Skip to main content
Type: rvn-eks-addons · Latest version: 0.22.0

​
Dependencies and consumers

Every dependency input can be specified manually to reference existing external infrastructure rather than a Ravion module. Set the dependency input to null and set its mapped inputs directly; see Use existing infrastructure instead of a module reference.

​
Readme

Selectable add-ons for an existing EKS cluster. Each add-on is toggled independently and brings its own IAM wiring, so the cluster module stays lean and clusters only carry what they use.

​
Add-ons

Load balancer controller CRDs upgrade with the selected chart version, including custom pins. Disabling or removing the controller retains its CRDs and workload bindings; re-enabling it adopts them again. Delete retained CRDs manually only after all their consumers have been removed. Zone-local DNS is on by default and has no form field: the kube-dns Service is patched with trafficDistribution: PreferClose, so every DNS lookup goes to the CoreDNS pod in the caller’s availability zone (the EKS Cluster module spreads those pods across zones). This removes cross-AZ data transfer charges from DNS, the one call every pod makes. It needs Kubernetes 1.31 or later and is switched off with topology_aware_routing_enabled: false under Advanced Terraform variables, which also clears the field again. EBS CSI and the CloudWatch Observability add-on are native EKS add-ons installed purely through the AWS API. Karpenter, the load balancer controller, the External Secrets Operator, Ravion EKS Management, both observability pipelines, and the EBS storage defaults (the gp3 StorageClass and volume growth) additionally install Helm charts into the cluster, which are the only parts that need Kubernetes API connectivity. Karpenter’s Interruption queue age alarm is enabled by default. It monitors the oldest unprocessed event with a 60-second threshold over one minute. Empty queues do not trigger it. Configure Alert actions and Recovery actions for direct notifications; both default to empty. Standard CloudWatch charges apply.

​
Event-driven autoscaling

KEDA is optional and off by default. Enabling it installs the operator, external metrics API server, admission webhooks and CRDs in KEDA namespace. Components default to On-Demand EC2 placement. It does not create workload scaling triggers or change Karpenter capacity settings. Install the add-ons before configuring workload ScaledObjects. Scaling from zero requires a signal that exists with no Spot application pods, such as an external backlog or shared ingress metric. Configure metric-source permissions and authentication separately; installation grants no AWS query permissions. Reference Secrets through TriggerAuthentication rather than putting credentials in trigger metadata or Helm values. KEDA owns the external metrics API, so check for an existing adapter before installing. Remove dependent ScaledObjects and TriggerAuthentications before disabling it. CRDs are managed by the Helm chart; follow the selected version’s upgrade and removal guidance. KEDA chart version defaults to 2.20.2. Its published Kubernetes test matrix covers 1.33–1.35; verify newer cluster versions, including 1.36, in staging before production adoption. Advanced chart settings can be supplied through keda_helm_values in Advanced Terraform variables.

​
Certificates

cert-manager is optional and off by default. Enabling it installs the controller, webhook, CA injector and CRDs in cert-manager namespace. Components default to On-Demand EC2 placement so certificates keep renewing through Spot interruptions. It creates no Issuers or Certificates; define those alongside the workloads that use them. The CRDs are kept when cert-manager is turned off, because deleting them would delete every Certificate and Issuer in the cluster and the Secrets they own. Check for an existing cert-manager installation before enabling: a cluster can run only one. cert-manager chart version defaults to v1.21.2. Check the version’s supported Kubernetes releases against your cluster before enabling or upgrading. Advanced chart settings, such as webhook replicas, can be supplied through cert_manager_helm_values in Advanced Terraform variables.

​
Logs, metrics and traces destinations

Each signal is a list of destinations. Loki, Prometheus with Thanos, and Tempo, each storing in S3, are the defaults, so a new cluster’s Logs and Metrics tabs work with nothing filled in, and its traces are in the in-cluster Grafana. CloudWatch log and metrics collectors are not installed unless selected. The interruption queue uses native SQS metrics independently of these collectors. Traces. Traces runs an OpenTelemetry collector of its own at an in-cluster Service on the OTLP ports (otlp_grpc_endpoint, otlp_http_endpoint), apart from the one that scrapes the cluster, so a burst of spans never competes with the scrape. Every trace goes to each destination card: Tempo in your cluster, AWS X-Ray (the cluster’s region unless another is set), Grafana Cloud Traces, Datadog, New Relic, or any OTLP endpoint. A vendor selected for logs or metrics too shares that signal’s site and credential. Spans carry the sending pod’s namespace, pod and workload. Point a workload’s OpenTelemetry exporter at those outputs: this module injects no agents and restarts no pods, and sampling stays the application’s. While metrics are on, the same receiver takes workload metrics into the metrics destinations; the curated allow-list covers only what the collector scrapes, so every series a workload sends is billed. The receiver authenticates no sender: any pod that reaches its Service can send spans under any service name, and they reach the destinations as sent. Every workload in the cluster is trusted with the trace data; restrict who reaches the collector with a NetworkPolicy when that does not hold. Tempo in your cluster is the traces counterpart of the in-cluster log store: Tempo in monolithic mode, reachable only inside the cluster and read by the in-cluster Grafana when that is on. Its blocks go to an S3 bucket in your account by default (30 days), or to Tempo’s own volume. That volume is a persistent gp3 volume by default, so spans not yet in a block survive a restart, or a scratch volume that restarts empty. Its metrics generator can write service graphs and span metrics to Prometheus for Grafana’s service map, and any other chart value can be set as JSON. Grafana. Turn on In-cluster Grafana for one place to query the cluster’s own stores: Loki, Prometheus through Thanos or Amazon Managed Prometheus, and Tempo, each as a data source when selected. Without Access Grafana is reachable only with a port-forward. Access serves Grafana over HTTPS at a hostname, through either of two methods:
  • Shared load balancer routes the hostname on the HTTPS listener of the shared private or public ALB. The private ALB keeps Grafana inside the VPC and the networks connected to it, such as a VPN or a Tailscale subnet router; the public ALB puts its sign-in page on the internet. Point the hostname’s DNS at private_alb_dns_name or public_alb_dns_name.
  • Kubernetes Ingress gives Grafana an Ingress for the hostname with TLS, served by the controller of the ingress class you name, with any annotations it needs. With the Tailscale Kubernetes operator’s tailscale class and a <name>.<tailnet>.ts.net hostname, Grafana becomes one device on the tailnet with a Let’s Encrypt certificate, and nothing else in the VPC is reachable through it. Install the class’s controller first: the AWS Load Balancer Controller refuses an Ingress whose class does not exist yet.
Grafana sign-in is Grafana’s own: username and password for local users, and any of Grafana’s OAuth providers side by side (Google, GitHub, GitLab, Microsoft Entra ID, Okta, or any OpenID Connect provider through generic OAuth), each configured under Grafana’s own setting names. Each provider’s client secret is a Secrets Manager ARN that External Secrets reads into the cluster. Register https://<hostname>/login/<provider> as the OAuth application’s redirect URI. Several destinations that render are a fallback chain, not a merge. Ravion reads the first one that can answer right now - the in-cluster store, then CloudWatch Logs; Amazon Managed Prometheus when selected, then Prometheus through Thanos, then Container Insights - and says which store it is showing. It never merges two of them for the same service, which would show every line twice. What each costs. The in-cluster stores cost S3 storage and requests, the pods, and their EBS volumes, with no per-gigabyte ingestion charge; S3 does not replace their write-ahead logs on those volumes. Their single-replica defaults are not highly available. Amazon Managed Prometheus bills per metric sample - roughly $25-50 a month for a 20-service cluster. CloudWatch bills per gigabyte of logs ingested and per metric. Every vendor bills for what it receives, so choosing two of them ships - and pays for - the same lines twice. That is a choice the form makes visible rather than one it prevents. Vendor keys are references, never values. Every API key, token and license key is a Secrets Manager ARN. The External Secrets Operator this module installs reads it in-cluster with its own IAM role and hands it to the collector; the value passes through neither Ravion nor Helm, and appears in no release history. Selecting a vendor with External secrets turned off fails the deployment rather than installing a collector that cannot authenticate. CloudWatch Container Insights is one of these destinations now, not a section of its own. Choosing it installs the add-on with Auto-Monitor off: left at its default, that webhook injects the AWS OpenTelemetry agent into every workload in the cluster and restarts the pods to do it. Application Signals auto-instrumentation is a separate toggle, off unless asked for, with a namespace list.

​
Metrics and traces in S3

Metrics history in S3 is on by default. Prometheus keeps 15 days on a 50Gi volume; Thanos uploads its two-hour blocks to S3 and answers queries over both. S3 retention defaults to 365 days and is enforced by the single Thanos compactor, not by bucket object age. Turn S3 history off for a Prometheus that keeps only its own volume. An Existing Prometheus URL skips the managed Prometheus and Thanos entirely and must serve both queries and remote writes. Prometheus storage class and Tempo’s Storage class default to the managed encrypted gp3 class, or the cluster default when the EBS CSI driver is off. Existing metrics bucket and Tempo’s Existing S3 bucket must name buckets dedicated to this cluster, in its region. The module does not manage their lifecycle, encryption settings or customer-managed KMS grants. Buckets the module creates are private and encrypted, but not versioned, and are deleted with what is in them when their destination is removed, when metrics history in S3 or Tempo’s S3 storage is turned off, or when the stack is destroyed. Existing buckets are never deleted. Export what you need before any of those changes. Upgrading to 0.15 changes the defaults: metrics go to Prometheus with Thanos instead of Amazon Managed Prometheus, Traces is on with Tempo, and the EBS CSI driver is on. Destinations you selected explicitly stay as they are. To keep an existing Amazon Managed Prometheus workspace, keep it selected, alone or beside Prometheus: removing it destroys the workspace the module created and its history, which is not copied to S3. An existing Prometheus keeps its release and volume and gets a Thanos sidecar; blocks it compacted earlier are not uploaded. Review the plan before upgrading, keep any namespace overrides, and turn Traces off to defer installing it. Upgrading from 0.7.x also re-applies the CloudWatch add-on with Auto-Monitor off, so agents it had injected leave workloads on their next rollout.

​
Ravion EKS Management

Ravion Operator is Ravion’s in-cluster agent. It dials the control plane outbound over a single WebSocket and reports workload, rollout, and node state back — the control plane can never dial in, which is what makes a cluster with a private API endpoint observable from Ravion at all. Outbound 443 to the agent endpoint is the only egress a cluster has to allow. Enabling the toggle does three things in one deployment: Ravion issues the agent’s credential — server-side, authorized by the pipeline’s own credentials, so there is no API key to paste — writes it into the agent’s Kubernetes secret and mirrors it into a Secrets Manager secret in your own AWS account, and installs the agent’s Helm chart. The plaintext is issued exactly once; rotating or revoking it is a redeploy, not an API call. Ravion EKS Management controls both Operator installation and in-cluster deployments. Deployments follow this toggle, including when upgrading an installation that previously disabled the separate deployments flag. By default, it enables durable executor Jobs, HA Operator and full-cluster management. Durable executor Jobs are enabled automatically, isolating deployments in Jobs; self-update stays on, so Ravion keeps the agent current. The module targets chart 0.5.11 from public.ecr.aws/a8z1i1r2/operator for execution-status watch RBAC and executor image prewarming; it must be published before this module version is released or applied. No image digest or chart version needs to be entered after the required chart is published. Execution mode customization is available only through Advanced Terraform variables. HA Operator is enabled automatically with executor Jobs and requires a replica-aware gateway. It runs two coordinators placed the way Karpenter places itself: one per node, spread across zones, and never on a node Karpenter provisioned, so a coordinator can never keep an autoscaled node alive. They run on the system node group, which has two nodes by default. A replica with no eligible node stays Pending until one appears; nothing provisions nodes. With fewer system nodes than coordinators, the count is reduced to fit automatically. With a single system node, one coordinator runs without high availability, and so does one Karpenter controller. Set the cluster’s system node minimum to 2 or more for high availability. Each coordinator requests 500m CPU and 1Gi memory. Ravion’s runtime policy always supplies resources for newly created executor Jobs; its current fleet defaults request 100m CPU, 128Mi memory and 1Gi ephemeral storage, with limits of 2 CPU, 2Gi memory and 20Gi ephemeral storage. Nodes still need free resources to schedule the pods. Executor resources are not Helm configuration and can be retuned without a chart or module release; existing Jobs remain immutable. Obsolete raw executionJobs.resources and executionJobs.resourcesSource Helm values are ignored. Coordinator resources, image-prewarm pod resources and warm-capacity placeholder resources remain independent and locally configurable. For predictable start latency, ravion_operator_warm_capacity.enabled=true through Advanced Terraform variables creates immediately preemptible, zero-grace placeholder pods. The eight default slots are sized for six executor requests plus a 100% surge of the default two-pod web service. They guarantee schedulable capacity only when their node placement overlaps those workloads and the workloads have priority greater than the placeholder class’s -10; configure slot requests, replica count and placement accordingly. To cache executor images as well, set prewarm.enabled=true in ravion_operator_helm_values and match prewarm.nodeSelector and prewarm.tolerations to executor nodes. The elected coordinator updates this chart-owned DaemonSet to its running digest after self-updates. New nodes and new digests still require their first image pull; this optional feature requires coordinator mode and an Operator image at least 0.5.11. Full-cluster management is enabled by default with Jobs and grants wildcard Kubernetes RBAC, including CRDs, RBAC, namespaces and custom resources. Different releases deploy in parallel, up to twelve at once by default; two versions of the same release never do, and management commands wait for running deploys. Ravion tunes capacity over the air without a module release. Pin it for this cluster with ravion_operator_execution_max_concurrent (1-64) through Advanced Terraform variables. Current Operators always serialize per release; namespace lane selection is not supported. To restrict deployments, set ravion_operator_full_management_enabled=false and provide ravion_operator_deploy_namespaces the same way. Drain existing ownership before changing management scope. Web, worker and cron modules keep their existing Helm deployment definitions. Ravion selects Operator by the cluster ARN; the addons module passes its stable enrollment ID to the chart as the installation identity. The project, environment, and AWS account this module belongs to are recorded on the agent automatically when its credential is issued; there is nothing to fill in. Job mode keeps self-update on: the elected coordinator updates itself when Ravion assigns a version, and pins its executor Jobs to the image it is running. Self-update and deployment namespace settings are available through Advanced Terraform variables. Preserve the installation namespace, identity and retained execution Leases across upgrades. Other installation tuning is available through the same overrides: In restricted mode, deployment namespaces fall back to ravion_operator_namespace_scope when empty. Workload namespace creation is enabled by default. Apply creates missing configured deployment and observation namespaces before installing Operator permissions. Namespaces managed elsewhere are reused without changing ownership. Created namespaces are retained on removal or uninstall. Disable bootstrap with ravion_operator_namespaces_creation_enabled=false through Advanced Terraform variables. Operator itself can create namespaces only with full management enabled. Namespace migration: the default shared namespace is ravion-operator. Moving existing releases replaces them and does not migrate PVCs or retained execution state. Keep an explicit existing namespace override when upgrading a running installation. Helm release names, resource selectors and credential Secret names retain their compatibility identities; the chart source and default connection path use Operator.

​
External secrets

Kubernetes has no equivalent of the ECS task definition’s valueFrom injection, so this add-on installs the External Secrets Operator as the bridge. A service references a secret by ARN; the operator reads it with its own IAM role and materializes it into a Kubernetes secret in the service’s namespace. Values live only in AWS — they never pass through Ravion, Helm values, or Helm release history. Two cluster-scoped stores are created for services to reference, one per AWS backend (the operator’s AWS provider takes a single service per store): By default the operator may read every secret and parameter in the cluster’s account and region. Add readable secret ARNs to scope it to specific secrets or prefixes, or to grant access in another region or account. At rest, the Kubernetes secrets the operator writes are KMS envelope-encrypted in etcd — the EKS Cluster module enables that by default with a dedicated key per cluster.

​
Persistent volumes

With the EBS CSI driver on, the module also sets up two storage defaults. Each can be turned off in the form. Default gp3 storage class. The module creates a StorageClass named gp3 and marks it as the cluster default. A chart that names no StorageClass gets gp3 volumes. EKS stopped creating a default class in Kubernetes 1.30, and without one those volumes stay Pending. The class encrypts volumes, allows them to grow, and creates each volume in the availability zone its pod was scheduled to. If your cluster already has a StorageClass named gp3 that this module didn’t create, the install fails. Delete that class or turn this option off. Online StatefulSet volume growth. Kubernetes doesn’t let a StatefulSet’s volume size change after it is created. Raising a chart’s volume size, for example pvc.size in a NATS chart, normally makes the deploy fail. With this option on:
  1. The deploy goes through. An admission policy accepts a StatefulSet update whose only volume change is a larger size, records the new size on the StatefulSet (ravion.com/volume-claim-template-sizes), and leaves the stored template unchanged.
  2. Within about 30 seconds, an in-cluster resizer grows each existing volume to the new size. It also grows volumes that the StatefulSet creates later, when it scales up.
  3. The EBS CSI driver resizes the EBS volume and its filesystem while the pod keeps running. Pods aren’t restarted and data isn’t copied.
Other volume changes, such as a smaller size, a different StorageClass or a different access mode, are still rejected, and the deploy fails as before. Volumes can only grow. kubectl get statefulset keeps showing the original template size. The volumes themselves show the real size. Some limits apply:
  • This needs Kubernetes 1.36 or newer, which is when MutatingAdmissionPolicy became generally available. On older clusters, only the StorageClass is installed.
  • The volume’s StorageClass must allow expansion. The gp3 class does.
  • AWS allows one modification per EBS volume every 6 hours. A second size increase within that window is applied once the window ends.
  • If a deploy that raised the size fails and rolls back, the volumes may already have grown. They keep the larger size, because a volume can’t shrink.

​
Shared load balancers

Instead of letting each Ingress provision its own ALB, this module can create up to four shared load balancers (public/private ALB, public/private NLB) with Terraform. Workload modules then create a target group and listener rule, and bind pods to the target group in-cluster with the load balancer controller’s TargetGroupBinding CRD — so one load balancer is shared across many services, exactly like the ECS Cluster module’s shared load balancers.
  • Public load balancers require public subnet IDs, inherited from the cluster reference (set them on the EKS Cluster module, where they flow in from its network reference).
  • Private load balancers are placed in the cluster’s node subnets.
  • Each load balancer’s security group is automatically allowed to reach pods through the EKS cluster security group (all TCP ports).
  • Because TargetGroupBinding depends on the controller, enabling any load balancer automatically installs the load balancer controller - there is nothing extra to configure.
Terraform source: ravionhq/modules/compute/eks/addons

​
Prerequisites

  • An EKS Cluster module.
  • When a Helm-installed add-on runs (Karpenter, the External Secrets Operator, Ravion EKS Management, the EBS CSI driver’s storage defaults, or any shared load balancer - which installs the load balancer controller): a Terraform execution environment in the cluster VPC for private endpoints. The add-ons pipeline automatically attaches the cluster’s Ravion Runner security group for each run. The other add-ons need no cluster connectivity.
The Helm installs authenticate by assuming the cluster’s Ravion Runner role (inherited automatically from the cluster reference) — a stable IAM role the EKS Cluster module registers as an access entry with cluster-admin. Per-run pipeline roles never appear in the cluster’s access configuration. For the load balancer controller to place load balancers automatically, VPC subnets must carry the standard discovery tags: kubernetes.io/role/elb = 1 on public subnets and kubernetes.io/role/internal-elb = 1 on private subnets (alternatively, specify subnets per Ingress via annotation).

​
Configuration

​
Default NodePool

The default NodePool provisions Linux nodes from the selected instance categories and CPU architectures. Capacity types default to both On-demand and Spot, allowing Karpenter to use lower-cost Spot capacity while retaining On-demand as an availability fallback. Restrict the list when workloads require one capacity type. The pool defaults to 100 vCPUs and a 30-day node lifetime. Disable it and bring your own NodePool manifests for full control. Default NodePool fields are required only when Karpenter and the default NodePool are enabled.

​
Static Spot warm nodes

Set Minimum warm Spot instances above zero to add a spot-warm static NodePool with that desired floor. This alpha Karpenter capacity feature requires version 1.8 or newer. It creates whole Spot nodes, not a CPU or memory reservation, and the count is a desired floor rather than a guarantee that nodes are available. Static nodes are outside the default NodePool CPU limit and may add EC2 and Spot interruption costs. Workloads must tolerate and select Spot capacity to use this pool. Warm-capacity placeholders pinned to the default NodePool do not consume spot-warm; the reservations are independent. Setting the count to zero removes the static NodePool through the normal owner-reference lifecycle, draining and deleting those nodes, which can disrupt workloads; validate that transition on a live cluster first.

​
Learn more

​
Inputs reference

All inputs for rvn-eks-addons version 0.22.0. Use the name shown for each field as the input key in module config.
​
$ref:rvn-eks-cluster
required
EKS cluster.
  • Immutable after creation
Set cluster to null. Mapped inputs for cluster: set these keys alongside cluster, not inside it, when supplying existing infrastructure instead of a module reference.
​
section
AWS account & region.
​
string
AWS account.
  • Default: << ref.input.aws_account_id >>
  • Immutable after creation
​
string
Region.
  • Default: << ref.input.aws_region >>
  • Immutable after creation
​
string
Terraform execution environment. Execution environment used by OpenTofu. For a private endpoint, choose one in the cluster VPC; the cluster’s Ravion Runner security group is attached automatically for each run.
  • Default: << ref.input.execution_environment_id >>
​
section
Cluster details.
​
string
required
EKS cluster name.
  • Default: <<ref.stack.output.cluster_name>>
  • Immutable after creation
​
string
Ravion Runner role ARN. IAM role Terraform assumes when authenticating to the Kubernetes API.
  • Default: <<ref.stack.output.ravion_runner_role_arn>>
​
string
Ravion Runner security group ID. Security group attached to the OpenTofu runner for access to the Kubernetes API. Leave blank only when the endpoint is public or the execution environment already provides access.
  • Default: <<ref.stack.output.ravion_runner_security_group_id>>
  • Immutable after creation
​
string
Cluster security group ID. EKS-managed security group used by Karpenter nodes and shared load balancers. Required when the default NodePool or any shared load balancer is enabled.
  • Default: <<ref.stack.output.cluster_security_group_id>>
​
string_array
Node subnet IDs. Subnets the default Karpenter NodePool launches nodes into. Also used by internal shared load balancers.
  • Default: <<ref.stack.output.node_subnet_ids>>
​
number
System nodes. Karpenter and Operator replicas scale down to fit. One system node runs one of each without high availability; use 2 or more for HA.
  • Default: << ref.input.system_node_min_size >>
  • Min: 0
​
string_array
Public subnet IDs. Public subnets for internet-facing shared load balancers.
  • Default: <<ref.stack.output.public_subnet_ids>>

​
Ravion EKS Management

​
boolean
Ravion EKS Management. Register the cluster with Ravion and install Ravion Operator for cluster visibility and in-cluster deployments.
  • Default: true

​
Application load balancers

​
string
Name slug. Name used for everything the add-ons create - the shared load balancers and their security groups (<name>-pub, <name>-priv, <name>-pub-nlb, <name>-priv-nlb), the Pod Identity roles, the Loki bucket, the log group, the AMP alias and the Karpenter queue. Defaults to the cluster name. Set it when those names are taken, for example by an ECS cluster with the same name. Up to 23 letters, digits and hyphens.
​
boolean
Ravion-managed domains. On: Ravion manages the cluster certificate and DNS. Off: attach certificates here. Requires one HTTPS-enabled ALB when on.
  • Default: false
​
string
Cluster domain. Base for service addresses; uses the module ID when empty.
  • Pattern: ^[a-z0-9]([a-z0-9-]*[a-z0-9])?$ — The subdomain must contain only lowercase letters, numbers, and hyphens, and start and end with a letter or number.
  • Shown when: {"use_ravion_managed_domains":true}
​
boolean
Public ALB. Create an internet-facing Application Load Balancer for traffic from the public internet.
  • Default: true
​
boolean
HTTPS. Add an HTTPS listener and redirect HTTP requests to it.
  • Default: true
  • Shown when: {"public_alb_creation_enabled":true}
​
$ref:rvn-acm-certificate
required
Certificate. ACM certificate module that supplies the default certificate for the public HTTPS listener.
  • Shown when: {"public_alb_creation_enabled":true,"public_alb_https_enabled":true,"use_ravion_managed_domains":false}
Set public_alb_certificate to null. Mapped inputs for public_alb_certificate: set these keys alongside public_alb_certificate, not inside it, when supplying existing infrastructure instead of a module reference.
​
string_array
required
Certificate ARNs. ACM certificate ARNs supplied by the selected module. The first certificate is used by default.
  • Default: ["<<ref.stack.output.certificate_arn>>"]
​
string_array
Additional certificate ARNs. Additional ACM certificate ARNs attached to the public ALB HTTPS listener for SNI.
  • Default: []
  • Shown when: {"public_alb_creation_enabled":true,"public_alb_https_enabled":true,"use_ravion_managed_domains":false}
​
string
SSL policy. AWS ELB security policy name for the public HTTPS listener.
  • Shown when: {"public_alb_creation_enabled":true,"public_alb_https_enabled":true}
​
number
Idle timeout (seconds).
  • Min: 1
  • Max: 4000
  • Shown when: {"public_alb_creation_enabled":true}
​
string
WAF web ACL ARN. WAFv2 Web ACL to associate with the public ALB.
  • Shown when: {"public_alb_creation_enabled":true}
​
boolean
Access logs. Write public ALB request logs to S3.
  • Default: false
  • Shown when: {"public_alb_creation_enabled":true}
​
string
Access logs bucket ARN. Existing S3 bucket ARN for access logs. Leave blank to create a private bucket that keeps logs for a year.
  • Shown when: {"public_alb_access_logs_enabled":true,"public_alb_creation_enabled":true}
​
boolean
Private ALB. Create an internal Application Load Balancer reachable only inside the VPC, for internal APIs, admin tools, and service-to-service traffic.
  • Default: false
​
boolean
HTTPS. Add an HTTPS listener and redirect HTTP requests to it.
  • Default: false
  • Shown when: {"private_alb_creation_enabled":true}
​
$ref:rvn-acm-certificate
required
Certificate. ACM certificate module that supplies the default certificate for the private HTTPS listener.
  • Shown when: {"private_alb_creation_enabled":true,"private_alb_https_enabled":true,"use_ravion_managed_domains":false}
Set private_alb_certificate to null. Mapped inputs for private_alb_certificate: set these keys alongside private_alb_certificate, not inside it, when supplying existing infrastructure instead of a module reference.
​
string_array
required
Certificate ARNs. ACM certificate ARNs supplied by the selected module. The first certificate is used by default.
  • Default: ["<<ref.stack.output.certificate_arn>>"]
​
string_array
Additional certificate ARNs. Additional ACM certificate ARNs attached to the private ALB HTTPS listener for SNI.
  • Default: []
  • Shown when: {"private_alb_creation_enabled":true,"private_alb_https_enabled":true,"use_ravion_managed_domains":false}
​
string
SSL policy. AWS ELB security policy name for the private HTTPS listener.
  • Shown when: {"private_alb_creation_enabled":true,"private_alb_https_enabled":true}
​
string_array
Allowed IPv4 CIDRs. IPv4 CIDR blocks allowed to reach the private ALB. Leave empty to use the RFC1918 private ranges.
  • Shown when: {"private_alb_creation_enabled":true}
​
string_array
Allowed IPv6 CIDRs. IPv6 CIDR blocks allowed to reach the private ALB. Leave empty to allow no IPv6 ingress.
  • Shown when: {"private_alb_creation_enabled":true}
​
string_array
Allowed security group IDs. Security groups whose members can access the private ALB. Useful for sources without static CIDRs, such as CloudFront VPC origins.
  • Shown when: {"private_alb_creation_enabled":true}
​
number
Idle timeout (seconds).
  • Min: 1
  • Max: 4000
  • Shown when: {"private_alb_creation_enabled":true}
​
boolean
Access logs. Write private ALB request logs to S3.
  • Default: false
  • Shown when: {"private_alb_creation_enabled":true}
​
string
Access logs bucket ARN. Existing S3 bucket ARN for access logs. Leave blank to create a private bucket that keeps logs for a year.
  • Shown when: {"private_alb_access_logs_enabled":true,"private_alb_creation_enabled":true}

​
Network load balancers

​
boolean
Public NLB. Create an internet-facing Network Load Balancer.
  • Default: false
​
string_array
Additional security group IDs. Additional security groups for the public NLB.
  • Shown when: {"public_nlb_creation_enabled":true}
​
boolean
Cross-zone load balancing. Distribute traffic to healthy targets in every enabled Availability Zone.
  • Default: false
  • Shown when: {"public_nlb_creation_enabled":true}
​
boolean
Use Elastic IP addresses. Assign one static Elastic IP address to each public subnet.
  • Default: false
  • Shown when: {"public_nlb_creation_enabled":true}
​
string_array
Elastic IP allocation IDs. One Elastic IP allocation ID for each public subnet, in matching order.
  • Shown when: {"public_nlb_creation_enabled":true,"public_nlb_elastic_ips_enabled":true}
​
boolean
Access logs. Write public NLB TLS listener connection logs to S3. AWS does not log TCP or UDP listeners.
  • Default: false
  • Shown when: {"public_nlb_creation_enabled":true}
​
string
Access logs bucket ARN. Existing S3 bucket ARN for access logs. Leave blank to create a private bucket that keeps logs for a year.
  • Shown when: {"public_nlb_access_logs_enabled":true,"public_nlb_creation_enabled":true}
​
boolean
Private NLB. Create an internal Network Load Balancer.
  • Default: false
​
string_array
Additional security group IDs. Additional security groups for the private NLB.
  • Shown when: {"private_nlb_creation_enabled":true}
​
boolean
Cross-zone load balancing. Distribute traffic to healthy targets in every enabled Availability Zone.
  • Default: false
  • Shown when: {"private_nlb_creation_enabled":true}
​
boolean
Use elastic IPs. Assign static Elastic IPs to the private NLB.
  • Default: false
  • Shown when: {"private_nlb_creation_enabled":true}
​
string_array
Elastic IP allocation IDs. Elastic IP allocation IDs for the private NLB, one per subnet.
  • Shown when: {"private_nlb_creation_enabled":true,"private_nlb_elastic_ips_enabled":true}
​
boolean
Access logs. Write private NLB TLS listener connection logs to S3. AWS does not log TCP or UDP listeners.
  • Default: false
  • Shown when: {"private_nlb_creation_enabled":true}
​
string
Access logs bucket ARN. Existing S3 bucket ARN for access logs. Leave blank to create a private bucket that keeps logs for a year.
  • Shown when: {"private_nlb_access_logs_enabled":true,"private_nlb_creation_enabled":true}
​
boolean
Load balancer deletion protection. Prevent accidental deletion of load balancers created by this module.
  • Default: true
​
string
Load balancer controller chart version. AWS Load Balancer Controller Helm chart version without a leading v, for example 3.5.0. The controller is installed when any shared load balancer is enabled.

​
Karpenter

​
boolean
Karpenter.
  • Default: true
​
boolean
Interruption queue age alarm. Detect stalled interruption processing. Disable if monitored elsewhere. CloudWatch charges apply.
  • Default: true
  • Shown when: {"karpenter_enabled":true}
​
number
Oldest message threshold (seconds). Triggers when the maximum age over one minute reaches this value. Must be below the queue retention period (300 seconds by default).
  • Default: 60
  • Min: 1
  • Shown when: {"karpenter_enabled":true,"karpenter_interruption_queue_alarm_creation_enabled":true}
​
string_array
Alert actions. Invoked when entering ALARM, for example an SNS topic ARN. Empty disables direct notifications.
  • Default: []
  • Shown when: {"karpenter_enabled":true,"karpenter_interruption_queue_alarm_creation_enabled":true}
​
string_array
Recovery actions. Invoked when returning to OK. Empty disables direct recovery notifications.
  • Default: []
  • Shown when: {"karpenter_enabled":true,"karpenter_interruption_queue_alarm_creation_enabled":true}
​
string
Chart version. Karpenter and Karpenter CRD Helm chart version without a leading v, for example 1.14.1.
  • Shown when: {"karpenter_enabled":true}
​
string
Controller namespace. Kubernetes namespace for the Karpenter controller, for example kube-system.
  • Shown when: {"karpenter_enabled":true}
​
string
Controller service account. Kubernetes service account name for the Karpenter controller, for example karpenter.
  • Shown when: {"karpenter_enabled":true}
​
boolean
Default NodePool. Create a general-purpose default NodePool and EC2NodeClass so Karpenter can provision nodes out of the box. Disable to manage NodePools yourself.
  • Default: true
  • Shown when: {"karpenter_enabled":true}
​
number
Minimum warm Spot instances. Enables alpha static Spot capacity when above zero. Zero removes the pool and disables the feature.
  • Default: 0
  • Min: 0
  • Shown when: {"karpenter_default_node_pool_creation_enabled":true,"karpenter_enabled":true}
​
string_array
required
Capacity types. EC2 purchasing models Karpenter may use. Selecting only Spot can leave workloads pending when Spot capacity is unavailable.
  • Default: ["on-demand","spot"]
  • Allowed values: on-demand (On-demand), spot (Spot)
  • Shown when: {"karpenter_default_node_pool_creation_enabled":true,"karpenter_enabled":true}
​
string_array
required
EC2 instance categories. Single-letter EC2 instance-family categories Karpenter may use, such as c, m, or r.
  • Default: ["c","m","r"]
  • Shown when: {"karpenter_default_node_pool_creation_enabled":true,"karpenter_enabled":true}
​
string_array
required
CPU architectures. CPU architectures Karpenter may provision. Workload images must support every selected architecture.
  • Default: ["amd64"]
  • Allowed values: amd64 (x86_64), arm64 (ARM64)
  • Shown when: {"karpenter_default_node_pool_creation_enabled":true,"karpenter_enabled":true}
​
number
required
CPU limit (vCPUs). Maximum total vCPUs Karpenter may provision through the default NodePool.
  • Default: 100
  • Min: 1
  • Shown when: {"karpenter_default_node_pool_creation_enabled":true,"karpenter_enabled":true}
​
string
required
Node lifetime. Maximum node age before Karpenter drains and replaces it. Use integer segments with s, m, or h, such as 1h30m or 720h; use Never to disable expiration.
  • Default: 720h
  • Pattern: ^(([0-9]+(s|m|h))+|Never)$ — Use integer segments with s, m, or h, such as 1h30m or 720h, or Never.
  • Shown when: {"karpenter_default_node_pool_creation_enabled":true,"karpenter_enabled":true}

​
Event-driven autoscaling

​
boolean
KEDA. Install the event-driven autoscaler; each workload still needs a scaling trigger.
  • Default: false
​
string
KEDA namespace.
  • Default: keda
  • Shown when: {"keda_enabled":true}
​
string
KEDA chart version. Verify this version against your cluster’s Kubernetes version before enabling.
  • Default: 2.20.2
  • Shown when: {"keda_enabled":true}

​
Certificates

​
boolean
cert-manager. Issue and renew TLS certificates in the cluster; Issuers and Certificates are configured separately.
  • Default: false
​
string
cert-manager namespace.
  • Default: cert-manager
  • Shown when: {"cert_manager_enabled":true}
​
string
cert-manager chart version. Verify this version against your cluster’s Kubernetes version before enabling.
  • Default: v1.21.2
  • Shown when: {"cert_manager_enabled":true}

​
EBS CSI driver

​
boolean
EBS CSI driver. EBS-backed Kubernetes persistent volumes. The default Prometheus and Tempo volumes need it; turn it off only when another provisioner supplies persistent storage.
  • Default: true
​
string
Add-on version. AWS EBS CSI add-on version, for example v1.49.0-eksbuild.1. Leave blank to use the latest compatible version.
  • Shown when: {"ebs_csi_driver_enabled":true}
​
boolean
Default gp3 storage class. Encrypts volumes and allows expansion. Claims without an explicit class use gp3; installation fails if gp3 is managed elsewhere.
  • Default: true
  • Shown when: {"ebs_csi_driver_enabled":true}
​
boolean
Online StatefulSet volume growth. Allows larger claims without restarting pods when templates explicitly name the managed gp3 class. Other classes still fail. Requires Kubernetes 1.36+.
  • Default: true
  • Shown when: {"ebs_csi_driver_enabled":true}

​
Logs

​
boolean
Logs. Collect container logs and send them to the selected destinations. Disabling logs removes the managed collectors and in-cluster log store.
  • Default: true
​
string_array
Log destinations. Send logs to one or more destinations. Ravion queries the in-cluster store first, then CloudWatch. External destinations each receive a copy.
  • Default: ["loki"]
  • Allowed values: loki (In-cluster log store (Loki, S3-backed)), cloudwatch (Amazon CloudWatch Logs), grafana_cloud (Grafana Cloud Logs), datadog (Datadog), new_relic (New Relic), opensearch (Amazon OpenSearch Service), splunk (Splunk (HEC)), otlp (Custom OTLP endpoint)
  • Shown when: {"logs_enabled":true}
​
number
Retention (days). Number of days logs remain searchable before deletion. Enter 1-3650.
  • Default: 365
  • Min: 1
  • Max: 3650
  • Shown when: {"logs_enabled":true,"logs_providers":"loki"}
​
string
Existing S3 log bucket. S3 bucket name for log storage. Leave blank to create a bucket. Lifecycle and encryption remain your responsibility for an existing bucket.
  • Shown when: {"logs_enabled":true,"logs_providers":"loki"}
​
number
CloudWatch retention (days). Retention for the module-managed CloudWatch log groups, in days.
  • Default: 365
  • Shown when: {"logs_enabled":true,"logs_providers":"cloudwatch"}
​
string
Grafana Cloud Loki push URL. Loki push URL from your Grafana Cloud Logs connection details.
  • Shown when: {"logs_enabled":true,"logs_providers":"grafana_cloud"}
​
string
Grafana Cloud Logs user ID. Numeric user or tenant ID from your Grafana Cloud Logs connection details.
  • Shown when: {"logs_enabled":true,"logs_providers":"grafana_cloud"}
​
string
Grafana Cloud token secret ARN. Secrets Manager ARN containing a Grafana Cloud token with logs:write; also grant metrics:write when used for metrics.
  • Shown when: {"logs_enabled":true,"logs_providers":"grafana_cloud"}
​
string
Grafana Cloud stack URL. Grafana Cloud stack URL used for links from Ravion. Leave blank to omit the link.
  • Shown when: {"logs_enabled":true,"logs_providers":"grafana_cloud"}
​
string
Datadog site. Datadog site that receives this cluster’s telemetry.
  • Default: datadoghq.com
  • Allowed values: datadoghq.com (US1 (datadoghq.com)), us3.datadoghq.com (US3 (us3.datadoghq.com)), us5.datadoghq.com (US5 (us5.datadoghq.com)), datadoghq.eu (EU1 (datadoghq.eu)), ap1.datadoghq.com (AP1 (ap1.datadoghq.com)), ddog-gov.com (US1-FED (ddog-gov.com))
  • Shown when: {"logs_enabled":true,"logs_providers":"datadog"}
​
string
Datadog API key secret ARN. Secrets Manager ARN containing the Datadog API key.
  • Shown when: {"logs_enabled":true,"logs_providers":"datadog"}
​
string
New Relic region. New Relic data region used to select the ingestion endpoint.
  • Default: us
  • Allowed values: us (United States), eu (Europe)
  • Shown when: {"logs_enabled":true,"logs_providers":"new_relic"}
​
string
New Relic license key secret ARN. Secrets Manager ARN containing the New Relic license key.
  • Shown when: {"logs_enabled":true,"logs_providers":"new_relic"}
​
string
OpenSearch domain endpoint. HTTPS endpoint for a managed OpenSearch domain in the cluster account and region. After deployment, grant the logs_opensearch_role_arn output access in the domain policy or fine-grained role mapping.
  • Shown when: {"logs_enabled":true,"logs_providers":"opensearch"}
​
string
OpenSearch index prefix. Prefix used for OpenSearch log indexes.
  • Default: ravion-logs
  • Shown when: {"logs_enabled":true,"logs_providers":"opensearch"}
​
string
Splunk HEC URL. Splunk HTTP Event Collector URL, including the /services/collector path.
  • Shown when: {"logs_enabled":true,"logs_providers":"splunk"}
​
string
Splunk HEC token secret ARN. Secrets Manager ARN containing the Splunk HEC token.
  • Shown when: {"logs_enabled":true,"logs_providers":"splunk"}
​
string
Splunk index. Splunk index the events are written to. Leave blank to use the token’s default index.
  • Shown when: {"logs_enabled":true,"logs_providers":"splunk"}
​
string
OTLP logs endpoint. HTTPS OTLP/HTTP endpoint that receives logs.
  • Shown when: {"logs_enabled":true,"logs_providers":"otlp"}
​
string
OTLP authorization secret ARN. Secrets Manager ARN containing the complete Authorization header value. Leave blank when authentication is not required.
  • Shown when: {"logs_enabled":true,"logs_providers":"otlp"}
​
string_array
Excluded namespaces. Kubernetes namespaces whose container logs are excluded from every destination.
  • Default: ["kube-system","kube-node-lease","amazon-cloudwatch","ravion-operator","ravion-beacon"]
  • Shown when: {"logs_enabled":true}

​
Grafana

​
boolean
In-cluster Grafana. Install Grafana in the cluster with data sources for the selected Loki, Prometheus (through Thanos with S3 storage), Amazon Managed Prometheus, and Tempo destinations. Without access turned on, Grafana is reachable only with a port-forward.
  • Default: false
​
boolean
Access. Serve Grafana over HTTPS at a hostname, on a shared load balancer or through a Kubernetes Ingress. DNS is not managed.
  • Default: false
  • Shown when: {"grafana_enabled":true}
​
string
Served through. How Grafana is reached.
  • Default: load_balancer
  • Allowed values: load_balancer (Shared load balancer), ingress (Kubernetes Ingress)
  • Shown when: {"grafana_access_enabled":true,"grafana_enabled":true}
​
string
Load balancer. Which shared load balancer serves Grafana.
  • Default: private
  • Allowed values: private (Private), public (Public)
  • Shown when: {"grafana_access_enabled":true,"grafana_access_method":"load_balancer","grafana_enabled":true}
​
string
Ingress class. Ingress class whose controller serves Grafana, such as tailscale, nginx or alb. Leave blank for the cluster’s default IngressClass. Install the controller first, such as the Tailscale operator; the AWS Load Balancer Controller refuses an Ingress whose class does not exist yet.
  • Shown when: {"grafana_access_enabled":true,"grafana_access_method":"ingress","grafana_enabled":true}
​
string
Grafana hostname. Hostname Grafana answers on. On a load balancer, a certificate on it must cover the hostname; point DNS at the load balancer. Through an Ingress, it is the Ingress host and TLS host: for Tailscale, <name>.<tailnet>.ts.net, where <name> becomes the device name.
  • Shown when: {"grafana_access_enabled":true,"grafana_enabled":true}
​
number
Listener rule priority. Explicit rule order on the chosen load balancer’s HTTPS listener. Leave blank to let AWS assign the next available priority.
  • Shown when: {"grafana_access_enabled":true,"grafana_access_method":"load_balancer","grafana_enabled":true}
​
object
Ingress annotations. Annotations for the Ingress, as JSON, passed to it as they are, such as {“cert-manager.io/cluster-issuer”: “letsencrypt”} or {“tailscale.com/tags”: “tag:grafana”}.
  • Default: {}
  • Shown when: {"grafana_access_enabled":true,"grafana_access_method":"ingress","grafana_enabled":true}
​
string
TLS secret. Kubernetes Secret holding the hostname’s certificate, for controllers that read one, such as nginx with cert-manager. Leave blank where the controller provides the certificate, as Tailscale does.
  • Shown when: {"grafana_access_enabled":true,"grafana_access_method":"ingress","grafana_enabled":true}
​
boolean
Amazon Managed Grafana access. Create an assumable role for querying the selected Amazon Managed Prometheus workspace plus Container Insights and EKS control-plane log groups. No Grafana workspace is created.
  • Default: false
  • Shown when: {"metrics_enabled":true}

​
Grafana sign-in

​
boolean
Username and password. Grafana’s built-in sign-in for local users, including the generated admin. Turning it off removes the login form and password access to the API, so only the providers below can sign in.
  • Default: true
  • Shown when: {"grafana_enabled":true}
​
string
Role for new accounts. Grafana role an account gets the first time it signs in through a provider, unless the provider’s role mapping says otherwise.
  • Default: Viewer
  • Allowed values: Viewer, Editor, Admin
  • Shown when: {"grafana_enabled":true}
​
object_array
Sign-in providers. Grafana’s OAuth providers people can sign in with, each a button on Grafana’s sign-in page. Google, GitHub and gitlab.com need allowed domains, organizations, teams or groups, since anyone with an account there could otherwise sign in.
  • Shown when: {"grafana_enabled":true}
​
array
Environment variables. Plain environment variables passed to Grafana, as an array of {name, value} objects. Grafana reads any setting from GF_<SECTION>_<KEY>, and expands $__env{NAME} in every setting.
  • Shown when: {"grafana_enabled":true}
​
array
Secrets. Secret references Grafana reads as environment variables, as an array of {name, value_from} objects. value_from must be a full Secrets Manager or SSM Parameter Store ARN. Ravion never reads these values; the External Secrets Operator resolves them inside the cluster. GF_AUTH_<PROVIDER>CLIENT_ID and GF_AUTH<PROVIDER>_CLIENT_SECRET give a sign-in provider its client.
  • Shown when: {"grafana_enabled":true}

​
Metrics

​
boolean
Metrics. Collect workload and Kubernetes metrics and send them to the selected destinations. Disabling metrics removes the managed metrics collectors.
  • Default: true
​
string_array
Metrics destinations. Send metrics to one or more destinations. Ravion queries Amazon Managed Prometheus first, then in-cluster Prometheus, in-cluster Mimir and CloudWatch. External destinations each receive a copy. Prometheus suits most clusters; Mimir is for clusters that outgrow one Prometheus, and costs more to run.
  • Default: ["prometheus"]
  • Allowed values: amp (Amazon Managed Prometheus), prometheus (Prometheus in your cluster), mimir (Grafana Mimir in your cluster (large clusters)), cloudwatch (Amazon CloudWatch (Container Insights)), grafana_cloud (Grafana Cloud Metrics), datadog (Datadog), new_relic (New Relic), otlp (Custom OTLP endpoint)
  • Shown when: {"metrics_enabled":true}
​
string
Existing workspace ID. Write into an existing Amazon Managed Prometheus workspace instead of creating one. Leave blank to create a workspace for this cluster.
  • Shown when: {"metrics_enabled":true,"metrics_providers":"amp"}
​
string
Workspace region. AWS Region containing the workspace. Leave blank to use the cluster Region. A different Region sends metrics across Regions.
  • Shown when: {"metrics_enabled":true,"metrics_providers":"amp"}
​
number
Prometheus retention (days). Days of recent metrics Prometheus keeps on its own volume, apart from the history in S3.
  • Default: 15
  • Min: 1
  • Shown when: {"metrics_enabled":true,"metrics_providers":"prometheus"}
​
string
Prometheus volume size. Persistent volume size as a Kubernetes quantity, for example 50Gi. Requires a working storage class; Ravion clusters normally use the EBS CSI driver.
  • Default: 50Gi
  • Shown when: {"metrics_enabled":true,"metrics_providers":"prometheus"}
​
string
Prometheus storage class. StorageClass of Prometheus’s volume. Leave blank for the managed gp3 class, or the cluster default when the EBS CSI driver is off.
  • Shown when: {"metrics_enabled":true,"metrics_providers":"prometheus"}
​
boolean
Metrics history in S3. Thanos uploads Prometheus’s two-hour blocks to S3, keeps them for the S3 retention, and answers queries over both. Off, Prometheus keeps only its own volume. Ignored with an existing Prometheus URL.
  • Default: true
  • Shown when: {"metrics_enabled":true,"metrics_providers":"prometheus"}
​
number
S3 retention (days). Days of metrics history Thanos keeps in S3. Its compactor deletes older blocks, not a bucket lifecycle rule.
  • Default: 365
  • Min: 1
  • Shown when: {"metrics_enabled":true,"metrics_providers":"prometheus","prometheus_s3_storage_enabled":true}
​
string
Existing metrics bucket. Store metrics history in an existing bucket instead of creating one. It must be dedicated to this cluster and in its region; customer-managed KMS grants remain your responsibility.
  • Shown when: {"metrics_enabled":true,"metrics_providers":"prometheus","prometheus_s3_storage_enabled":true}
​
string
Existing Prometheus URL. In-cluster base URL of an existing Prometheus remote-write receiver. The module appends /api/v1/write and does not install Prometheus.
  • Shown when: {"metrics_enabled":true,"metrics_providers":"prometheus"}
​
number
Mimir retention (days). Days of metrics history Mimir keeps in S3.
  • Default: 365
  • Min: 1
  • Shown when: {"metrics_enabled":true,"metrics_providers":"mimir"}
​
string
Existing Mimir bucket. Store Mimir’s metrics in an existing bucket instead of creating one. It must be dedicated to Mimir on this cluster and in its region; customer-managed KMS grants remain your responsibility.
  • Shown when: {"metrics_enabled":true,"metrics_providers":"mimir"}
​
string
Mimir storage class. StorageClass of Mimir’s volumes. Leave blank for the managed gp3 class, or the cluster default when the EBS CSI driver is off.
  • Shown when: {"metrics_enabled":true,"metrics_providers":"mimir"}
​
string_array
Mimir availability zones. Three or more availability zones to keep one copy of every sample in each, so losing a whole zone loses nothing. Leave empty to keep the three copies on separate nodes, spread across zones where possible. The cluster’s nodes must be able to launch in every zone listed.
  • Shown when: {"metrics_enabled":true,"metrics_providers":"mimir"}
​
boolean
Enhanced observability. Collect enhanced Container Insights metrics for pods and containers.
  • Default: true
  • Shown when: {"metrics_enabled":true,"metrics_providers":"cloudwatch"}
​
boolean
Application Signals auto-instrumentation. Enable AWS Application Signals auto-instrumentation. Existing pods receive the OpenTelemetry agent when they are recreated.
  • Default: false
  • Shown when: {"metrics_enabled":true,"metrics_providers":"cloudwatch"}
​
string_array
Namespaces to instrument. Namespaces intended for Application Signals. This module publishes the list but does not add injection annotations. Leave empty to enable cluster-wide auto-monitoring.
  • Shown when: {"cloudwatch_application_signals_enabled":true,"metrics_enabled":true,"metrics_providers":"cloudwatch"}
​
string
CloudWatch add-on version. Amazon CloudWatch Observability add-on version, for example v4.7.0-eksbuild.1. Leave blank to use the latest compatible version. Also applies to CloudWatch Logs.
  • Shown when: {"metrics_enabled":true,"metrics_providers":"cloudwatch"}
​
string
Grafana Cloud remote-write URL. Prometheus remote-write URL from your Grafana Cloud Metrics connection details.
  • Shown when: {"metrics_enabled":true,"metrics_providers":"grafana_cloud"}
​
string
Grafana Cloud instance ID. Numeric instance ID from your Grafana Cloud Metrics connection details.
  • Shown when: {"metrics_enabled":true,"metrics_providers":"grafana_cloud"}
​
string
Grafana Cloud token secret ARN. Secrets Manager ARN containing a Grafana Cloud token with metrics:write. The logs credential is reused when Grafana Cloud Logs is also selected.
  • Shown when: {"logs_providers":{"not":"grafana_cloud"},"metrics_enabled":true,"metrics_providers":"grafana_cloud"}
​
string
Datadog site. Datadog site that receives metrics. The logs selection is reused when Datadog Logs is also enabled.
  • Default: datadoghq.com
  • Allowed values: datadoghq.com (US1 (datadoghq.com)), us3.datadoghq.com (US3 (us3.datadoghq.com)), us5.datadoghq.com (US5 (us5.datadoghq.com)), datadoghq.eu (EU1 (datadoghq.eu)), ap1.datadoghq.com (AP1 (ap1.datadoghq.com)), ddog-gov.com (US1-FED (ddog-gov.com))
  • Shown when: {"logs_providers":{"not":"datadog"},"metrics_enabled":true,"metrics_providers":"datadog"}
​
string
Datadog API key secret ARN. Secrets Manager ARN containing the Datadog API key. The logs credential is reused when Datadog Logs is also enabled.
  • Shown when: {"logs_providers":{"not":"datadog"},"metrics_enabled":true,"metrics_providers":"datadog"}
​
string
New Relic region. New Relic data region used to select the ingestion endpoint. The logs selection is reused when New Relic Logs is also enabled.
  • Default: us
  • Allowed values: us (United States), eu (Europe)
  • Shown when: {"logs_providers":{"not":"new_relic"},"metrics_enabled":true,"metrics_providers":"new_relic"}
​
string
New Relic license key secret ARN. Secrets Manager ARN containing the New Relic license key. The logs credential is reused when New Relic Logs is also enabled.
  • Shown when: {"logs_providers":{"not":"new_relic"},"metrics_enabled":true,"metrics_providers":"new_relic"}
​
string
OTLP metrics endpoint. HTTPS OTLP/HTTP endpoint that receives metrics.
  • Shown when: {"metrics_enabled":true,"metrics_providers":"otlp"}
​
string
OTLP authorization secret ARN. Secrets Manager ARN containing the complete Authorization header value. The logs credential is reused when the same OTLP destination is selected for logs.
  • Shown when: {"logs_providers":{"not":"otlp"},"metrics_enabled":true,"metrics_providers":"otlp"}

​
Traces

​
boolean
Traces. Run an OTLP receiver (gRPC 4317, HTTP 4318) at an in-cluster Service and send workload traces to the selected destinations. While metrics are on, the receiver also takes workload metrics into the metrics destinations, without the curated allow-list, so every series a workload sends is billed. The receiver authenticates no sender, so any pod in the cluster can send spans under any service name.
  • Default: true
​
object_array
Trace destinations. Send every trace to one or more destinations, each a card with its own settings.
  • Default: [{"destination":"tempo"}]
  • Shown when: {"traces_enabled":true}

​
External secrets

​
boolean
External Secrets Operator.
  • Default: true
​
string_array
Readable secret ARNs. Secrets Manager secret and SSM parameter ARNs (wildcards allowed) the operator may read. Leave empty to allow reading every secret and parameter in this account and region. Add entries to scope the operator down, or to reach other regions and accounts.
  • Shown when: {"eso_enabled":true}
​
string_array
Allowed namespaces. Kubernetes namespaces whose ExternalSecrets may use the shared secret stores. Leave empty to allow the namespaces Ravion Operator manages, or the default service namespace (project and environment given IDs joined with a hyphen) when the Operator manages the whole cluster. Add every namespace an EKS service with a custom namespace uses, and any workloads deployed by other means.
  • Shown when: {"eso_enabled":true}
​
string
Chart version. External Secrets Helm chart version without a leading v, for example 2.11.0.
  • Shown when: {"eso_enabled":true}
​
string
Operator namespace. Kubernetes namespace for External Secrets. It is created if necessary.
  • Shown when: {"eso_enabled":true}

​
Misc

​
keyvalue
Tags. A map of tags to assign to all resources. Default tags are Owner, ProjectGivenId, EnvironmentGivenId, ModuleGivenId, ModuleId

​
Terraform settings

​
string
OpenTofu version override. Override the environment’s default version for this module
​
string
Ravion Terraform workspace name. Override Terraform state backend workspace name. Defaults to project + environment + module given ids.
  • Immutable after creation
​
boolean
Include default plan policies. Turn off to plan with only the policies below instead of the default read-only policies. Requires at least one policy below.
  • Default: true
​
string_array
Terraform plan IAM policies. IAM managed policy ARNs for the Terraform plan runner role. Without default policies, allow s3:CreateBucket, s3:PutObject, s3:GetObject, and s3:ListBucket on the ravion-terraform-plans-<AWS account number> bucket in this account.
  • Default: []
​
boolean
Include default apply policies. Turn off to apply and destroy with only the policies below instead of AdministratorAccess. Requires at least one policy below.
  • Default: true
​
string_array
Terraform apply IAM policies. IAM managed policy ARNs for the Terraform apply runner role. Without default policies, allow s3:CreateBucket, s3:PutObject, s3:GetObject, and s3:ListBucket on the ravion-terraform-plans-<AWS account number> bucket in this account.
  • Default: []
​
object
Advanced Terraform variables. Optional raw Terraform variable overrides for advanced module inputs or one-off overrides. Values here override the generated variables above.
  • Default: {}