Infrastructure🔗

For some of the cloud platforms, you must explicitly specify the infrastructure layer on which the OpenShift cluster(s) will be provisioned, or you can override the defaults.

For IBM Cloud, you can configure the VPC, subnets, NFS server(s), other Virtual Server Instance(s) and a number of other objects. When provisioning OpenShift on vSphere, you can configure data center, data store, network and virtual machine definitions. For Azure ARO you configure a single object with information about the virtual network (vnet) to be used and the node server profiles. When deploying OpenShift on AWS you can specify an EFS server if you want to use elastic storage.

This page lists all the objects you can configure for each of the supported cloud providers. - IBM Cloud - Microsoft Azure - Amazon AWS - vSphere

IBM Cloud🔗

For IBM Cloud, the following object types are supported:

• provider
• resource_group
• ssh_keys
• address_prefix
• subnet
• network_acl
• security_group
• vsi
• transit_gateway
• nfs_server
• serviceid
• cos

IBM Cloud provider🔗

Defines the provider that Terraform will use for managing the IBM Cloud assets.

provider:
- name: ibm
  region: eu-de

Property explanation🔗

IBM Cloud resource_group🔗

The resource group is for cloud asset grouping purposes. You can define multiple resource groups in your IBM cloud account to group the provisioned assets. If you do not need to group your assets, choose default.

resource_group:
- name: default

Property explanation🔗

IBM Cloud ssh_keys🔗

SSH keys to connect to VSIs. If you have Virtual Server Instances in your VPC, you will need an SSH key to connect to them. SSH keys defined here will be looked up in the vault and created if they don't exist already.

ssh_keys:
- name: vsi-access
  managed: True

Property explanation🔗

IBM Cloud security_rule🔗

Defines the services (or ports) which are allowed within the context of a VPC and/or VSI.

security_rule:
- name: https
  tcp: {port_min: 443, port_max: 443}
- name: ssh
  tcp: {port_min: 22, port_max: 22}

Property explanation🔗

IBM Cloud vpc🔗

Defines the virtual private cloud which groups the provisioned objects (including VSIs and OpenShift cluster).

vpc:
- name: sample
  allow_inbound: ['ssh', 'https']
  classic_access: false

Property explanation🔗

IBM Cloud address_prefix🔗

Defines the zones used within the VPC, along with the subnet the addresses will be issued for.

- name: sample-zone-1
  vpc: sample
  zone: eu-de-1
  cidr: 10.27.0.0/26
- name: sample-zone-2
  vpc: sample
  zone: eu-de-2
  cidr: 10.27.0.64/26
- name: sample-zone-3
  vpc: sample
  zone: eu-de-3
  cidr: 10.27.0.128/26

Property explanation🔗

IBM Cloud subnet🔗

Defines the subnet that Virtual Server Instances and ROKS compute nodes will be attached to.

subnet:
- name: sample-subnet-zone-1
  address_prefix: sample-zone-1
  ipv4_cidr_block: 10.27.0.0/26
  zone: eu-de-1
  vpc: sample
  network_acl: sample-acl

Property explanation🔗

IBM Cloud network_acl🔗

Defines the network access control list to be associated with subnets to allow or deny traffic from or to external connections. The rules are processed in sequence per direction. Rules that appear higher in the list will be processed first.

network_acl:
- name: "{{ env_id }}-acl"
  vpc_name: "{{ env_id }}"
  rules:
  - name: inbound-ssh
    action: allow               # Can be allow or deny
    source: "0.0.0.0/0"
    destination: "0.0.0.0/0"
    direction: inbound
    tcp:
      source_port_min: 1        # optional
      source_port_max: 65535    # optional
      dest_port_min: 22         # optional
      dest_port_max: 22         # optional
  - name: output-udp
    action: deny                # Can be allow or deny
    source: "0.0.0.0/0"
    destination: "0.0.0.0/0"
    direction: outbound
    udp:
      source_port_min: 1        # optional
      source_port_max: 65535    # optional
      dest_port_min: 1000       # optional
      dest_port_max: 2000       # optional
  - name: output-icmp
    action: allow               # Can be allow or deny
    source: "0.0.0.0/0"
    destination: "0.0.0.0/0"
    direction: outbound
    icmp:
      code: 1
      type: 1

Property explanation🔗

IBM Cloud vsi🔗

Defines a Virtual Server Instance within the VPC.

vsi:
- name: sample-bastion
  infrastructure:
    type: vpc
    keys:
    - "vsi-access"
    image: ibm-redhat-8-3-minimal-amd64-3
    subnet: sample-subnet-zone-1
    primary_ipv4_address: 10.27.0.4
    public_ip: True
    vpc_name: sample
    zone: eu-de-3

Property explanation🔗

IBM Cloud transit_gateway🔗

Connects one or more VPCs to each other.

transit_gateway:
- name: sample-tgw
  location: eu-de
  connections:
  - vpc: other-vpc
  - vpc: sample

Property explanation🔗

IBM Cloud nfs_server🔗

Defines a Virtual Server Instance within the VPC that will be used as an NFS server.

nfs_server:
- name: sample-nfs
  infrastructure:
    type: vpc
    vpc_name: sample
    subnet: sample-subnet-zone-1
    zone: eu-de-1
    primary_ipv4_address: 10.27.0.5
    image: ibm-redhat-8-3-minimal-amd64-3
    profile: cx2-2x4
    bastion_host: sample-bastion
    storage_folder: /data/nfs
    storage_profile: 10iops-tier
    keys:
      - "sample-nfs-provision"

Property explanation🔗

IBM Cloud cos🔗

Defines a IBM Cloud Cloud Object Storage instance and allows to create buckets.

cos:
- name: {{ env_id }}-cos
  plan: standard
  location: global
  serviceids:
  - name: {{ env_id }}-cos-serviceid
    roles: ["Manager", "Viewer", "Administrator"]
  buckets:
  - name: bucketone6c9d6840
    cross_region_location: eu

Property explanation🔗

serviceid🔗

Defines a iam_service_id that can be granted several role based accesss right via attaching iam_policies to it.

serviceid:
- name: sample-serviceid
  description: to access ibmcloud services from external
  servicekeys:
  - name: primarykey

Property explanation🔗

Microsoft Azure🔗

For Microsoft Azure, the following object type is supported:

• azure

Azure🔗

Defines an infrastructure configuration onto which OpenShift will be provisioned.

azure:
- name: sample
  resource_group:
    name: sample
    location: westeurope
  vnet:
    name: vnet
    address_space: 10.0.0.0/22
  control_plane:
    subnet:
      name: control-plane-subnet
      address_prefixes: 10.0.0.0/23
  compute:
    subnet:
      name: compute-subnet
      address_prefixes: 10.0.2.0/23

Properties explanation🔗

Amazon🔗

For Amazon AWS, the following object types are supported:

• nfs_server

AWS EFS Server nfs_server🔗

Defines a new Elastic File Storage (EFS) service that is connected to the OpenShift cluster within the same VPC. The file storage will be used as the back-end for the efs-nfs-client OpenShift storage class.

nfs_server:
- name: sample-elastic
  infrastructure:
    aws_region: eu-west-1

Property explanation🔗

vSphere🔗

For vSphere, the following object types are supported:

• vsphere
• vm_definition
• nfs_server

vSphere vsphere🔗

Defines the vSphere vCenter onto which OpenShift will be provisioned.

vsphere:
- name: sample
  vcenter: 10.99.92.13
  datacenter: Datacenter1
  datastore: Datastore1
  cluster: Cluster1
  network: "VM Network"
  folder: /Datacenter1/vm/sample

Property explanation🔗

vSphere vm_definition🔗

Defines the virtual machine properties to be used for the control-plane nodes and compute nodes.

vm_definition:
- name: control-plane
  vcpu: 8
  memory_mb: 32768
  boot_disk_size_gb: 100
- name: compute
  vcpu: 16
  memory_mb: 65536
  boot_disk_size_gb: 200
  # Optional overrides for vsphere properties
  # datastore: Datastore1
  # network: "VM Network"

Property explanation🔗

vSphere nfs_server🔗

Defines an existing NFS server that will be used for the OpenShift NFS storage class.

nfs_server:
- name: sample-nfs
  infrastructure:
    host_ip: 10.99.92.31
    storage_folder: /data/nfs

Property explanation🔗