chore(main): release 6.7.2

CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## [6.7.2](https://github.com/nullplatform/tofu-modules/compare/v6.7.1...v6.7.2) (2026-07-30)
+
+
+### Bug Fixes
+
+* allow gateway egress to additional VPC CIDR blocks ([#452](https://github.com/nullplatform/tofu-modules/issues/452)) ([c6a9f3a](https://github.com/nullplatform/tofu-modules/commit/c6a9f3a0567825a4c130766b4034c582d31d7151))
+* use pull_request trigger with per-PR concurrency instead of workflow_run ([#455](https://github.com/nullplatform/tofu-modules/issues/455)) ([6475fb6](https://github.com/nullplatform/tofu-modules/commit/6475fb682b7d8fa0a80c2e0363a14edbfe312225))
+
 ## [6.7.1](https://github.com/nullplatform/tofu-modules/compare/v6.7.0...v6.7.1) (2026-07-28)
 
 

infrastructure/aws/acm/README.md

@@ -18,7 +18,7 @@ The module creates an aws_acm_certificate resource with DNS validation, which is
 
 ```hcl
 module "acm" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/acm?ref=v6.7.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/acm?ref=v6.7.2"
 
   domain_name = "your-domain-name"
   zone_id     = "your-zone-id"

infrastructure/aws/aws_load_balancer_controller/README.md

@@ -18,7 +18,7 @@ This module creates a helm_release resource to deploy the AWS Load Balancer Cont
 
 ```hcl
 module "aws_load_balancer_controller" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/aws_load_balancer_controller?ref=v6.7.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/aws_load_balancer_controller?ref=v6.7.2"
 
   cluster_name = "your-cluster-name"
   vpc_id       = "your-vpc-id"

infrastructure/aws/backend/README.md

@@ -20,7 +20,7 @@ This module creates an S3 bucket with versioning and server-side encryption enab
 
 ```hcl
 module "backend" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/backend?ref=v6.7.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/backend?ref=v6.7.2"
 }
 ```
 

infrastructure/aws/dns/README.md

@@ -21,7 +21,7 @@ The module conditionally creates an aws_route53_zone resource for a public hoste
 
 ```hcl
 module "dns" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/dns?ref=v6.7.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/dns?ref=v6.7.2"
 
   domain_name = "your-domain-name"
   vpc_id      = "your-vpc-id"

infrastructure/aws/eks/README.md

@@ -22,7 +22,7 @@ The module wraps terraform-aws-modules/eks to create the EKS cluster (aws_eks_cl
 
 ```hcl
 module "eks" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/eks?ref=v6.7.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/eks?ref=v6.7.2"
 
   aws_subnets_private_ids = "your-aws-subnets-private-ids"
   aws_vpc_vpc_id          = "your-aws-vpc-vpc-id"

infrastructure/aws/iam/agent/README.md

@@ -21,7 +21,7 @@ The module uses the terraform-aws-modules/iam//modules/iam-role-for-service-acco
 
 ```hcl
 module "agent" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/agent?ref=v6.7.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/agent?ref=v6.7.2"
 
   agent_namespace                     = "your-agent-namespace"
   aws_iam_openid_connect_provider_arn = "your-aws-iam-openid-connect-provider-arn"

infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md

@@ -19,7 +19,7 @@ This module creates an IAM role for the AWS Load Balancer Controller using the t
 
 ```hcl
 module "aws_load_balancer_controller_iam" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/aws_load_balancer_controller_iam?ref=v6.7.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/aws_load_balancer_controller_iam?ref=v6.7.2"
 
   aws_iam_openid_connect_provider_arn = "your-aws-iam-openid-connect-provider-arn"
   cluster_name                        = "your-cluster-name"

infrastructure/aws/iam/cert_manager/README.md

@@ -20,7 +20,7 @@ An aws_iam_policy resource is always created granting route53:GetChange, route53
 
 ```hcl
 module "cert_manager" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cert_manager?ref=v6.7.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cert_manager?ref=v6.7.2"
 
   cluster_name = "your-cluster-name"
 }

infrastructure/aws/iam/ci-build-workflow-user/README.md

@@ -21,7 +21,7 @@ The module creates an aws_iam_user named with the cluster_name prefix and genera
 
 ```hcl
 module "ci-build-workflow-user" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ci-build-workflow-user?ref=v6.7.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ci-build-workflow-user?ref=v6.7.2"
 
   cluster_name = "your-cluster-name"
 }

infrastructure/aws/iam/cloudwatch/README.md

@@ -20,7 +20,7 @@ The module creates an aws_iam_policy granting CloudWatch Logs and Metrics write
 
 ```hcl
 module "cloudwatch" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cloudwatch?ref=v6.7.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cloudwatch?ref=v6.7.2"
 
   cluster_name = "your-cluster-name"
 }

infrastructure/aws/iam/ecr/README.md

@@ -20,7 +20,7 @@ The module creates an aws_iam_role named nullplatform-{cluster_name}-application
 
 ```hcl
 module "ecr" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ecr?ref=v6.7.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ecr?ref=v6.7.2"
 
   build_workflow_group_name = "your-build-workflow-group-name"
   cluster_name              = "your-cluster-name"

infrastructure/aws/iam/external_dns/README.md

@@ -20,7 +20,7 @@ An aws_iam_policy resource named nullplatform_external_dns_policy is always crea
 
 ```hcl
 module "external_dns" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/external_dns?ref=v6.7.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/external_dns?ref=v6.7.2"
 
   cluster_name = "your-cluster-name"
 }

infrastructure/aws/iam/s3/README.md

@@ -18,7 +18,7 @@ The module creates an aws_iam_policy resource that allows s3:PutObject and s3:Ge
 
 ```hcl
 module "s3" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/s3?ref=v6.7.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/s3?ref=v6.7.2"
 
   bucket                    = "your-bucket"
   build_workflow_group_name = "your-build-workflow-group-name"

infrastructure/aws/ingress/README.md

@@ -22,7 +22,7 @@ The module creates up to two kubernetes_ingress_v1 resources — one for an inte
 
 ```hcl
 module "ingress" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/ingress?ref=v6.7.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/ingress?ref=v6.7.2"
 
   certificate_arn = "your-certificate-arn"
 }

infrastructure/aws/security/README.md

@@ -2,27 +2,27 @@
 
 ## Description
 
-Creates AWS security groups and ingress/egress rules for Istio public and private gateways on an EKS cluster, with VPC and CIDR auto-derived from the cluster name
+Creates AWS security groups for Istio public and private gateways on EKS, with VPC-restricted health check rules and optional cluster security group ingress rules for ALB integration
 
 ## Architecture
 
-The module uses data sources (aws_eks_cluster, aws_vpc) to derive VPC ID and CIDR block from the provided cluster name, with optional overrides via input variables. It creates aws_security_group resources for public and private Istio gateways, each wired with aws_vpc_security_group_ingress_rule and aws_vpc_security_group_egress_rule resources controlling HTTPS (443) and health check (15021) traffic. When a cluster security group is resolved (either derived or overridden), additional aws_vpc_security_group_ingress_rule resources are attached to the cluster SG to allow traffic from the gateway security groups on the gateway port and health check port. Outputs expose the public and private gateway security group IDs for use by load balancer or other downstream resources.
+The module uses data sources (aws_eks_cluster, aws_vpc) to automatically derive VPC ID and CIDR from the cluster name, then creates aws_security_group resources for public and/or private Istio gateways. Each security group is wired with aws_vpc_security_group_ingress_rule and aws_vpc_security_group_egress_rule resources controlling ports 443 and 15021 based on gateway type and health check settings. When a cluster security group is present (derived or overridden), additional aws_vpc_security_group_ingress_rule resources are attached to the cluster SG to allow ALB-to-gateway traffic on the gateway port and health check port.
 
 ## Features
 
-- Creates aws_security_group for public Istio gateway with HTTPS open to internet and health check restricted to VPC CIDR
-- Creates aws_security_group for private Istio gateway with all traffic restricted to VPC CIDR only
-- Auto-derives VPC ID and CIDR block from EKS cluster name via aws_eks_cluster and aws_vpc data sources
-- Adds ingress rules on the EKS cluster primary security group to allow ALB-to-pod traffic from gateway security groups
-- Supports additional CIDR blocks for health check and HTTPS ingress rules via additional_network_cidrs variable
-- Allows toggling health check port 15021 ingress rules independently to support ALB versus NLB load balancer patterns
-- Supports override inputs for vpc_id, network_cidr, and cluster_security_group_id when auto-derivation is not desired
+- Creates aws_security_group for public Istio gateway allowing internet HTTPS (0.0.0.0/0) on port 443 with VPC-restricted health checks
+- Creates aws_security_group for private Istio gateway restricting all traffic (HTTPS and health checks) to VPC CIDR only
+- Derives VPC ID and CIDR block automatically from EKS cluster name via aws_eks_cluster and aws_vpc data sources
+- Attaches ingress rules to the EKS cluster primary security group to allow ALB-to-gateway traffic on gateway and health check ports
+- Supports additional CIDR blocks for peered VPCs or on-premises networks via aws_vpc_security_group_ingress_rule for_each rules
+- Allows toggling port 15021 health check ingress rules independently for ALB versus NLB load balancer patterns
+- Outputs public and private gateway security group IDs for use by downstream ALB or NLB Terraform resources
 
 ## Basic Usage
 
 ```hcl
 module "security" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/security?ref=v6.7.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/security?ref=v6.7.2"
 
   cluster_name = "your-cluster-name"
 }
@@ -57,7 +57,9 @@ resource "example_resource" "this" {
 | [aws_security_group.private_gateway](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
 | [aws_security_group.public_gateway](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
 | [aws_vpc_security_group_egress_rule.private_gateway_all](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_security_group_egress_rule) | resource |
+| [aws_vpc_security_group_egress_rule.private_gateway_all_additional](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_security_group_egress_rule) | resource |
 | [aws_vpc_security_group_egress_rule.public_gateway_all](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_security_group_egress_rule) | resource |
+| [aws_vpc_security_group_egress_rule.public_gateway_all_additional](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_security_group_egress_rule) | resource |
 | [aws_vpc_security_group_ingress_rule.cluster_from_private_gateway_health](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_security_group_ingress_rule) | resource |
 | [aws_vpc_security_group_ingress_rule.cluster_from_private_gateway_traffic](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_security_group_ingress_rule) | resource |
 | [aws_vpc_security_group_ingress_rule.cluster_from_public_gateway_health](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_security_group_ingress_rule) | resource |
@@ -95,16 +97,16 @@ resource "example_resource" "this" {
 <!-- BEGIN_AI_METADATA
 {
   "name": "security",
-  "description": "Creates AWS security groups and ingress/egress rules for Istio public and private gateways on an EKS cluster, with VPC and CIDR auto-derived from the cluster name",
-  "architecture": "The module uses data sources (aws_eks_cluster, aws_vpc) to derive VPC ID and CIDR block from the provided cluster name, with optional overrides via input variables. It creates aws_security_group resources for public and private Istio gateways, each wired with aws_vpc_security_group_ingress_rule and aws_vpc_security_group_egress_rule resources controlling HTTPS (443) and health check (15021) traffic. When a cluster security group is resolved (either derived or overridden), additional aws_vpc_security_group_ingress_rule resources are attached to the cluster SG to allow traffic from the gateway security groups on the gateway port and health check port. Outputs expose the public and private gateway security group IDs for use by load balancer or other downstream resources.",
+  "description": "Creates AWS security groups for Istio public and private gateways on EKS, with VPC-restricted health check rules and optional cluster security group ingress rules for ALB integration",
+  "architecture": "The module uses data sources (aws_eks_cluster, aws_vpc) to automatically derive VPC ID and CIDR from the cluster name, then creates aws_security_group resources for public and/or private Istio gateways. Each security group is wired with aws_vpc_security_group_ingress_rule and aws_vpc_security_group_egress_rule resources controlling ports 443 and 15021 based on gateway type and health check settings. When a cluster security group is present (derived or overridden), additional aws_vpc_security_group_ingress_rule resources are attached to the cluster SG to allow ALB-to-gateway traffic on the gateway port and health check port.",
   "features": [
-    "Creates aws_security_group for public Istio gateway with HTTPS open to internet and health check restricted to VPC CIDR",
-    "Creates aws_security_group for private Istio gateway with all traffic restricted to VPC CIDR only",
-    "Auto-derives VPC ID and CIDR block from EKS cluster name via aws_eks_cluster and aws_vpc data sources",
-    "Adds ingress rules on the EKS cluster primary security group to allow ALB-to-pod traffic from gateway security groups",
-    "Supports additional CIDR blocks for health check and HTTPS ingress rules via additional_network_cidrs variable",
-    "Allows toggling health check port 15021 ingress rules independently to support ALB versus NLB load balancer patterns",
-    "Supports override inputs for vpc_id, network_cidr, and cluster_security_group_id when auto-derivation is not desired"
+    "Creates aws_security_group for public Istio gateway allowing internet HTTPS (0.0.0.0/0) on port 443 with VPC-restricted health checks",
+    "Creates aws_security_group for private Istio gateway restricting all traffic (HTTPS and health checks) to VPC CIDR only",
+    "Derives VPC ID and CIDR block automatically from EKS cluster name via aws_eks_cluster and aws_vpc data sources",
+    "Attaches ingress rules to the EKS cluster primary security group to allow ALB-to-gateway traffic on gateway and health check ports",
+    "Supports additional CIDR blocks for peered VPCs or on-premises networks via aws_vpc_security_group_ingress_rule for_each rules",
+    "Allows toggling port 15021 health check ingress rules independently for ALB versus NLB load balancer patterns",
+    "Outputs public and private gateway security group IDs for use by downstream ALB or NLB Terraform resources"
   ],
   "inputs": [
     {
@@ -157,6 +159,6 @@ resource "example_resource" "this" {
     "public_gateway_security_group_id",
     "private_gateway_security_group_id"
   ],
-  "hash": "00a161a9b69cff9aaa1fb6a1952fd4ad"
+  "hash": "3933e003744e0a5e0a4c1f80d7471027"
 }
 END_AI_METADATA -->

infrastructure/aws/vpc/README.md

@@ -22,7 +22,7 @@ This module creates a terraform-aws-modules/vpc/aws module resource with DNS hos
 
 ```hcl
 module "vpc" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/vpc?ref=v6.7.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/vpc?ref=v6.7.2"
 
   account      = "your-account"
   organization = "your-organization"

infrastructure/azure/acr/README.md

@@ -18,7 +18,7 @@ The module uses the azurerm_container_registry resource to create the container
 
 ```hcl
 module "acr" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/acr?ref=v6.7.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/acr?ref=v6.7.2"
 
   containerregistry_name = "your-containerregistry-name"
   location               = "your-location"

infrastructure/azure/aks/README.md

@@ -22,7 +22,7 @@ The module wraps the Azure/aks/azurerm community module (version 11.0.0) which i
 
 ```hcl
 module "aks" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks?ref=v6.7.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks?ref=v6.7.2"
 
   cluster_name        = "your-cluster-name"
   location            = "your-location"

infrastructure/azure/aks_route_table/README.md

@@ -19,7 +19,7 @@ The module uses an azurerm_resources data source to discover the route table cre
 
 ```hcl
 module "aks_route_table" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks_route_table?ref=v6.7.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks_route_table?ref=v6.7.2"
 
   node_resource_group = "your-node-resource-group"
   subnet_id           = "your-subnet-id"

infrastructure/azure/dns/README.md

@@ -18,7 +18,7 @@ This module creates an azurerm_dns_zone resource and configures it with the prov
 
 ```hcl
 module "dns" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/dns?ref=v6.7.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/dns?ref=v6.7.2"
 
   domain_name         = "your-domain-name"
   resource_group_name = "your-resource-group-name"

infrastructure/azure/iam/README.md

@@ -21,7 +21,7 @@ The module creates an azurerm_user_assigned_identity resource in the specified r
 
 ```hcl
 module "iam" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/iam?ref=v6.7.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/iam?ref=v6.7.2"
 
   location             = "your-location"
   name                 = "your-name"

infrastructure/azure/private_dns/README.md

@@ -18,7 +18,7 @@ This module creates an azurerm_private_dns_zone resource and optionally multiple
 
 ```hcl
 module "private_dns" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/private_dns?ref=v6.7.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/private_dns?ref=v6.7.2"
 
   domain_name           = "your-domain-name"
   resource_group_name   = "your-resource-group-name"

infrastructure/azure/resource_group/README.md

@@ -18,7 +18,7 @@ This module creates an azurerm_resource_group resource and outputs its name and
 
 ```hcl
 module "resource_group" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/resource_group?ref=v6.7.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/resource_group?ref=v6.7.2"
 
   location            = "your-location"
   resource_group_name = "your-resource-group-name"

infrastructure/azure/security/README.md

@@ -21,7 +21,7 @@ The module uses azurerm_kubernetes_cluster and azurerm_virtual_network data sour
 
 ```hcl
 module "security" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/security?ref=v6.7.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/security?ref=v6.7.2"
 
   cluster_name        = "your-cluster-name"
   resource_group_name = "your-resource-group-name"