Podman requirements

You must meet the following requirements before installing Terraform Enterprise on Podman.

Versions

• A Podman version greater than or equal to v4.3.0.
• Any supported Linux OS, note that Red Hat Enterprise Linux (RHEL) users must use RHEL 8+

Install Podman

Follow the installation documentation for Podman on a Linux distribution of your choice.

Enable the Podman socket

Set up Podman’s docker-compatible REST API that runs as a systemd socket-activated service:

systemctl enable --now podman.socket

HTTP/S Ports

Because Podman does not expose privileged ports, ensure that you set the following environment variables and ports in the Kubernetes pod specification.

Set these environment variables in the kube.yaml:

- name: "TFE_HTTP_PORT"
  value: "8080"
- name: "TFE_HTTPS_PORT"
  value: "8443"

Set these ports in the kube.yaml:

"ports":
- "containerPort": 8080
  "hostPort": 80
- "containerPort": 8443
  "hostPort": 443
- "containerPort": 9090
  "hostPort": 9090

RHEL and SELinux

We recommend adding type: spc_t to the Kubernetes pod specification's security context when using volumes for an unprivileged Podman container on an SELinux-enabled system. This setting ensures the correct permissions are in place to access the volume when Terraform Enterprise creates the pod/container.

Set the security context in the kube.yaml:

"securityContext":
  "seLinuxOptions":
    "type": "spc_t"

Terraform Enterprise requirements

• You meet the shared requirements for all Flexible deployment methods.

• A DNS hostname for accessing Terraform Enterprise.

• A TLS certificate and private key for your DNS hostname.

• A HashiCorp-issued Terraform Enterprise license.

TLS certificate

You need three TLS certificate files:

• cert.pem - The end-entity certificate for your DNS hostname with any intermediate certificates appended to it.

• key.pem - The private key for the end-entity certificate. Must not be protected by a passphrase.

• bundle.pem - Additional certificates to be added to the Certificate Authority (CA) bundle.

If you’re using a certificate from Let’s Encrypt, those file names map to the following Terraform Enterprise files:

If you do not have a certificate, you can generate a self-signed one. Use the -nodes option in your command since Terraform Enterprise cannot use a private key that is protected by a passphrase.

$ openssl req -x509 -nodes -newkey rsa:4096 -keyout key.pem -out cert.pem -sha256 -days 365

Be sure to replace <terraform.example.com> with the hostname you use to access Terraform Enterprise.

You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:US
State or Province Name (full name) [Some-State]:California
Locality Name (eg, city) []:San Francisco
Organization Name (eg, company) [Internet Widgits Pty Ltd]:HashiCorp, Inc.
Organizational Unit Name (eg, section) []:Engineering
Common Name (e.g. server FQDN or YOUR name) []:<terraform.example.com>
Email Address []:

When done, you’ll have your cert.pem and key.pem files but no bundle.pem file.

Create your bundle.pem like so:

$ cp cert.pem bundle.pem