ARO HCP Reference Deployment

Reference Terraform and scripts for deploying Azure Red Hat OpenShift Hosted Control Plane (ARO HCP) on Azure (2026-06-30-preview API).

This repository uses reusable Terraform modules and a directory-per-cluster pattern (clusters/<name>/terraform.tfvars) for state isolation and lifecycle management.

Documentation map

I want to…	Start here
Deploy my first cluster quickly	Quick Start
Verify subscription, RBAC, and quota	Account Prerequisites
See least-privilege permissions per make target	Full-Stack Deployment — permissions by step
Configure Entra console OIDC	External Auth with Entra ID
Bootstrap GitOps and day-2 operators	GitOps bootstrap
Inspect Azure resources, RBAC scopes, and diagrams	Architecture
Network privacy (RFC1918 / Private Endpoints)	Architecture — Network privacy
Deploy ARO + OpenShift Virtualization (ANF + CNV)	Virt stack — two checkouts, clusters/aro-virt, sibling apply/bootstrap
Deploy virt E2E with a local AI agent	Quick start — OpenShift Virtualization (clone both repos; agent follows AGENTS.md + clusters/aro-virt/AGENTS.md)
Choose cluster profiles (public vs private)	Cluster configurations

Architecture at a glance

flowchart TB
  subgraph repo [This repository]
    Tfvars[clusters/name/terraform.tfvars]
    Terraform[terraform/ root module]
    Modules[modules/network identities cluster jumpbox]
  end

  subgraph azure [Azure subscription]
    RG[Customer resource group]
    Cluster[hcpOpenShiftClusters]
    Managed[Managed resource group]
  end

  Tfvars --> Terraform --> Modules
  Modules --> RG
  Modules --> Cluster
  Cluster --> Managed

Example cluster profiles

Profile	Example directory	Typical use
Public API + ingress	clusters/public/	Development, public console
Private API + ingress + jump	clusters/private/	RFC1918 API/ingress into the VNet; sshuttle via jump box
ARO + OpenShift Virtualization	clusters/aro-virt/	Same as public, plus node_pools.np-virt (Dsv6 Azure Boost, 8+ cores) and sibling ANF/CNV

Local preview

pip install -r requirements-docs.txt
make docs-preview

Open http://127.0.0.1:8000/validated-pattern-aro-hcp/.

Related

• GitHub repository