Validated Patterns

Hub-to-managed connectivity

Three install variants (main.variant in values-global.yaml):

  • odf (default) — full OpenShift Data Foundation Regional DR; MCG S3 on managed clusters; Submariner required for Ceph RBD replication

  • drpartner-s4 — partner CSI + hub S4; array-native volume replication; Submariner disabled (submariner.enabled: false in opp-policy)

  • drpartner-minimal — partner CSI operators and Hive/BYOC plumbing only; no S4, DRClusters, or Submariner

Draw.io source with one tab per variant: hub-managed-connectivity.drawio.

Variant comparison

Concernodfdrpartner-s4drpartner-minimal

S3 / DR metadata

MCG buckets on each managed cluster

Hub S4 buckets (vp-s4-storage)

None

Hub S3 reachability

Hub → each managed MCG endpoint

Hub + managed → hub S4

n/a

Peer S3

Managed ↔ managed object-bucket metadata

Not used

Not used

Volume replication

OpenShift Data Foundation/Ceph over Submariner

VSA ↔ VSA (array-native)

External / out of pattern

Submariner

Required for Regional-DR volumes

Disabled by default

Disabled

DRClusters / DRPolicy

MirrorPeer / MCO / regionaldr

regionaldr (infrastructureEnabled)

None

DRPC / VMs

Yes (regionaldr resources)

No (resourcesEnabled: false)

No

RHACM + DNS

Required

Required

Required

odf

Red Hat Advanced Cluster Management (RHACM) needs DNS resolvability of managed cluster APIs. S3 metadata buckets (MCG) live on each managed cluster — hub and peers both reach those endpoints. Submariner is required for OpenShift Data Foundation RBD cross-site replication.

odf hub-to-managed connectivity
Figure 1. odf connectivity

draw.io source: hub-managed-connectivity.drawio (odf tab).

Managed MCG S3 detail

flowchart LR
  Hub["Ramen Hub Operator"] --> MCG1["Primary MCG S3"]
  Hub --> MCG2["Secondary MCG S3"]
  MCG1 ---|"Peer metadata"| MCG2

drpartner-s4

Red Hat Advanced Cluster Management (RHACM) needs DNS resolvability of managed cluster APIs. S3 metadata lives on hub S4 (vp-s4-storage). Volume DR is array-native (VSA ↔ VSA). The regional-dr application creates hub DRClusters and a 2m-novm DRPolicy only — no DRPC or VMs. Submariner is not deployed (values-opp-policy.yaml sets submariner.enabled: false).

drpartner-s4 hub-to-managed connectivity
Figure 2. drpartner-s4 connectivity

PNG from draw.io: hub-managed-connectivity-drpartner-s4.png. SVG source: drpartner-s4-connectivity.svg. draw.io source: hub-managed-connectivity.drawio (drpartner-s4 tab).

Hub S4 detail

flowchart LR
  Ramen["Ramen Hub Operator"] --> S4["Hub S4 buckets"]
  P["Primary DR operator"] --> S4
  S["Secondary DR operator"] --> S4

No managed ↔ managed S3 and no Submariner in drpartner-s4.

drpartner-minimal

Red Hat Advanced Cluster Management (RHACM) needs DNS resolvability of managed cluster APIs. The pattern deploys partner operators (MCO/Ramen, OpenShift Virtualization, OADP) and Hive/BYOC plumbing only — no vp-s4-storage, no DRClusters, no s3StoreProfiles, and no Submariner. Volume DR and S3 metadata are outside this pattern.

drpartner-minimal hub-to-managed connectivity
Figure 3. drpartner-minimal connectivity

PNG from draw.io: hub-managed-connectivity-drpartner-minimal.png. SVG source: drpartner-minimal-connectivity.svg. draw.io source: hub-managed-connectivity.drawio (drpartner-minimal tab).

Shared requirements

  • RHACM + DNS — Hub must resolve each managed cluster API hostname, then connect over HTTPS 443 / kube API 6443.

  • TLS / CA trust — Trust custom certs for S4 (drpartner-s4) or MCG endpoints (odf) via opp-policy s3CaInjector where S3 is used.

  • Globalnet — For odf, enable if managed cluster/service CIDRs overlap.

Ports

PathWhenProtocol / ports

Hub DNS → managed API

All variants

DNS UDP/TCP 53

Hub ↔ managed API

All variants

HTTPS 443; kube API 6443

Clients → hub S4

drpartner-s4

HTTPS 443

Hub / peers → managed MCG

odf

HTTPS 443

Cluster ↔ local VSA

drpartner-s4, drpartner-minimal

Vendor CSI / iSCSI / NVMe / mgmt

VSA ↔ VSA replication

drpartner-s4, drpartner-minimal

Vendor replication ports

Submariner

odf only

UDP 4500 / 4800 / 4490

ArtifactPNGdraw.io / other

Full component schematic (odf)

ramendr-architecture-odf.png

ramendr-architecture-odf.drawio

Full component schematic (drpartner-s4)

ramendr-architecture-drpartner-s4.png

ramendr-architecture-drpartner-s4.drawio

Full component schematic (drpartner-minimal)

ramendr-architecture-drpartner-minimal.png

ramendr-architecture-drpartner-minimal.drawio

Connectivity overview (odf)

hub-managed-connectivity-odf.png

hub-managed-connectivity.drawio

Connectivity overview (drpartner-s4)

hub-managed-connectivity-drpartner-s4.png

drpartner-s4-connectivity.svg

Connectivity overview (drpartner-minimal)

hub-managed-connectivity-drpartner-minimal.png

drpartner-minimal-connectivity.svg

See also Architecture for TLS/CA handling and full schematic context.

Edit this page Open a documentation issue

QUICKLINKS

CONTRIBUTE

STAY IN TOUCH

Validated Patterns

Validated Patterns are an evolution of how you deploy applications in a hybrid cloud. With a pattern, you can automatically deploy a full application stack through a GitOps-based framework. With this framework, you can create business-centric solutions while maintaining a level of Continuous Integration (CI) over your application.