Podman requirements
Podman in beta
Note: Running Terraform Enterprise on Podman is still in beta. You should not deploy beta features in production environments! Provision a dedicated test environment before installing Terraform Enterprise on Podman. If you have questions or feedback about the Podman beta, contact your HashiCorp account representative.You must meet the following requirements before installing Terraform Enterprise on Podman.
Versions
Install the following software and versions:
- A Podman version greater than or equal to v4.3.0.
- Red Hat Enterprise Linux 8 or 9
Container tools
For Red Hat Enterprise Linux (RHEL) operating systems, you must download the container-tools
package since it includes packages
that you'll need including Podman, Buildah, and Skopeo.
For RHEL 8, you can download all dependencies with the following commands. Note that you must also download
the podman-docker
package to have access to the Docker socket.
For RHEL 9, you can download all dependencies with this single command:
Enable the Podman socket
Set up Podman’s docker-compatible REST API that runs as a systemd
socket-activated service:
Learn more about enabling the Podman API for RHEL 8 or RHEL 9.
SELinux
We recommend adding type: spc_t
to the Kubernetes pod specification's security context when using volumes
for an unprivileged Podman container on an SELinux-enabled system. This ensures the correct permissions
are in place to access the volume when the pod/container is created.
Set the security context in the kube.yaml
:
HTTP/S Ports
Because Podman does not expose privileged ports, ensure that you set the following environment variables and ports in the Kubernetes pod specification.
Set these environment variables in the kube.yaml
:
Set these ports in the kube.yaml
:
Terraform Enterprise requirements
You meet the shared requirements for all Flexible deployment methods.
A DNS hostname for accessing Terraform Enterprise.
Note: For exisiting Terraform Enterprise users with Replicated deployments, refer to Migrating to Flexible Deployment Options.
TLS certificate
You need three TLS certificate files:
cert.pem
- The end-entity certificate for your DNS hostname with any intermediate certificates appended to it.key.pem
- The private key for the end-entity certificate. Must not be protected by a passphrase.bundle.pem
- Additional certificates to be added to the Certificate Authority (CA) bundle.
If you’re using a certificate from Let’s Encrypt, those file names map to the following Terraform Enterprise files:
Terraform Enterprise | Let’s Encrypt |
---|---|
key.pem | privkey.pem |
cert.pem | fullchain.pem |
bundle.pem | fullchain.pem |
If you do not have a certificate, you can generate a self-signed one. Use the
-nodes
option in your command since Terraform Enterprise cannot
use a private key that is protected by a passphrase.
Be sure to replace <terraform.example.com>
with the hostname you use
to access Terraform Enterprise.
When done, you’ll have your cert.pem
and key.pem
files but no bundle.pem
file.
Create your bundle.pem
like so: