Skip to main content
Type: rvn-eks-addons · Latest version: 0.8.4

​
Dependencies and consumers

Every dependency input can be specified manually to reference existing external infrastructure rather than a Ravion module.

​
Readme

Selectable add-ons for an existing EKS cluster. Each add-on is toggled independently and brings its own IAM wiring, so the cluster module stays lean and clusters only carry what they use.

​
Add-ons

Zone-local DNS is on by default and has no form field: the kube-dns Service is patched with trafficDistribution: PreferClose, so every DNS lookup goes to the CoreDNS pod in the caller’s availability zone (the EKS Cluster module spreads those pods across zones). This removes cross-AZ data transfer charges from DNS, the one call every pod makes. It needs Kubernetes 1.31 or later and is switched off with topology_aware_routing_enabled: false under Advanced Terraform variables, which also clears the field again. EBS CSI and the CloudWatch Observability add-on are native EKS add-ons installed purely through the AWS API. Karpenter, the load balancer controller, the External Secrets Operator, Ravion EKS Management, and both observability pipelines additionally install Helm charts into the cluster, which are the only parts that need Kubernetes API connectivity.

​
Logs and metrics destinations

Each signal is one multi-select. The in-cluster log store and Amazon Managed Prometheus are the defaults, so a new cluster’s Logs and Metrics tabs work with nothing filled in. Nothing CloudWatch is installed by default, or as a side effect of anything else. Several destinations that render are a fallback chain, not a merge. Ravion reads the first one that can answer right now - the in-cluster store, then CloudWatch Logs; Amazon Managed Prometheus, then Container Insights - and says which store it is showing. It never merges two of them for the same service, which would show every line twice. What each costs. The in-cluster store costs S3 storage and requests plus the collector pods, with no per-gigabyte ingestion charge. Amazon Managed Prometheus bills per metric sample - roughly $25-50 a month for a 20-service cluster. CloudWatch bills per gigabyte of logs ingested and per metric. Every vendor bills for what it receives, so choosing two of them ships - and pays for - the same lines twice. That is a choice the form makes visible rather than one it prevents. Vendor keys are references, never values. Every API key, token and license key is a Secrets Manager ARN. The External Secrets Operator this module installs reads it in-cluster with its own IAM role and hands it to the collector; the value passes through neither Ravion nor Helm, and appears in no release history. Selecting a vendor with External secrets turned off fails the deployment rather than installing a collector that cannot authenticate. CloudWatch Container Insights is one of these destinations now, not a section of its own. Choosing it installs the add-on with Auto-Monitor off: left at its default, that webhook injects the AWS OpenTelemetry agent into every workload in the cluster and restarts the pods to do it. Application Signals auto-instrumentation is a separate toggle, off unless asked for, with a namespace list. Upgrading from 0.7.x changes nothing you did not ask for: a cluster with Logs on keeps the in-cluster store, a cluster with Logs off stays off, and a cluster that had Container Insights on keeps it as the fallback behind Amazon Managed Prometheus. The one behavioural change is that the CloudWatch add-on is re-applied with Auto-Monitor off, so agents it had injected leave workloads on their next rollout.

​
Ravion EKS Management

Ravion Operator is Ravion’s in-cluster agent. It dials the control plane outbound over a single WebSocket and reports workload, rollout, and node state back — the control plane can never dial in, which is what makes a cluster with a private API endpoint observable from Ravion at all. Outbound 443 to the agent endpoint is the only egress a cluster has to allow. Enabling the toggle does three things in one deployment: Ravion issues the agent’s credential — server-side, authorized by the pipeline’s own credentials, so there is no API key to paste — writes it into the agent’s Kubernetes secret and mirrors it into a Secrets Manager secret in your own AWS account, and installs the agent’s Helm chart. The plaintext is issued exactly once; rotating or revoking it is a redeploy, not an API call. Ravion EKS Management controls both Operator installation and in-cluster deployments. Deployments follow this toggle, including when upgrading an installation that previously disabled the separate deployments flag. By default, it enables durable executor Jobs, HA Operator and full-cluster management. Durable executor Jobs are enabled automatically, isolating deployments in Jobs; self-update stays on, so Ravion keeps the agent current. The module pins chart 0.5.1 from public.ecr.aws/a8z1i1r2/operator, which bundles its matching verified multiarchitecture image digest as the floor a fresh install starts from. No image digest or chart version needs to be entered. Execution mode customization is available only through Advanced Terraform variables. Earlier form-level mode choices are replaced by the managed defaults; preserve custom settings through advanced overrides before upgrading, and drain deployments and remediation before changing modes. HA Operator is enabled automatically with executor Jobs and requires a replica-aware gateway. It runs two coordinators placed the way Karpenter places itself: one per node, spread across zones, and never on a node Karpenter provisioned, so a coordinator can never keep an autoscaled node alive. They run on the system node group, which has two nodes by default. A replica with no eligible node stays Pending until one appears; nothing provisions nodes. A cluster with a single eligible node needs ravion_operator_coordinator_replicas=1 through Advanced Terraform variables. Each coordinator requests 500m CPU and 1Gi memory; each active executor requests 1 CPU, 2Gi memory and 1Gi ephemeral storage. Nodes still need free resources to schedule the pods. Replica count, placement and executor capacity can be overridden through Advanced Terraform variables. Full-cluster management is enabled by default with Jobs and grants wildcard Kubernetes RBAC, including CRDs, RBAC, namespaces and custom resources. It uses a single retained mutation lane, so only one cluster mutation runs at a time. To restrict deployments, set ravion_operator_full_management_enabled=false and provide ravion_operator_deploy_namespaces through Advanced Terraform variables. Scoped Jobs default to four installation-wide slots for independent namespaces; Kubernetes schedules them against available resources. Drain existing ownership before changing scope or retained capacity. Existing form-level scope, image and HA choices are replaced by these managed defaults; preserve custom settings through advanced overrides before upgrading. Web, worker and cron modules keep their existing Helm deployment definitions. Ravion selects Operator by the cluster ARN; the addons module passes its stable enrollment ID to the chart as the installation identity. The project, environment, and AWS account this module belongs to are recorded on the agent automatically when its credential is issued; there is nothing to fill in. Job mode keeps self-update on: the elected coordinator updates itself when Ravion assigns a version, and pins its executor Jobs to the image it is running. Self-update and deployment namespace settings are available through Advanced Terraform variables. Preserve the installation namespace, identity and retained execution Leases across upgrades. Other installation tuning is available through the same overrides: In restricted mode, deployment namespaces fall back to ravion_operator_namespace_scope when empty. Workload namespace creation is enabled by default. Apply creates missing configured deployment and observation namespaces before installing Operator permissions. Namespaces managed elsewhere are reused without changing ownership. Created namespaces are retained on removal or uninstall. Disable bootstrap with ravion_operator_namespaces_creation_enabled=false through Advanced Terraform variables. Operator itself can create namespaces only with full management enabled. Namespace migration: the default shared namespace is ravion-operator. Moving existing releases replaces them and does not migrate PVCs or retained execution state. Keep an explicit existing namespace override when upgrading a running installation. Helm release names, resource selectors and credential Secret names retain their compatibility identities; the chart source and default connection path use Operator.

​
External secrets

Kubernetes has no equivalent of the ECS task definition’s valueFrom injection, so this add-on installs the External Secrets Operator as the bridge. A service references a secret by ARN; the operator reads it with its own IAM role and materializes it into a Kubernetes secret in the service’s namespace. Values live only in AWS — they never pass through Ravion, Helm values, or Helm release history. Two cluster-scoped stores are created for services to reference, one per AWS backend (the operator’s AWS provider takes a single service per store): By default the operator may read every secret and parameter in the cluster’s account and region. Add readable secret ARNs to scope it to specific secrets or prefixes, or to grant access in another region or account. At rest, the Kubernetes secrets the operator writes are KMS envelope-encrypted in etcd — the EKS Cluster module enables that by default with a dedicated key per cluster.

​
Shared load balancers

Instead of letting each Ingress provision its own ALB, this module can create up to four shared load balancers (public/private ALB, public/private NLB) with Terraform. Workload modules then create a target group and listener rule, and bind pods to the target group in-cluster with the load balancer controller’s TargetGroupBinding CRD — so one load balancer is shared across many services, exactly like the ECS Cluster module’s shared load balancers.
  • Public load balancers require public subnet IDs, inherited from the cluster reference (set them on the EKS Cluster module, where they flow in from its network reference).
  • Private load balancers are placed in the cluster’s node subnets.
  • Each load balancer’s security group is automatically allowed to reach pods through the EKS cluster security group (all TCP ports).
  • Because TargetGroupBinding depends on the controller, enabling any load balancer automatically installs the load balancer controller - there is nothing extra to configure.
Terraform source: ravionhq/modules/compute/eks/addons

​
Prerequisites

  • An EKS Cluster module.
  • When a Helm-installed add-on runs (Karpenter, the External Secrets Operator, Ravion EKS Management, or any shared load balancer - which installs the load balancer controller): a Terraform execution environment in the cluster VPC for private endpoints. The add-ons pipeline automatically attaches the cluster’s Ravion Runner security group for each run. The other add-ons need no cluster connectivity.
The Helm installs authenticate by assuming the cluster’s Ravion Runner role (inherited automatically from the cluster reference) — a stable IAM role the EKS Cluster module registers as an access entry with cluster-admin. Per-run pipeline roles never appear in the cluster’s access configuration. For the load balancer controller to place load balancers automatically, VPC subnets must carry the standard discovery tags: kubernetes.io/role/elb = 1 on public subnets and kubernetes.io/role/internal-elb = 1 on private subnets (alternatively, specify subnets per Ingress via annotation).

​
Configuration

​
Default NodePool

The default NodePool provisions Linux nodes from the selected instance categories and CPU architectures. Capacity types default to both On-demand and Spot, allowing Karpenter to use lower-cost Spot capacity while retaining On-demand as an availability fallback. Restrict the list when workloads require one capacity type. The pool defaults to 100 vCPUs and a 30-day node lifetime. Disable it and bring your own NodePool manifests for full control. *Default NodePool fields are required only when Karpenter and the default NodePool are enabled.

​
Learn more

​
Inputs reference

All inputs for rvn-eks-addons version 0.8.4. Use the name shown for each field as the input key in module config.
​
$ref:rvn-eks-cluster
required
EKS cluster.
  • Immutable after creation

​
Ravion EKS Management

​
boolean
Ravion EKS Management. Register the cluster with Ravion and install Ravion Operator for cluster visibility and in-cluster deployments.
  • Default: true

​
Application load balancers

​
boolean
Public ALB. Create an internet-facing Application Load Balancer for traffic from the public internet.
  • Default: true
​
boolean
HTTPS. Add an HTTPS listener and redirect HTTP requests to it.
  • Default: true
  • Shown when: {"public_alb_creation_enabled":true}
​
$ref:rvn-acm-certificate
required
Certificate. ACM certificate module that supplies the default certificate for the public HTTPS listener.
  • Shown when: {"public_alb_creation_enabled":true,"public_alb_https_enabled":true}
​
string_array
Additional certificate ARNs. Additional ACM certificate ARNs attached to the public ALB HTTPS listener for SNI.
  • Default: []
  • Shown when: {"public_alb_creation_enabled":true,"public_alb_https_enabled":true}
​
string
SSL policy. AWS ELB security policy name for the public HTTPS listener.
  • Shown when: {"public_alb_creation_enabled":true,"public_alb_https_enabled":true}
​
number
Idle timeout (seconds).
  • Min: 1
  • Max: 4000
  • Shown when: {"public_alb_creation_enabled":true}
​
string
WAF web ACL ARN. WAFv2 Web ACL to associate with the public ALB.
  • Shown when: {"public_alb_creation_enabled":true}
​
boolean
Access logs. Write public ALB request logs to S3.
  • Default: false
  • Shown when: {"public_alb_creation_enabled":true}
​
string
Access logs bucket ARN. Existing S3 bucket ARN for access logs. Leave blank to create a private bucket with 90-day retention.
  • Shown when: {"public_alb_access_logs_enabled":true,"public_alb_creation_enabled":true}
​
boolean
Private ALB. Create an internal Application Load Balancer reachable only inside the VPC, for internal APIs, admin tools, and service-to-service traffic.
  • Default: false
​
boolean
HTTPS. Add an HTTPS listener and redirect HTTP requests to it.
  • Default: false
  • Shown when: {"private_alb_creation_enabled":true}
​
$ref:rvn-acm-certificate
required
Certificate. ACM certificate module that supplies the default certificate for the private HTTPS listener.
  • Shown when: {"private_alb_creation_enabled":true,"private_alb_https_enabled":true}
​
string_array
Additional certificate ARNs. Additional ACM certificate ARNs attached to the private ALB HTTPS listener for SNI.
  • Default: []
  • Shown when: {"private_alb_creation_enabled":true,"private_alb_https_enabled":true}
​
string
SSL policy. AWS ELB security policy name for the private HTTPS listener.
  • Shown when: {"private_alb_creation_enabled":true,"private_alb_https_enabled":true}
​
string_array
Allowed IPv4 CIDRs. IPv4 CIDR blocks allowed to reach the private ALB. Leave empty to use the RFC1918 private ranges.
  • Shown when: {"private_alb_creation_enabled":true}
​
string_array
Allowed IPv6 CIDRs. IPv6 CIDR blocks allowed to reach the private ALB. Leave empty to allow no IPv6 ingress.
  • Shown when: {"private_alb_creation_enabled":true}
​
string_array
Allowed security group IDs. Security groups whose members can access the private ALB. Useful for sources without static CIDRs, such as CloudFront VPC origins.
  • Shown when: {"private_alb_creation_enabled":true}
​
number
Idle timeout (seconds).
  • Min: 1
  • Max: 4000
  • Shown when: {"private_alb_creation_enabled":true}
​
boolean
Access logs. Write private ALB request logs to S3.
  • Default: false
  • Shown when: {"private_alb_creation_enabled":true}
​
string
Access logs bucket ARN. Existing S3 bucket ARN for access logs. Leave blank to create a private bucket with 90-day retention.
  • Shown when: {"private_alb_access_logs_enabled":true,"private_alb_creation_enabled":true}

​
Network load balancers

​
boolean
Public NLB. Create an internet-facing Network Load Balancer.
  • Default: false
​
string_array
Additional security group IDs. Additional security groups for the public NLB.
  • Shown when: {"public_nlb_creation_enabled":true}
​
boolean
Cross-zone load balancing. Distribute traffic to healthy targets in every enabled Availability Zone.
  • Default: false
  • Shown when: {"public_nlb_creation_enabled":true}
​
boolean
Use Elastic IP addresses. Assign one static Elastic IP address to each public subnet.
  • Default: false
  • Shown when: {"public_nlb_creation_enabled":true}
​
string_array
Elastic IP allocation IDs. One Elastic IP allocation ID for each public subnet, in matching order.
  • Shown when: {"public_nlb_creation_enabled":true,"public_nlb_elastic_ips_enabled":true}
​
boolean
Access logs. Write public NLB TLS listener connection logs to S3. AWS does not log TCP or UDP listeners.
  • Default: false
  • Shown when: {"public_nlb_creation_enabled":true}
​
string
Access logs bucket ARN. Existing S3 bucket ARN for access logs. Leave blank to create a private bucket with 90-day retention.
  • Shown when: {"public_nlb_access_logs_enabled":true,"public_nlb_creation_enabled":true}
​
boolean
Private NLB. Create an internal Network Load Balancer.
  • Default: false
​
string_array
Additional security group IDs. Additional security groups for the private NLB.
  • Shown when: {"private_nlb_creation_enabled":true}
​
boolean
Cross-zone load balancing. Distribute traffic to healthy targets in every enabled Availability Zone.
  • Default: false
  • Shown when: {"private_nlb_creation_enabled":true}
​
boolean
Use elastic IPs. Assign static Elastic IPs to the private NLB.
  • Default: false
  • Shown when: {"private_nlb_creation_enabled":true}
​
string_array
Elastic IP allocation IDs. Elastic IP allocation IDs for the private NLB, one per subnet.
  • Shown when: {"private_nlb_creation_enabled":true,"private_nlb_elastic_ips_enabled":true}
​
boolean
Access logs. Write private NLB TLS listener connection logs to S3. AWS does not log TCP or UDP listeners.
  • Default: false
  • Shown when: {"private_nlb_creation_enabled":true}
​
string
Access logs bucket ARN. Existing S3 bucket ARN for access logs. Leave blank to create a private bucket with 90-day retention.
  • Shown when: {"private_nlb_access_logs_enabled":true,"private_nlb_creation_enabled":true}
​
boolean
Load balancer deletion protection. Prevent accidental deletion of load balancers created by this module.
  • Default: true
​
string
Load balancer controller chart version. AWS Load Balancer Controller Helm chart version without a leading v, for example 1.14.0. The controller is installed when any shared load balancer is enabled.

​
Karpenter

​
boolean
Karpenter.
  • Default: true
​
string
Chart version. Karpenter and Karpenter CRD Helm chart version without a leading v, for example 1.14.0.
  • Shown when: {"karpenter_enabled":true}
​
string
Controller namespace. Kubernetes namespace for the Karpenter controller, for example kube-system.
  • Shown when: {"karpenter_enabled":true}
​
string
Controller service account. Kubernetes service account name for the Karpenter controller, for example karpenter.
  • Shown when: {"karpenter_enabled":true}
​
boolean
Default NodePool. Create a general-purpose default NodePool and EC2NodeClass so Karpenter can provision nodes out of the box. Disable to manage NodePools yourself.
  • Default: true
  • Shown when: {"karpenter_enabled":true}
​
string_array
required
Capacity types. EC2 purchasing models Karpenter may use. Selecting only Spot can leave workloads pending when Spot capacity is unavailable.
  • Default: ["on-demand","spot"]
  • Allowed values: on-demand (On-demand), spot (Spot)
  • Shown when: {"karpenter_default_node_pool_creation_enabled":true,"karpenter_enabled":true}
​
string_array
required
EC2 instance categories. Single-letter EC2 instance-family categories Karpenter may use, such as c, m, or r.
  • Default: ["c","m","r"]
  • Shown when: {"karpenter_default_node_pool_creation_enabled":true,"karpenter_enabled":true}
​
string_array
required
CPU architectures. CPU architectures Karpenter may provision. Workload images must support every selected architecture.
  • Default: ["amd64"]
  • Allowed values: amd64 (x86_64), arm64 (ARM64)
  • Shown when: {"karpenter_default_node_pool_creation_enabled":true,"karpenter_enabled":true}
​
number
required
CPU limit (vCPUs). Maximum total vCPUs Karpenter may provision through the default NodePool.
  • Default: 100
  • Min: 1
  • Shown when: {"karpenter_default_node_pool_creation_enabled":true,"karpenter_enabled":true}
​
string
required
Node lifetime. Maximum node age before Karpenter drains and replaces it. Use integer segments with s, m, or h, such as 1h30m or 720h; use Never to disable expiration.
  • Default: 720h
  • Pattern: ^(([0-9]+(s|m|h))+|Never)$ — Use integer segments with s, m, or h, such as 1h30m or 720h, or Never.
  • Shown when: {"karpenter_default_node_pool_creation_enabled":true,"karpenter_enabled":true}

​
EBS CSI driver

​
boolean
EBS CSI driver. Enable EBS-backed Kubernetes persistent volumes.
  • Default: false
​
string
Add-on version. AWS EBS CSI add-on version, for example v1.49.0-eksbuild.1. Leave blank to use the latest compatible version.
  • Shown when: {"ebs_csi_driver_enabled":true}

​
Logs

​
boolean
Logs. Collect container logs and send them to the selected destinations. Disabling logs removes the managed collectors and in-cluster log store.
  • Default: true
​
string_array
Log destinations. Send logs to one or more destinations. Ravion queries the in-cluster store first, then CloudWatch. External destinations each receive a copy.
  • Default: ["loki"]
  • Allowed values: loki (In-cluster log store (Loki, S3-backed)), cloudwatch (Amazon CloudWatch Logs), grafana_cloud (Grafana Cloud Logs), datadog (Datadog), new_relic (New Relic), opensearch (Amazon OpenSearch Service), splunk (Splunk (HEC)), otlp (Custom OTLP endpoint)
  • Shown when: {"logs_enabled":true}
​
number
Retention (days). Number of days logs remain searchable before deletion. Enter 1-3650.
  • Default: 30
  • Min: 1
  • Max: 3650
  • Shown when: {"logs_enabled":true,"logs_providers":"loki"}
​
string
Existing S3 log bucket. S3 bucket name for log storage. Leave blank to create a bucket. Lifecycle and encryption remain your responsibility for an existing bucket.
  • Shown when: {"logs_enabled":true,"logs_providers":"loki"}
​
number
CloudWatch retention (days). Retention for the module-managed CloudWatch log groups, in days.
  • Default: 30
  • Shown when: {"logs_enabled":true,"logs_providers":"cloudwatch"}
​
string
Grafana Cloud Loki push URL. Loki push URL from your Grafana Cloud Logs connection details.
  • Shown when: {"logs_enabled":true,"logs_providers":"grafana_cloud"}
​
string
Grafana Cloud Logs user ID. Numeric user or tenant ID from your Grafana Cloud Logs connection details.
  • Shown when: {"logs_enabled":true,"logs_providers":"grafana_cloud"}
​
string
Grafana Cloud token secret ARN. Secrets Manager ARN containing a Grafana Cloud token with logs:write; also grant metrics:write when used for metrics.
  • Shown when: {"logs_enabled":true,"logs_providers":"grafana_cloud"}
​
string
Grafana Cloud stack URL. Grafana Cloud stack URL used for links from Ravion. Leave blank to omit the link.
  • Shown when: {"logs_enabled":true,"logs_providers":"grafana_cloud"}
​
string
Datadog site. Datadog site that receives this cluster’s telemetry.
  • Default: datadoghq.com
  • Allowed values: datadoghq.com (US1 (datadoghq.com)), us3.datadoghq.com (US3 (us3.datadoghq.com)), us5.datadoghq.com (US5 (us5.datadoghq.com)), datadoghq.eu (EU1 (datadoghq.eu)), ap1.datadoghq.com (AP1 (ap1.datadoghq.com)), ddog-gov.com (US1-FED (ddog-gov.com))
  • Shown when: {"logs_enabled":true,"logs_providers":"datadog"}
​
string
Datadog API key secret ARN. Secrets Manager ARN containing the Datadog API key.
  • Shown when: {"logs_enabled":true,"logs_providers":"datadog"}
​
string
New Relic region. New Relic data region used to select the ingestion endpoint.
  • Default: us
  • Allowed values: us (United States), eu (Europe)
  • Shown when: {"logs_enabled":true,"logs_providers":"new_relic"}
​
string
New Relic license key secret ARN. Secrets Manager ARN containing the New Relic license key.
  • Shown when: {"logs_enabled":true,"logs_providers":"new_relic"}
​
string
OpenSearch domain endpoint. HTTPS endpoint for a managed OpenSearch domain in the cluster account and region. After deployment, grant the logs_opensearch_role_arn output access in the domain policy or fine-grained role mapping.
  • Shown when: {"logs_enabled":true,"logs_providers":"opensearch"}
​
string
OpenSearch index prefix. Prefix used for OpenSearch log indexes.
  • Default: ravion-logs
  • Shown when: {"logs_enabled":true,"logs_providers":"opensearch"}
​
string
Splunk HEC URL. Splunk HTTP Event Collector URL, including the /services/collector path.
  • Shown when: {"logs_enabled":true,"logs_providers":"splunk"}
​
string
Splunk HEC token secret ARN. Secrets Manager ARN containing the Splunk HEC token.
  • Shown when: {"logs_enabled":true,"logs_providers":"splunk"}
​
string
Splunk index. Splunk index the events are written to. Leave blank to use the token’s default index.
  • Shown when: {"logs_enabled":true,"logs_providers":"splunk"}
​
string
OTLP logs endpoint. HTTPS OTLP/HTTP endpoint that receives logs.
  • Shown when: {"logs_enabled":true,"logs_providers":"otlp"}
​
string
OTLP authorization secret ARN. Secrets Manager ARN containing the complete Authorization header value. Leave blank when authentication is not required.
  • Shown when: {"logs_enabled":true,"logs_providers":"otlp"}
​
string_array
Excluded namespaces. Kubernetes namespaces whose container logs are excluded from every destination.
  • Default: ["kube-system","kube-node-lease","amazon-cloudwatch","ravion-operator","ravion-beacon"]
  • Shown when: {"logs_enabled":true}

​
Grafana

​
boolean
In-cluster Grafana. Install private Grafana with data sources for selected Loki, Amazon Managed Prometheus, and in-cluster Prometheus destinations. No ingress is created; connect with a port-forward or advanced Helm values.
  • Default: false
​
boolean
Amazon Managed Grafana access. Create an assumable role for querying the selected Amazon Managed Prometheus workspace plus Container Insights and EKS control-plane log groups. No Grafana workspace is created.
  • Default: false
  • Shown when: {"metrics_enabled":true}

​
Metrics

​
boolean
Metrics. Collect workload and Kubernetes metrics and send them to the selected destinations. Disabling metrics removes the managed metrics collectors.
  • Default: true
​
string_array
Metrics destinations. Send metrics to one or more destinations. Ravion queries Amazon Managed Prometheus first, then in-cluster Prometheus and CloudWatch. External destinations each receive a copy.
  • Default: ["amp"]
  • Allowed values: amp (Amazon Managed Prometheus), prometheus (Prometheus in your cluster), cloudwatch (Amazon CloudWatch (Container Insights)), grafana_cloud (Grafana Cloud Metrics), datadog (Datadog), new_relic (New Relic), otlp (Custom OTLP endpoint)
  • Shown when: {"metrics_enabled":true}
​
string
Existing workspace ID. Write into an existing Amazon Managed Prometheus workspace instead of creating one. Leave blank to create a workspace for this cluster.
  • Shown when: {"metrics_enabled":true,"metrics_providers":"amp"}
​
string
Workspace region. AWS Region containing the workspace. Leave blank to use the cluster Region. A different Region sends metrics across Regions.
  • Shown when: {"metrics_enabled":true,"metrics_providers":"amp"}
​
number
Prometheus retention (days). Number of days the in-cluster Prometheus retains metrics.
  • Default: 15
  • Min: 1
  • Shown when: {"metrics_enabled":true,"metrics_providers":"prometheus"}
​
string
Prometheus volume size. Persistent volume size as a Kubernetes quantity, for example 50Gi. Requires a working storage class; Ravion clusters normally use the EBS CSI driver.
  • Default: 50Gi
  • Shown when: {"metrics_enabled":true,"metrics_providers":"prometheus"}
​
string
Existing Prometheus URL. In-cluster base URL of an existing Prometheus remote-write receiver. The module appends /api/v1/write and does not install Prometheus.
  • Shown when: {"metrics_enabled":true,"metrics_providers":"prometheus"}
​
boolean
Enhanced observability. Collect enhanced Container Insights metrics for pods and containers.
  • Default: true
  • Shown when: {"metrics_enabled":true,"metrics_providers":"cloudwatch"}
​
boolean
Application Signals auto-instrumentation. Enable AWS Application Signals auto-instrumentation. Existing pods receive the OpenTelemetry agent when they are recreated.
  • Default: false
  • Shown when: {"metrics_enabled":true,"metrics_providers":"cloudwatch"}
​
string_array
Namespaces to instrument. Namespaces intended for Application Signals. This module publishes the list but does not add injection annotations. Leave empty to enable cluster-wide auto-monitoring.
  • Shown when: {"cloudwatch_application_signals_enabled":true,"metrics_enabled":true,"metrics_providers":"cloudwatch"}
​
string
CloudWatch add-on version. Amazon CloudWatch Observability add-on version, for example v4.7.0-eksbuild.1. Leave blank to use the latest compatible version. Also applies to CloudWatch Logs.
  • Shown when: {"metrics_enabled":true,"metrics_providers":"cloudwatch"}
​
string
Grafana Cloud remote-write URL. Prometheus remote-write URL from your Grafana Cloud Metrics connection details.
  • Shown when: {"metrics_enabled":true,"metrics_providers":"grafana_cloud"}
​
string
Grafana Cloud instance ID. Numeric instance ID from your Grafana Cloud Metrics connection details.
  • Shown when: {"metrics_enabled":true,"metrics_providers":"grafana_cloud"}
​
string
Grafana Cloud token secret ARN. Secrets Manager ARN containing a Grafana Cloud token with metrics:write. The logs credential is reused when Grafana Cloud Logs is also selected.
  • Shown when: {"logs_providers":{"not":"grafana_cloud"},"metrics_enabled":true,"metrics_providers":"grafana_cloud"}
​
string
Datadog site. Datadog site that receives metrics. The logs selection is reused when Datadog Logs is also enabled.
  • Default: datadoghq.com
  • Allowed values: datadoghq.com (US1 (datadoghq.com)), us3.datadoghq.com (US3 (us3.datadoghq.com)), us5.datadoghq.com (US5 (us5.datadoghq.com)), datadoghq.eu (EU1 (datadoghq.eu)), ap1.datadoghq.com (AP1 (ap1.datadoghq.com)), ddog-gov.com (US1-FED (ddog-gov.com))
  • Shown when: {"logs_providers":{"not":"datadog"},"metrics_enabled":true,"metrics_providers":"datadog"}
​
string
Datadog API key secret ARN. Secrets Manager ARN containing the Datadog API key. The logs credential is reused when Datadog Logs is also enabled.
  • Shown when: {"logs_providers":{"not":"datadog"},"metrics_enabled":true,"metrics_providers":"datadog"}
​
string
New Relic region. New Relic data region used to select the ingestion endpoint. The logs selection is reused when New Relic Logs is also enabled.
  • Default: us
  • Allowed values: us (United States), eu (Europe)
  • Shown when: {"logs_providers":{"not":"new_relic"},"metrics_enabled":true,"metrics_providers":"new_relic"}
​
string
New Relic license key secret ARN. Secrets Manager ARN containing the New Relic license key. The logs credential is reused when New Relic Logs is also enabled.
  • Shown when: {"logs_providers":{"not":"new_relic"},"metrics_enabled":true,"metrics_providers":"new_relic"}
​
string
OTLP metrics endpoint. HTTPS OTLP/HTTP endpoint that receives metrics.
  • Shown when: {"metrics_enabled":true,"metrics_providers":"otlp"}
​
string
OTLP authorization secret ARN. Secrets Manager ARN containing the complete Authorization header value. The logs credential is reused when the same OTLP destination is selected for logs.
  • Shown when: {"logs_providers":{"not":"otlp"},"metrics_enabled":true,"metrics_providers":"otlp"}

​
External secrets

​
boolean
External Secrets Operator.
  • Default: true
​
string_array
Readable secret ARNs. Secrets Manager secret and SSM parameter ARNs (wildcards allowed) the operator may read. Leave empty to allow reading every secret and parameter in this account and region. Add entries to scope the operator down, or to reach other regions and accounts.
  • Shown when: {"eso_enabled":true}
​
string
Chart version. External Secrets Helm chart version without a leading v, for example 2.8.0.
  • Shown when: {"eso_enabled":true}
​
string
Operator namespace. Kubernetes namespace for External Secrets. It is created if necessary.
  • Shown when: {"eso_enabled":true}

​
Misc

​
keyvalue
Tags. A map of tags to assign to all resources. Default tags are Owner, ProjectGivenId, EnvironmentGivenId, ModuleGivenId, ModuleId

​
Terraform settings

​
string
OpenTofu version override. Override the environment’s default version for this module
​
string
Ravion Terraform workspace name. Override Terraform state backend workspace name. Defaults to project + environment + module given ids.
  • Immutable after creation
​
object
Advanced Terraform variables. Optional raw Terraform variable overrides for advanced module inputs or one-off overrides. Values here override the generated variables above.
  • Default: {}