constellation/terraform/infrastructure/aws/modules/instance_group/main.tf

116 lines
3.8 KiB
Terraform
Raw Normal View History

terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = "5.26.0"
}
2023-06-23 11:19:43 -04:00
random = {
source = "hashicorp/random"
version = "3.6.0"
2023-06-23 11:19:43 -04:00
}
}
}
locals {
2023-06-23 11:19:43 -04:00
group_uid = random_id.uid.hex
name = "${var.base_name}-${lower(var.role)}-${local.group_uid}"
}
2023-06-23 11:19:43 -04:00
resource "random_id" "uid" {
byte_length = 4
}
2022-10-24 17:35:28 -04:00
resource "aws_launch_template" "launch_template" {
name_prefix = local.name
image_id = var.image_id
instance_type = var.instance_type
iam_instance_profile {
name = var.iam_instance_profile
}
2022-10-24 17:35:28 -04:00
vpc_security_group_ids = var.security_groups
metadata_options {
2022-10-29 22:40:06 -04:00
http_endpoint = "enabled"
http_tokens = "required"
instance_metadata_tags = "disabled"
2022-10-29 22:40:06 -04:00
http_put_response_hop_limit = 2
}
2022-10-24 17:35:28 -04:00
block_device_mappings {
device_name = "/dev/sdb"
ebs {
volume_size = var.state_disk_size
volume_type = var.state_disk_type
encrypted = true
delete_on_termination = true
}
}
2023-06-23 11:19:43 -04:00
# See: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_template#cpu-options
cpu_options {
# use "enabled" to enable SEV-SNP
# use "disabled" to disable SEV-SNP (but still require SNP-capable hardware)
# use null to leave the setting unset (allows non-SNP-capable hardware to be used)
amd_sev_snp = var.enable_snp ? "enabled" : null
# Disable SMT. We are already disabling it inside the image.
# Disabling SMT only in the image, not in the Hypervisor creates problems.
# Thus, also disable it in the Hypervisor.
# TODO(derpsteb): reenable once AWS confirms it's safe to do so.
# threads_per_core = 1
# When setting threads_per_core we also have to set core_count.
# For the currently supported SNP instance families (C6a, M6a, R6a) default_cores
# equals the maximum number of available cores.
# core_count = data.aws_ec2_instance_type.instance_data.default_cores
2023-06-23 11:19:43 -04:00
}
lifecycle {
create_before_destroy = true
ignore_changes = [
2023-06-23 11:19:43 -04:00
cpu_options, # required. we cannot change the CPU options of a launch template
name_prefix, # required. Allow legacy scale sets to keep their old names
default_version, # required. update procedure creates new versions of the launch template
image_id, # required. update procedure modifies the image id externally
]
}
}
resource "aws_autoscaling_group" "autoscaling_group" {
2022-10-24 17:35:28 -04:00
name = local.name
launch_template {
id = aws_launch_template.launch_template.id
}
min_size = 1
max_size = 10
desired_capacity = var.initial_count
2022-10-24 17:35:28 -04:00
vpc_zone_identifier = [var.subnetwork]
target_group_arns = var.target_group_arns
# TODO(msanft): Remove this (to have the 10m default) once AWS SEV-SNP boot problems are resolved.
# Set a higher timeout for the ASG to fulfill the desired healthy capcity. Temporary workaround to
# long boot times on SEV-SNP machines on AWS.
wait_for_capacity_timeout = var.enable_snp ? "20m" : "10m"
2022-11-26 13:44:34 -05:00
dynamic "tag" {
for_each = var.tags
content {
key = tag.key
value = tag.value
propagate_at_launch = true
}
2022-10-29 22:40:06 -04:00
}
lifecycle {
create_before_destroy = true
ignore_changes = [
2023-06-23 11:19:43 -04:00
name, # required. Allow legacy scale sets to keep their old names
launch_template.0.version, # required. update procedure creates new versions of the launch template
min_size, # required. autoscaling modifies the instance count externally
max_size, # required. autoscaling modifies the instance count externally
desired_capacity, # required. autoscaling modifies the instance count externally
]
}
}
data "aws_ec2_instance_type" "instance_data" {
instance_type = var.instance_type
}