rvn-eks-addons / Latest version: 1.0.0
See EKS Add-ons module reference for the full module page.
$ref:rvn-eks-cluster
required
EKS cluster.
- Immutable after creation
cluster to null.
Mapped inputs for cluster: set these keys alongside cluster, not inside it, when supplying existing infrastructure instead of a module reference.
section
AWS account & region.
string
AWS account.
- Default:
<< ref.input.aws_account_id >> - Immutable after creation
string
Region.
- Default:
<< ref.input.aws_region >> - Immutable after creation
string
Terraform execution environment. Execution environment used by OpenTofu. For a private endpoint, choose one in the cluster VPC; the cluster’s Ravion Runner security group is attached automatically for each run.
- Default:
<< ref.input.execution_environment_id >>
section
Cluster details.
string
required
EKS cluster name.
- Default:
<<ref.stack.output.cluster_name>> - Immutable after creation
string
Ravion Runner role ARN. IAM role Terraform assumes when authenticating to the Kubernetes API.
- Default:
<<ref.stack.output.ravion_runner_role_arn>>
string
Ravion Runner security group ID. Lets the OpenTofu runner reach the Kubernetes API. Only blank for a public endpoint.
- Default:
<<ref.stack.output.ravion_runner_security_group_id>> - Immutable after creation
string
Cluster security group ID. EKS-managed security group used by Karpenter nodes and shared load balancers. Required when the default NodePool or any shared load balancer is enabled.
- Default:
<<ref.stack.output.cluster_security_group_id>>
string_array
Node subnet IDs. Subnets the default Karpenter NodePool launches nodes into. Also used by internal shared load balancers.
- Default:
<<ref.stack.output.node_subnet_ids>>
number
Default capacity nodes. Karpenter and Operator replicas scale down to fit. One system node runs one of each without high availability; use 2 or more for HA.
- Default:
<< ref.input.system_node_min_size >> - Min:
0
string_array
Public subnet IDs. Public subnets for internet-facing shared load balancers.
- Default:
<<ref.stack.output.public_subnet_ids>>
string
Name slug. Prefix for the load balancers, IAM roles and buckets the add-ons create. Defaults to the cluster name; set it if those names are taken. Up to 23 letters, digits and hyphens.
Ravion EKS Management
boolean
Ravion EKS Management. Register the cluster with Ravion and install Ravion Operator for cluster visibility and in-cluster deployments.
- Default:
true
boolean
Warm capacity. Low-priority placeholder pods keep spare nodes running, so rollouts and pipeline jobs start without waiting for a new node. They are evicted the moment real pods need the room. The reserved capacity is billed.
- Default:
false - Shown when:
{"ravion_operator_enabled":true}
number
Warm slots. Eight fit six pipeline jobs plus a second copy of a two-pod web service during a rollout.
- Default:
8 - Min:
1 - Shown when:
{"ravion_operator_enabled":true,"ravion_operator_warm_capacity_enabled":true}
string
CPU per slot.
- Default:
100m - Pattern:
^[0-9]+(\.[0-9]+)?m?$— A CPU quantity such as 100m, 0.5, or 2. - Shown when:
{"ravion_operator_enabled":true,"ravion_operator_warm_capacity_enabled":true}
string
Memory per slot.
- Default:
256Mi - Pattern:
^[0-9]+(Mi|Gi)$— A memory quantity in Mi or Gi, such as 512Mi or 4Gi. - Shown when:
{"ravion_operator_enabled":true,"ravion_operator_warm_capacity_enabled":true}
Application load balancers
boolean
Ravion-managed domains. On: Ravion manages the cluster certificate and DNS. Off: attach certificates here. Requires one HTTPS-enabled ALB when on.
- Default:
false
string
required
Cluster domain. Base for service addresses.
- Default:
<< module.given_id >> - Pattern:
^[a-z0-9]([a-z0-9-]*[a-z0-9])?$— The subdomain must contain only lowercase letters, numbers, and hyphens, and start and end with a letter or number. - Shown when:
{"use_ravion_managed_domains":true}
boolean
Public ALB. Create an internet-facing Application Load Balancer for traffic from the public internet.
- Default:
true
boolean
HTTPS. Add an HTTPS listener and redirect HTTP requests to it.
- Default:
true - Shown when:
{"public_alb_creation_enabled":true}
$ref:rvn-acm-certificate
required
Certificate. ACM certificate module that supplies the default certificate for the public HTTPS listener.
- Shown when:
{"public_alb_creation_enabled":true,"public_alb_https_enabled":true,"use_ravion_managed_domains":false}
public_alb_certificate to null.
Mapped inputs for public_alb_certificate: set these keys alongside public_alb_certificate, not inside it, when supplying existing infrastructure instead of a module reference.
string_array
required
Certificate ARNs. ACM certificate ARNs supplied by the selected module. The first certificate is used by default.
- Default:
["<<ref.stack.output.certificate_arn>>"]
string_array
Additional certificate ARNs. Additional ACM certificate ARNs attached to the public ALB HTTPS listener for SNI.
- Default:
[] - Shown when:
{"public_alb_creation_enabled":true,"public_alb_https_enabled":true,"use_ravion_managed_domains":false}
string
SSL policy.
- Shown when:
{"public_alb_creation_enabled":true,"public_alb_https_enabled":true}
number
Idle timeout (seconds).
- Min:
1 - Max:
4000 - Shown when:
{"public_alb_creation_enabled":true}
string
WAF web ACL ARN.
- Shown when:
{"public_alb_creation_enabled":true}
boolean
Access logs.
- Default:
true - Shown when:
{"public_alb_creation_enabled":true}
string
Access logs bucket ARN. Existing S3 bucket ARN for access logs. Leave blank to create a private bucket that keeps logs for a year.
- Shown when:
{"public_alb_access_logs_enabled":true,"public_alb_creation_enabled":true}
boolean
Private ALB. Create an internal Application Load Balancer reachable only inside the VPC, for internal APIs, admin tools, and service-to-service traffic.
- Default:
false
boolean
HTTPS. Add an HTTPS listener and redirect HTTP requests to it.
- Default:
false - Shown when:
{"private_alb_creation_enabled":true}
$ref:rvn-acm-certificate
required
Certificate. ACM certificate module that supplies the default certificate for the private HTTPS listener.
- Shown when:
{"private_alb_creation_enabled":true,"private_alb_https_enabled":true,"use_ravion_managed_domains":false}
private_alb_certificate to null.
Mapped inputs for private_alb_certificate: set these keys alongside private_alb_certificate, not inside it, when supplying existing infrastructure instead of a module reference.
string_array
required
Certificate ARNs. ACM certificate ARNs supplied by the selected module. The first certificate is used by default.
- Default:
["<<ref.stack.output.certificate_arn>>"]
string_array
Additional certificate ARNs. Additional ACM certificate ARNs attached to the private ALB HTTPS listener for SNI.
- Default:
[] - Shown when:
{"private_alb_creation_enabled":true,"private_alb_https_enabled":true,"use_ravion_managed_domains":false}
string
SSL policy.
- Shown when:
{"private_alb_creation_enabled":true,"private_alb_https_enabled":true}
string_array
Allowed IPv4 CIDRs. IPv4 CIDR blocks allowed to reach the private ALB. Leave empty to use the RFC1918 private ranges.
- Shown when:
{"private_alb_creation_enabled":true}
string_array
Allowed IPv6 CIDRs. IPv6 CIDR blocks allowed to reach the private ALB. Leave empty to allow no IPv6 ingress.
- Shown when:
{"private_alb_creation_enabled":true}
string_array
Allowed security group IDs. Security groups whose members can access the private ALB. Useful for sources without static CIDRs, such as CloudFront VPC origins.
- Shown when:
{"private_alb_creation_enabled":true}
number
Idle timeout (seconds).
- Min:
1 - Max:
4000 - Shown when:
{"private_alb_creation_enabled":true}
boolean
Access logs.
- Default:
true - Shown when:
{"private_alb_creation_enabled":true}
string
Access logs bucket ARN. Existing S3 bucket ARN for access logs. Leave blank to create a private bucket that keeps logs for a year.
- Shown when:
{"private_alb_access_logs_enabled":true,"private_alb_creation_enabled":true}
Network load balancers
boolean
Public NLB.
- Default:
false
string_array
Additional security group IDs.
- Shown when:
{"public_nlb_creation_enabled":true}
boolean
Cross-zone load balancing.
- Default:
false - Shown when:
{"public_nlb_creation_enabled":true}
boolean
Use Elastic IP addresses. Assign one static Elastic IP address to each public subnet.
- Default:
false - Shown when:
{"public_nlb_creation_enabled":true}
string_array
Elastic IP allocation IDs. One per public subnet, in subnet order.
- Shown when:
{"public_nlb_creation_enabled":true,"public_nlb_elastic_ips_enabled":true}
boolean
Access logs. Write public NLB TLS listener connection logs to S3. AWS does not log TCP or UDP listeners.
- Default:
false - Shown when:
{"public_nlb_creation_enabled":true}
string
Access logs bucket ARN. Existing S3 bucket ARN for access logs. Leave blank to create a private bucket that keeps logs for a year.
- Shown when:
{"public_nlb_access_logs_enabled":true,"public_nlb_creation_enabled":true}
boolean
Private NLB.
- Default:
false
string_array
Additional security group IDs.
- Shown when:
{"private_nlb_creation_enabled":true}
boolean
Cross-zone load balancing.
- Default:
false - Shown when:
{"private_nlb_creation_enabled":true}
boolean
Access logs. Write private NLB TLS listener connection logs to S3. AWS does not log TCP or UDP listeners.
- Default:
false - Shown when:
{"private_nlb_creation_enabled":true}
string
Access logs bucket ARN. Existing S3 bucket ARN for access logs. Leave blank to create a private bucket that keeps logs for a year.
- Shown when:
{"private_nlb_access_logs_enabled":true,"private_nlb_creation_enabled":true}
Load balancer settings
boolean
Load balancer deletion protection.
- Default:
true
string
Load balancer controller chart version. Without a leading v.
Karpenter
boolean
Karpenter.
- Default:
true
string
Chart version. Karpenter and Karpenter CRD Helm chart version without a leading v, for example 1.14.1.
- Shown when:
{"karpenter_enabled":true}
string
Controller namespace. Kubernetes namespace for the Karpenter controller, for example kube-system.
- Shown when:
{"karpenter_enabled":true}
string
Controller service account. Kubernetes service account name for the Karpenter controller, for example karpenter.
- Shown when:
{"karpenter_enabled":true}
boolean
Default NodePool. Create a general-purpose default NodePool and EC2NodeClass so Karpenter can provision nodes out of the box. Disable to manage NodePools yourself.
- Default:
true - Shown when:
{"karpenter_enabled":true}
number
Minimum warm Spot instances. Spot nodes Karpenter keeps running ahead of demand. 0 turns this off.
- Default:
0 - Min:
0 - Shown when:
{"karpenter_default_node_pool_creation_enabled":true,"karpenter_enabled":true}
string_array
required
Capacity types. EC2 purchasing models Karpenter may use. Selecting only Spot can leave workloads pending when Spot capacity is unavailable.
- Default:
["on-demand","spot"] - Allowed values:
on-demand(On-demand),spot(Spot) - Shown when:
{"karpenter_default_node_pool_creation_enabled":true,"karpenter_enabled":true}
string_array
required
EC2 instance categories. Single-letter EC2 instance-family categories Karpenter may use, such as c, m, or r.
- Default:
["c","m","r"] - Shown when:
{"karpenter_default_node_pool_creation_enabled":true,"karpenter_enabled":true}
string_array
required
CPU architectures. CPU architectures Karpenter may provision. Workload images must support every selected architecture.
- Default:
["amd64"] - Allowed values:
amd64(x86_64),arm64(ARM64) - Shown when:
{"karpenter_default_node_pool_creation_enabled":true,"karpenter_enabled":true}
number
required
CPU limit (vCPUs). Maximum total vCPUs Karpenter may provision through the default NodePool.
- Default:
100 - Min:
1 - Shown when:
{"karpenter_default_node_pool_creation_enabled":true,"karpenter_enabled":true}
string
required
Node lifetime. Maximum node age before Karpenter drains and replaces it. Use integer segments with s, m, or h, such as 1h30m or 720h; use Never to disable expiration.
- Default:
720h - Pattern:
^(([0-9]+(s|m|h))+|Never)$— Use integer segments with s, m, or h, such as 1h30m or 720h, or Never. - Shown when:
{"karpenter_default_node_pool_creation_enabled":true,"karpenter_enabled":true}
boolean
Interruption queue age alarm. Detect stalled interruption processing. Disable if monitored elsewhere. CloudWatch charges apply.
- Default:
true - Shown when:
{"karpenter_enabled":true}
number
Oldest message threshold (seconds). Triggers when the maximum age over one minute reaches this value. Must be below the queue retention period (300 seconds by default).
- Default:
60 - Min:
1 - Shown when:
{"karpenter_enabled":true,"karpenter_interruption_queue_alarm_creation_enabled":true}
string_array
Alert actions. Invoked when entering ALARM, for example an SNS topic ARN. Empty disables direct notifications.
- Default:
[] - Shown when:
{"karpenter_enabled":true,"karpenter_interruption_queue_alarm_creation_enabled":true}
string_array
Recovery actions. Invoked when returning to OK. Empty disables direct recovery notifications.
- Default:
[] - Shown when:
{"karpenter_enabled":true,"karpenter_interruption_queue_alarm_creation_enabled":true}
Event-driven autoscaling
boolean
KEDA. Install the event-driven autoscaler; each workload still needs a scaling trigger.
- Default:
false
string
KEDA namespace.
- Default:
keda - Shown when:
{"keda_enabled":true}
string
KEDA chart version.
- Default:
2.20.2 - Shown when:
{"keda_enabled":true}
Certificates
boolean
cert-manager. For TLS that ends inside the cluster, such as nginx ingress or mTLS. Load balancer HTTPS doesn’t need it. Define Issuers and Certificates with your workloads.
- Default:
false
string
cert-manager namespace.
- Default:
cert-manager - Shown when:
{"cert_manager_enabled":true}
string
cert-manager chart version.
- Default:
v1.21.2 - Shown when:
{"cert_manager_enabled":true}
EBS CSI driver
boolean
EBS CSI driver. EBS-backed Kubernetes persistent volumes. The default Prometheus and Tempo volumes need it; turn it off only when another provisioner supplies persistent storage.
- Default:
true
string
Add-on version. AWS EBS CSI add-on version, for example v1.49.0-eksbuild.1. Leave blank to use the latest compatible version.
- Shown when:
{"ebs_csi_driver_enabled":true}
boolean
Default gp3 storage class. Encrypts volumes and allows expansion. Claims without an explicit class use gp3; installation fails if gp3 is managed elsewhere.
- Default:
true - Shown when:
{"ebs_csi_driver_enabled":true}
boolean
Online StatefulSet volume growth. Allows larger claims without restarting pods when templates explicitly name the managed gp3 class. Other classes still fail. Requires Kubernetes 1.36+.
- Default:
true - Shown when:
{"ebs_csi_driver_enabled":true}
Logs
boolean
Logs. Collect container logs and send them to the selected destinations. Disabling logs removes the managed collectors and in-cluster log store.
- Default:
true
string_array
Log destinations. Send logs to one or more destinations. Ravion queries the in-cluster store first, then CloudWatch. External destinations each receive a copy.
- Default:
["loki"] - Allowed values:
loki(In-cluster log store (Loki, S3-backed)),cloudwatch(Amazon CloudWatch Logs),grafana_cloud(Grafana Cloud Logs),datadog(Datadog),new_relic(New Relic),opensearch(Amazon OpenSearch Service),splunk(Splunk (HEC)),otlp(Custom OTLP endpoint) - Shown when:
{"logs_enabled":true}
number
Retention (days).
- Default:
365 - Min:
1 - Max:
3650 - Shown when:
{"logs_enabled":true,"logs_providers":"loki"}
string
Existing S3 log bucket. S3 bucket name for log storage. Leave blank to create a bucket. Lifecycle and encryption remain your responsibility for an existing bucket.
- Shown when:
{"logs_enabled":true,"logs_providers":"loki"}
string
Loki CPU request.
- Default:
200m - Pattern:
^[0-9]+(\.[0-9]+)?m?$— A CPU quantity such as 100m, 0.5, or 2. - Shown when:
{"logs_enabled":true,"logs_providers":"loki"}
string
Loki memory request.
- Default:
512Mi - Pattern:
^[0-9]+(Mi|Gi)$— A memory quantity in Mi or Gi, such as 512Mi or 4Gi. - Shown when:
{"logs_enabled":true,"logs_providers":"loki"}
string
Loki memory limit. Searches over many streams are what push Loki over it, so raise this first.
- Default:
1Gi - Pattern:
^[0-9]+(Mi|Gi)$— A memory quantity in Mi or Gi, such as 512Mi or 4Gi. - Shown when:
{"logs_enabled":true,"logs_providers":"loki"}
number
CloudWatch retention (days). Retention for the module-managed CloudWatch log groups, in days.
- Default:
365 - Shown when:
{"logs_enabled":true,"logs_providers":"cloudwatch"}
string
Grafana Cloud Loki push URL. Loki push URL from your Grafana Cloud Logs connection details.
- Shown when:
{"logs_enabled":true,"logs_providers":"grafana_cloud"}
string
Grafana Cloud Logs user ID. Numeric user or tenant ID from your Grafana Cloud Logs connection details.
- Shown when:
{"logs_enabled":true,"logs_providers":"grafana_cloud"}
string
Grafana Cloud token secret ARN. Secrets Manager ARN containing a Grafana Cloud token with logs:write; also grant metrics:write when used for metrics.
- Shown when:
{"logs_enabled":true,"logs_providers":"grafana_cloud"}
string
Grafana Cloud stack URL. Grafana Cloud stack URL used for links from Ravion. Leave blank to omit the link.
- Shown when:
{"logs_enabled":true,"logs_providers":"grafana_cloud"}
string
Datadog site.
- Default:
datadoghq.com - Allowed values:
datadoghq.com(US1 (datadoghq.com)),us3.datadoghq.com(US3 (us3.datadoghq.com)),us5.datadoghq.com(US5 (us5.datadoghq.com)),datadoghq.eu(EU1 (datadoghq.eu)),ap1.datadoghq.com(AP1 (ap1.datadoghq.com)),ddog-gov.com(US1-FED (ddog-gov.com)) - Shown when:
{"logs_enabled":true,"logs_providers":"datadog"}
string
Datadog API key secret ARN.
- Shown when:
{"logs_enabled":true,"logs_providers":"datadog"}
string
New Relic region.
- Default:
us - Allowed values:
us(United States),eu(Europe) - Shown when:
{"logs_enabled":true,"logs_providers":"new_relic"}
string
New Relic license key secret ARN.
- Shown when:
{"logs_enabled":true,"logs_providers":"new_relic"}
string
OpenSearch domain endpoint. HTTPS endpoint for a managed OpenSearch domain in the cluster account and region. After deployment, grant the logs_opensearch_role_arn output access in the domain policy or fine-grained role mapping.
- Shown when:
{"logs_enabled":true,"logs_providers":"opensearch"}
string
OpenSearch index prefix.
- Default:
ravion-logs - Shown when:
{"logs_enabled":true,"logs_providers":"opensearch"}
string
Splunk HEC URL. Splunk HTTP Event Collector URL, including the /services/collector path.
- Shown when:
{"logs_enabled":true,"logs_providers":"splunk"}
string
Splunk HEC token secret ARN.
- Shown when:
{"logs_enabled":true,"logs_providers":"splunk"}
string
Splunk index. Splunk index the events are written to. Leave blank to use the token’s default index.
- Shown when:
{"logs_enabled":true,"logs_providers":"splunk"}
string
OTLP logs endpoint.
- Shown when:
{"logs_enabled":true,"logs_providers":"otlp"}
string
OTLP authorization secret ARN. Secrets Manager ARN containing the complete Authorization header value. Leave blank when authentication is not required.
- Shown when:
{"logs_enabled":true,"logs_providers":"otlp"}
string_array
Excluded namespaces. Kubernetes namespaces whose container logs are excluded from every destination.
- Default:
["kube-system","kube-node-lease","amazon-cloudwatch","ravion-operator","ravion-beacon"] - Shown when:
{"logs_enabled":true}