rvn-eks-worker / Latest version: 1.0.0
See EKS Worker module reference for the full module page.
EKS cluster
$ref:rvn-eks-cluster
required
Cluster.
- Immutable after creation
cluster to null.
Mapped inputs for cluster: set these keys alongside cluster, not inside it, when supplying existing infrastructure instead of a module reference.
section
AWS account & region.
string
AWS account.
- Default:
<< ref.input.aws_account_id >> - Immutable after creation
string
Region. Region of the selected cluster. Must match the region in the cluster ARN, which Ravion cross-checks on every deploy.
- Default:
<< ref.input.aws_region >> - Immutable after creation
string
Terraform execution environment.
- Default:
<< ref.input.execution_environment_id >>
section
Cluster connection.
string
required
EKS cluster name.
- Default:
<<ref.stack.output.cluster_name>> - Immutable after creation
string
required
Cluster ARN. Ravion resolves the owning AWS account and region from this ARN, and rejects a deploy whose cluster name or region disagrees with it.
- Default:
<<ref.stack.output.cluster_arn>> - Immutable after creation
string
required
Cluster API endpoint. HTTPS endpoint of the Kubernetes API server. May be private-only; the deploy runner executes inside the cluster VPC.
- Default:
<<ref.stack.output.cluster_endpoint>> - Immutable after creation
string
required
Cluster certificate authority data. Base64-encoded CA bundle used to verify the API server’s TLS certificate. Public key material, not a credential.
- Default:
<<ref.stack.output.cluster_certificate_authority_data>> - Immutable after creation
string
required
Ravion Runner role ARN. Stable IAM role the deploy runner assumes to obtain a cluster token. Registered as an EKS access entry by the cluster module.
- Default:
<<ref.stack.output.ravion_runner_role_arn>> - Immutable after creation
string
Ravion Runner security group ID. Security group the deploy runner’s network interface joins so it can reach the cluster API endpoint. Null when the cluster module did not create one, which is only workable if the endpoint is public or the execution environment supplies its own group.
- Default:
<<ref.stack.output.ravion_runner_security_group_id>> - Immutable after creation
string
required
VPC ID. VPC the cluster runs in. Load balancer target groups must live in the same VPC as the pods they register.
- Default:
<<ref.input.vpc_id>> - Immutable after creation
string_array
required
Cluster private subnet IDs. Private subnets from the selected EKS cluster. A workload targeting Fargate launches pod network interfaces in these subnets; EKS Fargate does not support public subnets.
- Default:
<<ref.input.subnet_ids>> - Immutable after creation
- Shown when:
{"compute_target":"fargate"}
$ref:rvn-eks-addons
EKS add-ons. Select this cluster’s Add-ons module for observability or KEDA when using Spot burst.
addons to null.
Mapped inputs for addons: set these keys alongside addons, not inside it, when supplying existing infrastructure instead of a module reference.
string
AMP workspace ID. From the selected EKS Add-ons module.
- Default:
<<ref.stack.output.amp_workspace_id>>
string
AMP region. From the selected EKS Add-ons module.
- Default:
<<ref.stack.output.amp_region>>
string_array
Logs rendering providers. From the selected EKS Add-ons module.
- Default:
<<ref.stack.output.logs_rendering_providers>>
string_array
Metrics rendering providers. From the selected EKS Add-ons module.
- Default:
<<ref.stack.output.metrics_rendering_providers>>
string
CloudWatch log group. From the selected EKS Add-ons module.
- Default:
<<ref.stack.output.logs_cloudwatch_log_group>>
string
In-cluster Prometheus endpoint. From the selected EKS Add-ons module.
- Default:
<<ref.stack.output.prometheus_endpoint>>
array
Logs vendor links. From the selected EKS Add-ons module.
- Default:
<<ref.stack.output.logs_external_links>>
array
Metrics vendor links. From the selected EKS Add-ons module.
- Default:
<<ref.stack.output.metrics_external_links>>
string
Grafana Cloud logs query URL. From the selected EKS Add-ons module.
- Default:
<<ref.stack.output.grafana_cloud_logs_query_url>>
string
Grafana Cloud metrics query URL. From the selected EKS Add-ons module.
- Default:
<<ref.stack.output.grafana_cloud_metrics_query_url>>
string
Observability credentials secret. Kubernetes Secret in the Ravion Operator namespace with vendor query credentials. Ravion never reads the values.
- Default:
<<ref.stack.output.observability_credentials_secret_name>>
boolean
KEDA enabled. From the selected EKS Add-ons module.
- Default:
<< ref.output.keda_enabled == true >>
Worker service
string
required
Service name. Name for the Helm release and the Kubernetes objects it creates.
- Default:
<<project.given_id>>-<<environment.given_id>>-<<module.given_id>> - Immutable after creation
- Pattern:
^[a-z0-9]([a-z0-9-]{0,51}[a-z0-9])?$— 1-53 lowercase letters, numbers, and hyphens. Start and end with a letter or number.
string
required
Namespace.
- Default:
<<project.given_id>>-<<environment.given_id>> - Immutable after creation
- Pattern:
^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$— 1-63 lowercase letters, numbers, and hyphens. Start and end with a letter or number.
boolean
Create namespace. Turn off when the namespace is managed elsewhere.
- Default:
true
Build config
string
required
Build source.
- Default:
dockerfile - Allowed values:
dockerfile(Dockerfile),railpack(Railpack),image_registry(Pull from image registry)
gitrepo
required
Git repository.
- Shown when:
{"build_source":["dockerfile","railpack"]}
string
Source base path.
- Default:
. - Shown when:
{"build_source":["dockerfile","railpack"]}
string_array
Watch paths. Globs from the repository root; prefix ! to exclude. Skips the build and deploy when no matching file changed. Empty always builds.
- Shown when:
{"build_source":["dockerfile","railpack"]}
Dockerfile
string
Dockerfile path. Relative to the source base path.
- Shown when:
{"build_source":"dockerfile"}
string
Docker build context path. Relative to the source base path.
- Shown when:
{"build_source":"dockerfile"}
Railpack
string
Railpack version. Blank uses the Ravion default.
- Pattern:
^(|latest|v?[0-9]+\.[0-9]+\.[0-9]+(?:[-+][0-9A-Za-z.-]+)?)$— Leave blank, use latest, a semantic version like 0.29.0, or a v-prefixed version like v0.29.0. - Shown when:
{"build_source":"railpack"}
string
Install command. Blank uses Railpack’s detected command.
- Shown when:
{"build_source":"railpack"}
string
Build command. Blank uses Railpack’s detected command.
- Shown when:
{"build_source":"railpack"}
string
Railpack start command. Blank uses Railpack’s detected command.
- Shown when:
{"build_source":"railpack"}
Image
string
required
Image repository. Image repository without a tag, such as 123456789012.dkr.ecr.us-east-1.amazonaws.com/api. The tag or digest is supplied at deploy time.
- Shown when:
{"build_source":"image_registry"}
string_array
Image pull secret names. Names of existing kubernetes.io/dockerconfigjson Secrets in the release namespace, for private registries.
- Shown when:
{"build_source":"image_registry"}
string_array
Start command. Overrides the image entrypoint. Leave empty to use the image default.
string_array
Start command arguments. Overrides the image default arguments. Leave empty to use the image default.
Container resources
string
required
Compute target. Choose whether Kubernetes schedules this workload automatically, on a specific EC2 capacity type, or on a dedicated EKS Fargate profile. EKS Fargate capacity is on-demand only.
- Default:
any - Allowed values:
any(Automatic),on_demand(EC2 on-demand),spot(EC2 Spot),fargate(Fargate)
string
required
CPU request. CPU reserved for the pod and its guaranteed share under load. 1 is one vCPU; m is thousandths of a core, so 100m is a tenth. Autoscaling CPU targets are a percentage of this value.
- Default:
100m - Pattern:
^[0-9]+(\.[0-9]+)?m?$— A CPU quantity such as 100m, 0.5, or 2.
string
CPU limit. Optional CPU ceiling, in the same units. Leave blank to let a pod burst into spare node CPU.
- Pattern:
^[0-9]+(\.[0-9]+)?m?$— A CPU quantity such as 100m, 0.5, or 2.
string
required
Memory request. Memory reserved for the pod, in binary units such as 256Mi or 1Gi (1024Mi). Set this close to steady-state usage.
- Default:
256Mi - Pattern:
^[0-9]+(\.[0-9]+)?(Ki|Mi|Gi|Ti|k|M|G|T)?$— A memory quantity such as 256Mi, 1Gi, or 512M.
string
required
Memory limit. Memory ceiling, in the same units. Exceeding it terminates the container with OOMKilled, so set it above the worst legitimate spike.
- Default:
512Mi - Pattern:
^[0-9]+(\.[0-9]+)?(Ki|Mi|Gi|Ti|k|M|G|T)?$— A memory quantity such as 256Mi, 1Gi, or 512M.
Autoscaling
boolean
Autoscaling. Scale pods with a HorizontalPodAutoscaler. Requires the metrics server or an equivalent metrics API in the cluster.
- Default:
false - Shown when:
{"spot_burst_enabled":{"not":true}}
number
Minimum pods.
- Default:
1 - Min:
1 - Max:
1000 - Shown when:
{"autoscaling_enabled":true,"spot_burst_enabled":{"not":true}}
number
Maximum pods.
- Default:
3 - Min:
1 - Max:
1000 - Shown when:
{"autoscaling_enabled":true,"spot_burst_enabled":{"not":true}}
number
CPU target (%). Average CPU utilization, as a percentage of the CPU request, the autoscaler aims to hold.
- Default:
70 - Min:
1 - Max:
100 - Shown when:
{"autoscaling_enabled":true,"spot_burst_enabled":{"not":true}}
number
Memory target (%). Optional average memory utilization target, as a percentage of the memory request. Leave blank to scale on CPU alone.
- Min:
1 - Max:
100 - Shown when:
{"autoscaling_enabled":true,"spot_burst_enabled":{"not":true}}
number
Desired pods.
- Default:
1 - Min:
0 - Max:
1000 - Shown when:
{"autoscaling_enabled":false,"spot_burst_enabled":{"not":true}}
boolean
Spot burst. Run a fixed On-Demand baseline with a separate KEDA-scaled Spot pool that starts at the configured minimum.
- Default:
false - Shown when:
{"compute_target":"on_demand"}
number
Baseline pods. Fixed number of On-Demand pods kept available while the Spot pool scales independently.
- Default:
2 - Min:
1 - Max:
1000 - Shown when:
{"compute_target":"on_demand","spot_burst_enabled":true}
number
Minimum Spot pods.
- Default:
0 - Min:
0 - Max:
1000 - Shown when:
{"compute_target":"on_demand","spot_burst_enabled":true}
number
Maximum Spot pods.
- Default:
8 - Min:
1 - Max:
1000 - Shown when:
{"compute_target":"on_demand","spot_burst_enabled":true}
array
required
KEDA triggers. At least one trigger must report demand at the configured minimum. If the minimum is zero, CPU or memory alone cannot wake the pool. Reference pre-created authentication resources only.
- Shown when:
{"compute_target":"on_demand","spot_burst_enabled":true}
number
Polling interval (secs).
- Default:
30 - Min:
1 - Shown when:
{"compute_target":"on_demand","spot_burst_enabled":true}
number
Cooldown period (secs). Seconds KEDA waits after the last active trigger before scaling the Spot pool down.
- Default:
300 - Min:
0 - Shown when:
{"compute_target":"on_demand","spot_burst_enabled":true}
number
Spot pods when metrics fail. Minimum Spot pods kept while KEDA cannot read its metrics; running pods are never removed. Empty uses the maximum. Not applied to CPU, memory or Utilization triggers.
- Min:
0 - Max:
1000 - Shown when:
{"compute_target":"on_demand","spot_burst_enabled":true}
Environment variables
object
Build environment variables. Only available during the build, not at runtime. Use environment variables or secrets for runtime values.
- Shown when:
{"build_source":["dockerfile","railpack"]}
boolean
Inject environment variables in Dockerfile. Passes build environment variables as
--build-arg.- Default:
false - Shown when:
{"build_source":"dockerfile"}
array
Runtime environment variables.
array
Runtime secrets.
{name, value_from} with a Secrets Manager or SSM Parameter Store ARN. Resolved inside the cluster; Ravion never reads the value.string_array
Deploy-provided environment variables. Names a pipeline deploy step may set with
input.environment_variables. Plain values only; can’t replace a runtime variable or secret.IAM roles and policies
boolean
Create IAM role. Gives pods short-lived AWS credentials through EKS Pod Identity, with no keys. Leave off if the workload calls no AWS APIs.
- Default:
false
string
IAM role name. Blank uses
<service>-task, like ECS. Must be unique in the account, so set it if the service also runs on ECS or another cluster.- Pattern:
^[\w+=,.@-]{1,64}$— 1-64 characters of letters, digits and + = , . @ _ - - Shown when:
{"pod_identity_role_creation_enabled":true}
string_array
IAM policy ARNs.
- Default:
[] - Shown when:
{"pod_identity_role_creation_enabled":true}
object
IAM inline policies. Keyed by policy name. Same shape as ECS task role inline policies.
- Shown when:
{"pod_identity_role_creation_enabled":true}
Networking and deployment
number
Maximum rollout surge (%). Extra pods Kubernetes may create during a rolling update, as a percentage of the desired count. Use 100 to create a full replacement set at once when the cluster has enough spare capacity. Zero-unavailable rollout protection remains enabled.
- Default:
100 - Min:
1 - Max:
100
number
Stop timeout (secs). Seconds a pod has to finish in-flight work after SIGTERM before it is killed. Raise this for workers with long-running jobs.
- Default:
30 - Min:
0 - Max:
3600
boolean
Disruption budget. Limit how many pods node drains, consolidation and cluster upgrades may evict at once. A worker loses its in-flight work when it is evicted, so draining a fleet all at once loses all of it. Takes effect only while the minimum pod count is above Minimum available pods, since a budget that allows no evictions would block every drain.
- Default:
true
number
Minimum available pods. Pods that must stay running during a node drain or other voluntary disruption.
- Default:
1 - Min:
1 - Max:
1000 - Shown when:
{"pod_disruption_budget_enabled":true}
Builder config
string
required
Builder capacity type. Sandbox starts fastest. EC2 spot costs less but may wait for capacity or be interrupted.
- Default:
sandbox - Allowed values:
sandbox(Sandbox),ec2(EC2),ec2-spot(EC2 spot) - Shown when:
{"build_source":["dockerfile","railpack"]}
string
required
Builder instance type. EC2 instance type for builds. Start with the default value, then increase or decrease it based on the resource usage report at the end of builds.
- Default:
c7a.4xlarge - Shown when:
{"build_capacity_type":["ec2","ec2-spot"],"build_source":["dockerfile","railpack"]}
boolean
Automatic build sizing. Ravion sizes CPU, memory, and disk from previous builds. Turn off to set fixed sizes.
- Default:
true - Shown when:
{"build_capacity_type":"sandbox","build_source":["dockerfile","railpack"]}
number
required
Builder vCPUs.
- Default:
14 - Shown when:
{"build_auto_sizing_enabled":false,"build_capacity_type":"sandbox","build_source":["dockerfile","railpack"]}
number
required
Builder memory (GiB).
- Default:
28 - Shown when:
{"build_auto_sizing_enabled":false,"build_capacity_type":"sandbox","build_source":["dockerfile","railpack"]}
number
Builder disk (GiB). Space the build reserves on the pool host for what it writes. Larger values let fewer builds share a host.
- Default:
30 - Shown when:
{"build_auto_sizing_enabled":false,"build_capacity_type":"sandbox","build_source":["dockerfile","railpack"]}
boolean
Interruptible build. Lets the build run on spot hosts and start over if AWS reclaims the host. Turn off if your build commands change anything outside the build, such as running database migrations.
- Default:
true - Shown when:
{"build_capacity_type":"sandbox","build_source":["dockerfile","railpack"]}
string
Builder execution environment. Optional execution environment ID or given ID for builds. Defaults to the module Terraform execution environment.
- Shown when:
{"build_source":["dockerfile","railpack"]}
string
Builder AMI. Optional AMI ID for build runners. Leave empty to use the default runner image.
- Shown when:
{"build_capacity_type":["ec2","ec2-spot"],"build_source":["dockerfile","railpack"]}
boolean
Include default build policies. The step’s built-in policies (ECR/S3 access, CloudWatch agent) stay attached alongside your Builder IAM policies. Turn off to run the build with only the policies listed below.
- Default:
true - Shown when:
{"build_source":["dockerfile","railpack"]}
string_array
Builder IAM policies. IAM managed policy ARNs for the EC2 build runner role, applied for the duration of each build.
- Default:
[] - Shown when:
{"build_source":["dockerfile","railpack"]}
Image registry lifecycle
string
Image repository name. Blank uses the name above. Set it when an ECR repository by that name already belongs to something else. Changing it replaces the repository.
- Pattern:
^(?:[a-z0-9]+(?:[._-][a-z0-9]+)*/)*[a-z0-9]+(?:[._-][a-z0-9]+)*$— Use lowercase letters and numbers, separated by single . _ - or / characters. - Pattern:
^.{2,256}$— Use 2-256 characters. - Shown when:
{"build_source":["dockerfile","railpack"]}
boolean
Scan images on push. Basic ECR vulnerability scan on every push. Turn off if another scanner covers it.
- Default:
true - Shown when:
{"build_source":["dockerfile","railpack"]}
boolean
Force delete image repository. Allow the ECR repository to be deleted even when it contains images. Use with care.
- Default:
false - Shown when:
{"build_source":["dockerfile","railpack"]}
Misc
keyvalue
Tags. A map of tags to assign to all resources. Default tags are
Owner, ProjectGivenId, EnvironmentGivenId, ModuleGivenId, ModuleIdTerraform settings
string
OpenTofu version override. Override the environment’s default version for this module
string
Ravion Terraform workspace name. Override Terraform state backend workspace name. Defaults to project + environment + module given ids.
- Immutable after creation
boolean
Include default plan policies. Turn off to plan with only the policies below instead of the default read-only policies. Requires at least one policy below.
- Default:
true
string_array
Terraform plan IAM policies. IAM managed policy ARNs for the Terraform plan runner role. Without default policies, allow s3:CreateBucket, s3:PutObject, s3:GetObject, and s3:ListBucket on the ravion-terraform-plans-<AWS account number> bucket in this account.
- Default:
[]
boolean
Include default apply policies. Turn off to apply and destroy with only the policies below instead of AdministratorAccess. Requires at least one policy below.
- Default:
true
string_array
Terraform apply IAM policies. IAM managed policy ARNs for the Terraform apply runner role. Without default policies, allow s3:CreateBucket, s3:PutObject, s3:GetObject, and s3:ListBucket on the ravion-terraform-plans-<AWS account number> bucket in this account.
- Default:
[]
object
Advanced Terraform variables. Optional raw Terraform variable overrides for advanced module inputs or one-off overrides. Values here override the generated variables above.
- Default:
{}