Enable bootstrap.memory_lock for Elasticsearch nodes (global) (#255)

.github/workflows/CD.yml

@@ -25,7 +25,7 @@ jobs:
         runs-on: ubuntu-24.04
         strategy:
             matrix:
-                codename: ["noble", "oracular"]
+                codename: ["noble"]
         steps:
             - uses: actions/checkout@v3
             - name: Install InfraHouse APT repository

debian/changelog

@@ -1,3 +1,15 @@
+puppet-code (0.1.0-1build294) noble; urgency=medium
+
+  * commit event. see changes history in git log
+
+ -- root <packager@infrahouse.com>  Fri, 06 Mar 2026 22:27:54 +0000
+
+puppet-code (0.1.0-1build293) noble; urgency=medium
+
+  * commit event. see changes history in git log
+
+ -- root <packager@infrahouse.com>  Fri, 06 Mar 2026 22:26:05 +0000
+
 puppet-code (0.1.0-1build292) noble; urgency=medium
 
   * commit event. see changes history in git log

modules/profile/manifests/elastic/config.pp

@@ -37,4 +37,28 @@
     ],
   }
 
+  if $facts.dig('elasticsearch', 'memory_lock') {
+    file { '/etc/systemd/system/elasticsearch.service.d':
+      ensure => directory,
+    }
+
+    file { '/etc/systemd/system/elasticsearch.service.d/override.conf':
+      ensure  => file,
+      content => "[Service]\nLimitMEMLOCK=infinity\n",
+      notify  => Exec['reload-systemd-for-elastic'],
+      require => File['/etc/systemd/system/elasticsearch.service.d'],
+    }
+
+    file { '/etc/sysctl.d/99-elasticsearch.conf':
+      ensure  => file,
+      content => "vm.swappiness = 1\n",
+      notify  => Exec['apply-elasticsearch-sysctl'],
+    }
+
+    exec { 'apply-elasticsearch-sysctl':
+      command     => '/sbin/sysctl -p /etc/sysctl.d/99-elasticsearch.conf',
+      refreshonly => true,
+    }
+  }
+
 }

modules/profile/templates/elasticsearch.yml.erb

@@ -37,4 +37,8 @@ xpack.security.authc:
     roles: <%= @elastic_monitoring_role_name %>
     authz_exception: true
 
+<% if @facts.dig('elasticsearch', 'memory_lock') -%>
+bootstrap.memory_lock: true
+
+<% end -%>
 logger.org.elasticsearch.discovery.ec2: "INFO"