This template allows users to easily create a VPC with one subnet in each of three zones, with a Red Hat OpenShift Cluster distributed in each zone with very few inputs needed by the user to quickly start using IBM Cloud VPC .
The defaults of this module can be overridden with JSON to allow for a fully cusomizable VPC environment.
| Name | Type | Description | Sensitive | Default |
|---|---|---|---|---|
| ibmcloud_api_key | string | The IBM Cloud platform API key needed to deploy IAM enabled resources. | true | |
| TF_VERSION | string | The version of the Terraform engine that's used in the Schematics workspace. | 1.0 |
|
| prefix | string | A unique identifier for resources. Must begin with a letter. This prefix will be prepended to any resources provisioned by this template. | ez-multizone-roks |
|
| region | string | Region where VPC will be created. To find your VPC region, use ibmcloud is regions command to find available regions. |
us-south |
|
| resource_group | string | Name of existing resource group where all infrastructure will be provisioned | asset-development |
|
| tags | list(string) | List of tags to apply to resources created by this module. | ["ez-vpc","multizone-vpc"] |
|
| use_public_gateways | bool | Add a public gateway in each zone. | true |
|
| allow_inbound_traffic | bool | Add a rule to the ACL to allow for inbound traffic from any IP address. | true |
|
| classic_access | bool | Add the ability to access classic infrastructure from your VPC. | false |
|
| object_storage_name | string | Name of the cloud object storage instance to use | ez-cluster-vpc-cos |
|
| create_new_cos_instance | bool | Create a new Cloud Object Storage instance. If this is false, the instance from object_storage_name will be retrieved from data. If you are using an existing COS instance, make sure that it is in the same resource group where you plan to create this template. |
true |
|
| object_storage_plan | string | Plan for object storage. Can be lite or standard. This value is only required on the creation of a new Cloud Object Storage instance |
standard |
|
| roks_cluster_version | string | ROKS Cluster version. To get a list of valid versions, use the IBM Cloud CLI command ibmcloud ks versions. To use the default version, leave as default. |
default |
|
| machine_type | string | The flavor of VPC worker node to use for your cluster. Use ibmcloud ks flavors to find flavors for a region. |
bx2.4x16 |
|
| workers_per_zone | number | Number of workers to provision in each subnet | 2 |
|
| disable_public_service_endpoint | bool | Disable public service endpoint for cluster. Once the service endpoint has been enabled, it cannot be disabled after cluster creation. | true |
|
| entitlement | string | If you purchased an IBM Cloud Cloud Pak that includes an entitlement to run worker nodes that are installed with OpenShift Container Platform, enter entitlement to create your cluster with that entitlement so that you are not charged twice for the OpenShift license. Note that this option can be set only when you create the cluster. After the cluster is created, the cost for the OpenShift license occurred and you cannot disable this charge. | cloud_pak |
|
| wait_till | string | To avoid long wait times when you run your Terraform code, you can specify the stage when you want Terraform to mark the cluster resource creation as completed. Depending on what stage you choose, the cluster creation might not be fully completed and continues to run in the background. However, your Terraform code can continue to run without waiting for the cluster to be fully created. Supported args are MasterNodeReady, OneWorkerNodeReady, and IngressReady |
IngressReady |
|
| override_json | string | Override any values with JSON to create a completely custom network. All quotation marks must be correctly escaped. | "{}" |
This module creates a single VPC in one IBM Cloud Region. The VPC can optionally be given access to Classic Infrastructure resources using the classic_access variable.
This module creates three subnets, one in each of the three zones:
| Zone | Subnet CIDR |
|---|---|
| 1 | 10.10.10.0/24 |
| 2 | 10.20.10.0/24 |
| 3 | 10.30.10.0/24 |
A single network ACL is created within the VPC and each of the three subnets are attached
The following network rules are automatically created for the VPC:
| Source | Destination | Direction | Allow / Deny |
|---|---|---|---|
| 10.10.10.0/24 | Any | Inbound | Allow |
| 10.20.10.0/24 | Any | Inbound | Allow |
| 10.30.10.0/24 | Any | Inbound | Allow |
| Any | 10.10.10.0/24 | Outbound | Allow |
| Any | 10.20.10.0/24 | Outbound | Allow |
| Any | 10.30.10.0/24 | Outbound | Allow |
| Any | Any | Outbound | Allow |
These rules are automatically added to allow the cluster to reach the nessecary endpoints for the creation of IBM Managed Cluster components.
| Source | Destination | TCP Rules | Direction | Allow / Deny |
|---|---|---|---|---|
| 161.26.0.0/16 | Any | Inbound | Allow | |
| 166.8.0.0/14 | Any | Inbound | Allow | |
| Any | Any | Port 30000-32767 | Inbound | Allow |
| Any | Any | Port 443 | Inbound | Allow |
| Any | 161.26.0.0/16 | Outbound | Allow | |
| Any | 166.8.0.0/14 | Outbound | Allow | |
| Any | Any | Port 30000-32767 | Outbound | Allow |
| Any | Any | Port 443 | Outbound | Allow |
| Any | Any | Outbound | Allow |
- To create a rule to allow all inbound traffic to your VPC, set the
allow_inbound_trafficvariable totrue.
Optionally, a public gateway can be added to each of the three subnets by setting the use_public_gateways variable to true.
This module creates a Red Hat OpenShift Cluster across all three subnets provisioned with the VPC.
This template uses a vpc module to create the network architecture. A complete custom network architecture can be created from this template by passing stringified json data into the override_json variable. For an example of a valid JSON file, see override.json