variables-cluster.tf

# Copyright (c) 2017, 2023 Oracle Corporation and/or its affiliates.
# Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl

variable "create_cluster" {
  default     = true
  description = "Whether to create the OKE cluster and dependent resources."
  type        = bool
}

variable "cluster_name" {
  default     = "oke"
  description = "The name of oke cluster."
  type        = string
}

variable "cluster_type" {
  default     = "basic"
  description = "The cluster type. See <a href=https://docs.oracle.com/en-us/iaas/Content/ContEng/Tasks/contengworkingwithenhancedclusters.htm>Working with Enhanced Clusters and Basic Clusters</a> for more information."
  type        = string
  validation {
    condition     = contains(["basic", "enhanced"], lower(var.cluster_type))
    error_message = "Accepted values are 'basic' or 'enhanced'."
  }
}

variable "control_plane_is_public" {
  default     = false
  description = "Whether the Kubernetes control plane endpoint should be allocated a public IP address to enable access over public internet."
  type        = bool
}

variable "assign_public_ip_to_control_plane" {
  default     = false
  description = "Whether to assign a public IP address to the API endpoint for public access. Requires the control plane subnet to be public to assign a public IP address."
  type        = bool
}

variable "control_plane_nsg_ids" {
  default     = []
  description = "An additional list of network security groups (NSG) ids for the cluster endpoint."
  type        = set(string)
}

variable "backend_nsg_ids" {
  default     = []
  description = "An additional list of network security groups (NSG) ids for the LB backends. Used when the service rule management mode is set to NSG via annotations. See <a href=https://docs.oracle.com/en-us/iaas/Content/ContEng/Tasks/contengconfiguringloadbalancersnetworkloadbalancers-subtopic.htm#contengcreatingloadbalancer_topic-Specifying_Load_Balancer_Security_Rule_Management_Options>Security Rule Management Options for Load Balancers and Network Load Balancers</a> for more information."
  type        = set(string)
}

variable "cni_type" {
  default     = "flannel"
  description = "The CNI for the cluster: 'flannel' or 'npn'. See <a href=https://docs.oracle.com/en-us/iaas/Content/ContEng/Concepts/contengpodnetworking.htm>Pod Networking</a>."
  type        = string
  validation {
    condition     = contains(["flannel", "npn"], var.cni_type)
    error_message = "Accepted values are flannel or npn"
  }
}

variable "enable_ipv6" {
  default     = false
  description = "Deprecated compatibility alias for enable_dual_stack_defaults."
  type        = bool
}

variable "enable_dual_stack_defaults" {
  default     = false
  description = "Whether to apply default settings for a dual-stack (IPv4/IPv6) cluster and network."
  type        = bool
}

variable "oke_ip_families" {
  default     = []
  type        = list(string)
  description = "Override the ip_families attribute for the OKE cluster. Supported values: ['IPv4'] or ['IPv4', 'IPv6'] or ['IPv6']"

  validation {
    condition = length(var.oke_ip_families) == 0 || (
      length(var.oke_ip_families) <= 2 &&
      alltrue([
        for family in var.oke_ip_families : contains(["IPv4", "IPv6"], family)
      ])
    )
    error_message = "Accepted values are 'IPv4', 'IPv6', or a combination of both. Example: ['IPv4'] or ['IPv4', 'IPv6'] or ['IPv6']."
  }

  validation {
    condition     = length(var.oke_ip_families) == length(distinct(var.oke_ip_families))
    error_message = "Duplicate values are not allowed in oke_ip_families."
  }
}

variable "pods_cidr" {
  default     = "10.244.0.0/16"
  description = "The CIDR range used for IP addresses by the pods. A /16 CIDR is generally sufficient. This CIDR should not overlap with any subnet range in the VCN (it can also be outside the VCN CIDR range). Ignored when cni_type = 'npn'."
  type        = string
}

variable "services_cidr" {
  default     = "10.96.0.0/16"
  description = "The CIDR range used within the cluster by Kubernetes services (ClusterIPs). This CIDR should not overlap with the VCN CIDR range."
  type        = string
}

variable "kubernetes_version" {
  default     = "v1.34.2"
  description = "The version of kubernetes to use when provisioning OKE or to upgrade an existing OKE cluster to."
  type        = string
}

variable "cluster_kms_key_id" {
  default     = ""
  description = "The id of the OCI KMS key to be used as the master encryption key for Kubernetes secrets encryption."
  type        = string
}

variable "use_signed_images" {
  default     = false
  description = "Whether to enforce the use of signed images. If set to true, at least 1 RSA key must be provided through image_signing_keys."
  type        = bool
}

variable "image_signing_keys" {
  default     = []
  description = "A list of KMS key ids used by the worker nodes to verify signed images. The keys must use RSA algorithm."
  type        = set(string)
}

variable "load_balancers" {
  default     = "both"
  description = "The type of subnets to create for load balancers."
  type        = string
  validation {
    condition     = contains(["public", "internal", "both"], var.load_balancers)
    error_message = "Accepted values are public, internal or both."
  }
}

variable "preferred_load_balancer" {
  default     = "public"
  description = "The preferred load balancer subnets that OKE will automatically choose when creating a load balancer. Valid values are 'public' or 'internal'. If 'public' is chosen, the value for load_balancers must be either 'public' or 'both'. If 'private' is chosen, the value for load_balancers must be either 'internal' or 'both'. NOTE: Service annotations for internal load balancers must still be specified regardless of this setting. See <a href=https://github.com/oracle/oci-cloud-controller-manager/blob/master/docs/load-balancer-annotations.md>Load Balancer Annotations</a> for more information."
  type        = string
  validation {
    condition     = contains(["public", "internal"], var.preferred_load_balancer)
    error_message = "Accepted values are public or internal."
  }
}

variable "oidc_discovery_enabled" {
  default     = false
  description = "Whether the cluster has OIDC Discovery enabled. See <a href=https://docs.oracle.com/en-us/iaas/Content/ContEng/Tasks/contengOpenIDConnect-Discovery.htm>OIDC Discovery configuration documentation</a>."
  type        = bool
}

variable "oidc_token_auth_enabled" {
  default     = false
  description = "Whether the cluster has OIDC Auth Config enabled."
  type        = bool
}

variable "oidc_token_authentication_config" {
  default     = {}
  description = "The properties that configure OIDC token authentication in kube-apiserver. See <a href=https://docs.oracle.com/en-us/iaas/Content/ContEng/Tasks/contengOpenIDConnect-Authentication.htm>OIDC Token Authentication configuration documentation</a>."
  type        = any
}