add support for standalone operator policy

module-operator.tf

@@ -54,29 +54,32 @@ module "operator" {
  bastion_user = var.bastion_user
 
  # Operator
- assign_dns = var.assign_dns
- availability_domain = coalesce(var.operator_availability_domain, lookup(local.ad_numbers_to_names, local.ad_numbers[0]))
- cloud_init = var.operator_cloud_init
- image_id = local.operator_image_id
- install_cilium = var.cilium_install
- install_helm = var.operator_install_helm
- install_istioctl = var.operator_install_istioctl
- install_k9s = var.operator_install_k9s
- install_kubectx = var.operator_install_kubectx
- install_kubectl_from_repo = var.operator_install_kubectl_from_repo
- kubeconfig = yamlencode(local.kubeconfig_private)
- kubernetes_version = var.kubernetes_version
- nsg_ids = compact(flatten([var.operator_nsg_ids, try(module.network.operator_nsg_id, null)]))
- operator_image_os_version = var.operator_image_os_version
- pv_transit_encryption = var.operator_pv_transit_encryption
- shape = var.operator_shape
- ssh_private_key = sensitive(local.ssh_private_key) # to await cloud-init completion
- ssh_public_key = local.ssh_public_key
- subnet_id = try(module.network.operator_subnet_id, "") # safe destroy; validated in submodule
- timezone = var.timezone
- upgrade = var.operator_upgrade
- user = var.operator_user
- volume_kms_key_id = var.operator_volume_kms_key_id
+ assign_dns = var.assign_dns
+ availability_domain = coalesce(var.operator_availability_domain, lookup(local.ad_numbers_to_names, local.ad_numbers[0]))
+ cloud_init = var.operator_cloud_init
+ create_cluster = var.create_cluster
+ create_operator_policy_to_manage_cluster = var.create_operator_policy_to_manage_cluster
+ cluster_id = one(module.cluster[*].cluster_id)
+ image_id = local.operator_image_id
+ install_cilium = var.cilium_install
+ install_helm = var.operator_install_helm
+ install_istioctl = var.operator_install_istioctl
+ install_k9s = var.operator_install_k9s
+ install_kubectx = var.operator_install_kubectx
+ install_kubectl_from_repo = var.operator_install_kubectl_from_repo
+ kubeconfig = yamlencode(local.kubeconfig_private)
+ kubernetes_version = var.kubernetes_version
+ nsg_ids = compact(flatten([var.operator_nsg_ids, try(module.network.operator_nsg_id, null)]))
+ operator_image_os_version = var.operator_image_os_version
+ pv_transit_encryption = var.operator_pv_transit_encryption
+ shape = var.operator_shape
+ ssh_private_key = sensitive(local.ssh_private_key) # to await cloud-init completion
+ ssh_public_key = local.ssh_public_key
+ subnet_id = try(module.network.operator_subnet_id, "") # safe destroy; validated in submodule
+ timezone = var.timezone
+ upgrade = var.operator_upgrade
+ user = var.operator_user
+ volume_kms_key_id = var.operator_volume_kms_key_id
 
 
  # Standard tags as defined if enabled for use, or freeform
@@ -95,6 +98,10 @@ module "operator" {
  depends_on = [
  module.iam,
  ]
+
+ providers = {
+ oci.home = oci.home
+ }
 }
 
 output "operator_id" {

modules/operator/iam.tf

@@ -0,0 +1,21 @@
+# Copyright (c) 2022, 2024 Oracle Corporation and/or its affiliates.
+# Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl
+
+
+resource "oci_identity_policy" "operator_policy" {
+ count = var.create_cluster != null && var.create_operator_policy_to_manage_cluster ? 1 : 0
+
+ provider = oci.home
+
+ compartment_id = var.compartment_id
+ description = "Policies for OKE Operator host state ${var.state_id}"
+ name = "oke-operator-${var.state_id}"
+ statements = [
+ "ALLOW any-user to manage cluster-family in compartment id ${var.compartment_id} where all {target.cluster.id = '${var.cluster_id}', request.principal.type = 'instance', request.principal.id = '${oci_core_instance.operator.id}'}"
+ ]
+ defined_tags = var.defined_tags
+ freeform_tags = var.freeform_tags
+ lifecycle {
+ ignore_changes = [defined_tags, freeform_tags]
+ }
+}

modules/operator/variables.tf

@@ -13,12 +13,18 @@ variable "bastion_user" { type = string }
 variable "assign_dns" { type = bool }
 variable "availability_domain" { type = string }
 variable "cloud_init" { type = list(map(string)) }
+variable "cluster_id" { type = string }
+variable "create_cluster" { type = bool }
+variable "create_operator_policy_to_manage_cluster" {
+ type = bool
+ default = false
+}
 variable "image_id" { type = string }
 variable "install_cilium" { type = bool }
 variable "install_helm" { type = bool }
 variable "install_istioctl" { type = bool }
 variable "install_k9s" { type = bool }
-variable "install_kubectl_from_repo" { 
+variable "install_kubectl_from_repo" {
  type = bool
  default = true
 }

modules/operator/versions.tf

@@ -16,8 +16,9 @@ terraform {
  }
 
  oci = {
- source = "oracle/oci"
- version = ">= 4.119.0"
+ configuration_aliases = [oci.home]
+ source = "oracle/oci"
+ version = ">= 4.119.0"
  }
  }
 }

variables-operator.tf

@@ -7,6 +7,12 @@ variable "create_operator" {
  type = bool
 }
 
+variable "create_operator_policy_to_manage_cluster" {
+ default = true
+ description = "Whether to create minimal IAM policy to allow the operator host to manage the cluster."
+ type = bool
+}
+
 variable "operator_availability_domain" {
  default = null
  description = "The availability domain for FSS placement. Defaults to first available."