Repository navigation
fix(aws): default instance_type to t3.small - #30
Merged
Merged
Conversation
Vault runs with mlock on and pins its binary in RAM. On a 1 GB t3.micro the kernel OOM-killed Vault about six minutes after boot, before bootstrap finished, and took the SSM agent with it. 2 GB is the floor. A cluster that left instance_type unset rolls to the new size on its next apply. No new AMI.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
A fresh one-node cluster on the default
t3.micronever finished bootstrapping. The console log shows the kernel OOM-killing Vault about six minutes after boot: 129 MB of heap plus 414 MB of file-backed pages pinned bymlock, on a 1 GB instance also running four helper daemons and the SSM agent. The agent dropped off at the same time, which is how it surfaced.What
instance_typeis nowt3.small. Variable description, module README, and the AMI bake note say why.Rollout
No new AMI. A cluster that left
instance_typeunset rolls to the new size on its next apply, through the 0.4.0 lifecycle hooks.Follow-up, not in this PR
The image should set
disable_mlock = true, which is HashiCorp's guidance for integrated storage, and drop the memlock limit andIPC_LOCKfrom the unit. That needs an AMI bake and is worth its own change.