Skip to content

Commit b01733a

Browse files
hrvolapeterhrvolapeter
authored
Merge pull request #113 from oci-landing-zones/oke
Add OKE Workload Extension
2 parents 17b9c65 + 7feab21 commit b01733a

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

53 files changed

+8861
-2
lines changed

‎CODEOWNERS

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
/workload-extensions/ocvs/ @hrvolapeter
22
/workload-extensions/ebs/ @rphibbert
3+
/workload-extensions/oke/ @paolajuarezgomez
34
/addons/oci-hub-models/ @vavardan @paalonso
45
/addons/oci-sovereign-controls/ @vavardan @hrvolapeter @paolajuarezgomez
56
/addons/oci-lz-subnetting/ @paolajuarezgomez @paalonso

‎commons/images/icon_oke.jpg

29.9 KB
Loading

‎workload-extensions/oke/multi-stack/1_oke_extension/1.1_Network_post_updates/readme.md

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
# Firewalls and RT updates <!-- omit from toc -->
2+
3+
## **Routing**
4+
5+
In all of our OCI Landing Zone models, we recommend implementing a Hub-and-Spoke network architecture. This approach enables you to deploy a firewall in the hub for traffic inspection, ensuring enhanced security. To save time in the design phase with our customers, we have included four hub models. You can choose to use either our OCI native firewall or a third-party solution, such as Fortinet or Palo Alto. Explore the four models [here](https://github.com/oci-landing-zones/oci-landing-zone-operating-entities/tree/master/addons/oci-hub-models).
6+
7+
In this case we have selected model A that is equipped with two OCI Network Firewalls - a next-generation managed network firewall and an intrusion detection and prevention service. The first firewall is dedicated to inbound traffic, while the second is responsible for outbound and East-West traffic control and inspection.
8+
9+
Model A offer two options: a **Light Version** (No Cost), where a virtual machine (VM) is deployed with a load balancer, and a **Complete Version** (With Cost), which includes the deployment of a firewalls.
10+
11+
The next Diagram shows the routing included in the [ONE-OE Hub A Deployment (Light Version - No Cost)](https://github.com/oci-landing-zones/oci-landing-zone-operating-entities/blob/master/addons/oci-hub-models/hub_b/readme.md):
12+
<img src="../../content/Routing_ONE-OE_HubA.png" width="1000" height="auto">
13+
14+
The next Diagram shows rounting included in the OKE Ext LZ:
15+
<img src="../../content/Routing_OKE_ext.png" width="1000" height="auto">
16+
17+
The next steps are to add the firewall and update the corresponding routes. To accomplish this, we need to follow the steps outlined in the [Hub A Deployment (Light Version - No Cost)](https://github.com/oci-landing-zones/oci-landing-zone-operating-entities/blob/master/addons/oci-hub-models/hub_a/readme.md)
18+
19+
For demo purposes, we will deploy a dummy VM instead of a firewall. If needed, the steps to deploy the firewall are also provided on the previous page
20+
21+
**a.** Deploy a dummy FW VM for the DMZ and INTERNAL FWs following these steps [How to create a dummy FW VM](https://github.com/oci-landing-zones/oci-landing-zone-operating-entities/blob/master/commons/content/howto_create_dummy_fw_vm.md)
22+
23+
<img src="../../content/Instances.png" width="1000" height="auto">
24+
25+
**b.** Identify the Private IP OCID of your firewalls following these [steps](https://github.com/oci-landing-zones/oci-landing-zone-operating-entities/blob/master/commons/content/howto_identify_private_ip_ocid_vm_vnic.md)
26+
27+
**c.**
28+
You can find a generic JSON file for HUB A checking our [hub models asset](https://github.com/oci-landing-zones/oci-landing-zone-operating-entities/tree/master/addons/oci-hub-models/hub_a).
29+
For this OKE LZ EXT we provided a [customized Json file](../oci_oke_lz_ext_open_lz_post_hub_a_network_light.auto.tfvars.json).
30+
31+
- Replace the "**DMZ FW PRIVATE IP OCID**" with the OCID of the Public DMZ Firewall Private IP OCID identified in the previous steps.
32+
- Replace the "**INT FW PRIVATE IP OCID**" with the OCID of the Private Internal Firewall Private IP OCID identified in the previous steps.
33+
- Replace the "**OCID VCN OKE PROD**" with the OCID for the Prod VCN.
34+
- Replace the "**OCID VCN OKE PREPROD**" with the OCID for the PreProd VCN.
35+
- Replace the "**OCID VCN OKE MGT**" with the OCID for the MGT VCN.
36+
37+
You can use the find & replace of the IDE of your choice.
38+
39+
**d.** Edit the ORM stack (STEP1) and replace the original Network JSON configuration file with the new **oci_oke_lz_ext_open_lz_post_hub_a_network_light.auto.tfvars** updated file.
40+
41+
**e.** Run Plan & Apply to populate the new changes.
42+
43+
This is the diagram that show the Network after adding the post STEP1 configuration:
44+
45+
<img src="../../content/PostSTEP1.png" width="1000" height="auto">
46+
47+
Now that the spokes are attached to the hub, you can update their routing by adding a rule to the DRG.
48+
49+
**f.** Edit the ORM stack (STEP2) and replace the original Network JSON configuration file with the new **oci_oke_lz_ext_network_npn_post.auto.tfvars** updated file.
50+
51+
**g.** Run Plan & Apply to populate the new changes.
52+
53+
This is the diagram that show the final Network configuration:
54+
55+
<img src="../../content/Final_Routing.png" width="1000" height="auto">
56+
57+
&nbsp;
58+
59+
# License <!-- omit from toc -->
60+
61+
Copyright (c) 2025 Oracle and/or its affiliates.
62+
63+
Licensed under the Universal Permissive License (UPL), Version 1.0.
64+
65+
See [LICENSE](/LICENSE) for more details.

‎workload-extensions/oke/multi-stack/1_oke_extension/ORM_OKE-LZ-EXT_deployment_steps.md

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
# STEP2. ORM OKE LZ EXT Deployment Steps <!-- omit from toc -->
2+
3+
If you deployed the 'Core LZ' in the initial operation using ORM and following the ONE-OE LZ model with the output feature enabled, deploying and running a LZ extension will be straightforward and require no additional changes.
4+
5+
When you press the provided magic button, a new ORM stack is created. Follow these steps:
6+
1. Accept terms, wait for the configuration to load.
7+
2. Set the working directory to “rms-facade”.
8+
3. Set the stack name you prefer.
9+
4. Set the terraform version to 1.5.x. Click Next.
10+
5. In our example, we include OKE LZ extension required JSON files stored in our open Landing Zone GitHub repository. Click next.
11+
6. Add the dependencies file created in OP1 as an output. We selected the **ocibucket** option, specifying our bucket name along with the compartments and network files
12+
7. Un-check run apply. Click Create.
13+
14+
<img src="../content/ORMOKE.png" width="1000" height="auto">
15+
16+
For standardization purposes and better control over the JSON files, we recommend following the same approach used in OP1 by uploading your own files to your OCI bucket.
17+
18+
# Upload your customized OKE LZ EXT JSON files
19+
20+
Click on each file to download it, and make any necessary changes if required.
21+
22+
* IAM:
23+
oci_oke_lz_ext_iam.auto.tfvars.json
24+
* Network:
25+
oci_oke_lz_ext_network.auto.tfvars.json
26+
27+
<img src="../content/UploadBucket.png" width="1000" height="auto">
28+
29+
Upload the files to your new bucket or drag and drop them directly.
30+
31+
<img src="../content/UploadObjects.png" width="1000" height="auto">
32+
33+
<img src="../content/UploadBucketOKE.png" width="1000" height="auto">
34+
35+
You can now view the uploaded files in your bucket, giving you full control over them.
36+
37+
&nbsp;
38+
# Update the ORM with your own JSON links
39+
40+
In the configuration variables page:
41+
42+
1. Review the region selected for the deployment.
43+
2. Set the configuration source to OCI bucket.
44+
3. Enter the name of the bucket created in the previous step.
45+
4. Remove the default files in the Configuration Files section and upload the four new updated files to the bucket.
46+
5. Add the dependencies file created in OP1 as an output. We selected the **ocibucket** option, specifying our bucket name along with the compartments and network files, Click next.
47+
6. Un-check run apply. Click Create.
48+
49+
<img src="../content/ORMUpdatedOKE.png" width="1000" height="auto">
50+
51+
52+
First, execute a plan job (1) to review all the resources that Terraform will create. Once verified, proceed to run the apply job (2) to initiate the deployment.
53+
54+
<img src="../content/ORMJobsOKE.png" width="500" height="auto">
55+
56+
57+
# License <!-- omit from toc -->
58+
59+
Copyright (c) 2025 Oracle and/or its affiliates.
60+
61+
Licensed under the Universal Permissive License (UPL), Version 1.0.
62+
63+
See [LICENSE](/LICENSE) for more details.

‎workload-extensions/oke/multi-stack/1_oke_extension/ORM_ONE-OE_deployment_steps.md

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
# STEP1. ORM ONE-OE Deployment Steps <!-- omit from toc -->
2+
3+
4+
## **Using Output and Dependencies features with ORM**
5+
6+
Our Landing Zone extensions are designed to integrate seamlessly with our core Landing Zone models, such as ONE-OE or Multi-OE. We onboard a LZ extension as an additional operation performed after the initial deployment of the core Landing Zone.
7+
8+
When you press the provided magic button, a new ORM stack is created. Follow these steps:
9+
1. Accept terms, wait for the configuration to load.
10+
2. Set the working directory to “rms-facade”.
11+
3. Set the stack name you prefer.
12+
4. Set the terraform version to 1.5.x. Click Next.
13+
5. In our example, we include the required JSON files stored in our open Landing Zone GitHub repository. Running it as-is will deploy the ONE-OE Landing Zone in your tenancy. However, if you want to use the **Dependencies** and **Output** features, some minor modifications will be necessary. Click next.
14+
6. Un-check run apply. Click Create.
15+
16+
<img src="../content/MagicButton.png" width="1000" height="auto">
17+
18+
To minimize customizations and leverage the provided extension templates, we highly recommend using the output feature. This feature automatically generates a file containing key-resource pairs, simplifying subsequent operational deployments.
19+
20+
To store the Json files in a OCI bucket follow the next steps:
21+
22+
# Create your own OCI Bucket <!-- omit from toc -->
23+
24+
1. **Main Menu-> Storage -> Buckets**
25+
2. **Create a new Bucket**.
26+
27+
<img src="../content/Bucket.png" width="1000" height="auto">
28+
29+
&nbsp;
30+
# Upload your customized JSON files
31+
32+
Click on each file to download it, and make any necessary changes if required.
33+
34+
* IAM:
35+
[oci_open_lz_one-oe_iam.auto.tfvars.json](https://github.com/oci-landing-zones/oci-landing-zone-operating-entities/blob/v2.2.0-oneoe_v2/blueprints/one-oe/runtime/one-stack/oci_open_lz_one-oe_iam.auto.tfvars.json)
36+
* Security:
37+
[oci_open_lz_one-oe_security_cisl1.auto.tfvars.json](https://github.com/oci-landing-zones/oci-landing-zone-operating-entities/blob/v2.2.0-oneoe_v2/blueprints/one-oe/runtime/one-stack/oci_open_lz_one-oe_security_cisl1.auto.tfvars.json)
38+
* Network:
39+
[oci_open_lz_hub_a_network_light.auto.tfvars.json](https://github.com/oci-landing-zones/oci-landing-zone-operating-entities/blob/v2.2.0-oneoe_v2/blueprints/one-oe/runtime/one-stack/oci_open_lz_hub_a_network_light.auto.tfvars.json)
40+
* Observability:
41+
[oci_open_lz_one-oe_observability_cisl1.auto.tfvars.json](https://github.com/oci-landing-zones/oci-landing-zone-operating-entities/blob/v2.2.0-oneoe_v2/blueprints/one-oe/runtime/one-stack/oci_open_lz_one-oe_observability_cisl1.auto.tfvars.json)
42+
43+
<img src="../content/UploadBucket.png" width="1000" height="auto">
44+
45+
Upload the files to your new bucket or drag and drop them directly.
46+
47+
<img src="../content/UploadObjects.png" width="1000" height="auto">
48+
49+
You can now view the uploaded files in your bucket, giving you full control over them.
50+
51+
<img src="../content/BucketFiles.png" width="1000" height="auto">
52+
53+
54+
&nbsp;
55+
# Update the ORM with your own JSON links
56+
57+
In the configuration variables page:
58+
59+
1. Review the region selected for the deployment.
60+
2. Set the configuration source to OCI bucket.
61+
3. Enter the name of the bucket created in the previous step.
62+
4. Remove the default files in the Configuration Files section and upload the four new updated files to the bucket.
63+
5. In the Output Files section, click 'Save Output' and specify a folder where the output files will be saved.
64+
6. Click next.
65+
7. Un-check run apply. Click Create.
66+
67+
<img src="../content/ORMUpdated.png" width="1000" height="auto">
68+
69+
70+
First, execute a plan job (1) to review all the resources that Terraform will create. Once verified, proceed to run the apply job (2) to initiate the deployment.
71+
72+
<img src="../content/ORMJobs.png" width="500" height="auto">
73+
74+
After deployment, you can visit your bucket to check the new files created using the output option.
75+
76+
<img src="../content/output.png" width="1000" height="auto">
77+
78+
Example of compartment_output.json
79+
80+
```
81+
{"compartments":
82+
{
83+
"CMP-LANDINGZONE-P-KEY":{"id":"ocid1.compartment.oc1..xxx"},"CMP-LZP-NETWORK-KEY":{"id":"ocid1.compartment.oc1..xxx"},"CMP-LZP-P-NETWORK-KEY":{"id":"ocid1.compartment.oc1..xxx"},"CMP-LZP-P-PLATFORM-KEY":{"id":"ocid1.compartment.oc1..xxx"},"CMP-LZP-P-PROJ1-APP-KEY":{"id":"ocid1.compartment.oc1..xxx"},"CMP-LZP-P-PROJ1-DB-KEY":{"id":"ocid1.compartment.oc1..xxx"},"CMP-LZP-P-PROJ1-INFRA-KEY":{"id":"ocid1.compartment.oc1..xxx"},"CMP-LZP-P-PROJ1-KEY":{"id":"ocid1.compartment.oc1..xxx"},"CMP-LZP-P-PROJECTS-KEY":{"id":"ocid1.compartment.oc1..xxx"},"CMP-LZP-P-SECURITY-KEY":{"id":"ocid1.compartment.oc1..xxx"},"CMP-LZP-PLATFORM-KEY":{"id":"ocid1.compartment.oc1..xxx"},"CMP-LZP-PP-NETWORK-KEY":{"id":"ocid1.compartment.oc1..xxx"},"CMP-LZP-PP-PLATFORM-KEY":{"id":"ocid1.compartment.oc1..xxx"},"CMP-LZP-PP-PROJ1-APP-KEY":{"id":"ocid1.compartment.oc1..xxx"},"CMP-LZP-PP-PROJ1-DB-KEY":{"id":"ocid1.compartment.oc1..xxx"},"CMP-LZP-PP-PROJ1-INFRA-KEY":{"id":"ocid1.compartment.oc1..xxx"},"CMP-LZP-PP-PROJ1-KEY":{"id":"ocid1.compartment.oc1..xxx"},"CMP-LZP-PP-PROJECTS-KEY":{"id":"ocid1.compartment.oc1..xxx"},"CMP-LZP-PP-SECURITY-KEY":{"id":"ocid1.compartment.oc1..xxx"},"CMP-LZP-PREPROD-KEY":{"id":"ocid1.compartment.oc1..xxx"},
84+
"CMP-LZP-PROD-KEY":{"id":"ocid1.compartment.oc1..xxx"},"CMP-LZP-SECURITY-KEY":{"id":"ocid1.compartment.oc1..xxx"}
85+
}
86+
}
87+
```
88+
89+
# License <!-- omit from toc -->
90+
91+
Copyright (c) 2025 Oracle and/or its affiliates.
92+
93+
Licensed under the Universal Permissive License (UPL), Version 1.0.
94+
95+
See [LICENSE](/LICENSE) for more details.

0 commit comments

Comments
 (0)