> ## Documentation Index
> Fetch the complete documentation index at: https://www.ravion.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# EKS Web Service inputs: EKS cluster to networking and deployment

> Reference the EKS Web Service module's EKS cluster, Web service, Domains, Build config, Dockerfile, Railpack, Image, Health check and more inputs.

**Type:** `rvn-eks-web` / **Latest version:** `1.17.0`

See [EKS Web Service module reference](https://www.ravion.com/docs/module-definitions/catalog/rvn-eks-web) for the full module page.

### EKS cluster

**cluster** `$ref:rvn-eks-cluster` *required*

**Cluster.**

* Immutable after creation

Set `cluster` to `null`.
Mapped inputs for `cluster`: set these keys alongside `cluster`, not inside it, when supplying existing infrastructure instead of a module reference.

**section\_aws** `section`

**AWS account & region.**

**aws\_account\_id** `string`

**AWS account.**

* Default: `<< ref.input.aws_account_id >>`
* Immutable after creation

**aws\_region** `string`

**Region.** Region of the selected cluster. Must match the region in the cluster ARN, which Ravion cross-checks on every deploy.

* Default: `<< ref.input.aws_region >>`
* Immutable after creation

**execution\_environment\_id** `string`

**Terraform execution environment.**

* Default: `<< ref.input.execution_environment_id >>`

**section\_cluster\_identity** `section`

**Cluster connection.**

**cluster\_name** `string` *required*

**EKS cluster name.**

* Default: `<<ref.stack.output.cluster_name>>`
* Immutable after creation

**cluster\_arn** `string` *required*

**Cluster ARN.** Ravion resolves the owning AWS account and region from this ARN, and rejects a deploy whose cluster name or region disagrees with it.

* Default: `<<ref.stack.output.cluster_arn>>`
* Immutable after creation

**cluster\_endpoint** `string` *required*

**Cluster API endpoint.** HTTPS endpoint of the Kubernetes API server. May be private-only; the deploy runner executes inside the cluster VPC.

* Default: `<<ref.stack.output.cluster_endpoint>>`
* Immutable after creation

**cluster\_certificate\_authority\_data** `string` *required*

**Cluster certificate authority data.** Base64-encoded CA bundle used to verify the API server's TLS certificate. Public key material, not a credential.

* Default: `<<ref.stack.output.cluster_certificate_authority_data>>`
* Immutable after creation

**ravion\_runner\_role\_arn** `string` *required*

**Ravion Runner role ARN.** Stable IAM role the deploy runner assumes to obtain a cluster token. Registered as an EKS access entry by the cluster module.

* Default: `<<ref.stack.output.ravion_runner_role_arn>>`
* Immutable after creation

**ravion\_runner\_security\_group\_id** `string`

**Ravion Runner security group ID.** Security group the deploy runner's network interface joins so it can reach the cluster API endpoint. Null when the cluster module did not create one, which is only workable if the endpoint is public or the execution environment supplies its own group.

* Default: `<<ref.stack.output.ravion_runner_security_group_id>>`
* Immutable after creation

**vpc\_id** `string` *required*

**VPC ID.** VPC the cluster runs in. Load balancer target groups must live in the same VPC as the pods they register.

* Default: `<<ref.input.vpc_id>>`
* Immutable after creation

**cluster\_private\_subnet\_ids** `string_array` *required*

**Cluster private subnet IDs.** Private subnets from the selected EKS cluster. A workload targeting Fargate launches pod network interfaces in these subnets; EKS Fargate does not support public subnets.

* Default: `<<ref.input.subnet_ids>>`
* Immutable after creation
* Shown when: `{"compute_target":"fargate"}`

**addons** `$ref:rvn-eks-addons` *required*

**EKS add-ons.** Select this cluster's Add-ons module; it owns shared load balancers and can install KEDA for Spot burst.

* Immutable after creation

Set `addons` to `null`.
Mapped inputs for `addons`: set these keys alongside `addons`, not inside it, when supplying existing infrastructure instead of a module reference.

**public\_alb\_http\_listener\_arn** `string`

**Public ALB HTTP listener ARN.**

* Default: `<<ref.stack.output.public_alb_http_listener_arn>>`
* Immutable after creation

**public\_alb\_https\_listener\_arn** `string`

**Public ALB HTTPS listener ARN.** HTTPS listener ARN from the shared public ALB. Ravion uses it when present, otherwise falls back to HTTP.

* Default: `<<ref.stack.output.public_alb_https_listener_arn>>`
* Immutable after creation

**private\_alb\_http\_listener\_arn** `string`

**Private ALB HTTP listener ARN.**

* Default: `<<ref.stack.output.private_alb_http_listener_arn>>`
* Immutable after creation

**private\_alb\_https\_listener\_arn** `string`

**Private ALB HTTPS listener ARN.** HTTPS listener ARN from the shared private ALB. Ravion uses it when present, otherwise falls back to HTTP.

* Default: `<<ref.stack.output.private_alb_https_listener_arn>>`
* Immutable after creation

**ravion\_managed\_domains\_enabled** `boolean`

**Ravion-managed domains.** On: Ravion manages service certificates and listener rules. Off: attach certificates on the cluster and configure listener rules here.

* Default: `<< ref.stack.output.ravion_managed_domains_enabled || false >>`

**cluster\_parent\_fqdn** `string`

**Cluster domain.** Base for the service's Ravion address.

* Default: `<<ref.stack.output.ravion_cluster_domain_fqdn>>`

**public\_alb\_dns\_name** `string`

**Public ALB DNS name.**

* Default: `<<ref.stack.output.public_alb_dns_name>>`
* Immutable after creation

**public\_alb\_zone\_id** `string`

**Public ALB hosted zone ID.**

* Default: `<<ref.stack.output.public_alb_zone_id>>`
* Immutable after creation

**private\_alb\_dns\_name** `string`

**Private ALB DNS name.**

* Default: `<<ref.stack.output.private_alb_dns_name>>`
* Immutable after creation

**private\_alb\_zone\_id** `string`

**Private ALB hosted zone ID.**

* Default: `<<ref.stack.output.private_alb_zone_id>>`
* Immutable after creation

**amp\_workspace\_id** `string`

**AMP workspace ID.** From the selected EKS Add-ons module.

* Default: `<<ref.stack.output.amp_workspace_id>>`

**amp\_workspace\_region** `string`

**AMP region.** From the selected EKS Add-ons module.

* Default: `<<ref.stack.output.amp_region>>`

**logs\_rendering\_providers** `string_array`

**Logs rendering providers.** From the selected EKS Add-ons module.

* Default: `<<ref.stack.output.logs_rendering_providers>>`

**metrics\_rendering\_providers** `string_array`

**Metrics rendering providers.** From the selected EKS Add-ons module.

* Default: `<<ref.stack.output.metrics_rendering_providers>>`

**logs\_cloudwatch\_log\_group** `string`

**CloudWatch log group.** From the selected EKS Add-ons module.

* Default: `<<ref.stack.output.logs_cloudwatch_log_group>>`

**prometheus\_endpoint** `string`

**In-cluster Prometheus endpoint.** From the selected EKS Add-ons module.

* Default: `<<ref.stack.output.prometheus_endpoint>>`

**logs\_external\_links** `array`

**Logs vendor links.** From the selected EKS Add-ons module.

* Default: `<<ref.stack.output.logs_external_links>>`

**metrics\_external\_links** `array`

**Metrics vendor links.** From the selected EKS Add-ons module.

* Default: `<<ref.stack.output.metrics_external_links>>`

**grafana\_cloud\_logs\_query\_url** `string`

**Grafana Cloud logs query URL.** From the selected EKS Add-ons module.

* Default: `<<ref.stack.output.grafana_cloud_logs_query_url>>`

**grafana\_cloud\_metrics\_query\_url** `string`

**Grafana Cloud metrics query URL.** From the selected EKS Add-ons module.

* Default: `<<ref.stack.output.grafana_cloud_metrics_query_url>>`

**observability\_credentials\_secret\_name** `string`

**Observability credentials secret.** Kubernetes Secret in the Ravion Operator namespace with vendor query credentials. Ravion never reads the values.

* Default: `<<ref.stack.output.observability_credentials_secret_name>>`

**keda\_enabled** `boolean`

**KEDA enabled.** From the selected EKS Add-ons module.

* Default: `<< ref.output.keda_enabled == true >>`

### Web service

**name** `string` *required*

**Service name.** Name for the Helm release, Kubernetes objects, target group, and listener rule.

* Default: `<<project.given_id>>-<<environment.given_id>>-<<module.given_id>>`
* Immutable after creation
* Pattern: `^[a-z0-9]([a-z0-9-]{0,51}[a-z0-9])?$` — 1-53 lowercase letters, numbers, and hyphens. Start and end with a letter or number.

**namespace** `string` *required*

**Namespace.**

* Default: `<<project.given_id>>-<<environment.given_id>>`
* Immutable after creation
* Pattern: `^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$` — 1-63 lowercase letters, numbers, and hyphens. Start and end with a letter or number.

**namespace\_creation\_enabled** `boolean`

**Create namespace.** Turn off when the namespace is managed elsewhere.

* Default: `true`

**load\_balancer** `string` *required*

**Load balancer.** Public and private use the shared ALBs from EKS Add-ons. Cluster only is reachable just from other pods, at `<service name>.<namespace>`.

* Default: `public`
* Allowed values: `public` (Public ALB), `private` (Private ALB), `kubernetes_service` (Cluster only (no load balancer))

**target\_group\_name** `string`

**Target group name.** Blank derives it from the service name. Set it if that name is already taken in this account and region.

* Pattern: `^[A-Za-z0-9]([A-Za-z0-9-]{0,30}[A-Za-z0-9])?$` — Use 1-32 letters, numbers, or hyphens, starting and ending with a letter or number.
* Shown when: `{"load_balancer":{"not":"kubernetes_service"}}`

### Domains

**ravion\_domain\_enabled** `boolean`

**Default Ravion domain.** Off requires at least one custom domain.

* Default: `true`
* Shown when: `{"load_balancer":{"not":"kubernetes_service"},"ravion_managed_domains_enabled":true}`

**ravion\_domain\_name** `string`

**Subdomain.**

* Default: `<< module.given_id >>`
* Pattern: `^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$` — Use 1-63 lowercase letters, numbers, or hyphens, starting and ending with a letter or number.
* Shown when: `{"load_balancer":{"not":"kubernetes_service"},"ravion_domain_enabled":true,"ravion_managed_domains_enabled":true}`

**domains** `string_array`

**Custom domains.** Served alongside the default Ravion domain when it is on. Ravion manages certificates and listener rules; add the provided DNS records at your DNS provider.

* Shown when: `{"load_balancer":{"not":"kubernetes_service"},"ravion_managed_domains_enabled":true}`

### Build config

**build\_source** `string` *required*

**Build source.**

* Default: `dockerfile`
* Allowed values: `dockerfile` (Dockerfile), `railpack` (Railpack), `image_registry` (Pull from image registry)

**source\_repo** `gitrepo` *required*

**Git repository.**

* Shown when: `{"build_source":["dockerfile","railpack"]}`

**source\_base\_path** `string`

**Source base path.**

* Default: `.`
* Shown when: `{"build_source":["dockerfile","railpack"]}`

**watch\_paths** `string_array`

**Watch paths.** Globs from the repository root; prefix ! to exclude. Skips the build and deploy when no matching file changed. Empty always builds.

* Shown when: `{"build_source":["dockerfile","railpack"]}`

### Dockerfile

**dockerfile** `string`

**Dockerfile path.** Relative to the source base path.

* Shown when: `{"build_source":"dockerfile"}`

**dockerfile\_context** `string`

**Docker build context path.** Relative to the source base path.

* Shown when: `{"build_source":"dockerfile"}`

### Railpack

**railpack\_version** `string`

**Railpack version.** Blank uses the Ravion default.

* Pattern: `^(|latest|v?[0-9]+\.[0-9]+\.[0-9]+(?:[-+][0-9A-Za-z.-]+)?)$` — Leave blank, use latest, a semantic version like 0.29.0, or a v-prefixed version like v0.29.0.
* Shown when: `{"build_source":"railpack"}`

**railpack\_install\_cmd** `string`

**Install command.** Blank uses Railpack's detected command.

* Shown when: `{"build_source":"railpack"}`

**railpack\_build\_cmd** `string`

**Build command.** Blank uses Railpack's detected command.

* Shown when: `{"build_source":"railpack"}`

**railpack\_start\_cmd** `string`

**Railpack start command.** Blank uses Railpack's detected command.

* Shown when: `{"build_source":"railpack"}`

### Image

**image\_repository** `string` *required*

**Image repository.** Image repository without a tag, such as 123456789012.dkr.ecr.us-east-1.amazonaws.com/api. The tag or digest is supplied at deploy time.

* Shown when: `{"build_source":"image_registry"}`

**image\_pull\_secret\_names** `string_array`

**Image pull secret names.** Names of existing kubernetes.io/dockerconfigjson Secrets in the release namespace, for private registries.

* Shown when: `{"build_source":"image_registry"}`

**start\_command** `string_array`

**Start command.** Overrides the image entrypoint. Leave empty to use the image default.

**start\_command\_args** `string_array`

**Start command arguments.** Overrides the image default arguments. Leave empty to use the image default.

### Health check

**container\_port** `number` *required*

**Container port.** Port the application listens on, also set as `PORT`. The Kubernetes Service and the target group use it.

* Default: `8080`
* Min: `1`
* Max: `65535`
* Immutable after creation

**health\_check\_path** `string` *required*

**Health check path.** Unauthenticated endpoint that succeeds when the app can receive requests. Kubernetes readiness and the load balancer both use this path.

* Default: `/`

**health\_check\_matcher** `string` *required*

**Success codes.** HTTP status code matcher for successful health checks. Defaults to 200-399 so redirects and common successful responses are accepted.

* Default: `200-399`

**health\_check\_interval** `number`

**Interval (secs).** Seconds between load balancer health checks. Lower values detect failures faster but send more health-check traffic.

* Default: `5`
* Min: `5`
* Max: `300`

**health\_check\_timeout** `number`

**Timeout (secs).** Seconds to wait for the health-check response before marking that check as failed. Must be lower than the interval.

* Default: `4`
* Min: `2`
* Max: `120`

**probe\_initial\_delay\_seconds** `number`

**Initial delay (secs).** Seconds Kubernetes waits after the container starts or the startup check succeeds before checking traffic readiness or liveness.

* Default: `0`
* Min: `0`
* Max: `600`

**readiness\_probe\_period\_seconds** `number`

**Readiness check interval (secs).** Seconds between Kubernetes readiness checks. A pod leaves traffic after about 30 seconds of failed checks at any interval; the load balancer readiness gate still waits for target registration when enabled.

* Default: `1`
* Min: `1`
* Max: `300`

**health\_check\_healthy\_threshold** `number`

**Healthy threshold.** Number of consecutive successful checks required before an unhealthy target is considered healthy.

* Default: `2`
* Min: `2`
* Max: `10`

**health\_check\_unhealthy\_threshold** `number`

**Unhealthy threshold.** Number of consecutive failed checks required before a target is considered unhealthy.

* Default: `2`
* Min: `2`
* Max: `10`

**load\_balancer\_readiness\_gate\_enabled** `boolean`

**Wait for load balancer health.** Keep old pods serving until new ones pass load balancer health checks.

* Default: `true`
* Shown when: `{"load_balancer":{"not":"kubernetes_service"}}`

**target\_group\_deregistration\_delay** `number`

**Deregistration delay (secs).** Seconds the load balancer keeps sending in-flight responses to a pod that is shutting down.

* Default: `300`
* Min: `0`
* Max: `3600`
* Shown when: `{"load_balancer":{"not":"kubernetes_service"}}`

**target\_group\_slow\_start** `number`

**Slow start duration (secs).** Gradually ramps traffic to newly registered pods. Use 0 to disable, otherwise 30-900.

* Default: `0`
* Min: `0`
* Max: `900`
* Shown when: `{"load_balancer":{"not":"kubernetes_service"}}`

**target\_group\_stickiness\_enabled** `boolean`

**Sticky sessions.** Enable load balancer cookie stickiness so repeat requests are routed to the same pod when possible.

* Default: `false`
* Shown when: `{"load_balancer":{"not":"kubernetes_service"}}`

**target\_group\_stickiness\_type** `string`

**Stickiness type.**

* Default: `lb_cookie`
* Allowed values: `lb_cookie` (Load balancer cookie), `app_cookie` (Application cookie)
* Shown when: `{"load_balancer":{"not":"kubernetes_service"},"target_group_stickiness_enabled":true}`

**target\_group\_stickiness\_cookie\_duration** `number`

**Stickiness cookie duration (secs).**

* Default: `86400`
* Min: `1`
* Max: `604800`
* Shown when: `{"load_balancer":{"not":"kubernetes_service"},"target_group_stickiness_enabled":true}`

**target\_group\_stickiness\_cookie\_name** `string`

**Application cookie name.**

* Shown when: `{"load_balancer":{"not":"kubernetes_service"},"target_group_stickiness_type":"app_cookie"}`

### Startup and liveness

**startup\_probe\_enabled** `boolean`

**Enforce startup timeout.** Restart the container if the app does not become responsive in time. A bad path or short timeout can cause a restart loop.

* Default: `false`

**startup\_timeout\_seconds** `number`

**Maximum startup time (secs).** Maximum time the app may take to start before Kubernetes restarts it. Rounded up to the next five-second check.

* Default: `150`
* Min: `5`
* Max: `1500`
* Shown when: `{"startup_probe_enabled":true}`

**startup\_probe\_path** `string`

**Startup health path.** Endpoint used while the app starts. Leave blank to use the liveness path when set, otherwise the health check path.

* Shown when: `{"startup_probe_enabled":true}`

**liveness\_probe\_enabled** `boolean`

**Restart unresponsive containers.** Restart a running process that stops responding. A dependency-aware path can restart every pod during an outage.

* Default: `false`

**liveness\_probe\_path** `string`

**Liveness health path.** Lightweight endpoint that confirms the app process is responsive. Avoid database or external-service checks. Leave blank to use the health check path.

* Shown when: `{"liveness_probe_enabled":true}`

### HTTP listener rules

**host\_header\_values** `string_array`

**Domain host rules.** Hostnames that should route to this service, such as app.example.com or \*.example.com. Leave empty to use path-based routing.

* Shown when: `{"load_balancer":{"not":"kubernetes_service"},"ravion_managed_domains_enabled":false}`

**path\_pattern\_values** `string_array`

**Path rules.** Path patterns that should route to this service, such as /*, /api/*, or /app/*. If both domain host rules and path rules are empty, the service routes all paths with /*.

* Shown when: `{"load_balancer":{"not":"kubernetes_service"},"ravion_managed_domains_enabled":false}`

**listener\_rule\_priority** `number`

**Listener rule priority.** Optional ALB listener rule priority. Leave blank to let AWS assign the next available priority.

* Min: `1`
* Max: `50000`
* Shown when: `{"load_balancer":{"not":"kubernetes_service"},"ravion_managed_domains_enabled":false}`

### Container resources

**compute\_target** `string` *required*

**Compute target.** Choose whether Kubernetes schedules this workload automatically, on a specific EC2 capacity type, or on a dedicated EKS Fargate profile. EKS Fargate capacity is on-demand only.

* Default: `any`
* Allowed values: `any` (Automatic), `on_demand` (EC2 on-demand), `spot` (EC2 Spot), `fargate` (Fargate)

**cpu\_request** `string` *required*

**CPU request.** CPU reserved for the pod and its guaranteed share under load. 1 is one vCPU; m is thousandths of a core, so 100m is a tenth. Autoscaling CPU targets are a percentage of this value.

* Default: `100m`
* Pattern: `^[0-9]+(\.[0-9]+)?m?$` — A CPU quantity such as 100m, 0.5, or 2.

**cpu\_limit** `string`

**CPU limit.** Optional CPU ceiling, in the same units. Leave blank to let a pod burst into spare node CPU.

* Pattern: `^[0-9]+(\.[0-9]+)?m?$` — A CPU quantity such as 100m, 0.5, or 2.

**memory\_request** `string` *required*

**Memory request.** Memory reserved for the pod, in binary units such as 256Mi or 1Gi (1024Mi). Set this close to steady-state usage.

* Default: `256Mi`
* Pattern: `^[0-9]+(\.[0-9]+)?(Ki|Mi|Gi|Ti|k|M|G|T)?$` — A memory quantity such as 256Mi, 1Gi, or 512M.

**memory\_limit** `string` *required*

**Memory limit.** Memory ceiling, in the same units. Exceeding it terminates the container with OOMKilled, so set it above the worst legitimate spike.

* Default: `512Mi`
* Pattern: `^[0-9]+(\.[0-9]+)?(Ki|Mi|Gi|Ti|k|M|G|T)?$` — A memory quantity such as 256Mi, 1Gi, or 512M.

### Autoscaling

**autoscaling\_enabled** `boolean`

**Autoscaling.** Scale pods with a HorizontalPodAutoscaler. Requires the metrics server or an equivalent metrics API in the cluster.

* Default: `true`
* Shown when: `{"spot_burst_enabled":{"not":true}}`

**autoscaling\_min\_replicas** `number`

**Minimum pods.**

* Default: `2`
* Min: `1`
* Max: `1000`
* Shown when: `{"autoscaling_enabled":true,"spot_burst_enabled":{"not":true}}`

**autoscaling\_max\_replicas** `number`

**Maximum pods.**

* Default: `3`
* Min: `1`
* Max: `1000`
* Shown when: `{"autoscaling_enabled":true,"spot_burst_enabled":{"not":true}}`

**autoscaling\_cpu\_target** `number`

**CPU target (%).** Average CPU utilization, as a percentage of the CPU request, the autoscaler aims to hold.

* Default: `70`
* Min: `1`
* Max: `100`
* Shown when: `{"autoscaling_enabled":true,"spot_burst_enabled":{"not":true}}`

**autoscaling\_memory\_target** `number`

**Memory target (%).** Optional average memory utilization target, as a percentage of the memory request. Leave blank to scale on CPU alone.

* Min: `1`
* Max: `100`
* Shown when: `{"autoscaling_enabled":true,"spot_burst_enabled":{"not":true}}`

**replica\_count** `number`

**Desired pods.**

* Default: `2`
* Min: `0`
* Max: `1000`
* Shown when: `{"autoscaling_enabled":false,"spot_burst_enabled":{"not":true}}`

**spot\_burst\_enabled** `boolean`

**Spot burst.** Run a fixed On-Demand baseline with a separate KEDA-scaled Spot pool that starts at the configured minimum.

* Default: `false`
* Shown when: `{"compute_target":"on_demand"}`

**spot\_burst\_baseline\_replicas** `number`

**Baseline pods.** Fixed number of On-Demand pods kept available while the Spot pool scales independently.

* Default: `2`
* Min: `1`
* Max: `1000`
* Shown when: `{"compute_target":"on_demand","spot_burst_enabled":true}`

**spot\_burst\_min\_replicas** `number`

**Minimum Spot pods.**

* Default: `0`
* Min: `0`
* Max: `1000`
* Shown when: `{"compute_target":"on_demand","spot_burst_enabled":true}`

**spot\_burst\_max\_replicas** `number`

**Maximum Spot pods.**

* Default: `8`
* Min: `1`
* Max: `1000`
* Shown when: `{"compute_target":"on_demand","spot_burst_enabled":true}`

**spot\_burst\_triggers** `array` *required*

**KEDA triggers.** At least one trigger must report demand at the configured minimum. If the minimum is zero, CPU or memory alone cannot wake the pool. Reference pre-created authentication resources only.

* Shown when: `{"compute_target":"on_demand","spot_burst_enabled":true}`

**spot\_burst\_polling\_interval** `number`

**Polling interval (secs).**

* Default: `30`
* Min: `1`
* Shown when: `{"compute_target":"on_demand","spot_burst_enabled":true}`

**spot\_burst\_cooldown\_period** `number`

**Cooldown period (secs).** Seconds KEDA waits after the last active trigger before scaling the Spot pool down.

* Default: `300`
* Min: `0`
* Shown when: `{"compute_target":"on_demand","spot_burst_enabled":true}`

**spot\_burst\_fallback\_replicas** `number`

**Spot pods when metrics fail.** Minimum Spot pods kept while KEDA cannot read its metrics; running pods are never removed. Empty uses the maximum. Not applied to CPU, memory or Utilization triggers.

* Min: `0`
* Max: `1000`
* Shown when: `{"compute_target":"on_demand","spot_burst_enabled":true}`

### Environment variables

**build\_environment\_variables** `object`

**Build environment variables.** Only available during the build, not at runtime. Use environment variables or secrets for runtime values.

* Shown when: `{"build_source":["dockerfile","railpack"]}`

**dockerfile\_environment\_variable\_injection\_enabled** `boolean`

**Inject environment variables in Dockerfile.** Passes build environment variables as `--build-arg`.

* Default: `false`
* Shown when: `{"build_source":"dockerfile"}`

**environment\_variables** `array`

**Runtime environment variables.**

**secrets** `array`

**Runtime secrets.** `{name, value_from}` with a Secrets Manager or SSM Parameter Store ARN. Resolved inside the cluster; Ravion never reads the value.

**deploy\_environment\_variable\_names** `string_array`

**Deploy-provided environment variables.** Names a pipeline deploy step may set with `input.environment_variables`. Plain values only; can't replace a runtime variable or secret.

### IAM roles and policies

**pod\_identity\_role\_creation\_enabled** `boolean`

**Create IAM role.** Gives pods short-lived AWS credentials through EKS Pod Identity, with no keys. Leave off if the workload calls no AWS APIs.

* Default: `false`

**pod\_identity\_role\_name** `string`

**IAM role name.** Blank uses `<service>-task`, like ECS. Must be unique in the account, so set it if the service also runs on ECS or another cluster.

* Pattern: `^[\w+=,.@-]{1,64}$` — 1-64 characters of letters, digits and + = , . @ \_ -
* Shown when: `{"pod_identity_role_creation_enabled":true}`

**pod\_identity\_managed\_policy\_arns** `string_array`

**IAM policy ARNs.**

* Default: `[]`
* Shown when: `{"pod_identity_role_creation_enabled":true}`

**pod\_identity\_inline\_policies** `object`

**IAM inline policies.** Keyed by policy name. Same shape as ECS task role inline policies.

* Shown when: `{"pod_identity_role_creation_enabled":true}`

### Networking and deployment

**rollout\_max\_surge\_percent** `number`

**Maximum rollout surge (%).** Extra pods Kubernetes may create during a rolling update, as a percentage of the desired count. Use 100 to create a full replacement set at once when the cluster has enough spare capacity. Zero-unavailable rollout protection remains enabled.

* Default: `100`
* Min: `1`
* Max: `100`

**termination\_grace\_period\_seconds** `number`

**Stop timeout (secs).** Seconds a pod has to finish in-flight requests after SIGTERM before it is killed, including the pre-stop delay below. Raise this for services that move long-lived connections such as WebSockets to other pods on shutdown.

* Default: `30`
* Min: `0`
* Max: `3600`

**pre\_stop\_sleep\_seconds** `number`

**Pre-stop delay (secs).** Seconds a stopping pod keeps serving before SIGTERM, so the load balancer stops sending it new connections first. 0 turns it off. Must be less than the stop timeout.

* Default: `10`
* Min: `0`
* Max: `3599`

**pod\_disruption\_budget\_enabled** `boolean`

**Disruption budget.** Limit how many pods node drains, consolidation and cluster upgrades may evict at once. Takes effect only while the minimum pod count is above Minimum available pods, since a budget that allows no evictions would block every drain.

* Default: `true`

**pod\_disruption\_budget\_min\_available** `number`

**Minimum available pods.** Pods that must stay running during a node drain or other voluntary disruption.

* Default: `1`
* Min: `1`
* Max: `1000`
* Shown when: `{"pod_disruption_budget_enabled":true}`

**ingress\_allowed\_workloads** `string_array`

**Ingress allow-list.** EKS services in this namespace allowed to call this one. Set it and every other pod is blocked; the load balancer is always allowed.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.