Kubernetes and OpenShift (Beta) requirements
OpenShift Beta
Terraform Enterprise operating on Red Hat OpenShift is still in beta. Do not deploy beta features in production environments. Provision a dedicated test environment before installing Terraform Enterprise on OpenShift. If you have questions or feedback about the OpenShift beta, contact your HashiCorp account representative. Refer toOperate on Red Hat OpenShift for additional information.We recommend that developers have a deep understanding of Kubernetes or OpenShift before deploying Terraform Enterprise to a production environment.
Kubernetes and OpenShift deployments have different operational and observability considerations than Replicated- and Docker-based deployments. External service dependencies should be deployed outside the cluster and scale reliably to accommodate Terraform Enterprise workloads.
External services
Terraform Enterprise requires the following external services to install on Kubernetes or OpenShift:
- PostgreSQL
- Blob Storage (AWS S3, Azure Cloud Storage, Google Cloud Storage, or any S3-compatible storage service)
- Redis version 6 or 7 (Redis Cluster and Redis Sentinel are not currently supported)
Runtime
Terraform Enterprise requires the following to deploy in a Kubernetes or OpenShift runtime:
- A hostname for Terraform Enterprise
- A valid TLS certificate and private key provisioned and matching the hostname selected in
pem
format - License as the password for Terraform Enterprise FDO container registry:
images.releases.hashicorp.com
- Install the Helm CLI version 3.0 or above. Learn more about Helm.
Network
Refer to the Network requirements
Configuration
You must create a custom values file (e.g., /tmp/overrides.yaml
) to override the default values in the terraform-enterprise
helm chart. Refer to Application configuration for a full list of customizable settings.
OpenShift requirements
The OpenShift default restricted security context constraints
require that containers run under a unique user ID. There is no exception to these security constraints for tfc-agent
. To plan and apply workspaces
in Terraform Enterprise on OpenShift , you need a custom tfc-agent
image that creates the default working directory for
tfc-agent
and assigns permissions to the root group.
Place your custom tfc-agent
image in a container registry accessible from the OpenShift nodes that will host Terraform Enterprise. Custom tfc-agent
sourced images cannot use automatic CA certificate injection, and you may need to add CA certificate injection configuration to the Dockerfile below.
Enterprise. Automatic CA certificate injection is not available when a custom image source is used for the tfc-agent
image and may be required as an additional configuration in this Dockerfile. Use the following settings to configure
Terraform Enterprise to use this image.
Example configurations
The below examples for each cloud-platform are based on cloud native hosted PostgreSQL, storage, or Redis cache services. Please customize the values in angle brackets before using these examples for you configuration.
The following is true for all of the below YAML examples:
- Values under
.env.variables
are set as aConfigMap
and mounted as Terraform Enterprise environment variables. - Values under
.env.secrets
are set as Kubernetes secrets and mounted as Terraform Enterprise environment variables. - Extend the
env.configMapRefs[]
orenv.secretRefs[]
with your own resources to add additionalConfigMap
orSecret
resources within your environment configuration.
Note: In the below examples, any values marked BASE_64_ENCODED*
indicates that the value given must be base 64 encoded. If you are using this certificate configuration to host Terraform Enterprise web traffic, this value must be valid with the env.TFE_HOSTNAME
, or match the wildcard pattern.
AWS Elastic Kubernetes Service (EKS)
Below is an example configuration for AWS Elastic Kubernetes Services.
Google Kubernetes Engine (GKE)
Below is an example configuration for Google Kubernetes Engine.
Azure Kubernetes Service (AKS)
Below is an example configuration for Azure Kubernetes Service.
OpenShift in Azure with hosted external services
Below is an example configuration for an OpenShift environment hosted in Microsoft Azure.
Enabling OpenShift (beta)
To deploy Terraform Enterprise on OpenShift, you'll need to set the Values.openshift.enabled
option to true.
Below are additional reference materials for setting up these value files:
- Terraform Enterprise Helm repository
- Tag (release version)
- Generic reference for values file to override the default values in the helm chart.
Follow the Kubernetes installation guide to install Terraform Enterprise application using helm.
Security context configuration
Modify the .securityContext
helm chart value to set pod security configuration for Terraform Enterprise Flexible Deployment Options. Modify the .container.securityContext
helm chart value to set the container security configuration. The allowPrivilegeEscalation
container security context option must be omitted or set to true
in order for Terraform Enterprise to function properly.