| acm_cert_base_domain |
Base domain of the certificate used for the ALB Proxy |
string |
"" |
no |
| admin_principal_arns |
List of principal_arns that require admin access to the cluster |
list(string) |
[] |
no |
| admin_readonly_principal_arns |
List of principal_arns that require admin readonly access to the cluster |
list(string) |
[] |
no |
| alb_deletion_protection |
Enable/Disable ALB deletion protection for both ALBs |
bool |
false |
no |
| alb_drop_invalid_header_fields |
Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type application |
bool |
true |
no |
| alb_idle_timeout |
Default idle request timeout for the ALB |
string |
"60" |
no |
| alb_private_tags |
Additional private ALB tags |
map(any) |
null |
no |
| alb_proxy_ingress_cidrs |
List of CIDR blocks allowed to access the ALB Proxy; used to restrict public access to a certain set of IPs |
list(string) |
[] |
no |
| alb_proxy_ingress_prefix_lists |
List of Prefix List IDs allowed to access the ALB Proxy; used to restrict public access to a certain set of IPs |
list(string) |
[] |
no |
| alb_proxy_is_internal |
If the ALB Proxy should be using internal ips. Defaults to false, because the reason for ALB proxy existing is typically to make it accessible over the Internet |
bool |
false |
no |
| alb_proxy_restricted_hosts |
A list of allowable host for proxy alb |
set(string) |
[] |
no |
| alb_proxy_subnets |
List of subnet ids for the ALB Proxy to be deployed into |
list(string) |
[] |
no |
| alb_public_tags |
Additional public ALB tags |
map(any) |
null |
no |
| alb_restricted_hosts |
A list of allowable host for private alb |
set(string) |
[] |
no |
| alb_shared_ingress_cidrs |
List of CIDR blocks allowed to access the ALB Proxy; used to restrict public access to a certain set of IPs |
list(string) |
[] |
no |
| alb_shared_ingress_prefix_lists |
List of Prefix List IDs allowed to access the ALB Proxy; used to restrict public access to a certain set of IPs |
list(string) |
[] |
no |
| alb_shared_is_internal |
If the ALB in the shared subnet should be using internal ips. Defaults to false, because the reason for this ALB existing is to make it accessible over the Internet |
bool |
false |
no |
| alb_shared_restricted_hosts |
A list of allowable host for shared alb. Defaults to deny to ensure this load balancer is configured correctly. |
set(string) |
[
"deny-by-default.example.com"
] |
no |
| alb_shared_subnets |
List of subnet ids for the ALB in the shared subnet |
list(string) |
[] |
no |
| alb_ssl_security_policy |
ALB SSL Security Policy |
string |
"ELBSecurityPolicy-TLS13-1-2-Res-2021-06" |
no |
| alb_subnets_by_zone |
n/a |
map(string) |
n/a |
yes |
| ami_date |
n/a |
string |
"" |
no |
| ami_regex_override |
Overrides default AMI lookup regex, which grabs latest AMI matching cluster_version by default |
string |
"" |
no |
| autoscaling_group_tags |
Tags to apply to all autoscaling groups created |
map(any) |
{} |
no |
| cluster_additional_sg_prefix_lists |
n/a |
list(string) |
n/a |
yes |
| cluster_enabled_log_types |
A list of the desired control plane logging to enable. For more information, see Amazon EKS Control Plane Logging documentation (https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html) |
list(string) |
[
"api",
"audit",
"authenticator",
"controllerManager",
"scheduler"
] |
no |
| cluster_name |
n/a |
string |
n/a |
yes |
| cluster_security_group_additional_rules |
Map of security group rules to attach to the cluster security group, as you cannot change cluster security groups without replacing the instance |
map(any) |
{} |
no |
| cluster_service_cidr |
n/a |
string |
"172.20.0.0/16" |
no |
| cluster_version |
n/a |
string |
"1.28" |
no |
| create_alb_proxy |
Create an Application Load Balancer proxy to live in front of the K8s ALB and act as a proxy from the public Internet |
bool |
false |
no |
| create_alb_shared |
Creaes an ALB in the shared subnet |
bool |
false |
no |
| create_cosign_iam_role |
Flag to create Cosign IAM role |
bool |
false |
no |
| custom_node_policy_arns |
Custom node policy arns |
set(string) |
[] |
no |
| custom_node_pools |
n/a |
any |
{} |
no |
| delete_ebs_volume_role_arn |
principal_arn for delete ebs volume role |
string |
"" |
no |
| enable_cluster_creator_admin_permissions |
Grants the user who created the cluster admin permissions |
bool |
true |
no |
| enable_eks_managed_nodes |
Enables eks managed nodes |
bool |
false |
no |
| enable_hoplimit |
Enables a IMDSv2 hop limit of 1 on all nodes. Defaults to false |
bool |
false |
no |
| enable_self_managed_nodes |
Enables self managed nodes |
bool |
true |
no |
| enable_ssm_patching |
Enables Systems Manager to patch nodes |
bool |
false |
no |
| environment |
n/a |
string |
"dev" |
no |
| force_update_version |
Force update version |
bool |
true |
no |
| general_node_pool |
General node pool, required for hosting core services |
any |
{
"desired_size": 3,
"instance_type": "c5.2xlarge",
"labels": {
"general": "true"
},
"max_size": 5,
"min_size": 2,
"taints": {}
} |
no |
| grant_delete_ebs_volumes_lambda_access |
When set to true, a cluster role and permissions will be created to grant the delete-ebs-volumes Lambda access to the PersistentVolumes API. |
bool |
false |
no |
| host_subnets |
Override the ec2 instance subnets. By default, they are launche in private_subnets, just like the EKS control plane. |
list(any) |
[] |
no |
| iam_role_path |
n/a |
string |
"/delegatedadmin/developer/" |
no |
| iam_role_permissions_boundary |
n/a |
string |
"arn:aws:iam::373346310182:policy/cms-cloud-admin/developer-boundary-policy" |
no |
| instance_tags |
Instance custom tags |
map(any) |
null |
no |
| logging_bucket |
Name of the S3 bucket to send load balancer access logs. |
string |
null |
no |
| node_https_ingress_cidr_blocks |
List of CIDR blocks to allow into the node over the HTTPs port |
list(string) |
[
"10.0.0.0/8",
"100.0.0.0/8"
] |
no |
| node_schedule_shutdown_cron |
The cron expression for the shutdown schedule. If left empty, the cluster will not be stopped. Overrides node_schedule_shutdown_hour |
string |
"" |
no |
| node_schedule_shutdown_hour |
The hour of the day (0-23) the cluster should be shutdown. If left empty, the cluster will not be stopped. Will run every day otherwise. |
number |
-1 |
no |
| node_schedule_startup_cron |
The cron expression for the startup schedule. If left empty, the cluster will not be restarted after shutdown. Overrides node_schedule_startup_hour |
string |
"" |
no |
| node_schedule_startup_hour |
The hour of the day (0-23) the cluster should be restarted. If left empty, the cluster will not be restarted after shutdown. Will run every weekday otherwise. |
number |
-1 |
no |
| node_schedule_timezone |
The timezone of the schedule. Ex: 'America/New_York', 'America/Chicago', 'America/Denver', 'America/Los_Angeles', 'Pacific/Honolulu' See: https://www.joda.org/joda-time/timezones.html |
string |
"America/New_York" |
no |
| openid_connect_audiences |
OpenID Connect Audiences |
list(string) |
[] |
no |
| private_subnets |
n/a |
list(any) |
n/a |
yes |
| ssm_iam_patching_policy |
SSM IAM policy for patching |
string |
"cms-cloud-ssm-iam-policy-v3" |
no |
| ssm_tag_patch_group |
SSM Patching group for instances. For more information: https://cloud.cms.gov/patching-prerequisites |
string |
"AL2" |
no |
| ssm_tag_patch_window |
SSM Patching window for instances. For more information: https://cloud.cms.gov/patching-prerequisites |
string |
"ITOPS-Wave1-Non-Mktplc-DevTestImpl-MW" |
no |
| tags |
Global resource tags to apply to all resources |
map(any) |
null |
no |
| vpc_cidr_blocks |
List of VPC CIDR blocks |
list(string) |
n/a |
yes |
| vpc_id |
n/a |
string |
n/a |
yes |