diff --git a/README.md b/README.md index 775f320..c167e19 100644 --- a/README.md +++ b/README.md @@ -1,742 +1,60 @@ # tf_hachef This terraform plan makes use of chef-backend and chef-server-core to create a -Chef HA architecture spread across multiple AWS availability zones within one -AWS region. Cross region deployment is not supported with this plan or with -chef-backend at this time. - -By default, this terraform plan will create a VPC, subnets, security groups, -security group rules, frontend nodes (chef-server-core), backend nodes -(chef-backend), and an AWS ELB comprised of the frontend nodes. - -This plan is rather large and complex. Be sure to read through the -[README](README.md) in full. - -## Assumptions - -This terraform plan is designed for near-production use. Please take note as -the requirements are extensive - -* Requires: - * AWS (duh!) - * Route53 internal and external zones - * Uploaded to AWS a SSL certificate (wildcard preferred) - * SSL certificate/key for created instance (local files to upload to instances) - * Terraform >= 0.7.3 -* Uses public IPs and public DNS -* Creates default security group as follows: - * Frontend: - * 443/tcp: HTTPS from anywhere - * 80/tcp: HTTP from anywhere - * Backend: - * ALL: inside security group - * 2379/tcp: etcd from Frontend SG - * 5432/tcp: PostgreSQL from Frontend SG - * 7331/tcp: leaderl from Frontend SG - * 9200/tcp: Elasticsearch from Frontend SG - * SSH Security Group: - * 22/tcp: SSH from anywhere (default), restrict with `${ssh_cidrs}` list -* Creates subnets spread across AWS AZs -* Minimum three (3) chef-backend instances required (`chef["backend_count"]`) -* Minimum two (2) chef-server-core instances required (`chef["frontend_count"]`) -* Understand Terraform and ability to read the source +Chef HA architecture. In order to support multiple providers and various +feature sets based upon provider this repo has a tree structure to help you +choose the right plan based on certain assumptions. -## Usage +# Providers +The following providers are currently supported: -### Module +* AWS -Usage as a module has not been tested, however in Terraform 0.7.0 many things -are first-class which were not before. Choose to run this way at your own risk +# Plans -### Directly +The following plans exist in this repo: -1. Clone this repo: `git clone https://github.com/mengesb/tf_hachef.git` -2. Make a local terraform.tfvars file: `cp terraform.tfvars.example terraform.tfvars` -3. Edit `terraform.tfvars` with your editor of choice, ensuring -`var.chef["accept_mlsa"]` is set to `true` -4. Test the plan: `terraform plan` -5. Apply the plan: `terraform apply` +* AWS w/valid SSL and Route53 internal/external zones - [providers/aws/route53_ssl/README.md](providers/aws/route53_ssl/README.md) -## Supported OSes +# Tree navigation -All supported OSes are 64-bit and HVM (though PV should be supported) +* providers + * aws + * route53_ssl + * ... future provider + * ... future feature set -* Ubuntu 12.04 LTS -* Ubuntu 14.04 LTS (default) -* Ubuntu 16.04 LTS (pending) -* CentOS 6 -* CentOS 7 (pending) -* Others (here be dragons! Please see Map Variables) +## Usage -## AWS -These resources will incur charges on your AWS bill. It is your responsibility -to delete the resources. +### Module + +Usage as a module has not been tested, however in Terraform 0.7.0+ many things +are first-class which were not before. Choose to run this way at your own risk + + +### Directly + +1. Clone this repo: `git clone https://github.com/mengesb/tf_hachef.git` +2. Navigate to the correct plan in the provider tree. +3. Make a local terraform.tfvars file: `cp terraform.tfvars.example terraform.tfvars` +4. Edit `terraform.tfvars` with your editor of choice, ensuring +`var.chef["accept_mlsa"]` is set to `true` +5. Test the plan: `terraform plan` +6. Apply the plan: `terraform apply` ## Recommendations -The defaults set forth in the [variables.tf](variables.tf) file have been set -for good reasons. Please note that a good amount of testing went into defining -these defaults and necessary inputs are defined, for your convenience in -[terraform.tfvars.example](terraform.tfvars.example) - - -## Input variables - - -
Variable | -Key | -Description | -Type | -Default Value | -
---|---|---|---|---|
provider | -- | AWS provider map | -map | -- |
- | access_key | -AWS access key | -string | -- |
- | region | -AWS region for deployment | -string | -us-east-1 | -
- | secret_key | -AWS secret | -string | -- |
vpc | -- | AWS VPC settings map | -map | -- |
- | cidr | -CIDR block for VPC | -string | -10.20.30.0/24 | -
- | dns_hostnames | -Support DNS hostnames (required) | -boolean | -true | -
- | dns_support | -Support DNS in VPC (required) | -boolean | -true | -
- | tags_desc | -Description tag | -string | -Chef HA VPC | -
- | tenancy | -AWS instance tenancy | -string | -default | -
subnets | -- | AWS subnet settings | -map | -- |
- | `key` | -AWS AZ to create subnet | -string | -us-east-1a us-east-1c us-east-1d us-east-1e |
-
- | `value` | -Subnet to configure for `key` | -string | -10.20.30.0/26 10.20.30.64/26 10.20.30.128/26 10.20.30.192/26 |
-
ssh_cidrs | -- | List of CIDRs allowing SSH | -list | -0.0.0.0/0 | -
ami | -- | AWS AMI map | -map | -- |
- | `key` | -Key comprised of of os-type-region | -string | -View [variables.tf](variables.tf) | -
- | `value` | -AWS AMI identifier | -string | -View [variables.tf](variables.tf) | -
os | -- | AWS AMI operating system | -string | -ubuntu14 | -
ami_user | -- | Mapping of AMI OS to AMI username | -map | -ubuntu | -
- | `key` | -AMI OS | -string | -centos7 centos6 ubuntu16 ubuntu14 ubuntu12 |
-
- | `value` | -Username for `key` | -string | -centos centos ubuntu ubuntu ubuntu |
-
ssl_certificate | -- | SSL certificate information | -map | -- |
- | cert_file | -Full path to SSL certificate file | -string | -- |
- | key_file | -Full path to SSL certificate key file | -string | -- |
elb | -- | AWS ELB settings | -map | -- |
- | certificate | -AWS identifier for SSL certificate | -string | -- |
- | hostname | -Base hostname for AWS ELB | -string | -chefelb | -
- | tags_desc | -Description tag | -string | -Created using Terraform | -
chef_backend | -- | Chef backend settings | -map | -- |
- | count | -Count of chef-backend instances | -integer | -3 | -
- | version | -Version of chef-backend to install | -string | -1.1.2 | -
chef_client | -- | Version of chef-client to install | -string | -12.12.15 | -
chef_mlsa | -- | Chef MLSA licese acceptance | -string | -false | -
chef_org | -- | Chef server organization settings | -map | -- |
- | short | -Chef server organization short name | -string | -chef | -
- | long | -Chef server organization long name | -Chef Organization | -string | -
chef_server | -- | Chef server core settings | -map | -- |
- | count | -Count of chef-server-core instances | -integer | -2 | -
- | version | -Version of chef-server-core to install | -string | -12.8.0 | -
chef_user | -- | Chef initial user settings | -map | -- |
- | Chef user e-mail address | -string | -chef@domain.tld | -|
- | first_name | -Chef user first name | -string | -Chef | -
- | last_name | -Chef user last name | -string | -User | -
- | username | -Chef user username | -string | -chef | -
instance | -- | AWS instance settings | -map | -- |
- | backend_flavor | -AWS instance type for chef-backend | -string | -r3.xlarge | -
- | backend_iops | -Root volume IOPs on chef-backend instance (`io1`) | -integer | -0 | -
- | backend_public | -Associate public IP to chef-backend instance | -boolean | -true | -
- | backend_size | -Root volume size (GB) on chef-backend instance | -integer | -40 | -
- | backend_term | -Root volume delete on chef-backend instance termination | -boolean | -true | -
- | backend_type | -Root volume type on chef-backend instance | -string | -gp2 | -
- | ebs_optimized | -Deploy EBS optimized root volume | -boolean | -true | -
- | frontend_flavor | -AWS instance type for chef-server-core | -string | -m4.large | -
- | frontend_iops | -Root volume IOPs on chef-server-core instance (`io1`). | -integer | -0 | -
- | frontend_public | -Associate public IP to chef-server-core instance | -- | true | -
- | frontend_size | -Root volume size (GB) on chef-server-core instance | -integer | -40 | -
- | frontend_term | -Root volume delete on chef-server-core instance termination | -- | true | -
- | frontend_type | -Root volume type on chef-server-core instance | -string | -gp2 | -
- | tags_desc | -Description name tag for instances. | -- | Created using Terraform | -
instance_hostname | -- | AWS instance base hostname | -map | -- |
- | backend | -Chef backend base hostname | -string | -chefbe | -
- | frontend | -Chef server core base hostname | -string | -chefbe | -
instance_keys | -- | AWS SSH key settings | -map | -- |
- | key_name | -AWS key pair | -string | -- |
- | key_file | -Full path to matching private key | -string | -- |
instance_store | -- | AWS instance store settings | -map | -- |
- | device | -AWS instance store device name | -string | -xvdb | -
- | enabled | -Use AWS instance store | -boolean | -true | -
- | filesystem | -AWS instance store filesystem | -string | -ext4 | -
- | mount | -AWS instance store mount point | -string | -/mnt/xvdb | -
- | mount_options | -AWS instance store mount options | -string | -defaults,noatime,errors=remount-ro | -
domain | -- | Domain name | -string | -localdomain | -
r53_zones | -- | AWS Route53 zone settings | -map | -- |
- | internal | -AWS Route53 internal zone ID | -string | -- |
- | external | -AWS Route53 external zone ID | -string | -- |
r53_ttls | -- | AWS Route53 TTL settings | -map | -- |
- | internal | -Internal record TTL setting | -integer | -180 | -
- | external | -External record TTL setting | -integer | -180 | -
Key | -Value | -
---|---|
centos7 | -centos | -
centos6 | -centos | -
ubuntu16 | -ubuntu | -
ubuntu14 | -ubuntu | -
ubuntu12 | -ubuntu | -
Variable | +Key | +Description | +Type | +Default Value | +
---|---|---|---|---|
provider | ++ | AWS provider map | +map | ++ |
+ | access_key | +AWS access key | +string | ++ |
+ | region | +AWS region for deployment | +string | +us-east-1 | +
+ | secret_key | +AWS secret | +string | ++ |
vpc | ++ | AWS VPC settings map | +map | ++ |
+ | cidr | +CIDR block for VPC | +string | +10.20.30.0/24 | +
+ | dns_hostnames | +Support DNS hostnames (required) | +boolean | +true | +
+ | dns_support | +Support DNS in VPC (required) | +boolean | +true | +
+ | tags_desc | +Description tag | +string | +Chef HA VPC | +
+ | tenancy | +AWS instance tenancy | +string | +default | +
subnets | ++ | AWS subnet settings | +map | ++ |
+ | `key` | +AWS AZ to create subnet | +string | +us-east-1a us-east-1c us-east-1d us-east-1e |
+
+ | `value` | +Subnet to configure for `key` | +string | +10.20.30.0/26 10.20.30.64/26 10.20.30.128/26 10.20.30.192/26 |
+
ssh_cidrs | ++ | List of CIDRs allowing SSH | +list | +0.0.0.0/0 | +
ami | ++ | AWS AMI map | +map | ++ |
+ | `key` | +Key comprised of of os-type-region | +string | +View [variables.tf](variables.tf) | +
+ | `value` | +AWS AMI identifier | +string | +View [variables.tf](variables.tf) | +
os | ++ | AWS AMI operating system | +string | +ubuntu14 | +
ami_user | ++ | Mapping of AMI OS to AMI username | +map | +ubuntu | +
+ | `key` | +AMI OS | +string | +centos7 centos6 ubuntu16 ubuntu14 ubuntu12 |
+
+ | `value` | +Username for `key` | +string | +centos centos ubuntu ubuntu ubuntu |
+
ssl_certificate | ++ | SSL certificate information | +map | ++ |
+ | cert_file | +Full path to SSL certificate file | +string | ++ |
+ | key_file | +Full path to SSL certificate key file | +string | ++ |
elb | ++ | AWS ELB settings | +map | ++ |
+ | certificate | +AWS identifier for SSL certificate | +string | ++ |
+ | hostname | +Base hostname for AWS ELB | +string | +chefelb | +
+ | tags_desc | +Description tag | +string | +Created using Terraform | +
chef_backend | ++ | Chef backend settings | +map | ++ |
+ | count | +Count of chef-backend instances | +integer | +3 | +
+ | version | +Version of chef-backend to install | +string | +1.1.2 | +
chef_client | ++ | Version of chef-client to install | +string | +12.12.15 | +
chef_mlsa | ++ | Chef MLSA licese acceptance | +string | +false | +
chef_org | ++ | Chef server organization settings | +map | ++ |
+ | short | +Chef server organization short name | +string | +chef | +
+ | long | +Chef server organization long name | +Chef Organization | +string | +
chef_server | ++ | Chef server core settings | +map | ++ |
+ | count | +Count of chef-server-core instances | +integer | +2 | +
+ | version | +Version of chef-server-core to install | +string | +12.8.0 | +
chef_user | ++ | Chef initial user settings | +map | ++ |
+ | Chef user e-mail address | +string | +chef@domain.tld | +|
+ | first_name | +Chef user first name | +string | +Chef | +
+ | last_name | +Chef user last name | +string | +User | +
+ | username | +Chef user username | +string | +chef | +
instance | ++ | AWS instance settings | +map | ++ |
+ | backend_flavor | +AWS instance type for chef-backend | +string | +r3.xlarge | +
+ | backend_iops | +Root volume IOPs on chef-backend instance (`io1`) | +integer | +0 | +
+ | backend_public | +Associate public IP to chef-backend instance | +boolean | +true | +
+ | backend_size | +Root volume size (GB) on chef-backend instance | +integer | +40 | +
+ | backend_term | +Root volume delete on chef-backend instance termination | +boolean | +true | +
+ | backend_type | +Root volume type on chef-backend instance | +string | +gp2 | +
+ | ebs_optimized | +Deploy EBS optimized root volume | +boolean | +true | +
+ | frontend_flavor | +AWS instance type for chef-server-core | +string | +m4.large | +
+ | frontend_iops | +Root volume IOPs on chef-server-core instance (`io1`). | +integer | +0 | +
+ | frontend_public | +Associate public IP to chef-server-core instance | ++ | true | +
+ | frontend_size | +Root volume size (GB) on chef-server-core instance | +integer | +40 | +
+ | frontend_term | +Root volume delete on chef-server-core instance termination | ++ | true | +
+ | frontend_type | +Root volume type on chef-server-core instance | +string | +gp2 | +
+ | tags_desc | +Description name tag for instances. | ++ | Created using Terraform | +
instance_hostname | ++ | AWS instance base hostname | +map | ++ |
+ | backend | +Chef backend base hostname | +string | +chefbe | +
+ | frontend | +Chef server core base hostname | +string | +chefbe | +
instance_keys | ++ | AWS SSH key settings | +map | ++ |
+ | key_name | +AWS key pair | +string | ++ |
+ | key_file | +Full path to matching private key | +string | ++ |
instance_store | ++ | AWS instance store settings | +map | ++ |
+ | device | +AWS instance store device name | +string | +xvdb | +
+ | enabled | +Use AWS instance store | +boolean | +true | +
+ | filesystem | +AWS instance store filesystem | +string | +ext4 | +
+ | mount | +AWS instance store mount point | +string | +/mnt/xvdb | +
+ | mount_options | +AWS instance store mount options | +string | +defaults,noatime,errors=remount-ro | +
domain | ++ | Domain name | +string | +localdomain | +
r53_zones | ++ | AWS Route53 zone settings | +map | ++ |
+ | internal | +AWS Route53 internal zone ID | +string | ++ |
+ | external | +AWS Route53 external zone ID | +string | ++ |
r53_ttls | ++ | AWS Route53 TTL settings | +map | ++ |
+ | internal | +Internal record TTL setting | +integer | +180 | +
+ | external | +External record TTL setting | +integer | +180 | +
Key | +Value | +
---|---|
centos7 | +centos | +
centos6 | +centos | +
ubuntu16 | +ubuntu | +
ubuntu14 | +ubuntu | +
ubuntu12 | +ubuntu | +