Skip to content

Commit aa23dd2

Browse files
martatolosamartatolosa
authored
Merge pull request #2569 from oracle-devrel/oke-rm
Oke rm 1.3.0
2 parents c911ba6 + 534788d commit aa23dd2

34 files changed

Lines changed: 1049 additions & 67 deletions

‎app-dev/devops-and-containers/oke/oke-rm/README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,13 +17,13 @@ This stack is used to create the initial network infrastructure for OKE. When co
1717
* You can apply this stack even on an existing VCN, so that only the NSGs for OKE will be created
1818
* The default CNI is the VCN Native CNI, and it is the recommended one
1919

20-
[![Deploy to Oracle Cloud](https://oci-resourcemanager-plugin.plugins.oci.oraclecloud.com/latest/deploy-to-oracle-cloud.svg)](https://cloud.oracle.com/resourcemanager/stacks/create?zipUrl=https://github.com/oracle-devrel/technology-engineering/releases/download/oke-rm-1.2.1/infra.zip)
20+
[![Deploy to Oracle Cloud](https://oci-resourcemanager-plugin.plugins.oci.oraclecloud.com/latest/deploy-to-oracle-cloud.svg)](https://cloud.oracle.com/resourcemanager/stacks/create?zipUrl=https://github.com/oracle-devrel/technology-engineering/releases/download/oke-rm-1.3.0/infra.zip)
2121

2222
## Step 2: Create the OKE control plane
2323

2424
This stack is used to create the OKE control plane ONLY.
2525

26-
[![Deploy to Oracle Cloud](https://oci-resourcemanager-plugin.plugins.oci.oraclecloud.com/latest/deploy-to-oracle-cloud.svg)](https://cloud.oracle.com/resourcemanager/stacks/create?zipUrl=https://github.com/oracle-devrel/technology-engineering/releases/download/oke-rm-1.2.1/oke.zip)
26+
[![Deploy to Oracle Cloud](https://oci-resourcemanager-plugin.plugins.oci.oraclecloud.com/latest/deploy-to-oracle-cloud.svg)](https://cloud.oracle.com/resourcemanager/stacks/create?zipUrl=https://github.com/oracle-devrel/technology-engineering/releases/download/oke-rm-1.3.0/oke.zip)
2727

2828
Also note that if the network infrastructure is located in a different compartment than the OKE cluster AND you are planning to use the OCI_VCN_NATIVE CNI,
2929
you must add these policies:

‎app-dev/devops-and-containers/oke/oke-rm/images/architecture.png‎

-7.55 KB
Loading

‎app-dev/devops-and-containers/oke/oke-rm/infra/infra.zip‎

5.68 KB
Binary file not shown.

‎app-dev/devops-and-containers/oke/oke-rm/infra/local.tf‎

Lines changed: 12 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2,22 +2,27 @@ locals {
22
# VCN_NATIVE_CNI internally it is mapped as npn
33
cni = var.cni_type == "vcn_native" ? "npn" : var.cni_type
44
vcn_cidr_blocks = [var.vcn_cidr_block]
5+
tag_value = var.tag_value == null ? { "freeformTags" = {}, "definedTags" = {} } : var.tag_value
56
subnets = {
67
cidr = {
7-
pod = var.create_vcn ? cidrsubnet(var.vcn_cidr_block, 1, 0) : null # e.g., "10.1.0.0/17"
8-
worker = var.create_vcn ? cidrsubnet(var.vcn_cidr_block, 3, 4) : null # e.g., "10.1.128.0/19"
9-
lb_external = var.create_vcn ? cidrsubnet(var.vcn_cidr_block, 8, 160) : null # e.g., "10.1.160.0/24"
10-
lb_internal = var.create_vcn ? cidrsubnet(var.vcn_cidr_block, 8, 161) : null # e.g., "10.1.161.0/24"
11-
fss = var.create_vcn ? cidrsubnet(var.vcn_cidr_block, 8, 162) : null # e.g., "10.1.162.0/24"
12-
bastion = var.create_vcn ? cidrsubnet(var.vcn_cidr_block, 13, 5216) : null # e.g., "10.1.163.0/29"
13-
cp = var.create_vcn ? cidrsubnet(var.vcn_cidr_block, 13, 5217) : null # e.g., "10.1.163.8/29"
8+
pod = var.create_vcn ? cidrsubnet(var.vcn_cidr_block, 1, 0) : null # e.g., "10.0.0.0/17"
9+
worker = var.create_vcn ? cidrsubnet(var.vcn_cidr_block, 3, 4) : null # e.g., "10.0.128.0/19"
10+
lb_external = var.create_vcn ? cidrsubnet(var.vcn_cidr_block, 8, 160) : null # e.g., "10.0.160.0/24"
11+
lb_internal = var.create_vcn ? cidrsubnet(var.vcn_cidr_block, 8, 161) : null # e.g., "10.0.161.0/24"
12+
fss = var.create_vcn ? cidrsubnet(var.vcn_cidr_block, 8, 162) : null # e.g., "10.0.162.0/24"
13+
db = var.create_vcn ? cidrsubnet(var.vcn_cidr_block, 8, 164) : null # e.g., "10.0.164.0/24"
14+
msg = var.create_vcn ? cidrsubnet(var.vcn_cidr_block, 8, 165) : null # e.g., "10.0.165.0/24"
15+
bastion = var.create_vcn ? cidrsubnet(var.vcn_cidr_block, 13, 5216) : null # e.g., "10.0.163.0/29"
16+
cp = var.create_vcn ? cidrsubnet(var.vcn_cidr_block, 13, 5217) : null # e.g., "10.0.163.8/29"
1417
}
1518
dns = {
1619
pod = "pod"
1720
worker = "worker"
1821
lb_external = "lbext"
1922
lb_internal = "lbint"
2023
fss = "fss"
24+
db = "db"
25+
msg = "msg"
2126
bastion = "bastion"
2227
cp = "cp"
2328
}

‎app-dev/devops-and-containers/oke/oke-rm/infra/main.tf‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,11 +31,13 @@ module "network" {
3131
worker_subnet_cidr = local.subnets.cidr.worker
3232
worker_subnet_dns_label = local.subnets.dns.worker
3333
worker_subnet_name = var.worker_subnet_name
34+
allow_worker_nat_egress = var.allow_worker_nat_egress
3435
# POD SUBNET
3536
create_pod_subnet = var.create_pod_subnet
3637
pod_subnet_cidr = local.subnets.cidr.pod
3738
pod_subnet_dns_label = local.subnets.dns.pod
3839
pod_subnet_name = var.pod_subnet_name
40+
allow_pod_nat_egress = var.allow_pod_nat_egress
3941
# BASTION SUBNET
4042
create_bastion_subnet = var.create_bastion_subnet
4143
bastion_subnet_cidr = local.subnets.cidr.bastion
@@ -47,6 +49,13 @@ module "network" {
4749
fss_subnet_cidr = local.subnets.cidr.fss
4850
fss_subnet_dns_label = local.subnets.dns.fss
4951
fss_subnet_name = var.fss_subnet_name
52+
# DB SUBNET
53+
create_db_subnet = var.create_db_subnet
54+
db_subnet_cidr = local.subnets.cidr.db
55+
db_subnet_dns_label = local.subnets.dns.db
56+
db_subnet_name = var.db_subnet_name
57+
db_service_list = var.db_service_list
58+
separate_db_nsg = var.separate_db_nsg
5059
# GATEWAYS
5160
create_gateways = var.create_gateways
5261
create_internet_gateway = var.create_internet_gateway
@@ -61,4 +70,6 @@ module "network" {
6170
drg_name = var.drg_name
6271
create_drg_attachment = var.create_drg_attachment
6372
peer_vcns = var.peer_vcns
73+
# Tagging
74+
tag_value = local.tag_value
6475
}

‎app-dev/devops-and-containers/oke/oke-rm/infra/modules/network/cp-nsg.tf‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@ resource "oci_core_network_security_group" "cp_nsg" {
22
compartment_id = var.network_compartment_id
33
vcn_id = local.vcn_id
44
display_name = "cp"
5+
freeform_tags = var.tag_value.freeformTags
6+
defined_tags = var.tag_value.definedTags
57
}
68

79
# Worker nodes to control plane - Kubelet communication (port 12250)

‎app-dev/devops-and-containers/oke/oke-rm/infra/modules/network/db-nsg.tf‎

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
locals {
2+
create_db_nsg = local.create_db_subnet || ! var.create_vcn
3+
app_nsg_lookup = {
4+
npn = {
5+
nsg_id = local.is_npn ? oci_core_network_security_group.pod_nsg.0.id : null
6+
nsg_db = oci_core_network_security_group.pod_db
7+
}
8+
flannel = {
9+
nsg_id = oci_core_network_security_group.worker_nsg.id
10+
nsg_db = oci_core_network_security_group.worker_db
11+
}
12+
}
13+
app_nsg = local.is_npn ? local.app_nsg_lookup.npn : local.app_nsg_lookup.flannel
14+
}
15+
16+
resource "oci_core_network_security_group" "db" {
17+
for_each = local.create_db_nsg ? toset(var.db_service_list) : []
18+
compartment_id = var.network_compartment_id
19+
vcn_id = local.vcn_id
20+
freeform_tags = var.tag_value.freeformTags
21+
defined_tags = var.tag_value.definedTags
22+
display_name = each.value
23+
}
24+
25+
# POSTGRES
26+
27+
resource "oci_core_network_security_group_security_rule" "postgres_db_ingress" {
28+
direction = "INGRESS"
29+
network_security_group_id = oci_core_network_security_group.db[local.postgres_service].id
30+
protocol = local.tcp_protocol
31+
source_type = "NETWORK_SECURITY_GROUP"
32+
source = local.create_app_db_nsg ? local.app_nsg.nsg_db[local.postgres_service].id : local.app_nsg.nsg_id
33+
stateless = true
34+
description = "Allow communication from applications to postgres"
35+
tcp_options {
36+
destination_port_range {
37+
max = 5432
38+
min = 5432
39+
}
40+
}
41+
count = local.create_db_nsg && contains(var.db_service_list, local.postgres_service) ? 1 : 0
42+
}
43+
44+
resource "oci_core_network_security_group_security_rule" "postgres_db_egress" {
45+
direction = "EGRESS"
46+
network_security_group_id = oci_core_network_security_group.db[local.postgres_service].id
47+
protocol = local.tcp_protocol
48+
destination_type = "NETWORK_SECURITY_GROUP"
49+
destination = local.create_app_db_nsg ? local.app_nsg.nsg_db[local.postgres_service].id : local.app_nsg.nsg_id
50+
stateless = true
51+
description = "Allow communication from applications to pods"
52+
tcp_options {
53+
source_port_range {
54+
max = 5432
55+
min = 5432
56+
}
57+
}
58+
count = local.create_db_nsg && contains(var.db_service_list, local.postgres_service) ? 1 : 0
59+
}
60+
61+
# OCI Cache
62+
63+
resource "oci_core_network_security_group_security_rule" "cache_db_ingress" {
64+
direction = "INGRESS"
65+
network_security_group_id = oci_core_network_security_group.db[local.cache_service].id
66+
protocol = local.tcp_protocol
67+
source_type = "NETWORK_SECURITY_GROUP"
68+
source = local.create_app_db_nsg ? local.app_nsg.nsg_db[local.cache_service].id : local.app_nsg.nsg_id
69+
stateless = true
70+
description = "Allow communication from pods to oci cache"
71+
tcp_options {
72+
destination_port_range {
73+
max = 6379
74+
min = 6379
75+
}
76+
}
77+
count = local.create_db_nsg && contains(var.db_service_list, local.cache_service) ? 1 : 0
78+
}
79+
80+
resource "oci_core_network_security_group_security_rule" "cache_db_egress" {
81+
direction = "EGRESS"
82+
network_security_group_id = oci_core_network_security_group.db[local.cache_service].id
83+
protocol = local.tcp_protocol
84+
destination_type = "NETWORK_SECURITY_GROUP"
85+
destination = local.create_app_db_nsg ? local.app_nsg.nsg_db[local.cache_service].id : local.app_nsg.nsg_id
86+
stateless = true
87+
description = "Allow communication from oci cache to pods"
88+
tcp_options {
89+
source_port_range {
90+
max = 6379
91+
min = 6379
92+
}
93+
}
94+
count = local.create_db_nsg && contains(var.db_service_list, local.cache_service) ? 1 : 0
95+
}
96+
97+
# Oracle Database
98+
99+
resource "oci_core_network_security_group_security_rule" "oracle_db_ingress" {
100+
direction = "INGRESS"
101+
network_security_group_id = oci_core_network_security_group.db[local.oracledb_service].id
102+
protocol = local.tcp_protocol
103+
source_type = "NETWORK_SECURITY_GROUP"
104+
source = local.create_app_db_nsg ? local.app_nsg.nsg_db[local.oracledb_service].id : local.app_nsg.nsg_id
105+
stateless = true
106+
description = "Allow communication from pods to oracle database"
107+
tcp_options {
108+
destination_port_range {
109+
max = 1522
110+
min = 1521
111+
}
112+
}
113+
count = local.create_db_nsg && contains(var.db_service_list, local.oracledb_service) ? 1 : 0
114+
}
115+
116+
resource "oci_core_network_security_group_security_rule" "oracle_db_egress" {
117+
direction = "EGRESS"
118+
network_security_group_id = oci_core_network_security_group.db[local.oracledb_service].id
119+
protocol = local.tcp_protocol
120+
destination_type = "NETWORK_SECURITY_GROUP"
121+
destination = local.create_app_db_nsg ? local.app_nsg.nsg_db[local.oracledb_service].id : local.app_nsg.nsg_id
122+
stateless = true
123+
description = "Allow communication from oracle database to pods"
124+
tcp_options {
125+
source_port_range {
126+
max = 1522
127+
min = 1521
128+
}
129+
}
130+
count = local.create_db_nsg && contains(var.db_service_list, local.oracledb_service) ? 1 : 0
131+
}

‎app-dev/devops-and-containers/oke/oke-rm/infra/modules/network/dhcp.tf‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@ resource "oci_core_dhcp_options" "external_lb_dhcp" {
22
compartment_id = var.network_compartment_id
33
vcn_id = local.vcn_id
44
display_name = var.external_lb_subnet_name
5+
freeform_tags = var.tag_value.freeformTags
6+
defined_tags = var.tag_value.definedTags
57
options {
68
type = "DomainNameServer"
79
server_type = "VcnLocalPlusInternet"
@@ -13,6 +15,8 @@ resource "oci_core_dhcp_options" "internal_lb_dhcp" {
1315
compartment_id = var.network_compartment_id
1416
vcn_id = local.vcn_id
1517
display_name = var.internal_lb_subnet_name
18+
freeform_tags = var.tag_value.freeformTags
19+
defined_tags = var.tag_value.definedTags
1620
options {
1721
type = "DomainNameServer"
1822
server_type = "VcnLocalPlusInternet"
@@ -24,6 +28,8 @@ resource "oci_core_dhcp_options" "oke_cp_dhcp" {
2428
compartment_id = var.network_compartment_id
2529
vcn_id = local.vcn_id
2630
display_name = var.cp_subnet_name
31+
freeform_tags = var.tag_value.freeformTags
32+
defined_tags = var.tag_value.definedTags
2733
options {
2834
type = "DomainNameServer"
2935
server_type = "VcnLocalPlusInternet"
@@ -35,6 +41,8 @@ resource "oci_core_dhcp_options" "worker_dhcp" {
3541
compartment_id = var.network_compartment_id
3642
vcn_id = local.vcn_id
3743
display_name = var.worker_subnet_name
44+
freeform_tags = var.tag_value.freeformTags
45+
defined_tags = var.tag_value.definedTags
3846
options {
3947
type = "DomainNameServer"
4048
server_type = "VcnLocalPlusInternet"
@@ -46,6 +54,8 @@ resource "oci_core_dhcp_options" "pods_dhcp" {
4654
compartment_id = var.network_compartment_id
4755
vcn_id = local.vcn_id
4856
display_name = var.pod_subnet_name
57+
freeform_tags = var.tag_value.freeformTags
58+
defined_tags = var.tag_value.definedTags
4959
options {
5060
type = "DomainNameServer"
5161
server_type = "VcnLocalPlusInternet"
@@ -57,6 +67,8 @@ resource "oci_core_dhcp_options" "bastion_dhcp" {
5767
compartment_id = var.network_compartment_id
5868
vcn_id = local.vcn_id
5969
display_name = var.bastion_subnet_name
70+
freeform_tags = var.tag_value.freeformTags
71+
defined_tags = var.tag_value.definedTags
6072
options {
6173
type = "DomainNameServer"
6274
server_type = "VcnLocalPlusInternet"
@@ -68,9 +80,24 @@ resource "oci_core_dhcp_options" "fss_dhcp" {
6880
compartment_id = var.network_compartment_id
6981
vcn_id = local.vcn_id
7082
display_name = var.fss_subnet_name
83+
freeform_tags = var.tag_value.freeformTags
84+
defined_tags = var.tag_value.definedTags
7185
options {
7286
type = "DomainNameServer"
7387
server_type = "VcnLocalPlusInternet"
7488
}
7589
count = local.create_fss_subnet ? 1 : 0
7690
}
91+
92+
resource "oci_core_dhcp_options" "db_dhcp" {
93+
compartment_id = var.network_compartment_id
94+
vcn_id = local.vcn_id
95+
display_name = var.db_subnet_name
96+
freeform_tags = var.tag_value.freeformTags
97+
defined_tags = var.tag_value.definedTags
98+
options {
99+
type = "DomainNameServer"
100+
server_type = "VcnLocalPlusInternet"
101+
}
102+
count = local.create_db_subnet ? 1 : 0
103+
}

‎app-dev/devops-and-containers/oke/oke-rm/infra/modules/network/drg.tf‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
resource "oci_core_drg" "vcn_drg" {
22
compartment_id = var.network_compartment_id
33
display_name = var.drg_name
4+
freeform_tags = var.tag_value.freeformTags
5+
defined_tags = var.tag_value.definedTags
46

57
count = local.create_drg ? 1 : 0
68
}
79

810
resource "oci_core_drg_attachment" "oke_drg_attachment" {
9-
drg_id = local.drg_id
10-
display_name = var.vcn_name
11+
drg_id = local.drg_id
12+
display_name = var.vcn_name
13+
freeform_tags = var.tag_value.freeformTags
14+
defined_tags = var.tag_value.definedTags
1115

1216
network_details {
1317
id = local.vcn_id

‎app-dev/devops-and-containers/oke/oke-rm/infra/modules/network/fss-nsg.tf‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@ resource "oci_core_network_security_group" "fss_nsg" {
22
compartment_id = var.network_compartment_id
33
vcn_id = local.vcn_id
44
display_name = "fss"
5+
freeform_tags = var.tag_value.freeformTags
6+
defined_tags = var.tag_value.definedTags
57
}
68

79
# NFS Portmapper - UDP (port 111)

0 commit comments

Comments
 (0)