rvn-eks-web / Latest version: 1.17.0
See EKS Web Service module reference for the full module page.
EKS cluster
$ref:rvn-eks-cluster
required
Cluster.
- Immutable after creation
cluster to null.
Mapped inputs for cluster: set these keys alongside cluster, not inside it, when supplying existing infrastructure instead of a module reference.
section
AWS account & region.
string
AWS account.
- Default:
<< ref.input.aws_account_id >> - Immutable after creation
string
Region. Region of the selected cluster. Must match the region in the cluster ARN, which Ravion cross-checks on every deploy.
- Default:
<< ref.input.aws_region >> - Immutable after creation
string
Terraform execution environment.
- Default:
<< ref.input.execution_environment_id >>
section
Cluster connection.
string
required
EKS cluster name.
- Default:
<<ref.stack.output.cluster_name>> - Immutable after creation
string
required
Cluster ARN. Ravion resolves the owning AWS account and region from this ARN, and rejects a deploy whose cluster name or region disagrees with it.
- Default:
<<ref.stack.output.cluster_arn>> - Immutable after creation
string
required
Cluster API endpoint. HTTPS endpoint of the Kubernetes API server. May be private-only; the deploy runner executes inside the cluster VPC.
- Default:
<<ref.stack.output.cluster_endpoint>> - Immutable after creation
string
required
Cluster certificate authority data. Base64-encoded CA bundle used to verify the API server’s TLS certificate. Public key material, not a credential.
- Default:
<<ref.stack.output.cluster_certificate_authority_data>> - Immutable after creation
string
required
Ravion Runner role ARN. Stable IAM role the deploy runner assumes to obtain a cluster token. Registered as an EKS access entry by the cluster module.
- Default:
<<ref.stack.output.ravion_runner_role_arn>> - Immutable after creation
string
Ravion Runner security group ID. Security group the deploy runner’s network interface joins so it can reach the cluster API endpoint. Null when the cluster module did not create one, which is only workable if the endpoint is public or the execution environment supplies its own group.
- Default:
<<ref.stack.output.ravion_runner_security_group_id>> - Immutable after creation
string
required
VPC ID. VPC the cluster runs in. Load balancer target groups must live in the same VPC as the pods they register.
- Default:
<<ref.input.vpc_id>> - Immutable after creation
string_array
required
Cluster private subnet IDs. Private subnets from the selected EKS cluster. A workload targeting Fargate launches pod network interfaces in these subnets; EKS Fargate does not support public subnets.
- Default:
<<ref.input.subnet_ids>> - Immutable after creation
- Shown when:
{"compute_target":"fargate"}
$ref:rvn-eks-addons
required
EKS add-ons. Select this cluster’s Add-ons module; it owns shared load balancers and can install KEDA for Spot burst.
- Immutable after creation
addons to null.
Mapped inputs for addons: set these keys alongside addons, not inside it, when supplying existing infrastructure instead of a module reference.
string
Public ALB HTTP listener ARN.
- Default:
<<ref.stack.output.public_alb_http_listener_arn>> - Immutable after creation
string
Public ALB HTTPS listener ARN. HTTPS listener ARN from the shared public ALB. Ravion uses it when present, otherwise falls back to HTTP.
- Default:
<<ref.stack.output.public_alb_https_listener_arn>> - Immutable after creation
string
Private ALB HTTP listener ARN.
- Default:
<<ref.stack.output.private_alb_http_listener_arn>> - Immutable after creation
string
Private ALB HTTPS listener ARN. HTTPS listener ARN from the shared private ALB. Ravion uses it when present, otherwise falls back to HTTP.
- Default:
<<ref.stack.output.private_alb_https_listener_arn>> - Immutable after creation
boolean
Ravion-managed domains. On: Ravion manages service certificates and listener rules. Off: attach certificates on the cluster and configure listener rules here.
- Default:
<< ref.stack.output.ravion_managed_domains_enabled || false >>
string
Cluster domain. Base for the service’s Ravion address.
- Default:
<<ref.stack.output.ravion_cluster_domain_fqdn>>
string
Public ALB DNS name.
- Default:
<<ref.stack.output.public_alb_dns_name>> - Immutable after creation
string
Public ALB hosted zone ID.
- Default:
<<ref.stack.output.public_alb_zone_id>> - Immutable after creation
string
Private ALB DNS name.
- Default:
<<ref.stack.output.private_alb_dns_name>> - Immutable after creation
string
Private ALB hosted zone ID.
- Default:
<<ref.stack.output.private_alb_zone_id>> - Immutable after creation
string
AMP workspace ID. From the selected EKS Add-ons module.
- Default:
<<ref.stack.output.amp_workspace_id>>
string
AMP region. From the selected EKS Add-ons module.
- Default:
<<ref.stack.output.amp_region>>
string_array
Logs rendering providers. From the selected EKS Add-ons module.
- Default:
<<ref.stack.output.logs_rendering_providers>>
string_array
Metrics rendering providers. From the selected EKS Add-ons module.
- Default:
<<ref.stack.output.metrics_rendering_providers>>
string
CloudWatch log group. From the selected EKS Add-ons module.
- Default:
<<ref.stack.output.logs_cloudwatch_log_group>>
string
In-cluster Prometheus endpoint. From the selected EKS Add-ons module.
- Default:
<<ref.stack.output.prometheus_endpoint>>
array
Logs vendor links. From the selected EKS Add-ons module.
- Default:
<<ref.stack.output.logs_external_links>>
array
Metrics vendor links. From the selected EKS Add-ons module.
- Default:
<<ref.stack.output.metrics_external_links>>
string
Grafana Cloud logs query URL. From the selected EKS Add-ons module.
- Default:
<<ref.stack.output.grafana_cloud_logs_query_url>>
string
Grafana Cloud metrics query URL. From the selected EKS Add-ons module.
- Default:
<<ref.stack.output.grafana_cloud_metrics_query_url>>
string
Observability credentials secret. Kubernetes Secret in the Ravion Operator namespace with vendor query credentials. Ravion never reads the values.
- Default:
<<ref.stack.output.observability_credentials_secret_name>>
boolean
KEDA enabled. From the selected EKS Add-ons module.
- Default:
<< ref.output.keda_enabled == true >>
Web service
string
required
Service name. Name for the Helm release, Kubernetes objects, target group, and listener rule.
- Default:
<<project.given_id>>-<<environment.given_id>>-<<module.given_id>> - Immutable after creation
- Pattern:
^[a-z0-9]([a-z0-9-]{0,51}[a-z0-9])?$— 1-53 lowercase letters, numbers, and hyphens. Start and end with a letter or number.
string
required
Namespace.
- Default:
<<project.given_id>>-<<environment.given_id>> - Immutable after creation
- Pattern:
^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$— 1-63 lowercase letters, numbers, and hyphens. Start and end with a letter or number.
boolean
Create namespace. Turn off when the namespace is managed elsewhere.
- Default:
true
string
required
Load balancer. Public and private use the shared ALBs from EKS Add-ons. Cluster only is reachable just from other pods, at
<service name>.<namespace>.- Default:
public - Allowed values:
public(Public ALB),private(Private ALB),kubernetes_service(Cluster only (no load balancer))
string
Target group name. Blank derives it from the service name. Set it if that name is already taken in this account and region.
- Pattern:
^[A-Za-z0-9]([A-Za-z0-9-]{0,30}[A-Za-z0-9])?$— Use 1-32 letters, numbers, or hyphens, starting and ending with a letter or number. - Shown when:
{"load_balancer":{"not":"kubernetes_service"}}
Domains
boolean
Default Ravion domain. Off requires at least one custom domain.
- Default:
true - Shown when:
{"load_balancer":{"not":"kubernetes_service"},"ravion_managed_domains_enabled":true}
string
Subdomain.
- Default:
<< module.given_id >> - Pattern:
^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$— Use 1-63 lowercase letters, numbers, or hyphens, starting and ending with a letter or number. - Shown when:
{"load_balancer":{"not":"kubernetes_service"},"ravion_domain_enabled":true,"ravion_managed_domains_enabled":true}
string_array
Custom domains. Served alongside the default Ravion domain when it is on. Ravion manages certificates and listener rules; add the provided DNS records at your DNS provider.
- Shown when:
{"load_balancer":{"not":"kubernetes_service"},"ravion_managed_domains_enabled":true}
Build config
string
required
Build source.
- Default:
dockerfile - Allowed values:
dockerfile(Dockerfile),railpack(Railpack),image_registry(Pull from image registry)
gitrepo
required
Git repository.
- Shown when:
{"build_source":["dockerfile","railpack"]}
string
Source base path.
- Default:
. - Shown when:
{"build_source":["dockerfile","railpack"]}
string_array
Watch paths. Globs from the repository root; prefix ! to exclude. Skips the build and deploy when no matching file changed. Empty always builds.
- Shown when:
{"build_source":["dockerfile","railpack"]}
Dockerfile
string
Dockerfile path. Relative to the source base path.
- Shown when:
{"build_source":"dockerfile"}
string
Docker build context path. Relative to the source base path.
- Shown when:
{"build_source":"dockerfile"}
Railpack
string
Railpack version. Blank uses the Ravion default.
- Pattern:
^(|latest|v?[0-9]+\.[0-9]+\.[0-9]+(?:[-+][0-9A-Za-z.-]+)?)$— Leave blank, use latest, a semantic version like 0.29.0, or a v-prefixed version like v0.29.0. - Shown when:
{"build_source":"railpack"}
string
Install command. Blank uses Railpack’s detected command.
- Shown when:
{"build_source":"railpack"}
string
Build command. Blank uses Railpack’s detected command.
- Shown when:
{"build_source":"railpack"}
string
Railpack start command. Blank uses Railpack’s detected command.
- Shown when:
{"build_source":"railpack"}
Image
string
required
Image repository. Image repository without a tag, such as 123456789012.dkr.ecr.us-east-1.amazonaws.com/api. The tag or digest is supplied at deploy time.
- Shown when:
{"build_source":"image_registry"}
string_array
Image pull secret names. Names of existing kubernetes.io/dockerconfigjson Secrets in the release namespace, for private registries.
- Shown when:
{"build_source":"image_registry"}
string_array
Start command. Overrides the image entrypoint. Leave empty to use the image default.
string_array
Start command arguments. Overrides the image default arguments. Leave empty to use the image default.
Health check
number
required
Container port. Port the application listens on, also set as
PORT. The Kubernetes Service and the target group use it.- Default:
8080 - Min:
1 - Max:
65535 - Immutable after creation
string
required
Health check path. Unauthenticated endpoint that succeeds when the app can receive requests. Kubernetes readiness and the load balancer both use this path.
- Default:
/
string
required
Success codes. HTTP status code matcher for successful health checks. Defaults to 200-399 so redirects and common successful responses are accepted.
- Default:
200-399
number
Interval (secs). Seconds between load balancer health checks. Lower values detect failures faster but send more health-check traffic.
- Default:
5 - Min:
5 - Max:
300
number
Timeout (secs). Seconds to wait for the health-check response before marking that check as failed. Must be lower than the interval.
- Default:
4 - Min:
2 - Max:
120
number
Initial delay (secs). Seconds Kubernetes waits after the container starts or the startup check succeeds before checking traffic readiness or liveness.
- Default:
0 - Min:
0 - Max:
600
number
Readiness check interval (secs). Seconds between Kubernetes readiness checks. A pod leaves traffic after about 30 seconds of failed checks at any interval; the load balancer readiness gate still waits for target registration when enabled.
- Default:
1 - Min:
1 - Max:
300
number
Healthy threshold. Number of consecutive successful checks required before an unhealthy target is considered healthy.
- Default:
2 - Min:
2 - Max:
10
number
Unhealthy threshold. Number of consecutive failed checks required before a target is considered unhealthy.
- Default:
2 - Min:
2 - Max:
10
boolean
Wait for load balancer health. Keep old pods serving until new ones pass load balancer health checks.
- Default:
true - Shown when:
{"load_balancer":{"not":"kubernetes_service"}}
number
Deregistration delay (secs). Seconds the load balancer keeps sending in-flight responses to a pod that is shutting down.
- Default:
300 - Min:
0 - Max:
3600 - Shown when:
{"load_balancer":{"not":"kubernetes_service"}}
number
Slow start duration (secs). Gradually ramps traffic to newly registered pods. Use 0 to disable, otherwise 30-900.
- Default:
0 - Min:
0 - Max:
900 - Shown when:
{"load_balancer":{"not":"kubernetes_service"}}
boolean
Sticky sessions. Enable load balancer cookie stickiness so repeat requests are routed to the same pod when possible.
- Default:
false - Shown when:
{"load_balancer":{"not":"kubernetes_service"}}
string
Stickiness type.
- Default:
lb_cookie - Allowed values:
lb_cookie(Load balancer cookie),app_cookie(Application cookie) - Shown when:
{"load_balancer":{"not":"kubernetes_service"},"target_group_stickiness_enabled":true}
number
Stickiness cookie duration (secs).
- Default:
86400 - Min:
1 - Max:
604800 - Shown when:
{"load_balancer":{"not":"kubernetes_service"},"target_group_stickiness_enabled":true}
string
Application cookie name.
- Shown when:
{"load_balancer":{"not":"kubernetes_service"},"target_group_stickiness_type":"app_cookie"}
Startup and liveness
boolean
Enforce startup timeout. Restart the container if the app does not become responsive in time. A bad path or short timeout can cause a restart loop.
- Default:
false
number
Maximum startup time (secs). Maximum time the app may take to start before Kubernetes restarts it. Rounded up to the next five-second check.
- Default:
150 - Min:
5 - Max:
1500 - Shown when:
{"startup_probe_enabled":true}
string
Startup health path. Endpoint used while the app starts. Leave blank to use the liveness path when set, otherwise the health check path.
- Shown when:
{"startup_probe_enabled":true}
boolean
Restart unresponsive containers. Restart a running process that stops responding. A dependency-aware path can restart every pod during an outage.
- Default:
false
string
Liveness health path. Lightweight endpoint that confirms the app process is responsive. Avoid database or external-service checks. Leave blank to use the health check path.
- Shown when:
{"liveness_probe_enabled":true}
HTTP listener rules
string_array
Domain host rules. Hostnames that should route to this service, such as app.example.com or *.example.com. Leave empty to use path-based routing.
- Shown when:
{"load_balancer":{"not":"kubernetes_service"},"ravion_managed_domains_enabled":false}
string_array
Path rules. Path patterns that should route to this service, such as /, /api/, or /app/. If both domain host rules and path rules are empty, the service routes all paths with /.
- Shown when:
{"load_balancer":{"not":"kubernetes_service"},"ravion_managed_domains_enabled":false}
number
Listener rule priority. Optional ALB listener rule priority. Leave blank to let AWS assign the next available priority.
- Min:
1 - Max:
50000 - Shown when:
{"load_balancer":{"not":"kubernetes_service"},"ravion_managed_domains_enabled":false}
Container resources
string
required
Compute target. Choose whether Kubernetes schedules this workload automatically, on a specific EC2 capacity type, or on a dedicated EKS Fargate profile. EKS Fargate capacity is on-demand only.
- Default:
any - Allowed values:
any(Automatic),on_demand(EC2 on-demand),spot(EC2 Spot),fargate(Fargate)
string
required
CPU request. CPU reserved for the pod and its guaranteed share under load. 1 is one vCPU; m is thousandths of a core, so 100m is a tenth. Autoscaling CPU targets are a percentage of this value.
- Default:
100m - Pattern:
^[0-9]+(\.[0-9]+)?m?$— A CPU quantity such as 100m, 0.5, or 2.
string
CPU limit. Optional CPU ceiling, in the same units. Leave blank to let a pod burst into spare node CPU.
- Pattern:
^[0-9]+(\.[0-9]+)?m?$— A CPU quantity such as 100m, 0.5, or 2.
string
required
Memory request. Memory reserved for the pod, in binary units such as 256Mi or 1Gi (1024Mi). Set this close to steady-state usage.
- Default:
256Mi - Pattern:
^[0-9]+(\.[0-9]+)?(Ki|Mi|Gi|Ti|k|M|G|T)?$— A memory quantity such as 256Mi, 1Gi, or 512M.
string
required
Memory limit. Memory ceiling, in the same units. Exceeding it terminates the container with OOMKilled, so set it above the worst legitimate spike.
- Default:
512Mi - Pattern:
^[0-9]+(\.[0-9]+)?(Ki|Mi|Gi|Ti|k|M|G|T)?$— A memory quantity such as 256Mi, 1Gi, or 512M.
Autoscaling
boolean
Autoscaling. Scale pods with a HorizontalPodAutoscaler. Requires the metrics server or an equivalent metrics API in the cluster.
- Default:
true - Shown when:
{"spot_burst_enabled":{"not":true}}
number
Minimum pods.
- Default:
2 - Min:
1 - Max:
1000 - Shown when:
{"autoscaling_enabled":true,"spot_burst_enabled":{"not":true}}
number
Maximum pods.
- Default:
3 - Min:
1 - Max:
1000 - Shown when:
{"autoscaling_enabled":true,"spot_burst_enabled":{"not":true}}
number
CPU target (%). Average CPU utilization, as a percentage of the CPU request, the autoscaler aims to hold.
- Default:
70 - Min:
1 - Max:
100 - Shown when:
{"autoscaling_enabled":true,"spot_burst_enabled":{"not":true}}
number
Memory target (%). Optional average memory utilization target, as a percentage of the memory request. Leave blank to scale on CPU alone.
- Min:
1 - Max:
100 - Shown when:
{"autoscaling_enabled":true,"spot_burst_enabled":{"not":true}}
number
Desired pods.
- Default:
2 - Min:
0 - Max:
1000 - Shown when:
{"autoscaling_enabled":false,"spot_burst_enabled":{"not":true}}
boolean
Spot burst. Run a fixed On-Demand baseline with a separate KEDA-scaled Spot pool that starts at the configured minimum.
- Default:
false - Shown when:
{"compute_target":"on_demand"}
number
Baseline pods. Fixed number of On-Demand pods kept available while the Spot pool scales independently.
- Default:
2 - Min:
1 - Max:
1000 - Shown when:
{"compute_target":"on_demand","spot_burst_enabled":true}
number
Minimum Spot pods.
- Default:
0 - Min:
0 - Max:
1000 - Shown when:
{"compute_target":"on_demand","spot_burst_enabled":true}
number
Maximum Spot pods.
- Default:
8 - Min:
1 - Max:
1000 - Shown when:
{"compute_target":"on_demand","spot_burst_enabled":true}
array
required
KEDA triggers. At least one trigger must report demand at the configured minimum. If the minimum is zero, CPU or memory alone cannot wake the pool. Reference pre-created authentication resources only.
- Shown when:
{"compute_target":"on_demand","spot_burst_enabled":true}
number
Polling interval (secs).
- Default:
30 - Min:
1 - Shown when:
{"compute_target":"on_demand","spot_burst_enabled":true}
number
Cooldown period (secs). Seconds KEDA waits after the last active trigger before scaling the Spot pool down.
- Default:
300 - Min:
0 - Shown when:
{"compute_target":"on_demand","spot_burst_enabled":true}
number
Spot pods when metrics fail. Minimum Spot pods kept while KEDA cannot read its metrics; running pods are never removed. Empty uses the maximum. Not applied to CPU, memory or Utilization triggers.
- Min:
0 - Max:
1000 - Shown when:
{"compute_target":"on_demand","spot_burst_enabled":true}
Environment variables
object
Build environment variables. Only available during the build, not at runtime. Use environment variables or secrets for runtime values.
- Shown when:
{"build_source":["dockerfile","railpack"]}
boolean
Inject environment variables in Dockerfile. Passes build environment variables as
--build-arg.- Default:
false - Shown when:
{"build_source":"dockerfile"}
array
Runtime environment variables.
array
Runtime secrets.
{name, value_from} with a Secrets Manager or SSM Parameter Store ARN. Resolved inside the cluster; Ravion never reads the value.string_array
Deploy-provided environment variables. Names a pipeline deploy step may set with
input.environment_variables. Plain values only; can’t replace a runtime variable or secret.IAM roles and policies
boolean
Create IAM role. Gives pods short-lived AWS credentials through EKS Pod Identity, with no keys. Leave off if the workload calls no AWS APIs.
- Default:
false
string
IAM role name. Blank uses
<service>-task, like ECS. Must be unique in the account, so set it if the service also runs on ECS or another cluster.- Pattern:
^[\w+=,.@-]{1,64}$— 1-64 characters of letters, digits and + = , . @ _ - - Shown when:
{"pod_identity_role_creation_enabled":true}
string_array
IAM policy ARNs.
- Default:
[] - Shown when:
{"pod_identity_role_creation_enabled":true}
object
IAM inline policies. Keyed by policy name. Same shape as ECS task role inline policies.
- Shown when:
{"pod_identity_role_creation_enabled":true}
Networking and deployment
number
Maximum rollout surge (%). Extra pods Kubernetes may create during a rolling update, as a percentage of the desired count. Use 100 to create a full replacement set at once when the cluster has enough spare capacity. Zero-unavailable rollout protection remains enabled.
- Default:
100 - Min:
1 - Max:
100
number
Stop timeout (secs). Seconds a pod has to finish in-flight requests after SIGTERM before it is killed, including the pre-stop delay below. Raise this for services that move long-lived connections such as WebSockets to other pods on shutdown.
- Default:
30 - Min:
0 - Max:
3600
number
Pre-stop delay (secs). Seconds a stopping pod keeps serving before SIGTERM, so the load balancer stops sending it new connections first. 0 turns it off. Must be less than the stop timeout.
- Default:
10 - Min:
0 - Max:
3599
boolean
Disruption budget. Limit how many pods node drains, consolidation and cluster upgrades may evict at once. Takes effect only while the minimum pod count is above Minimum available pods, since a budget that allows no evictions would block every drain.
- Default:
true
number
Minimum available pods. Pods that must stay running during a node drain or other voluntary disruption.
- Default:
1 - Min:
1 - Max:
1000 - Shown when:
{"pod_disruption_budget_enabled":true}
string_array
Ingress allow-list. EKS services in this namespace allowed to call this one. Set it and every other pod is blocked; the load balancer is always allowed.