1. Log in to the Oracle Cloud Infrastructure Console.
2. Select Networking Virtual Cloud Networks.
3. Click Start VCN Wizard.
4. Select Create VCN with Internet Connectivity and click Start VCN Wizard.
5. Enter the following information in the wizard:
   • Name: Select a name for the network. For example idm_oke_vcn.
   • Compartment: Select the name of the compartment you created earlier. See Creating an OCI Compartment.
   • VCN CIDR Block: Enter the internal CIDR block you want to use for your network. For example: 10.0.0.0/16.
   • Public Subnet CIDR Block: Enter the CIDR of the subnet you want to export to the internet. For example: 10.0.20.0/24.
   • Private Subnet CIDR Block: Enter the CIDR of the subnet you want to use privately (this is where the Kubernetes worker nodes will reside). For example: 10.0.10.0/24.
   • Use DNS Hostnames in this VCN: Select this option.
6. Click Next.
7. Review the summary information of the details specified and click Create.
8. When complete, click View Virtual Cloud Network.

1. Log in to the Oracle Cloud Infrastructure Console.
2. Select Networking Virtual Cloud Networks.
3. Select the newly created network idm_oke_vcn. See Creating an Oracle Virtual Cloud Network.
4. Click Security Lists.
5. Click the default security list. For example, security list for the private subnet - idm_oke_vcn.
6. Click Add Ingress Rules to add an Ingress rule as described in Table 10-1.
7. Click Egress in the Resources List
8. Click Add Egress Rules to add an Egress rule as described in Table 10-1.

   Table 10-1 Description of Ingress and Egress Rules

   Rule Type	Type	Source CIDR	Destination CIDR	Protocol	Destination Port Range	Type	Code
   Ingress	CIDR	10.0.10.0/24		All protocols
   Ingress	CIDR	10.0.0.0/28		ICMP		3	4
   Ingress	CIDR	10.0.0.0/28		TCP
   Ingress	CIDR	0.0.0.0.0/0		TCP	22
   Egress	CIDR		10.0.10.0/24	All protocols
   Egress	CIDR		10.0.0.0/28	TCP	6433
   Egress	CIDR		10.0.0.0/28	TCP	12250
   Egress	CIDR		10.0.0.0/28	ICMP		3	4
   Egress	Service		All Services in Oracle Service Network	TCP	443

1. Log in to the Oracle Cloud Infrastructure Console.
2. Select Networking Virtual Cloud Networks.
3. Click the newly created network idm_oke_vcn. See Creating an Oracle Virtual Cloud Network.
4. Click Security Lists and select Create Security List.
5. Enter the following information:
   • Name: Enter a name for the security list. For example: api-seclist.
   • Compartment: Select the name of the compartment you created earlier. See Creating an OCI Compartment.
6. Click Add Another Ingress Rule to add an Ingress rule as described in Table 10-2 (repeat for each Ingress rule).
7. Click Add Another Egress Rule to add an Egress rule as described in Table 10-2 (repeat for each Egress rule).

   Table 10-2 Description of Ingress and Egress Rules

   Rule Type	Type	Source CIDR	Destination CIDR	Protocol	Destination Port Range	Type	Code
   Ingress	CIDR	0.0.0.0/0		TCP	6443
   Ingress	CIDR	10.0.10.0/24		TCP	6443
   Ingress	CIDR	10.0.10.0/24		TCP	12250
   Ingress	CIDR	10.0.10.0/24		ICMP		3	4
   Egress	CIDR	10.0.10.0/24		TCP
   Egress	CIDR	10.0.10.0/24		ICMP		3	4
   Egress	Service	All services in the Services Network.		TCP	443

8. Click Create Security List.

1. Log in to the Oracle Cloud Infrastructure Console.
2. Select Networking Virtual Cloud Networks.
3. Click the newly created network idm_vcn. See Creating an Oracle Virtual Cloud Network.
4. Click Subnets and select Create Subnet.
5. Enter the following information:
   • Name: Enter a name for the subnet. For example: api-subnet.
   • Compartment: Select the name of the compartment you created earlier. See Creating an OCI Compartment.
   • Subnet Type: Select Regional.
   • CIDR Block: Enter the CIDR of the subnet. For example: 10.0.0.0/28.
   • Route Table: Select Default Route Table for idm_vcn.
   • Subnet Access: Select Private.
   • Use DNS Hostnames in this Subnet - Select this option.
   • Security List: Select the security list you created above: api-seclist. See Creating an API Security List.
6. Click Create Subnet.

1. Log in to the Oracle Cloud Infrastructure Console.
2. Select Developer Services (located in Solutions and Platform) and click Kubernetes Containers (OKE).
3. Click Create Cluster and select Custom Create.
4. Click Submit.
5. Enter the following information in the wizard:
   • Name: Enter a name for the cluster. For example: idm-oke.
   • Compartment: Select the name of the compartment you created earlier. See Creating an OCI Compartment.
   • Kubernetes Version: Select the version of Kubernetes you want to create.
6. Click Next.
7. Enter the following information in the Networking Setup page:
   • Network Type: Select VCN-native pod networking.
   • VCN: Select the VCN you created earlier. For example: idm_oke_vcn. See Creating an Oracle Virtual Cloud Network.
   • Kubernetes Service LB Subnets: Select the public subnet that was automatically created with the VCN.
   • Kubernetes API Endpoint Subnet: Select the API subnet you created earlier. For example: api-subnet. See Creating an API Subnet.
   • Assign a Public IP Address to the API Endpoint - Do not select this option.
   • Click Next.
8. Enter the following information in the Node Pools page:
   • Name: Specify a name for the pool. For example: Pool1.
   • Compartment: Select the name of the compartment you created earlier. See Creating an OCI Compartment.
   • Node Type: Choose Managed or Virtual depending on your requirements.
   • Kubernetes Version: Select the version of Kubernetes you want to create. This should be the same as the cluster version.
   • Placement Configuration: You should place the worker nodes in different fault domains. To place the worker nodes, create a placement for each fault zone. For example, if you have three or four worker nodes, create a placement for three different fault domains. To create a placement, enter the following information:
     • Availability Domain: Select one.
     • Worker Node Subnet: Select the default private subnet which was created with the VCN.
     • Fault Domain: Select one.

     Click Add another Row.

     Enter the same information again to distribute your worker nodes across different fault domains.

   • Shape and Image: Enter details of the shape and capacity of the worker nodes you want to create. For example: VM.Standard.E3.Flex.
   • OCPU: 4.
   • RAM: 64GB.
   • Image: Oracle Linux 8.
   • Number of Nodes: The number of worker nodes you want to create.
   • Boot Volume: You can use the default value or increase the size of the boot volume if you anticipate using different container images and versions.
9. Click Next.
10. Review the cluster summary, and then click Create Cluster.

1. Click Create Security List.
2. Enter the following details:
   • Name: Enter a name for the security list. For example: bastion-private-seclist.
   • Compartment: Select the name of the compartment you created earlier. See Creating an OCI Compartment.
3. Click Add Another Ingress Rule to add an Ingress rule as described in Table 10-3 (repeat for each Ingress rule).
4. Click Add Another Egress Rule to add an Egress rule as described in Table 10-3 (repeat for each Egress rule).
5. Click Create Security List.

1. Click Create Security List.
2. Enter the following details:
   • Name: Enter a name for the security list. For example: bastion-public-seclist.
   • Compartment: Select the name of the compartment you created earlier. See Creating an OCI Compartment.
3. Click Add Another Ingress Rule to add an Ingress rule as described in Table 10-4 (repeat for each Ingress rule).
4. Click Add Another Egress Rule to add an Egress rule as described in Table 10-4 (repeat for each Egress rule).
5. Click Create Security List.

1. Click Create Security List.
2. Enter the following details:
   • Name: Enter a name for the security list. For example: bastion-setup-seclist.
   • Compartment: Select the name of the compartment you created earlier. See Creating an OCI Compartment.
3. Click Add Another Ingress Rule to add an Ingress rule as described in Table 10-5 (repeat for each Ingress rule).
4. Click Create Security List.

1. Ensure that you are using the latest version of Python by using the following command:

   python -V

   If you are using Python version 3.6, switch to the latest version by using the command:

   sudo alternatives --set python3 /usr/bin/python3.9

   Check the version again.

   Failure to do check the version may result in cryptography errors when you run the kubectl commands.

   If Python 3.9 is not available, then install it using the command:

   sudo yum install -y python39

2. Install OCI CLI.

   bash -c "$(curl -L https://raw.githubusercontent.com/oracle/oci-cli/master/scripts/install/install.sh)"

3. Respond to the prompts from the installation script.
4. To download kubeconfig later, after the set up, you need to set up the oci config file. Run the following command and enter the details when prompted:

   oci setup config

   Sample Setup:

   $ oci setup config
       This command provides a walk through of creating a valid CLI config file.
     
       The following links explain where to find the information required by this
       script:
     
       User API Signing Key, OCID and Tenancy OCID:
     
           https://docs.cloud.oracle.com/Content/API/Concepts/apisigningkey.htm#Other
     
       Region:
     
           https://docs.cloud.oracle.com/Content/General/Concepts/regions.htm
     
       General config documentation:
     
           https://docs.cloud.oracle.com/Content/API/Concepts/sdkconfig.htm
    
   Enter a location for your config [/home/opc/.oci/config]:
   Enter a user OCID: ocid1.user.oc1..xxxxxxxxxxx
   Enter a tenancy OCID: ocid1.tenancy.oc1..xxxxxxxxx
   Enter a region (e.g. ap-hyderabad-1, ap-melbourne-1, ap-mumbai-1, ap-osaka-1, ap-seoul-1, ap-sydney-1, ap-tokyo-1, ca-montreal-1, ca-toronto-1, eu-amsterdam-1, eu-frankfurt-1, eu-zurich-1, me-jeddah-1, sa-saopaulo-1, uk-gov-london-1, uk-london-1, us-ashburn-1, us-gov-ashburn-1, us-gov-chicago-1, us-gov-phoenix-1, us-langley-1, us-luke-1, us-phoenix-1): us-phoenix-1
   Do you want to generate a new API Signing RSA key pair? (If you decline you will be asked to supply the path to an existing key.) [Y/n]: Y
   Enter a directory for your keys to be created [/home/opc/.oci]:
   Enter a name for your key [oci_api_key]:
   Public key written to: /home/opc/.oci/oci_api_key_public.pem
   Enter a passphrase for your private key (empty for no passphrase):
   Private key written to: /home/opc/.oci/oci_api_key.pem
   Fingerprint: 74:d2:f2:db:62:a9:c4:bd:9b:4f:6c:d8:31:1d:a1:d8
   Config written to /home/opc/.oci/config
     
     
       If you haven't already uploaded your API Signing public key through the
       console, follow the instructions on the page linked below in the section
       'How to upload the public key':
     
           https://docs.cloud.oracle.com/Content/API/Concepts/apisigningkey.htm#How2

5. The above command creates a keyfile called oci_api_key_public.pem in $HOME/.oci. Add this key to the Oracle Cloud Infrastructure Console.
   1. Log in to the Oracle Cloud Infrastructure Console.
   2. Select Profile and click User Settings.
   3. On the User Settings screen, select API Keys .
   4. Click Add API Key.
   5. Click Paste Public Key.
   6. Copy the contents of the oci_api_key_public.pem file to the Public Key block and click Add.
6. You now need to refer the Oracle Cloud Infrastructure Console to get the remaining steps to set up the bastion node. Each deployment is different:
   1. Log in to the Oracle Cloud Infrastructure Console for your tenancy.
   2. From the Kubernetes Cluster Summary screen, click Access Cluster. A screen will be displayed with the remaining steps. These steps will include:
      • Creating a directory for the kube file.
      • Accessing the Kubeconfig file for the cluster.
      • Adding an environment variable to point to the cluster. (You should also add this variable to the .bashrc file for persistence.)

      For example:

      Sample Cluster Access Steps on the bastion node

      $ oci -v

      $ mkdir -p $HOME/.kube

      $ oci ce cluster create-kubeconfig --cluster-id ocid1.cluster.oc1.xxxxx --file $HOME/.kube/config --region us-phoenix-1 --token-version 2.0.0

      $ export KUBECONFIG=$HOME/.kube/config

      $ echo "export KUBECONFIG=$HOME/.kube/config" > $HOME/.bashrc

7. Install the kubectl client to access the cluster from the bastion node.

   Enter the following commands to download the kubectl client:

   $ curl -LO https://storage.googleapis.com/kubernetes-release/release/v1.20.8/bin/linux/amd64/kubectl
   $ sudo mv kubectl  /bin/
   $ sudo chmod +x /bin/kubectl

   Note:

   Download the version appropriate to the version of Kubernetes you selected at the time of creating the OKE cluster. See Creating an OKE Cluster in OCI.

   If you are unsure of the Kubernetes version:

   1. Log in to the Oracle Cloud Infrastructure Console.
   2. Select Developer Services (located in Solutions and Platform), and then click Kubernetes Clusters.
8. Validate that kubectl works by using the following command:

   kubectl get nodes

Helm is required by the WebLogic Operator and Oracle Unified Directory. To install Helm on to the bastion node, run the following commands:

$ curl -fsSL -o get_helm.sh
      https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3
$ chmod 700 get_helm.sh
$ ./get_helm.sh
$ helm version
version.BuildInfo{Version:"v3.13.1",
GitCommit:"3547a4b5bf5edb5478ce352e18858d8a552a4110", 
GitTreeState:"clean", GoVersion:"go1.20.8"}

Git contains sample code to deploy Oracle Fusion Middleware on Kubernetes. Install GIT using the following command:

sudo yum install git -y

For security reasons, the Oracle HTTP Server is not installed inside the Kubernetes cluster. To install the Oracle HTTP Server, you need to install the X11 packages to enable X11 forwarding. Use the following command to install the X11 packages:

sudo yum install -y libXrender libXtst xauth xterm nc

sudo yum install -y openldap java

For information about using automation scripts, see Automating the Identity and Access Management Enterprise Deployment.

1. Open /etc/ssh/sshd_config in your preferred editor.

   sudo vi /etc/ssh/sshd_config

2. Search for the line that has "X11UseLocalhost yes" (it is commented out).
3. Remove the comment from the beginning of the line.
4. Change the yes to no.
5. Save the file.
6. Restart SSHD by using the following command:

   sudo systemctl restart sshd

For security reasons, the Oracle HTTP Server is not installed inside the Kubernetes cluster. To install the Oracle HTTP Server, you have to install the X11 packages to enable X11 forwarding.

Use the following commands to install the X11 packages:

sudo yum repolist

sudo yum install -y libXrender libXtst xauth xterm nc xorg-x11*

The Oracle HTTP Server requires additional packages to be present as part of the installation. Use the following command to install these additional packages:

sudo yum install -y libaio-devel* compat-libstdc++-* compat-libcap* gcc-c++-* ksh* libnsl*

1. Open /etc/ssh/sshd_config in your preferred editor.
2. Search for the line that has "X11UseLocalhost yes" (it is commented out).
3. Remove the comment from the beginning of the line.
4. Change the yes to no.
5. Save the file.
6. Restart SSHD by using the following command:

   sudo systemctl restart sshd

You may also need to install additional Linux packages required to install the Oracle HTTP server, as well as setting the kernel parameters. See Preparing the Kubernetes Host Computers for an Enterprise Deployment.

The compute instance is created using an Oracle Linux image. The image comes with a built-in firewall, which is enabled by default. Even though you have security rules defined in your network, the Linux server rejects these requests because of the built-in Linux firewall.

You can decide to use this extra firewall or rely on your OCI security rules.

• Opening the Ports in the Firewall
  
• Disabling the Firewall
  

It is not good practice to install the Oracle software using the OPC user. It is better to create a custom user to own the software. You can create a custom user by running the following commands:

sudo adduser -u 1001 oracle
sudo groupadd -g 1002 oinstall
sudo usermod -a -G oinstall oracle 
sudo usermod -g oinstall oracle

The nature of the networks in an OCI environment means that the Oracle HTTP Server instances will not have access to the public load balancer. This can cause issues when the Oracle HTTP Server tries to access some virtual hosts.

In later sections, you will create a public load balancer for connections from the outside world to your system. See Creating a Public Load Balancer.

You will also create a private load balancer to allow you to route requests from the private subnets to this load balancer. See Creating a Private Load Balancer.

IP ADDRESS OF PRIVATE LOAD BALANCER login.example.com

10.0.2.7 login.example.com

1. From your desktop/laptop, install an 'X' Window server. For example: XQuartz for MacOS.
2. SSH to the bastion server by using the following command:

   ssh -AX opc@bastionserver

3. SSH to the web server by using the following command:

   ssh -AX oracle@webserver

1. Create the CA (certificate authority) private key by using the following command:

   openssl genrsa -out ca.key 2048

   Generating RSA private key, 2048 bit long modulus
   ....................+++
   .....+++
   e is 65537 (0x10001)

2. Create the Certificate Signing Request (CSR).

   openssl req -new -key ca.key -out ca.csr

   You are about to be asked to enter information that will be incorporated
   into your certificate request.
   What you are about to enter is what is called a Distinguished Name or a DN.
   There are quite a few fields but you can leave some blank
   For some fields there will be a default value,
   If you enter '.', the field will be left blank.
   -----
   Country Name (2 letter code) [XX]:CR
   State or Province Name (full name) []:SJO
   Locality Name (eg, city) [Default City]:
   Organization Name (eg, company) [Default Company Ltd]:mycompany
   Organizational Unit Name (eg, section) []:
   Common Name (eg, your name or your server's hostname) []:*.example.com
   Email Address []:
   Please enter the following 'extra' attributes
   to be sent with your certificate request
   A challenge password []:
   An optional company name []:

3. Create the CA SIGN certificate that will be used to sign the new certificates.

   openssl x509 -req -in ca.csr -signkey ca.key -out ca.crt

   Signature ok
   subject=/C=CR/ST=SJO/L=Default City/O=mycompany/CN=*.example.com
   Getting Private key

4. Create the private key for the load balancer.

   openssl genrsa -out loadbalancer.key 2048

   Generating RSA private key, 2048 bit long modulus
   ....................+++
   .....+++
   e is 65537 (0x10001)

5. Create the CSR for the load balancer.

   openssl req -new -key loadbalancer.key -out loadbalancer.csr

   You are about to be asked to enter information that will be incorporated
   into your certificate request.
   What you are about to enter is what is called a Distinguished Name or a DN.
   There are quite a few fields but you can leave some blank
   For some fields there will be a default value,
   If you enter '.', the field will be left blank.
   -----
   Country Name (2 letter code) [XX]:CR
   State or Province Name (full name) []:SJO
   Locality Name (eg, city) [Default City]:
   Organization Name (eg, company) [Default Company Ltd]:mycompany
   Organizational Unit Name (eg, section) []:
   Common Name (eg, your name or your server's hostname) []:*.example.com
   Email Address []:
   Please enter the following 'extra' attributes
   to be sent with your certificate request
   A challenge password []:
   An optional company name []:

6. Sign the certificate with the CA certificate.

   openssl x509 -req -in loadbalancer.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out loadbalancer.crt -days 50000

   Signature ok
   subject=/C=CR/ST=SJO/L=Default City/O=mycompany/CN=*.example.com
   Getting CA Private Key

7. Check that the certificate is signed by the CA.

   openssl x509 -in loadbalancer.crt -text

   Certificate:
   Data:
   Version: 1 (0x0)
   Serial Number:
   df:e7:c9:6a:56:e5:e4:c9
   Signature Algorithm: sha256WithRSAEncryption
   Issuer: Issuer: C=CR, ST=SJO, L=Default City, O=mycompany, CN=*.example.com <==== here signed by my ca..
   Validity
   Not Before: Dec 3 16:34:58 2019 GMT
   Not After : Oct 25 16:34:58 2156 GMT
   Subject: =/C=CR/ST=SJO/L=Default City/O=mycompany/CN=*.example.com
   Subject Public Key Info:
   Public Key Algorithm: rsaEncryption
   Public-Key: (2048 bit)
   Modulus:
   00:da:62:ce:69:77:ff:45:b0:84:9f:af:53:44:97:
   13:28:91:44:cd:0b:1d:e5:a1:f6:a3:ef:f8:98:19:
   8d:c2:56:a0:e1:80:1c:e0:0e:ae:34:9a:a8:ae:52:
   d4:71:a4:da:10:8b:fd:df:73:0d:8e:98:ef:d4:7b:
   36:f1:1c:5a:d7:24:88:63:f5:b2:6b:7a:62:50:3a:
   e7:3a:3d:9a:b7:41:db:8e:f5:e8:91:46:48:cf:0c:
   54:da:7b:da:20:76:b6:eb:4b:cb:fa:36:09:f7:94:
   ea:c9:53:3f:b2:bc:66:4c:6d:7f:3f:09:cc:cd:c2:
   10:1f:39:0f:6c:1d:49:7c:db:99:d9:d9:7d:48:dd:
   09:52:50:9d:f5:44:fd:2e:48:f2:78:22:20:3c:07:
   b6:a1:4d:f8:17:82:67:a1:45:52:0a:21:78:ed:1b:
   ca:45:79:16:21:c9:e3:2f:a4:93:d4:bf:67:68:7a:
   b6:d9:8f:e1:53:35:31:a6:17:38:f2:a6:79:b5:12:
   6b:36:f2:2d:69:56:c2:d9:c0:89:d9:31:6b:06:0c:
   1e:ba:a6:30:88:32:7b:92:e4:af:11:ab:37:1a:cb:
   cf:4b:4c:7d:ff:a7:4d:f8:be:cd:98:17:63:83:06:
   cf:e7:ae:4a:d5:6e:6b:e4:0d:f3:6f:70:52:2b:8b:
   12:83
   Exponent: 65537 (0x10001)
   Signature Algorithm: sha256WithRSAEncryption
   d8:36:2e:2e:42:72:76:15:ec:a8:3a:e9:dd:2d:2e:28:42:97:
   48:4e:6f:33:ec:df:3e:a3:11:19:8b:62:d5:89:07:af:b5:ff:
   b6:de:d7:5c:8b:7a:46:37:46:da:b7:44:7f:b6:cc:c8:a9:1e:
   f9:ca:0f:76:2b:29:d2:4c:6a:af:18:9b:1a:62:42:87:e6:21:
   b7:09:15:8d:b3:1d:05:4a:4d:1b:d1:07:00:cd:69:40:92:ed:
   f9:3d:24:c9:b7:b9:00:7e:c3:f9:73:42:7f:13:34:a8:d1:e4:
   32:91:08:51:07:a5:d0:ab:42:fb:83:c4:a7:b5:94:0f:2a:56:
   8b:95:34:1b:63:5b:39:59:88:9b:9f:34:91:98:dc:8c:0a:0e:
   01:f9:b2:6e:fd:2e:95:28:4c:76:dd:fe:a0:3f:f1:16:3b:88:
   cd:e5:0a:f3:dd:52:0d:39:2a:60:2c:f0:5d:79:3b:7e:99:43:
   3b:47:33:85:f9:7c:f1:e8:cb:3d:cd:ab:4c:1f:a2:72:99:70:
   f4:8d:92:4a:24:9e:37:96:ad:24:d5:13:33:05:32:ae:d5:58:
   ed:3e:32:6f:a7:1e:a8:61:a5:fb:73:ea:54:46:b7:07:77:07:
   9a:9d:af:eb:66:5c:55:f1:50:23:fb:da:d9:b7:4b:0b:6d:bb:
   c7:39:18:ae
   -----BEGIN CERTIFICATE-----
   MIIDUDCCAXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXAQsFADBaMQswCQYDVQQGEwJD
   UjEMMAoGA1UECAwDU0pPMRUwEwYDVQQHDAxEZWZhdWx0IENpdHkxDzANBgNVBAoM
   Bm9yYWNsZTEVMBMGA1UEAwwMKi5vcmFjbGUuY29tMCAXDTE5MTIwMzE2MzQ1OFoY
   DzIxNTYxMDI1MTYzNDU4WjB4MQswCQYDVQQGEwJDUjEMMAoGA1UECAwDU0pPMRUw
   EwYDVQQHDAxEZWZhdWx0IENpdHkxHDAaBgNVBAoME0RlZmF1bHQgQ29tcGFueSBM
   dGQxDzANBgNVBAsMBm9yYWNsZTEVMBMGA1UEAwwMKi5vcmFjbGUuY29tMIIBIjAN
   BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2mLOaXf/RbCEn69TRJcTKJFEzQsd
   5aH2o+/4mBmNwlag4YAc4A6uNJqorlLUcaTaEIv933MNjpjv1Hs28Rxa1ySIY/Wy
   a3piUDrnOj2at0HbjvXokUZIzwxU2nvaIHa260vL+jYJ95TqyVM/srxmTG1/PwnM
   zcIQHzkPbB1JfNuZ2dl9SN0JUlCd9UT9LkjyeCIgPAe2oU34F4JnoUVSCiF47RvK
   RXkWIcnjL6ST1L9naHq22Y/hUzUxphc48qZ5tRJrNvItaVbC2cCJ2TFrBgweuqYw
   iDJ7kuSvEas3GsvPS0x9/6dN+L7NmBdjgwbP565K1W5r5A3zb3BSK4sSgwIDAQAB
   MA0GCSqGSIb3DQEBCwUAA4IBAQDYNi4uQnJ2FeyoOundLS4oQpdITm8z7N8+oxEZ
   i2LViQevtf+23tdci3pGN0bat0R/tszIqR75yg92KynSTGqvGJsaYkKH5iG3CRWN
   sx0FSk0b0QcAzWlAku35PSTJt7kAfsP5c0J/EzSo0eQykQhRB6XQq0L7g8SntZQP
   KlaLlTQbY1s5WYibnzSRmNyMCg4B+bJu/S6VKEx23f6gP/EWO4jN5Qrz3VINOSpg
   LPBdeTt+mUM7RzOF+Xzx6Ms9zatMH6JymXD0jZJKJJ43lq0k1RMzBTKu1VjtPjJv
   px6oYaX7c+pURrcHdweana/rZlxV8VAj+9rZt0sLbbvHORiu
   -----END CERTIFICATE-----

1. Log in to the Oracle Cloud Infrastructure Console for your tenancy.
2. Navigate to Networking and click Virtual Cloud Networks.
3. Click the VCN Name that looks similar to oke-vcn-quick-clustername-id.
4. Select Security Lists from the list of resources.
5. Click Create Security List.
6. Enter the following details:
   • Name: Enter a name for the security list. For example: public-lbr-seclist.
   • Compartment: Select the name of the compartment you created earlier. See Creating an OCI Compartment.
7. Click Add Another Ingress Rule to add an Ingress rule as described in Table 10-9 (repeat for each Ingress rule).
8. Click Add Another Egress Rule to add an Egress rule as described in Table 10-9 (repeat for each Egress rule).
9. Click Create Security List.

1. Log in to the Oracle Cloud Infrastructure Console for your tenancy.
2. Navigate to Networking and click Virtual Cloud Networks.
3. Click the VCN Name that looks similar to oke-vcn-quick-clustername-id.
4. Select Route Tables from the list of resources.
5. Click Create Route Table.
6. Enter the following details:
   • Name: Enter a name for the route table. For example: lbr-route-table.
   • Compartment: Select the name of the compartment you created earlier. See Creating an OCI Compartment.
7. Click Add Another Route Rule .
8. Enter the following information:
   • Target Type: Select Internet Gateway.
   • Destination CIDR: Enter 0.0.0.0/0.
   • Compartment: Select the name of the compartment you created earlier. See Creating an OCI Compartment.
   • Target Internet Gateway: Select the internet gateway. For example: oke-igw-quick-clustername-id.
9. Click Create.

1. Log in to the Oracle Cloud Infrastructure Console for your tenancy.
2. Navigate to Networking and click Virtual Cloud Networks.
3. Click the VCN Name that looks similar to oke-vcn-quick-clustername-id.
4. Click Create Subnet.
5. Enter the following details:
   • Name: Enter a name for the subnet. For example: lbr-subnet1.
   • Subnet Type: Select Regional.
   • Availability Domain: Select an availability domain.
   • CIDR Block: Select the subnet you want to use for the load balancer network. For example: 10.0.4.0/24.
   • Route Table: Select the route table you created earlier. For example: lbr-route-table. See Creating a Route Table.
   • Subnet Access: Select Public Subnet.
   • DNS Resolution: Select Use DNS Hostnames in the subnet.
   • DHCP Options: Select Default DHCP Options for the VCN.
   • Security List: Select the public security list you created earlier. For example: public-lbr-seclist. See Creating a Security List.
6. Click Create Subnet.

1. Log in to the Oracle Cloud Infrastructure Console for your tenancy.
2. Navigate to Networking and click Load Balancers.
3. Click Create Load Balancer.
4. Select Load Balancer and click Create Load Balancer.
5. Enter the following information:
   • Name: Enter a name for the load balancer. For example: public-loadbalancer.
   • Visibility Type: Select Public.
   • Select Assign a Public IP Address and Ephemeral IP Address unless you want to use a specific IP address, in which case select Reserved IP Address.
   • Shapes: Select Flexible Shape.
   • Bandwidth: Select the anticipated bandwidth.
   • Virtual Cloud Network: Select the Virtual Cloud Network.
   • Subnet: Select both the load balancer subnets you created earlier. See Creating Subnets for the Load Balancer.
6. Click Next.
7. On the Choose Back Ends screen, select your preferred Load Balancing Policy.
8. Click Add Back Ends.
   1. Select Web Server Instances.
   2. Click Add Selected Back Ends.
   3. Change the port to the listen port for Oracle HTTP Server. For example: 7777.
9. In the Specify Health Check Policy screen, change the port to the HTTP server port. For example: 7777.
10. Click Show Advanced Options and enter a name for the back-end set. For example: ohs_servers.
11. Click Next.
12. On the Configure Listener screen, enter the following information:

    Note:

    You will need one listener for each entry point. However, you can add only one listener at this point.

    • Name: Select a name for the listener. For example: iadadmin.
    • Traffic Type: Select the traffic type the listener uses. iadadmin.example.com uses HTTP.
    • Port: Select the load balancer port. iadadmin.example.com uses port 80.
13. Click Next.
14. In the Manage Logging screen, ensure that Create a New Log Group is selected.
15. Change Name. For example: Public_Lbr.
16. Change Log Name. For example: Public_lbr_error.
17. Click Submit.

1. Log in to the Oracle Cloud Infrastructure Console for your tenancy.
2. Navigate to Networking and click Load Balancers.
3. Click the load balancer. For example: public_loadbalancer.
4. Select Certificates from the resource list.
5. Select Load Balancer Managed Certificate.
6. Click Add Certificate.
7. Enter the following information. You can either upload the files directly or paste the contents of the files.
   • Certificate Name: Enter a name for the certificate. For example: Loadbalancer.
   • SSL Certificate: Include the contents of the loadbalancer.crt file.
   • CA Certificate: Select the Specify CA Certificate check box to include the contents of the ca.crt file.
   • Private Key: Select the Specify Private Key check box to include the contents of the loadbalancer.key file.

   See Creating a Self-Signed Certificate.

8. Click Add Certificate.

1. Log in to the Oracle Cloud Infrastructure Console for your tenancy.
2. Navigate to Networking and click Load Balancers.
3. Click the load balancer. For example: public_loadbalancer.
4. Select Hostnames from the resource list.
5. Click Create Hostname.
6. Enter the following information:
   • Name: Enter a name for the host name. For example: iadadmin.
   • Hostname: Enter the fully qualified host name. For example: iadadmin.example.com.
7. Click Create.
8. Repeat for each host name to be created.

1. Log in to the Oracle Cloud Infrastructure Console for your tenancy.
2. Navigate to Networking and click Load Balancers.
3. Click the load balancer. For example: public_loadbalancer.
4. Select Listeners from the resource list.
5. Click Create Listener.
6. Enter the following information:
   • Name: Enter a name for the listener. For example: login.
   • Protocol: Select https.
   • Port: Specify 443.
   • Certificate Name: Ensure that the certificate you created for the load balancer is displayed. If not displayed, select the certificate.

     Note:

     This option will be available only if you use the HTTPS protocol.
   • Hostname: Select login.
   • Backend Set: Select the back end set. For example: ohs_servers.
7. Click Create Listener.
8. Repeat the steps to create the remaining listeners.

1. Log in to the Oracle Cloud Infrastructure Console for your tenancy.
2. Navigate to Networking and click Load Balancers.
3. Click the load balancer. For example: public-loadbalancer.
4. Select Listeners from the resource list.
5. To edit the listener, click the three dots next to the name, and then click Edit.
6. Set the host name to the host name you created earlier. For example: iadadmin. See Creating Host Names.
7. Click Update Listener.

1. Log in to the Oracle Cloud Infrastructure Console for your tenancy.
2. Navigate to Networking and click Load Balancers.
3. Click Create Load Balancer.
4. Select Load Balancer and click Create Load Balancer.
5. Enter the following information:
   • Name: Enter a name for the load balancer. For example: internal-loadbalancer.
   • Visibility Type: Select Private.
   • Shapes: Select Flexible Shape.
   • Bandwidth: Select the anticipated bandwidth.
   • Virtual Cloud Network: Select the Virtual Cloud Network.
   • Subnet: Select the same subnet as the web servers. For example: web-subnet. See Creating Subnets for the Load Balancer.
6. Click Next.
7. On the Choose Back Ends screen, select your preferred Load Balancing Policy.
8. Click Add Back Ends.
   1. Select Web Server Instances.
   2. Click Add Selected Back Ends.
   3. Change the port to the listen port for Oracle HTTP Server. For example: 7777.
9. In the Specify Health Check Policy screen, change the port to the HTTP server port. For example: 7777.
10. Click Show Advanced Options and enter a name for the back-end set. For example: ohs_servers.
11. Click Next.
12. On the Configure Listener screen, enter the following information:
    • Name: Select a name for the listener. For example: igdinternal.
    • Traffic Type: Select the traffic type the listener uses. igdinternal uses HTTP.
    • Port: Select the load balancer port. igdinternal uses port 7777.
13. Click Next.
14. In the Manage Logging screen, ensure that Create a New Log Group is selected.
15. Click Submit.

1. Log in to the Oracle Cloud Infrastructure Console for your tenancy.
2. Navigate to Networking and click Load Balancers.
3. Click the load balancer. For example: internal_loadbalancer.
4. Select Hostnames from the resource list.
5. Click Create Hostname.
6. Enter the following information:
   • Name: Enter a name for the host name. For example: igdinternal.
   • Hostname: Enter the fully qualified host name. For example: igdinternal.example.com.
7. Click Create.
8. Repeat Steps 5 through 7 to create each of the required host names.

1. Log in to the Oracle Cloud Infrastructure Console for your tenancy.
2. Navigate to Networking and click Load Balancers.
3. Click the load balancer. For example: internal_loadbalancer.
4. Select Listeners from the resource list.
5. To edit the listener, click the three dots next to the name, and then click Edit.
6. Set the host name to the host name you created earlier. For example: igdinternal. See Creating Host Names.
7. Click Update Listener.

1. Log in to the Oracle Cloud Infrastructure Console for your tenancy.
2. Navigate to Networking and click Load Balancers.
3. Click the load balancer. For example: internal_loadbalancer.
4. Select Certificates from the resource list.
5. Click Add Certificate.
6. Enter the following information. You can either upload the files directly or paste the contents of the files.
   • Name: Enter a name for the certificate. For example: Loadbalancer.
   • SSL Certificate: Include the contents of the loadbalancer.crt file.
   • CA Certificate: Select the Specify CA Certificate check box to include the contents of the ca.crt file.
   • Private Key: Select the Specify Private Key check box to include the contents of the loadbalancer.key file.

   See Creating a Self-Signed Certificate.

7. Click Add Certificate.

1. Log in to the Oracle Cloud Infrastructure Console for your tenancy.
2. Navigate to Networking and click Load Balancers.
3. Click the load balancer. For example: internal_loadbalancer.
4. Select Listeners from the resource list.
5. Click Create Listener.
6. Enter the following information:
   • Name: Enter a name for the listener. For example: login.example.com.
   • Protocol: Select HTTPS.
   • Port: Specify 443.
   • Certificate Name: Ensure that the certificate you created for the load balancer is displayed. If not displayed, select the certificate.
   • Hostname: Select login.
   • Backend Set: Select the back end set. For example: ohs_servers.
7. Click Create Listener.