Legend
EksModuleDeployment
AWS EKS deployment configuration. Helm executes on an ephemeral Ravion runner inside the cluster VPC — the deploy manager orchestrates but never touches the Kubernetes API itself.helm upgrade --atomic auto-reverts failed deploys.enum
required
Deployment type discriminatorAllowed values:
aws:eksEksDeploymentInfrastructure
required
Infrastructure resources required by the deployment.See: EksDeploymentInfrastructure
EcsDeployConcurrency
Concurrency policy — controls how simultaneous deploy requests are handled.
Omit to use defaults: queue_size=1, queue_overflow=oldest.See: EcsDeployConcurrency
integer
Maximum total wall-clock budget (in seconds) for a single deploy,
measured from the moment the workflow starts (including time spent
waiting for the deployment-manager lock). Matches the semantics of
pipeline step
timeout.
Default: unset (no wall-clock cap).(format:int32,min:60)InputProperty[]
required
Deployment-specific inputs shown in the deploy modal.
Same types as module inputs — reuses the InputProperty union.See: InputProperty
EksDeploymentDefinition
required
Per-deploy definition. Templateable — supports both module.input and
deploy.input references inside string fields.See: EksDeploymentDefinition(templateable)
EksDeploymentDefinition
Helm-engine EKS deploy definition. The runner executeshelm upgrade --install --atomic, so a deploy either lands or leaves
the cluster untouched. Release name and namespace are explicit —
Ravion derives nothing implicitly.enum
required
Definition engine discriminator.Allowed values:
helm(templateable)string
required
Helm release name the deploy upgrades. Explicit and stable per
module instance — rollback and history target this release.(minLen:1; templateable)
string
required
Kubernetes namespace the release is installed into.(minLen:1; templateable)
HelmChartSource
required
Where the chart comes from — a chart directory (bundled or checked
out of Git), an OCI registry, or an HTTP repository.See: HelmChartSource(templateable)
map<string,any | null>
Values passed to Helm (equivalent to a
--values file). Merged over
the chart’s defaults. Templateable — supports module.input and
deploy.input references, including object spread directives.(templateable)EcsSecret[] | null
Secret references injected into the release’s containers. Reuses the
ECS
EcsSecret shape verbatim — {name, value_from: <ARN>}, Parameter
Store or Secrets Manager, including ECS’s JSON-key extraction suffix
(arn:…:secret:db-AbCdEf:password::) — so a service migrating from
aws:ecs to aws:eks carries its secret configuration unchanged.Reference-only: Ravion never reads these values. The ARNs travel to the
chart as ordinary Helm values under the reserved ravion.secrets key,
the chart renders an External Secrets Operator ExternalSecret from
them, and ESO materializes the Kubernetes Secret in-cluster. No secret
value ever reaches Tower, the Helm values document, the release
manifest, deploymentData, or Ravion logs.value_from must be a full ARN — unlike ECS, a bare Parameter Store
name is rejected, because the chart has to know which provider a
reference belongs to in order to pick the right ESO SecretStore.See: EcsSecret(templateable)boolean | null
Whether Helm creates the target namespace when it does not exist
(
--create-namespace).
Default: false.(templateable)EksDeploymentInfrastructure
Infrastructure resources required for an AWS EKS deployment. Not provisioned by the deploy manager — must already exist (created by thecompute/eks
composite Terraform module). The deploy manager launches an ephemeral runner
inside the cluster VPC, assembles a kubeconfig in-memory from these values
plus aws eks get-token, and never persists credentials.string
required
Full ARN of the EKS cluster the deploy targets, e.g.
arn:aws:eks:us-east-1:123456789012:cluster/prod. Ravion parses the
AWS account number and region out of it to resolve which connected
AWS account owns the cluster — the same contract aws:ecs uses with
ecs_cluster_arn.(minLen:1; templateable)string
required
Name of the EKS cluster the deploy targets.(minLen:1; templateable)
string
required
HTTPS endpoint of the cluster’s Kubernetes API server. May be a
private-only endpoint — the runner executes inside the cluster VPC, so
reachability is guaranteed by construction.(minLen:1; templateable)
string
required
Base64-encoded certificate authority data of the cluster, used to
verify the API server’s TLS certificate when assembling the
kubeconfig.(minLen:1; templateable)
string
required
ARN of the stable
<cluster>-ravion-runner IAM role provisioned by
the EKS module alongside its cluster access entry. The runner assumes
this role to obtain a cluster token via aws eks get-token --role-arn
— per-step ephemeral roles are incompatible with
authentication_mode = API access entries. The field name matches
the shipped rvn-eks Terraform output, so the template reads
straight through.(minLen:1; templateable)string | null
ID or given ID of the execution environment the deploy’s ephemeral Helm
runner is launched into. The environment supplies the runner’s VPC,
subnet and security group.Its AWS account and region must match the cluster’s, both of which are
read out of
cluster_arn — an environment elsewhere cannot assume the
cluster’s runner role or reach its network, and the deploy fails naming
the environment rather than failing later at EC2 launch.A pipeline deploy step, or an API deploy request, that names its own
environment overrides this one.(templateable)Pipeline.ExecutionEnvironmentOverrides
Overrides for individual attributes of the resolved execution
environment. Valid with or without
execution_environment_id: without
one they apply on top of the AWS account’s default environment.Merged per field with the step- or request-level overrides, which win
wherever both name the same attribute.See: Pipeline.ExecutionEnvironmentOverrides(templateable)EksHelmDefinition
Helm-engine EKS deploy definition. The runner executeshelm upgrade --install --atomic, so a deploy either lands or leaves
the cluster untouched. Release name and namespace are explicit —
Ravion derives nothing implicitly.enum
required
Definition engine discriminator.Allowed values:
helm(templateable)string
required
Helm release name the deploy upgrades. Explicit and stable per
module instance — rollback and history target this release.(minLen:1; templateable)
string
required
Kubernetes namespace the release is installed into.(minLen:1; templateable)
HelmChartSource
required
Where the chart comes from — a chart directory (bundled or checked
out of Git), an OCI registry, or an HTTP repository.See: HelmChartSource(templateable)
map<string,any | null>
Values passed to Helm (equivalent to a
--values file). Merged over
the chart’s defaults. Templateable — supports module.input and
deploy.input references, including object spread directives.(templateable)EcsSecret[] | null
Secret references injected into the release’s containers. Reuses the
ECS
EcsSecret shape verbatim — {name, value_from: <ARN>}, Parameter
Store or Secrets Manager, including ECS’s JSON-key extraction suffix
(arn:…:secret:db-AbCdEf:password::) — so a service migrating from
aws:ecs to aws:eks carries its secret configuration unchanged.Reference-only: Ravion never reads these values. The ARNs travel to the
chart as ordinary Helm values under the reserved ravion.secrets key,
the chart renders an External Secrets Operator ExternalSecret from
them, and ESO materializes the Kubernetes Secret in-cluster. No secret
value ever reaches Tower, the Helm values document, the release
manifest, deploymentData, or Ravion logs.value_from must be a full ARN — unlike ECS, a bare Parameter Store
name is rejected, because the chart has to know which provider a
reference belongs to in order to pick the right ESO SecretStore.See: EcsSecret(templateable)boolean | null
Whether Helm creates the target namespace when it does not exist
(
--create-namespace).
Default: false.(templateable)HelmChartSource
Where the Helm chart comes from — discriminated bytype.Discriminated union. The type field selects which schema applies.HelmGitChartSource
Helm chart installed from a directory of chart files. Either the directory is already in the runner’s working directory — the Ravion charts shipped with a module definition (rvn-eks-web,
rvn-eks-worker, rvn-eks-cron) — or Ravion checks a repository out
onto the runner first and the directory lives inside that checkout.Private repositories authenticate through the organization’s connected
code source, exactly as a build checkout does. There is no token field:
the clone credential is resolved on the runner and never travels through
the deploy’s history.enum
required
Chart source discriminator.Allowed values:
git(templateable)string | null
Git repository URL containing the chart. Omit to install a chart
already present in the runner’s working directory.(templateable)
string | null
Branch to check out. Required whenever
repo_url is set — the
runner’s clone needs a branch to start from.(templateable)string | null
Exact commit SHA or tag to pin the checkout to, applied on top of
branch. Strongly preferred for reproducible deploys.(templateable)string
required
Path of the chart directory within the repository, or — when
repo_url is omitted — relative to the runner’s working directory.(minLen:1; templateable)HelmHttpChartSource
Helm chart pulled from a classic HTTP Helm repository.enum
required
Chart source discriminator.Allowed values:
http(templateable)string
required
HTTP(S) URL of the Helm repository.(minLen:1; templateable)
string
required
Name of the chart within the repository.(minLen:1; templateable)
string | null
Chart version to install. Prefer pinning an exact version for
reproducibility.(templateable)
HelmRegistryCredentials
HelmOciChartSource
Helm chart pulled from an OCI registry.enum
required
Chart source discriminator.Allowed values:
oci(templateable)string
required
Full OCI chart reference.(minLen:1; templateable)
string | null
Chart version to install. Prefer pinning an exact version for
reproducibility.(templateable)
HelmRegistryCredentials
HelmRegistryCredentials
Credentials for a private OCI registry or HTTP Helm repository, passed tohelm pull as --username / --password. Supply both — a registry
that wants one wants the other.HelmCredentialRef
required
HelmCredentialRef
required