templates/openshift-main-existing-vpc.template.yaml [217:627]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  PullSecret:
    Description: >-
      Required for OpenShift v4: The OCP Pull Secret JSON
    Type: String
    NoEcho: 'true'
    Default: xxxxxxxx
  SSHKey:
    Description: The public key to be added to the CoreOS boxes for ssh access.
    Default: ""
    Type: String
  NumberOfAZs:
    Default: 3
    Description: >-
      The number of Availability Zones to be used for the deployment. 3 Availability Zones are needed to avoid
      a single point of failure when using 3 or more master nodes or etcd nodes.
    Type: Number
    AllowedValues:
    - 1
    - 3
  AmiId:
    Description: >-
      OPTIONAL: bring your own AMI. In Enterprise environment, you might
      need to bring your own AMI (with proxy, softwares, ...).
      If the AMI is encrypted, keep in mind that the key policy should allow use of
      the key from AWSServiceRoleForAutoScaling.
      If left blank, we'll use the base RHEL image from your region.
    Type: String
    Default: ""
  AvailabilityZones:
    Description: List of Availability Zones to use for the subnets in the VPC. Three
      Availability Zones are used for this deployment, and the logical order of your
      selections is preserved.
    Type: List<AWS::EC2::AvailabilityZone::Name>
  KeyPairName:
    Description: (OS v3 only. Use SSHKey Parameter for OS v4) The name of an existing public/private key pair, which allows you
      to securely connect to your instance after it launches
    Type: String
    Default: ""
  PrivateSubnet1CIDR:
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$
    ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28
    Default: 10.0.0.0/19
    Description: CIDR block for private subnet 1 located in Availability Zone 1
    Type: String
  PrivateSubnet2CIDR:
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$
    ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28
    Default: 10.0.32.0/19
    Description: CIDR block for private subnet 2 located in Availability Zone 2
    Type: String
  PrivateSubnet3CIDR:
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$
    ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28
    Default: 10.0.64.0/19
    Description: CIDR block for private subnet 2 located in Availability Zone 3
    Type: String
  PublicSubnet1CIDR:
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$
    ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28
    Default: 10.0.128.0/20
    Description: CIDR block for the public (DMZ) subnet 1 located in Availability
      Zone 1
    Type: String
  PublicSubnet2CIDR:
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$
    ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28
    Default: 10.0.144.0/20
    Description: CIDR block for the public (DMZ) subnet 2 located in Availability
      Zone 2
    Type: String
  PublicSubnet3CIDR:
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$
    ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28
    Default: 10.0.160.0/20
    Description: CIDR block for the public (DMZ) subnet 2 located in Availability
      Zone 3
    Type: String
  QSS3BucketName:
    AllowedPattern: ^[0-9a-zA-Z]+([0-9a-zA-Z-]*[0-9a-zA-Z])*$
    ConstraintDescription: Quick Start bucket name can include numbers, lowercase
      letters, uppercase letters, and hyphens (-). It cannot start or end with a hyphen
      (-).
    Default: aws-quickstart
    Description: S3 bucket name for the Quick Start assets. This string can include
      numbers, lowercase letters, uppercase letters, and hyphens (-). It cannot start
      or end with a hyphen (-).
    Type: String
  QSS3KeyPrefix:
    AllowedPattern: ^[0-9a-zA-Z-/.]*$
    ConstraintDescription: Quick Start key prefix can include numbers, lowercase letters,
      uppercase letters, hyphens (-), and forward slash (/).
    Default: quickstart-redhat-openshift/
    Description: S3 key prefix for the Quick Start assets. Quick Start key prefix
      can include numbers, lowercase letters, uppercase letters, hyphens (-), and
      forward slash (/).
    Type: String
  QSS3BucketRegion:
    Default: 'us-east-1'
    Description: The AWS Region where the Quick Start S3 bucket (QSS3BucketName) is
      hosted. When using your own bucket, you must specify this value.
    Type: String
  RemoteAccessCIDR:
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$
    ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/x
    Description: The CIDR IP range that is permitted to access the instances We recommend
      that you set this value to a trusted IP range.
    Type: String
  ContainerAccessCIDR:
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$
    ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/x
    Description: The CIDR IP range that is permitted to access the instances We recommend
      that you set this value to a trusted IP range.
    Type: String
  OpenShiftAdminPassword:
    Description: (Optional for OS v4) Password for OpenShift Admin UI Must be at least 8 and no more than
      12 characters containing letters and (minimum 1 capital letter), numbers and
      symbols
    Type: String
    MinLength: '8'
    AllowedPattern: ^[^ \\']+$
    NoEcho: 'true'
    Default: 'xxxxxxxx'
  OpenshiftContainerPlatformVersion:
    Description: OpenShift version to deploy
    Default: '4.6'
    Type: String
    AllowedValues: [ '4.3', '4.6' ]
  VPCCIDR:
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$
    ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28
    Default: 10.0.0.0/16
    Description: CIDR block for the VPC
    Type: String
  MasterInstanceType:
    Default: m5.xlarge
    Type: String
    AllowedValues:
      - t3.xlarge
      - t3.2xlarge
      - m5.xlarge
      - m5.2xlarge
      - m5.4xlarge
      - m5.8xlarge
      - m5.12xlarge
      - m5a.4xlarge
      - m5a.8xlarge
      - m5a.12xlarge
      - c5.large
      - c5.xlarge
      - c5.2xlarge
      - c5.4xlarge
      - c5.9xlarge
      - c5.12xlarge
      - c5.18xlarge
      - c5.24xlarge
      - c4.2xlarge
      - c4.4xlarge
      - c4.8xlarge
      - m4.xlarge
      - m4.2xlarge
      - m4.4xlarge
      - m4.10xlarge
      - m4.16xlarge
      - r4.xlarge
      - r4.2xlarge
      - r4.4xlarge
      - r4.8xlarge
      - r4.16xlarge
    ConstraintDescription: Must contain valid instance type
    Description: Type of EC2 instance for the Master instances
  NodesInstanceType:
    Default: m5.xlarge
    AllowedValues:
      - t3.xlarge
      - t3.2xlarge
      - m5.large
      - m5.xlarge
      - m5.2xlarge
      - m5.4xlarge
      - m5.8xlarge
      - m5.12xlarge
      - m5a.4xlarge
      - m5a.8xlarge
      - m5a.12xlarge
      - c5.large
      - c5.xlarge
      - c5.2xlarge
      - c5.4xlarge
      - c5.9xlarge
      - c5.12xlarge
      - c5.18xlarge
      - c5.24xlarge
      - c4.large
      - c4.xlarge
      - c4.2xlarge
      - c4.4xlarge
      - c4.8xlarge
      - m4.large
      - m4.xlarge
      - m4.2xlarge
      - m4.4xlarge
      - m4.10xlarge
      - m4.16xlarge
      - r4.large
      - r4.xlarge
      - r4.2xlarge
      - r4.4xlarge
      - r4.8xlarge
      - r4.16xlarge
    ConstraintDescription: Must contain valid instance type
    Description: Type of EC2 instance for the Node instances
    Type: String
  NumberOfMaster:
    Default: '3'
    Description: This Deployment requires at least 3 OpenShift Master instances
    Type: String
    AllowedPattern: '^[3579]$|(^[1-9]+[13579]$)'
  NumberOfNodes:
    Default: '3'
    Description: The desired capacity for the OpenShift node instances
    Type: Number
  HostedZoneID:
    Description: 'Required: Route 53 Hosted Zone ID to use.'
    Type: String
    AllowedPattern: ".+"
    Default: "Required"
  DomainName:
    Description: "Required: domain name configured for the cluster."
    Type: String
    AllowedPattern: ".+"
    Default: "Required"
  SubDomainPrefix:
    Default: ''
    Description: 'OPTIONAL: Subdomain to use, if left blank DomainName will be used
      without a prefix. If you specify this you must also specify DomainName and HostedZoneID'
    Type: String
  CertificateArn:
    Description: >-
      OPTIONAL: Specify the ACM arn of the certificate for OpenShift applications. Must be
      valid for *.apps.ClusterName.DomainName. Example: *.apps.my-cluster.example.com
    Type: String
    Default: ""
  ClusterName:
    AllowedPattern: ".+"
    Default: "Required"
    Description: "Required: cluster name is required for OCP 4.x"
    Type: String
Resources:
  #
  # Generates an S3 Bucket for OpenShift to back its container image registry
  #
  RegistryBucket:
    Type: AWS::S3::Bucket
  #
  # This will clean up the contents of the Image Registry Bucket so CloudFormation can delete it
  #
  DeleteRegistryBucketContents:
    Type: Custom::DeleteBucketContents
    Version: '1.0'
    Properties:
      ServiceToken: !GetAtt CustomLambdaStack.Outputs.DeleteBucketContentsLambdaArn
      Bucket: !Ref 'RegistryBucket'
  OpenShiftLogGroup:
    Type: 'AWS::Logs::LogGroup'
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Properties:
      RetentionInDays: 7
  #
  # Creates the DNS Zone and subdomain (if required)
  #
  DNSZoneStack:
    Type: AWS::CloudFormation::Stack
    Condition: SetupSubdomain
    Properties:
      TemplateURL: !Sub
        - 'https://${S3Bucket}.s3.${S3Region}.${AWS::URLSuffix}/${QSS3KeyPrefix}templates/common/dns.template.yaml'
        - S3Region: !If [UsingDefaultBucket, !Ref 'AWS::Region', !Ref QSS3BucketRegion]
          S3Bucket: !If [UsingDefaultBucket, !Sub '${QSS3BucketName}-${AWS::Region}', !Ref QSS3BucketName]
      Parameters:
        HostedZoneID: !Ref HostedZoneID
        DomainName: !Ref DomainName
        SubDomainPrefix: !Ref SubDomainPrefix
  #
  # Creates the VPC Network for the cluster
  #
  VPCStack:
    Metadata:
      cfn-lint:
        config:
          ignore_checks:
            - E9902
          ignore_reasons:
            E9902: Parameter name is same
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: !Sub
        - 'https://${S3Bucket}.s3.${S3Region}.${AWS::URLSuffix}/${QSS3KeyPrefix}submodules/quickstart-aws-vpc/templates/aws-vpc.template.yaml'
        - S3Region: !If [UsingDefaultBucket, !Ref 'AWS::Region', !Ref QSS3BucketRegion]
          S3Bucket: !If [UsingDefaultBucket, !Sub '${QSS3BucketName}-${AWS::Region}', !Ref QSS3BucketName]
      Parameters:
        AvailabilityZones: !Join [ ',', !Ref 'AvailabilityZones' ]
        NumberOfAZs: '3'
        PrivateSubnet1ACIDR: !Ref 'PrivateSubnet1CIDR'
        PrivateSubnet2ACIDR: !Ref 'PrivateSubnet2CIDR'
        PrivateSubnet3ACIDR: !Ref 'PrivateSubnet3CIDR'
        PublicSubnet1CIDR: !Ref 'PublicSubnet1CIDR'
        PublicSubnet2CIDR: !Ref 'PublicSubnet2CIDR'
        PublicSubnet3CIDR: !Ref 'PublicSubnet3CIDR'
        PublicSubnetTag3: "kubernetes.io/role/elb="
        VPCCIDR: !Ref 'VPCCIDR'
  #
  # SSL Certificate management
  #
  # Either created through ACM or bring your own ARN
  SSLCertificateStack:
    Type: AWS::CloudFormation::Stack
    Condition: EnableSSLGeneration
    Properties:
      TemplateURL: !Sub
        - 'https://${S3Bucket}.s3.${S3Region}.${AWS::URLSuffix}/${QSS3KeyPrefix}templates/common/ssl_certificate.template.yaml'
        - S3Region: !If [UsingDefaultBucket, !Ref 'AWS::Region', !Ref QSS3BucketRegion]
          S3Bucket: !If [UsingDefaultBucket, !Sub '${QSS3BucketName}-${AWS::Region}', !Ref QSS3BucketName]
      Parameters:
        Route53HostedSubdomainZone: !If
          - SetupSubdomain
          - !GetAtt DNSZoneStack.Outputs.Route53HostedSubdomainZone
          - !Ref HostedZoneID
        ACMCertificateLambdaArn: !If
          - SetupRoute53
          - !GetAtt CustomLambdaStack.Outputs.ACMCertificateLambdaArn
          - ""
        ClusterName: !Ref ClusterName
        HostedZoneID: !Ref HostedZoneID
        CertificateArn: !Ref CertificateArn
        DomainName: !Ref DomainName
        SubDomainPrefix: !Ref SubDomainPrefix
  #
  # Custom Resource definitions
  #
  # Creates a set of custom resources definitions
  #
  CustomLambdaStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: !Sub
        - 'https://${S3Bucket}.s3.${S3Region}.${AWS::URLSuffix}/${QSS3KeyPrefix}templates/common/custom_lambda.template.yaml'
        - S3Region: !If [UsingDefaultBucket, !Ref 'AWS::Region', !Ref QSS3BucketRegion]
          S3Bucket: !If [UsingDefaultBucket, !Sub '${QSS3BucketName}-${AWS::Region}', !Ref QSS3BucketName]
      Parameters:
        HostedZoneID: !Ref HostedZoneID
        Route53HostedSubdomainZone: !If
          - SetupSubdomain
          - !GetAtt DNSZoneStack.Outputs.Route53HostedSubdomainZone
          - !Ref HostedZoneID
        DomainName: !Ref DomainName
        SubDomainPrefix: !Ref SubDomainPrefix
        RegistryBucket: !Ref RegistryBucket
        QSS3BucketName: !Ref QSS3BucketName
        QSS3KeyPrefix: !Ref QSS3KeyPrefix
  OpenShift4:
    Type: AWS::CloudFormation::Stack
    DependsOn: CustomLambdaStack
    Properties:
      TemplateURL: !Sub
        - 'https://${S3Bucket}.s3.${S3Region}.${AWS::URLSuffix}/${QSS3KeyPrefix}templates/openshift4/os4.template.yaml'
        - S3Region: !If [UsingDefaultBucket, !Ref 'AWS::Region', !Ref QSS3BucketRegion]
          S3Bucket: !If [UsingDefaultBucket, !Sub '${QSS3BucketName}-${AWS::Region}', !Ref QSS3BucketName]
      Parameters:
        # CloudFormation Meta
        QSS3BucketName: !Ref 'QSS3BucketName'
        QSS3KeyPrefix: !Ref 'QSS3KeyPrefix'
        QSS3BucketRegion: !Ref 'QSS3BucketRegion'
        # Cluster Configuration
        OpenshiftContainerPlatformVersion: !Ref 'OpenshiftContainerPlatformVersion'
        AmiId: !Ref AmiId
        OpenShiftMirrorURL: !FindInMap
          - OpenShiftVersion
          - !Ref OpenshiftContainerPlatformVersion
          -  OpenShiftMirrorURL
        OpenShiftVersion: !FindInMap
          - OpenShiftVersion
          - !Ref OpenshiftContainerPlatformVersion
          -  OpenShiftVersionNum
        OpenShiftClientBinary: !FindInMap
          - OpenShiftVersion
          - !Ref OpenshiftContainerPlatformVersion
          - OpenShiftClientBinary
        OpenShiftInstallBinary: !FindInMap
          - OpenShiftVersion
          - !Ref OpenshiftContainerPlatformVersion
          -  OpenShiftInstallBinary
        SSHKey: !Ref SSHKey
        PullSecret: !If
          - EmptyPullSecret
          - ""
          - !Ref PullSecret
        ClusterIngressPrivateKeySecretName: !Ref ClusterIngressPrivateKeySecretName
        ClusterIngressCertificateArn: !Ref ClusterIngressCertificateArn
        MasterInstanceProfileName: !Ref MasterInstanceProfileName
        WorkerInstanceProfileName: !Ref WorkerInstanceProfileName
        NumberOfNodes: !Ref NumberOfNodes
        MasterInstanceType: !Ref 'MasterInstanceType'
        NodesInstanceType: !Ref 'NodesInstanceType'
        ClusterName: !If
        - CustomClusterName
        - !Ref ClusterName
        - !Sub '${AWS::StackName}-${AWS::Region}'
        # Network Configuration
        RemoteAccessCIDR: !Ref RemoteAccessCIDR
        ContainerAccessCIDR: !Ref ContainerAccessCIDR
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



templates/openshift-main.template.yaml [165:575]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  PullSecret:
    Description: >-
      Required for OpenShift v4: The OCP Pull Secret JSON
    Type: String
    NoEcho: 'true'
    Default: xxxxxxxx
  SSHKey:
    Description: The public key to be added to the CoreOS boxes for ssh access.
    Default: ""
    Type: String
  NumberOfAZs:
    Default: 3
    Description: >-
      The number of Availability Zones to be used for the deployment. 3 Availability Zones are needed to avoid
      a single point of failure when using 3 or more master nodes or etcd nodes.
    Type: Number
    AllowedValues:
    - 1
    - 3
  AmiId:
    Description: >-
      OPTIONAL: bring your own AMI. In Enterprise environment, you might
      need to bring your own AMI (with proxy, softwares, ...).
      If the AMI is encrypted, keep in mind that the key policy should allow use of
      the key from AWSServiceRoleForAutoScaling.
      If left blank, we'll use the base RHEL image from your region.
    Type: String
    Default: ""
  AvailabilityZones:
    Description: List of Availability Zones to use for the subnets in the VPC. Three
      Availability Zones are used for this deployment, and the logical order of your
      selections is preserved.
    Type: List<AWS::EC2::AvailabilityZone::Name>
  KeyPairName:
    Description: (OS v3 only. Use SSHKey Parameter for OS v4) The name of an existing public/private key pair, which allows you
      to securely connect to your instance after it launches
    Type: String
    Default: ""
  PrivateSubnet1CIDR:
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$
    ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28
    Default: 10.0.0.0/19
    Description: CIDR block for private subnet 1 located in Availability Zone 1
    Type: String
  PrivateSubnet2CIDR:
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$
    ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28
    Default: 10.0.32.0/19
    Description: CIDR block for private subnet 2 located in Availability Zone 2
    Type: String
  PrivateSubnet3CIDR:
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$
    ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28
    Default: 10.0.64.0/19
    Description: CIDR block for private subnet 2 located in Availability Zone 3
    Type: String
  PublicSubnet1CIDR:
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$
    ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28
    Default: 10.0.128.0/20
    Description: CIDR block for the public (DMZ) subnet 1 located in Availability
      Zone 1
    Type: String
  PublicSubnet2CIDR:
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$
    ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28
    Default: 10.0.144.0/20
    Description: CIDR block for the public (DMZ) subnet 2 located in Availability
      Zone 2
    Type: String
  PublicSubnet3CIDR:
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$
    ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28
    Default: 10.0.160.0/20
    Description: CIDR block for the public (DMZ) subnet 2 located in Availability
      Zone 3
    Type: String
  QSS3BucketName:
    AllowedPattern: ^[0-9a-zA-Z]+([0-9a-zA-Z-]*[0-9a-zA-Z])*$
    ConstraintDescription: Quick Start bucket name can include numbers, lowercase
      letters, uppercase letters, and hyphens (-). It cannot start or end with a hyphen
      (-).
    Default: aws-quickstart
    Description: S3 bucket name for the Quick Start assets. This string can include
      numbers, lowercase letters, uppercase letters, and hyphens (-). It cannot start
      or end with a hyphen (-).
    Type: String
  QSS3KeyPrefix:
    AllowedPattern: ^[0-9a-zA-Z-/.]*$
    ConstraintDescription: Quick Start key prefix can include numbers, lowercase letters,
      uppercase letters, hyphens (-), and forward slash (/).
    Default: quickstart-redhat-openshift/
    Description: S3 key prefix for the Quick Start assets. Quick Start key prefix
      can include numbers, lowercase letters, uppercase letters, hyphens (-), and
      forward slash (/).
    Type: String
  QSS3BucketRegion:
    Default: 'us-east-1'
    Description: The AWS Region where the Quick Start S3 bucket (QSS3BucketName) is
      hosted. When using your own bucket, you must specify this value.
    Type: String
  RemoteAccessCIDR:
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$
    ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/x
    Description: The CIDR IP range that is permitted to access the instances We recommend
      that you set this value to a trusted IP range.
    Type: String
  ContainerAccessCIDR:
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$
    ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/x
    Description: The CIDR IP range that is permitted to access the instances We recommend
      that you set this value to a trusted IP range.
    Type: String
  OpenShiftAdminPassword:
    Description: (Optional for OS v4) Password for OpenShift Admin UI Must be at least 8 and no more than
      12 characters containing letters and (minimum 1 capital letter), numbers and
      symbols
    Type: String
    MinLength: '8'
    AllowedPattern: ^[^ \\']+$
    NoEcho: 'true'
    Default: 'xxxxxxxx'
  OpenshiftContainerPlatformVersion:
    Description: OpenShift version to deploy
    Default: '4.6'
    Type: String
    AllowedValues: [ '4.3', '4.6' ]
  VPCCIDR:
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$
    ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28
    Default: 10.0.0.0/16
    Description: CIDR block for the VPC
    Type: String
  MasterInstanceType:
    Default: m5.xlarge
    Type: String
    AllowedValues:
      - t3.xlarge
      - t3.2xlarge
      - m5.xlarge
      - m5.2xlarge
      - m5.4xlarge
      - m5.8xlarge
      - m5.12xlarge
      - m5a.4xlarge
      - m5a.8xlarge
      - m5a.12xlarge
      - c5.large
      - c5.xlarge
      - c5.2xlarge
      - c5.4xlarge
      - c5.9xlarge
      - c5.12xlarge
      - c5.18xlarge
      - c5.24xlarge
      - c4.2xlarge
      - c4.4xlarge
      - c4.8xlarge
      - m4.xlarge
      - m4.2xlarge
      - m4.4xlarge
      - m4.10xlarge
      - m4.16xlarge
      - r4.xlarge
      - r4.2xlarge
      - r4.4xlarge
      - r4.8xlarge
      - r4.16xlarge
    ConstraintDescription: Must contain valid instance type
    Description: Type of EC2 instance for the Master instances
  NodesInstanceType:
    Default: m5.xlarge
    AllowedValues:
      - t3.xlarge
      - t3.2xlarge
      - m5.large
      - m5.xlarge
      - m5.2xlarge
      - m5.4xlarge
      - m5.8xlarge
      - m5.12xlarge
      - m5a.4xlarge
      - m5a.8xlarge
      - m5a.12xlarge
      - c5.large
      - c5.xlarge
      - c5.2xlarge
      - c5.4xlarge
      - c5.9xlarge
      - c5.12xlarge
      - c5.18xlarge
      - c5.24xlarge
      - c4.large
      - c4.xlarge
      - c4.2xlarge
      - c4.4xlarge
      - c4.8xlarge
      - m4.large
      - m4.xlarge
      - m4.2xlarge
      - m4.4xlarge
      - m4.10xlarge
      - m4.16xlarge
      - r4.large
      - r4.xlarge
      - r4.2xlarge
      - r4.4xlarge
      - r4.8xlarge
      - r4.16xlarge
    ConstraintDescription: Must contain valid instance type
    Description: Type of EC2 instance for the Node instances
    Type: String
  NumberOfMaster:
    Default: '3'
    Description: This Deployment requires at least 3 OpenShift Master instances
    Type: String
    AllowedPattern: '^[3579]$|(^[1-9]+[13579]$)'
  NumberOfNodes:
    Default: '3'
    Description: The desired capacity for the OpenShift node instances
    Type: Number
  HostedZoneID:
    Description: 'Required: Route 53 Hosted Zone ID to use.'
    Type: String
    AllowedPattern: ".+"
    Default: "Required"
  DomainName:
    Description: "Required: domain name configured for the cluster."
    Type: String
    AllowedPattern: ".+"
    Default: "Required"
  SubDomainPrefix:
    Default: ''
    Description: 'OPTIONAL: Subdomain to use, if left blank DomainName will be used
      without a prefix. If you specify this you must also specify DomainName and HostedZoneID'
    Type: String
  CertificateArn:
    Description: >-
      OPTIONAL: Specify the ACM arn of the certificate for OpenShift applications. Must be
      valid for *.apps.ClusterName.DomainName. Example: *.apps.my-cluster.example.com
    Type: String
    Default: ""
  ClusterName:
    AllowedPattern: ".+"
    Default: "Required"
    Description: "Required: cluster name is required for OCP 4.x"
    Type: String
Resources:
  #
  # Generates an S3 Bucket for OpenShift to back its container image registry
  #
  RegistryBucket:
    Type: AWS::S3::Bucket
  #
  # This will clean up the contents of the Image Registry Bucket so CloudFormation can delete it
  #
  DeleteRegistryBucketContents:
    Type: Custom::DeleteBucketContents
    Version: '1.0'
    Properties:
      ServiceToken: !GetAtt CustomLambdaStack.Outputs.DeleteBucketContentsLambdaArn
      Bucket: !Ref 'RegistryBucket'
  OpenShiftLogGroup:
    Type: 'AWS::Logs::LogGroup'
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Properties:
      RetentionInDays: 7
  #
  # Creates the DNS Zone and subdomain (if required)
  #
  DNSZoneStack:
    Type: AWS::CloudFormation::Stack
    Condition: SetupSubdomain
    Properties:
      TemplateURL: !Sub
        - 'https://${S3Bucket}.s3.${S3Region}.${AWS::URLSuffix}/${QSS3KeyPrefix}templates/common/dns.template.yaml'
        - S3Region: !If [UsingDefaultBucket, !Ref 'AWS::Region', !Ref QSS3BucketRegion]
          S3Bucket: !If [UsingDefaultBucket, !Sub '${QSS3BucketName}-${AWS::Region}', !Ref QSS3BucketName]
      Parameters:
        HostedZoneID: !Ref HostedZoneID
        DomainName: !Ref DomainName
        SubDomainPrefix: !Ref SubDomainPrefix
  #
  # Creates the VPC Network for the cluster
  #
  VPCStack:
    Metadata:
      cfn-lint:
        config:
          ignore_checks:
            - E9902
          ignore_reasons:
            E9902: Parameter name is same
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: !Sub
        - 'https://${S3Bucket}.s3.${S3Region}.${AWS::URLSuffix}/${QSS3KeyPrefix}submodules/quickstart-aws-vpc/templates/aws-vpc.template.yaml'
        - S3Region: !If [UsingDefaultBucket, !Ref 'AWS::Region', !Ref QSS3BucketRegion]
          S3Bucket: !If [UsingDefaultBucket, !Sub '${QSS3BucketName}-${AWS::Region}', !Ref QSS3BucketName]
      Parameters:
        AvailabilityZones: !Join [ ',', !Ref 'AvailabilityZones' ]
        NumberOfAZs: '3'
        PrivateSubnet1ACIDR: !Ref 'PrivateSubnet1CIDR'
        PrivateSubnet2ACIDR: !Ref 'PrivateSubnet2CIDR'
        PrivateSubnet3ACIDR: !Ref 'PrivateSubnet3CIDR'
        PublicSubnet1CIDR: !Ref 'PublicSubnet1CIDR'
        PublicSubnet2CIDR: !Ref 'PublicSubnet2CIDR'
        PublicSubnet3CIDR: !Ref 'PublicSubnet3CIDR'
        PublicSubnetTag3: "kubernetes.io/role/elb="
        VPCCIDR: !Ref 'VPCCIDR'
  #
  # SSL Certificate management
  #
  # Either created through ACM or bring your own ARN
  SSLCertificateStack:
    Type: AWS::CloudFormation::Stack
    Condition: EnableSSLGeneration
    Properties:
      TemplateURL: !Sub
        - 'https://${S3Bucket}.s3.${S3Region}.${AWS::URLSuffix}/${QSS3KeyPrefix}templates/common/ssl_certificate.template.yaml'
        - S3Region: !If [UsingDefaultBucket, !Ref 'AWS::Region', !Ref QSS3BucketRegion]
          S3Bucket: !If [UsingDefaultBucket, !Sub '${QSS3BucketName}-${AWS::Region}', !Ref QSS3BucketName]
      Parameters:
        Route53HostedSubdomainZone: !If
          - SetupSubdomain
          - !GetAtt DNSZoneStack.Outputs.Route53HostedSubdomainZone
          - !Ref HostedZoneID
        ACMCertificateLambdaArn: !If
          - SetupRoute53
          - !GetAtt CustomLambdaStack.Outputs.ACMCertificateLambdaArn
          - ""
        ClusterName: !Ref ClusterName
        HostedZoneID: !Ref HostedZoneID
        CertificateArn: !Ref CertificateArn
        DomainName: !Ref DomainName
        SubDomainPrefix: !Ref SubDomainPrefix
  #
  # Custom Resource definitions
  #
  # Creates a set of custom resources definitions
  #
  CustomLambdaStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: !Sub
        - 'https://${S3Bucket}.s3.${S3Region}.${AWS::URLSuffix}/${QSS3KeyPrefix}templates/common/custom_lambda.template.yaml'
        - S3Region: !If [UsingDefaultBucket, !Ref 'AWS::Region', !Ref QSS3BucketRegion]
          S3Bucket: !If [UsingDefaultBucket, !Sub '${QSS3BucketName}-${AWS::Region}', !Ref QSS3BucketName]
      Parameters:
        HostedZoneID: !Ref HostedZoneID
        Route53HostedSubdomainZone: !If
          - SetupSubdomain
          - !GetAtt DNSZoneStack.Outputs.Route53HostedSubdomainZone
          - !Ref HostedZoneID
        DomainName: !Ref DomainName
        SubDomainPrefix: !Ref SubDomainPrefix
        RegistryBucket: !Ref RegistryBucket
        QSS3BucketName: !Ref QSS3BucketName
        QSS3KeyPrefix: !Ref QSS3KeyPrefix
  OpenShift4:
    Type: AWS::CloudFormation::Stack
    DependsOn: CustomLambdaStack
    Properties:
      TemplateURL: !Sub
        - 'https://${S3Bucket}.s3.${S3Region}.${AWS::URLSuffix}/${QSS3KeyPrefix}templates/openshift4/os4.template.yaml'
        - S3Region: !If [UsingDefaultBucket, !Ref 'AWS::Region', !Ref QSS3BucketRegion]
          S3Bucket: !If [UsingDefaultBucket, !Sub '${QSS3BucketName}-${AWS::Region}', !Ref QSS3BucketName]
      Parameters:
        # CloudFormation Meta
        QSS3BucketName: !Ref 'QSS3BucketName'
        QSS3KeyPrefix: !Ref 'QSS3KeyPrefix'
        QSS3BucketRegion: !Ref 'QSS3BucketRegion'
        # Cluster Configuration
        OpenshiftContainerPlatformVersion: !Ref 'OpenshiftContainerPlatformVersion'
        AmiId: !Ref AmiId
        OpenShiftMirrorURL: !FindInMap
          - OpenShiftVersion
          - !Ref OpenshiftContainerPlatformVersion
          -  OpenShiftMirrorURL
        OpenShiftVersion: !FindInMap
          - OpenShiftVersion
          - !Ref OpenshiftContainerPlatformVersion
          -  OpenShiftVersionNum
        OpenShiftClientBinary: !FindInMap
          - OpenShiftVersion
          - !Ref OpenshiftContainerPlatformVersion
          - OpenShiftClientBinary
        OpenShiftInstallBinary: !FindInMap
          - OpenShiftVersion
          - !Ref OpenshiftContainerPlatformVersion
          -  OpenShiftInstallBinary
        SSHKey: !Ref SSHKey
        PullSecret: !If
          - EmptyPullSecret
          - ""
          - !Ref PullSecret
        ClusterIngressPrivateKeySecretName: !Ref ClusterIngressPrivateKeySecretName
        ClusterIngressCertificateArn: !Ref ClusterIngressCertificateArn
        MasterInstanceProfileName: !Ref MasterInstanceProfileName
        WorkerInstanceProfileName: !Ref WorkerInstanceProfileName
        NumberOfNodes: !Ref NumberOfNodes
        MasterInstanceType: !Ref 'MasterInstanceType'
        NodesInstanceType: !Ref 'NodesInstanceType'
        ClusterName: !If
        - CustomClusterName
        - !Ref ClusterName
        - !Sub '${AWS::StackName}-${AWS::Region}'
        # Network Configuration
        RemoteAccessCIDR: !Ref RemoteAccessCIDR
        ContainerAccessCIDR: !Ref ContainerAccessCIDR
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



