Requirements

This guide covers deploying a standalone LogScale cluster on OKE (dr=""). The deployment provisions a single cluster with no DR infrastructure.

Prerequisites

Software Requirements:

Software Minimum VersionPurpose
Terraform>= 1.12.2Infrastructure provisioning
kubectl>= 1.28Kubernetes cluster management
OCI CLILatestOCI authentication and management
jqLatestJSON processing for verification scripts

Terraform Providers (installed automatically by terraform init):

Software Minimum VersionPurpose
oci (oracle/oci)~> 8.1.0OCI Resource Manager resources
kubernetes>= 2.36.0Kubernetes resources (namespaces, secrets)
helm>= 2.13.2, < 3.0.0Helm chart deployments (Falcon LogScale Collector, operators)
random>= 3.7.0Random name prefixes, encryption key generation
local>= 2.4.0Local file generation (kubeconfig)
null>= 3.2.0Provisioners for Docker build/push
time>= 0.9.1Time-based resource management
cloudinit>= 2.2.0Cloud-init configuration for worker nodes

OCI Account Requirements

  • OCI tenancy with billing enabled

  • Access to one or more OCI regions (e.g., us-chicago-1 and us-ashburn-1)

  • Compartment created for LogScale resources

  • OCI API key authentication configured (key file + fingerprint + tenancy OCID + user OCID)

IAM Permissions

The following OCI IAM policies are required for the deploying user/service principal:

PolicyPurpose
manage clusters in compartmentOKE cluster creation and management
manage node-pools in compartmentNode pool lifecycle management
manage virtual-network-family in compartmentVCN, subnets, NSGs, NAT Gateway
manage object-family in compartmentObject Storage buckets, S3 credentials
manage bastion-family in compartmentOCI Bastion Service for private cluster access

Infrastructure Prerequisites

The following infrastructure is created automatically by module.oci-core during deployment:

  • Virtual Cloud Network (VCN) with dedicated subnets per availability domain

  • Network Security Groups (NSGs) for API endpoint, worker nodes, and load balancer

  • Internet Gateway for public subnet routing (load balancer)

  • NAT Gateway for outbound internet access from private worker nodes

  • Service Gateway for access to OCI services without traversing the internet

  • Bastion subnet (when provision_bastion = true)

  • Cluster endpoint subnet and load balancer subnet

User action required before deployment:

  • SSL/TLS certificates available, or plan to use cert-manager (deployed automatically by module.logscale). When public_lb_cidrs restricts access, DNS-01 validation via module.cert-manager-oci-webhook is required

  • OCI worker node image OCID (worker_image_id) for your chosen region. Find the latest Oracle Linux image:

shell
oci compute image list --compartment-id <compartment-ocid> \
 --operating-system "Oracle Linux" --shape "VM.Standard.E4.Flex" \
 --sort-by TIMECREATED --sort-order DESC --limit 5 \
 --query 'data[].{Name:"display-name",OCID:id}' --output table

SSH key pair generated for bastion and worker node access (ssh_public_key_path, ssh_private_key_path)

Object Storage Bucket Naming Convention

Bucket names are derived deterministically from cluster_name via locals.tf:

  • Pattern: ${cluster_name}-logscale-data

  • The resource_name_prefix local is set to var.cluster_name

ClusterBucket Name Example
Standalone (cluster_name = "logscale-prod")logscale-prod-logscale-data

The bucket name is exported as a Terraform output (storage_bucket_name) and is intended to be consumed via terraform_remote_state. The namespace is auto-discovered from the tenancy via data.oci_objectstorage_namespace.this.

Pre-Deployment Checklist

  • Terraform backend (OCI Object Storage state bucket) accessible

  • OCI identity and backend reachability confirmed:

shell
oci iam user get --user-id $OCI_USER_OCID
oci os ns get
terraform version

  • Worker node image OCID (worker_image_id) identified for the target region

  • SSH key pair generated and paths configured (ssh_public_key_path, ssh_private_key_path)