Update RDR SK Docs for v1.3

content/patterns/ramendr-starter-kit/_index.adoc

@@ -44,10 +44,29 @@ The setup process is relatively intricate; the goal of this pattern is to handle
 a functional DR-capable starting point for Virtual Machine workloads. In particular this pattern takes care to sequence
 installations and validate pre-requisites for all of the core components of the Disaster Recovery system.
 
-In particular, this pattern must be customized to specify DNS basedomains for the managed clusters, which makes 
-forking the pattern (which we generally recommend anyway, in case you want to make other customizations) effectively
-a requirement. The link:https://validatedpatterns/patterns/getting-started[**Getting Started**] doc has
-details on what needs to be changed and how to commit and push those changes.
+You might fork the repository to customize chart values (for example `aws.region` in
+link:https://github.com/validatedpatterns/ramendr-starter-kit/blob/main/charts/hub/rdr/values.yaml[`charts/hub/rdr/values.yaml`])
+or to select a non-default install variant. The link:/patterns/ramendr-starter-kit/getting-started/[Getting started] page describes variant
+selection, BYOC, required secrets, and verification steps.
+
+[id="install-variants"]
+=== Install variants
+
+The pattern ships three install variants under `variants/` in the repository. Set `main.variant` in
+link:https://github.com/validatedpatterns/ramendr-starter-kit/blob/main/values-global.yaml[`values-global.yaml`]
+before install. The default is `odf`.
+
+[cols="1,1,3",options="header"]
+|===
+| Variant | `main.variant` | Purpose
+| `odf` | `odf` (default) | Full {ocp-data-short} Regional DR with {VirtProductName} workloads, MirrorPeer, and failover-capable VMs
+| `drpartner-s4` | `drpartner-s4` | Partner CSI foundation with hub S4 object storage: OADP, {VirtProductName}, Ramen/Multicluster Orchestrator; infrastructure DRClusters and a `2m-novm` DRPolicy without DRPC or VMs; Submariner disabled
+| `drpartner-minimal` | `drpartner-minimal` | Partner CSI foundation without S4, Submariner, or DRCluster sync/validation: OADP, {VirtProductName}, and Ramen/Multicluster Orchestrator only (Hive or BYOC bring-up)
+|===
+
+Spoke configuration files nest under each variant as `variants/<variant>/values-<managedClusterGroup.name>.yaml`.
+See link:/patterns/ramendr-starter-kit/installation-details/#variant-installation-differences[Installation details] for what each variant deploys on the hub and managed clusters.
+For component schematics, connectivity paths, and TLS/CA handling, see link:/patterns/ramendr-starter-kit/architecture/[Architecture] and link:/patterns/ramendr-starter-kit/connectivity/[Connectivity].
 
 === Background
 
@@ -74,7 +93,20 @@ This pattern uses OpenShift Virtualization (the productization of Kubevirt) to s
 * HashiCorp Vault (Community Edition)
 * External Secrets Operator (Community Edition)
 
-=== Architecture
+=== Architecture overview
+
+The default `odf` variant deploys a three-cluster Regional DR layout with {ocp-data-short}, Submariner, DRPC-protected VMs, and failover workflows documented in link:/patterns/ramendr-starter-kit/getting-started/[Getting started].
 
 .ramendr-architecture-diagram
-image::/images/ramendr-starter-kit/ramendr-architecture.drawio.png[ramendr-starter-kit-architecture,title="RamenDR Starter Kit Architecture"]
+image::/images/ramendr-starter-kit/ramendr-architecture-odf.png[ramendr-starter-kit-architecture,title="RamenDR Starter Kit architecture (odf)"]
+
+draw.io source: link:/images/ramendr-starter-kit/ramendr-architecture-odf.drawio[`ramendr-architecture-odf.drawio`]
+
+Partner variants use different S3 and replication models. See link:/patterns/ramendr-starter-kit/architecture/[Architecture] for per-variant schematics and draw.io sources, and link:/patterns/ramendr-starter-kit/connectivity/[Connectivity] for hub-to-managed network paths and ports.
+
+=== Next steps
+
+* link:/patterns/ramendr-starter-kit/architecture/[Architecture] — Component schematics, TLS/CA, draw.io sources
+* link:/patterns/ramendr-starter-kit/connectivity/[Connectivity] — Hub-to-managed connectivity by variant
+* link:/patterns/ramendr-starter-kit/getting-started/[Getting started] — Prerequisites, variant selection, BYOC, and deployment
+* link:/patterns/ramendr-starter-kit/installation-details/[Installation details] — Install sequence and pattern scripts

content/patterns/ramendr-starter-kit/architecture.adoc

@@ -0,0 +1,105 @@
+---
+title: Architecture
+weight: 5
+aliases: /ramendr-starter-kit/architecture/
+---
+
+:toc:
+:imagesdir: /images
+:_content-type: ASSEMBLY
+include::modules/comm-attributes.adoc[]
+
+[id="ramendr-architecture"]
+= Architecture
+
+This page describes component schematics, connectivity overview diagrams, and TLS/CA handling for each install variant. For hub-to-managed network paths and ports, see link:/patterns/ramendr-starter-kit/connectivity/[Connectivity].
+
+[id="architecture-diagrams"]
+== Architecture diagrams
+
+Each install variant has a full hub/spoke schematic exported as PNG from draw.io source. PNG and draw.io files live in `static/images/ramendr-starter-kit/`.
+
+[cols="2,1,2,2",options="header"]
+|===
+| Diagram | Variant | PNG | draw.io source
+
+| `ramendr-architecture-odf`
+| `odf`
+| link:/images/ramendr-starter-kit/ramendr-architecture-odf.png[`ramendr-architecture-odf.png`]
+| link:/images/ramendr-starter-kit/ramendr-architecture-odf.drawio[`ramendr-architecture-odf.drawio`]
+
+| `ramendr-architecture-drpartner-s4`
+| `drpartner-s4`
+| link:/images/ramendr-starter-kit/ramendr-architecture-drpartner-s4.png[`ramendr-architecture-drpartner-s4.png`]
+| link:/images/ramendr-starter-kit/ramendr-architecture-drpartner-s4.drawio[`ramendr-architecture-drpartner-s4.drawio`]
+
+| `ramendr-architecture-drpartner-minimal`
+| `drpartner-minimal`
+| link:/images/ramendr-starter-kit/ramendr-architecture-drpartner-minimal.png[`ramendr-architecture-drpartner-minimal.png`]
+| link:/images/ramendr-starter-kit/ramendr-architecture-drpartner-minimal.drawio[`ramendr-architecture-drpartner-minimal.drawio`]
+
+| `hub-managed-connectivity`
+| All variants
+| link:/images/ramendr-starter-kit/hub-managed-connectivity-odf.png[`hub-managed-connectivity-odf.png`] (and per-variant tabs)
+| link:/images/ramendr-starter-kit/hub-managed-connectivity.drawio[`hub-managed-connectivity.drawio`]
+|===
+
+[id="architecture-odf"]
+=== `odf` schematic
+
+Full hub/spoke schematic. DRPolicies live on the hub with the RamenDR Hub Operator and become volume replications and volume group replications on the managed clusters. The hub operator orchestrates the RamenDR Cluster Operators, which manage those replications plus {ocp-data-short} and OpenShift ADP (Kubernetes object backups), along with Submariner and Edge GitOps VMs.
+
+.ramendr-architecture-odf
+image::/images/ramendr-starter-kit/ramendr-architecture-odf.png[RamenDR architecture for the odf variant,title="RamenDR Starter Kit architecture (odf)"]
+
+draw.io source: link:/images/ramendr-starter-kit/ramendr-architecture-odf.drawio[`ramendr-architecture-odf.drawio`]
+
+[id="architecture-drpartner-s4"]
+=== `drpartner-s4` schematic
+
+Hub S4 Object store for OpenShift ADP Kubernetes object backups. Partner CSI on the managed clusters provides VM data replication. DRPolicies live on the hub and become volume replications and volume group replications on the managed clusters. The RamenDR Hub Operator orchestrates the cluster operators. The pattern does not create DRPC or VMs.
+
+.ramendr-architecture-drpartner-s4
+image::/images/ramendr-starter-kit/ramendr-architecture-drpartner-s4.png[RamenDR architecture for the drpartner-s4 variant,title="RamenDR Starter Kit architecture (drpartner-s4)"]
+
+draw.io source: link:/images/ramendr-starter-kit/ramendr-architecture-drpartner-s4.drawio[`ramendr-architecture-drpartner-s4.drawio`]
+
+[id="architecture-drpartner-minimal"]
+=== `drpartner-minimal` schematic
+
+{rh-rhacm-first} and partner operators only. S3-compatible storage for OpenShift ADP is bring-your-own; this variant does not deploy S4. DRPolicies live on the hub and become volume replications and volume group replications on the managed clusters. The pattern does not create DR CRs.
+
+.ramendr-architecture-drpartner-minimal
+image::/images/ramendr-starter-kit/ramendr-architecture-drpartner-minimal.png[RamenDR architecture for the drpartner-minimal variant,title="RamenDR Starter Kit architecture (drpartner-minimal)"]
+
+draw.io source: link:/images/ramendr-starter-kit/ramendr-architecture-drpartner-minimal.drawio[`ramendr-architecture-drpartner-minimal.drawio`]
+
+[id="tls-and-ca"]
+== TLS and CA (current implementation)
+
+Certificate handling is delivered by external charts deployed via Argo CD, not local policy YAML in the pattern repository.
+
+[cols="2,3",options="header"]
+|===
+| Chart | Role
+
+| **vp-manage-proxy-cluster-ca**
+| Differential CA bundle for cluster API/ingress CAs (all variants)
+
+| **opp-policy-chart**
+| `s3CaInjector` injects `caCertificates` on Ramen `s3StoreProfiles` (`odf`, `drpartner-s4`)
+|===
+
+Chart overrides live in the pattern repository:
+
+* link:https://github.com/validatedpatterns/ramendr-starter-kit/blob/main/overrides/values-vp-manage-proxy-cluster-ca-hub.yaml[`overrides/values-vp-manage-proxy-cluster-ca-hub.yaml`]
+* link:https://github.com/validatedpatterns/ramendr-starter-kit/blob/main/overrides/values-vp-manage-proxy-cluster-ca-resilient.yaml[`overrides/values-vp-manage-proxy-cluster-ca-resilient.yaml`]
+
+Manual CA and cluster helpers live under `scripts/` in the pattern repository. Verify resource names against the live cluster before using examples that reference {rh-rhacm} policy names.
+
+[id="related-pages"]
+== Related pages
+
+* link:/patterns/ramendr-starter-kit/connectivity/[Connectivity] — Hub-to-managed paths, ports, and variant comparison
+* link:/patterns/ramendr-starter-kit/installation-details/[Installation details] — Variant installation differences and pattern scripts
+* link:/patterns/ramendr-starter-kit/getting-started/[Getting started] — Variant selection, BYOC, and deployment

content/patterns/ramendr-starter-kit/connectivity.adoc

@@ -0,0 +1,151 @@
+---
+title: Connectivity
+weight: 15
+aliases: /ramendr-starter-kit/connectivity/
+---
+
+:toc:
+:imagesdir: /images
+:_content-type: ASSEMBLY
+include::modules/comm-attributes.adoc[]
+
+[id="ramendr-connectivity"]
+= Hub-to-managed connectivity
+
+Three install variants (`main.variant` in `values-global.yaml`):
+
+* **odf** (default) — full {ocp-data-short} Regional DR; MCG S3 on managed clusters; Submariner required for Ceph RBD replication
+* **drpartner-s4** — partner CSI + hub S4; array-native volume replication; **Submariner disabled** (`submariner.enabled: false` in `opp-policy`)
+* **drpartner-minimal** — partner CSI operators and Hive/BYOC plumbing only; no S4, DRClusters, or Submariner
+
+Draw.io source with one tab per variant: link:/images/ramendr-starter-kit/hub-managed-connectivity.drawio[`hub-managed-connectivity.drawio`].
+
+[id="variant-comparison"]
+== Variant comparison
+
+[cols="2,1,1,1",options="header"]
+|===
+| Concern | odf | drpartner-s4 | drpartner-minimal
+
+| S3 / DR metadata | MCG buckets on each managed cluster | Hub S4 buckets (`vp-s4-storage`) | None
+| Hub S3 reachability | Hub → each managed MCG endpoint | Hub + managed → hub S4 | n/a
+| Peer S3 | Managed ↔ managed object-bucket metadata | Not used | Not used
+| Volume replication | {ocp-data-short}/Ceph over Submariner | VSA ↔ VSA (array-native) | External / out of pattern
+| Submariner | Required for Regional-DR volumes | **Disabled by default** | **Disabled**
+| DRClusters / DRPolicy | MirrorPeer / MCO / regionaldr | regionaldr (`infrastructureEnabled`) | None
+| DRPC / VMs | Yes (regionaldr resources) | No (`resourcesEnabled: false`) | No
+| {rh-rhacm} + DNS | Required | Required | Required
+|===
+
+[id="connectivity-odf"]
+== `odf`
+
+{rh-rhacm-first} needs DNS resolvability of managed cluster APIs. S3 metadata buckets (MCG) live **on each managed cluster** — hub and peers both reach those endpoints. **Submariner is required** for {ocp-data-short} RBD cross-site replication.
+
+.ramendr-hub-managed-connectivity-odf
+image::/images/ramendr-starter-kit/hub-managed-connectivity-odf.png[odf hub-to-managed connectivity,title="odf connectivity"]
+
+draw.io source: link:/images/ramendr-starter-kit/hub-managed-connectivity.drawio[`hub-managed-connectivity.drawio`] (**odf** tab).
+
+[id="managed-mcg-s3-detail"]
+=== Managed MCG S3 detail
+
+++++
+<pre class="mermaid">
+flowchart LR
+  Hub["Ramen Hub Operator"] --> MCG1["Primary MCG S3"]
+  Hub --> MCG2["Secondary MCG S3"]
+  MCG1 ---|"Peer metadata"| MCG2
+</pre>
+++++
+
+[id="connectivity-drpartner-s4"]
+== `drpartner-s4`
+
+{rh-rhacm-first} needs DNS resolvability of managed cluster APIs. S3 metadata lives on **hub S4** (`vp-s4-storage`). Volume DR is array-native (VSA ↔ VSA). The `regional-dr` application creates hub DRClusters and a `2m-novm` DRPolicy only — no DRPC or VMs. **Submariner is not deployed** (`values-opp-policy.yaml` sets `submariner.enabled: false`).
+
+.ramendr-drpartner-s4-connectivity
+image::/images/ramendr-starter-kit/drpartner-s4-connectivity.png[drpartner-s4 hub-to-managed connectivity,title="drpartner-s4 connectivity"]
+
+PNG from draw.io: link:/images/ramendr-starter-kit/hub-managed-connectivity-drpartner-s4.png[`hub-managed-connectivity-drpartner-s4.png`]. SVG source: link:/images/ramendr-starter-kit/drpartner-s4-connectivity.svg[`drpartner-s4-connectivity.svg`]. draw.io source: link:/images/ramendr-starter-kit/hub-managed-connectivity.drawio[`hub-managed-connectivity.drawio`] (**drpartner-s4** tab).
+
+[id="hub-s4-detail"]
+=== Hub S4 detail
+
+++++
+<pre class="mermaid">
+flowchart LR
+  Ramen["Ramen Hub Operator"] --> S4["Hub S4 buckets"]
+  P["Primary DR operator"] --> S4
+  S["Secondary DR operator"] --> S4
+</pre>
+++++
+
+No managed ↔ managed S3 and no Submariner in `drpartner-s4`.
+
+[id="connectivity-drpartner-minimal"]
+== `drpartner-minimal`
+
+{rh-rhacm-first} needs DNS resolvability of managed cluster APIs. The pattern deploys partner operators (MCO/Ramen, {VirtProductName}, OADP) and Hive/BYOC plumbing only — **no `vp-s4-storage`**, no DRClusters, no `s3StoreProfiles`, and **no Submariner**. Volume DR and S3 metadata are outside this pattern.
+
+.ramendr-drpartner-minimal-connectivity
+image::/images/ramendr-starter-kit/drpartner-minimal-connectivity.png[drpartner-minimal hub-to-managed connectivity,title="drpartner-minimal connectivity"]
+
+PNG from draw.io: link:/images/ramendr-starter-kit/hub-managed-connectivity-drpartner-minimal.png[`hub-managed-connectivity-drpartner-minimal.png`]. SVG source: link:/images/ramendr-starter-kit/drpartner-minimal-connectivity.svg[`drpartner-minimal-connectivity.svg`]. draw.io source: link:/images/ramendr-starter-kit/hub-managed-connectivity.drawio[`hub-managed-connectivity.drawio`] (**drpartner-minimal** tab).
+
+[id="shared-requirements"]
+== Shared requirements
+
+* **{rh-rhacm} + DNS** — Hub must resolve each managed cluster API hostname, then connect over HTTPS 443 / kube API 6443.
+* **TLS / CA trust** — Trust custom certs for S4 (`drpartner-s4`) or MCG endpoints (`odf`) via `opp-policy` `s3CaInjector` where S3 is used.
+* **Globalnet** — For `odf`, enable if managed cluster/service CIDRs overlap.
+
+[id="ports"]
+== Ports
+
+[cols="2,2,2",options="header"]
+|===
+| Path | When | Protocol / ports
+
+| Hub DNS → managed API | All variants | DNS UDP/TCP 53
+| Hub ↔ managed API | All variants | HTTPS 443; kube API 6443
+| Clients → hub S4 | `drpartner-s4` | HTTPS 443
+| Hub / peers → managed MCG | `odf` | HTTPS 443
+| Cluster ↔ local VSA | `drpartner-s4`, `drpartner-minimal` | Vendor CSI / iSCSI / NVMe / mgmt
+| VSA ↔ VSA replication | `drpartner-s4`, `drpartner-minimal` | Vendor replication ports
+| Submariner | `odf` only | UDP 4500 / 4800 / 4490
+|===
+
+[id="related-diagrams"]
+== Related diagrams
+
+[cols="2,2,2",options="header"]
+|===
+| Artifact | PNG | draw.io / other
+
+| Full component schematic (`odf`)
+| link:/images/ramendr-starter-kit/ramendr-architecture-odf.png[`ramendr-architecture-odf.png`]
+| link:/images/ramendr-starter-kit/ramendr-architecture-odf.drawio[`ramendr-architecture-odf.drawio`]
+
+| Full component schematic (`drpartner-s4`)
+| link:/images/ramendr-starter-kit/ramendr-architecture-drpartner-s4.png[`ramendr-architecture-drpartner-s4.png`]
+| link:/images/ramendr-starter-kit/ramendr-architecture-drpartner-s4.drawio[`ramendr-architecture-drpartner-s4.drawio`]
+
+| Full component schematic (`drpartner-minimal`)
+| link:/images/ramendr-starter-kit/ramendr-architecture-drpartner-minimal.png[`ramendr-architecture-drpartner-minimal.png`]
+| link:/images/ramendr-starter-kit/ramendr-architecture-drpartner-minimal.drawio[`ramendr-architecture-drpartner-minimal.drawio`]
+
+| Connectivity overview (`odf`)
+| link:/images/ramendr-starter-kit/hub-managed-connectivity-odf.png[`hub-managed-connectivity-odf.png`]
+| link:/images/ramendr-starter-kit/hub-managed-connectivity.drawio[`hub-managed-connectivity.drawio`]
+
+| Connectivity overview (`drpartner-s4`)
+| link:/images/ramendr-starter-kit/hub-managed-connectivity-drpartner-s4.png[`hub-managed-connectivity-drpartner-s4.png`]
+| link:/images/ramendr-starter-kit/drpartner-s4-connectivity.svg[`drpartner-s4-connectivity.svg`]
+
+| Connectivity overview (`drpartner-minimal`)
+| link:/images/ramendr-starter-kit/hub-managed-connectivity-drpartner-minimal.png[`hub-managed-connectivity-drpartner-minimal.png`]
+| link:/images/ramendr-starter-kit/drpartner-minimal-connectivity.svg[`drpartner-minimal-connectivity.svg`]
+|===
+
+See also link:/patterns/ramendr-starter-kit/architecture/[Architecture] for TLS/CA handling and full schematic context.