OCI VCN

Deploys an Oracle Cloud Infrastructure Virtual Cloud Network (VCN) with optional Internet, NAT, and Service Gateways. The VCN supports multiple CIDR blocks, IPv6, and DNS hostnames. Each gateway is controlled by a boolean toggle and only provisioned when enabled.

What Gets Created

When you deploy an OciVcn resource, OpenMCF provisions:

• Virtual Cloud Network — an oci_core_vcn resource in the specified compartment with one or more CIDR blocks, optional DNS label, and optional IPv6 prefix. OCI automatically creates a default route table, default security list, and default DHCP options alongside the VCN.
• Internet Gateway — created only when isInternetGatewayEnabled is true. Provides direct inbound and outbound internet access for resources in public subnets.
• NAT Gateway — created only when isNatGatewayEnabled is true. Allows resources in private subnets to initiate outbound internet connections without accepting inbound traffic.
• Service Gateway — created only when isServiceGatewayEnabled is true. Provides private access to OCI services (Object Storage, etc.) without traffic leaving the Oracle backbone network. Automatically configured for all services in the Oracle Services Network.

Prerequisites

• OCI credentials configured via environment variables or OpenMCF provider config (API Key, Instance Principal, Security Token, Resource Principal, or OKE Workload Identity)
• A compartment OCID where the VCN and gateways will be created — either a literal value or a reference to an OciCompartment resource
• A CIDR plan — at least one IPv4 CIDR block between /16 and /30

Quick Start

Create a file vcn.yaml:

apiVersion: oci.openmcf.org/v1
kind: OciVcn
metadata:
  name: my-vcn
  labels:
    openmcf.org/provisioner: pulumi
    pulumi.openmcf.org/organization: my-org
    pulumi.openmcf.org/project: my-project
    pulumi.openmcf.org/stack.name: dev.OciVcn.my-vcn
spec:
  compartmentId:
    value: "ocid1.compartment.oc1..example"
  cidrBlocks:
    - "10.0.0.0/16"

Deploy:

openmcf apply -f vcn.yaml

This creates a VCN with a single 10.0.0.0/16 CIDR block and no gateways. The VCN ID, default route table, default security list, and default DHCP options are exported as stack outputs for use by downstream resources such as OciSubnet.

Configuration Reference

Required Fields

Optional Fields

Examples

Minimal VCN

A VCN with a single CIDR block and no gateways — suitable for development or isolated workloads:

apiVersion: oci.openmcf.org/v1
kind: OciVcn
metadata:
  name: dev-vcn
  labels:
    openmcf.org/provisioner: pulumi
    pulumi.openmcf.org/organization: my-org
    pulumi.openmcf.org/project: my-project
    pulumi.openmcf.org/stack.name: dev.OciVcn.dev-vcn
spec:
  compartmentId:
    value: "ocid1.compartment.oc1..example"
  cidrBlocks:
    - "10.0.0.0/16"

VCN with Internet and NAT Gateways

A VCN for workloads that need both public-facing and private subnets. The Internet Gateway serves public subnets; the NAT Gateway gives private subnets outbound internet access:

apiVersion: oci.openmcf.org/v1
kind: OciVcn
metadata:
  name: web-vcn
  labels:
    openmcf.org/provisioner: pulumi
    pulumi.openmcf.org/organization: my-org
    pulumi.openmcf.org/project: my-project
    pulumi.openmcf.org/stack.name: staging.OciVcn.web-vcn
spec:
  compartmentId:
    value: "ocid1.compartment.oc1..example"
  cidrBlocks:
    - "10.0.0.0/16"
  displayName: "Web Tier VCN"
  dnsLabel: "webvcn"
  isInternetGatewayEnabled: true
  isNatGatewayEnabled: true

Full-Featured Production VCN

All gateways enabled, IPv6 for dual-stack workloads, multiple CIDRs for address segmentation, and DNS resolution for hostname-based communication:

apiVersion: oci.openmcf.org/v1
kind: OciVcn
metadata:
  name: prod-vcn
  labels:
    openmcf.org/provisioner: pulumi
    pulumi.openmcf.org/organization: my-org
    pulumi.openmcf.org/project: my-project
    pulumi.openmcf.org/stack.name: prod.OciVcn.prod-vcn
  env: prod
  org: acme
spec:
  compartmentId:
    value: "ocid1.compartment.oc1..example"
  cidrBlocks:
    - "10.0.0.0/16"
    - "172.16.0.0/16"
  displayName: "Production VCN"
  dnsLabel: "prodvcn"
  isIpv6Enabled: true
  isInternetGatewayEnabled: true
  isNatGatewayEnabled: true
  isServiceGatewayEnabled: true

Using Foreign Key References

Reference an OpenMCF-managed compartment instead of hardcoding the OCID:

apiVersion: oci.openmcf.org/v1
kind: OciVcn
metadata:
  name: ref-vcn
  labels:
    openmcf.org/provisioner: pulumi
    pulumi.openmcf.org/organization: my-org
    pulumi.openmcf.org/project: my-project
    pulumi.openmcf.org/stack.name: prod.OciVcn.ref-vcn
spec:
  compartmentId:
    valueFrom:
      kind: OciCompartment
      name: prod-compartment
      fieldPath: status.outputs.compartmentId
  cidrBlocks:
    - "10.0.0.0/16"
  isInternetGatewayEnabled: true
  isNatGatewayEnabled: true
  isServiceGatewayEnabled: true

Stack Outputs

After deployment, the following outputs are available in status.outputs:

Related Components

• OciSubnet — creates subnets within this VCN, with route table attachments for gateway routing
• OciSecurityGroup — manages network security rules for resources attached to this VCN
• OciCompartment — provides the compartment referenced by compartmentId via valueFrom