terraform-rhcs-rosa-classic

A Terraform module which creates ROSA Classic clusters

Introduction

This module serves as a comprehensive solution for deploying, configuring, and managing Red Hat OpenShift on AWS (ROSA) Classic clusters within your AWS environment. With a focus on simplicity and efficiency, this module streamlines the process of setting up and maintaining ROSA Classic clusters, enabling users to use the power of OpenShift using AWS infrastructure effortlessly.

Example Usage

module "rosa_cluster_classic" {
  source = "terraform-redhat/rosa-classic/rhcs"

  cluster_name          = "my-cluster"
  openshift_version     = "4.14.24"
  create_account_roles  = true
  create_operator_roles = true
  create_oidc           = true
  create_admin_user     = true
}

Sub-modules

Sub-modules included in this module:

• account-iam-resources: Handles the provisioning of IAM (Identity and Access Management) resources required for managing access and permissions in the AWS account associated with the ROSA Classic cluster.
• idp: Responsible for configuring Identity Providers (IDPs) within the ROSA Classic cluster, facilitating seamless integration with external authentication systems such as GitHub, GitLab, Google, HTPasswd, LDAP, and OpenID Connect (OIDC).
• machine-pool: Facilitates the management of machine pools within the ROSA Classic cluster, enabling users to scale resources and adjust specifications based on workload demands.
• oidc-config-and-provider: Manages the configuration of OIDC (OpenID Connect) providers within the ROSA Classic cluster, enabling secure authentication and access control mechanisms.
• operator-policies: Responsible for managing policies associated with ROSA operators within the cluster, ensuring proper permissions for core cluster functionalities.
• operator-roles: Oversees the management of roles assigned to operators within the ROSA Classic cluster, enabling them to perform required actions with the appropriate permissions.
• rosa-cluster-classic: Handles the core configuration and provisioning of the ROSA Classic cluster, including cluster networking, security settings, and other essential components.
• shared-vpc-policy-and-hosted-zone: Manages policies and configurations related to shared Virtual Private Cloud (VPC) resources and Route 53 hosted zones, facilitating connectivity and access control in the AWS environment.
• vpc: Handles the configuration and provisioning of the Virtual Private Cloud (VPC) infrastructure required for hosting the ROSA Classic cluster and its associated resources.

The primary sub-module responsible for ROSA Classic cluster creation includes the optional configurations for setting up account roles, operator roles, and OIDC configurations. This comprehensive module handles the entire process of provisioning and configuring ROSA Classic clusters in your AWS environment.

Prerequisites

• The Terraform CLI (1.4.6+) must be installed.
• An AWS account and the associated credentials that allow you to create resources. These credentials must be configured for the AWS provider (see Authentication and Configuration section in AWS terraform provider documentation.)
• The ROSA getting started AWS prerequisites must be completed.
• A valid OpenShift Cluster Manager API Token must be configured (see Authentication and configuration for more information.)

We recommend you install the following CLI tools:

• AWS CLI
• ROSA CLI
• Openshift CLI (oc)

Requirements

Name	Version
terraform	>= 1.0
aws	>= 4.0
null	>= 3.0.0
rhcs	>= 1.6.2

Providers

Name	Version
aws	>= 4.0
null	>= 3.0.0

Modules

Name	Source	Version
account_iam_resources	./modules/account-iam-resources	n/a
oidc_config_and_provider	./modules/oidc-config-and-provider	n/a
operator_policies	./modules/operator-policies	n/a
operator_roles	./modules/operator-roles	n/a
rhcs_identity_provider	./modules/idp	n/a
rhcs_machine_pool	./modules/machine-pool	n/a
rosa_cluster_classic	./modules/rosa-cluster-classic	n/a

Resources

Name	Type
null_resource.validations	resource
aws_caller_identity.current	data source
aws_partition.current	data source

Inputs

Name	Description	Type	Default	Required
account_role_prefix	User-defined prefix for all generated AWS resources (default "account-role-").	string	null	no
additional_trust_bundle	A string containing a PEM-encoded X.509 certificate bundle that will be added to the nodes' trusted certificate store.	string	null	no
admin_credentials_password	Admin password that is created with the cluster. The password must contain at least 14 characters (ASCII-standard) without whitespaces including uppercase letters, lowercase letters, and numbers or symbols.	string	null	no
admin_credentials_username	Admin username that is created with the cluster. auto generated username - "cluster-admin"	string	null	no
autoscaler_balance_similar_node_groups	Automatically identify node groups with the same instance type and the same set of labels and try to keep the respective sizes of those node groups balanced.	bool	null	no
autoscaler_balancing_ignored_labels	This option specifies labels that cluster autoscaler should ignore when considering node group similarity. For example, if you have nodes with 'topology.ebs.csi.aws.com/zone' label, you can add name of this label here to prevent cluster autoscaler from splitting nodes into different node groups based on its value.	list(string)	null	no
autoscaler_cores	Minimum and maximum number of cores in cluster, in the format :. Cluster autoscaler does not scale the cluster beyond these numbers.	object({ min = number max = number })	null	no
autoscaler_gpus	Minimum and maximum number of different GPUs in cluster, in the format <gpu_type>::. Cluster autoscaler does not scale the cluster beyond these numbers. Can be passed multiple times.	list(object({ type = string range = object({ min = number max = number }) }))	null	no
autoscaler_ignore_daemonsets_utilization	Should cluster-autoscaler ignore DaemonSet pods when calculating resource utilization for scaling down. Default is false.	bool	null	no
autoscaler_log_verbosity	Sets the autoscaler log level. Default value is 1, level 4 is recommended for DEBUGGING and level 6 enables almost everything.	number	null	no
autoscaler_max_node_provision_time	Maximum time cluster-autoscaler waits for node to be provisioned.	string	null	no
autoscaler_max_nodes_total	Maximum number of nodes in all node groups. Cluster autoscaler does not grow the cluster beyond this number.	number	null	no
autoscaler_max_pod_grace_period	Gives pods graceful termination time before scaling down.	number	null	no
autoscaler_memory	Minimum and maximum number of gigabytes of memory in cluster, in the format :. Cluster autoscaler does not scale the cluster beyond these numbers.	object({ min = number max = number })	null	no
autoscaler_pod_priority_threshold	To allow users to schedule 'best-effort' pods, which shouldn't trigger cluster autoscaler actions, but only run when there are spare resources available.	number	null	no
autoscaler_scale_down_delay_after_add	How long after scale up that scale down evaluation resumes.	string	null	no
autoscaler_scale_down_delay_after_delete	How long after node deletion that scale down evaluation resumes.	string	null	no
autoscaler_scale_down_delay_after_failure	How long after scale down failure that scale down evaluation resumes.	string	null	no
autoscaler_scale_down_enabled	Should cluster-autoscaler scale down the cluster.	bool	null	no
autoscaler_scale_down_unneeded_time	How long a node should be unneeded before it is eligible for scale down.	string	null	no
autoscaler_scale_down_utilization_threshold	Node utilization level, defined as sum of requested resources divided by capacity, below which a node can be considered for scale down.	string	null	no
autoscaler_skip_nodes_with_local_storage	If true, cluster autoscaler never deletes nodes with pods with local storage, e.g. EmptyDir or HostPath. Default is true.	bool	null	no
autoscaling_enabled	Enable autoscaling for the initial worker pool. (default: false)	bool	null	no
aws_additional_compute_security_group_ids	The additional security group IDs to be added to the default worker machine pool.	list(string)	null	no
aws_additional_control_plane_security_group_ids	The additional security group IDs to be added to the control plane nodes.	list(string)	null	no
aws_additional_infra_security_group_ids	The additional security group IDs to be added to the infra worker nodes.	list(string)	null	no
aws_availability_zones	The AWS availability zones where instances of the default worker machine pool are deployed. Leave empty for the installer to pick availability zones.	list(string)	[]	no
aws_private_link	Provides private connectivity between VPCs, AWS services, and on-premises networks, without exposing traffic to the public internet. (default: false)	bool	null	no
aws_subnet_ids	The subnet IDs to use when installing the cluster. Leave empty for installer provisioned subnet IDs.	list(string)	[]	no
base_dns_domain	Base DNS domain name previously reserved and matching the hosted zone name of the private Route 53 hosted zone associated with intended shared VPC, e.g., '1vo8.p1.openshiftapps.com'.	string	null	no
cluster_autoscaler_enabled	Enable autoscaler for this cluster.	bool	false	no
cluster_name	Name of the cluster. After resource creation, it is not possible to update the attribute value.	string	n/a	yes
compute_machine_type	Identifies the Instance type used by the default worker machine pool e.g. m5.xlarge. Use the rhcs_machine_types data source to find the possible values.	string	null	no
create_account_roles	Create the AWS account roles for ROSA.	bool	false	no
create_admin_user	To create cluster admin user with default username cluster-admin and generated password. It will be ignored if admin_credentials_username or admin_credentials_password is set. (default: false)	bool	null	no
create_oidc	Create the OIDC resources.	bool	false	no
create_operator_roles	Create the AWS account roles for ROSA.	bool	false	no
default_ingress_cluster_routes_hostname	Components route hostname for oauth, console, download.	string	null	no
default_ingress_cluster_routes_tls_secret_ref	Components route TLS secret reference for oauth, console, download.	string	null	no
default_ingress_excluded_namespaces	Excluded namespaces for ingress. Format should be a comma-separated list 'value1, value2...'. If no values are specified, all namespaces are exposed.	list(string)	null	no
default_ingress_id	Unique identifier of the ingress.	string	null	no
default_ingress_load_balancer_type	Type of Load Balancer. Options are ["classic", "nlb"]:with.	string	null	no
default_ingress_route_namespace_ownership_policy	Namespace ownership policy for ingress. Options are ["Strict", "InterNamespaceAllowed"]. Default is "Strict".	string	null	no
default_ingress_route_selectors	Route Selectors for ingress. Format should be a comma-separated list of 'key=value'. If no label is specified, all routes are exposed on both routers. For legacy ingress support, these are inclusion labels, otherwise they are treated as exclusion label.	map(string)	null	no
default_ingress_route_wildcard_policy	Wildcard policy for ingress. Options are ["WildcardsDisallowed", "WildcardsAllowed"]. Default is "WildcardsDisallowed".	string	null	no
default_mp_labels	Labels for the worker machine pool. This list overwrites any modifications made to node labels on an ongoing basis.	map(string)	null	no
destroy_timeout	Maximum duration in minutes to allow for destroying resources. (Default: 60 minutes)	number	null	no
disable_scp_checks	Indicates if cloud permission checks are disabled when attempting installation of the cluster.	bool	null	no
disable_waiting_in_destroy	Disable addressing cluster state in the destroy resource. Default value is false; destroy waits for the cluster to be deleted.	bool	null	no
disable_workload_monitoring	Enables you to monitor your own projects in isolation from Red Hat Site Reliability Engineer (SRE) platform metrics.	bool	null	no
ec2_metadata_http_tokens	Should cluster nodes use both v1 and v2 endpoints or just v2 endpoint of EC2 Instance Metadata Service (IMDS). Available since OpenShift 4.11.0.	string	null	no
etcd_encryption	Add etcd encryption. By default, etcd data is encrypted at rest. This option configures etcd encryption on top of existing storage encryption.	bool	null	no
fips	Create cluster that uses FIPS Validated / Modules in Process cryptographic libraries.	bool	null	no
host_prefix	Subnet prefix length to assign to each individual node. For example, if host prefix is set to "23", then each node is assigned a /23 subnet out of the given CIDR.	number	null	no
http_proxy	A proxy URL to use for creating HTTP connections outside the cluster. The URL scheme must be http.	string	null	no
https_proxy	A proxy URL to use for creating HTTPS connections outside the cluster.	string	null	no
identity_providers	Provides a generic approach to add multiple identity providers after the creation of the cluster. This variable allows users to specify configurations for multiple identity providers in a flexible and customizable manner, facilitating the management of resources post-cluster deployment. For additional details regarding the variables utilized, refer to the idp sub-module. For non-primitive variables (such as maps, lists, and objects), supply the JSON-encoded string.	map(any)	{}	no
kms_key_arn	The key ARN is the Amazon Resource Name (ARN) of a CMK. It is a unique, fully qualified identifier for the CMK. A key ARN includes the AWS account, region, and the key ID.	string	null	no
machine_cidr	Block of IP addresses used by OpenShift while installing the cluster, for example "10.0.0.0/16".	string	null	no
machine_pools	Provides a generic approach to add multiple machine pools after the creation of the cluster. This variable allows users to specify configurations for multiple machine pools in a flexible and customizable manner, facilitating the management of resources post-cluster deployment. For additional details regarding the variables utilized, refer to the machine-pool sub-module. For non-primitive variables (such as maps, lists, and objects), supply the JSON-encoded string.	map(any)	{}	no
managed_oidc	OIDC type managed or unmanaged OIDC.	bool	true	no
max_replicas	Maximum number of compute nodes. This attribute is applicable solely when autoscaling is enabled. (default: 2)	number	null	no
min_replicas	Minimum number of compute nodes. This attribute is applicable solely when autoscaling is enabled. (default: 2)	number	null	no
multi_az	Specifies whether the deployment of the cluster should extend across multiple availability zones. (default: false)	bool	null	no
no_proxy	A comma-separated list of destination domain names, domains, IP addresses or other network CIDRs to exclude proxying.	string	null	no
oidc_config_id	The unique identifier associated with users authenticated through OpenID Connect (OIDC) within the ROSA cluster.	string	null	no
oidc_endpoint_url	Registered OIDC configuration issuer URL, added as the trusted relationship to the operator roles. Valid only when create_oidc is false.	string	null	no
openshift_version	Desired version of OpenShift for the cluster, for example '4.1.0'. If version is later than the currently running version, an upgrade is scheduled.	string	n/a	yes
operator_role_prefix	User-defined prefix for generated AWS operator policies. Use "account-role-prefix" in case no value provided.	string	null	no
path	The ARN path for the account/operator roles and policies.	string	"/"	no
permissions_boundary	The ARN of the policy that is used to set the permissions boundary for the IAM roles in STS clusters.	string	""	no
pod_cidr	Block of IP addresses from which pod IP addresses are allocated, for example "10.128.0.0/14".	string	null	no
private	Restrict master API endpoint and application routes to direct, private connectivity. (default: false)	bool	null	no
private_hosted_zone_id	ID assigned by AWS to private Route 53 hosted zone associated with intended shared VPC, e.g., 'Z05646003S02O1ENCDCSN'.	string	null	no
private_hosted_zone_role_arn	AWS IAM role ARN with a policy attached, granting permissions necessary to create and manage Route 53 DNS records in private Route 53 hosted zone associated with intended shared VPC.	string	null	no
properties	User defined properties.	map(string)	null	no
replicas	Number of worker nodes to provision. This attribute is applicable solely when autoscaling is disabled. Single zone clusters need at least 2 nodes, multizone clusters need at least 3 nodes. Hosted clusters require that the number of worker nodes be a multiple of the number of private subnets. (default: 2)	number	null	no
service_cidr	Block of IP addresses for services, for example "172.30.0.0/16".	string	null	no
tags	Apply user defined tags to all cluster resources created in AWS. After the creation of the cluster is completed, it is not possible to update this attribute.	map(string)	null	no
upgrade_acknowledgements_for	Indicates acknowledgement of agreements required to upgrade the cluster version between minor versions (e.g. a value of "4.12" indicates acknowledgement of any agreements required to upgrade to OpenShift 4.12.z from 4.11 or before).	string	null	no
wait_for_create_complete	Wait until the cluster is either in a ready state or in an error state. The waiter has a timeout of 60 minutes. (default: true)	bool	true	no
worker_disk_size	Default worker machine pool root disk size with a unit suffix like GiB or TiB, e.g. 200GiB.	number	null	no

Outputs

Name	Description
account_role_prefix	The prefix used for all generated AWS resources.
account_roles_arn	A map of Amazon Resource Names (ARNs) associated with the AWS IAM roles created. The key in the map represents the name of an AWS IAM role, while the corresponding value represents the associated Amazon Resource Name (ARN) of that role.
api_url	URL of the API server.
cluster_admin_password	The password of the admin user.
cluster_admin_username	The username of the admin user.
cluster_id	Unique identifier of the cluster.
console_url	URL of the console.
current_version	The currently running version of OpenShift on the cluster, for example '4.11.0'.
domain	DNS domain of cluster.
infra_id	The ROSA cluster infrastructure ID.
oidc_config_id	The unique identifier associated with users authenticated through OpenID Connect (OIDC) generated by this OIDC config.
oidc_endpoint_url	Registered OIDC configuration issuer URL, generated by this OIDC config.
operator_role_prefix	Prefix used for generated AWS operator policies.
operator_roles_arn	List of Amazon Resource Names (ARNs) for all operator roles created.
path	The arn path for the account/operator roles as well as their policies.
private_hosted_zone_id	ID assigned by AWS to private Route 53 hosted zone associated with intended shared VPC
state	The state of the cluster.