diff --git a/CHANGELOG.md b/CHANGELOG.md index c9606f1..acf87b7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,9 +3,17 @@ tf_hachef CHANGELOG This file is used to list changes made in each version of the tf_hachef Terraform plan. +v0.2.6 (2016-08-11) +------------------- +- Updated root device to use gp2 on backends +- Added map `instance_store` with reasonable defaults +- Now using local node instance storage for backends +- Large documentation overhaul + v0.2.5 (2016-08-10) ------------------- -- Adding `postgresql.md5_auth_cidr_addresses` to `chef-backend.rb` before joining cluster no longer breaks chef-backend +- Adding `postgresql.md5_auth_cidr_addresses` to `chef-backend.rb` before +joining cluster no longer breaks chef-backend - attributes-json.tpl -> backend-attributes-json.tpl for consistency v0.2.4 (2016-08-10) diff --git a/README.md b/README.md index 2a63af8..ca94071 100644 --- a/README.md +++ b/README.md @@ -79,133 +79,656 @@ These resources will incur charges on your AWS bill. It is your responsibility to delete the resources. -## Input variables +## Recommendations +The defaults set forth in the [variables.tf](variables.tf) file have been set +for good reasons. Please note that a good amount of testing went into defining +these defaults and necessary inputs are defined, for your convenience in +[terraform.tfvars.example](terraform.tfvars.example) -* `provider`: AWS provider settings - * `access_key`: Your AWS key, usually referred to as `AWS_ACCESS_KEY_ID` - * `region`: AWS region you want to deploy to. Default: `us-east-1` - * `secret_key`: Your secret for your AWS key, usually referred to as `AWS_SECRET_ACCESS_KEY` -* `vpc`: AWS VPC settings - * `cidr`: CIDR block for VPC creation. Default: `10.20.30.0/24` - * `dns_hostnames`: Support DNS hostnames (required). Default: `true` - * `dns_support`: Support DNS in VPC (required). Default: `true` - * `tags_desc`: AWS Name tag for VPC. Default: `Chef HA VPC` - * `tenancy`: AWS instance tenancy. Default: `default` -* `subnets`: AWS subnet settings - * This map is a dynamic map. Please read below: - * `KEY`: You create the key labeled as the availability zone (i.e us-east-1a) - * Default keys: `us-east-1a`, `us-east-1c`, `us-east-1d`, `us-east-1e` - * `VALUE`: Value is the CIDR subnet to create in that availability zone - * Default values: `10.20.30.0/26`, `10.20.30.64/26`, `10.20.30.128/26`, `10.20.30.192/26` -* `subnets_public`: Subnet map defaulting the public IP assignment in that availability zone's subnet - * `KEY`: Must have the same keys as `subnets`. Default: reference `subnets` - * `VALUE`: Can be `true` or `false`. Default: `true` -* `ssh_cidrs`: List of CIDR ranges allowed SSH access. Default: `["0.0.0.0/0"]` -* `ami`: AMI map for selecting the AMI - * The `KEY` is comprised of the `os`-`instance["(frontend|backend)_type"]`-`provider["region"]` - * The `value` is a mapping based on AMIs found publicly available as of 2016-03-14 -* `os`: The operating system for the deployed instance. Default: `ubuntu14` -* `ami_user`: Mapping of `os` to a default user for the instance. Default: `ubuntu14 = "ubuntu"` -* `ssl_certificate`: SSL Certificate information for chef-server-core installation - * `cert_file`: Full path to certificate file (usually `.crt` or `.pem` file) - * `key_file`: Full path to the certificate key file (usually `.key` file) -* `elb`: AWS ELB settings - * `certificate`: The uploaded identifier for the SSL certificate to use with AWS ELB - * `hostname`: Basename for the hostname. Default: `chefelb` - * `tags_desc`: Default tag for ELB. Default: `Created using Terraform` -* `chef_backend`: Chef backend settings - * `count`: Count of chef-backend instances to deploy. Default: `4` - * `version`: Chef backend version to install. Default: `1.1.2` -* `chef_client`: Chef client version to install. Default: `12.12.15` -* `chef_mlsa`: Indicate acceptance of the Chef MLSA. Must update to `true`. Default: `false` -* `chef_org`: Chef organization settings - * `short`: Chef organization to create. Default: `chef` - * `long`: Chef long organization name. Default: `Chef Organization` -* `chef_server`: Chef server core settings - * `count`: Chef server core instance count. Default: `4` - * `version`: Chef server core version to install. Default: `12.8.0` -* `chef_user`: Chef initial user settings - * `username`: Chef username to create. Default: `chef` - * `email`: Chef user e-mail address. Default: `chef@domain.tld` - * `first_name`: Chef user first name. Default: `Chef` - * `last_name`: Chef user last name. Default: `User` -* `instance`: Map of various AWS instance settings (backend and frontend) - * `backend_flavor`: Backend default instance type. Default: `r3.xlarge` - * `backend_iops`: Backend root volume IOPs (when using `io1`). Default: `6000` - * `backend_public`: Backend default association to public ip. Default: `true` - * `backend_size`: Backend root volume size in gigabytes. Default: `200` - * `backend_term`: Delete root volume on VM termination. Default: `true` - * `backend_type`: Backend root volume type: Default `io1` - * `ebs_optimized`: Deploy EBS optimized root volume. Default `true` - * `frontend_flavor`: Frontend default instance type. Default: `r3.xlarge` - * `frontend_iops`: Frontend root volume IOPs (when using `io1`). Default: `6000` - * `frontend_public`: Frontend default association to public ip. Default: `true` - * `frontend_size`: Frontend root volume size in gigabytes. Default: `200` - * `frontend_term`: Delete root volume on VM termination. Default: `true` - * `frontend_type`: Frontend root volume type: Default `io1` - * `tags_desc` = "Created using Terraform" -* `instance_hostname`: Map of frontend and backend base hostnames - * `backend`: Chef backend base hostname. Default: `chefbe` - * `frontend`: Chef server core base hostname. Default: `chefbe` -* `instance_keys`: Map of SSH key settings to deploy and access AWS instances - * `key_name`: The private key pair name on AWS to use (String) - * `key_file`: The full path to the private kye matching `instance_keys["key_name"]` public key on AWS -* `domain`: Domain name for instances and ELB. Default: `localdomain` -* `r53_zones`: AWS Route53 zone settings - * `internal`: Route53 internal zone ID - * `external`: Route53 external zone ID -* `r53_ttls`: AWS Route53 TTL default settings - * `internal`: Time to live setting for internal zone route53 records. Default: `180` - * `external`: Time to live setting for external zone route53 records. Default: `180` - - -### AMI map and customizing - -The below mapping variables construct selection criteria - -* `ami`: AMI selection map comprised of `os`, `instance["(frontend|backend)_type"]` and `aws_region` -* `ami_user`: Default username selection map based off `ami_os` - -To override this, construct the maps in the following manner: -``` +## Input variables + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
VariableKeyDescriptionTypeDefault Value
providerAWS provider mapmap
access_keyAWS access keystring
regionAWS region for deploymentstringus-east-1
secret_keyAWS secretstring
vpcAWS VPC settings mapmap
cidrCIDR block for VPCstring10.20.30.0/24
dns_hostnamesSupport DNS hostnames (required)booleantrue
dns_supportSupport DNS in VPC (required)booleantrue
tags_descDescription tagstringChef HA VPC
tenancyAWS instance tenancystringdefault
subnetsAWS subnet settingsmap
`key`AWS AZ to create subnetstringus-east-1a
us-east-1c
us-east-1d
us-east-1e
`value`Subnet to configure for `key`string10.20.30.0/26
10.20.30.64/26
10.20.30.128/26
10.20.30.192/26
ssh_cidrsList of CIDRs allowing SSHlist0.0.0.0/0
amiAWS AMI mapmap
`key`Key comprised of of os-type-regionstringView [variables.tf](variables.tf)
`value`AWS AMI identifierstringView [variables.tf](variables.tf)
osAWS AMI operating systemstringubuntu14
ami_userMapping of AMI OS to AMI usernamemapubuntu
`key`AMI OSstringcentos7
centos6
ubuntu16
ubuntu14
ubuntu12
`value`Username for `key`stringcentos
centos
ubuntu
ubuntu
ubuntu
ssl_certificateSSL certificate informationmap
cert_fileFull path to SSL certificate filestring
key_fileFull path to SSL certificate key filestring
elbAWS ELB settingsmap
certificateAWS identifier for SSL certificatestring
hostnameBase hostname for AWS ELBstringchefelb
tags_descDescription tagstringCreated using Terraform
chef_backendChef backend settingsmap
countCount of chef-backend instancesinteger3
versionVersion of chef-backend to installstring1.1.2
chef_clientVersion of chef-client to installstring12.12.15
chef_mlsaChef MLSA licese acceptancestringfalse
chef_orgChef server organization settingsmap
shortChef server organization short namestringchef
longChef server organization long nameChef Organizationstring
chef_serverChef server core settingsmap
countCount of chef-server-core instancesinteger2
versionVersion of chef-server-core to installstring12.8.0
chef_userChef initial user settingsmap
emailChef user e-mail addressstringchef@domain.tld
first_nameChef user first namestringChef
last_nameChef user last namestringUser
usernameChef user usernamestringchef
instanceAWS instance settingsmap
backend_flavorAWS instance type for chef-backendstringr3.xlarge
backend_iopsRoot volume IOPs on chef-backend instance (`io1`)integer0
backend_publicAssociate public IP to chef-backend instancebooleantrue
backend_sizeRoot volume size (GB) on chef-backend instanceinteger40
backend_termRoot volume delete on chef-backend instance terminationbooleantrue
backend_typeRoot volume type on chef-backend instancestringgp2
ebs_optimizedDeploy EBS optimized root volumebooleantrue
frontend_flavorAWS instance type for chef-server-corestringm4.large
frontend_iopsRoot volume IOPs on chef-server-core instance (`io1`).integer0
frontend_publicAssociate public IP to chef-server-core instancetrue
frontend_sizeRoot volume size (GB) on chef-server-core instanceinteger40
frontend_termRoot volume delete on chef-server-core instance terminationtrue
frontend_typeRoot volume type on chef-server-core instancestringgp2
tags_descDescription name tag for instances.Created using Terraform
instance_hostnameAWS instance base hostnamemap
backendChef backend base hostnamestringchefbe
frontendChef server core base hostnamestringchefbe
instance_keysAWS SSH key settingsmap
key_nameAWS key pairstring
key_fileFull path to matching private keystring
instance_storeAWS instance store settingsmap
deviceAWS instance store device namestringxvdb
enabledUse AWS instance storebooleantrue
filesystemAWS instance store filesystemstringext4
mountAWS instance store mount pointstring/mnt/xvdb
mount_optionsAWS instance store mount optionsstringdefaults,noatime,errors=remount-ro
domainDomain namestringlocaldomain
r53_zonesAWS Route53 zone settingsmap
internalAWS Route53 internal zone IDstring
externalAWS Route53 external zone IDstring
r53_ttlsAWS Route53 TTL settingsmap
internalInternal record TTL settinginteger180
externalExternal record TTL settinginteger180
+ + +### AMI map customization + +There following variables work in concert with each other to set a number of +required settings ffor this plan to succeed. + +* `ami`: Map of `os`-`instance[..._type]`-`provider[region]` to AMI ID +* `ami_user`: Map of AMI OS to default AMI username +* `os`: String containing OS+Version (i.e. Ubuntu 14.04.x LTS = `ubuntu14`) +* `provider[region]`: AWS region + +Normally you will not interract with the `ami` map directly, however if you +want to override the AMI selected take note of the following example. + +Example: Use newer AMI for default `ubuntu14` requires a simple `ami` override: + +```hcl ami = { - myos-io1-us-west-1 = "ami-________" + ubuntu14-gp2-us-east-1 = "ami-ffffffff" } +``` + +Example: Custom AMI user with custom AMI image + +```hcl os = "myos" +ami = { + myos-gp2-us-east-1 = "ami-ffffffff" +} ami_user = { - myos = "myloginuser" + myos = "someuser" } +``` + +Example: Using existing AMIs but with an io1 root volume on chef-backend +```hcl instance = { - ... - backend_type = "io1" - ... + backend_flavor = "r3.xlarge" + backend_iops = 6000 + backend_public = true + backend_size = 200 + backend_term = true + backend_type = "io1" + ebs_optimized = true + frontend_flavor = "m4.large" + frontend_iops = 0 + frontend_public = true + frontend_size = 40 + frontend_term = true + frontend_type = "gp2" + tags_desc = "Created using Terraform" } ``` -Defaults for `os` map: - -* centos6 -* centos7 -* ubuntu12 -* ubuntu14 (default) -* ubuntu16 - -Default region in `provider["region"]` should likely be one of the following: - -* us-east-1 (default) -* us-west-2 -* us-west-1 -* eu-central-1 -* eu-west-1 -* ap-southeast-1 -* ap-southeast-2 -* ap-northeast-1 -* ap-northeast-2 -* sa-east-1 -* Custom (must be an AWS region, requires setting `ami_map` and setting AMI value) +Defaults in `ami_user` map: + + + + + + + + + + + + + + + + + + + + + + + + + + +
KeyValue
centos7centos
centos6centos
ubuntu16ubuntu
ubuntu14ubuntu
ubuntu12ubuntu
## Outputs diff --git a/files/instance_store.bash b/files/instance_store.bash new file mode 100644 index 0000000..d040028 --- /dev/null +++ b/files/instance_store.bash @@ -0,0 +1,122 @@ +#!/usr/bin/env bash + +# ----------------------------------------------------------------------------- +VERSION=1.0 +AUTHOR="Brian Menges" +AUTHOR_EMAIL="mengesb@gmail.com" +LICENSE="Apache 2.0" +LICENSE_URL="http://www.apache.org/licenses/LICENSE-2.0" +# ----------------------------------------------------------------------------- + +PROTECTED_ROOT=$(mount|grep ' / '|cut -d' ' -f 1|sed 's,/dev/,,') + +# Usage +usage() +{ + cat < + Version: ${VERSION} + +EOF +} + +while getopts ":d:e:f:m:ohv" OPTION; do + case "$OPTION" in + d) + DEV=${OPTARG} + ;; + e) + case ${OPTARG} in + true) + ENABLED=1 + ;; + 1) + ENABLED=1 + ;; + esac + ;; + f) + FS=${OPTARG} + ;; + h) + usage && exit 0 + ;; + m) + MNT=${OPTARG} + ;; + o) + OPT=${OPTARG} + ;; + v) + set -x + VERBOSE=1 + ;; + *) + usage && exit 1 + ;; + ?) + usage && exit 1 + ;; + esac +done + +# Defaults +[[ -z $DEV ]] && DEV=xvdb +[[ -z $FS ]] && FS=ext4 +[[ -z $MNT ]] && MNT=/mnt/$DEV +[[ -z $OPT ]] && OPT='defaults,noatime,errors=remount-ro' + +# Requirements check +[[ -z $ENABLED ]] && echo "The safety is still on" && exit 0 + +[[ $EUID -ne 0 ]] && echo "$0 must be ran as root" && exit 1 + +if [[ ! -b /dev/$DEV ]] +then + echo "ERROR: Device not a block device: /dev/$DEV" && exit 1 +fi + +if [[ $DEV =~ $PROTECTED_ROOT ]] +then + echo "ERROR: Cannot use root device" && exit 1 +fi + +# Main + +# Setup instance store device +mkfs -t $FS /dev/$DEV + +# Mount point setup +mkdir -p ${MNT} /opt /var/opt /var/cache/chef /var/log/chef-backend +mount /dev/${DEV} ${MNT} +mkdir -p /mnt/${DEV}/var/opt /mnt/${DEV}/var/log/chef-backend /mnt/${DEV}/opt /mnt/${DEV}/var/cache/chef +umount /dev/${DEV} + +# Update /etc/fstab +sed -i "/$DEV/d" /etc/fstab +echo " +/dev/${DEV} ${MNT} auto ${OPT} 0 0 +/mnt/${DEV}/opt /opt auto defaults,bind 0 0 +/mnt/${DEV}/var/cache/chef /var/cache/chef auto defaults,bind 0 0 +/mnt/${DEV}/var/log/chef-backend /var/log/chef-backend auto defaults,bind 0 0 +/mnt/${DEV}/var/opt /var/opt auto defaults,bind 0 0 +" | tee -a /etc/fstab + +# Mount +mount -a diff --git a/main.tf b/main.tf index 20e8a63..5c3a553 100644 --- a/main.tf +++ b/main.tf @@ -254,6 +254,20 @@ resource "aws_instance" "chef-backends" { provisioner "remote-exec" { script = "${path.module}/files/disable_firewall.sh" } + # Setup instance storage + provisioner "file" { + source = "${path.module}/files/instance_store.bash" + destination = "/tmp/instance_store.bash" + } + provisioner "remote-exec" { + inline = [ + "#!/usr/bin/env bash", + "sudo chmod a+x /tmp/instance_store.bash", + "sudo cp /etc/fstab /tmp/fstab.before", + "sudo /tmp/instance_store.bash -d ${var.instance_store["device"]} -e ${var.instance_store["enabled"]} -f ${var.instance_store["filesystem"]} -m ${var.instance_store["mount"]} -o '${var.instance_store["mount_options"]}' -v", + "cp /etc/fstab /tmp/fstab.after", + ] + } # Put cookbooks provisioner "remote-exec" { script = "${path.module}/files/chef-cookbooks.sh" diff --git a/terraform.tfvars.example b/terraform.tfvars.example index 819de4f..16de89f 100644 --- a/terraform.tfvars.example +++ b/terraform.tfvars.example @@ -44,7 +44,7 @@ provider = { # AWS AMI settings map # #ami = { -# ubuntu14-io1-us-east-1 = "ami-aac24fbd" +# ubuntu12-gp2-us-east-1 = "ami-b74688da" #} #os = "ubuntu14" #ami_user = { @@ -54,21 +54,20 @@ provider = { # AWS EC2 instance settings # #instance = { -# backend_flavor = "r3.xlarge" -# backend_iops = 6000 -# backend_public = true -# backend_size = 200 -# backend_term = true -# backend_type = "io1" -# ebs_optimized = true -# frontend_flavor = "m4.large" -# frontend_iops = 0 -# frontend_public = true -# frontend_size = 40 -# frontend_term = true -# frontend_type = "gp2" -# tags_desc = "Created using Terraform" -# key = "value" +# backend_flavor = "r3.xlarge" +# backend_iops = 0 +# backend_public = true +# backend_size = 40 +# backend_term = true +# backend_type = "gp2" +# ebs_optimized = true +# frontend_flavor = "m4.large" +# frontend_iops = 0 +# frontend_public = true +# frontend_size = 40 +# frontend_term = true +# frontend_type = "gp2" +# tags_desc = "Created using Terraform" #} #instance_hostname = { # backend = "chefbe" @@ -78,6 +77,13 @@ instance_keys = { key_name = "" key_file = "" } +#instance_store = { +# device = "xvdb" +# enabled = true +# filesystem = "ext4" +# mount = "/mnt/xvdb" +# mount_options = "defaults,noatime,errors=remount-ro" +#} domain = "" # # SSL settings diff --git a/variables.tf b/variables.tf index 2895b9a..b9b2c86 100644 --- a/variables.tf +++ b/variables.tf @@ -273,11 +273,11 @@ variable "instance" { description = "" default = { backend_flavor = "r3.xlarge" - backend_iops = 6000 + backend_iops = 0 backend_public = true - backend_size = 200 + backend_size = 40 backend_term = true - backend_type = "io1" + backend_type = "gp2" ebs_optimized = true frontend_flavor = "m4.large" frontend_iops = 0 @@ -304,6 +304,17 @@ variable "instance_keys" { key_file = "" } } +variable "instance_store" { + type = "map" + description = "Instance storage settings" + default = { + device = "xvdb" + enabled = true + filesystem = "ext4" + mount = "/mnt/xvdb" + mount_options = "defaults,noatime,errors=remount-ro" + } +} variable "domain" { description = "Chef server domain name" default = "localdomain"