Skip to content

Commit 8d6369b

Browse files
juniorjunior
authored
Merge pull request #21 from junior/5G-example
Extra seclist for VCN Native pod networking + Initial 5G NF Infra example
2 parents 2d4bc91 + 33ec033 commit 8d6369b

File tree

13 files changed

+575
-8
lines changed

13 files changed

+575
-8
lines changed

‎VERSION

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
0.8.8
1+
0.8.9

‎defaults.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
################################################################################
2121
locals {
2222
deploy_id = random_string.deploy_id.result
23-
deploy_tags = { "DeploymentID" = local.deploy_id, "AppName" = local.app_name, "Quickstart" = "terraform-oci-oke-quickstart" }
23+
deploy_tags = { "DeploymentID" = local.deploy_id, "AppName" = local.app_name, "Quickstart" = "terraform-oci-oke-quickstart", "OKEclusterName" = "${local.app_name} (${local.deploy_id})" }
2424
oci_tag_values = {
2525
"freeformTags" = merge(var.tag_values.freeformTags, local.deploy_tags),
2626
"definedTags" = var.tag_values.definedTags

‎examples/5G-NF-Infra/README.md

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
# Terraform Scripts for deploying the Unreal Pixel Streaming infrastructure on OCI OKE
2+
3+
## Deploy Using the Terraform CLI
4+
5+
### Clone the Module
6+
7+
Clone the source code from suing the following command:
8+
9+
```bash
10+
git clone github.com/oracle-quickstart/oke-unreal-pixel-streaming
11+
```
12+
13+
```bash
14+
cd oke-unreal-pixel-streaming/deploy/terraform
15+
```
16+
17+
### Updating Terraform variables
18+
19+
```bash
20+
cp terraform.tfvars.example terraform.tfvars
21+
```
22+
23+
Update the `terraform.tfvars` file with the required variables, including the OCI credentials information.
24+
25+
Make sure that the information of the Instance Shape on each Node Pool are correct and you have enough quota to deploy the infrastructure, including the GPU nodes. This scripts defaults to `BM.GPU.A10.4`.
26+
27+
### Running Terraform
28+
29+
After specifying the required variables you can run the stack using the following commands:
30+
31+
```bash
32+
terraform init
33+
```
34+
35+
```bash
36+
terraform plan
37+
```
38+
39+
```bash
40+
terraform apply
41+
```
42+
43+
### Destroying the Stack
44+
45+
```bash
46+
terraform destroy -refresh=false
47+
```
48+
49+
> Note: The `-refresh=false` flag is required to prevent Terraform from attempting to refresh the state of the kubernetes API url, which will return `localhost` without the refresh-false.
50+
51+
### Deploying the demo app
52+
53+
After the infrastructure is deployed, you can deploy the demo app using the following commands:
54+
55+
```bash
56+
kubectl create ns demo
57+
```
58+
59+
```bash
60+
kubectl apply -f ../demo.yaml
61+
```
62+
63+
> Note: Demo App uses Prebuilt images are included with this repo, along with a demo Pixel Streaming image. You can build your own images using the instructions [here](../README.md#pixel-streaming-build).
64+
65+
## Questions
66+
67+
If you have an issue or a question, please take a look at our [FAQs](./FAQs.md) or [open an issue](https://github.com/oracle-quickstart/oke-unreal-pixel-streaming/issues/new).

‎examples/5G-NF-Infra/VERSION

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
0.0.3

‎examples/5G-NF-Infra/networking.tf

Lines changed: 250 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,250 @@
1+
# Copyright (c) 2022 Oracle and/or its affiliates. All rights reserved.
2+
# Licensed under the Universal Permissive License v 1.0 as shown at http://oss.oracle.com/licenses/upl.
3+
#
4+
5+
# Network locals
6+
locals {
7+
vcn_cidr_blocks = split(",", var.vcn_cidr_blocks)
8+
network_cidrs = {
9+
VCN-MAIN-CIDR = local.vcn_cidr_blocks[0] # e.g.: "10.75.0.0/16" = 65536 usable IPs
10+
VCN-NATIVE-POD-NETWORKING-REGIONAL-SUBNET-CIDR = cidrsubnet(local.vcn_cidr_blocks[0], 1, 1) # e.g.: "10.20.128.0/17" = 32766 usable IPs (10.20.128.0 - 10.20.255.255)
11+
SUBNET-5GC-OAM-CIDR = cidrsubnet(local.vcn_cidr_blocks[0], 9, 128) # e.g.: "10.75.64.0/25" = 128 usable IPs
12+
SUBNET-5GC-SIGNALLING-CIDR = cidrsubnet(local.vcn_cidr_blocks[0], 9, 129) # e.g.: "10.75.64.128/25" = 128 usable IPs
13+
SUBNET-5G-RAN-CIDR = cidrsubnet(local.vcn_cidr_blocks[0], 11, 520) # e.g.: "10.75.65.0/27" = 32 usable IPs
14+
SUBNET-LEGAL-INTERCEPT-CIDR = cidrsubnet(local.vcn_cidr_blocks[0], 11, 521) # e.g.: "10.75.65.32/27" = 32 usable IPs
15+
SUBNET-5G-EPC-CIDR = cidrsubnet(local.vcn_cidr_blocks[0], 11, 522) # e.g.: "10.75.65.64/27" = 32 usable IPs
16+
ALL-CIDR = "0.0.0.0/0"
17+
}
18+
}
19+
20+
# Extra Security Lists for the 5G NF
21+
locals {
22+
extra_security_lists = [
23+
{
24+
security_list_name = "5gc_oam_security_list"
25+
display_name = "5GC OAM Security List"
26+
ingress_security_rules = concat(local.common_5g_security_list_ingress_rules, local.temp_all_vcn_security_list_ingress_rules)
27+
egress_security_rules = concat(local.common_5g_security_list_egress_rules, local.temp_all_vcn_security_list_egress_rules)
28+
},
29+
{
30+
security_list_name = "5gc_signalling_security_list"
31+
display_name = "5GC Signalling (SBI) Security List"
32+
ingress_security_rules = concat(local.common_5g_security_list_ingress_rules, local.temp_all_vcn_security_list_ingress_rules)
33+
egress_security_rules = concat(local.common_5g_security_list_egress_rules, local.temp_all_vcn_security_list_egress_rules)
34+
},
35+
{
36+
security_list_name = "5g_ran_security_list"
37+
display_name = "5G RAN Security List"
38+
ingress_security_rules = concat(local.common_5g_security_list_ingress_rules, local.temp_all_vcn_security_list_ingress_rules)
39+
egress_security_rules = concat(local.common_5g_security_list_egress_rules, local.temp_all_vcn_security_list_egress_rules)
40+
},
41+
{
42+
security_list_name = "legal_intercept_security_list"
43+
display_name = "Legal Intercept Security List"
44+
ingress_security_rules = concat(local.common_5g_security_list_ingress_rules, local.temp_all_vcn_security_list_ingress_rules)
45+
egress_security_rules = concat(local.common_5g_security_list_egress_rules, local.temp_all_vcn_security_list_egress_rules)
46+
},
47+
{
48+
security_list_name = "5g_epc_security_list"
49+
display_name = "5G EPC Security List"
50+
ingress_security_rules = concat(local.common_5g_security_list_ingress_rules, local.temp_all_vcn_security_list_ingress_rules)
51+
egress_security_rules = concat(local.common_5g_security_list_egress_rules, local.temp_all_vcn_security_list_egress_rules)
52+
}, {
53+
security_list_name = "5g_for_pods_security_list"
54+
display_name = "5G subnets x pods Security List"
55+
ingress_security_rules = [{
56+
description = "Allow 5GC OAM to pod communication"
57+
source = lookup(local.network_cidrs, "SUBNET-5GC-OAM-CIDR")
58+
source_type = "CIDR_BLOCK"
59+
protocol = local.security_list_ports.all_protocols
60+
stateless = false
61+
tcp_options = { max = -1, min = -1, source_port_range = null }
62+
udp_options = { max = -1, min = -1, source_port_range = null }
63+
icmp_options = null
64+
}, {
65+
description = "Allow 5GC Signalling (SBI) to pod communication"
66+
source = lookup(local.network_cidrs, "SUBNET-5GC-SIGNALLING-CIDR")
67+
source_type = "CIDR_BLOCK"
68+
protocol = local.security_list_ports.all_protocols
69+
stateless = false
70+
tcp_options = { max = -1, min = -1, source_port_range = null }
71+
udp_options = { max = -1, min = -1, source_port_range = null }
72+
icmp_options = null
73+
}, {
74+
description = "Allow 5G RAN to pod communication"
75+
source = lookup(local.network_cidrs, "SUBNET-5G-RAN-CIDR ")
76+
source_type = "CIDR_BLOCK"
77+
protocol = local.security_list_ports.all_protocols
78+
stateless = false
79+
tcp_options = { max = -1, min = -1, source_port_range = null }
80+
udp_options = { max = -1, min = -1, source_port_range = null }
81+
icmp_options = null
82+
}, {
83+
description = "Allow 5G Legal Intercept to pod communication"
84+
source = lookup(local.network_cidrs, "SUBNET-LEGAL-INTERCEPT-CIDR")
85+
source_type = "CIDR_BLOCK"
86+
protocol = local.security_list_ports.all_protocols
87+
stateless = false
88+
tcp_options = { max = -1, min = -1, source_port_range = null }
89+
udp_options = { max = -1, min = -1, source_port_range = null }
90+
icmp_options = null
91+
}, {
92+
description = "Allow 5G EPC to pod communication"
93+
source = lookup(local.network_cidrs, "SUBNET-5G-EPC-CIDR ")
94+
source_type = "CIDR_BLOCK"
95+
protocol = local.security_list_ports.all_protocols
96+
stateless = false
97+
tcp_options = { max = -1, min = -1, source_port_range = null }
98+
udp_options = { max = -1, min = -1, source_port_range = null }
99+
icmp_options = null
100+
}]
101+
egress_security_rules = []
102+
},
103+
]
104+
common_5g_security_list_ingress_rules = [{
105+
description = "Allow pods to communicate with 5G subnets"
106+
source = lookup(local.network_cidrs, "VCN-NATIVE-POD-NETWORKING-REGIONAL-SUBNET-CIDR")
107+
source_type = "CIDR_BLOCK"
108+
protocol = local.security_list_ports.all_protocols
109+
stateless = false
110+
tcp_options = { max = -1, min = -1, source_port_range = null }
111+
udp_options = { max = -1, min = -1, source_port_range = null }
112+
icmp_options = null
113+
}, {
114+
description = "Path discovery"
115+
source = lookup(local.network_cidrs, "ALL-CIDR")
116+
source_type = "CIDR_BLOCK"
117+
protocol = local.security_list_ports.icmp_protocol_number
118+
stateless = false
119+
tcp_options = { max = -1, min = -1, source_port_range = null }
120+
udp_options = { max = -1, min = -1, source_port_range = null }
121+
icmp_options = { type = "3", code = "4" }
122+
}]
123+
common_5g_security_list_egress_rules = [{
124+
description = "Allow 5G subnets to communicate with pods"
125+
destination = lookup(local.network_cidrs, "VCN-NATIVE-POD-NETWORKING-REGIONAL-SUBNET-CIDR")
126+
destination_type = "CIDR_BLOCK"
127+
protocol = local.security_list_ports.all_protocols
128+
stateless = false
129+
tcp_options = { max = -1, min = -1, source_port_range = null }
130+
udp_options = { max = -1, min = -1, source_port_range = null }
131+
icmp_options = null
132+
}, {
133+
description = "Path discovery"
134+
destination = lookup(local.network_cidrs, "ALL-CIDR")
135+
destination_type = "CIDR_BLOCK"
136+
protocol = local.security_list_ports.icmp_protocol_number
137+
stateless = false
138+
tcp_options = { max = -1, min = -1, source_port_range = null }
139+
udp_options = { max = -1, min = -1, source_port_range = null }
140+
icmp_options = { type = "3", code = "4" }
141+
}]
142+
temp_all_vcn_security_list_ingress_rules = [{
143+
description = "Allow all from VCN"
144+
source = lookup(local.network_cidrs, "ALL-CIDR")
145+
source_type = "CIDR_BLOCK"
146+
protocol = local.security_list_ports.all_protocols
147+
stateless = false
148+
tcp_options = { max = -1, min = -1, source_port_range = null }
149+
udp_options = { max = -1, min = -1, source_port_range = null }
150+
icmp_options = null
151+
}]
152+
temp_all_vcn_security_list_egress_rules = [{
153+
description = "Allow all to VCN"
154+
destination = lookup(local.network_cidrs, "ALL-CIDR")
155+
destination_type = "CIDR_BLOCK"
156+
protocol = local.security_list_ports.all_protocols
157+
stateless = false
158+
tcp_options = { max = -1, min = -1, source_port_range = null }
159+
udp_options = { max = -1, min = -1, source_port_range = null }
160+
icmp_options = null
161+
}]
162+
security_list_ports = {
163+
http_port_number = 80
164+
https_port_number = 443
165+
k8s_api_endpoint_port_number = 6443
166+
k8s_api_endpoint_to_worker_port_number = 10250
167+
k8s_worker_to_control_plane_port_number = 12250
168+
ssh_port_number = 22
169+
tcp_protocol_number = "6"
170+
udp_protocol_number = "17"
171+
icmp_protocol_number = "1"
172+
all_protocols = "all"
173+
}
174+
}
175+
176+
# Extra Subnets for for the 5G NF
177+
locals {
178+
extra_subnets = [
179+
{
180+
subnet_name = "5GC_OAM_subnet"
181+
cidr_block = lookup(local.network_cidrs, "SUBNET-5GC-OAM-CIDR")
182+
display_name = "5GC OAM subnet"
183+
dns_label = "sn5gcoam"
184+
prohibit_public_ip_on_vnic = true
185+
prohibit_internet_ingress = true
186+
route_table_id = null
187+
alternative_route_table_name = "private"
188+
dhcp_options_id = ""
189+
security_list_ids = []
190+
extra_security_list_names = ["5gc_oam_security_list"]
191+
ipv6cidr_block = null
192+
},
193+
{
194+
subnet_name = "5GC_Signalling_subnet"
195+
cidr_block = lookup(local.network_cidrs, "SUBNET-5GC-SIGNALLING-CIDR")
196+
display_name = "5GC Signalling (SBI) subnet"
197+
dns_label = "sn5gcsig"
198+
prohibit_public_ip_on_vnic = true
199+
prohibit_internet_ingress = true
200+
route_table_id = null
201+
alternative_route_table_name = "private"
202+
dhcp_options_id = ""
203+
security_list_ids = []
204+
extra_security_list_names = ["5gc_signalling_security_list"]
205+
ipv6cidr_block = null
206+
},
207+
{
208+
subnet_name = "5G_RAN_subnet"
209+
cidr_block = lookup(local.network_cidrs, "SUBNET-5G-RAN-CIDR")
210+
display_name = "5G RAN subnet"
211+
dns_label = "sn5gran"
212+
prohibit_public_ip_on_vnic = true
213+
prohibit_internet_ingress = true
214+
route_table_id = null
215+
alternative_route_table_name = "private"
216+
dhcp_options_id = ""
217+
security_list_ids = []
218+
extra_security_list_names = ["5g_ran_security_list"]
219+
ipv6cidr_block = null
220+
},
221+
{
222+
subnet_name = "Legal_Intercept_subnet"
223+
cidr_block = lookup(local.network_cidrs, "SUBNET-LEGAL-INTERCEPT-CIDR")
224+
display_name = "Legal Intercept subnet"
225+
dns_label = "snlegalin"
226+
prohibit_public_ip_on_vnic = true
227+
prohibit_internet_ingress = true
228+
route_table_id = null
229+
alternative_route_table_name = "private"
230+
dhcp_options_id = ""
231+
security_list_ids = []
232+
extra_security_list_names = ["legal_intercept_security_list"]
233+
ipv6cidr_block = null
234+
},
235+
{
236+
subnet_name = "5G_EPC_subnet"
237+
cidr_block = lookup(local.network_cidrs, "SUBNET-5G-EPC-CIDR")
238+
display_name = "5G EPC subnet"
239+
dns_label = "sn5gcepc"
240+
prohibit_public_ip_on_vnic = true
241+
prohibit_internet_ingress = true
242+
route_table_id = null
243+
alternative_route_table_name = "private"
244+
dhcp_options_id = ""
245+
security_list_ids = []
246+
extra_security_list_names = ["5g_epc_security_list"]
247+
ipv6cidr_block = null
248+
},
249+
]
250+
}

‎examples/5G-NF-Infra/oke.tf

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
# Copyright (c) 2022, Oracle and/or its affiliates. All rights reserved.
2+
# Licensed under the Universal Permissive License v 1.0 as shown at http://oss.oracle.com/licenses/upl.
3+
#
4+
5+
################################################################################
6+
# OKE Cluster
7+
################################################################################
8+
module "oke-quickstart" {
9+
source = "github.com/oracle-quickstart/terraform-oci-oke-quickstart?ref=0.8.9"
10+
11+
# Oracle Cloud Infrastructure Tenancy and Compartment OCID
12+
tenancy_ocid = var.tenancy_ocid
13+
compartment_ocid = var.compartment_ocid
14+
region = var.region
15+
16+
# Note: Just few arguments are showing here to simplify the basic example. All other arguments are using default values.
17+
# App Name to identify deployment. Used for naming resources.
18+
app_name = "Dev 5G NF Example"
19+
20+
# Freeform Tags + Defined Tags. Tags are applied to all resources.
21+
tag_values = { "freeformTags" = { "Environment" = "Development", "DeploymentType" = "5G example", "QuickstartExample" = "5G-NF-Infra" }, "definedTags" = {} }
22+
23+
# VCN for OKE arguments
24+
vcn_cidr_blocks = var.vcn_cidr_blocks
25+
extra_security_lists = local.extra_security_lists
26+
extra_subnets = local.extra_subnets
27+
28+
# OKE Node Pool 1 arguments
29+
node_pool_cni_type_1 = "OCI_VCN_IP_NATIVE" # Use "FLANNEL_OVERLAY" for overlay network or "OCI_VCN_IP_NATIVE" for VCN Native PODs Network. If the node pool 1 uses the OCI_VCN_IP_NATIVE, the cluster will also be configured with same cni
30+
cluster_autoscaler_enabled = true
31+
node_pool_name_1 = "pool1"
32+
node_pool_initial_num_worker_nodes_1 = 5 # Minimum number of nodes in the node pool
33+
node_pool_max_num_worker_nodes_1 = 10 # Maximum number of nodes in the node pool
34+
node_pool_instance_shape_1 = var.node_pool_instance_shape_1
35+
extra_security_list_name_for_nodes = "5g_for_pods_security_list"
36+
extra_security_list_name_for_vcn_native_pod_networking = "5g_for_pods_security_list"
37+
38+
# Cluster Tools
39+
# ingress_nginx_enabled = true
40+
# cert_manager_enabled = true
41+
}

0 commit comments

Comments
 (0)