Skip to main content

Infrastructure as Code

The AI Optimizer includes OpenTofu infrastructure as code (IaC) in the opentofu/ directory for deploying into Oracle Cloud Infrastructure (OCI). You can either deploy the IaC from OCI Resource Manager or from a local checkout using OpenTofu or Terraform.

The stack provisions compute, networking, load balancer, Oracle AI Database resources, and the AI Optimizer platform. It can provision a new Autonomous Database or connect the deployment to an existing Autonomous Database or other Oracle database.

OCI Resource Manager​

To get started with OCI Resource Manager, select Deploy to Oracle Cloud:

Deploy to Oracle Cloud

Terms​

After signing in to OCI, review and accept the terms.

Resource Manager stack information

Select Next to configure variables.

Deployment Type​

Choose the deployment type that suits your use case, then select it under Infrastructure to Deploy.

DeploymentUse case
AlwaysFreeAn Always Free-compatible VM deployment with a free-tier Autonomous Database.
VMAn all-in-one Server and Client deployment for development or small-scale use.
KubernetesSeparate Server and Client deployments on Oracle Kubernetes Engine (OKE).

Resource Manager infrastructure selection

Options​

The available compute, database, networking, and load-balancer options depend on the selected deployment type. The following sections highlight the common configuration choices.

Models and Compute​

VM deployments can use a GPU shape. Kubernetes deployments can add a GPU node pool. A VM deployment can also install Ollama and pull the default models; CPU-only Ollama deployments are intended for development use. For model configuration after deployment, see AI Models.

Models Needed

GPU deployments install Ollama and pull the default models. For a CPU VM deployment, select Install Ollama to do the same; otherwise, configure a model before using model-dependent features.

Network​

Access Control for Application GUI controls browser access to the Client, and Access Control for Application API Server controls direct access to the Server API. Both values accept comma-separated CIDR ranges. Their default, 127.0.0.0/8, does not permit access from external client networks.

Access Denied

The default access-control values block external clients. Before using the Client or Server, replace them with the smallest CIDR ranges required for your client networks. For an individual workstation, use a single-host /32 range.

To use the Client, set Access Control for Application GUI under Load Balancer Options to the smallest CIDR ranges required for your users. If users or applications call the Server API directly, also set Access Control for Application API Server. Application access-control settings

For example:

192.168.1.0/24,10.0.0.0/16,203.0.113.42/32

Database​

To provision a new Autonomous Database, leave Bring Your Own Oracle Database? unselected. To connect to an existing Autonomous Database or other Oracle database, select it, choose the value under Bring Your Own Database - Type, and provide its connection details.

Kubernetes API Endpoint​

For OKE, leave API Endpoint Access Control empty when deploying through Resource Manager.

OKE API endpoint access-control settings

TLS​

The stack terminates TLS at the load balancer. Set TLS Termination to one of the following:

  • none for HTTP only.
  • self-signed to generate a certificate. Retrieve the sensitive ssl_ca_certificate stack output and add it to the trust store of browsers, operating systems, or other clients that connect to the deployment.
  • provided to supply PEM-encoded certificate and private-key content.

Load-balancer TLS settings

For the application's other TLS deployment options, see TLS / HTTPS.

Review and Apply​

Review the plan and costs, then select Apply to create the stack.

Resource Manager review and apply

Outputs​

After the apply job succeeds, use the stack outputs to open the Client or Server API URL. The Server output points to its OpenAPI documentation. Initial image pulls and application startup can take several minutes after the infrastructure job completes. If a URL is not ready, wait a few minutes and try again.

Resource Manager outputs

Clean Up​

To remove a Resource Manager deployment, open its stack in OCI and select Destroy.

OpenTofu​

Use OpenTofu or Terraform 1.5 or later when deploying from a local checkout. Before continuing, follow the OpenTofu README to configure prerequisites and OCI credentials. Then start from the example closest to your deployment:

ExampleDeployment
vm-new-adb.tfvarsVM with a new Autonomous Database
vm-byo-adb.tfvarsVM with an existing Autonomous Database
vm-byo-other-db.tfvarsVM with another Oracle database
k8s-new-adb.tfvarsOKE with a new Autonomous Database
k8s-byo-other-db.tfvarsOKE with another Oracle database
always-free.tfvarsAlways Free VM and Autonomous Database

If you choose an OKE example, set k8s_api_endpoint_allowed_cidrs to a reachable source CIDR, typically your public IP address with a /32 suffix.

The example files contain placeholders. Copy one to terraform.tfvars, replace the OCI and database values, then run:

cd opentofu
cp examples/vm-new-adb.tfvars terraform.tfvars
tofu init
tofu plan
tofu apply

Clean Up​

To remove a local deployment, run:

cd opentofu
tofu destroy

Review the destruction plan before confirming it. This removes resources managed by the stack.