Skip to content

Commit c601072

Browse files
alcampagalcampag
authored
Merge pull request #2710 from oracle-devrel/oke-rm
Oke-rm 1.3.3
2 parents b0572ee + 8d08119 commit c601072

13 files changed

Lines changed: 166 additions & 44 deletions

File tree

‎app-dev/devops-and-containers/oke/oke-rm/README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,13 +17,13 @@ This stack is used to create the initial network infrastructure for OKE. When co
1717
* You can apply this stack even on an existing VCN, so that only the NSGs for OKE will be created
1818
* The default CNI is the VCN Native CNI, and it is the recommended one
1919

20-
[![Deploy to Oracle Cloud](https://oci-resourcemanager-plugin.plugins.oci.oraclecloud.com/latest/deploy-to-oracle-cloud.svg)](https://cloud.oracle.com/resourcemanager/stacks/create?zipUrl=https://github.com/oracle-devrel/technology-engineering/releases/download/oke-rm-1.3.2/infra.zip)
20+
[![Deploy to Oracle Cloud](https://oci-resourcemanager-plugin.plugins.oci.oraclecloud.com/latest/deploy-to-oracle-cloud.svg)](https://cloud.oracle.com/resourcemanager/stacks/create?zipUrl=https://github.com/oracle-devrel/technology-engineering/releases/download/oke-rm-1.3.3/infra.zip)
2121

2222
## Step 2: Create the OKE control plane
2323

2424
This stack is used to create the OKE control plane ONLY.
2525

26-
[![Deploy to Oracle Cloud](https://oci-resourcemanager-plugin.plugins.oci.oraclecloud.com/latest/deploy-to-oracle-cloud.svg)](https://cloud.oracle.com/resourcemanager/stacks/create?zipUrl=https://github.com/oracle-devrel/technology-engineering/releases/download/oke-rm-1.3.2/oke.zip)
26+
[![Deploy to Oracle Cloud](https://oci-resourcemanager-plugin.plugins.oci.oraclecloud.com/latest/deploy-to-oracle-cloud.svg)](https://cloud.oracle.com/resourcemanager/stacks/create?zipUrl=https://github.com/oracle-devrel/technology-engineering/releases/download/oke-rm-1.3.3/oke.zip)
2727

2828
Also note that if the network infrastructure is located in a different compartment than the OKE cluster AND you are planning to use the OCI_VCN_NATIVE CNI,
2929
you must add these policies:

‎app-dev/devops-and-containers/oke/oke-rm/images/architecture.png‎

-5.18 MB
Loading

‎app-dev/devops-and-containers/oke/oke-rm/infra/infra.zip‎

-3.4 KB
Binary file not shown.

‎app-dev/devops-and-containers/oke/oke-rm/infra/local.tf‎

Lines changed: 57 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -4,18 +4,64 @@ locals {
44
vcn_cidr_blocks = [var.vcn_cidr_block]
55
tag_value = var.tag_value == null ? { "freeformTags" = {}, "definedTags" = {} } : var.tag_value
66
db_service_list = var.db_service_list == null ? [] : var.db_service_list
7-
subnets = {
8-
cidr = {
9-
pod = var.create_vcn ? cidrsubnet(var.vcn_cidr_block, 1, 0) : null # e.g., "10.0.0.0/17"
10-
worker = var.create_vcn ? cidrsubnet(var.vcn_cidr_block, 3, 4) : null # e.g., "10.0.128.0/19"
11-
lb_external = var.create_vcn ? cidrsubnet(var.vcn_cidr_block, 8, 160) : null # e.g., "10.0.160.0/24"
12-
lb_internal = var.create_vcn ? cidrsubnet(var.vcn_cidr_block, 8, 161) : null # e.g., "10.0.161.0/24"
13-
fss = var.create_vcn ? cidrsubnet(var.vcn_cidr_block, 8, 162) : null # e.g., "10.0.162.0/24"
14-
db = var.create_vcn ? cidrsubnet(var.vcn_cidr_block, 8, 164) : null # e.g., "10.0.164.0/24"
15-
msg = var.create_vcn ? cidrsubnet(var.vcn_cidr_block, 8, 165) : null # e.g., "10.0.165.0/24"
16-
bastion = var.create_vcn ? cidrsubnet(var.vcn_cidr_block, 13, 5216) : null # e.g., "10.0.163.0/29"
17-
cp = var.create_vcn ? cidrsubnet(var.vcn_cidr_block, 13, 5217) : null # e.g., "10.0.163.8/29"
7+
8+
vcn_cidr_prefix = tonumber(split("/", trimspace(var.vcn_cidr_block))[1])
9+
subnet_profile_by_cidr = {
10+
"16" = "large"
11+
"18" = "medium"
12+
"20" = "small"
13+
}
14+
subnet_profile = lookup(local.subnet_profile_by_cidr, tostring(local.vcn_cidr_prefix), "large")
15+
is_large = local.subnet_profile == "large"
16+
is_medium = local.subnet_profile == "medium"
17+
is_small = local.subnet_profile == "small"
18+
19+
subnet_profiles = {
20+
large = {
21+
# Assumes /16 base VCN (e.g., 10.0.0.0/16). Used IPs: 49936. Remaining free IPs: 15600.
22+
cidr = {
23+
pod = var.create_vcn && local.is_large ? cidrsubnet(var.vcn_cidr_block, 1, 0) : null # e.g., "10.0.0.0/17"
24+
worker = var.create_vcn && local.is_large ? cidrsubnet(var.vcn_cidr_block, 3, 4) : null # e.g., "10.0.128.0/19"
25+
lb_external = var.create_vcn && local.is_large ? cidrsubnet(var.vcn_cidr_block, 8, 160) : null # e.g., "10.0.160.0/24"
26+
lb_internal = var.create_vcn && local.is_large ? cidrsubnet(var.vcn_cidr_block, 8, 161) : null # e.g., "10.0.161.0/24"
27+
fss = var.create_vcn && local.is_large ? cidrsubnet(var.vcn_cidr_block, 8, 162) : null # e.g., "10.0.162.0/24"
28+
db = var.create_vcn && local.is_large ? cidrsubnet(var.vcn_cidr_block, 8, 164) : null # e.g., "10.0.164.0/24"
29+
msg = var.create_vcn && local.is_large ? cidrsubnet(var.vcn_cidr_block, 8, 165) : null # e.g., "10.0.165.0/24"
30+
bastion = var.create_vcn && local.is_large ? cidrsubnet(var.vcn_cidr_block, 13, 5216) : null # e.g., "10.0.163.0/29"
31+
cp = var.create_vcn && local.is_large ? cidrsubnet(var.vcn_cidr_block, 13, 5217) : null # e.g., "10.0.163.8/29"
32+
}
33+
}
34+
medium = {
35+
# Assumes /18 base VCN (e.g., 10.0.0.0/18). Used IPs: 9872. Remaining free IPs: 6512.
36+
cidr = {
37+
pod = var.create_vcn && local.is_medium ? cidrsubnet(var.vcn_cidr_block, 1, 0) : null # e.g., "10.0.0.0/19"
38+
worker = var.create_vcn && local.is_medium ? cidrsubnet(var.vcn_cidr_block, 4, 8) : null # e.g., "10.0.32.0/22"
39+
lb_external = var.create_vcn && local.is_medium ? cidrsubnet(var.vcn_cidr_block, 7, 72) : null # e.g., "10.0.36.0/25"
40+
lb_internal = var.create_vcn && local.is_medium ? cidrsubnet(var.vcn_cidr_block, 7, 73) : null # e.g., "10.0.36.128/25"
41+
fss = var.create_vcn && local.is_medium ? cidrsubnet(var.vcn_cidr_block, 7, 74) : null # e.g., "10.0.37.0/25"
42+
db = var.create_vcn && local.is_medium ? cidrsubnet(var.vcn_cidr_block, 7, 75) : null # e.g., "10.0.37.128/25"
43+
msg = var.create_vcn && local.is_medium ? cidrsubnet(var.vcn_cidr_block, 7, 76) : null # e.g., "10.0.38.0/25"
44+
bastion = var.create_vcn && local.is_medium ? cidrsubnet(var.vcn_cidr_block, 11, 1248) : null # e.g., "10.0.39.0/29"
45+
cp = var.create_vcn && local.is_medium ? cidrsubnet(var.vcn_cidr_block, 11, 1249) : null # e.g., "10.0.39.8/29"
46+
}
1847
}
48+
small = {
49+
# Assumes /20 base VCN (e.g., 10.0.0.0/20). Used IPs: 2896. Remaining free IPs: 1200.
50+
cidr = {
51+
pod = var.create_vcn && local.is_small ? cidrsubnet(var.vcn_cidr_block, 1, 0) : null # e.g., "10.0.0.0/21"
52+
worker = var.create_vcn && local.is_small ? cidrsubnet(var.vcn_cidr_block, 3, 4) : null # e.g., "10.0.8.0/23"
53+
lb_external = var.create_vcn && local.is_small ? cidrsubnet(var.vcn_cidr_block, 6, 40) : null # e.g., "10.0.10.0/26"
54+
lb_internal = var.create_vcn && local.is_small ? cidrsubnet(var.vcn_cidr_block, 6, 41) : null # e.g., "10.0.10.64/26"
55+
fss = var.create_vcn && local.is_small ? cidrsubnet(var.vcn_cidr_block, 6, 42) : null # e.g., "10.0.10.128/26"
56+
db = var.create_vcn && local.is_small ? cidrsubnet(var.vcn_cidr_block, 6, 43) : null # e.g., "10.0.10.192/26"
57+
msg = var.create_vcn && local.is_small ? cidrsubnet(var.vcn_cidr_block, 6, 44) : null # e.g., "10.0.11.0/26"
58+
bastion = var.create_vcn && local.is_small ? cidrsubnet(var.vcn_cidr_block, 9, 360) : null # e.g., "10.0.11.64/29"
59+
cp = var.create_vcn && local.is_small ? cidrsubnet(var.vcn_cidr_block, 9, 361) : null # e.g., "10.0.11.72/29"
60+
}
61+
}
62+
}
63+
subnets = {
64+
cidr = local.subnet_profiles[local.subnet_profile].cidr
1965
dns = {
2066
pod = "pod"
2167
worker = "worker"

‎app-dev/devops-and-containers/oke/oke-rm/infra/modules/network/dhcp.tf‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,10 @@ resource "oci_core_dhcp_options" "external_lb_dhcp" {
88
type = "DomainNameServer"
99
server_type = "VcnLocalPlusInternet"
1010
}
11+
options {
12+
type = "SearchDomain"
13+
search_domain_names = [local.vcn_search_domain]
14+
}
1115
count = local.create_external_lb_subnet ? 1 : 0
1216
}
1317

@@ -21,6 +25,10 @@ resource "oci_core_dhcp_options" "internal_lb_dhcp" {
2125
type = "DomainNameServer"
2226
server_type = "VcnLocalPlusInternet"
2327
}
28+
options {
29+
type = "SearchDomain"
30+
search_domain_names = [local.vcn_search_domain]
31+
}
2432
count = local.create_internal_lb_subnet ? 1 : 0
2533
}
2634

@@ -34,6 +42,10 @@ resource "oci_core_dhcp_options" "oke_cp_dhcp" {
3442
type = "DomainNameServer"
3543
server_type = "VcnLocalPlusInternet"
3644
}
45+
options {
46+
type = "SearchDomain"
47+
search_domain_names = [local.vcn_search_domain]
48+
}
3749
count = local.create_cp_subnet ? 1 : 0
3850
}
3951

@@ -47,6 +59,10 @@ resource "oci_core_dhcp_options" "worker_dhcp" {
4759
type = "DomainNameServer"
4860
server_type = "VcnLocalPlusInternet"
4961
}
62+
options {
63+
type = "SearchDomain"
64+
search_domain_names = [local.vcn_search_domain]
65+
}
5066
count = local.create_worker_subnet ? 1 : 0
5167
}
5268

@@ -60,6 +76,10 @@ resource "oci_core_dhcp_options" "pods_dhcp" {
6076
type = "DomainNameServer"
6177
server_type = "VcnLocalPlusInternet"
6278
}
79+
options {
80+
type = "SearchDomain"
81+
search_domain_names = [local.vcn_search_domain]
82+
}
6383
count = local.create_pod_subnet ? 1 : 0
6484
}
6585

@@ -73,6 +93,10 @@ resource "oci_core_dhcp_options" "bastion_dhcp" {
7393
type = "DomainNameServer"
7494
server_type = "VcnLocalPlusInternet"
7595
}
96+
options {
97+
type = "SearchDomain"
98+
search_domain_names = [local.vcn_search_domain]
99+
}
76100
count = local.create_bastion_subnet ? 1 : 0
77101
}
78102

@@ -86,6 +110,10 @@ resource "oci_core_dhcp_options" "fss_dhcp" {
86110
type = "DomainNameServer"
87111
server_type = "VcnLocalPlusInternet"
88112
}
113+
options {
114+
type = "SearchDomain"
115+
search_domain_names = [local.vcn_search_domain]
116+
}
89117
count = local.create_fss_subnet ? 1 : 0
90118
}
91119

@@ -99,6 +127,10 @@ resource "oci_core_dhcp_options" "db_dhcp" {
99127
type = "DomainNameServer"
100128
server_type = "VcnLocalPlusInternet"
101129
}
130+
options {
131+
type = "SearchDomain"
132+
search_domain_names = [local.vcn_search_domain]
133+
}
102134
count = local.create_db_subnet ? 1 : 0
103135
}
104136

@@ -112,5 +144,9 @@ resource "oci_core_dhcp_options" "msg_dhcp" {
112144
type = "DomainNameServer"
113145
server_type = "VcnLocalPlusInternet"
114146
}
147+
options {
148+
type = "SearchDomain"
149+
search_domain_names = [local.vcn_search_domain]
150+
}
115151
count = local.create_msg_subnet ? 1 : 0
116152
}

‎app-dev/devops-and-containers/oke/oke-rm/infra/modules/network/local.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ locals {
99
create_internal_lb_subnet = var.create_internal_lb_subnet && var.create_vcn
1010
all_subnet_private = (var.cp_subnet_private || !local.create_cp_subnet) && (!local.create_external_lb_subnet) && (var.bastion_subnet_private || !var.create_bastion_subnet)
1111
vcn_id = var.create_vcn ? oci_core_vcn.spoke_vcn.0.id : var.vcn_id
12+
vcn_search_domain = var.create_vcn ? oci_core_vcn.spoke_vcn.0.vcn_domain_name : null
1213
cp_nat_mode = local.create_cp_subnet && var.cp_subnet_private && var.cp_external_nat
1314
create_cp_external_traffic_rule = var.allow_external_cp_traffic && (!var.create_cp_subnet || (!var.cp_subnet_private || var.cp_external_nat))
1415

‎app-dev/devops-and-containers/oke/oke-rm/infra/modules/network/peering-nsg.tf‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
locals {
2+
# Only used when NSG exists
3+
peer_vcns_set = local.create_drg_attachment ? toset(var.peer_vcns) : []
4+
}
5+
6+
resource "oci_core_network_security_group" "peering" {
7+
compartment_id = var.network_compartment_id
8+
vcn_id = local.vcn_id
9+
freeform_tags = var.tag_value.freeformTags
10+
defined_tags = var.tag_value.definedTags
11+
display_name = "peering"
12+
count = local.create_drg_attachment && length(var.peer_vcns) > 0 ? 1 : 0
13+
}
14+
15+
resource "oci_core_network_security_group_security_rule" "peering_egress" {
16+
for_each = local.peer_vcns_set
17+
direction = "EGRESS"
18+
network_security_group_id = oci_core_network_security_group.peering.0.id
19+
protocol = "all"
20+
destination_type = "CIDR_BLOCK"
21+
destination = each.value
22+
stateless = true
23+
description = "Allow egress traffic to peered VCN ${each.value}"
24+
}
25+
26+
resource "oci_core_network_security_group_security_rule" "peering_ingress" {
27+
for_each = local.peer_vcns_set
28+
direction = "INGRESS"
29+
network_security_group_id = oci_core_network_security_group.peering.0.id
30+
protocol = "all"
31+
source_type = "CIDR_BLOCK"
32+
source = each.value
33+
stateless = true
34+
description = "Allow ingress traffic from peered VCN ${each.value}"
35+
}

‎app-dev/devops-and-containers/oke/oke-rm/infra/modules/network/routing.tf‎

Lines changed: 4 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -22,15 +22,6 @@ resource "oci_core_route_table" "bastion_route_table" {
2222
description = "Route to reach external Internet through the Internet gateway"
2323
}
2424
}
25-
dynamic "route_rules" {
26-
for_each = var.enable_drg ? var.peer_vcns : []
27-
content {
28-
network_entity_id = local.drg_id
29-
destination_type = "CIDR_BLOCK"
30-
destination = route_rules.value
31-
description = "Route to ${route_rules.value} through the DRG"
32-
}
33-
}
3425
count = local.create_bastion_subnet ? 1 : 0
3526
}
3627

@@ -68,7 +59,7 @@ resource "oci_core_route_table" "cp_route_table" {
6859
}
6960
}
7061
dynamic "route_rules" {
71-
for_each = var.enable_drg ? var.peer_vcns : []
62+
for_each = local.create_drg_attachment ? var.peer_vcns : []
7263
content {
7364
network_entity_id = local.drg_id
7465
destination_type = "CIDR_BLOCK"
@@ -91,15 +82,6 @@ resource "oci_core_route_table" "lb_ext_route_table" {
9182
destination = "0.0.0.0/0"
9283
description = "Route to reach external Internet through the Internet gateway"
9384
}
94-
dynamic "route_rules" {
95-
for_each = var.enable_drg ? var.peer_vcns : []
96-
content {
97-
network_entity_id = local.drg_id
98-
destination_type = "CIDR_BLOCK"
99-
destination = route_rules.value
100-
description = "Route to ${route_rules.value} through the DRG"
101-
}
102-
}
10385
count = local.create_external_lb_subnet ? 1 : 0
10486
}
10587

@@ -116,7 +98,7 @@ resource "oci_core_route_table" "lb_int_route_table" {
11698
description = "Route for all internal OCI services in the region"
11799
}
118100
dynamic "route_rules" {
119-
for_each = var.enable_drg ? var.peer_vcns : []
101+
for_each = local.create_drg_attachment ? var.peer_vcns : []
120102
content {
121103
network_entity_id = local.drg_id
122104
destination_type = "CIDR_BLOCK"
@@ -149,7 +131,7 @@ resource "oci_core_route_table" "worker_route_table" {
149131
}
150132
}
151133
dynamic "route_rules" {
152-
for_each = var.enable_drg ? var.peer_vcns : []
134+
for_each = local.create_drg_attachment ? var.peer_vcns : []
153135
content {
154136
network_entity_id = local.drg_id
155137
destination_type = "CIDR_BLOCK"
@@ -182,7 +164,7 @@ resource "oci_core_route_table" "pod_route_table" {
182164
}
183165
}
184166
dynamic "route_rules" {
185-
for_each = var.enable_drg ? var.peer_vcns : []
167+
for_each = local.create_drg_attachment ? var.peer_vcns : []
186168
content {
187169
network_entity_id = local.drg_id
188170
destination_type = "CIDR_BLOCK"

‎app-dev/devops-and-containers/oke/oke-rm/infra/schema.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -138,10 +138,10 @@ variables:
138138

139139
vcn_cidr_block:
140140
title: "VCN CIDR block"
141-
description: "CIDR blocks to be allocated for the VCN. MUST BE A /16 VCN"
141+
description: "CIDR blocks to be allocated for the VCN. MUST BE (x.y.0.0/16) OR (x.y.(0|64|128|192).0/18) OR (x.y.(multiple of 16).0/20)"
142142
type: string
143143
required: true
144-
pattern: "^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?).){2}0.0\/16$"
144+
pattern: "^(?:(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){2}0\\.0\\/(?:16)|(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){2}(?:0|64|128|192)\\.0\\/(?:18)|(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){2}(?:0|16|32|48|64|80|96|112|128|144|160|176|192|208|224|240)\\.0\\/(?:20))$"
145145
visible: ${create_vcn}
146146

147147
vcn_dns_label:

‎app-dev/devops-and-containers/oke/oke-rm/oke/addons.tf‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -140,4 +140,16 @@ resource "oci_containerengine_addon" "oke_cluster_autoscaler" {
140140
}
141141
depends_on = [module.oke]
142142
count = local.enable_cluster_autoscaler ? 1 : 0
143+
}
144+
145+
resource "oci_containerengine_addon" "oke_nodeProblemDetector" {
146+
addon_name = "NodeProblemDetector"
147+
cluster_id = module.oke.cluster_id
148+
remove_addon_resources_on_delete = false
149+
override_existing = true
150+
configurations {
151+
key = "enableKubernetesExporter"
152+
value = "true"
153+
}
154+
depends_on = [module.oke]
143155
}

0 commit comments

Comments
 (0)