Tasks · The plan as a document

Change the database engine version, and nothing else

The change

Security have asked for PostgreSQL 16.6. Apply it. The workers and the load balancer are serving traffic and must not be touched.

routine6 mindisruption budget 0s simulated

The configuration

variable "environment" {
  type    = string
  default = "prod"
}

locals {
  common_tags = {
    environment = var.environment
    managed_by  = "opentofu"
    team        = "orders"
  }

# Which /24 each zone gets. Written out rather than derived, because
  # deriving it from the key is how three subnets end up sharing a range.
  subnet_numbers = {
    a = 1
    b = 2
    c = 3
  }
}

resource "cloud_vpc" "main" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_hostnames = true
  tags                 = merge(local.common_tags, { name = "orders-main" })
}

resource "cloud_subnet" "private" {
  for_each = toset(["a", "b", "c"])

vpc_id                  = cloud_vpc.main.id
  cidr_block              = cidrsubnet(cloud_vpc.main.cidr_block, 8, lookup(local.subnet_numbers, each.key, 0))
  availability_zone       = "eu-west-1${each.key}"
  map_public_ip_on_launch = false
  tags                    = merge(local.common_tags, { name = "orders-private-${each.key}" })
}

resource "cloud_security_group" "database" {
  name        = "orders-database"
  description = "Managed by Terraform"
  vpc_id      = cloud_vpc.main.id
  tags        = local.common_tags
}

resource "cloud_security_group" "web" {
  name        = "orders-web"
  description = "Managed by Terraform"
  vpc_id      = cloud_vpc.main.id
  tags        = local.common_tags
}

resource "cloud_iam_role" "application" {
  name               = "orders-application"
  assume_role_policy = "{\"Version\":\"2012-10-17\",\"Statement\":[]}"
  description        = "The orders service"
  tags               = local.common_tags
}

resource "cloud_iam_policy" "bucket_access" {
  name        = "orders-bucket-access"
  policy      = "{\"Version\":\"2012-10-17\",\"Statement\":[]}"
  description = "Read and write the orders bucket"
  tags        = local.common_tags
}

resource "cloud_bucket" "uploads" {
  bucket        = "orders-uploads-eu-west-1"
  force_destroy = false
  tags          = local.common_tags
}

resource "cloud_db_instance" "primary" {
  identifier              = "orders-primary"
  instance_class          = "db.r6g.large"
  engine                  = "postgres"
  engine_version          = "16.4"
  username                = "app"
  password                = "correct-horse-battery-staple"
  db_name                 = "orders"
  allocated_storage       = 100
  storage_encrypted       = true
  availability_zone       = "eu-west-1a"
  multi_az                = false
  db_subnet_group_name    = "orders-private"
  backup_retention_period = 7
  skip_final_snapshot     = false
  tags                    = local.common_tags
}

resource "cloud_instance" "worker" {
  count = 3

ami                    = "ami-0a1b2c3d4e5f60718"
  instance_type          = "t3.medium"
  subnet_id              = cloud_subnet.private["a"].id
  availability_zone      = "eu-west-1a"
  vpc_security_group_ids = [cloud_security_group.web.id]
  monitoring             = false
  tags                   = merge(local.common_tags, { name = "orders-worker" })
}

resource "cloud_lb" "public" {
  name                       = "orders-public"
  internal                   = false
  load_balancer_type         = "application"
  subnets                    = [for s in cloud_subnet.private : s.id]
  security_groups            = [cloud_security_group.web.id]
  enable_deletion_protection = true
  tags                       = local.common_tags
}

resource "cloud_dns_record" "api" {
  zone_id = "Z0SAMPLEZONEID01"
  name    = "api.orders.example.com"
  type    = "CNAME"
  ttl     = 300
  records = [cloud_lb.public.dns_name]
}

# __APPEND__

The plan

Plan: 0 to add, 0 to change, 0 to destroy.

Change the configuration first.