 be handy so you can access the machines if needed.
* `vpc_id` - the ID of the VPC to launch the cluster in.

The rest of the configurations are mostly around cluster topology and  machine types and sizes.

### Cluster topology

Two modes of deployment are supported:

* A recommended configuration, with dedicated master-eligible nodes, data nodes, and client nodes. This is a production-ready and best-practice configuration. See more details in the [official documentation](https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-node.html). 
* Single node mode - mostly useful for experimentation

At this point we consider the role `ingest` as unanimous with `data`, so all data nodes are also ingest nodes.

The default mode is the single-node mode. To change it to the recommended configuration, edit `variables.tf` and set number of master nodes to 3, data nodes to at least 2, and client nodes to at least 1.

All nodes with the `client` role will be attached to an ELB, so access to all client nodes can be done via the DNS it exposes.

### Cluster bootstrap
Deploying a cluster in non single-node mode requires [bootstrapping the cluster](https://www.elastic.co/guide/en/elasticsearch/reference/master/modules-discovery-bootstrap-cluster.html).  
We do this automatically, by spinning up a special bootstrap node, and terminating it once finished. This only happens once, first time you deploy the cluster. State information on whether cluster is bootstrapped or not is kept in a local file `cluster_bootstrap_state` which is used on later `terraform apply` runs.    
After the bootstrap node has terminated, you can start using the cluster.

### Security groups

By default we create two security groups - one for the internal cluster nodes (data and master), and one for the client nodes. Your applications need to be in the latter only, and communicate with the cluster via the client nodes only.

If you prefer using a security group of your own, you can add it to `additional_security_groups` in variables.tf.

## Launch the cluster with Terraform

On first usage, you will need to execute `terraform init` to initialize the terraform providers used.

To deploy the cluster, or apply any changes to an existing cluster deployed using this project, run:

```bash
terraform plan
terraform apply
```

When terraform is done, you should see a lot of output ending with something like this:

```
Apply complete! Resources: 14 added, 0 changed, 0 destroyed.

The state of your infrastructure has been saved to the path
below. This state is required to modify and destroy your
infrastructure, so keep it safe. To inspect the complete state
use the `terraform show` command.

State path: terraform.tfstate

Outputs:

clients_dns = internal-es-test-client-lb-963348710.eu-central-1.elb.amazonaws.com
```

Note `clients_dns` - that's your entry point to the cluster.

### Look around

The client nodes are the ones exposed to external networks. They provide Kibana, Kopf and direct Elasticsearch access. Client nodes are accessible via their public IPs (depending on your security group / VPC settings) and the DNS of the ELB they are attached to (see above).

Client nodes listen on port 8080 and are password protected. Access is managed by nginx which is expecting a username and password pair. Default ones are exampleuser/changeme. You can change those defaults by editing [this file](https://github.com/synhershko/elasticsearch-cloud-deploy/blob/master/packer/install-nginx.sh) and running Packer again.

On client nodes you will find:

* Kibana access is direct on port 8080 (http://host:8080)
* [Cerebro](https://github.com/lmenezes/cerebro) (a cluster management UI) is available on http://host:8080/cerebro/
* For direct Elasticsearch access, go to host:8080/es/

You can pull the list of instances by their state and role using aws-cli:

```bash
aws ec2 describe-instances --filters Name=instance-state-name,Values=running
aws ec2 describe-instances --filters Name=instance-state-name,Values=running,Name=tag:Role,Values=client
```

To login to one of the instances:

```bash
ssh -i elasticsearch.pem ubuntu@{public IP / DNS of the instance}
```

### Changing cluster size after deployment

Terraform is smart enough to make the least amount of changes possible and resize resources when possible instead of destroying them.
 
When you want to change the cluster configuration (e.g. add more client nodes, data nodes, resize disk or instances, etc) just edit variables.tf and run `terraform plan` followed by `terraform apply`.Employee ownership: A Viable Exit Strategy
At some point in the life cycle of a typical small to medium sized business the owner(s) will turn their minds to the question of their “exit” strategy.The most common goal is to seek a trade sale of the business, or a partial exit involving investment by a private equity firm or similar investor. Another option is the “management buy out” where the key managers buy the business supported by a bank or similar funder. For a larger business, flotation might also be a realistic possibility.
Is there another way?
A new variation on the theme which is gathering pace is the idea of transferring the business into the ownership of employees generally. There is no single model for this but it may be based on any or all of the following circumstances :
- the owner does not wish to pass control to a competitor who may simply take the business and dispense with the services of anyone who does not fit the new corporate culture,
- the owner is attracted by the proposition, supported by substantial academic research, that businesses owned by their employees tend to perform better than those not so owned,
- the new regime may involve “all employee” ownership whereby the entire workforce is “engaged”, partly by share ownership, but also by involvement in the decision making processes through new formal structures, in which all employees are invited to contribute.
Funding
As this route is still relatively new and less common in the market place, funding can be more difficult. However, several factors may converge to render the prospect viable.
The owner may be willing to accept sale proceeds at the lower end of the valuation range, in the knowledge that the business is being left to a motivated workforce who contributed to the creation of the value, and a structure that may be expected to preserve the legacy long term.
Specialist funders are emerging in the market who are familiar with the issues and may be able to offer suitable terms.
The government is keen to widen employee ownership generally and is relaxing various provisions in both company and tax law in order to facilitate this. For example, private companies may buy back shares in instalments (thus allowing the business time to generate the funds necessary to meet the purchase price). They will also be permitted to hold shares in treasury (thus dispensing with the need for an employee benefit trust to “warehouse” the shares).
Possible structures
There are various ways of creating a new “employee owned” structure.
Direct ownership by employees
This may involve direct ownership of shares by employees (with potential for growth in value in their hands to be taxed more favourably than income and thus enhancing its incentive effect).
Shares might be transferred to employees under one or more of the various government-sponsored tax efficient share schemes for employees (“Enterprise Management Incentive” options, “Company Share Option Schemes”, “Share Incentive Plans”, and so on). The 2013 Budget contained a number of measures to make these plans easier and cheaper to operate.
There are also various government-sponsored tax efficient investment schemes (Enterprise Investment Schemes, Seed Enterprise Investment Schemes, etc) that can be implemented.
And there may even be a role for the government’s proposed “Employee Shareholder” scheme (under which employees trade certain employment rights for shares whose growth in value is potentially free of all tax). This assumes that the government presses ahead despite the recent rejection of the plan by the House of Lords.
Ownership by an employee trust
Alternatively, the shares might be held long term in an employee benefit trust. The trustees act solely to benefit employees generally. Although there are generally few tax advantages in this arrangement, other commercial benefits may make the structure attractive and sustainable ( for example, a more engaged workforce, no need to fund dividends to external shareholders, etc), as exemplified by John Lewis, Arup and similar groups.
Other structures
A “partnership” ethos might best be achieved for some (with some tax advantages), by establishing a limited liability partnership and giving traditional partnership rights to the workers accordingly (see related article – Cometh the hour, cometh the LLP).
Any of these schemes may involve cash coming into the company and/or going to the former owners, to acquire shares, with tax breaks along the way.
Conclusion
In our experience of guiding business owners through