Merge pull request #122 from mdr-engineering/feature/ftd_MSOCI-1445_OptSplunkDrives

Drive Fixes for Moose in mdr-test-c2

test/aws-us-gov/mdr-test-c2/160-splunk-indexer-cluster/terragrunt.hcl

@@ -39,7 +39,6 @@ inputs = {
   vpc_id = dependency.vpc.outputs.vpc_id
   vpc_cidr = local.account_vars.locals.vpc_info["vpc-splunk"]["cidr"]
   azs = dependency.vpc.outputs.azs
-  volume_sizes = local.account_vars.locals.splunk_volume_sizes
   private_subnets = dependency.vpc.outputs.private_subnets
   public_subnets  = dependency.vpc.outputs.public_subnets
 }

test/aws-us-gov/mdr-test-c2/180-splunk-heavy-forwarder/terragrunt.hcl

@@ -13,7 +13,7 @@ locals {
 # working directory, into a temporary folder, and execute your Terraform commands in that folder.
 terraform {
   # Double slash is intentional and required to show root of modules
-  source = "git@github.mdr.defpoint.com:mdr-engineering/xdr-terraform-modules.git//base/splunk_servers/searchhead?ref=v1.0.0"
+  source = "git@github.mdr.defpoint.com:mdr-engineering/xdr-terraform-modules.git//base/splunk_servers/heavy_forwarder?ref=v1.0.0"
 }
 
 dependency "vpc" {
@@ -31,7 +31,7 @@ inputs = {
   # (via the `inputs` section of the root `terragrunt.hcl`). However, modules
   # will be more flexible if you specify particular input values.
   tags = {
-    Purpose = "Splunk Searchhead"
+    Purpose = "Splunk Heavy Forwarder"
     Terraform = "aws/${basename(get_parent_terragrunt_dir())}/${path_relative_to_include()}/"
   }
   prefix = local.account_vars.locals.splunk_prefix

test/aws-us-gov/mdr-test-c2/account.hcl

@@ -23,14 +23,50 @@ locals {
   ]
   splunk_asg_sizes = [ 1, 1, 1 ] # How many?
   splunk_volume_sizes = {
-    "swap": 8,  # minimum: 8
-    "/": 10,    # minimum: 10
-    "/home": 4, # minimum: 4
-    "/var": 15, # minimum: 15
-    "/var/tmp": 4, # minimum: 4
-    "/var/log": 8, # minimum: 8
-    "/var/log/audit": 8, # minimum: 8
-    "/tmp": 4  # minimum: 4
+    "cluster_master" = {
+      "swap": 8,  # minimum: 8
+      "/": 10,    # minimum: 10
+      "/home": 4, # minimum: 4
+      "/var": 15, # minimum: 15
+      "/var/tmp": 4, # minimum: 4
+      "/var/log": 8, # minimum: 8
+      "/var/log/audit": 8, # minimum: 8
+      "/tmp": 4,  # minimum: 4
+      "/opt/splunk": 30, # No minimum; not in base image
+    },
+    "indexer" = {
+      "swap": 8,  # minimum: 8
+      "/": 10,    # minimum: 10
+      "/home": 4, # minimum: 4
+      "/var": 15, # minimum: 15
+      "/var/tmp": 4, # minimum: 4
+      "/var/log": 8, # minimum: 8
+      "/var/log/audit": 8, # minimum: 8
+      "/tmp": 4,  # minimum: 4
+      "/opt/splunk": 30, # No minimum; not in base image
+    },
+    "searchhead" = {
+      "swap": 8,  # minimum: 8
+      "/": 10,    # minimum: 10
+      "/home": 4, # minimum: 4
+      "/var": 15, # minimum: 15
+      "/var/tmp": 4, # minimum: 4
+      "/var/log": 8, # minimum: 8
+      "/var/log/audit": 8, # minimum: 8
+      "/tmp": 4,  # minimum: 4
+      "/opt/splunk": 30, # No minimum; not in base image
+    },
+    "heavy_forwarder" = {
+      "swap": 8,  # minimum: 8
+      "/": 10,    # minimum: 10
+      "/home": 4, # minimum: 4
+      "/var": 15, # minimum: 15
+      "/var/tmp": 4, # minimum: 4
+      "/var/log": 8, # minimum: 8
+      "/var/log/audit": 8, # minimum: 8
+      "/tmp": 4,  # minimum: 4
+      "/opt/splunk": 30, # No minimum; not in base image
+    },
   }
   
   account_tags = { } 
@@ -91,6 +127,7 @@ locals {
   instance_types = {
     "splunk-cm"      = "t3a.small",  # legacy: t2.small
     "splunk-indexer" = "i3en.large", # legacy: t2.small, but whats the point if we don't have instance storage.
+    #"splunk-indexer" = "m5d.large", # these are 1/2 the price of i3en.larges, but my first test didn't work. Worth retesting.
     "splunk-hf"      = "t3a.small", # legacy: t2.medium
     "splunk-sh"      = "t3a.small", # legacy: ? not sure
   }