Skip to content

Commit a14399b

Browse files
author
Dmitry Berezovsky
committed
Started to work on elasticsearch module
1 parent e08fcb4 commit a14399b

File tree

7 files changed

+466
-0
lines changed

7 files changed

+466
-0
lines changed

‎modules/elasticsearch/ec2.tf‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
resource "aws_instance" "elasticsearch_instance" {
2+
count = "${var.instances_count}"
3+
depends_on = ["aws_ebs_volume.elasticsearch_volume"]
4+
ami = "${var.ami_id}"
5+
instance_type = "${var.instance_type}"
6+
subnet_id = "${element(var.vpc_subnets, count.index)}"
7+
key_name = "${var.instance_key_name}"
8+
iam_instance_profile = "${aws_iam_instance_profile.elasticsearch.name}"
9+
vpc_security_group_ids = ["${concat(var.security_groups, list(aws_security_group.elasticsearch.id))}"]
10+
associate_public_ip_address = false
11+
source_dest_check = false
12+
disable_api_termination = "${var.enable_termination_protection}"
13+
instance_initiated_shutdown_behavior = "stop"
14+
15+
tags {
16+
Env = "${var.env_name}"
17+
Name = "${var.env_name}: ${var.verbose_name} Elasticsearch ${count.index}"
18+
}
19+
user_data = <<USER_DATA_END
20+
#cloud-config
21+
write_files:
22+
- path: /usr/bin/install-unix-tools
23+
encoding: b64
24+
content: ${base64encode(file("${path.module}/../resources/install-unix-tools.sh"))}
25+
owner: root:root
26+
permissions: '0755'
27+
- path: /etc/dive-in-docker.conf
28+
content: elasticsearch
29+
- path: /etc/ecs/ecs.config
30+
content: |
31+
ECS_CLUSTER=${var.ecs_cluster_name}
32+
ECS_AVAILABLE_LOGGING_DRIVERS=["json-file","syslog","journald","gelf","awslogs"]
33+
- path: /etc/sysctl.d/01-elasticsearch.conf
34+
content: |
35+
vm.max_map_count = 262144
36+
runcmd:
37+
- [ cloud-init-per, once, "install-unix-tools", "install-unix-tools", "-t", "1.0", "full"]
38+
- [ cloud-init-per, once, "set-hostname", "aws-set-hostname", "${lower(var.verbose_name)}graylog-elasticsearch-{count.index}", "-s"]
39+
- [ cloud-init-per, once, "read-custom-syslog", "sysctl", "-p", "/etc/sysctl.d/01-elasticsearch.conf"]
40+
- [ cloud-init-per, once, "docker-stop", "service", "docker", "stop"]
41+
- [ cloud-init-per, once, "mount-ebs", "mount-ebs", "${var.data_volume_device}", "${var.data_volume_path}", "0777" ]
42+
- [ cloud-init-per, once, "docker-start", "service", "docker", "start"]
43+
- [ cloud-init-per, once, "start-ecs", "start", "ecs"]
44+
USER_DATA_END
45+
}
46+
47+
resource "aws_ebs_volume" "elasticsearch_volume" {
48+
count = "${length(var.instances_count)}"
49+
availability_zone = "${element(var.availability_zones, count.index)}"
50+
size = "${var.storage_size}"
51+
52+
tags {
53+
Env = "${var.env_name}"
54+
Name = "${var.env_name}: ${var.verbose_name} Elasticseach Volume ${count.index}"
55+
}
56+
}
57+
58+
resource "aws_volume_attachment" "elasticsearch_volume_attachement" {
59+
count = "${length(var.instances_count)}"
60+
device_name = "${var.data_volume_device}"
61+
force_detach = true
62+
volume_id = "${element(aws_ebs_volume.elasticsearch_volume.*.id, count.index)}"
63+
instance_id = "${element(aws_instance.elasticsearch_instance.*.id, count.index)}"
64+
}
65+
66+
67+
resource "aws_security_group" "elasticsearch" {
68+
name = "${lower(var.env_name)}-${lower(var.verbose_name)}-elasticsearch"
69+
vpc_id = "${var.vpc_id}"
70+
71+
# Elasticsearch native transport protocol
72+
ingress {
73+
from_port = 9300
74+
to_port = 9300
75+
protocol = "tcp"
76+
cidr_blocks = ["${var.native_trusted_networks}"]
77+
}
78+
79+
# Elasticsearch HTTP service
80+
ingress {
81+
from_port = 9200
82+
to_port = 9200
83+
protocol = "tcp"
84+
cidr_blocks = ["${var.http_trusted_networks}"]
85+
}
86+
87+
# Elasticsearch native transport protocol
88+
egress {
89+
from_port = 9300
90+
to_port = 9300
91+
protocol = "tcp"
92+
cidr_blocks = ["${var.native_trusted_networks}"]
93+
}
94+
95+
# Elasticsearch HTTP service
96+
egress {
97+
from_port = 9200
98+
to_port = 9200
99+
protocol = "tcp"
100+
cidr_blocks = ["${var.http_trusted_networks}"]
101+
}
102+
103+
tags {
104+
Env = "${var.env_name}"
105+
Name = "${var.env_name}: ${var.verbose_name} Elasticsearch"
106+
}
107+
}

‎modules/elasticsearch/ecs.tf‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
data "template_file" "elasticsearch_master_config" {
2+
template = "${file("${path.module}/resources/elasticsearch.json")}"
3+
vars {
4+
container_name = "elasticsearch-master"
5+
elasticsearch_version = "${var.elasticsearch_version}"
6+
memory = "${var.container_memory_limit}"
7+
node_name = "${var.verbose_name}-elasticsearch-master"
8+
elasticsearch-cluster-name = "${var.elasticsearch_cluster_name}"
9+
volume_name = "elasticseach-data"
10+
native_transport_port = 9300
11+
http_service_port = 9200
12+
extra-options = ""
13+
}
14+
}
15+

‎modules/elasticsearch/iam.tf‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
resource "aws_iam_instance_profile" "elasticsearch" {
2+
name = "${lower(var.env_name)}-${var.verbose_name}-elasticsearch"
3+
role = "${aws_iam_role.elasticsearch_role.name}"
4+
}
5+
6+
resource "aws_iam_role" "elasticsearch_role" {
7+
name = "${lower(var.env_name)}-${var.verbose_name}-elasticsearch"
8+
assume_role_policy = "${data.aws_iam_policy_document.ec2_assume_policy}"
9+
}
10+
11+
resource "aws_iam_role_policy" "docker_policy" {
12+
name = "${lower(var.env_name)}-docker-policy"
13+
role = "${aws_iam_role.elasticsearch_role.id}"
14+
policy = "${data.aws_iam_policy_document.docker_policy.json}"
15+
}
16+
17+
data "aws_iam_policy_document" "ec2_assume_policy" {
18+
statement {
19+
effect = "Allow"
20+
actions = ["sts:AssumeRole"]
21+
principals {
22+
type = "Service"
23+
identifiers = ["ec2.amazonaws.com"]
24+
}
25+
}
26+
statement {
27+
effect = "Allow"
28+
actions = ["sts:AssumeRole"]
29+
principals {
30+
type = "Service"
31+
identifiers = ["ecs.amazonaws.com"]
32+
}
33+
}
34+
}
35+
36+
data "aws_iam_policy_document" "docker_policy" {
37+
statement {
38+
effect = "Allow"
39+
actions = [
40+
"ecs:CreateCluster",
41+
"ecs:DeregisterContainerInstance",
42+
"ecs:DiscoverPollEndpoint",
43+
"ecs:Poll",
44+
"ecs:RegisterContainerInstance",
45+
"ecs:StartTelemetrySession",
46+
"ecs:Submit*",
47+
"ecr:GetAuthorizationToken",
48+
"ecr:BatchCheckLayerAvailability",
49+
"ecr:GetDownloadUrlForLayer",
50+
"ecr:BatchGetImage",
51+
"logs:CreateLogStream",
52+
"logs:PutLogEvents",
53+
54+
"ec2:AuthorizeSecurityGroupIngress",
55+
"ec2:Describe*",
56+
"elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
57+
"elasticloadbalancing:Describe*",
58+
"elasticloadbalancing:RegisterInstancesWithLoadBalancer"
59+
]
60+
resources = ["*"]
61+
}
62+
}

‎modules/elasticsearch/output.tf‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
output "private_ips" {
2+
value = ["${aws_instance.elasticsearch_instance.*.private_ip}"]
3+
}
4+
5+
output "instance_ids" {
6+
value = ["${aws_instance.elasticsearch_instance.*.id}"]
7+
}
8+
9+
output "elasticsearch_sg_id" {
10+
value = "${aws_security_group.elasticsearch.id}"
11+
}
12+
13+
output "instance_profile_id" {
14+
value = "${aws_iam_instance_profile.elasticsearch.id}"
15+
}
16+
17+
output "iam_role_id" {
18+
value = "${aws_iam_role.elasticsearch_role.id}"
19+
}

‎modules/elasticsearch/resources/elasticsearch.json‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
[
2+
{
3+
"name": "${container-name}",
4+
"image": "elasticsearch:${elasticsearch-version}",
5+
"memory": ${memory},
6+
"essential": true,
7+
"portMappings": [
8+
{
9+
"hostPort": ${native_transport_port},
10+
"containerPort": 9300,
11+
"protocol": "tcp"
12+
},
13+
{
14+
"hostPort": ${http_service_port},
15+
"containerPort": 9200,
16+
"protocol": "tcp"
17+
}
18+
],
19+
"environment": [
20+
21+
],
22+
"mountPoints": [
23+
{
24+
"sourceVolume": "${volume_name}",
25+
"containerPath": "/usr/share/elasticsearch/data",
26+
"readOnly": false
27+
}
28+
],
29+
"volumesFrom": null,
30+
"extraHosts": null,
31+
"ulimits": [
32+
{
33+
"name": "nofile",
34+
"hardLimit": 65536,
35+
"softLimit": 65536
36+
}
37+
],
38+
"dockerLabels": null,
39+
"command": ["bash", "-c", "chmod -R o+rw /usr/share/elasticsearch/data && gosu elasticsearch elasticsearch -Enetwork.publish_host=`curl -s http://169.254.169.254/latest/meta-data/local-ipv4` -Etransport.tcp.port=${native_transport_port} -Enode.name=${node_name} -Ecluster.name=${elasticsearch_cluster_name} ${extra_options}"]
40+
}
41+
]

‎modules/elasticsearch/variables.tf‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
variable "env_name" {
2+
type = "string"
3+
}
4+
5+
variable "vpc_id" {
6+
type = "string"
7+
}
8+
9+
variable "vpc_subnets" {
10+
type = "list"
11+
}
12+
13+
variable "availability_zones" {
14+
type = "list"
15+
}
16+
17+
variable "verbose_name" {
18+
type = "string"
19+
default = ""
20+
description = "Will be used in resources names. E.g. Graylog"
21+
}
22+
23+
variable "enable_termination_protection" {
24+
type = "string"
25+
default = true
26+
}
27+
28+
variable "security_groups" {
29+
type = "list"
30+
default = []
31+
description = "Extra security groups to be assigned"
32+
}
33+
34+
variable "instance_key_name" {
35+
type = "string"
36+
description = "EC2 instance key name"
37+
}
38+
39+
variable "ami_id" {
40+
type = "string"
41+
}
42+
43+
variable "instance_type" {
44+
type = "string"
45+
default = "t2.small"
46+
}
47+
48+
variable "elasticsearch_cluster_name" {
49+
type = "string"
50+
}
51+
52+
variable "ecs_cluster_name" {
53+
type = "string"
54+
}
55+
56+
variable "instances_count" {
57+
type = "string"
58+
default = 1
59+
}
60+
61+
variable "data_volume_device" {
62+
type = "string"
63+
default = "/dev/sdh"
64+
}
65+
66+
variable "data_volume_device" {
67+
type = "string"
68+
default = "/dev/sdh"
69+
}
70+
71+
variable "data_volume_path" {
72+
type = "string"
73+
default = "/srv/elasticseach-data"
74+
}
75+
76+
variable container_memory_limit {
77+
default = "2048"
78+
description = "RAM limit for container"
79+
}
80+
81+
variable "storage_size" {
82+
type = "string"
83+
}
84+
85+
variable "http_trusted_networks" {
86+
type = "list"
87+
}
88+
89+
variable "native_trusted_networks" {
90+
type = "list"
91+
}
92+
93+
variable "elasticsearch_version" {
94+
type = "string"
95+
default = "5.2.2"
96+
}

0 commit comments

Comments
 (0)