoint_url
43+
description = "Registered OIDC configuration issuer URL, generated by this OIDC config."
44+
}
45+
46+
output "operator_role_prefix" {
47+
value = module.hcp.operator_role_prefix
48+
description = "Prefix used for generated AWS operator policies."
49+
}
50+
51+
output "operator_roles_arn" {
52+
value = module.hcp.operator_roles_arn
53+
description = "List of Amazon Resource Names (ARNs) for all operator roles created."
54+
}
55+
56+
output "password" {
57+
value = resource.random_password.password
58+
sensitive = true
59+
}

‎examples/rosa-hcp-private-zero-egress/variables.tf

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
variable "openshift_version" {
2+
type = string
3+
default = "4.16.3"
4+
validation {
5+
condition = can(regex("^[0-9]*[0-9]+.[0-9]*[0-9]+.[0-9]*[0-9]+$", var.openshift_version))
6+
error_message = "openshift_version must be with structure <major>.<minor>.<patch> (for example 4.13.6)."
7+
}
8+
}
9+
10+
variable "cluster_name" {
11+
type = string
12+
}

‎examples/rosa-hcp-private-zero-egress/versions.tf

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
terraform {
2+
required_version = ">= 1.0"
3+
4+
required_providers {
5+
aws = {
6+
source = "hashicorp/aws"
7+
version = ">= 5.35.0"
8+
}
9+
rhcs = {
10+
version = ">= 1.6.2"
11+
source = "terraform-redhat/rhcs"
12+
}
13+
random = {
14+
source = "hashicorp/random"
15+
version = ">= 2.0"
16+
}
17+
}
18+
}

‎examples/rosa-hcp-private/README.md

-1
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,6 @@ This example includes:
1717
############################
1818
module "hcp" {
1919
source = "terraform-redhat/rosa-hcp/rhcs"
20-
version = "1.6.2"
2120
2221
cluster_name = "my-cluster"
2322
openshift_version = "4.14.24"

‎examples/rosa-hcp-public-unmanaged-oidc/README.md

-1
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,6 @@ This example includes:
1616
############################
1717
module "hcp" {
1818
source = "terraform-redhat/rosa-hcp/rhcs"
19-
version = "1.6.2"
2019
2120
cluster_name = "my-cluster"
2221
openshift_version = "4.14.24"

‎examples/rosa-hcp-public/README.md

-1
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,6 @@ This example includes:
1616
############################
1717
module "hcp" {
1818
source = "terraform-redhat/rosa-hcp/rhcs"
19-
version = "1.6.2"
2019
2120
cluster_name = "my-cluster"
2221
openshift_version = "4.14.24"

0 commit comments

Comments
 (0)