rvn-eks-addons / Latest version: 1.0.0
See EKS Add-ons module reference for the full module page.
Metrics
boolean
Metrics. Collect workload and Kubernetes metrics and send them to the selected destinations. Disabling metrics removes the managed metrics collectors.
- Default:
true
string_array
Metrics destinations. Prometheus fits most clusters; Mimir is for clusters that outgrow it. Each external destination gets a copy.
- Default:
["prometheus"] - Allowed values:
amp(Amazon Managed Prometheus),prometheus(Prometheus in your cluster),mimir(Grafana Mimir in your cluster (large clusters)),cloudwatch(Amazon CloudWatch (Container Insights)),grafana_cloud(Grafana Cloud Metrics),datadog(Datadog),new_relic(New Relic),otlp(Custom OTLP endpoint) - Shown when:
{"metrics_enabled":true}
string
Existing workspace ID. Write into an existing Amazon Managed Prometheus workspace instead of creating one. Leave blank to create a workspace for this cluster.
- Shown when:
{"metrics_enabled":true,"metrics_providers":"amp"}
string
Workspace region. AWS Region containing the workspace. Leave blank to use the cluster Region. A different Region sends metrics across Regions.
- Shown when:
{"metrics_enabled":true,"metrics_providers":"amp"}
boolean
Amazon Managed Grafana access. Assumable role for an Amazon Managed Grafana workspace to query this cluster’s metrics and logs. No workspace is created.
- Default:
false - Shown when:
{"metrics_enabled":true}
number
Prometheus retention (days). Days of recent metrics Prometheus keeps on its own volume, apart from the history in S3.
- Default:
15 - Min:
1 - Shown when:
{"metrics_enabled":true,"metrics_providers":"prometheus"}
string
Prometheus volume size. Persistent volume size as a Kubernetes quantity, for example 50Gi. Requires a working storage class; Ravion clusters normally use the EBS CSI driver.
- Default:
50Gi - Shown when:
{"metrics_enabled":true,"metrics_providers":"prometheus"}
string
Prometheus storage class. StorageClass of Prometheus’s volume. Leave blank for the managed gp3 class, or the cluster default when the EBS CSI driver is off.
- Shown when:
{"metrics_enabled":true,"metrics_providers":"prometheus"}
boolean
Metrics history in S3. Thanos uploads Prometheus’s two-hour blocks to S3, keeps them for the S3 retention, and answers queries over both. Off, Prometheus keeps only its own volume. Ignored with an existing Prometheus URL.
- Default:
true - Shown when:
{"metrics_enabled":true,"metrics_providers":"prometheus"}
number
S3 retention (days). Days of metrics history Thanos keeps in S3. Its compactor deletes older blocks, not a bucket lifecycle rule.
- Default:
365 - Min:
1 - Shown when:
{"metrics_enabled":true,"metrics_providers":"prometheus","prometheus_s3_storage_enabled":true}
string
Existing metrics bucket. Store metrics history in an existing bucket instead of creating one. It must be dedicated to this cluster and in its region; customer-managed KMS grants remain your responsibility.
- Shown when:
{"metrics_enabled":true,"metrics_providers":"prometheus","prometheus_s3_storage_enabled":true}
string
Existing Prometheus URL. In-cluster base URL of an existing Prometheus remote-write receiver. The module appends /api/v1/write and does not install Prometheus.
- Shown when:
{"metrics_enabled":true,"metrics_providers":"prometheus"}
number
Mimir retention (days).
- Default:
365 - Min:
1 - Shown when:
{"metrics_enabled":true,"metrics_providers":"mimir"}
string
Existing Mimir bucket. Store Mimir’s metrics in an existing bucket instead of creating one. It must be dedicated to Mimir on this cluster and in its region; customer-managed KMS grants remain your responsibility.
- Shown when:
{"metrics_enabled":true,"metrics_providers":"mimir"}
string
Mimir storage class. StorageClass of Mimir’s volumes. Leave blank for the managed gp3 class, or the cluster default when the EBS CSI driver is off.
- Shown when:
{"metrics_enabled":true,"metrics_providers":"mimir"}
string_array
Mimir availability zones. Three or more zones, one copy of every sample in each. Empty spreads copies across nodes. Nodes must be able to launch in every zone listed.
- Shown when:
{"metrics_enabled":true,"metrics_providers":"mimir"}
number
Mimir ingesters. Every series is held by three ingesters, so more ingesters each hold less of them. Each runs on its own node.
- Default:
3 - Min:
3 - Shown when:
{"metrics_enabled":true,"metrics_providers":"mimir"}
string
Ingester CPU request.
- Default:
1 - Pattern:
^[0-9]+(\.[0-9]+)?m?$— A CPU quantity such as 100m, 0.5, or 2. - Shown when:
{"metrics_enabled":true,"metrics_providers":"mimir"}
string
Ingester memory. Request and limit of each ingester, at roughly 5-8KiB per series it holds. Series from pods that have gone count until they age out.
- Default:
6Gi - Pattern:
^[0-9]+(Mi|Gi)$— A memory quantity in Mi or Gi, such as 512Mi or 4Gi. - Shown when:
{"metrics_enabled":true,"metrics_providers":"mimir"}
number
Series limit per ingester. An ingester refuses new series past this many, so a burst is rejected and retried instead of running every ingester out of memory. Blank for no limit.
- Min:
1 - Shown when:
{"metrics_enabled":true,"metrics_providers":"mimir"}
boolean
Enhanced observability.
- Default:
true - Shown when:
{"metrics_enabled":true,"metrics_providers":"cloudwatch"}
boolean
Application Signals auto-instrumentation. Enable AWS Application Signals auto-instrumentation. Existing pods receive the OpenTelemetry agent when they are recreated.
- Default:
false - Shown when:
{"metrics_enabled":true,"metrics_providers":"cloudwatch"}
string_array
Namespaces to instrument. Namespaces intended for Application Signals. This module publishes the list but does not add injection annotations. Leave empty to enable cluster-wide auto-monitoring.
- Shown when:
{"cloudwatch_application_signals_enabled":true,"metrics_enabled":true,"metrics_providers":"cloudwatch"}
string
CloudWatch add-on version. Amazon CloudWatch Observability add-on version, for example v4.7.0-eksbuild.1. Leave blank to use the latest compatible version. Also applies to CloudWatch Logs.
- Shown when:
{"metrics_enabled":true,"metrics_providers":"cloudwatch"}
string
Grafana Cloud remote-write URL. Prometheus remote-write URL from your Grafana Cloud Metrics connection details.
- Shown when:
{"metrics_enabled":true,"metrics_providers":"grafana_cloud"}
string
Grafana Cloud instance ID. Numeric instance ID from your Grafana Cloud Metrics connection details.
- Shown when:
{"metrics_enabled":true,"metrics_providers":"grafana_cloud"}
string
Grafana Cloud token secret ARN. Secrets Manager ARN containing a Grafana Cloud token with metrics:write. The logs credential is reused when Grafana Cloud Logs is also selected.
- Shown when:
{"logs_providers":{"not":"grafana_cloud"},"metrics_enabled":true,"metrics_providers":"grafana_cloud"}
string
Datadog site.
- Default:
datadoghq.com - Allowed values:
datadoghq.com(US1 (datadoghq.com)),us3.datadoghq.com(US3 (us3.datadoghq.com)),us5.datadoghq.com(US5 (us5.datadoghq.com)),datadoghq.eu(EU1 (datadoghq.eu)),ap1.datadoghq.com(AP1 (ap1.datadoghq.com)),ddog-gov.com(US1-FED (ddog-gov.com)) - Shown when:
{"logs_providers":{"not":"datadog"},"metrics_enabled":true,"metrics_providers":"datadog"}
string
Datadog API key secret ARN.
- Shown when:
{"logs_providers":{"not":"datadog"},"metrics_enabled":true,"metrics_providers":"datadog"}
string
New Relic region.
- Default:
us - Allowed values:
us(United States),eu(Europe) - Shown when:
{"logs_providers":{"not":"new_relic"},"metrics_enabled":true,"metrics_providers":"new_relic"}
string
New Relic license key secret ARN.
- Shown when:
{"logs_providers":{"not":"new_relic"},"metrics_enabled":true,"metrics_providers":"new_relic"}
string
OTLP metrics endpoint.
- Shown when:
{"metrics_enabled":true,"metrics_providers":"otlp"}
string
OTLP authorization secret ARN. Secrets Manager ARN containing the complete Authorization header value. The logs credential is reused when the same OTLP destination is selected for logs.
- Shown when:
{"logs_providers":{"not":"otlp"},"metrics_enabled":true,"metrics_providers":"otlp"}
Traces
boolean
Traces. In-cluster OTLP receiver (gRPC 4317, HTTP 4318). Any pod can send to it. With metrics on, it also forwards workload metrics, which are billed per series.
- Default:
true
object_array
Trace destinations. Send every trace to one or more destinations, each a card with its own settings.
- Default:
[{"destination":"tempo"}] - Shown when:
{"traces_enabled":true}
Grafana
boolean
In-cluster Grafana. Grafana with data sources for the in-cluster Loki, Prometheus, Mimir and Tempo stores and Amazon Managed Prometheus. Without Access, reach it with a port-forward.
- Default:
false
boolean
Access. Serve Grafana over HTTPS at a hostname, on a shared load balancer or through a Kubernetes Ingress. DNS is not managed.
- Default:
false - Shown when:
{"grafana_enabled":true}
string
Served through.
- Default:
load_balancer - Allowed values:
load_balancer(Shared load balancer),ingress(Kubernetes Ingress) - Shown when:
{"grafana_access_enabled":true,"grafana_enabled":true}
string
Load balancer.
- Default:
private - Allowed values:
private(Private),public(Public) - Shown when:
{"grafana_access_enabled":true,"grafana_access_method":"load_balancer","grafana_enabled":true}
string
Ingress class. Blank uses the default IngressClass. Install its controller first.
- Shown when:
{"grafana_access_enabled":true,"grafana_access_method":"ingress","grafana_enabled":true}
string
Grafana hostname. Point DNS at the load balancer, with a certificate that covers it. For Tailscale,
<name>.<tailnet>.ts.net.- Shown when:
{"grafana_access_enabled":true,"grafana_enabled":true}
number
Listener rule priority. Explicit rule order on the chosen load balancer’s HTTPS listener. Leave blank to let AWS assign the next available priority.
- Shown when:
{"grafana_access_enabled":true,"grafana_access_method":"load_balancer","grafana_enabled":true}
object
Ingress annotations. Annotations for the Ingress, as JSON, passed to it as they are, such as {“cert-manager.io/cluster-issuer”: “letsencrypt”} or {“tailscale.com/tags”: “tag:grafana”}.
- Default:
{} - Shown when:
{"grafana_access_enabled":true,"grafana_access_method":"ingress","grafana_enabled":true}
string
TLS secret. Kubernetes Secret holding the hostname’s certificate, for controllers that read one, such as nginx with cert-manager. Leave blank where the controller provides the certificate, as Tailscale does.
- Shown when:
{"grafana_access_enabled":true,"grafana_access_method":"ingress","grafana_enabled":true}
array
Environment variables. Grafana reads any setting from
GF_<SECTION>_<KEY>.- Shown when:
{"grafana_enabled":true}
array
Secrets.
{name, value_from} with a Secrets Manager or SSM ARN, read in-cluster. Use GF_AUTH_<PROVIDER>_CLIENT_SECRET for a sign-in client.- Shown when:
{"grafana_enabled":true}
string
Grafana CPU request.
- Default:
100m - Pattern:
^[0-9]+(\.[0-9]+)?m?$— A CPU quantity such as 100m, 0.5, or 2. - Shown when:
{"grafana_enabled":true}
string
Grafana memory request.
- Default:
256Mi - Pattern:
^[0-9]+(Mi|Gi)$— A memory quantity in Mi or Gi, such as 512Mi or 4Gi. - Shown when:
{"grafana_enabled":true}
string
Grafana memory limit. Many dashboards or alert rules need more; Grafana evaluates alert rules itself.
- Default:
512Mi - Pattern:
^[0-9]+(Mi|Gi)$— A memory quantity in Mi or Gi, such as 512Mi or 4Gi. - Shown when:
{"grafana_enabled":true}
Grafana sign-in
string
Role for new accounts. Grafana role an account gets the first time it signs in through an OAuth provider, unless the provider’s role mapping says otherwise.
- Default:
Viewer - Allowed values:
Viewer,Editor,Admin - Shown when:
{"grafana_enabled":true}
object_array
Sign-in providers. Without Username and password there’s no login form. Google, GitHub and gitlab.com need a domain, org, team or group restriction.
- Default:
[{"provider":"basic"}] - Shown when:
{"grafana_enabled":true}
External secrets
boolean
External Secrets Operator.
- Default:
true
string_array
Readable secret ARNs. Wildcards allowed. Empty allows every secret and parameter in this account and region.
- Shown when:
{"eso_enabled":true}
string_array
Allowed namespaces. Namespaces whose ExternalSecrets may use the shared stores. Empty allows the namespaces Ravion Operator manages. Add custom service namespaces here.
- Shown when:
{"eso_enabled":true}
string
Chart version. External Secrets Helm chart version without a leading v, for example 2.11.0.
- Shown when:
{"eso_enabled":true}
string
Operator namespace. Created if missing.
- Shown when:
{"eso_enabled":true}
Misc
keyvalue
Tags. A map of tags to assign to all resources. Default tags are
Owner, ProjectGivenId, EnvironmentGivenId, ModuleGivenId, ModuleIdTerraform settings
string
OpenTofu version override. Override the environment’s default version for this module
string
Ravion Terraform workspace name. Override Terraform state backend workspace name. Defaults to project + environment + module given ids.
- Immutable after creation
boolean
Include default plan policies. Turn off to plan with only the policies below instead of the default read-only policies. Requires at least one policy below.
- Default:
true
string_array
Terraform plan IAM policies. IAM managed policy ARNs for the Terraform plan runner role. Without default policies, allow s3:CreateBucket, s3:PutObject, s3:GetObject, and s3:ListBucket on the ravion-terraform-plans-<AWS account number> bucket in this account.
- Default:
[]
boolean
Include default apply policies. Turn off to apply and destroy with only the policies below instead of AdministratorAccess. Requires at least one policy below.
- Default:
true
string_array
Terraform apply IAM policies. IAM managed policy ARNs for the Terraform apply runner role. Without default policies, allow s3:CreateBucket, s3:PutObject, s3:GetObject, and s3:ListBucket on the ravion-terraform-plans-<AWS account number> bucket in this account.
- Default:
[]
object
Advanced Terraform variables. Optional raw Terraform variable overrides for advanced module inputs or one-off overrides. Values here override the generated variables above.
- Default:
{}