131 lines
4.6 KiB
Markdown
131 lines
4.6 KiB
Markdown
# Assignment
|
||
|
||
The Nautilus DevOps team needs to set up an Amazon OpenSearch Service domain to store and search their application logs. The domain should have the following specification:
|
||
|
||
1) The domain name should be devops-es.
|
||
|
||
2) Use Terraform to create the OpenSearch domain. The Terraform working directory is /home/bob/terraform. Create the main.tf file (do not create a different .tf file) to accomplish this task.
|
||
|
||
|
||
Notes:
|
||
|
||
The Terraform working directory is /home/bob/terraform.
|
||
|
||
Right-click under the EXPLORER section in VS Code and select Open in Integrated Terminal to launch the terminal.
|
||
|
||
Before submitting the task, ensure that terraform plan returns No changes. Your infrastructure matches the configuration.
|
||
|
||
The OpenSearch domain creation process may take several minutes. Please wait until the domain is fully created before submitting.
|
||
|
||
# Solution
|
||
|
||
# OpenSearch Domain — `devops-es`
|
||
|
||
Terraform solution to create a minimal, single-node Amazon OpenSearch Service domain
|
||
that comes up clean and reports no drift on re-plan.
|
||
|
||
## `main.tf`
|
||
|
||
```hcl
|
||
terraform {
|
||
required_providers {
|
||
aws = {
|
||
source = "hashicorp/aws"
|
||
version = "~> 6.0"
|
||
}
|
||
}
|
||
}
|
||
|
||
provider "aws" {
|
||
region = "us-east-1"
|
||
}
|
||
|
||
resource "aws_opensearch_domain" "devops_es" {
|
||
domain_name = "devops-es"
|
||
|
||
cluster_config {
|
||
instance_type = "t3.small.search"
|
||
instance_count = 1
|
||
}
|
||
|
||
ebs_options {
|
||
ebs_enabled = true
|
||
volume_type = "gp2"
|
||
volume_size = 10
|
||
}
|
||
}
|
||
```
|
||
|
||
## How to run
|
||
|
||
```bash
|
||
cd /home/bob/terraform
|
||
terraform init
|
||
terraform apply -auto-approve
|
||
# Domain creation takes ~10-20 minutes. Wait for apply to fully return.
|
||
|
||
# Required idempotency check:
|
||
terraform plan
|
||
# -> "No changes. Your infrastructure matches the configuration."
|
||
```
|
||
|
||
## How it works
|
||
|
||
### `aws_opensearch_domain`
|
||
|
||
- **`domain_name = "devops-es"`** — the domain name, exactly as required.
|
||
|
||
- **`cluster_config`** — defines the data nodes:
|
||
- `instance_type = "t3.small.search"` — the smallest current-generation
|
||
general-purpose node. OpenSearch instance types carry a `.search` suffix. Small
|
||
burstable nodes keep the domain inside sandbox cost limits (OpenSearch isn't in
|
||
the published KodeKloud caps, so the general "smallest viable instance" rule
|
||
applies).
|
||
- `instance_count = 1` — a single node. No `zone_awareness_enabled` and no
|
||
`dedicated_master_enabled`, which are unnecessary (and would cost more) for a
|
||
lab domain.
|
||
|
||
- **`ebs_options`** — OpenSearch nodes on this instance family use EBS for storage:
|
||
- `ebs_enabled = true` — required for non-instance-store types.
|
||
- `volume_type = "gp2"` — **deliberately gp2, not gp3** (see idempotency note
|
||
below).
|
||
- `volume_size = 10` — 10 GiB, the minimum allowed per node.
|
||
|
||
### Why this config passes the "No changes" plan check
|
||
|
||
The task explicitly requires `terraform plan` to report no drift after apply.
|
||
OpenSearch domains are notorious for phantom diffs; two choices here prevent that:
|
||
|
||
1. **gp2 instead of gp3.** A gp3 volume has `throughput` and `iops` attributes that
|
||
AWS auto-populates with defaults when you don't specify them. Terraform then sees
|
||
values in the remote state that aren't in your config and reports a perpetual
|
||
diff. gp2 has no such tunables, so there's nothing to drift — the cleanest choice
|
||
for an idempotent lab domain.
|
||
|
||
2. **`engine_version` omitted.** When you don't pin the engine version, the argument
|
||
is treated as computed — AWS picks its current default at create, Terraform
|
||
records it in state, and because your config says nothing about it, there's
|
||
nothing to compare against on the next plan. Pinning a version can instead cause
|
||
drift when AWS applies an automatic minor-version patch.
|
||
|
||
Everything else (encryption blocks, endpoint options, auto-tune, off-peak window) is
|
||
left unset, so the provider treats those as computed defaults rather than managed
|
||
values — again, no diff.
|
||
|
||
### On creation time
|
||
|
||
OpenSearch domains provision slowly — the control plane spins up nodes, storage, and
|
||
networking, which typically takes 10–20 minutes. `terraform apply` blocks until the
|
||
domain reaches `Active`, so when the command returns the domain is ready. Don't
|
||
submit until apply completes and the follow-up `plan` is clean.
|
||
|
||
## Verify
|
||
|
||
```bash
|
||
aws opensearch describe-domain --domain-name devops-es \
|
||
--query 'DomainStatus.{Name:DomainName,Processing:Processing,Type:ClusterConfig.InstanceType,Count:ClusterConfig.InstanceCount,Vol:EBSOptions.VolumeType,Size:EBSOptions.VolumeSize}'
|
||
```
|
||
|
||
Expected — name `devops-es`, `Processing: false` (creation finished), instance type
|
||
`t3.small.search`, count `1`, volume `gp2` size `10`.
|