The company I work for wants to prevent provider lock-in adn therefore told us to use Terraform+Ansible instead of Cloudformation. We already decided to use terragrunt as an addon. While the motivation for the company decision is clear they didn't provide guidance how to achieve this and we have to find out on our own how to do this in an "elegant" way.
In my scenario this means I use the two tools like this:
- provision EC2 instances (Ubuntu 20.04 in this case)
- define security groups with ingress rules
- define host name aliases (assigning them is a weak spot, I will come back to this later)
- install additional OS level components
- install and configure the application
All of this will be run from a devops machine, after that I have a working application setup. But what happens when for example monitoring decides that one of ten instances is no longer healthy ? That component will then be nuked and created from scratch. In this scenario, how can I make sure that:
- the replacement instance is configured using the same Ansible playbooks that were run before ?
- host name aliases will be updated
For the host name alias topic I have to give you a little bit more background on what we need. In one scenario we use an application that does not load balance. Because of this we create for example three instances which we assign aliases:
inst-one -> lg1.company.foo inst-two -> lg2.company.foo inst-three -> lg3.company.foo
Users access the instances using the aliases
Let's assume that
inst-two becomes unhealthy, then this will need to happen:
inst-one -> lg1.company.foo inst-two -> terminated inst-new -> lg2.company.foo inst-three -> lg3.company.foo