Requirements

First check Prerequisites.

Kubernetes Namespace Separation

Multiple namespaces are created in Kubernetes during the terraform application process in order to promote security and separation of the applications. All namespaces are created using variable var.k8s_namespace_prefix (default: log). Assuming the default value for k8s_namespace_prefix, Terraform creates the following namespaces in kubernetes:

Type Description
Log LogScale Humio Operator, Strimzi Kafka Brokers / Controllers (Optional), Strimzi Kafka Operator (Optional), Ingestion Generator Pods (Optional)
log-topolvm TopoLVM Controller and Nodes
log-cert Cert Manager
log-ingress NGINX ingress controllers

Cluster Size Configuration

The cluster_size.tpl file specifies the available parameters for different sizes of LogScale clusters. This template defines various cluster sizes, for example xsmall, small, medium and their associated configurations, including node counts, instance types, disk sizes, and resource limits. The Terraform Configuration uses this template to dynamically configure the LogScale deployment based on the selected cluster size. See also Sizing.

The data from cluster_size.tpl is retrieved and rendered by the locals.tf file. The locals.tf file uses the jsondecode function to parse the template and select the appropriate cluster size configuration based on the logscale_cluster_size variable.

This is shown in the following example:

# Local Variables
  locals {
    # Render a template of available cluster sizes
    cluster_size_template = jsondecode(templatefile("${path.module}/cluster_size.tpl", {}))
    cluster_size_rendered = {
      for key in keys(local.cluster_size_template) :
      key => local.cluster_size_template[key]
    }
    cluster_size_selected = local.cluster_size_rendered[var.logscale_cluster_size]
  }

Setting LogScale Configuration Variables

LogScale will be configured with a default set of configuration values that can be overridden or added to by defining var.user_logscale_envars in your TFVAR_FILE. For example, to change default values for LOCAL_STORAGE_MIN_AGE_DAYS and LOCAL_STORAGE_PERCENTAGE, you can set this in your TFVAR_FILE, as shown in the following example:

user_logscale_envvars = [
        {
        "name" = "SECRET_LOGSCALE_CONFIGURATION",
        "valueFrom" = {
            "secretKeyRef" = {
                "key"  = "secret_value"
                "name" = "kubernetes_secret_name"
            }
        }
        },
        { "name" = "LOCAL_STORAGE_MIN_AGE_DAYS", "value" = "7" },
        { "name" = "LOCAL_STORAGE_PERCENTAGE", "value" = "85" }
    ]

The default environment values set by this Terraform are as follows:

Configuration Name Value
S3_STORAGE_BUCKET var.s3_bucket_prefix
S3_STORAGE_REGION var.aws_region
S3_STORAGE_PREFERRED_COPY_SOURCE true
INGEST_FEED_AWS_ROLE_ARN service_account_aws_iam_role_arn
S3_STORAGE_ENCRYPTION_KEY Kubernetes Secret: s3-storage-encryption-key
KAFKA_COMMON_SECURITY_PROTOCOL SSL
USING_EPHEMERAL_DISKS true
LOCAL_STORAGE_PERCENTAGE 80
LOCAL_STORAGE_MIN_AGE_DAYS 1
KAFKA_BOOTSTRAP_SERVERS var.kafka_broker_servers
KAFKA_SERVERS var.kafka_broker_servers
PUBLIC_URL https://${var.logscale_public_fqdn}
AUTHENTICATION_METHOD static
STATIC_USERS Kubernetes Secret: var.k8s_secret_static_user_logins
KAFKA_COMMON_SSL_TRUSTSTORE_TYPE - (removed when var.provision_kafka_servers is set to false) PKCS12
KAFKA_COMMON_SSL_TRUSTSTORE_PASSWORD - (removed when var.provision_kafka_servers is set to false) Kubernetes Secret: local.kafka_truststore_secret_name
KAFKA_COMMON_SSL_TRUSTSTORE_LOCATION - (removed when var.provision_kafka_servers is set to false) /tmp/kafka/ca.p12

Bring Your Own Kafka

If Kafka already exists and meets the following expectations, it can be used in place of Strimzi created by this Terraform. Expected configuration:

  • Client Authentication: None

  • KRaft Mode: Enabled

  • TLS Communications: Enabled

In order to use your own Kafka, make the following modifications to the execution instructions:

  • Set the Terraform variable provision_kafka_servers to false.

  • Set the Terraform variable byo_kafka_connection_string to your connection string.

  • Do not execute the build of Strimzi in the following instructions.

Bring Your Own Certificate

By default, a Let's Encrypt certificate will be generated and placed on the ingress controller. You can bring your own certificate to the ingress by:

Importing or generating a certificate as a k8s secret under the name <resource_name_prefix>-tls-certificate Setting use_own_certificate_for_ingress to true in the .tfvars file.

Targeted Terraform

When leveraging this Terraform repository, you must run terraform using the -target flag to apply specific modules. The latter half of the terraforming process requires access to a Kubernetes API to successfully plan and apply changes.

After the environment is fully built, the targeted approach isn't strictly required but remains recommended to ensure proper order of operations.