oci-devops-rm-1.0.0

Changelog

All notable changes to the OKE DevOps Starter are documented in this file.

This project follows Semantic Versioning.

[1.0.0] - 2026-07-10

Initial public release of the OCI Resource Manager stack.

Application Delivery

• Added support for multiple applications with multiple globally unique components from a concise JSON configuration.
• Added generated OCI Code repositories, protected main branches, pull-request validation pipelines, build pipelines, deployment pipelines, artifacts, triggers, and OCIR paths for every configured application and component.
• Added component-owned pull-request build specifications so teams can implement language-specific unit, integration, security, and quality checks.
• Added parameterless main builds that produce multi-architecture images tagged with the immutable 7-character Git commit SHA.
• Added automatic development deployment after a successful component build.
• Added release-candidate promotion with skopeo, staging deployment, production approval, final image promotion, production deployment, Helm status reporting, and final Git tagging.
• Separated application baseline charts from independently versioned and deployed component charts.
• Added per-application bootstrap pipelines that initialize application namespaces and OCIR pull secrets on pre-production and production clusters.
• Added cluster-specific application baseline values and environment-specific component values for development, staging, and production.

Cluster Administration

• Added optional cluster administration behind the enable_cluster_admin feature flag.
• Added a dedicated cluster-admin repository for cluster tool configuration, values, supplemental namespaced resources, and cluster-wide baseline manifests.
• Added support for mirroring pinned public HTTP(S) and OCI Helm charts into OCIR.
• Added dependency-aware tool deployment using a configurable DAG, with independent tools deployed in parallel and dependent tools deployed in topological waves.
• Added immutable cluster values artifacts versioned by the full configuration commit SHA.
• Added selective deployments so a merged configuration change invokes only affected cluster and tool stages.
• Added matching pre-production and production orchestration, with approval required before production mutation.
• Added explicit tool decommission pipelines without automatic pruning of unrelated Kubernetes resources.

Resource Manager Experience

• Added a guided Resource Manager form for OCI DevOps, applications, independent pre-production and production OKE targets, IAM, logging, notifications, and optional cluster administration.
• Added multiline, human-readable JSON defaults and validation for application/component and cluster-tool configuration.
• Added configurable DevOps project, logging, notification topic, Generic Artifact repository, IAM resource names, and component build-spec paths.
• Added structured application information outputs covering repositories, pipelines, environments, artifacts, OCIR paths, and suggested next actions.
• Added support for using one OKE cluster as both pre-production and production for evaluation environments.

Template Ownership And Safety

• Added release-mode lifecycle protection so teams can customize generated OCI DevOps starter resources without later Resource Manager applies overwriting those changes.
• Added add-only Git repository seeding that preserves existing developer and administrator content.
• Added a separate hidden development packaging mode for stack maintainers to refresh template-managed resources during functional testing.
• Added Vault-backed OCIR pull credentials, private OKE endpoint access from configured worker subnets, optional NSGs, and scoped IAM policies.
• Added release packaging exclusions for local state, credentials, development artifacts, maintainer agent context, and private stack update helpers.

Documentation

• Added a customer quickstart and a Deploy to Oracle Cloud entry point.
• Added separate developer and cluster-operations guides, workflows, runbooks, architecture diagrams, naming conventions, chart lifecycle documentation, security guidance, troubleshooting, responsibilities, and template-upgrade guidance.

Lifecycle Notes

• Generated OCI DevOps resources are starter templates, not a continuously enforced CI/CD policy.
• Removing an application, component, tool, or manifest from configuration does not automatically delete its Git content or live Kubernetes resources.
• Production can target the same physical OKE cluster as pre-production for evaluation, but separate clusters are recommended for production isolation.

oke-rm-1.3.5

Changelog

This file documents notable user-facing changes to the OCI Resource Manager infrastructure and OKE stacks.

2026-07-01

Changed

• OKE-managed worker node pools now default to Oracle Linux 9 images.

2026-06-30

Added

• Added outputs that simplify passing network resources from the infrastructure stack to the OKE stack, including VCN, subnet, and NSG OCIDs.
• Added database and messaging outputs, including database-side NSGs, client NSGs, and the OCI Streaming NSG.
• Added create_database_nsgs to control the creation of database NSGs and corresponding pod or worker rules. Resources are created only when this option is enabled and at least one database service is selected.
• Added a custom worker hostname cloud-init example for Kubernetes 1.32 and later. The example also expands the boot volume with oci-growfs.
• Added a disabled-by-default managed node pool example using Generic VNIC Attachments (GVA), including a secondary VNIC profile and Application Resource.

Changed

• Upgraded the OCI Terraform provider from 8.1.0 to 8.19.0 in both stacks.
• Upgraded oracle-terraform-modules/oke/oci from 5.4.3 to 5.5.0.
• Added Terraform dependency lock files to provide reproducible provider selections.
• Renamed cloud-init/oca.yml to cloud-init/storage.yml and updated its example reference.
• Reorganized the infrastructure stack interface into separate Database and Messaging sections.
• Made the database service selector and separate-NSG option visible only when database NSG creation is enabled.
• Disabled the CoreDNS Terraform override by default. It can still be enabled when the required worker capacity is available.
• Clarified the infrastructure stack's two deployment modes:
  • Create and manage a new VCN and its network resources.
  • Deploy supported network configuration on an existing VCN.
  • Create the applicable OKE NSGs in either mode.

Fixed

• Corrected the KMS vault and key selectors to use kms_compartment_id.
• Clarified that customer-managed OKE encryption keys require an IAM policy, either created by the stack or supplied by the customer.
• Included generated KMS statements in the policy_statements output.
• Prevented automatic KMS policy resource creation when stack policy creation is disabled.
• Corrected the Karpenter CLUSTER_JOIN policy condition syntax.
• Prevented unnecessary updates caused by service-managed identity-domain dynamic resource group attributes.
• Updated external subnet and NSG handling for compatibility with the stricter validation in OKE module 5.5.0.
• Explicitly constrained the OKE wrapper to oke_ip_families = ["IPv4"], matching the stack's current capabilities.
• Corrected Resource Manager output definitions so OCIDs are displayed as copyable values instead of malformed resource paths.
• Exposed database and messaging subnet and NSG outputs in the Resource Manager UI.

oke-gitops-1.3.0

• The OKE GitOps solution now supports both ArgoCD and FluxCD
• Mirror pipelines are now more clear and documented

oke-rm-1.3.4

• Support for extending the pod subnet by specifying multiple CIDR blocks
• Worker and Pod subnet and NSGs now have a freeForm tag to identify them (useful for Karpenter): karpenter-oci/role
• Karpenter support: creation of policies and dynamic group
• New Policy section, with the possibility to specify which policies to create, and a DRY_RUN mode to only output the required policies
• If the kms key is specified to encrypt etcd, a policy will be created automatically (if policies are enabled for the stack)
• Examples now for node pools are more clear, also added a System Node Pool example for Karpenter
• Created a Karpenter guide
• Deprecated the "enable cluster-autoscaler" add-on, policies for cluster autoscaler can still be created
• Upgraded the oke module to 5.4.3

oke-gitops-1.2.0

The oke-gitops solution has substantially changed in this release:

• First solution based on Flux Operator
• Rewritten the entire documentation
• OCI DevOps pipelines to mirror images and helm charts
• Examples for developer repositories
• Inserted example pipelines to mirror OCI Code repositories to different regions for DR

oke-rm-1.3.3

• Reviewed some routing rules for peered VCNs
• Fixed a bug where vcn_peering rules were added even though no drg attachment was present
• New peering NSG, created only when VNC peering is enabled in create VCN mode
• OKE NodeProblemDetector add-on is now deployed by default in every OKE cluster, and this stack also enables the Kubernetes exporter
• Node pools provisioned through the oke module now feature a label so that the node problem detector is correctly deployed
• Cloud init default sample script improvements for UHP volumes and fss in-transit encryption
• Added DHCP VCN search domain by default
• Support for different range of VCN CIDR blocks: /20 (small), /18 (medium), /20 (large)
• Fixed a bug when inserting a particular peering CIDR block (0.0.0.0)

oke-rm-1.3.2

• Added messaging subnet
• Support for OCI Streaming
• Updated architecture image

oke-rm-1.3.1

• Added support for mysql service NSG
• Added support for Autonomous JSON Database Mongodb APIs
• OKE module 5.4.1

oke-rm-1.3.0

• New UI organization for the infra module
• Possibility to create an additional db subnet
• Automatic creation of NSGs rules for selected database services: OCI PostgreSQL, OCI Cache, Oracle Database
• Create OKE clusters in air-gapped networks
• Support for tagging
• Upgraded oke terraform module to 5.4.0
• Upgraded oci terraform providers

oke-rm-1.2.1

• Simplified the oke.tf script
• Added support for cloud-init and an example to update oracle cloud agent capabilities of the nodes