Tasks · State

Bring an existing record under management

The change

There is a DNS record called status.orders.example.com that somebody created by hand. It already points where it should. Put it in the configuration without touching what is live.

routine7 mindisruption budget 0s simulated

The configuration

variable "environment" {
  type    = string
  default = "prod"
}

locals {
  common_tags = {
    environment = var.environment
    managed_by  = "opentofu"
    team        = "orders"
  }

# Which /24 each zone gets. Written out rather than derived, because
  # deriving it from the key is how three subnets end up sharing a range.
  subnet_numbers = {
    a = 1
    b = 2
    c = 3
  }
}

resource "cloud_vpc" "main" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_hostnames = true
  tags                 = merge(local.common_tags, { name = "orders-main" })
}

resource "cloud_subnet" "private" {
  for_each = toset(["a", "b", "c"])

vpc_id                  = cloud_vpc.main.id
  cidr_block              = cidrsubnet(cloud_vpc.main.cidr_block, 8, lookup(local.subnet_numbers, each.key, 0))
  availability_zone       = "eu-west-1${each.key}"
  map_public_ip_on_launch = false
  tags                    = merge(local.common_tags, { name = "orders-private-${each.key}" })
}

resource "cloud_security_group" "database" {
  name        = "orders-database"
  description = "Managed by Terraform"
  vpc_id      = cloud_vpc.main.id
  tags        = local.common_tags
}

resource "cloud_security_group" "web" {
  name        = "orders-web"
  description = "Managed by Terraform"
  vpc_id      = cloud_vpc.main.id
  tags        = local.common_tags
}

resource "cloud_iam_role" "application" {
  name               = "orders-application"
  assume_role_policy = "{\"Version\":\"2012-10-17\",\"Statement\":[]}"
  description        = "The orders service"
  tags               = local.common_tags
}

resource "cloud_iam_policy" "bucket_access" {
  name        = "orders-bucket-access"
  policy      = "{\"Version\":\"2012-10-17\",\"Statement\":[]}"
  description = "Read and write the orders bucket"
  tags        = local.common_tags
}

resource "cloud_bucket" "uploads" {
  bucket        = "orders-uploads-eu-west-1"
  force_destroy = false
  tags          = local.common_tags
}

resource "cloud_db_instance" "primary" {
  identifier              = "orders-primary"
  instance_class          = "db.r6g.large"
  engine                  = "postgres"
  engine_version          = "16.4"
  username                = "app"
  password                = "correct-horse-battery-staple"
  db_name                 = "orders"
  allocated_storage       = 100
  storage_encrypted       = true
  availability_zone       = "eu-west-1a"
  multi_az                = false
  db_subnet_group_name    = "orders-private"
  backup_retention_period = 7
  skip_final_snapshot     = false
  tags                    = local.common_tags
}

resource "cloud_instance" "worker" {
  count = 3

ami                    = "ami-0a1b2c3d4e5f60718"
  instance_type          = "t3.medium"
  subnet_id              = cloud_subnet.private["a"].id
  availability_zone      = "eu-west-1a"
  vpc_security_group_ids = [cloud_security_group.web.id]
  monitoring             = false
  tags                   = merge(local.common_tags, { name = "orders-worker" })
}

resource "cloud_lb" "public" {
  name                       = "orders-public"
  internal                   = false
  load_balancer_type         = "application"
  subnets                    = [for s in cloud_subnet.private : s.id]
  security_groups            = [cloud_security_group.web.id]
  enable_deletion_protection = true
  tags                       = local.common_tags
}

resource "cloud_dns_record" "api" {
  zone_id = "Z0SAMPLEZONEID01"
  name    = "api.orders.example.com"
  type    = "CNAME"
  ttl     = 300
  records = [cloud_lb.public.dns_name]
}

# __APPEND__

The plan

Plan: 0 to add, 0 to change, 0 to destroy.

Change the configuration first.