terraform.tfvars.example

# Copyright 2017, 2021 Oracle Corporation and/or affiliates.
# Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl

# Identity and access parameters
api_fingerprint      = ""
# api_private_key      = <<EOT
#-----BEGIN RSA PRIVATE KEY-----
#content+of+api+key
#-----END RSA PRIVATE KEY-----
#EOT

api_private_key_path = ""

home_region = "us-ashburn-1"
region = "us-phoenix-1"

tenancy_id           = ""
user_id              = ""

# general oci parameters
compartment_id = ""
label_prefix   = "dev"

# ssh keys
ssh_private_key      = ""
# ssh_private_key    = <<EOT
#-----BEGIN RSA PRIVATE KEY-----
#content+of+api+key
#-----END RSA PRIVATE KEY-----
#EOT
ssh_private_key_path = "~/.ssh/id_rsa"
# ssh_public_key       = ""
# ssh_public_key_path  = "none"
# ssh_public_key_path = "~/.ssh/id_rsa.pub"

# networking
create_drg       = false
drg_display_name = "drg"
drg_id           = null

internet_gateway_route_rules = [
#   {
#     destination       = "192.168.0.0/16" # Route Rule Destination CIDR
#     destination_type  = "CIDR_BLOCK"     # only CIDR_BLOCK is supported at the moment
#     network_entity_id = "drg"            # for internet_gateway_route_rules input variable, you can use special strings "drg", "internet_gateway" or pass a valid OCID using string or any Named Values
#     description       = "Terraformed - User added Routing Rule: To drg provided to this module. drg_id, if available, is automatically retrieved with keyword drg"
#   },
]

local_peering_gateways = {}

lockdown_default_seclist = true

nat_gateway_route_rules = [
#   {
#     destination       = "192.168.0.0/16" # Route Rule Destination CIDR
#     destination_type  = "CIDR_BLOCK"     # only CIDR_BLOCK is supported at the moment
#     network_entity_id = "drg"            # for nat_gateway_route_rules input variable, you can use special strings "drg", "nat_gateway" or pass a valid OCID using string or any Named Values
#     description       = "Terraformed - User added Routing Rule: To drg provided to this module. drg_id, if available, is automatically retrieved with keyword drg"
#   },
]

nat_gateway_public_ip_id = "none"

subnets = {
  bastion  = { netnum = 0, newbits = 13 }
  operator = { netnum = 1, newbits = 13 }
  cp       = { netnum = 2, newbits = 13 }
  int_lb   = { netnum = 16, newbits = 11 }
  pub_lb   = { netnum = 17, newbits = 11 }
  workers  = { netnum = 1, newbits = 2 }
  pods     = { netnum = 2, newbits = 2 }
  fss      = { netnum = 18, newbits = 11 }
}

create_vcn                   = true
vcn_cidrs                    = ["10.0.0.0/16"]
vcn_dns_label                = "oke"
vcn_name                     = "vcnoke"
vcn_display_name             = ""
vcn_id                       = ""
ig_route_table_display_name  = ""
ig_route_table_id            = ""
nat_route_table_display_name = ""
nat_route_table_id           = ""


# bastion host
create_bastion_host = true
bastion_access      = ["anywhere"]
bastion_image_id    = "Autonomous"
bastion_os_version  = "7.9"
bastion_user        = "opc"
bastion_shape = {
  shape            = "VM.Standard.E4.Flex",
  ocpus            = 1,
  memory           = 4,
  boot_volume_size = 50
}
bastion_state    = "RUNNING"
bastion_timezone = "Etc/UTC"
bastion_type     = "public"
upgrade_bastion  = false

# Use an existing bastion. If create_bastion_host = false and set
# to non-empty string, will be used for SSH access into the VCN.
bastion_public_ip = ""

## bastion notification
enable_bastion_notification   = false
bastion_notification_endpoint = ""
bastion_notification_protocol = "EMAIL"
bastion_notification_topic    = "bastion_server_notification"

# bastion service
create_bastion_service        = false
bastion_service_access        = ["0.0.0.0/0"]
bastion_service_name          = "bastion"
bastion_service_target_subnet = "operator"

# operator host
create_operator                    = true
operator_image_id                  = "Oracle"
enable_operator_instance_principal = true
operator_nsg_ids                   = []
operator_os_version                = "8"
operator_user                      = "opc"
operator_shape = {
  shape            = "VM.Standard.E4.Flex",
  ocpus            = 1,
  memory           = 4,
  boot_volume_size = 50
}
operator_state    = "RUNNING"
operator_timezone = "Etc/UTC"
upgrade_operator  = false

# Use an existing operator. If create_operator = false and set
# to non-empty string, will be used for k8s access within the VCN.
operator_private_ip = ""

# Operator in-transit encryption for the data volume's paravirtualized attachment.
enable_operator_pv_encryption_in_transit = false

# operator volume kms integration
operator_volume_kms_id = ""

## operator notification
enable_operator_notification   = false
operator_notification_endpoint = ""
operator_notification_protocol = "EMAIL"
operator_notification_topic    = ""

# availability_domains
availability_domains = {
  bastion  = 1,
  operator = 1,
  fss      = 1
}

# oke cluster options
admission_controller_options = {
  PodSecurityPolicy = false
}
allow_node_port_access       = false
allow_pod_internet_access    = true
allow_worker_internet_access = true
allow_worker_ssh_access      = false
cluster_name                 = "oke"
cni_type                     = "flannel"
control_plane_type           = "private"
control_plane_allowed_cidrs  = ["0.0.0.0/0"]
control_plane_nsgs           = []
dashboard_enabled            = false
kubernetes_version           = "v1.23.4"
pods_cidr                    = "10.244.0.0/16"
services_cidr                = "10.96.0.0/16"

## oke cluster kms integration
use_cluster_encryption  = false
cluster_kms_key_id      = ""
create_policies = true

## oke cluster container image policy and keys
use_signed_images = false
image_signing_keys = []

# node pools
check_node_active = "all"
enable_pv_encryption_in_transit = false
node_pools = {
  # Basic node pool
  np1 = {
    shape            = "VM.Standard.E4.Flex",
    ocpus            = 2,
    memory           = 32,
    node_pool_size   = 1,
    boot_volume_size = 150,
  }
  # # node pool with initial node labels
  # np2 = {
  #   shape            = "VM.Standard.E4.Flex",
  #   ocpus            = 2,
  #   memory           = 32,
  #   node_pool_size   = 1,
  #   boot_volume_size = 150,
  #   label            = { app = "frontend", pool = "np2" },
  # }
  # # node pool with freeform tags 
  # np3 = {
  #   shape                  = "VM.Standard.E4.Flex",
  #   ocpus                  = 2,
  #   memory                 = 32,
  #   node_pool_size         = 1,
  #   boot_volume_size       = 150,
  #   nodepool_freeform_tags = { app = "frontend", pool = "np2" },
  #   node_freeform_tags     = { app = "frontend", nodes = "np2" },
  # }
  # # node pool with defined tags
  # np4 = {
  #   shape                 = "VM.Standard.E4.Flex",
  #   ocpus                 = 2,
  #   memory                = 32,
  #   node_pool_size        = 1,
  #   boot_volume_size      = 150,
  #   nodepool_defined_tags = { "cn.environment" = "prod" },
  #   node_defined_tags     = { "cn.environment" = "prod" },
  # }
  # # node pool with placement ads
  # np5 = {
  #   shape            = "VM.Standard.E4.Flex",
  #   ocpus            = 2,
  #   memory           = 32,
  #   node_pool_size   = 1,
  #   boot_volume_size = 150,
  #   placement_ads    = [1]
  # }
  # # node pool using ARM Flex shape
  # np6 = {
  #   shape            = "VM.Standard.A1.Flex",
  #   ocpus            = 2,
  #   memory           = 32,
  #   node_pool_size   = 1,
  #   boot_volume_size = 150,
  # }
  # # node pool using Baremetal X86_64
  # np7 = {
  #   shape            = "BM.Standard2.52",
  #   node_pool_size   = 1,
  #   boot_volume_size = 150,
  # }
  # # node pool using Baremetal ARM
  # np8 = {
  #   shape            = "BM.Standard.A1.160",
  #   node_pool_size   = 1,
  #   boot_volume_size = 150,
  # }
  # # node pool using Optimized Flex
  # np9 = {
  #   shape            = "VM.Optimized3.Flex",
  #   node_pool_size   = 1,
  #   boot_volume_size = 150,
  # }
  # # node pool using DenseIO2
  # np9 = {
  #   shape            = "BM.DenseIO2.52",
  #   node_pool_size   = 1,
  #   boot_volume_size = 150,
  # }
  # # node pool using BM.GPU3.8
  # np10 = {
  #   shape            = "BM.GPU3.8",
  #   node_pool_size   = 1,
  #   boot_volume_size = 150,
  # }
  # # node pool using BM.GPU4.8
  # np11 = {
  #   shape            = "BM.GPU4.8",
  #   node_pool_size   = 1,
  #   boot_volume_size = 150,
  # }
}
node_pool_image_id    = "none"
node_pool_image_type  = "oke"
node_pool_name_prefix = "np"
node_pool_os          = "Oracle Linux"
node_pool_os_version  = "7.9"
worker_nsgs           = []
worker_type           = "private"

#cloudinit_nodepool_common = "/tmp/commoncloudinit.sh"
#cloudinit_nodepool        = {
  #np1 = "/tmp/np1cloudinit.sh"
  #np3 = "/tmp/np3cloudinit.sh"
#}
node_pool_timezone        = "Etc/UTC"

# upgrade of existing node pools
upgrade_nodepool        = false
node_pools_to_drain     = ["np1", "np2"]
nodepool_upgrade_method = "out_of_place"

# oke load balancers
enable_waf                   = false
load_balancers               = "both"
preferred_load_balancer      = "public"
# internal_lb_allowed_cidrs  = ["172.16.1.0/24", "172.16.2.0/24"] # By default, anywhere i.e. 0.0.0.0/0 is allowed
# internal_lb_allowed_ports  = [80, 443, "7001-7005"] # By default, only 80 and 443 are allowed
# public_lb_allowed_cidrs    = ["0.0.0.0/0"] # By default, anywhere i.e. 0.0.0.0/0 is allowed
# public_lb_allowed_ports    = [443,"9001-9002"] # By default, only 443 is allowed

#fss
create_fss = false
fss_mount_path = "/oke_fss"
max_fs_stat_bytes = 23843202333
max_fs_stat_files = 223442


# ocir
email_address    = ""
secret_id        = "none"
secret_name      = "ocirsecret"
secret_namespace = "default"
username         = ""

# calico
enable_calico  = false
calico_version = "3.19"

# horizontal and vertical pod autoscaling
enable_metric_server = false
enable_vpa           = false
vpa_version          = 0.8

#OPA Gatekeeper
enable_gatekeeper = false
gatekeeeper_version = "3.7"

# service account
create_service_account               = false
service_account_name                 = ""
service_account_namespace            = ""
service_account_cluster_role_binding = ""

# freeform_tags
freeform_tags = {
  # vcn, bastion and operator freeform_tags are required
  # add more freeform_tags in each as desired
  vcn = {
    environment = "dev"
  }
  bastion = {
    access      = "public",
    environment = "dev",
    role        = "bastion",
    security    = "high"
  }
  operator = {
    access      = "restricted",
    environment = "dev",
    role        = "operator",
    security    = "high"
  }
  oke = {
    cluster = {
      environment = "dev"
      role        = "cluster"
    }
    persistent_volume = {
      environment = "dev"
    }    
    service_lb = {
      environment = "dev"
      role        = "load balancer"
    }
    node_pool = {
      environment = "dev"
      role        = "node-pool"
    }
    node = {
      environment = "dev"
      role        = "worker"
    }
  }
}

# defined_tags
defined_tags = {
  # vcn, bastion and operator freeform_tags are required
  # add more freeform_tags in each as desired
  vcn = {
    "cn.environment" = "dev"
  }
  oke = {
    cluster = {
      "cn.environment" = "dev"
      "cn.role"        = "cluster"
    }
    persistent_volume = {
      "cn.environment" = "dev"
    }    
    service_lb = {
      "cn.environment" = "dev"
      "cn.role"        = "load balancer"
    }
    node_pool = {
      "cn.environment" = "dev"
      "cn.role"        = "node-pool"
    }
    node = {
      "cn.environment" = "dev"
      "cn.role"        = "worker"
    }
  }
}

# placeholder variable for debugging scripts. To be implemented in future
debug_mode = false