Red Hat OpenShift cluster on VPC infrastructure

This module creates a resource group, a VPC in that resource group, IAM Access Groups, and invites users to those Access Groups. It then creates a Red Hat OpenShift Cluster on that VPC

Access Groups

The iam module creates any number of access groups, with any number of policies.

The flexible access_groups variable allows users to dynamically create groups with complex rules using a single object.

Invite Users

Users can be invited to these groups. Users invited to these access groups will be added to the access group even if they have not yet accepted the invite to the account. (If you do not need to invite users, delete ./iam/invite_users.tf and remove invite_users fom the access_group variable definition.)

Varable Type

    list(
        object({
            name        = string # Name of the group
            description = string # Description of group
            policies    = list(
                object({
                    name      = string       # Name of the policy
                    roles     = list(string) # list of roles for the policy
                    resources = object({
                        resource_group       = optional(string) # Name of the resource group the policy will apply to
                        resource_type        = optional(string) # Name of the resource type for the policy ex. "resource-group"
                        service              = optional(string) # Name of the service type for the policy ex. "cloud-object-storage"
                        resource_instance_id = optional(string) # ID of a service instance to give permissions
                    })
                })
            )
            dynamic_policies = optional(
                list(
                    object({
                        name              = string # Dynamic group name
                        identity_provider = string # URI for identity provider
                        expiration        = number # How many hours authenticated users can work before refresh
                        conditions        = object({
                                claim    = string # key value to evaluate the condition against.
                                operator = string # The operation to perform on the claim. Supported values are EQUALS, EQUALS_IGNORE_CASE, IN, NOT_EQUALS_IGNORE_CASE, NOT_EQUALS, and CONTAINS.
                                value    = string # Value to be compared agains
                        })
                    })
                )
            )
            account_management_policies = optional(list(string)) # A list of group access management roles to create.
            invite_users                = list(string)           # Users to invite to the access group
        })
    )

VPC

This module creates a VPC in a resource group with optional Classic Access. It also allows users to update the default vpc security group with additional rules.

Default Security Group Rules

Default security group rules are converted from a list to an object to ensure that adding, deleting, or changing the order of rules listed will not force unwanted changes. Example:

ibm_is_security_group_rule.default_vpc_rule["allow-inbound-ping"]
ibm_is_security_group_rule.default_vpc_rule["allow-inbound-ssh"]

Public Gateways

This module allows a user to optionally create public gateways in the VPC in each of the three zones of the VPC's region.

Network ACL

This module creates a network ACL with any number of rules. (Note: by default, VPC Network ACLs have a maximum of 50 rules.) Any subnets created by this module will be connected to this ACL. The following rules are automatically created in dynamic_acl_rules.tf.

Cluster ACL Rules

These ACL rules will be automatically created for the VPC regardless of subnet CIDR blocks:

Direction	Rule	Allow / Deny	Protocol	Source	Source Port	Destination	Desination Port
Inbound	Allow Worker Nodes to be Created	Allow	All	161.26.0.0/16	-	0.0.0.0/0	-
Inbound	Allow communication to Services over Private Service Endpoint	Allow	All	166.8.0.0/14	-	0.0.0.0/0	-
Outbound	Allow Worker Nodes to be Created	Allow	All	0.0.0.0/0	-	161.26.0.0/16	-
Outbound	Allow communication to Services over Private Service Endpoint	Allow	All	0.0.0.0/0	-	166.8.0.0/14	-

Control Pane IP ACL Rules

The control pane ip module dynamicly creates ACL allow rules for the OpenShift Control Pane based on the region provided. Due to the maximum of 50 ACL rules, only inbound traffic allow rules are created. For this architecture, use a rule to allow all outbound traffic.

Dynamic ACL Rules

This module dynamically creates a rule to allow outbound traffic from and allow inbound traffic to each subnet created by the subnets variable. This is an example of the rules created from the default value:

Direction	Allow / Deny	Protocol	Source	Source Port	Destination	Desination Port
Inbound	Allow	All	10.10.10.0/24	-	0.0.0.0/0	-
Inbound	Allow	All	10.20.10.0/24	-	0.0.0.0/0	-
Inbound	Allow	All	10.30.10.0/24	-	0.0.0.0/0	-
Outbound	Allow	All	0.0.0.0/0	-	10.10.10.0/24	-
Outbound	Allow	All	0.0.0.0/0	-	10.20.10.0/24	-
Outbound	Allow	All	0.0.0.0/0	-	10.30.10.0/24	-

Subnets

The subnet module allows users to create subnets in 1, 2, or 3 zones. Public gateways can be optionally attached to each subnet.

Address Prefixes

A CIDR block is created in the VPC for each subnet that will be provisioned

Subnets

The type of the subnets variable is as follows:

object({
    zone-1 = list(object({
      name           = string
      cidr           = string
      public_gateway = optional(bool)
    }))
    zone-2 = list(object({
      name           = string
      cidr           = string
      public_gateway = optional(bool)
    }))
    zone-3 = list(object({
      name           = string
      cidr           = string
      public_gateway = optional(bool)
    }))
  })

While zone-1, zone-2, and zone-3 are all lists, these lists are converted into an object before the resources are provisioned. This ensures that the addition or deletion of subnets will affect only the added or deleted subnets. Example:

module.subnets.ibm_is_subnet.subnet["gcat-multizone-subnet-a"]
module.subnets.ibm_is_subnet.subnet["gcat-multizone-subnet-b"]
module.subnets.ibm_is_subnet.subnet["gcat-multizone-subnet-c"]
module.subnets.ibm_is_vpc_address_prefix.subnet_prefix["gcat-multizone-subnet-a"]
module.subnets.ibm_is_vpc_address_prefix.subnet_prefix["gcat-multizone-subnet-b"]
module.subnets.ibm_is_vpc_address_prefix.subnet_prefix["gcat-multizone-subnet-c"]

Cloud Object Storage

This module creates an IBM Cloud Object Stroage instance required for the creation of an OpenShift cluster.