terraform.tfvars.example

# Copyright (c) 2017, 2022 Oracle Corporation and/or its affiliates.
# Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl

# Identity and access parameters
api_fingerprint = ""
# api_private_key      = <<EOT
#-----BEGIN RSA PRIVATE KEY-----
#content+of+api+key
#-----END RSA PRIVATE KEY-----
#EOT

api_private_key_path = ""

home_region = "us-ashburn-1"
region      = "us-phoenix-1"

tenancy_id = ""
user_id    = ""

# general oci parameters
compartment_id = ""
label_prefix   = "dev"

# ssh keys
ssh_private_key = ""
# ssh_private_key    = <<EOT
#-----BEGIN RSA PRIVATE KEY-----
#content+of+api+key
#-----END RSA PRIVATE KEY-----
#EOT
ssh_private_key_path = "~/.ssh/id_rsa"
# ssh_public_key       = ""
# ssh_public_key_path  = "none"
# ssh_public_key_path = "~/.ssh/id_rsa.pub"

# networking
create_drg       = false
drg_display_name = "drg"
drg_id           = null
remote_peering_connections = {} 
#
# map of remote peering connections
# - key-only items represent represent local acceptors with no info about the remote peer
# - items containing key and values represent local requestor and must have the OCID and region of the remote acceptor
# remote_peering_connections = {
#    "rpc_name_1" : {}
#    "rpc_name_2" : {
#        "rpc_acceptor_id" : "ocid1.remotepeeringconnection.oc1.aaaaaa" # <-- edit this OCID
#        "rpc_acceptor_region" : "us-ashburn-1" #<-- replace the region
#    }
# }

internet_gateway_route_rules = [
  #   {
  #     destination       = "192.168.0.0/16" # Route Rule Destination CIDR
  #     destination_type  = "CIDR_BLOCK"     # only CIDR_BLOCK is supported at the moment
  #     network_entity_id = "drg"            # for internet_gateway_route_rules input variable, you can use special strings "drg", "internet_gateway" or pass a valid OCID using string or any Named Values
  #     description       = "Terraformed - User added Routing Rule: To drg provided to this module. drg_id, if available, is automatically retrieved with keyword drg"
  #   },
]

local_peering_gateways = {}

lockdown_default_seclist = true

nat_gateway_route_rules = [
  #   {
  #     destination       = "192.168.0.0/16" # Route Rule Destination CIDR
  #     destination_type  = "CIDR_BLOCK"     # only CIDR_BLOCK is supported at the moment
  #     network_entity_id = "drg"            # for nat_gateway_route_rules input variable, you can use special strings "drg", "nat_gateway" or pass a valid OCID using string or any Named Values
  #     description       = "Terraformed - User added Routing Rule: To drg provided to this module. drg_id, if available, is automatically retrieved with keyword drg"
  #   },
]

nat_gateway_public_ip_id = "none"

subnets = {
  bastion  = { netnum = 0, newbits = 13 }
  operator = { netnum = 1, newbits = 13 }
  cp       = { netnum = 2, newbits = 13 }
  int_lb   = { netnum = 16, newbits = 11 }
  pub_lb   = { netnum = 17, newbits = 11 }
  workers  = { netnum = 1, newbits = 2 }
  pods     = { netnum = 2, newbits = 2 }
  fss      = { netnum = 18, newbits = 11 }
}

assign_dns                   = true
create_vcn                   = true
vcn_cidrs                    = ["10.0.0.0/16"]
vcn_dns_label                = "oke"
vcn_name                     = "vcnoke"
vcn_display_name             = ""
vcn_id                       = ""
ig_route_table_display_name  = ""
ig_route_table_id            = ""
nat_route_table_display_name = ""
nat_route_table_id           = ""


# bastion host
create_bastion_host = true
bastion_access      = ["anywhere"]
bastion_image_id    = "Autonomous"
bastion_os_version  = "8.7"
bastion_user        = "opc"
bastion_shape = {
  shape            = "VM.Standard.E4.Flex",
  ocpus            = 1,
  memory           = 4,
  boot_volume_size = 50
}
bastion_state    = "RUNNING"
bastion_timezone = "Etc/UTC"
bastion_type     = "public"
upgrade_bastion  = false

# Use an existing bastion. If create_bastion_host = false and set
# to non-empty string, will be used for SSH access into the VCN.
bastion_public_ip = ""

## bastion notification
enable_bastion_notification   = false
bastion_notification_endpoint = ""
bastion_notification_protocol = "EMAIL"
bastion_notification_topic    = "bastion_server_notification"

# bastion service
create_bastion_service        = false
bastion_service_access        = ["0.0.0.0/0"]
bastion_service_name          = "bastion"
bastion_service_target_subnet = "operator"

# operator host
create_operator                    = true
operator_image_id                  = "Oracle"
enable_operator_instance_principal = true
operator_nsg_ids                   = []
operator_os_version                = "8"
operator_user                      = "opc"
operator_shape = {
  shape            = "VM.Standard.E4.Flex",
  ocpus            = 1,
  memory           = 4,
  boot_volume_size = 50
}
operator_state    = "RUNNING"
operator_timezone = "Etc/UTC"
upgrade_operator  = false

# Use an existing operator. If create_operator = false and set
# to non-empty string, will be used for k8s access within the VCN.
operator_private_ip = ""

# Operator in-transit encryption for the data volume's paravirtualized attachment.
enable_operator_pv_encryption_in_transit = false

# operator volume kms integration
operator_volume_kms_id = ""

## operator notification
enable_operator_notification   = false
operator_notification_endpoint = ""
operator_notification_protocol = "EMAIL"
operator_notification_topic    = ""

# availability_domains
availability_domains = {
  bastion  = 1,
  operator = 1,
  fss      = 1
}

# oke cluster options
admission_controller_options = {
  PodSecurityPolicy = false
}
allow_node_port_access       = false
allow_pod_internet_access    = true
allow_worker_internet_access = true
allow_worker_ssh_access      = false
cluster_name                 = "oke"
cluster_type                 = "basic"
cni_type                     = "flannel"
control_plane_type           = "private"
control_plane_allowed_cidrs  = ["0.0.0.0/0"]
control_plane_nsgs           = []
dashboard_enabled            = false
kubernetes_version           = "v1.24.1"
pods_cidr                    = "10.244.0.0/16"
services_cidr                = "10.96.0.0/16"

## oke cluster kms integration
use_cluster_encryption = false
cluster_kms_key_id     = ""
create_policies        = true

## oke cluster container image policy and keys
use_signed_images  = false
image_signing_keys = []

# node pools
check_node_active               = "all"
enable_pv_encryption_in_transit = false
kubeproxy_mode = "iptables"
node_pools = {
  # Basic node pool
  #preemptible = {
  #  shape            = "VM.Standard.1.1",
  #  ocpus            = 1,
  #  memory           = 1,
  #  node_pool_size   = 1,
  #  boot_volume_size = 150,
  #  eviction_grace_duration = 0,  //Grade duration in minutes. Service default is 60.
  #  force_node_delete       = true
  #  preemptible_config = {"enable": true, "is_preserve_boot_volume": true}
  #}
  #np1 = {
  #  shape            = "VM.Standard.E4.Flex",
  #  ocpus            = 2,
  #  memory           = 32,
  #  node_pool_size   = 1,
  #  boot_volume_size = 150,
  #  eviction_grace_duration = 0,  //Grade duration in minutes. Service default is 60.
  #  force_node_delete       = true  
  #}
  # # node pool with initial node labels
  # np2 = {
  #   shape            = "VM.Standard.E4.Flex",
  #   ocpus            = 2,
  #   memory           = 32,
  #   node_pool_size   = 1,
  #   boot_volume_size = 150,
  #   label            = { app = "frontend", pool = "np2" },
  # }
  # # node pool with freeform tags
  # np3 = {
  #   shape                  = "VM.Standard.E4.Flex",
  #   ocpus                  = 2,
  #   memory                 = 32,
  #   node_pool_size         = 1,
  #   boot_volume_size       = 150,
  #   nodepool_freeform_tags = { app = "frontend", pool = "np2" },
  #   node_freeform_tags     = { app = "frontend", nodes = "np2" },
  # }
  # # node pool with defined tags
  # np4 = {
  #   shape                 = "VM.Standard.E4.Flex",
  #   ocpus                 = 2,
  #   memory                = 32,
  #   node_pool_size        = 1,
  #   boot_volume_size      = 150,
  #   nodepool_defined_tags = { "cn.environment" = "prod" },
  #   node_defined_tags     = { "cn.environment" = "prod" },
  # }
  # # node pool using ARM Flex shape
  # np6 = {
  #   shape            = "VM.Standard.A1.Flex",
  #   ocpus            = 2,
  #   memory           = 32,
  #   node_pool_size   = 1,
  #   boot_volume_size = 150,
  # }
  # # node pool using Baremetal X86_64
  # np7 = {
  #   shape            = "BM.Standard2.52",
  #   node_pool_size   = 1,
  #   boot_volume_size = 150,
  # }
  # # node pool using Baremetal ARM
  # np8 = {
  #   shape            = "BM.Standard.A1.160",
  #   node_pool_size   = 1,
  #   boot_volume_size = 150,
  # }
  # # node pool using Optimized Flex
  # np9 = {
  #   shape            = "VM.Optimized3.Flex",
  #   node_pool_size   = 1,
  #   boot_volume_size = 150,
  # }
  # # node pool using DenseIO2
  # np9 = {
  #   shape            = "BM.DenseIO2.52",
  #   node_pool_size   = 1,
  #   boot_volume_size = 150,
  # }
  # # node pool using BM.GPU4.8 and availability domain placement
  # np11 = {
  #   shape            = "BM.GPU4.8",
  #   node_pool_size   = 1,
  #   boot_volume_size = 150,
  #   placement_ads    = [1]
  # }
  # # node pool managed by Kubernetes Cluster Autoscaler
  # np12 = {
  #   shape              = "VM.Standard.E4.Flex",
  #   ocpus              = 2,
  #   memory             = 32,
  #   node_pool_size     = 1,
  #   max_node_pool_size = 5,
  #   boot_volume_size   = 150,
  #   autoscale          = true,
  # }
}

node_pool_image_id    = "none"
node_pool_image_type  = "oke"
node_pool_name_prefix = "np"
node_pool_os          = "Oracle Linux"
node_pool_os_version  = "7.9"
worker_nsgs           = []
worker_type           = "private"

#cloudinit_nodepool_common = "/tmp/commoncloudinit.sh"
#cloudinit_nodepool        = {
  #np1 = "/tmp/np1cloudinit.sh"
  #np3 = "/tmp/np3cloudinit.sh"
#}
node_pool_timezone = "Etc/UTC"

# upgrade of existing node pools
upgrade_nodepool        = false
node_pools_to_drain     = ["np1", "np2"]
nodepool_upgrade_method = "out_of_place"

# oke load balancers
enable_waf              = false
load_balancers          = "both"
preferred_load_balancer = "public"
# internal_lb_allowed_cidrs  = ["172.16.1.0/24", "172.16.2.0/24"] # By default, anywhere i.e. 0.0.0.0/0 is allowed
# internal_lb_allowed_ports  = [80, 443, "7001-7005"] # By default, only 80 and 443 are allowed
# public_lb_allowed_cidrs    = ["0.0.0.0/0"] # By default, anywhere i.e. 0.0.0.0/0 is allowed
# public_lb_allowed_ports    = [443,"9001-9002"] # By default, only 443 is allowed

# fss
create_fss        = false
fss_mount_path    = "/oke_fss"
max_fs_stat_bytes = 23843202333
max_fs_stat_files = 223442


# ocir
email_address    = ""
secret_id        = "none"
secret_name      = "ocirsecret"
secret_namespace = "default"
username         = ""

# calico
enable_calico            = false
calico_version           = "3.24.5"
calico_mode              = "policy-only"
calico_mtu               = 0     # automatic if 0
calico_apiserver_enabled = false # default false
typha_enabled            = false # automatic if false
typha_replicas           = 0     # automatic if 0

# horizontal and vertical pod autoscaling
enable_metric_server = false
enable_vpa           = false
vpa_version          = 0.8

# OPA Gatekeeper
enable_gatekeeper  = false
gatekeeper_version = "3.7"

# service account
create_service_account               = false
service_account_name                 = ""
service_account_namespace            = ""
service_account_cluster_role_binding = ""

# freeform_tags
freeform_tags = {
  # # vcn, bastion and operator freeform_tags are required
  # # add more freeform_tags in each as desired
  # vcn = {
  #   environment = "dev"
  # }
  # bastion = {
  #   access      = "public",
  #   environment = "dev",
  #   role        = "bastion",
  #   security    = "high"
  # }
  # operator = {
  #   access      = "restricted",
  #   environment = "dev",
  #   role        = "operator",
  #   security    = "high"
  # }
  # oke = {
  #   cluster = {
  #     environment = "dev"
  #     role        = "cluster"
  #   }
  #   persistent_volume = {
  #     environment = "dev"
  #   }
  #   service_lb = {
  #     environment = "dev"
  #     role        = "load balancer"
  #   }
  #   node_pool = {
  #     environment = "dev"
  #     role        = "node-pool"
  #   }
  #   node = {
  #     environment = "dev"
  #     role        = "worker"
  #   }
  # }
}

# defined_tags
defined_tags = {
  # # vcn, bastion and operator freeform_tags are required
  # # add more freeform_tags in each as desired
  # vcn = {
  #   "cn.environment" = "dev"
  # }
  # oke = {
  #   cluster = {
  #     "cn.environment" = "dev"
  #     "cn.role"        = "cluster"
  #   }
  #   persistent_volume = {
  #     "cn.environment" = "dev"
  #   }
  #   service_lb = {
  #     "cn.environment" = "dev"
  #     "cn.role"        = "load balancer"
  #   }
  #   node_pool = {
  #     "cn.environment" = "dev"
  #     "cn.role"        = "node-pool"
  #   }
  #   node = {
  #     "cn.environment" = "dev"
  #     "cn.role"        = "worker"
  #   }
  # }
}

# cluster autoscaler
enable_cluster_autoscaler = false
autoscaler_pools = {
  # only 1 pool is needed at a time unless during upgrade
  asp_v124 = {}
}

# placeholder variable for debugging scripts. To be implemented in future
debug_mode = false