{"id":23826090,"url":"https://github.com/appuio/terraform-openshift4-exoscale","last_synced_at":"2026-02-19T11:13:30.931Z","repository":{"id":37867155,"uuid":"281104152","full_name":"appuio/terraform-openshift4-exoscale","owner":"appuio","description":"OpenShift 4 Terraform setup for Exoscale","archived":false,"fork":false,"pushed_at":"2026-02-17T12:30:58.000Z","size":271,"stargazers_count":2,"open_issues_count":2,"forks_count":0,"subscribers_count":11,"default_branch":"master","last_synced_at":"2026-02-17T17:56:59.811Z","etag":null,"topics":["appuio","projectsyn","terraform","vshn-project-ocp"],"latest_commit_sha":null,"homepage":"","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/appuio.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"security_groups.tf","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2020-07-20T11:59:53.000Z","updated_at":"2026-02-17T12:30:52.000Z","dependencies_parsed_at":"2023-02-08T12:01:32.437Z","dependency_job_id":"085eacf5-7cc7-4aef-940b-b93c1ae8759d","html_url":"https://github.com/appuio/terraform-openshift4-exoscale","commit_stats":null,"previous_names":[],"tags_count":39,"template":false,"template_full_name":null,"purl":"pkg:github/appuio/terraform-openshift4-exoscale","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/appuio%2Fterraform-openshift4-exoscale","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/appuio%2Fterraform-openshift4-exoscale/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/appuio%2Fterraform-openshift4-exoscale/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/appuio%2Fterraform-openshift4-exoscale/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/appuio","download_url":"https://codeload.github.com/appuio/terraform-openshift4-exoscale/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/appuio%2Fterraform-openshift4-exoscale/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29611012,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-19T10:52:55.328Z","status":"ssl_error","status_checked_at":"2026-02-19T10:52:26.323Z","response_time":117,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["appuio","projectsyn","terraform","vshn-project-ocp"],"created_at":"2025-01-02T12:15:23.234Z","updated_at":"2026-02-19T11:13:30.892Z","avatar_url":"https://github.com/appuio.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# OpenShift 4 on Exoscale\n\n\u003e :warning: **WIP**: This is still a work in progress and will change!\n\nThis repository provides a Terraform module to provision the infrastructure for an OpenShift 4 cluster on Exoscale.\n\nPlease see the [VSHN OCP4 on Exoscale install how-to](https://openshift.docs.vshn.ch/oc4/how-tos/exoscale/install.html) for a step-by-step installation guide.\n\n## Overview\n\nThe Terraform module in this repository provisions all the infrastructure which is required to setup an OpenShift 4 cluster on Exoscale using UPI (User-provisioned infrastructure).\n\nThe module manages the VMs (including their Ignition or cloud-init config), DNS zone and records, security groups, and floating IPs for a highly-available OpenShift 4 cluster.\n\nBy default, the module will provision all the VMs with public IPs (the default on Exoscale), and restricts access to the cluster VMs using Exoscale's security group mechanism.\nOut of the box, all the cluster VMs (which use RedHat CoreOS) are reachable over SSH for debugging purposes using a SSH key which is provided during provisioning.\n\nThe module expects that a suitable RHCOS VM template is available in the Exoscale organisation and region in which the cluster is getting deployed.\n\nThe module also provisions a pair of load balancer VMs.\nThe module uses [vshn-lbaas-exoscale](https://github.com/appuio/terraform-modules/tree/main/modules/vshn-lbaas-exoscale) to provision the LBs.\n\n### Module input variables\n\nThe module provides variables to\n\n* control the instance size of each VM type (LB, bootstrap, master, infra, storage, and worker).\n  Note that we don't officially support smaller instance sizes than the ones provided as defaults.\n* control the count of each VM type (LB, bootstrap, master, infra, storage, and worker).\n  Note that we don't recommend changing the count for the LBs and masters from their default values.\n* control the size of the root partition for all nodes.\n  This value is used for all nodes and cannot be customized for individual node groups.\n* control the size of the empty partition on worker or infra nodes.\n  By default, worker and infra nodes are provisioned without an empty partition (by defaulting the variable to 0)\n  However, users can create worker and infra nodes with an empty partition by providing a positive value for the variable.\n* control the size of the empty partition on the storage nodes.\n  This partition can be used as backing storage by in-cluster storage clusters, such as Rook-Ceph.\n* configure additional worker node groups.\n  This variable is a map from worker group names (used as node prefixes) to objects providing node instance size, node count, node data disk size, and node state.\n* configure additional affinity group IDs which are configured on all master, infra, storage, and worker VMs\n  This allows users to configure pre-existing affinity groups (e.g. for Exoscale dedicated VM hosts) for the cluster\n* configure additional security group IDs which are configured on worker VMs\n  This allows users to configure pre-existing security groups (e.g. for node ports) for the worker nodes\n* specify the cluster's id, name (optional), Exoscale region, base domain, SSH key, RHCOS template, and Ignition API CA.\n* enable PROXY protocol on the LBs for the ingress router.\n* configure additional Exoscale private networks to attach to the LBs.\n  To avoid issues with network interfaces getting assigned arbitrarily, we recommend to only configure additional private networks after the LBs have been provisioned.\n* specify a bootstrap S3 bucket (required only to provision the boostrap node)\n* specify an Exoscale API key and secret for Floaty\n* specify the username for the APPUiO hieradata Git repository (see next sections for details).\n* provide an API token for control.vshn.net (see next sections for details).\n* choose a dedicated deployment target\n  This allows for using dedicated hypervisors.\n* choose to provision Exoscale instance pools for the infra and worker nodes.\n  Note that we currently don't support provisioning Exoscale instance pools for the control plane and storage nodes.\n  By default, we only provision instance pools for the worker nodes.\n  You can selectively enable or disable instance pool provisioning for additional worker groups by setting variable `use_instancepool` for the worker group.\n  If you wish to use an instance pool for the infra nodes, you need to set variable `infra_use_instancepool = true`.\n\nThe cluster's domain is constructed from the provided base domain, cluster id and cluster name.\nIf a cluster name is provided the cluster domain is set to `\u003ccluster name\u003e.\u003cbase domain\u003e`.\nOtherwise the cluster domain is set to `\u003ccluster id\u003e.\u003cbase domain\u003e`.\n\n## Configuring additional worker groups\n\nPlease note that you cannot use names \"master\", \"infra\", \"worker\" or \"storage\" for additional worker groups.\nWe prohibit these names to ensure there are no collisions between the generated nodes names for different worker groups.\n\nAs the examples show, attributes `disk_size`, `state` and `affinity_group_ids` for entries in `additional_worker_groups` are optional.\nIf these attributes are not given, the nodes are deployed with `disk_size = var.root_disk_size`, `state = \"Running\"` and `affinity_group_ids = []`.\n\nTo configure an additional worker group named \"cpu1\" with 3 instances with type \"CPU-huge\" the following input can be given:\n\n```terraform\n# File main.tf\nmodule \"cluster\" {\n  // Remaining config for module omitted\n\n  additional_worker_groups = {\n    \"cpu1\": {\n      size: \"CPU-huge\"\n      count: 3\n    }\n  }\n}\n```\n\nTo configure an additional worker group named \"storage1\" with 3 instances with type \"Storage-huge\", and 5120GB of total disk size (120GB root disk + 5000GB data disk), the following input can be given:\n\n```terraform\n# File main.tf\nmodule \"cluster\" {\n  // Remaining config for module omitted\n\n  additional_worker_groups = {\n    \"storage1\": {\n      size: \"Storage-huge\"\n      count: 3\n      data_disk_size: 5000\n    }\n  }\n}\n```\n\n## Required credentials\n\n* An unrestricted Exoscale API key in the organisation in which the cluster should be deployed\n* An Exoscale API key for Floaty\n  * The minimum required permissions for the Floaty API key are the following \"compute-legacy\" operations: `addIpToNic`, `listNics`, `listResourceDetails`, `listVirtualMachines`, `queryAsyncJobResult` and `removeIpFromNic`.\n* An API token for the Servers API must be created on [control.vshn.net](https://control.vshn.net/tokens/_create/servers)\n* A project access token for the APPUiO hieradata repository must be created on [git.vshn.net](https://git.vshn.net/appuio/appuio_hieradata/-/settings/access_tokens)\n  * The minimum required permissions for the project access token are `api` (to create MRs), `read_repository` (to clone the repo) and `write_repository` (to push to the repo).\n\n## VSHN service dependencies\n\nSince the module manages a VSHN-specific Puppet configuration for the LB VMs, it needs access to some https://www.vshn.ch[VSHN] infrastructure:\n\n* The module makes requests to the control.vshn.net [Servers API](https://control.docs.vshn.ch/control/api_servers.html) to register the LB VMs in VSHN's Puppet enc (external node classifier)\n* The module needs access to the [APPUiO hieradata on git.vshn.net](https://git.vshn.net/appuio/appuio_hieradata) to create the appropriate configuration for the LBs\n\n### Using the module outside VSHN\n\nIf you're interested in a version of the module which doesn't include VSHN-managed LBs, you can check out the standalone MVP LB configuration in commit [172e2a0](https://github.com/appuio/terraform-openshift4-exoscale/commit/172e2a074b6b23e995ba961da0688397a10474bb).\n\n\u003e :warning: Please note that we're not actively developing the MVP LB configuration at the moment.\n\n## Optional features\n\n### Private network\n\n\u003e :warning: This mode is less polished than the default mode and we're currently not actively working on improving this mode.\n\nOptionally, the OpenShift 4 cluster VMs can be provisioned solely in an Exoscale managed private network.\nTo use this variation, set module variable `use_privnet` to `true`.\nIf required, you can change the CIDR of the private network by setting variable `privnet_cidr`.\n\nWhen deploying the RHCOS VMs with a private network only, the VMs **must** first be provisioned in `Stopped` state, and then powered on in a subsequent apply step.\nOtherwise, the initial Ignition config run fails because the Ignition API is not reachable early enough in the boot process, as the network interface is also configured by Ignition in this scenario.\nThis can be achieved by running the following sequence of `terraform apply` steps.\nThe example assumes that the LBs and bootstrap node have been provisioned correctly already and that we're now provisioning the OCP4 master VMs.\n\n```bash\nfor state in \"stopped\" \"running\" \"running\"; do\n  cat \u003eoverride.tf \u003c\u003cEOF\n  module \"cluster\" {\n    bootstrap_count = 1\n    infra_count = 0\n    worker_count = 0\n    master_state = \"${state}\"\n  }\n  terraform apply\ndone\n```\n\nNote: the second `terraform apply` with `state = \"Running\"` may not be required in all cases, but is there as a safeguard if creation of DNS records fails in the first `terraform apply` with `state = \"Running\".\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fappuio%2Fterraform-openshift4-exoscale","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fappuio%2Fterraform-openshift4-exoscale","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fappuio%2Fterraform-openshift4-exoscale/lists"}