terraform-oci-base for Oracle Cloud Infrastructure provides a reusable Terraform module that provisions a minimal infrastructure on OCI, including a VCN, an optional bastion host and an optional internal admin server
License: Universal Permissive License v1.0
# Copy-paste any Terraform configurations for how the requested feature may be used. https://docs.cloud.oracle.com/en-us/iaas/Content/ContEng/Tasks/contengupgradingk8smasternode.htm
https://docs.cloud.oracle.com/en-us/iaas/Content/ContEng/Tasks/contengupgradingk8sworkernode.htm
# Copy-paste any Terraform configurations for how the requested feature may be used. To determine the values for the newbits and subnets variables, users would have to learn about the cidrsubnet function, by reading https://www.terraform.io/docs/configuration/functions/cidrsubnet.html). To make that learning experience just a tad bit easier, consider changing the name of the subnets variable to netnum, i.e., consistent with the arguments names of the cidrsubnet function.
@hyder - Hi Ali, when I tested the terraform-oci-base config the other day, I had set region to us-ashburn-1 and everything worked. But when I tested with region=us-phoenix-1 today, the resources were still created in Ashburn (the home region)! I suspect that only one provider is defined, i.e., for the home region. Am I missing anything?
@hyder , per our email conversation...
To create the policy we could use the compartment_id instead of compartment_name:
Allow dynamic-group base-bastion-instance-principal to manage all-resources in compartment id <ocid>
If we take this route, then we can remove compartment_name from the list of input variables. Please consider this suggestion.
0.12.16
autonomous_image_id = lookup(data.oci_core_app_catalog_subscriptions.autonomous_linux[0].app_catalog_subscriptions[0], "listing_resource_id")
oracle_image_id = data.oci_core_images.oracle_images[0].images.0.id
bastion/locals.tf
# Copy-paste your Terraform configurations here - for large Terraform configs,
# please use a service like Dropbox and share a link to the ZIP file.
# Please remove any sensitive information from configuration files before sharing them. Error: Invalid index on modules\base\bastion\locals.tf line 13, in locals: 13: oracle_image_id = data.oci_core_images.oracle_images[0].images.0.id
data.oci_core_images.oracle_images is empty tuple
The given key does not identify an element in this collection value.
terraform planThe need to introduce a delay for instance_principal was a red herring. oracle-terraform-modules/terraform-oci-oke#156
We can remove it.
# Copy-paste any Terraform configurations for how the requested feature may be used. Some solutions require the instance_principal on the admin host to be enabled after which they issue oci commands from the admin host. In such cases, they also need to know when the instance_principal is effective so that the oci commands are run successfully. See oracle-terraform-modules/terraform-oci-oke#143 for more details.
We should add a file on the admin host so that users can look and wait for its creation before they can proceed.
# Copy-paste any Terraform configurations for how the requested feature may be used. We should be able to add VCN flow logs, bastion and operator logs as well as any other infra that is created on top of the base module.
# Copy-paste any Terraform configurations for how the requested feature may be used. # Copy-paste any Terraform configurations for how the requested feature may be used. # Copy-paste your Terraform configurations here - for large Terraform configs,
# please use a service like Dropbox and share a link to the ZIP file.
# Please remove any sensitive information from configuration files before sharing them. terraform applyAdd tagging for resources
# Copy-paste your Terraform configurations here - for large Terraform configs,
# please use a service like Dropbox and share a link to the ZIP file.
# Please remove any sensitive information from configuration files before sharing them. terraform apply# Copy-paste any Terraform configurations for how the requested feature may be used. # Copy-paste your Terraform configurations here - for large Terraform configs,
# please use a service like Dropbox and share a link to the ZIP file.
# Please remove any sensitive information from configuration files before sharing them. terraform applyUse terraform-oci-vcn module: https://github.com/oracle-terraform-modules/terraform-oci-vcn
instead of managing base as a monolithic module.
# Copy-paste any Terraform configurations for how the requested feature may be used. In the vcn module definition, the tags are hardcoded instead of taken from the variables.
# Copy-paste your Terraform configurations here - for large Terraform configs,
# please use a service like Dropbox and share a link to the ZIP file.
# Please remove any sensitive information from configuration files before sharing them. terraform applyThe notifications documentation link on the README gives a 404 error.
modules\base\modules\bastion\datasources.tf
data "oci_ons_notification_topic" "bastion_notification" {
#Required
topic_id = oci_ons_notification_topic.bastion_notification[0].topic_id
count = (var.oci_bastion.bastion_enabled == true && var.oci_bastion_notification.notification_enabled == true) ? 1 : 0
}
# Copy-paste your Terraform configurations here - for large Terraform configs,
# please use a service like Dropbox and share a link to the ZIP file.
# Please remove any sensitive information from configuration files before sharing them. terraform applyConsider replacing the quickstart doc with a link to the solution guide
resource "oci_core_instance" "bastion" {
....
source_details {
source_type = "image"
source_id = lookup(data.oci_core_app_catalog_subscriptions.autonomous_linux.app_catalog_subscriptions[0], "listing_resource_id") //allow option to specify bastion image id here
}
....
}
# Copy-paste any Terraform configurations for how the requested feature may be used. image_id = "...."
The Autonomous Linux image is now available as a platform image. We should use that instead of the Marketplace image for the bastion host.
datasources.tf in bastion module
terraform plan give below error for root compartment provided in tfvars file, but works fine with child compartment id--
module.bastion.oci_core_instance.bastion[0]: Refreshing state... [id=ocid1.instance.oc1.ap-mumbai-1.anrg6ljrbrnzudqcd55dlcmtirxqkc5ph6cndyusq6vbf2xb7i2pelb266ta]
Error: Invalid index
on modules/admin/instance_principal.tf line 42, in resource "oci_identity_policy" "admin_instance_principal":
42: statements = ["Allow dynamic-group ${oci_identity_dynamic_group.admin_instance_principal[0].name} to manage all-resources in compartment id ${data.oci_identity_compartments.compartments_id.compartments.0.id}"]
|----------------
| data.oci_identity_compartments.compartments_id.compartments is empty list of object
The given key does not identify an element in this collection value.
# Copy-paste your Terraform configurations here - for large Terraform configs,
# please use a service like Dropbox and share a link to the ZIP file.
# Please remove any sensitive information from configuration files before sharing them. terraform applyoci_ons_notification_topic
oci_ons_subscription
modules/bastion/ons.tf
When bastion_enabled = false, the notification topic and the subscription for the bastion must not be created.
The notification topic and the subscription for the bastion are created even if bastion_enabled = false
# Copy-paste any Terraform configurations for how the requested feature may be used. oci_core_images.autonomous_images
The operating system name has changed since last commit. It should now be "Oracle Autonomous Linux".
# Copy-paste your Terraform configurations here - for large Terraform configs,
# please use a service like Dropbox and share a link to the ZIP file.
# Please remove any sensitive information from configuration files before sharing them. Running terraform plan should be successful.
Running terraform plan returns the following:
terraform plan# Copy-paste your Terraform configurations here - for large Terraform configs,
# please use a service like Dropbox and share a link to the ZIP file.
# Please remove any sensitive information from configuration files before sharing them. terraform apply# Copy-paste your Terraform configurations here - for large Terraform configs,
# please use a service like Dropbox and share a link to the ZIP file.
# Please remove any sensitive information from configuration files before sharing them. oci cli tool installed on admin host
oci cli tool installed on admin host
terraform applyTo perform administrative tasks using oci-cli from a host, it is required for the host to have instance_principal. This removes the need to to upload keys, and setting up oci-cli configuration.
Allowing the bastion instance_principal access is not a good idea. Instead, we can use an internal admin server with instance_principal access that resides on a private subnet. The bastion host is then used as jump host only.
New module for admin host
# Copy-paste any Terraform configurations for how the requested feature may be used. # Copy-paste any Terraform configurations for how the requested feature may be used. 0.12
data "oci_core_images" "autonomous_images" and locals in bastion module
datasources.tf and locals.tf in bastion module
# Copy-paste your Terraform configurations here - for large Terraform configs,
# please use a service like Dropbox and share a link to the ZIP file.
# Please remove any sensitive information from configuration files before sharing them. Error: Invalid index
on modules\bastion\locals.tf line 12, in locals:
12: bastion_image_id = var.oci_bastion.bastion_image_id == "Autonomous" ? data.oci_core_images.autonomous_images[0].images.0.id : var.oci_bastion.bastion_image_id
|----------------
| data.oci_core_images.autonomous_images is empty tuple
The given key does not identify an element in this collection value.
terraform plan# Copy-paste any Terraform configurations for how the requested feature may be used. # Copy-paste any Terraform configurations for how the requested feature may be used. Make level prefix optional by passing appropriate values to submodules. Also change vcn module to 1.0.3
Document all OCI IAM requirements:
Things to document:
# Copy-paste any Terraform configurations for how the requested feature may be used. @hyder , Hi Ali, what's the purpose of disable_auto_retries ? I don't see it used anywhere in the code.
terraform --version
Terraform v0.14.7
oci_core_instance
bastion
# Copy-paste your Terraform configurations here - for large Terraform configs,
# please use a service like Dropbox and share a link to the ZIP file.
# Please remove any sensitive information from configuration files before sharing them. By filling mandatory parameters, terraform plan should pass.
terraform plan fails for bastion resources creation as it is set as default enabled etc. Either documentation should says its mandatory or it should be default false in codebase
terraform applyError: Invalid function argument
on .terraform/modules/bastion/compute.tf line 29, in resource "oci_core_instance" "bastion":
29: ssh_authorized_keys = var.ssh_public_key != "" ? var.ssh_public_key : file(var.ssh_public_key_path)
|----------------
| var.ssh_public_key_path is ""
Invalid value for "path" parameter: failed to read ..
Error: Invalid function argument
on .terraform/modules/operator/compute.tf line 35, in resource "oci_core_instance" "operator":
35: ssh_authorized_keys = var.ssh_public_key != "" ? var.ssh_public_key : file(var.ssh_public_key_path)
|----------------
| var.ssh_public_key_path is ""
Invalid value for "path" parameter: failed to read ..
The input variables to this module currently use structural types (object/tuples) and this is a bit difficult to pass/render as input when used in ORM, command line arguments. Users also struggle with initializing and passing the correct arguments to it.
We propose that we revert to using a primitive and collection types (list, map, set) only. The changes would be reflected in a major version.
# Copy-paste any Terraform configurations for how the requested feature may be used. Use instance_configuration and pool for bastion and admin servers to ensure a minimum of 1 instance for each
# Copy-paste any Terraform configurations for how the requested feature may be used. In terraform.tfvars, I had to add a timezone variable for terraform apply to work. I wasn’t sure what string format the time zone should be in. So I tried the IANA time zone format, “America/Los_Angeles”, and it worked. Please add this variable to terraform.tfvars.example, with a comment about the time zone format.
After the changes in #7, #8 and #10, update the docs for the example gitlab module.
Also, finish load balancer example code.
@hyder , in our offline email exchange, you clarified that the ssh_private_key_path variable is not needed for the bastion module, and asked me to file an issue to remove it.
Both locals.tf in root and ons.tf in bastion have the label prefix.
# Copy-paste your Terraform configurations here - for large Terraform configs,
# please use a service like Dropbox and share a link to the ZIP file.
# Please remove any sensitive information from configuration files before sharing them. terraform apply# Copy-paste any Terraform configurations for how the requested feature may be used. 
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
Django
The Web framework for perfectionists with deadlines.
Laravel
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft
Open source projects and samples from Microsoft.
Google
Google ❤️ Open Source for everyone.
Alibaba
Alibaba Open Source for everyone
D3
Data-Driven Documents codes.
Tencent
China tencent open source team.