oke-rm 1.3.6

[alcampag]

Changelog

This file documents notable user-facing changes to the OCI Resource Manager infrastructure and OKE stacks.

2026-08-24

Changed

• Upgraded oracle-terraform-modules/oke/oci from 5.5.0 to 5.5.1.

Fixed

• Ensured the IAM policy for a customer-managed OKE cluster encryption key is created before the cluster.

2026-07-01

Changed

• OKE-managed worker node pools now default to Oracle Linux 9 images.

2026-06-30

Added

• Added outputs that simplify passing network resources from the infrastructure stack to the OKE stack, including VCN, subnet, and NSG OCIDs.
• Added database and messaging outputs, including database-side NSGs, client NSGs, and the OCI Streaming NSG.
• Added create_database_nsgs to control the creation of database NSGs and corresponding pod or worker rules. Resources are created only when this option is enabled and at least one database service is selected.
• Added a custom worker hostname cloud-init example for Kubernetes 1.32 and later. The example also expands the boot volume with oci-growfs.
• Added a disabled-by-default managed node pool example using Generic VNIC Attachments (GVA), including a secondary VNIC profile and Application Resource.

Changed

• Upgraded the OCI Terraform provider from 8.1.0 to 8.19.0 in both stacks.
• Upgraded oracle-terraform-modules/oke/oci from 5.4.3 to 5.5.0.
• Added Terraform dependency lock files to provide reproducible provider selections.
• Renamed cloud-init/oca.yml to cloud-init/storage.yml and updated its example reference.
• Reorganized the infrastructure stack interface into separate Database and Messaging sections.
• Made the database service selector and separate-NSG option visible only when database NSG creation is enabled.
• Disabled the CoreDNS Terraform override by default. It can still be enabled when the required worker capacity is available.
• Clarified the infrastructure stack's two deployment modes:
  • Create and manage a new VCN and its network resources.
  • Deploy supported network configuration on an existing VCN.
  • Create the applicable OKE NSGs in either mode.

Fixed

• Corrected the KMS vault and key selectors to use kms_compartment_id.
• Clarified that customer-managed OKE encryption keys require an IAM policy, either created by the stack or supplied by the customer.
• Included generated KMS statements in the policy_statements output.
• Prevented automatic KMS policy resource creation when stack policy creation is disabled.
• Corrected the Karpenter CLUSTER_JOIN policy condition syntax.
• Prevented unnecessary updates caused by service-managed identity-domain dynamic resource group attributes.
• Updated external subnet and NSG handling for compatibility with the stricter validation in OKE module 5.5.0.
• Explicitly constrained the OKE wrapper to oke_ip_families = ["IPv4"], matching the stack's current capabilities.
• Corrected Resource Manager output definitions so OCIDs are displayed as copyable values instead of malformed resource paths.
• Exposed database and messaging subnet and NSG outputs in the Resource Manager UI.