Oracle Enterprise Landing Zone v2 - Workload Expansion Configuration
This information describes the required and available configurations needed to deploy an Oracle Enterprise Landing Zone (OELZ) v2 Workload Expansion in Oracle Cloud Infrastructure (OCI).
Prerequisites
The OELZ stack should be fully deployed in the OCI tenancy.
Minimum Required Configuration
Deployment of the OELZ is controlled by several Terraform input variables, however most of these have sensible default values. The following information describes the minimum required configurations to deploy an OELZ workload expansion.
Basic Terraform Connection Information
The following information lists the required provider variables for the OELZ.
| Name | Description | Type | Default | Required |
|---|---|---|---|---|
| input_current_user_ocid | ID of the user to deploy OELZ | string | "" | Yes |
| input_api_fingerprint | API fingerprint retrieved from the Console | string | "" | Yes |
| input_api_private_key_path | Local path to the API private key | string | "" | Yes |
| input_tenancy_ocid | ID of tenancy | string | n/a | Yes |
| input_region | OCI region to deploy the OELZ resources to | string | n/a | Yes |
Compartment Module
The following diagram shows the compartments for OELZ deployment of the workload expansion.
The following information provides the required arguments for the OELZ workload compartment.
| Name | Description | Type | Default | Required |
|---|---|---|---|---|
| input_enable_compartment_delete | Set to true to allow the compartments to be deleted on Terraform destroy. | bool | true | Yes |
| workload_compartment_name | Name of the workload compartment under which all workload resources are deployed. | string | "OCI-ELZ-Workload1-[Region]-01" | Yes |
| environment_compartment_id | Name of the parent compartment where the workload compartment is created. | string | "OCID Value" | Yes |
| workload_expansion_flag | Flag to enable workload expansion. | bool | true | Yes |
| environment_prefix | Unique prefix for the environment created in the baseline stack (such as N, P). | string | Yes |
Network Module
The following information provides the required arguments for the OELZ workload network.
OELZ Workload Spoke VCN Related Variables
| Name | Description | Type | Default | Required |
|---|---|---|---|---|
| workload_prefix | Workload prefix | string | "WRK1" | Yes |
| vcn_display_name | Workload spoke VCN display name | string | "OCI-ELZ-${var.workload_prefix}-EXP-SPK-VCN-${local.region_key[0]}" | No |
| workload_spoke_vcn_cidr | Workload spoke VCN IPv4 CIDR block | string | Yes | |
| vcn_dns_label | Workload spoke VCN DNS label | string | "wrkspokevcn" | Yes |
OELZ Workload Spoke VCN Subnet Related Variables
| Name | Description | Type | Default | Required |
|---|---|---|---|---|
| workload_private_spoke_subnet_web_display_name | Workload spoke VCN web subnet display name | string | "OCI-ELZ-${var.workload_prefix}-EXP-SPK-VCN-SUB-${local.region_key[0]}-001" | No |
| workload_private_spoke_subnet_app_display_name | Workload spoke VCN app subnet display name | string | "OCI-ELZ-${var.workload_prefix}-EXP-SPK-VCN-SUB-${local.region_key[0]}-002" | No |
| workload_private_spoke_subnet_db_display_name | Workload spoke VCN DB subnet display name | string | "OCI-ELZ-${var.workload_prefix}-EXP-SPK-VCN-SUB-${local.region_key[0]}-003" | No |
| workload_private_spoke_subnet_web_cidr_block | Workload spoke VCN web subnet CIDR block | string | ""(Valid IPv4 Address) | Yes |
| workload_private_spoke_subnet_app_cidr_block | Workload spoke VCN app subnet CIDR block | string | ""(Valid IPv4 Address) | Yes |
| workload_private_spoke_subnet_db_cidr_block | Workload spoke VCN DB subnet CIDR block | string | ""(Valid IPv4 Address) | Yes |
| workload_private_spoke_subnet_web_dns_label | Workload spoke VCN web subnet DNS label | string | "wrkweblabel" | Yes |
| workload_private_spoke_subnet_app_dns_label | Workload spoke VCN app subnet DNS label | string | "wrkapplabel" | Yes |
| workload_private_spoke_subnet_db_dns_label | Workload spoke VCN DB subnet DNS label | string | "wrkdblabel" | Yes |
OELZ Workload Spoke VCN Gateway Related Variables
| Name | Description | Type | Default | Required |
|---|---|---|---|---|
| enable_nat_gateway_spoke | Enable NAT gateway in spoke | bool | false | Yes |
| nat_gateway_display_name | Workload spoke VCN NAT gateway display name | string | "OCI-ELZ-${var.workload_prefix}-EXP-SPK-NAT-${local.region_key[0]}" | No |
| enable_service_gateway_spoke | Enable service gateway in spoke | bool | false | Yes |
| service_gateway_display_name | Workload spoke VCN service gateway display name | string | "OCI-ELZ-${var.workload_prefix}-EXP-SPK-SGW-${local.region_key[0]}" | No |
OELZ Workload Spoke VCN Route Table and Security List Related Variables
| Name | Description | Type | Default | Required |
|---|---|---|---|---|
| hub_public_subnet_cidr_block | Hub public subnet IPv4 CIDR block | string | ""(Valid IPv4 CIDR Block) | Yes |
| hub_private_subnet_cidr_block | Hub private subnet IPv4 CIDR block | string | ""(Valid IPv4 CIDR Block) | Yes |
IAM
The following information provides the required arguments for workload expansion identity and access management (IAM).
| Name | Description | Type | Default | Required |
|---|---|---|---|---|
| workload_admin_group_name | Workload Admin Group name | string | "OCI-ELZ-UGP-[workload_prefix]-WRK-ADMIN" | Yes |
| application_admin_group_name | Workload Application Admin Group name | string | "OCI-ELZ-UGP-[workload_prefix]-APP-ADMIN" | Yes |
| database_admin_group_name | Workload DB Admin Group name | string | "OCI-ELZ-UGP-[workload_prefix]-DB-ADMIN" | Yes |
Policy
The following information provides the required arguments for workload expansion policy.
| Name | Description | Type | Default | Required |
|---|---|---|---|---|
| security_compartment_name | Security compartment name | string | "" | Yes |
| security_compartment_ocid | Security compartment Oracle Cloud Identifier (OCID) | string | "" | Yes |
| identity_domain_name | Identity domain name | string | "" | Yes |
| identity_domain_id | Identity domain OCID | string | "" | Yes |
Monitoring
The following information provides the configuration options for workload monitoring.
| Name | Description | Type | Default | Required |
|---|---|---|---|---|
| input_workload_topic_endpoints | List of email addresses for workload notifications | list(string) | [] | No |
| input_workload_name | Prefix to avoid name conflicts in topic | string | W | No |
| input_enable_network_monitoring_alarms | Enable network alarm in workload expansion | bool | false | No |
| input_enable_security_monitoring_alarms | Enable security alarm in workload expansion | bool | false | No |
| input_enable_workload_monitoring_alarms | Enable workload alarm in workload expansion | bool | false | No |