Hybrid Cloud Patterns

OpenShift Cluster Sizing for the Multicluster DevSecOps Pattern

Tested Platforms

The Multicluster DevSecOps pattern has been tested in the following Certified Cloud Providers. Due to changes in Advanced Cluster Management 2.5, this pattern does not work, “out-of-the-box”, with earlier versions of OCP than 4.10. While it’s possible that it could work with some changes, we do not recommend using a version less than 4.10.

| Certified Cloud Providers | 4.10 | 4.11 | 4.x | :—- | :—- | :—- | Amazon Web Services | Tested | Untested | | Google Compute | Untested | Untested | | Microsoft Azure | Untested | Untested |

Multicluster DevSecOps Pattern Components

Here’s an inventory of what gets deployed by default the Secure Supply Chain pattern on the Hub OpenShift cluster:

NameKindNamespaceDescription
Red Hat Advanced Cluster ManagementOperatoropen-cluster-managementAdvance cluster management
Red Hat OpenShift GitOpsOperatoropenshift-operatorsArgoCD GitOps
Red Hat Advanced Cluster SecurityOperatorstackroxAdvanced cluster security, central and secured
Red Hat QuayOperatorquay-enterpriseSecure container registry
Red Hat Open Data FoundationOperatoropenshift-storageHighly available software-defined storage
Hashicorp Vault Community versionOperatorvaultSecrets Management

The hub can be modified to deploy OpenShift Pipelines if needed. See Development cluster pattern components.

Multicluster DevSecOps Pattern OpenShift Datacenter HUB Cluster Size

The Secure Supply Chain pattern has been tested with a defined set of specifically tested configurations that represent the most common combinations that Red Hat OpenShift Container Platform (OCP) customers are using or deploying for the x86_64 architecture.

The Hub OpenShift Cluster is made up of the the following on the AWS deployment tested:

Node TypeNumber of nodesCloud ProviderInstance Type
Control Plane3Amazon Web Servicesm5.xlarge
Worker3Amazon Web Servicesm5.4xlarge

The Hub OpenShift cluster needs to be a larger than the managed clusters for this demo because it deploys critical pattern infrastructure components like Red Hat Quay which requires Red Hat Open Data Foundation (ODF). The above cluster sizing is close to a minimum size for a Hub cluster. In the next few sections we take some snapshots of the cluster utilization while the Multicluster DevSecOps pattern is running. Keep in mind that resources will have to be added as more images and image versions are added to the Quay registry.

Hub Cluster utilization

Below is a snapshot of the OpenShift cluster utilization while running the Multicluster DevSecOps pattern:

TBD

CPUMemoryFile SystemNetworkPod Count
3866 GiB226 MiB13 MB/s441

Secure Supply Chain Pattern OpenShift Development (devel) Cluster Size

Here’s an inventory of what gets deployed by default the Secure Supply Chain pattern on the Development (devel) OpenShift cluster:

NameKindNamespaceDescription
Red Hat Advanced Cluster Managementagentopen-cluster-managementAdvance cluster management agent only
Red Hat OpenShift GitOpsOperatoropenshift-operatorsArgoCD GitOps
Red Hat Advanced Cluster SecurityOperatorstackroxAdvanced cluster security, secured
Red Hat OpenShift PipelinesOperatoropenshift-operatorsTekton pipelines for CI
Red Hat Quay BridgeOperatoropenshift-operatorsQuay registry integration

The OpenShift cluster is a standard deployment of 3 control plane nodes and 3 or more worker nodes.

Node TypeNumber of nodesCloud ProviderInstance Type
Control Plane/Worker6Google Cloudn1-standard-8
Control Plane/Worker6Amazon Cloud Servicesm5.2xlarge
Control Plane/Worker6Microsoft AzureStandard_D8s_v3

Multicluster DevSecOps Pattern OpenShift Production (prod) Cluster Size

Here’s an inventory of what gets deployed by default the Multicluster DevSecOps pattern on the Production (prod) OpenShift cluster:

NameKindNamespaceDescription
Red Hat Advanced Cluster Managementagentopen-cluster-managementAdvance cluster management agent only
Red Hat OpenShift GitOpsOperatoropenshift-operatorsArgoCD GitOps
Red Hat Advanced Cluster SecurityOperatorstackroxAdvanced cluster security, secured
Red Hat Quay BridgeOperatoropenshift-operatorsQuay registry integration

The OpenShift cluster is a standard datacenter deployment of 3 control plane nodes and 3 or more worker nodes.

Node TypeNumber of nodesCloud ProviderInstance Type
Control Plane/Worker6Google Cloudn1-standard-8
Control Plane/Worker6Amazon Cloud Servicesm5.2xlarge
Control Plane/Worker6Microsoft AzureStandard_D8s_v3

Managed Datacenter Cluster Utilization

GCP

This is a snapshot of a Google Cloud managed data center cluster running the production Multicluster DevSecOps pattern.

CPUMemoryFile SystemNetworkPod Count

AWS

This is a snapshot of a Amazon Web Services managed data center cluster running the production Multicluster DevSecOps pattern.

CPUMemoryFile SystemNetworkPod Count

Azure

This is a snapshot of an Azure managed data center cluster running the production Multicluster DevSecOps pattern.

CPUMemoryFile SystemNetworkPod Count

AWS Instance Types

The Multicluster DevSecOps pattern was tested with the highlighted AWS instances in bold. The OpenShift installer will let you know if the instance type meets the minimum requirements for a cluster.

The message that the openshift installer will give you will be similar to this message

INFO Credentials loaded from default AWS environment variables
FATAL failed to fetch Metadata: failed to load asset "Install Config": [controlPlane.platform.aws.type: Invalid value: "m4.large": instance type does not meet minimum resource requirements of 4 vCPUs, controlPlane.platform.aws.type: Invalid value: "m4.large": instance type does not meet minimum resource requirements of 16384 MiB Memory]

Below you can find a list of the AWS instance types that can be used to deploy the Multicluster DevSecOps pattern.

Instance typeDefault vCPUsMemory (GiB)DatacenterFactory/Edge
3x3 OCP Cluster3 Node OCP Cluster
m4.xlarge416NN
m4.2xlarge832YY
m4.4xlarge1664YY
m4.10xlarge40160YY
m4.16xlarge64256YY
m5.xlarge416YN
m5.2xlarge832YY
m5.4xlarge1664YY
m5.8xlarge32128YY
m5.12xlarge48192YY
m5.16xlarge64256YY
m5.24xlarge96384YY

The OpenShift cluster is made of 4 Control Plane nodes and 3 Workers for the Datacenter and the Edge/managed data center cluster are made of 3 Control Plane and 3 Worker nodes. For the node sizes we used the m5.xlarge on AWS and this instance type met the minimum requirements to deploy the Multicluster DevSecOps pattern successfully on the Datacenter hub. On the managed data center cluster we used the m5.xlarge since the minimum cluster was comprised of 3 nodes. .

To understand better what types of nodes you can use on other Cloud Providers we provide some of the details below.

Azure Instance Types

The Multicluster DevSecOps pattern was also deployed on Azure using the Standard_D8s_v3 VM size. Below is a table of different VM sizes available for Azure. Keep in mind that due to limited access to Azure we only used the Standard_D8s_v3 VM size.

The OpenShift cluster is made of 3 Control Plane nodes and 3 Workers for the Datacenter cluster.

The OpenShift cluster is made of 3 Control Plane nodes and 3 or more workers for each of the managed data center clusters.

TypeSizesDescription
General purposeB, Dsv3, Dv3, Dasv4, Dav4, DSv2, Dv2, Av2, DC, DCv2, Dv4, Dsv4, Ddv4, Ddsv4Balanced CPU-to-memory ratio. Ideal for testing and development, small to medium databases, and low to medium traffic web servers.
Compute optimizedF, Fs, Fsv2, FXHigh CPU-to-memory ratio. Good for medium traffic web servers, network appliances, batch processes, and application servers.
Memory optimizedEsv3, Ev3, Easv4, Eav4, Ev4, Esv4, Edv4, Edsv4, Mv2, M, DSv2, Dv2High memory-to-CPU ratio. Great for relational database servers, medium to large caches, and in-memory analytics.
Storage optimizedLsv2High disk throughput and IO ideal for Big Data, SQL, NoSQL databases, data warehousing and large transactional databases.
GPUNC, NCv2, NCv3, NCasT4_v3, ND, NDv2, NV, NVv3, NVv4Specialized virtual machines targeted for heavy graphic rendering and video editing, as well as model training and inferencing (ND) with deep learning. Available with single or multiple GPUs.
High performance computeHB, HBv2, HBv3, HC, HOur fastest and most powerful CPU virtual machines with optional high-throughput network interfaces (RDMA).

For more information please refer to the Azure VM Size Page.

Google Cloud (GCP) Instance Types

The Multicluster DevSecOps pattern was also deployed on GCP using the n1-standard-8 VM size. Below is a table of different VM sizes available for GCP. Keep in mind that due to limited access to GCP we only used the n1-standard-8 VM size.

The OpenShift cluster is made of 3 Control Plane and 3 Workers for the Datacenter cluster.

The OpenShift cluster is made of 3 Nodes combining Control Plane/Workers for the Edge/managed data center cluster.

The following table provides VM recommendations for different workloads.

| General purpose | Workload optimized

Cost-optimizedBalancedScale-out optimizedMemory-optimizedCompute-optimizedAccelerator-optimized
E2N2, N2D, N1T2DM2, M1C2A2
Day-to-day computing at a lower costBalanced price/performance across a wide range of VM shapesBest performance/cost for scale-out workloadsUltra high-memory workloadsUltra high performance for compute-intensive workloadsOptimized for high performance computing workloads

For more information please refer to the GCP VM Size Page.

Copyright © 2022 Red Hat, Inc.