schema.yaml

# Copyright (c) 2022 Oracle and/or its affiliates. All rights reserved.
# Licensed under the Universal Permissive License v 1.0 as shown at http://oss.oracle.com/licenses/upl.
# 

title: "OKE BASE Stack"
description: "OKE BASE Stack"
informationalText: "This stack deploys a new OKE Cluster with cluster tools or just the cluster tools on an existent OKE Cluster."
schemaVersion: 1.1.0
version: "20190304"

source:
  type: quickstart

locale: "en"
variableGroups:
  - title: "Basic Hidden"
    variables:
    - tenancy_ocid
    - region
    visible: false

  - title: "General Configuration"
    variables:
    - app_name
    - show_advanced

  - title: "OKE Cluster Configuration"
    variables:
    - create_new_oke_cluster
    - compartment_ocid
    - existent_oke_cluster_id
    - k8s_version
    - create_new_compartment_for_oke
    - node_pool_cni_type_1

  - title: "OKE Network Configuration"
    variables:
    - cluster_workers_visibility
    - cluster_endpoint_visibility
    - existent_oke_cluster_vcn
    - create_orm_private_endpoint
    - existent_oke_cluster_private_endpoint
    - cluster_load_balancer_visibility
    - create_new_vcn
    - existent_vcn_compartment_ocid
    - existent_vcn_ocid
    - vcn_cidr_blocks
    - create_subnets
    - existent_oke_k8s_endpoint_subnet_ocid
    - existent_oke_nodes_subnet_ocid
    - existent_oke_load_balancer_subnet_ocid

  - title: "OKE Network - Hidden"
    variables:
    - is_ipv6enabled
    - ipv6private_cidr_blocks
    - existent_oke_vcn_native_pod_networking_subnet_ocid
    - existent_oke_fss_mount_targets_subnet_ocid
    visible: false

  - title: "OKE Worker Nodes"
    variables:
    - node_pool_autoscaler_enabled_1
    - existent_oke_nodepool_id_for_autoscaler_1
    - node_pool_initial_num_worker_nodes_1
    - node_pool_max_num_worker_nodes_1
    - node_pool_instance_shape_1
    - generate_public_ssh_key
    - public_ssh_key
    - image_operating_system_1
    - image_operating_system_version_1
    - node_pool_name_1

  - title: "OKE Worker Nodes - Hidden"
    variables:
    - extra_node_pools
    - extra_route_tables
    - extra_security_list_name_for_api_endpoint
    - extra_security_list_name_for_nodes
    - extra_security_list_name_for_vcn_native_pod_networking
    - extra_security_lists
    - extra_subnets
    - node_pool_oke_init_params_1
    visible: false

  - title: "Dynamic Group and Policies"
    variables:
    - create_dynamic_group_for_nodes_in_compartment
    - existent_dynamic_group_for_nodes_in_compartment
    - create_compartment_policies

  - title: "Encryption using OCI Vault (KMS)"
    variables:
    - use_encryption_from_oci_vault
    - create_new_encryption_key
    - existent_encryption_key_vault
    - existent_encryption_key_id
    - create_vault_policies_for_group
    - user_admin_group_for_vault_policy

  - title: "Cluster Tools - Ingress Controller"
    variables:
    - ingress_nginx_enabled
    - ingress_load_balancer_shape
    - ingress_load_balancer_shape_flex_min
    - ingress_load_balancer_shape_flex_max

  - title: "Cluster Tools - Ingress"
    variables:
    - ingress_hosts_include_nip_io
    - use_custom_nip_io_domain
    - nip_io_domain
    - ingress_hosts
    - cert_manager_enabled
    - ingress_tls
    - ingress_cluster_issuer
    - ingress_email_issuer

  - title: "Cluster Tools"
    variables:
    - metrics_server_enabled
    - prometheus_enabled
    - grafana_enabled

  - title: "Tagging"
    variables:
    - tag_values

  - title: "Extras Hidden"
    variables:
      - user_ocid
      - fingerprint
      - private_key_path
      - node_pool_boot_volume_size_in_gbs_1
      - oke_compartment_description
      - cluster_cni_type
      - create_pod_network_subnet
      - extra_initial_node_labels_1
      - node_pool_shape_specific_ad_1
      - pods_network_visibility
    visible: false

variables:
  # compartment_ocid:
  #   type: oci:identity:compartment:id
  #   title: "Compartment"
  #   description: "The compartment in which to create compute instance(s)"
  #   required: true

  app_name:
    type: string
    title: "Cluster Name Prefix"
    required: true
    visible:
      and:
        - create_new_oke_cluster

  show_advanced:
    type: boolean
    title: "Show advanced options?"
    description: "Shows advanced options, allowing enable customer-managed encryption keys, select your ssh key, select/unselect cluster utilities, do not create policies, and other advanced options"
    visible: true

  # OKE Cluster Configuration
  create_new_oke_cluster:
    type: boolean
    title: "Create new OKE Cluster"

  compartment_ocid:
    type: oci:identity:compartment:id
    title: "Existent OKE Cluster Compartment"
    description: "The compartment where you find the existent OKE Cluster"
    required: true
    visible:
      not:
        - create_new_oke_cluster

  existent_oke_cluster_id:
    type: oci:container:cluster:id
    title: "Existent OKE Cluster"
    required: true
    dependsOn:
      compartmentId: compartment_ocid
    visible:
      not:
        - create_new_oke_cluster

  k8s_version:
    type: oci:kubernetes:versions:id
    title: "Kubernetes Version"
    required: false
    dependsOn:
      compartmentId: compartment_ocid
      clusterOptionId: "all"
    visible:
      and:
        - create_new_oke_cluster
        - show_advanced

  create_new_compartment_for_oke:
    type: boolean
    title: "Create new Compartment"
    visible:
      and:
        - create_new_oke_cluster
        - show_advanced

  # OKE Network
  cluster_workers_visibility:
    type: enum
    enum:
    - "Private"
    - "Public"
    title: "Choose Worker Nodes visibility type"
    required: true
    visible:
      and:
        - create_new_oke_cluster

  cluster_endpoint_visibility:
    type: enum
    enum:
    - "Private"
    - "Public"
    title: "Choose Kubernetes API Endpoint visibility type"
    required: true
    # visible:
    #   and:
    #     - create_new_oke_cluster

  existent_oke_cluster_vcn:
    type: oci:core:vcn:id
    title: "Existent OKE Cluster VCN for Private Endpoint"
    required: true
    dependsOn:
      compartmentId: compartment_ocid
    visible:
      and:
        - not:
          - create_new_oke_cluster
        - eq:
          - cluster_endpoint_visibility
          - "Private"

  create_orm_private_endpoint:
    type: boolean
    title: "Create ORM Private Endpoint for Kubernetes API Endpoint"
    visible:
      eq:
        - cluster_endpoint_visibility
        - "Private"

  existent_oke_cluster_private_endpoint:
    type: oci:resourcemanager:privateendpoint:id
    title: "Existent OKE Cluster ORM Private Endpoint"
    required: true
    dependsOn:
      compartmentId: compartment_ocid
      vcnId: existent_oke_cluster_vcn
    visible:
      and:
        - not:
          - create_new_oke_cluster
          - create_orm_private_endpoint
        - eq:
          - cluster_endpoint_visibility
          - "Private"

  cluster_load_balancer_visibility:
    type: enum
    enum:
    - "Private"
    - "Public"
    title: "Choose Load Balancers visibility type"
    required: true
    visible: false
      # and:
      #   - create_new_oke_cluster
      #   - show_advanced

  create_new_vcn:
    type: boolean
    title: "Create new Virtual Cloud Network (VCN)?"
    visible:
      and:
        - create_new_oke_cluster
        - show_advanced

  existent_vcn_compartment_ocid:
    type: oci:identity:compartment:id
    title: "Existent VCN Compartment"
    required: true
    default: compartment_ocid
    visible:
      and:
        - and:
          - create_new_oke_cluster
          - show_advanced
        - not:
          - create_new_vcn

  existent_vcn_ocid:
    type: oci:core:vcn:id
    title: "Existent VCN to be used for OKE Cluster"
    required: true
    dependsOn:
        compartmentId: existent_vcn_compartment_ocid
    visible:
      and:
        - and:
          - create_new_oke_cluster
          - show_advanced
        - not:
          - create_new_vcn

  vcn_cidr_blocks:
    type: string
    title: VCN CIDR BLOCK
    required: true
    default: 10.20.0.0/16
    pattern: "^(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9]).(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9]).(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9]).(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\\/(3[0-2]|[1-2]?[0-9])$"
    visible:
      and:
        - create_new_oke_cluster
        - create_new_vcn
        - show_advanced

  create_subnets:
    type: boolean
    title: "Create all subnets for the OKE VCN?"
    visible:
      and:
        - and:
          - create_new_oke_cluster
          - show_advanced
        - not:
          - create_new_vcn

  existent_oke_k8s_endpoint_subnet_ocid:
    type: oci:core:subnet:id
    title: "Existent subnet for Kubernetes API Endpoint"
    required: true
    dependsOn:
        compartmentId: existent_vcn_compartment_ocid
        vcnId: existent_vcn_ocid
    visible:
      and:
        - and:
          - create_new_oke_cluster
          - show_advanced
        - not:
          - create_subnets
        - not:
          - create_new_vcn

  existent_oke_nodes_subnet_ocid:
    type: oci:core:subnet:id
    title: "Existent subnet for OKE Worker Nodes"
    required: true
    dependsOn:
        compartmentId: existent_vcn_compartment_ocid
        vcnId: existent_vcn_ocid
    visible:
      and:
        - and:
          - create_new_oke_cluster
          - show_advanced
        - not:
          - create_subnets
        - not:
          - create_new_vcn

  existent_oke_load_balancer_subnet_ocid:
    type: oci:core:subnet:id
    title: "Existent subnet for Load Balancers created by Kubernetes"
    required: true
    dependsOn:
        compartmentId: existent_vcn_compartment_ocid
        vcnId: existent_vcn_ocid
    visible:
      and:
        - and:
          - create_new_oke_cluster
          - show_advanced
        - not:
          - create_subnets
        - not:
          - create_new_vcn

  existent_oke_vcn_native_pod_networking_subnet_ocid:
    type: oci:core:subnet:id
    title: "(Required if using OCI_VCN_IP_NATIVE CNI) Existent subnet for VCN Native Pod Networking"
    required: false
    dependsOn:
        compartmentId: existent_vcn_compartment_ocid
        vcnId: existent_vcn_ocid
    visible:
      and:
        - and:
          - create_new_oke_cluster
          - show_advanced
          - eq:
            - node_pool_cni_type_1
            - "OCI_VCN_IP_NATIVE"
        - not:
          - create_subnets
        - not:
          - create_new_vcn

  # OKE Worker Nodes - Node Pool
  node_pool_autoscaler_enabled_1:
    type: boolean
    title: "Enable Cluster Autoscaler for Node Pool"
    # visible:
    #   and:
    #     - create_new_oke_cluster 

  node_pool_initial_num_worker_nodes_1:
    type: integer
    title: "Initial or min Number of Worker Nodes"
    minimum: 1
    maximum: 1000
    required: true
    visible: create_new_oke_cluster

  node_pool_max_num_worker_nodes_1:
    type: integer
    title: "Autoscaler: Maximum number of nodes"
    minimum: 1
    maximum: 1000
    required: true
    visible:
      and:
        - create_new_oke_cluster
        - node_pool_autoscaler_enabled_1

  existent_oke_nodepool_id_for_autoscaler_1:
    type: string
    title: "OKE Nodepool id"
    required: true
    visible:
      and:
        - and:
          - node_pool_autoscaler_enabled_1
        - not:
          - create_new_oke_cluster

  # node_pool_shape:
  #   type: oci:core:instanceshape:name
  #   title: "Select a shape for the Worker Nodes instances"
  #   required: true
  #   dependsOn:
  #     compartmentId: compartment_ocid
  #   visible:
  #     and:
  #       - create_new_oke_cluster

  node_pool_instance_shape_1:
    type: oci:core:instanceshapewithflex:name
    title: "Select a flex or fixed shape for the Worker Nodes instances"
    required: true
    dependsOn:
      compartmentId: compartment_ocid
    visible:
      and:
        - create_new_oke_cluster
        - show_advanced

  # node_pool_node_shape_config_ocpus:
  #   type: integer
  #   minimum: 1
  #   maximum: 64
  #   title: "Number of OCPUs"
  #   visible:
  #     and:
  #       - and:
  #         - create_new_oke_cluster
  #       - or:
  #         - eq:
  #           - node_pool_shape 
  #           - "VM.Standard.E3.Flex"
  #         - eq:
  #           - node_pool_shape 
  #           - "VM.Standard.E4.Flex"
  #         - eq:
  #           - node_pool_shape 
  #           - "VM.Standard.A1.Flex"

  # node_pool_node_shape_config_memory_in_gbs:
  #   type: integer
  #   minimum: 1
  #   maximum: 1024
  #   title: "Amount of memory (GB)"
  #   visible:
  #     and:
  #       - and:
  #         - create_new_oke_cluster
  #       - or:
  #         - eq:
  #           - node_pool_shape 
  #           - "VM.Standard.E3.Flex"
  #         - eq:
  #           - node_pool_shape 
  #           - "VM.Standard.E4.Flex"
  #         - eq:
  #           - node_pool_shape 
  #           - "VM.Standard.A1.Flex"

  node_pool_name_1:
    type: string
    title: "Node Pool Name"
    required: true
    visible:
      and:
        - create_new_oke_cluster
        - show_advanced

  node_pool_cni_type_1:
    type: enum
    title: "Cluster (and Node Pool) CNI Type"
    enum:
      - "FLANNEL_OVERLAY"
      - "OCI_VCN_IP_NATIVE"
    required: true
    visible:
      and:
        - create_new_oke_cluster
        - show_advanced

  cluster_options_add_ons_is_kubernetes_dashboard_enabled:
    type: boolean
    title: "Kubernetes Dashboard Enabled"
    visible: false

  generate_public_ssh_key:
    type: boolean
    title: "Auto generate public ssh key?"
    required: true
    visible:
      and:
        - create_new_oke_cluster
        - show_advanced

  public_ssh_key:
    type: oci:core:ssh:publickey
    title: "Import your own SSH public key"
    additionalProps:
      allowMultiple: true
    required: false
    pattern: "((^(ssh-rsa AAAAB3NzaC1yc2|ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNT|ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzOD|ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1Mj|ssh-ed25519 AAAAC3NzaC1lZDI1NTE5|ssh-dss AAAAB3NzaC1kc3)[0-9A-Za-z+\/]+[=]{0,3})( [^,]*)?)(,((ssh-rsa AAAAB3NzaC1yc2|ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNT|ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzOD|ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1Mj|ssh-ed25519 AAAAC3NzaC1lZDI1NTE5|ssh-dss AAAAB3NzaC1kc3)[0-9A-Za-z+\/]+[=]{0,3})( [^,]*)?)*$"
    visible:
      and:
        - and:
          - create_new_oke_cluster
          - show_advanced
        - not:
          - generate_public_ssh_key

  image_operating_system_1:
    type: enum
    title: "Image OS"
    enum:
      - "Oracle Linux"
    required: true
    visible:
      and:
        - create_new_oke_cluster
        - show_advanced

  image_operating_system_version_1:
    type: string
    title: "Image OS Version"
    required: true
    visible:
      and:
        - create_new_oke_cluster
        - show_advanced

  # Dynamic Groups and Policies for Instance Principals and Autoscaler
  create_dynamic_group_for_nodes_in_compartment:
    type: boolean
    title: "Create Dynamic Group for Worker Nodes in the Compartment"
    required: true
    visible:
      and:
        - show_advanced

  existent_dynamic_group_for_nodes_in_compartment:
    type: string
    title: "Existent Dynamic Group"
    required: true
    visible:
      and:
        - and:
          - show_advanced
        - or:
          - create_compartment_policies
        - not:
          - create_dynamic_group_for_nodes_in_compartment

  create_compartment_policies:
    type: boolean
    title: "Create Compartment Policies"
    required: true
    visible:
      and:
        - show_advanced

  # Encryption options
  use_encryption_from_oci_vault:
    type: boolean
    title: "Encrypt using Customer-Managed Encryption Keys instead of OracleManaged Encryption Keys"
    visible:
      and:
        - create_new_oke_cluster
        - show_advanced

  create_new_encryption_key:
    type: boolean
    title: "Create new Vault and Key"
    visible:
      and:
        - create_new_oke_cluster
        - show_advanced
        - use_encryption_from_oci_vault

  existent_encryption_key_vault:
    type: oci:kms:vault:id
    title: "Existent Encryption Key Vault"
    required: true
    dependsOn:
      compartmentId: compartment_ocid
    visible:
      and:
        - and:
          - create_new_oke_cluster
          - show_advanced
          - use_encryption_from_oci_vault
        - not:
          - create_new_encryption_key

  existent_encryption_key_id:
    type: oci:kms:key:id
    title: "Existent Encryption Key OCID"
    required: true
    dependsOn:
      compartmentId: compartment_ocid
      vaultId: existent_encryption_key_vault
    visible:
      and:
        - and:
          - create_new_oke_cluster
          - show_advanced
          - use_encryption_from_oci_vault
        - not:
          - create_new_encryption_key

  create_vault_policies_for_group:
    type: boolean
    title: "Create policies for the user group to manage vault and keys"
    visible:
      and:
        - create_new_oke_cluster
        - show_advanced
        - use_encryption_from_oci_vault
        - create_new_encryption_key

  user_admin_group_for_vault_policy:
    type: string
    title: "Specify your group to include the policy"
    visible:
      and:
        - create_new_oke_cluster
        - show_advanced
        - use_encryption_from_oci_vault
        - create_new_encryption_key
        - create_vault_policies_for_group

  # Cluster Tools - Ingress
  ingress_nginx_enabled:
    type: boolean
    title: "Ingress NGINX Controller"

  ingress_load_balancer_shape:
    type: enum
    enum:
    - "flexible"
    - "10Mbps"
    - "100Mbps"
    - "400Mbps"
    - "8000Mbps"
    title: "Select a shape for the load balancer created by the Ingress Controller"
    visible:
      and:
        - show_advanced
        - ingress_nginx_enabled

  ingress_load_balancer_shape_flex_min:
    type: integer
    minimum: 10
    maximum: 8000
    title: "Choose the minimum bandwidth"
    required: true
    visible:
      and:
        - and:
          - show_advanced
          - ingress_nginx_enabled
        - eq:
          - ingress_load_balancer_shape
          - "flexible"

  ingress_load_balancer_shape_flex_max:
    type: integer
    minimum: 10
    maximum: 8000
    title: "Choose the maximum bandwidth"
    required: true
    visible:
      and:
        - and:
          - show_advanced
          - ingress_nginx_enabled
        - eq:
          - ingress_load_balancer_shape
          - "flexible"

  ingress_hosts_include_nip_io:
    type: boolean
    title: "Optional dynamic DNS valid domain name?"
    visible:
      and:
        - ingress_nginx_enabled

  use_custom_nip_io_domain:
    type: boolean
    title: "Use custom nip.io domain suffix?"
    description: If you want to use a custom nip.io domain suffix, you must first deploy a nip.io service with a custom domain.
    default: false
    visible:
      and:
        - show_advanced
        - ingress_nginx_enabled
        - ingress_hosts_include_nip_io

  nip_io_domain:
    type: string
    title: "Dynamic wildcard DNS service domain"
    visible:
      and:
        - show_advanced
        - ingress_nginx_enabled
        - ingress_hosts_include_nip_io
        - use_custom_nip_io_domain

  ingress_hosts:
    type: string
    title: "Optional valid domain name"
    visible:
      and:
        - show_advanced
        - ingress_nginx_enabled

  cert_manager_enabled:
    type: boolean
    title: "Certificate Management"
    visible:
      and:
        - ingress_nginx_enabled

  ingress_tls:
    type: boolean
    title: "Use TLS to enable HTTPS on the valid domain name"
    visible:
      and:
        - show_advanced
        - ingress_nginx_enabled
        - cert_manager_enabled

  ingress_cluster_issuer:
    type: enum
    enum:
    - "letsencrypt-prod"
    - "letsencrypt-staging"
    - "selfsigned"
    title: "Certificate Issuer"
    required: true
    visible:
      and:
        - show_advanced
        - ingress_nginx_enabled
        - ingress_tls
        - cert_manager_enabled

  ingress_email_issuer:
    type: string
    title: "Certificate Issuer Email"
    required: true
    visible:
      and:
        - show_advanced
        - ingress_nginx_enabled
        - ingress_tls
        - cert_manager_enabled

  # Cluster Tools
  metrics_server_enabled:
    type: boolean
    title: "Metrics Server"

  prometheus_enabled:
    type: boolean
    title: "Prometheus"

  grafana_enabled:
    type: boolean
    title: "Grafana"

  tag_values:
    type: oci:identity:tag:value
    title: Tag Resources
    required: false
    visible: show_advanced
    dependsOn:
      compartmentId: compartment_ocid

outputGroups:
  - title: Deployment Info
    outputs:
      - deploy_id
      - deployed_to_region
      - stack_version

  - title: Kubernetes
    outputs:
      - deployed_oke_kubernetes_version
      - kubeconfig

  - title: Passwords and Keys
    outputs:
      - grafana_admin_password
      - generated_private_key_pem

  - title: Comments
    outputs:
      - comments

  - title: Dev Notes
    outputs:
      - dev

outputs:
  external_ip:
    type: string
    title: Ingress LoadBalancer External IP
    displayText: Ingress Nginx LoadBalancer External IP Address
    visible: true

  grafana_url:
    type: link
    title: Grafana
    displayText: Dashboards
    visible: true

  grafana_admin_password:
    type: string
    title: Grafana Admin Password
    displayText: Grafana Admin Password
    visible: true

  deploy_id:
    type: string
    title: "Deployment Id"
    visible: true

  deployed_to_region:
    type: string
    title: "Deployed using Region"
    visible: true

  deployed_oke_kubernetes_version:
    type: string
    title: "OKE Kubernetes version deployed"
    visible: true

  stack_version:
    type: string
    title: Stack Version
    displayText: Stack Version deployed
    visible: true

  generated_private_key_pem:
    type: string
    title: Generated Private Key
    displayText: Generated Private Key

  comments:
    type: string
    title: Comments
    displayText: Comments
    visible: true

  dev:
    type: string
    title: dev
    displayText: dev note from Oracle Developers
    visible: true

  kubeconfig:
    type: string
    title: kubeconfig
    displayText: kubeconfig for local kubectl run. Not used by ORM
    visible: true

  kubeconfig_for_kubectl:
    type: string
    title: kubeconfig
    displayText: kubeconfig for local kubectl run. Not used by ORM
    visible: false

  sensitive_comments_local_tf:
    type: string
    title: kubeconfig
    displayText: Instructions to get sensitive outputs on local Terraform. Not used by ORM
    visible: false

primaryOutputButton: mushop_url_button