diff --git a/CHANGELOG.md b/CHANGELOG.md
index ebb128da..9ca9f60e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,12 @@
# Changelog
+## [6.20.0](https://github.com/nullplatform/tofu-modules/compare/v6.19.1...v6.20.0) (2026-08-28)
+
+
+### Features
+
+* require an explicit version for everything the modules deploy ([#540](https://github.com/nullplatform/tofu-modules/issues/540)) ([868ad98](https://github.com/nullplatform/tofu-modules/commit/868ad989663aa15e4dbdea98fa940e668e4994c2))
+
## [6.19.1](https://github.com/nullplatform/tofu-modules/compare/v6.19.0...v6.19.1) (2026-08-21)
diff --git a/infrastructure/aws/acm/README.md b/infrastructure/aws/acm/README.md
index 1c68008b..b046db27 100644
--- a/infrastructure/aws/acm/README.md
+++ b/infrastructure/aws/acm/README.md
@@ -18,7 +18,7 @@ The module creates an aws_acm_certificate resource with DNS validation, which is
```hcl
module "acm" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/acm?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/acm?ref=v6.20.0"
domain_name = "your-domain-name"
zone_id = "your-zone-id"
diff --git a/infrastructure/aws/aws_load_balancer_controller/README.md b/infrastructure/aws/aws_load_balancer_controller/README.md
index ec2533e0..0f475e25 100644
--- a/infrastructure/aws/aws_load_balancer_controller/README.md
+++ b/infrastructure/aws/aws_load_balancer_controller/README.md
@@ -18,7 +18,7 @@ This module creates a helm_release resource to deploy the AWS Load Balancer Cont
```hcl
module "aws_load_balancer_controller" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/aws_load_balancer_controller?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/aws_load_balancer_controller?ref=v6.20.0"
cluster_name = "your-cluster-name"
vpc_id = "your-vpc-id"
diff --git a/infrastructure/aws/backend/README.md b/infrastructure/aws/backend/README.md
index 44323c49..85c4d03c 100644
--- a/infrastructure/aws/backend/README.md
+++ b/infrastructure/aws/backend/README.md
@@ -20,7 +20,7 @@ This module creates an S3 bucket with versioning and server-side encryption enab
```hcl
module "backend" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/backend?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/backend?ref=v6.20.0"
}
```
diff --git a/infrastructure/aws/dns/README.md b/infrastructure/aws/dns/README.md
index 3a1df499..da46c3d6 100644
--- a/infrastructure/aws/dns/README.md
+++ b/infrastructure/aws/dns/README.md
@@ -21,7 +21,7 @@ The module conditionally creates an aws_route53_zone resource for a public hoste
```hcl
module "dns" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/dns?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/dns?ref=v6.20.0"
domain_name = "your-domain-name"
vpc_id = "your-vpc-id"
diff --git a/infrastructure/aws/eks/README.md b/infrastructure/aws/eks/README.md
index 3341dc81..f8d11086 100644
--- a/infrastructure/aws/eks/README.md
+++ b/infrastructure/aws/eks/README.md
@@ -22,7 +22,7 @@ The module wraps terraform-aws-modules/eks to create the EKS cluster (aws_eks_cl
```hcl
module "eks" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/eks?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/eks?ref=v6.20.0"
aws_subnets_private_ids = "your-aws-subnets-private-ids"
aws_vpc_vpc_id = "your-aws-vpc-vpc-id"
diff --git a/infrastructure/aws/iam/agent/README.md b/infrastructure/aws/iam/agent/README.md
index 578bbece..a70bd194 100644
--- a/infrastructure/aws/iam/agent/README.md
+++ b/infrastructure/aws/iam/agent/README.md
@@ -21,7 +21,7 @@ The module uses the terraform-aws-modules/iam//modules/iam-role-for-service-acco
```hcl
module "agent" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/agent?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/agent?ref=v6.20.0"
agent_namespace = "your-agent-namespace"
aws_iam_openid_connect_provider_arn = "your-aws-iam-openid-connect-provider-arn"
diff --git a/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md b/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md
index 2e7448d2..ef051cb6 100644
--- a/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md
+++ b/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md
@@ -19,7 +19,7 @@ This module creates an IAM role for the AWS Load Balancer Controller using the t
```hcl
module "aws_load_balancer_controller_iam" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/aws_load_balancer_controller_iam?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/aws_load_balancer_controller_iam?ref=v6.20.0"
aws_iam_openid_connect_provider_arn = "your-aws-iam-openid-connect-provider-arn"
cluster_name = "your-cluster-name"
diff --git a/infrastructure/aws/iam/cert_manager/README.md b/infrastructure/aws/iam/cert_manager/README.md
index d9fe4ef2..556e3b1b 100644
--- a/infrastructure/aws/iam/cert_manager/README.md
+++ b/infrastructure/aws/iam/cert_manager/README.md
@@ -20,7 +20,7 @@ An aws_iam_policy resource is always created granting route53:GetChange, route53
```hcl
module "cert_manager" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cert_manager?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cert_manager?ref=v6.20.0"
cluster_name = "your-cluster-name"
}
diff --git a/infrastructure/aws/iam/ci-build-workflow-user/README.md b/infrastructure/aws/iam/ci-build-workflow-user/README.md
index 2f9c08cc..ba258c56 100644
--- a/infrastructure/aws/iam/ci-build-workflow-user/README.md
+++ b/infrastructure/aws/iam/ci-build-workflow-user/README.md
@@ -21,7 +21,7 @@ The module creates an aws_iam_user named with the cluster_name prefix and genera
```hcl
module "ci-build-workflow-user" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ci-build-workflow-user?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ci-build-workflow-user?ref=v6.20.0"
cluster_name = "your-cluster-name"
}
diff --git a/infrastructure/aws/iam/cloudwatch/README.md b/infrastructure/aws/iam/cloudwatch/README.md
index cbdea312..e89f473b 100644
--- a/infrastructure/aws/iam/cloudwatch/README.md
+++ b/infrastructure/aws/iam/cloudwatch/README.md
@@ -20,7 +20,7 @@ The module creates an aws_iam_policy granting CloudWatch Logs and Metrics write
```hcl
module "cloudwatch" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cloudwatch?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cloudwatch?ref=v6.20.0"
cluster_name = "your-cluster-name"
}
diff --git a/infrastructure/aws/iam/ecr/README.md b/infrastructure/aws/iam/ecr/README.md
index f5145d65..beb601fe 100644
--- a/infrastructure/aws/iam/ecr/README.md
+++ b/infrastructure/aws/iam/ecr/README.md
@@ -20,7 +20,7 @@ The module creates an aws_iam_role named nullplatform-{cluster_name}-application
```hcl
module "ecr" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ecr?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ecr?ref=v6.20.0"
build_workflow_group_name = "your-build-workflow-group-name"
cluster_name = "your-cluster-name"
diff --git a/infrastructure/aws/iam/external_dns/README.md b/infrastructure/aws/iam/external_dns/README.md
index 30755805..e3ae4310 100644
--- a/infrastructure/aws/iam/external_dns/README.md
+++ b/infrastructure/aws/iam/external_dns/README.md
@@ -20,7 +20,7 @@ An aws_iam_policy resource named nullplatform_external_dns_policy is always crea
```hcl
module "external_dns" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/external_dns?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/external_dns?ref=v6.20.0"
cluster_name = "your-cluster-name"
}
diff --git a/infrastructure/aws/iam/s3/README.md b/infrastructure/aws/iam/s3/README.md
index cab44f6c..20c13e88 100644
--- a/infrastructure/aws/iam/s3/README.md
+++ b/infrastructure/aws/iam/s3/README.md
@@ -18,7 +18,7 @@ The module creates an aws_iam_policy resource that allows s3:PutObject and s3:Ge
```hcl
module "s3" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/s3?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/s3?ref=v6.20.0"
bucket = "your-bucket"
build_workflow_group_name = "your-build-workflow-group-name"
diff --git a/infrastructure/aws/ingress/README.md b/infrastructure/aws/ingress/README.md
index b4b30cec..a64b8adf 100644
--- a/infrastructure/aws/ingress/README.md
+++ b/infrastructure/aws/ingress/README.md
@@ -22,7 +22,7 @@ The module creates up to two kubernetes_ingress_v1 resources — one for an inte
```hcl
module "ingress" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/ingress?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/ingress?ref=v6.20.0"
certificate_arn = "your-certificate-arn"
}
diff --git a/infrastructure/aws/security/README.md b/infrastructure/aws/security/README.md
index ff0cabd2..01a42ee0 100644
--- a/infrastructure/aws/security/README.md
+++ b/infrastructure/aws/security/README.md
@@ -22,7 +22,7 @@ The module uses data sources (aws_eks_cluster, aws_vpc) to automatically derive
```hcl
module "security" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/security?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/security?ref=v6.20.0"
cluster_name = "your-cluster-name"
}
diff --git a/infrastructure/aws/vpc/README.md b/infrastructure/aws/vpc/README.md
index ed0c1d12..d9ae720e 100644
--- a/infrastructure/aws/vpc/README.md
+++ b/infrastructure/aws/vpc/README.md
@@ -22,7 +22,7 @@ This module creates a terraform-aws-modules/vpc/aws module resource with DNS hos
```hcl
module "vpc" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/vpc?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/vpc?ref=v6.20.0"
account = "your-account"
organization = "your-organization"
diff --git a/infrastructure/azure/acr/README.md b/infrastructure/azure/acr/README.md
index b1498531..0acf4d77 100644
--- a/infrastructure/azure/acr/README.md
+++ b/infrastructure/azure/acr/README.md
@@ -18,7 +18,7 @@ The module uses the azurerm_container_registry resource to create the container
```hcl
module "acr" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/acr?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/acr?ref=v6.20.0"
containerregistry_name = "your-containerregistry-name"
location = "your-location"
diff --git a/infrastructure/azure/aks/README.md b/infrastructure/azure/aks/README.md
index 4a13dce3..da3ffb3a 100644
--- a/infrastructure/azure/aks/README.md
+++ b/infrastructure/azure/aks/README.md
@@ -22,7 +22,7 @@ The module wraps the Azure/aks/azurerm community module (version 11.0.0) and use
```hcl
module "aks" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks?ref=v6.20.0"
cluster_name = "your-cluster-name"
location = "your-location"
diff --git a/infrastructure/azure/aks_route_table/README.md b/infrastructure/azure/aks_route_table/README.md
index 0d55e409..a1dfd623 100644
--- a/infrastructure/azure/aks_route_table/README.md
+++ b/infrastructure/azure/aks_route_table/README.md
@@ -19,7 +19,7 @@ The module uses an azurerm_resources data source to discover the AKS-managed rou
```hcl
module "aks_route_table" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks_route_table?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks_route_table?ref=v6.20.0"
node_resource_group = "your-node-resource-group"
subnet_id = "your-subnet-id"
diff --git a/infrastructure/azure/dns/README.md b/infrastructure/azure/dns/README.md
index 2f13a06a..3d6c11f6 100644
--- a/infrastructure/azure/dns/README.md
+++ b/infrastructure/azure/dns/README.md
@@ -18,7 +18,7 @@ This module creates an azurerm_dns_zone resource and configures it with the prov
```hcl
module "dns" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/dns?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/dns?ref=v6.20.0"
domain_name = "your-domain-name"
resource_group_name = "your-resource-group-name"
diff --git a/infrastructure/azure/iam/README.md b/infrastructure/azure/iam/README.md
index 2189b04c..942e5c31 100644
--- a/infrastructure/azure/iam/README.md
+++ b/infrastructure/azure/iam/README.md
@@ -21,7 +21,7 @@ The module creates an azurerm_user_assigned_identity resource in the specified r
```hcl
module "iam" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/iam?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/iam?ref=v6.20.0"
location = "your-location"
name = "your-name"
diff --git a/infrastructure/azure/private_dns/README.md b/infrastructure/azure/private_dns/README.md
index 6e0c787b..f71b1d98 100644
--- a/infrastructure/azure/private_dns/README.md
+++ b/infrastructure/azure/private_dns/README.md
@@ -18,7 +18,7 @@ This module creates an azurerm_private_dns_zone resource and optionally multiple
```hcl
module "private_dns" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/private_dns?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/private_dns?ref=v6.20.0"
domain_name = "your-domain-name"
resource_group_name = "your-resource-group-name"
diff --git a/infrastructure/azure/resource_group/README.md b/infrastructure/azure/resource_group/README.md
index 776db4ac..f15ae092 100644
--- a/infrastructure/azure/resource_group/README.md
+++ b/infrastructure/azure/resource_group/README.md
@@ -18,7 +18,7 @@ This module creates an azurerm_resource_group resource and outputs its name and
```hcl
module "resource_group" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/resource_group?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/resource_group?ref=v6.20.0"
location = "your-location"
resource_group_name = "your-resource-group-name"
diff --git a/infrastructure/azure/security/README.md b/infrastructure/azure/security/README.md
index cef18c22..87b2ffa5 100644
--- a/infrastructure/azure/security/README.md
+++ b/infrastructure/azure/security/README.md
@@ -21,7 +21,7 @@ The module uses azurerm_kubernetes_cluster and azurerm_virtual_network data sour
```hcl
module "security" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/security?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/security?ref=v6.20.0"
cluster_name = "your-cluster-name"
resource_group_name = "your-resource-group-name"
diff --git a/infrastructure/azure/vnet/README.md b/infrastructure/azure/vnet/README.md
index 829e1c2e..63fd4880 100644
--- a/infrastructure/azure/vnet/README.md
+++ b/infrastructure/azure/vnet/README.md
@@ -18,7 +18,7 @@ This module creates an Azure virtual network using the azurerm provider and conf
```hcl
module "vnet" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/vnet?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/vnet?ref=v6.20.0"
address_space = "your-address-space"
location = "your-location"
diff --git a/infrastructure/commons/cert_manager/README.md b/infrastructure/commons/cert_manager/README.md
index 9334229f..fe813212 100644
--- a/infrastructure/commons/cert_manager/README.md
+++ b/infrastructure/commons/cert_manager/README.md
@@ -2,55 +2,57 @@
## Description
-Deploys cert-manager and its configuration Helm charts on Kubernetes with multi-cloud DNS01 solver support for GCP, Azure, AWS, Cloudflare, and OCI
+Deploys cert-manager and its configuration via Helm onto a Kubernetes cluster with DNS01 challenge solvers for GCP, Azure, AWS, Cloudflare, or OCI cloud providers
## Architecture
-Two primary helm_release resources are created: cert-manager from the Jetstack chart repository and nullplatform-cert-manager-config from the nullplatform chart repository, with the config chart depending on the base cert-manager release. A third conditional helm_release for cert-manager-webhook-oci is created only when cloud_provider is 'oci'. The cert_manager_values local constructs the Helm values dynamically, merging base service account annotations with provider-specific annotations (GCP Workload Identity, AWS IRSA role ARN, Azure Workload Identity client ID, or OCI workload identity principal) based on cloud_provider and aws_identity_mode. Template files cert_manager_default_values and cert_manager_provider_values are rendered via templatefile() using common_context and provider_context locals and passed as values to the config chart.
+The module creates two core helm_release resources: cert-manager from charts.jetstack.io and nullplatform-cert-manager-config from nullplatform's Helm registry, with the config chart depending on the cert-manager chart via depends_on. A third conditional helm_release for cert-manager-webhook-oci is created only when cloud_provider is 'oci'. Service account annotations are assembled in locals by merging base annotations with provider-specific identity annotations (GKE Workload Identity email, IRSA role ARN, Azure Workload Identity client ID, or OCI workload identity OCID) and passed to the cert-manager helm_release via yamlencode. Provider-specific Helm values are rendered from templatefiles and passed to the config helm_release.
## Features
- Deploys cert-manager Helm chart with CRDs enabled and DNS01 recursive nameserver configuration
-- Deploys nullplatform-cert-manager-config Helm chart with provider-specific DNS01 solver templates rendered via templatefile()
-- Configures cert-manager Kubernetes service account annotations for GCP Workload Identity, AWS IRSA, Azure Workload Identity, and OCI workload identity
-- Deploys cert-manager-webhook-oci Helm chart conditionally when cloud_provider is set to oci
-- Supports AWS Pod Identity mode that omits IRSA role annotation for EKS Pod Identity agent-based credential injection
-- Supports Azure Service Principal authentication when workload identity is disabled via azure_workload_identity_enabled
-- Merges provider-specific pod labels for Azure Workload Identity use annotation on cert-manager pods
+- Renders provider-specific cert-manager configuration from templatefiles for GCP, Azure, AWS, Cloudflare, and OCI
+- Configures Kubernetes service account annotations for cloud-native identity (GKE Workload Identity, IRSA, Azure Workload Identity, OCI workload identity principal)
+- Deploys OCI webhook helm_release conditionally when cloud_provider is set to oci
+- Supports Azure Workload Identity or Service Principal authentication modes with conditional annotation and pod label injection
+- Supports AWS IRSA and Pod Identity identity modes for cert-manager service account credential delivery
+- Pins all Helm chart versions explicitly to prevent drift from floating version references
## Basic Usage
```hcl
module "cert_manager" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.20.0"
- account_slug = "your-account-slug"
- cloud_provider = "your-cloud-provider"
- hosted_zone_name = "your-hosted-zone-name"
- private_domain_name = "your-private-domain-name"
+ account_slug = "your-account-slug"
+ cert_manager_version = "your-cert-manager-version"
+ cloud_provider = "your-cloud-provider"
+ hosted_zone_name = "your-hosted-zone-name"
+ private_domain_name = "your-private-domain-name"
}
```
-### Usage with GCP Provider
+### Usage with GCP Cloud Provider
```hcl
module "cert_manager" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.19.1"
-
- account_slug = "your-account-slug"
- cloud_provider = "gcp"
- gcp_sa_email = "your-gcp-sa-email" # Required when cloud_provider = "gcp"
- hosted_zone_name = "your-hosted-zone-name"
- private_domain_name = "your-private-domain-name"
- project_id = "your-project-id" # Required when cloud_provider = "gcp"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.20.0"
+
+ account_slug = "your-account-slug"
+ cert_manager_version = "your-cert-manager-version"
+ cloud_provider = "gcp"
+ gcp_sa_email = "your-gcp-sa-email" # Required when cloud_provider = "gcp"
+ hosted_zone_name = "your-hosted-zone-name"
+ private_domain_name = "your-private-domain-name"
+ project_id = "your-project-id" # Required when cloud_provider = "gcp"
}
```
-### Usage with Azure Provider
+### Usage with Azure Cloud Provider
```hcl
module "cert_manager" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.20.0"
account_slug = "your-account-slug"
azure_client_id = "your-azure-client-id" # Required when cloud_provider = "azure"
@@ -58,19 +60,21 @@ module "cert_manager" {
azure_resource_group_name = "your-azure-resource-group-name" # Required when cloud_provider = "azure"
azure_subscription_id = "your-azure-subscription-id" # Required when cloud_provider = "azure"
azure_tenant_id = "your-azure-tenant-id" # Required when cloud_provider = "azure"
+ cert_manager_version = "your-cert-manager-version"
cloud_provider = "azure"
hosted_zone_name = "your-hosted-zone-name"
private_domain_name = "your-private-domain-name"
}
```
-### Usage with Cloudflare Provider
+### Usage with Cloudflare Cloud Provider
```hcl
module "cert_manager" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.20.0"
account_slug = "your-account-slug"
+ cert_manager_version = "your-cert-manager-version"
cloud_provider = "cloudflare"
cloudflare_secret_name = "your-cloudflare-secret-name" # Required when cloud_provider = "cloudflare"
cloudflare_token = "your-cloudflare-token" # Required when cloud_provider = "cloudflare"
@@ -79,29 +83,31 @@ module "cert_manager" {
}
```
-### Usage with AWS Provider
+### Usage with AWS Cloud Provider
```hcl
module "cert_manager" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.19.1"
-
- account_slug = "your-account-slug"
- aws_identity_mode = "your-aws-identity-mode" # Required when cloud_provider = "aws"
- aws_region = "your-aws-region" # Required when cloud_provider = "aws"
- aws_sa_arn = "your-aws-sa-arn" # Required when cloud_provider = "aws"
- cloud_provider = "aws"
- hosted_zone_name = "your-hosted-zone-name"
- private_domain_name = "your-private-domain-name"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.20.0"
+
+ account_slug = "your-account-slug"
+ aws_identity_mode = "your-aws-identity-mode" # Required when cloud_provider = "aws"
+ aws_region = "your-aws-region" # Required when cloud_provider = "aws"
+ aws_sa_arn = "your-aws-sa-arn" # Required when cloud_provider = "aws"
+ cert_manager_version = "your-cert-manager-version"
+ cloud_provider = "aws"
+ hosted_zone_name = "your-hosted-zone-name"
+ private_domain_name = "your-private-domain-name"
}
```
-### Usage with OCI Provider
+### Usage with OCI Cloud Provider
```hcl
module "cert_manager" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.20.0"
account_slug = "your-account-slug"
+ cert_manager_version = "your-cert-manager-version"
cert_manager_webhook_oci_namespace = "your-cert-manager-webhook-oci-namespace" # Required when cloud_provider = "oci"
cert_manager_webhook_oci_version = "your-cert-manager-webhook-oci-version" # Required when cloud_provider = "oci"
cloud_provider = "oci"
@@ -113,6 +119,20 @@ module "cert_manager" {
}
```
+### Usage with Cert-Manager Version (fixed semver)
+
+```hcl
+module "cert_manager" {
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.20.0"
+
+ account_slug = "your-account-slug"
+ cert_manager_version = "v1.21.1"
+ cloud_provider = "your-cloud-provider"
+ hosted_zone_name = "your-hosted-zone-name"
+ private_domain_name = "your-private-domain-name"
+}
+```
+
## Using Outputs
```hcl
@@ -163,7 +183,7 @@ resource "example_resource" "this" {
| [azure\_workload\_identity\_enabled](#input\_azure\_workload\_identity\_enabled) | Enable Workload Identity for Azure DNS solver. When false, Service Principal auth is used and azure\_client\_secret is required. | `bool` | `true` | no |
| [cert\_manager\_config\_version](#input\_cert\_manager\_config\_version) | The version of the cert-manager configuration Helm chart | `string` | `"2.35.0"` | no |
| [cert\_manager\_namespace](#input\_cert\_manager\_namespace) | The Kubernetes namespace where cert-manager will be deployed | `string` | `"cert-manager"` | no |
-| [cert\_manager\_version](#input\_cert\_manager\_version) | The version of cert-manager Helm chart to deploy | `string` | `"1.18.2"` | no |
+| [cert\_manager\_version](#input\_cert\_manager\_version) | No default: every install pins this deliberately — see VERSIONS.md. The version of cert-manager Helm chart to deploy. Was declared but never wired to the helm\_release, so installs tracked whatever the chart repository served; the default is the version that resolved to as of 2026-08-27, which keeps behaviour unchanged while removing the drift. | `string` | n/a | yes |
| [cert\_manager\_webhook\_oci\_namespace](#input\_cert\_manager\_webhook\_oci\_namespace) | Kubernetes namespace where the cert-manager OCI webhook is deployed | `string` | `"cert-manager"` | no |
| [cert\_manager\_webhook\_oci\_version](#input\_cert\_manager\_webhook\_oci\_version) | Helm chart version for the cert-manager OCI webhook | `string` | `"1.4.1"` | no |
| [cloud\_provider](#input\_cloud\_provider) | The cloud provider to use: gcp, azure, aws, cloudflare, or oci | `string` | n/a | yes |
@@ -181,16 +201,16 @@ resource "example_resource" "this" {
diff --git a/infrastructure/commons/external_dns/README.md b/infrastructure/commons/external_dns/README.md
index 9e63bd0e..4be4c203 100644
--- a/infrastructure/commons/external_dns/README.md
+++ b/infrastructure/commons/external_dns/README.md
@@ -22,7 +22,7 @@ The module creates an optional kubernetes_namespace_v1 resource and a helm_relea
```hcl
module "external_dns" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.20.0"
dns_provider_name = "your-dns-provider-name"
domain_filters = "your-domain-filters"
@@ -33,7 +33,7 @@ module "external_dns" {
```hcl
module "external_dns" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.20.0"
cloudflare_token = "your-cloudflare-token" # Required when dns_provider_name = "cloudflare"
dns_provider_name = "cloudflare"
@@ -45,7 +45,7 @@ module "external_dns" {
```hcl
module "external_dns" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.20.0"
aws_iam_role_arn = "your-aws-iam-role-arn" # Required when dns_provider_name = "aws"
aws_identity_mode = "your-aws-identity-mode" # Required when dns_provider_name = "aws"
@@ -61,7 +61,7 @@ module "external_dns" {
```hcl
module "external_dns" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.20.0"
dns_provider_name = "oci"
domain_filters = "your-domain-filters"
@@ -76,7 +76,7 @@ module "external_dns" {
```hcl
module "external_dns" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.20.0"
azure_client_id = "your-azure-client-id" # Required when dns_provider_name = "azure"
azure_resource_group = "your-azure-resource-group" # Required when dns_provider_name = "azure"
@@ -92,7 +92,7 @@ module "external_dns" {
```hcl
module "external_dns" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.20.0"
azure_client_id = "your-azure-client-id" # Required when dns_provider_name = "azure-private-dns"
azure_resource_group = "your-azure-resource-group" # Required when dns_provider_name = "azure-private-dns"
@@ -108,7 +108,7 @@ module "external_dns" {
```hcl
module "external_dns" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.20.0"
dns_provider_name = "google"
domain_filters = "your-domain-filters"
diff --git a/infrastructure/commons/istio/README.md b/infrastructure/commons/istio/README.md
index 6365be7d..fd3cd179 100644
--- a/infrastructure/commons/istio/README.md
+++ b/infrastructure/commons/istio/README.md
@@ -21,7 +21,7 @@ The module creates three helm_release resources in a strict dependency chain: is
```hcl
module "istio" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/istio?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/istio?ref=v6.20.0"
}
```
diff --git a/infrastructure/commons/prometheus/README.md b/infrastructure/commons/prometheus/README.md
index d3d53729..b187e134 100644
--- a/infrastructure/commons/prometheus/README.md
+++ b/infrastructure/commons/prometheus/README.md
@@ -2,23 +2,58 @@
## Description
-Deploys Prometheus using Helm chart in a specified Kubernetes namespace
+Deploys Prometheus monitoring stack into a Kubernetes cluster using the prometheus-community Helm chart with opinionated release settings
## Architecture
-This module creates a helm_release resource to deploy the Prometheus chart from the prometheus-community repository, and uses a templatefile to populate the prometheus_values template with the nullplatform_port variable, the resulting values are then passed to the helm_release resource, which creates the necessary Kubernetes resources, including deployments, services, and pods, in the specified namespace
+A single helm_release resource named 'prometheus' installs the prometheus-community/prometheus chart into the namespace defined by var.prometheus_namespace, with the chart version pinned via var.prometheus_version. A templatefile-rendered locals block produces the Helm values YAML by interpolating var.nullplatform_port into a template file, and that rendered string is passed as the sole values override to the helm_release. Release lifecycle flags such as atomic, cleanup_on_fail, and recreate_pods are hardcoded to enforce deterministic, self-healing deployments on every apply.
## Features
-- Deploys Prometheus chart with customizable nullplatform port
-- Configures Kubernetes namespace for Prometheus deployment
-- Creates necessary Kubernetes resources for Prometheus
+- Deploys prometheus-community/prometheus Helm chart with a pinned, explicit chart version to prevent drift
+- Renders Helm values from a template file with configurable nullplatform service port injection
+- Creates the target Kubernetes namespace automatically via create_namespace flag
+- Enforces atomic, self-healing releases with cleanup_on_fail and recreate_pods enabled
+- Caps Helm release history to 10 revisions to limit etcd storage growth
+- Configures a 600-second timeout with wait_for_jobs to ensure all Prometheus workloads reach ready state before completing
## Basic Usage
```hcl
module "prometheus" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.20.0"
+
+ prometheus_version = "your-prometheus-version"
+}
+```
+
+### Usage with Pinned Release Version
+
+```hcl
+module "prometheus" {
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.20.0"
+
+ prometheus_version = "latest"
+}
+```
+
+### Usage with Pinned Release Version
+
+```hcl
+module "prometheus" {
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.20.0"
+
+ prometheus_version = "main"
+}
+```
+
+### Usage with Pinned Release Version
+
+```hcl
+module "prometheus" {
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.20.0"
+
+ prometheus_version = "master"
}
```
@@ -42,7 +77,7 @@ resource "example_resource" "this" {
| Name | Version |
|------|---------|
-| [helm](#provider\_helm) | ~> 3.0 |
+| [helm](#provider\_helm) | 3.2.0 |
## Resources
@@ -56,19 +91,28 @@ resource "example_resource" "this" {
|------|-------------|------|---------|:--------:|
| [nullplatform\_port](#input\_nullplatform\_port) | Port number for nullplatform service communication | `number` | `2021` | no |
| [prometheus\_namespace](#input\_prometheus\_namespace) | Kubernetes namespace where Prometheus will be deployed | `string` | `"prometheus"` | no |
+| [prometheus\_version](#input\_prometheus\_version) | No default: every install pins this deliberately — see VERSIONS.md. Helm chart version for the prometheus-community/prometheus chart. The helm\_release carried no version at all, so every apply resolved to whatever the repository served latest; the default is the version that resolved to as of 2026-08-27, which keeps behaviour unchanged while removing the drift. | `string` | n/a | yes |
diff --git a/infrastructure/gcp/artifact-registry/README.md b/infrastructure/gcp/artifact-registry/README.md
index e1df15f0..4a60af0f 100644
--- a/infrastructure/gcp/artifact-registry/README.md
+++ b/infrastructure/gcp/artifact-registry/README.md
@@ -21,7 +21,7 @@ The module creates a google_artifact_registry_repository resource configured wit
```hcl
module "artifact-registry" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/artifact-registry?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/artifact-registry?ref=v6.20.0"
location = "your-location"
project_id = "your-project-id"
diff --git a/infrastructure/gcp/backend/README.md b/infrastructure/gcp/backend/README.md
index 7c4fe15d..179cbb74 100644
--- a/infrastructure/gcp/backend/README.md
+++ b/infrastructure/gcp/backend/README.md
@@ -22,7 +22,7 @@ The module creates a random_id resource to generate a unique 8-byte hex suffix,
```hcl
module "backend" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/backend?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/backend?ref=v6.20.0"
project_id = "your-project-id"
}
diff --git a/infrastructure/gcp/cloud-dns/README.md b/infrastructure/gcp/cloud-dns/README.md
index e8cc4bdf..7f81bfd5 100644
--- a/infrastructure/gcp/cloud-dns/README.md
+++ b/infrastructure/gcp/cloud-dns/README.md
@@ -21,7 +21,7 @@ The module creates a single google_dns_managed_zone resource in the specified GC
```hcl
module "cloud-dns" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-dns?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-dns?ref=v6.20.0"
domain_name = "your-domain-name"
project_id = "your-project-id"
diff --git a/infrastructure/gcp/cloud-nat/README.md b/infrastructure/gcp/cloud-nat/README.md
index dc2e20cb..1fc12ae7 100644
--- a/infrastructure/gcp/cloud-nat/README.md
+++ b/infrastructure/gcp/cloud-nat/README.md
@@ -19,7 +19,7 @@ This module creates a google_compute_router resource in a specified region and n
```hcl
module "cloud-nat" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-nat?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-nat?ref=v6.20.0"
nat_name = "your-nat-name"
network_id = "your-network-id"
diff --git a/infrastructure/gcp/gke/README.md b/infrastructure/gcp/gke/README.md
index 2ca8faac..f409bcbd 100644
--- a/infrastructure/gcp/gke/README.md
+++ b/infrastructure/gcp/gke/README.md
@@ -22,7 +22,7 @@ The module conditionally creates one of two mutually-exclusive submodules based
```hcl
module "gke" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.20.0"
cluster_name = "your-cluster-name"
ip_range_pods = "your-ip-range-pods"
@@ -38,7 +38,7 @@ module "gke" {
```hcl
module "gke" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.20.0"
cluster_name = "your-cluster-name"
ip_range_pods = "your-ip-range-pods"
@@ -73,7 +73,7 @@ module "gke" {
```hcl
module "gke" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.20.0"
cluster_name = "your-cluster-name"
ip_range_pods = "your-ip-range-pods"
diff --git a/infrastructure/gcp/iam/README.md b/infrastructure/gcp/iam/README.md
index 483b30da..0d460c5d 100644
--- a/infrastructure/gcp/iam/README.md
+++ b/infrastructure/gcp/iam/README.md
@@ -19,7 +19,7 @@ The module creates google_service_account resources for each service account spe
```hcl
module "iam" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/iam?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/iam?ref=v6.20.0"
project_id = "your-project-id"
}
diff --git a/infrastructure/gcp/security/README.md b/infrastructure/gcp/security/README.md
index 97ee046a..826c46cd 100644
--- a/infrastructure/gcp/security/README.md
+++ b/infrastructure/gcp/security/README.md
@@ -22,7 +22,7 @@ The module uses data.google_container_cluster and data.google_compute_subnetwork
```hcl
module "security" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/security?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/security?ref=v6.20.0"
cluster_name = "your-cluster-name"
gcp_project_id = "your-gcp-project-id"
diff --git a/infrastructure/gcp/vpc/README.md b/infrastructure/gcp/vpc/README.md
index dd823cb4..376ce0e1 100644
--- a/infrastructure/gcp/vpc/README.md
+++ b/infrastructure/gcp/vpc/README.md
@@ -20,7 +20,7 @@ The module invokes the terraform-google-modules/network/google module to create
```hcl
module "vpc" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/vpc?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/vpc?ref=v6.20.0"
network_name = "your-network-name"
project_id = "your-project-id"
diff --git a/infrastructure/oci/backend/README.md b/infrastructure/oci/backend/README.md
index 68661cc7..377a88d5 100644
--- a/infrastructure/oci/backend/README.md
+++ b/infrastructure/oci/backend/README.md
@@ -18,7 +18,7 @@ The module creates an oci_objectstorage_bucket resource, which is configured wit
```hcl
module "backend" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/backend?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/backend?ref=v6.20.0"
compartment_id = "your-compartment-id"
namespace = "your-namespace"
diff --git a/infrastructure/oci/dns/README.md b/infrastructure/oci/dns/README.md
index 09f7ac1f..b430abb9 100644
--- a/infrastructure/oci/dns/README.md
+++ b/infrastructure/oci/dns/README.md
@@ -18,7 +18,7 @@ This module creates oci_dns_zone resources for each DNS zone defined in the dns_
```hcl
module "dns" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dns?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dns?ref=v6.20.0"
compartment_id = "your-compartment-id"
}
diff --git a/infrastructure/oci/dynamic_groups/README.md b/infrastructure/oci/dynamic_groups/README.md
index 6dc095de..cb57afef 100644
--- a/infrastructure/oci/dynamic_groups/README.md
+++ b/infrastructure/oci/dynamic_groups/README.md
@@ -19,7 +19,7 @@ This module creates an OCI dynamic group and an OCI identity policy, connecting
```hcl
module "dynamic_groups" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dynamic_groups?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dynamic_groups?ref=v6.20.0"
cluster_id = "your-cluster-id"
compartment_id = "your-compartment-id"
diff --git a/infrastructure/oci/oke/README.md b/infrastructure/oci/oke/README.md
index a257bcd2..d94f5e05 100644
--- a/infrastructure/oci/oke/README.md
+++ b/infrastructure/oci/oke/README.md
@@ -21,7 +21,7 @@ The module instantiates the oracle-terraform-modules/oke/oci module to create an
```hcl
module "oke" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/oke?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/oke?ref=v6.20.0"
api_endpoint_subnet_id = "your-api-endpoint-subnet-id"
cluster_name = "your-cluster-name"
diff --git a/infrastructure/oci/vcn/README.md b/infrastructure/oci/vcn/README.md
index 78207d5d..3d722546 100644
--- a/infrastructure/oci/vcn/README.md
+++ b/infrastructure/oci/vcn/README.md
@@ -19,7 +19,7 @@ The module instantiates oci_core_subnet resources for public and private subnets
```hcl
module "vcn" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/vcn?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/vcn?ref=v6.20.0"
}
```
diff --git a/nullplatform/account/README.md b/nullplatform/account/README.md
index 22072195..0e2457d4 100644
--- a/nullplatform/account/README.md
+++ b/nullplatform/account/README.md
@@ -19,7 +19,7 @@ The module iterates over the `nullplatform_accounts` input map using `for_each`
```hcl
module "account" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/account?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/account?ref=v6.20.0"
nullplatform_accounts = "your-nullplatform-accounts"
}
diff --git a/nullplatform/agent/README.md b/nullplatform/agent/README.md
index c676c746..7f384d41 100644
--- a/nullplatform/agent/README.md
+++ b/nullplatform/agent/README.md
@@ -2,96 +2,163 @@
## Description
-Deploys the nullplatform agent to a Kubernetes cluster via a Helm chart, supporting AWS, GCP, Azure, and OCI cloud providers
+Deploys the nullplatform agent to a Kubernetes cluster via a Helm chart, configuring it for a specific cloud provider with pinned versions for all components
## Architecture
-The module creates a helm_release resource targeting the nullplatform-agent chart from the official nullplatform Helm repository, with chart values rendered from a templatefile into a YAML values document. A terraform_data resource tracks the api_key input and triggers helm_release replacement when the key changes, while a second terraform_data resource enforces cross-variable preconditions (e.g., aws_iam_role_arn for AWS, Azure credentials for Azure). Cloud-provider-specific configuration is merged into the agent's environment variables via locals, and an optional worker orchestration block is encoded as a second Helm values layer when the worker variable is non-null.
+The module creates a `helm_release` resource named `agent` that deploys the `nullplatform-agent` chart from the nullplatform Helm repository, with values templated from `nullplatform_agent_values.tmpl.yaml` using `templatefile()`. A `terraform_data.api_key_trigger` resource monitors the API key and forces a `helm_release` replacement when it changes, while a second `terraform_data.cross_variable_validation` resource enforces cross-variable preconditions at plan time. Cloud-provider-specific configuration (AWS IAM role ARN, Azure credentials) is merged into the Helm values via `locals.all_config`, and an optional `worker` block is encoded with `yamlencode` and appended as a second Helm values layer.
## Features
-- Deploys nullplatform-agent Helm chart with cloud-provider-specific environment variable injection for AWS, GCP, Azure, and OCI
-- Enforces cross-variable preconditions at plan time using terraform_data lifecycle blocks for required provider credentials
-- Triggers full Helm release replacement when the API key changes via a terraform_data input tracker
-- Configures agent Git repository scope and extra repositories by merging and deduplicating entries into a comma-separated list
-- Supports optional worker orchestration configuration including allowedRegistries, patches, idleTTL, and rules passed as a second Helm values layer
-- Renders agent arguments and environment variables from a YAML template supporting tags, API key, cluster name, domain, DNS type, and ingress paths
-- Supports Istio ingress with required service_template, initial_ingress_path, and blue_green_ingress_path via precondition validation
+- Deploys nullplatform-agent Helm chart with strictly pinned chart version, agent image tag, and traffic manager image tag to prevent unintended drift
+- Configures cloud-provider-specific environment variables for AWS (IAM role ARN), Azure (client credentials, subscription, resource group, tenant), GCP, and OCI
+- Assembles agent repository list from a primary scope repo with pinned git tag and optional extra repos, each requiring a fixed ref fragment
+- Enforces cross-variable preconditions at plan time ensuring required cloud credentials are present and Istio ingress paths are configured when needed
+- Supports worker orchestration configuration via a structured `worker` block merged as a second Helm values layer for allowedRegistries, patches, and idleTTL
+- Triggers full Helm release replacement when the API key changes via a `terraform_data` lifecycle dependency
+- Accepts arbitrary extra environment variables via `extra_envs` to override or extend the default agent configuration
## Basic Usage
```hcl
module "agent" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.20.0"
+
+ agent_repos_scope_tag = "your-agent-repos-scope-tag"
+ agent_traffic_manager_tag = "your-agent-traffic-manager-tag"
+ api_key = "your-api-key"
+ cloud_provider = "your-cloud-provider"
+ cluster_name = "your-cluster-name"
+ image_tag = "your-image-tag"
+ nullplatform_agent_helm_version = "your-nullplatform-agent-helm-version"
+ tags_selectors = "your-tags-selectors"
+}
+```
+
+### Usage with AWS Cloud Provider
- api_key = "your-api-key"
- cloud_provider = "your-cloud-provider"
- cluster_name = "your-cluster-name"
- image_tag = "your-image-tag"
- tags_selectors = "your-tags-selectors"
+```hcl
+module "agent" {
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.20.0"
+
+ agent_repos_scope_tag = "your-agent-repos-scope-tag"
+ agent_traffic_manager_tag = "your-agent-traffic-manager-tag"
+ api_key = "your-api-key"
+ aws_iam_role_arn = "your-aws-iam-role-arn" # Required when cloud_provider = "aws"
+ cloud_provider = "aws"
+ cluster_name = "your-cluster-name"
+ image_tag = "your-image-tag"
+ nullplatform_agent_helm_version = "your-nullplatform-agent-helm-version"
+ tags_selectors = "your-tags-selectors"
}
```
-### Usage with AWS
+### Usage with GCP Cloud Provider
```hcl
module "agent" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.19.1"
-
- api_key = "your-api-key"
- aws_iam_role_arn = "your-aws-iam-role-arn" # Required when cloud_provider = "aws"
- cloud_provider = "aws"
- cluster_name = "your-cluster-name"
- image_tag = "your-image-tag"
- tags_selectors = "your-tags-selectors"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.20.0"
+
+ agent_repos_scope_tag = "your-agent-repos-scope-tag"
+ agent_traffic_manager_tag = "your-agent-traffic-manager-tag"
+ api_key = "your-api-key"
+ cloud_provider = "gcp"
+ cluster_name = "your-cluster-name"
+ image_tag = "your-image-tag"
+ nullplatform_agent_helm_version = "your-nullplatform-agent-helm-version"
+ tags_selectors = "your-tags-selectors"
}
```
-### Usage with GCP
+### Usage with Azure Cloud Provider
```hcl
module "agent" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.20.0"
+
+ agent_repos_scope_tag = "your-agent-repos-scope-tag"
+ agent_traffic_manager_tag = "your-agent-traffic-manager-tag"
+ api_key = "your-api-key"
+ azure_client_id = "your-azure-client-id" # Required when cloud_provider = "azure"
+ azure_client_secret = "your-azure-client-secret" # Required when cloud_provider = "azure"
+ azure_resource_group = "your-azure-resource-group" # Required when cloud_provider = "azure"
+ azure_subscription_id = "your-azure-subscription-id" # Required when cloud_provider = "azure"
+ azure_tenant_id = "your-azure-tenant-id" # Required when cloud_provider = "azure"
+ cloud_provider = "azure"
+ cluster_name = "your-cluster-name"
+ image_tag = "your-image-tag"
+ nullplatform_agent_helm_version = "your-nullplatform-agent-helm-version"
+ private_hosted_zone_rg = "your-private-hosted-zone-rg" # Required when cloud_provider = "azure"
+ tags_selectors = "your-tags-selectors"
+}
+```
+
+### Usage with OCI Cloud Provider
- api_key = "your-api-key"
- cloud_provider = "gcp"
- cluster_name = "your-cluster-name"
- image_tag = "your-image-tag"
- tags_selectors = "your-tags-selectors"
+```hcl
+module "agent" {
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.20.0"
+
+ agent_repos_scope_tag = "your-agent-repos-scope-tag"
+ agent_traffic_manager_tag = "your-agent-traffic-manager-tag"
+ api_key = "your-api-key"
+ cloud_provider = "oci"
+ cluster_name = "your-cluster-name"
+ image_tag = "your-image-tag"
+ nullplatform_agent_helm_version = "your-nullplatform-agent-helm-version"
+ tags_selectors = "your-tags-selectors"
}
```
-### Usage with Azure
+### Usage with Pinned Helm Chart Version
```hcl
module "agent" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.19.1"
-
- api_key = "your-api-key"
- azure_client_id = "your-azure-client-id" # Required when cloud_provider = "azure"
- azure_client_secret = "your-azure-client-secret" # Required when cloud_provider = "azure"
- azure_resource_group = "your-azure-resource-group" # Required when cloud_provider = "azure"
- azure_subscription_id = "your-azure-subscription-id" # Required when cloud_provider = "azure"
- azure_tenant_id = "your-azure-tenant-id" # Required when cloud_provider = "azure"
- cloud_provider = "azure"
- cluster_name = "your-cluster-name"
- image_tag = "your-image-tag"
- private_hosted_zone_rg = "your-private-hosted-zone-rg" # Required when cloud_provider = "azure"
- tags_selectors = "your-tags-selectors"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.20.0"
+
+ agent_repos_scope_tag = "your-agent-repos-scope-tag"
+ agent_traffic_manager_tag = "your-agent-traffic-manager-tag"
+ api_key = "your-api-key"
+ cloud_provider = "your-cloud-provider"
+ cluster_name = "your-cluster-name"
+ image_tag = "your-image-tag"
+ nullplatform_agent_helm_version = "fixed semver (e.g. 2.37.0)"
+ tags_selectors = "your-tags-selectors"
}
```
-### Usage with OCI
+### Usage with Pinned Scope Repository Tag
```hcl
module "agent" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.20.0"
+
+ agent_repos_scope = "your-agent-repos-scope" # Required when agent_repos_scope_tag = "fixed git tag (e.g. v1.15.1)"
+ agent_repos_scope_tag = "fixed git tag (e.g. v1.15.1)"
+ agent_traffic_manager_tag = "your-agent-traffic-manager-tag"
+ api_key = "your-api-key"
+ cloud_provider = "your-cloud-provider"
+ cluster_name = "your-cluster-name"
+ image_tag = "your-image-tag"
+ nullplatform_agent_helm_version = "your-nullplatform-agent-helm-version"
+ tags_selectors = "your-tags-selectors"
+}
+```
+
+### Usage with Pinned Traffic Manager Tag
- api_key = "your-api-key"
- cloud_provider = "oci"
- cluster_name = "your-cluster-name"
- image_tag = "your-image-tag"
- tags_selectors = "your-tags-selectors"
+```hcl
+module "agent" {
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.20.0"
+
+ agent_repos_scope_tag = "your-agent-repos-scope-tag"
+ agent_traffic_manager_tag = "fixed semver (e.g. 1.8.0)"
+ api_key = "your-api-key"
+ cloud_provider = "your-cloud-provider"
+ cluster_name = "your-cluster-name"
+ image_tag = "your-image-tag"
+ nullplatform_agent_helm_version = "your-nullplatform-agent-helm-version"
+ tags_selectors = "your-tags-selectors"
}
```
@@ -131,8 +198,11 @@ resource "example_resource" "this" {
| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
-| [agent\_repos\_extra](#input\_agent\_repos\_extra) | List of additional Git repositories used for extended agent configuration | `list(string)` | `[]` | no |
-| [agent\_repos\_scope](#input\_agent\_repos\_scope) | Git repository URL containing agent scope configurations (format: repo#branch) | `string` | `"https://github.com/nullplatform/scopes.git#main"` | no |
+| [agent\_repos\_extra](#input\_agent\_repos\_extra) | List of additional Git repositories used for extended agent configuration. Each entry MUST carry a pinned ref fragment (repo.git#v1.2.3); moving refs are rejected. Covers scopes-* and services-* without enumerating them. | `list(string)` | `[]` | no |
+| [agent\_repos\_scope](#input\_agent\_repos\_scope) | Git repository URL containing agent scope configurations, WITHOUT the ref fragment. The ref goes in agent\_repos\_scope\_tag. | `string` | `"https://github.com/nullplatform/scopes.git"` | no |
+| [agent\_repos\_scope\_tag](#input\_agent\_repos\_scope\_tag) | Git tag of the scopes repository to clone. No default: every install pins this deliberately so the agent cannot pick up scope changes it was never rolled out with — see VERSIONS.md. | `string` | n/a | yes |
+| [agent\_traffic\_manager\_repository](#input\_agent\_traffic\_manager\_repository) | Container image repository for the traffic manager. Defaults to the official nullplatform image; override to pull from a mirror. Matches the pattern nullplatform/base uses for its own images. | `string` | `"public.ecr.aws/nullplatform/k8s-traffic-manager"` | no |
+| [agent\_traffic\_manager\_tag](#input\_agent\_traffic\_manager\_tag) | No default: every install pins this deliberately — see VERSIONS.md. Image tag for the traffic manager, published to the agent as TRAFFIC\_CONTAINER\_IMAGE. Pinning this used to mean passing the whole image string through extra\_envs; the registry lives here so only the tag is exposed. extra\_envs still takes precedence for anyone who needs a digest or a mirrored path. | `string` | n/a | yes |
| [api\_key](#input\_api\_key) | API key for authenticating with the nullplatform API | `string` | n/a | yes |
| [aws\_iam\_role\_arn](#input\_aws\_iam\_role\_arn) | ARN of the AWS IAM role assigned to the agent | `string` | `""` | no |
| [azure\_client\_id](#input\_azure\_client\_id) | Azure client ID for authentication | `string` | `null` | no |
@@ -152,7 +222,7 @@ resource "example_resource" "this" {
| [init\_scripts](#input\_init\_scripts) | List of initialization scripts to execute during agent startup | `list(string)` | `[]` | no |
| [initial\_ingress\_path](#input\_initial\_ingress\_path) | Defines the initial ingress path used when deploying the application for the first time. Required when extra\_envs.INGRESS\_TYPE is 'istio' — the k8s scope's default template is AWS ALB Ingress and won't route traffic correctly through Istio, so it must be pointed at an Istio HTTPRoute template instead. | `string` | `""` | no |
| [namespace](#input\_namespace) | Kubernetes namespace where the nullplatform agent will run | `string` | `"nullplatform-tools"` | no |
-| [nullplatform\_agent\_helm\_version](#input\_nullplatform\_agent\_helm\_version) | Version of the nullplatform agent Helm chart to deploy | `string` | `"2.37.0"` | no |
+| [nullplatform\_agent\_helm\_version](#input\_nullplatform\_agent\_helm\_version) | No default: every install pins this deliberately — see VERSIONS.md. Version of the nullplatform agent Helm chart to deploy | `string` | n/a | yes |
| [private\_gateway\_name](#input\_private\_gateway\_name) | Name of the private/internal gateway used for routing | `string` | `"gateway-private"` | no |
| [private\_hosted\_zone\_rg](#input\_private\_hosted\_zone\_rg) | Resource group for private hosted zone | `string` | `null` | no |
| [public\_gateway\_name](#input\_public\_gateway\_name) | Name of the public gateway used for routing | `string` | `"gateway-public"` | no |
@@ -167,16 +237,16 @@ resource "example_resource" "this" {
diff --git a/nullplatform/api_key/README.md b/nullplatform/api_key/README.md
index 13c3a658..cc7e1fde 100644
--- a/nullplatform/api_key/README.md
+++ b/nullplatform/api_key/README.md
@@ -21,7 +21,7 @@ The module creates a single nullplatform_api_key resource whose name, grants, an
```hcl
module "api_key" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.20.0"
type = "your-type"
}
@@ -31,7 +31,7 @@ module "api_key" {
```hcl
module "api_key" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.20.0"
nrn = "your-nrn" # Required when type = "agent"
type = "agent"
@@ -42,7 +42,7 @@ module "api_key" {
```hcl
module "api_key" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.20.0"
nrn = "your-nrn" # Required when type = "scope_notification"
specification_slug = "your-specification-slug" # Required when type = "scope_notification"
@@ -54,7 +54,7 @@ module "api_key" {
```hcl
module "api_key" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.20.0"
nrn = "your-nrn" # Required when type = "service_notification"
specification_slug = "your-specification-slug" # Required when type = "service_notification"
@@ -66,7 +66,7 @@ module "api_key" {
```hcl
module "api_key" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.20.0"
custom_grants = "your-custom-grants" # Required when type = "custom"
custom_name = "your-custom-name" # Required when type = "custom"
diff --git a/nullplatform/asset/docker_server/README.md b/nullplatform/asset/docker_server/README.md
index fa777e54..6cc3a4aa 100644
--- a/nullplatform/asset/docker_server/README.md
+++ b/nullplatform/asset/docker_server/README.md
@@ -21,7 +21,7 @@ Creates a nullplatform_provider_config resource of type 'docker-server' with enc
```hcl
module "docker_server" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/docker_server?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/docker_server?ref=v6.20.0"
login_server = "your-login-server"
nrn = "your-nrn"
diff --git a/nullplatform/asset/ecr/README.md b/nullplatform/asset/ecr/README.md
index db1053f8..7341450b 100644
--- a/nullplatform/asset/ecr/README.md
+++ b/nullplatform/asset/ecr/README.md
@@ -21,7 +21,7 @@ The module reads the current AWS region via the aws_region data source and combi
```hcl
module "ecr" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/ecr?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/ecr?ref=v6.20.0"
application_role_arn = "your-application-role-arn"
build_workflow_access_key_id = "your-build-workflow-access-key-id"
diff --git a/nullplatform/asset/s3/README.md b/nullplatform/asset/s3/README.md
index a45d7998..c84dd20f 100644
--- a/nullplatform/asset/s3/README.md
+++ b/nullplatform/asset/s3/README.md
@@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type s3-con
```hcl
module "s3" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/s3?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/s3?ref=v6.20.0"
bucket_name = "your-bucket-name"
nrn = "your-nrn"
diff --git a/nullplatform/base/README.md b/nullplatform/base/README.md
index fcb03c9f..e33c9dce 100644
--- a/nullplatform/base/README.md
+++ b/nullplatform/base/README.md
@@ -2,85 +2,103 @@
## Description
-Deploys the nullplatform base Helm chart onto a Kubernetes cluster across multiple cloud providers with configurable networking, logging, and observability integrations
+Deploys the nullplatform base Helm chart to a Kubernetes cluster with pre-created namespaces and multi-cloud gateway, logging, and observability configuration across EKS, GKE, AKS, OKE, and ARO providers
## Architecture
-The module creates two kubernetes_namespace_v1 resources (nullplatform-tools and nullplatform) to pre-seed namespaces before chart installation, then deploys a helm_release resource pointing to the nullplatform-base chart from the nullplatform GitHub Helm registry. A templatefile-rendered local (nullplatform_base_values) merges all input variables into a YAML values file that is passed directly to the helm_release, controlling everything from gateway topology and ingress controllers to logging backends and observability pipelines. Outputs surface provider-specific security resource identifiers (AWS security group IDs, Azure NSG IDs, GCP firewall names) that are expected to originate from companion security submodules.
+The module creates two kubernetes_namespace_v1 resources ('nullplatform-tools' and 'nullplatform') before deploying a helm_release named 'nullplatform-base' from the nullplatform Helm repository, using a templatefile-rendered locals block to produce the chart values. All provider-specific gateway settings (AWS security groups, Azure NSGs, GCP firewall rules, OCI subnets), logging backends (Loki, GELF, Datadog, Dynatrace, New Relic, CloudWatch), ingress controllers, and control plane agent image coordinates are wired from input variables into the template and passed as the helm_release values argument. Outputs expose the rendered Helm values and cloud-specific gateway security resource identifiers (security group IDs, NSG IDs, firewall names) for consumption by upstream modules.
## Features
-- Creates kubernetes_namespace_v1 resources for nullplatform-tools and nullplatform to prevent Helm lookup race conditions
-- Deploys nullplatform-base helm_release with full values rendered from a templatefile covering gateways, ingress, logging, and observability
-- Configures public and private gateway resources with per-cloud security group, NSG, firewall, and OCI subnet annotations
-- Supports multi-provider observability integrations including Prometheus, Loki, GELF, Dynatrace, Datadog, New Relic, and CloudWatch
-- Configures ingress controllers with independent public and private scopes, names, and domains
-- Enables optional control plane agent deployment with configurable image repository and tag
-- Supports image pull secrets for private container registries across all Kubernetes providers
+- Creates kubernetes_namespace_v1 resources for 'nullplatform-tools' and 'nullplatform' with Helm-compatible labels and annotations before chart installation
+- Deploys helm_release 'nullplatform-base' with pinned chart version, 600-second timeout, and job completion waiting to ensure deterministic installs
+- Configures multi-cloud gateway resources (AWS, Azure, GCP, OCI) with provider-specific security groups, NSGs, firewall rules, and subnet annotations
+- Supports multiple observability backends including Prometheus, GELF, Loki, Dynatrace, Datadog, New Relic, and CloudWatch with per-backend enable flags
+- Renders all Helm values via a templatefile from a YAML template, converting Terraform booleans and variables into chart-compatible strings
+- Enforces pinned non-moving version references for Helm chart version, control plane agent image tag, and logging controller image tag via validation rules
+- Configures public and private ingress controllers and Gateway API resources with per-controller scope, domain, and enablement settings
## Basic Usage
```hcl
module "base" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.20.0"
- k8s_provider = "your-k8s-provider"
- np_api_key = "your-np-api-key"
+ control_plane_agent_image_tag = "your-control-plane-agent-image-tag"
+ k8s_provider = "your-k8s-provider"
+ logging_controller_image_tag = "your-logging-controller-image-tag"
+ np_api_key = "your-np-api-key"
+ nullplatform_base_helm_version = "your-nullplatform-base-helm-version"
}
```
-### Usage with Amazon EKS
+### Usage with EKS (Amazon Elastic Kubernetes Service)
```hcl
module "base" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.20.0"
- k8s_provider = "eks"
- np_api_key = "your-np-api-key"
+ control_plane_agent_image_tag = "your-control-plane-agent-image-tag"
+ k8s_provider = "eks"
+ logging_controller_image_tag = "your-logging-controller-image-tag"
+ np_api_key = "your-np-api-key"
+ nullplatform_base_helm_version = "your-nullplatform-base-helm-version"
}
```
-### Usage with Google GKE
+### Usage with GKE (Google Kubernetes Engine)
```hcl
module "base" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.20.0"
- k8s_provider = "gke"
- np_api_key = "your-np-api-key"
+ control_plane_agent_image_tag = "your-control-plane-agent-image-tag"
+ k8s_provider = "gke"
+ logging_controller_image_tag = "your-logging-controller-image-tag"
+ np_api_key = "your-np-api-key"
+ nullplatform_base_helm_version = "your-nullplatform-base-helm-version"
}
```
-### Usage with Azure AKS
+### Usage with AKS (Azure Kubernetes Service)
```hcl
module "base" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.20.0"
- k8s_provider = "aks"
- np_api_key = "your-np-api-key"
+ control_plane_agent_image_tag = "your-control-plane-agent-image-tag"
+ k8s_provider = "aks"
+ logging_controller_image_tag = "your-logging-controller-image-tag"
+ np_api_key = "your-np-api-key"
+ nullplatform_base_helm_version = "your-nullplatform-base-helm-version"
}
```
-### Usage with Oracle OKE
+### Usage with OKE (Oracle Container Engine for Kubernetes)
```hcl
module "base" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.20.0"
- k8s_provider = "oke"
- np_api_key = "your-np-api-key"
+ control_plane_agent_image_tag = "your-control-plane-agent-image-tag"
+ k8s_provider = "oke"
+ logging_controller_image_tag = "your-logging-controller-image-tag"
+ np_api_key = "your-np-api-key"
+ nullplatform_base_helm_version = "your-nullplatform-base-helm-version"
}
```
-### Usage with Azure Red Hat OpenShift (ARO)
+### Usage with ARO (Azure Red Hat OpenShift)
```hcl
module "base" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.20.0"
- k8s_provider = "aro"
- np_api_key = "your-np-api-key"
+ control_plane_agent_image_tag = "your-control-plane-agent-image-tag"
+ k8s_provider = "aro"
+ logging_controller_image_tag = "your-logging-controller-image-tag"
+ np_api_key = "your-np-api-key"
+ nullplatform_base_helm_version = "your-nullplatform-base-helm-version"
}
```
@@ -128,7 +146,7 @@ resource "example_resource" "this" {
| [cloudwatch\_performance\_metrics\_enabled](#input\_cloudwatch\_performance\_metrics\_enabled) | Enable performance metrics in CloudWatch. | `bool` | `false` | no |
| [cloudwatch\_service\_account\_annotations](#input\_cloudwatch\_service\_account\_annotations) | Annotations for the logs controller ServiceAccount (nullplatform-pod-metadata-reader-sa). Rendered only when cloudwatch\_enabled is true. Set eks.amazonaws.com/role-arn here to use IRSA instead of the node instance role. | `map(string)` | `{}` | no |
| [control\_plane\_agent\_image\_repository](#input\_control\_plane\_agent\_image\_repository) | Container image repository for the control plane agent. | `string` | `"public.ecr.aws/nullplatform/controlplane-agent"` | no |
-| [control\_plane\_agent\_image\_tag](#input\_control\_plane\_agent\_image\_tag) | Container image tag for the control plane agent. | `string` | `"0.9.2"` | no |
+| [control\_plane\_agent\_image\_tag](#input\_control\_plane\_agent\_image\_tag) | No default: every install pins this deliberately — see VERSIONS.md. Container image tag for the control plane agent. | `string` | n/a | yes |
| [control\_plane\_enabled](#input\_control\_plane\_enabled) | Enable the control plane. | `bool` | `false` | no |
| [datadog\_api\_key](#input\_datadog\_api\_key) | Datadog API key. | `string` | `""` | no |
| [datadog\_enabled](#input\_datadog\_enabled) | Enable Datadog integration. | `bool` | `false` | no |
@@ -178,7 +196,7 @@ resource "example_resource" "this" {
| [k8s\_provider](#input\_k8s\_provider) | Cloud provider (eks, gke, aks, oke and aro). | `string` | n/a | yes |
| [logging\_application\_logs\_enabled](#input\_logging\_application\_logs\_enabled) | Enable application log forwarding. Set to false to keep only http/sys metrics pipelines active across all providers. | `bool` | `true` | no |
| [logging\_controller\_image\_repository](#input\_logging\_controller\_image\_repository) | Container image repository for the logs controller DaemonSet. | `string` | `"public.ecr.aws/nullplatform/k8s-logs-controller"` | no |
-| [logging\_controller\_image\_tag](#input\_logging\_controller\_image\_tag) | Container image tag for the logs controller DaemonSet. | `string` | `"1.6.0"` | no |
+| [logging\_controller\_image\_tag](#input\_logging\_controller\_image\_tag) | No default: every install pins this deliberately — see VERSIONS.md. Container image tag for the logs controller DaemonSet. | `string` | n/a | yes |
| [logging\_enabled](#input\_logging\_enabled) | Enable the logging layer. | `bool` | `true` | no |
| [logging\_mount\_docker\_containers](#input\_logging\_mount\_docker\_containers) | Mount Docker container log paths. Enable when using Docker container runtime (e.g. Minikube). | `bool` | `false` | no |
| [loki\_bearer\_token](#input\_loki\_bearer\_token) | Loki bearer token (if applicable). | `string` | `""` | no |
@@ -195,7 +213,7 @@ resource "example_resource" "this" {
| [newrelic\_metrics\_enabled](#input\_newrelic\_metrics\_enabled) | Enable metrics forwarding to New Relic. Set to false to send only logs. | `bool` | `true` | no |
| [newrelic\_region](#input\_newrelic\_region) | New Relic region (e.g., US, EU). | `string` | `""` | no |
| [np\_api\_key](#input\_np\_api\_key) | Nullplatform API key for authentication (account level). | `string` | n/a | yes |
-| [nullplatform\_base\_helm\_version](#input\_nullplatform\_base\_helm\_version) | Helm chart version for the nullplatform base. | `string` | `"2.44.0"` | no |
+| [nullplatform\_base\_helm\_version](#input\_nullplatform\_base\_helm\_version) | No default: every install pins this deliberately — see VERSIONS.md. Helm chart version for the nullplatform base. | `string` | n/a | yes |
| [prometheus\_enabled](#input\_prometheus\_enabled) | Enable the Prometheus exporter. | `bool` | `true` | no |
| [tls\_required](#input\_tls\_required) | Whether TLS is required. | `bool` | `true` | no |
@@ -215,16 +233,16 @@ resource "example_resource" "this" {
diff --git a/nullplatform/cloud/aws/cloud/README.md b/nullplatform/cloud/aws/cloud/README.md
index 94dcd369..73305ffb 100644
--- a/nullplatform/cloud/aws/cloud/README.md
+++ b/nullplatform/cloud/aws/cloud/README.md
@@ -21,7 +21,7 @@ The module uses data sources aws_caller_identity and aws_region to dynamically r
```hcl
module "cloud" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/cloud?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/cloud?ref=v6.20.0"
domain_name = "your-domain-name"
hosted_private_zone_id = "your-hosted-private-zone-id"
diff --git a/nullplatform/cloud/aws/vpc/README.md b/nullplatform/cloud/aws/vpc/README.md
index 89b288a5..08a96c13 100644
--- a/nullplatform/cloud/aws/vpc/README.md
+++ b/nullplatform/cloud/aws/vpc/README.md
@@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource of type aws-ne
```hcl
module "vpc" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/vpc?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/vpc?ref=v6.20.0"
nrn = "your-nrn"
vpc_id = "your-vpc-id"
diff --git a/nullplatform/cloud/azure/cloud/README.md b/nullplatform/cloud/azure/cloud/README.md
index 606729c6..d59bd2af 100644
--- a/nullplatform/cloud/azure/cloud/README.md
+++ b/nullplatform/cloud/azure/cloud/README.md
@@ -22,7 +22,7 @@ The module creates a single nullplatform_provider_config resource of type 'azure
```hcl
module "cloud" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/azure/cloud?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/azure/cloud?ref=v6.20.0"
azure_resource_group_name = "your-azure-resource-group-name"
nrn = "your-nrn"
diff --git a/nullplatform/cloud/gcp/cloud/README.md b/nullplatform/cloud/gcp/cloud/README.md
index 3deedc72..f3a71872 100644
--- a/nullplatform/cloud/gcp/cloud/README.md
+++ b/nullplatform/cloud/gcp/cloud/README.md
@@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type 'googl
```hcl
module "cloud" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/gcp/cloud?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/gcp/cloud?ref=v6.20.0"
domain_name = "your-domain-name"
location = "your-location"
diff --git a/nullplatform/cloud/oci/cloud/README.md b/nullplatform/cloud/oci/cloud/README.md
index cd9513ff..a1d62963 100644
--- a/nullplatform/cloud/oci/cloud/README.md
+++ b/nullplatform/cloud/oci/cloud/README.md
@@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type 'oci-c
```hcl
module "cloud" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/oci/cloud?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/oci/cloud?ref=v6.20.0"
account_id = "your-account-id"
account_name = "your-account-name"
diff --git a/nullplatform/code_repository/README.md b/nullplatform/code_repository/README.md
index 648ddd6b..a3bbee45 100644
--- a/nullplatform/code_repository/README.md
+++ b/nullplatform/code_repository/README.md
@@ -22,7 +22,7 @@ The module uses local boolean flags (is_gitlab, is_github, is_azure, is_bitbucke
```hcl
module "code_repository" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.20.0"
git_provider = "your-git-provider"
nrn = "your-nrn"
@@ -33,7 +33,7 @@ module "code_repository" {
```hcl
module "code_repository" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.20.0"
git_provider = "github"
github_installation_id = "your-github-installation-id" # Required when git_provider = "github"
@@ -46,7 +46,7 @@ module "code_repository" {
```hcl
module "code_repository" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.20.0"
git_provider = "gitlab"
gitlab_access_token = "your-gitlab-access-token" # Required when git_provider = "gitlab"
@@ -62,7 +62,7 @@ module "code_repository" {
```hcl
module "code_repository" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.20.0"
azure_access_token = "your-azure-access-token" # Required when git_provider = "azure"
azure_agent_pool = "your-azure-agent-pool" # Required when git_provider = "azure"
@@ -76,7 +76,7 @@ module "code_repository" {
```hcl
module "code_repository" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.20.0"
bitbucket_collaborators = "your-bitbucket-collaborators" # Required when git_provider = "bitbucket"
bitbucket_installation_url = "your-bitbucket-installation-url" # Required when git_provider = "bitbucket"
diff --git a/nullplatform/container_orchestration/aks/README.md b/nullplatform/container_orchestration/aks/README.md
index 4e88bb96..d241f8f6 100644
--- a/nullplatform/container_orchestration/aks/README.md
+++ b/nullplatform/container_orchestration/aks/README.md
@@ -2,31 +2,75 @@
## Description
-Configures an AKS cluster in the Nullplatform by creating a provider configuration resource that encapsulates cluster settings, gateway configuration, resource management policies, and security parameters
+Configures an AKS cluster provider configuration in Nullplatform by encoding cluster, gateway, resource management, security, and traffic manager settings into a nullplatform_provider_config resource
## Architecture
-The module builds a local.attributes map that aggregates cluster metadata, gateway specs, resource limits, and security settings, then passes this JSON-encoded structure to the nullplatform_provider_config resource of type aks-configuration. Inputs like cluster_name, resource_group, and gateway names flow into the attributes map, while optional blocks for resource_management and security are conditionally included based on non-empty variables. The resulting provider configuration is registered against the given NRN in the Nullplatform.
+The module constructs a set of locals that merge optional and required inputs into structured maps representing cluster identity, gateway configuration, resource management ratios, and security settings. These locals are JSON-encoded and passed as the attributes argument to a single nullplatform_provider_config resource of type aks-configuration, keyed by the provided NRN and optional dimensions. The traffic_manager_version is always included in the attributes payload, while fields like authentication_mode, private_gateway_name, image_pull_secrets, service_account_name, resource_management ratios, and object_modifiers are conditionally included only when non-empty values are provided.
## Features
-- Creates Nullplatform provider configuration for AKS clusters
-- Configures public and optional private Application Gateway references
-- Supports resource quotas for CPU/memory ratios and core limits
-- Manages image pull secrets and service account mappings
-- Enables traffic manager sidecar version specification
-- Applies dynamic object modifiers for Kubernetes resources
+- Creates a nullplatform_provider_config resource of type aks-configuration scoped to a Nullplatform NRN
+- Encodes AKS cluster identity including name, resource group, and default application namespace
+- Configures public and optionally private Application Gateway references within the Istio ingress namespace
+- Pins traffic manager sidecar container to a fixed, explicitly declared version tag
+- Conditionally includes resource management tuning parameters such as memory-to-CPU ratio and max milicores
+- Supports optional Kubernetes security settings including image pull secrets and service account name
+- Applies dynamic Kubernetes object modifiers when object_modifiers list is provided
## Basic Usage
```hcl
module "aks" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.20.0"
- cluster_name = "your-cluster-name"
- nrn = "your-nrn"
- public_gateway_name = "your-public-gateway-name"
- resource_group = "your-resource-group"
+ cluster_name = "your-cluster-name"
+ nrn = "your-nrn"
+ public_gateway_name = "your-public-gateway-name"
+ resource_group = "your-resource-group"
+ traffic_manager_version = "your-traffic-manager-version"
+}
+```
+
+### Usage with Fixed Version Tag
+
+```hcl
+module "aks" {
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.20.0"
+
+ cluster_name = "your-cluster-name"
+ nrn = "your-nrn"
+ public_gateway_name = "your-public-gateway-name"
+ resource_group = "your-resource-group"
+ traffic_manager_version = "latest"
+}
+```
+
+### Usage with Fixed Version Tag
+
+```hcl
+module "aks" {
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.20.0"
+
+ cluster_name = "your-cluster-name"
+ nrn = "your-nrn"
+ public_gateway_name = "your-public-gateway-name"
+ resource_group = "your-resource-group"
+ traffic_manager_version = "main"
+}
+```
+
+### Usage with Fixed Version Tag
+
+```hcl
+module "aks" {
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.20.0"
+
+ cluster_name = "your-cluster-name"
+ nrn = "your-nrn"
+ public_gateway_name = "your-public-gateway-name"
+ resource_group = "your-resource-group"
+ traffic_manager_version = "master"
}
```
@@ -78,21 +122,22 @@ resource "example_resource" "this" {
| [public\_gateway\_name](#input\_public\_gateway\_name) | Name of the public Application Gateway in AKS | `string` | n/a | yes |
| [resource\_group](#input\_resource\_group) | Name of the resource group containing the AKS cluster | `string` | n/a | yes |
| [service\_account\_name](#input\_service\_account\_name) | The name of the Kubernetes service account used for deployments | `string` | `""` | no |
-| [traffic\_manager\_version](#input\_traffic\_manager\_version) | Tag for the traffic manager sidecar container | `string` | `""` | no |
+| [traffic\_manager\_version](#input\_traffic\_manager\_version) | No default: every install pins this deliberately — see VERSIONS.md. Tag for the traffic manager sidecar container | `string` | n/a | yes |
diff --git a/nullplatform/container_orchestration/eks/README.md b/nullplatform/container_orchestration/eks/README.md
index 6bb568e3..b86c9baf 100644
--- a/nullplatform/container_orchestration/eks/README.md
+++ b/nullplatform/container_orchestration/eks/README.md
@@ -2,30 +2,67 @@
## Description
-Configures a Nullplatform EKS provider configuration resource with cluster, load balancer, networking, resource management, security, and traffic manager settings
+Configures a Nullplatform EKS provider by creating a nullplatform_provider_config resource that encodes cluster, load balancer, network, resource management, security, and traffic manager settings as structured JSON attributes
## Architecture
-The module assembles a set of structured locals by merging optional variables into nested maps for cluster, balancer, network, resource_management, security, and traffic_manager configurations. All assembled locals are merged into a single attributes map and JSON-encoded before being passed to a single nullplatform_provider_config resource of type eks-configuration. Input variables flow directly into the locals merge logic, where empty strings and null values are conditionally excluded to avoid sending unset fields to the provider API. The nrn and dimensions variables are passed directly to the nullplatform_provider_config resource to identify and scope the configuration.
+The module assembles multiple local maps (cluster, balancer, network, resource_management, security, traffic_manager) from input variables and merges them into a single attributes object that is JSON-encoded. A single nullplatform_provider_config resource of type 'eks-configuration' is created using the nrn, dimensions, and the encoded attributes payload. Optional fields are conditionally included in the merged locals only when their values are non-empty or non-null, preventing unnecessary keys from appearing in the provider configuration. The resulting resource registers the EKS cluster configuration within the Nullplatform control plane.
## Features
-- Creates a nullplatform_provider_config resource of type eks-configuration to register EKS cluster settings with the Nullplatform platform
-- Configures public and private ALB load balancers with support for additional balancers to scale beyond the 100-rule ALB limit
-- Enforces ALB naming validation ensuring names are 1-32 alphanumeric characters with hyphens and no leading or trailing hyphens
-- Configures traffic manager sidecar container version and pod-binding port with range validation between 1 and 65535
-- Supports resource management tuning via memory-to-CPU ratio, memory request-to-limit ratio, max CPU cores multiplier, and max milicores
-- Configures Kubernetes security settings including image pull secrets and a custom service account name
-- Supports dynamic Kubernetes object modifiers for patching deployed k8s resources via selector, action, type, and value
+- Creates a nullplatform_provider_config resource that registers EKS cluster configuration with the Nullplatform control plane
+- Configures ALB load balancer settings including public, private, additional balancers, and capacity thresholds with 50–99% rule usage validation
+- Pins the traffic manager sidecar container to a fixed version tag, preventing unintended upgrades from moving references like latest or main
+- Configures traffic manager sidecar port binding with a valid 1–65535 range, supporting environments that restrict pod-to-pod traffic on port 80
+- Manages Kubernetes resource allocation ratios including memory-to-CPU ratio, request-to-limit ratio, and maximum milicores per pod
+- Supports dynamic Kubernetes object modification via configurable object_modifiers with selector, action, type, and value fields
+- Configures security context including image pull secrets and Kubernetes service account name for deployment workloads
## Basic Usage
```hcl
module "eks" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.20.0"
- cluster_name = "your-cluster-name"
- nrn = "your-nrn"
+ cluster_name = "your-cluster-name"
+ nrn = "your-nrn"
+ traffic_manager_version = "your-traffic-manager-version"
+}
+```
+
+### Usage with Pinned Release Version
+
+```hcl
+module "eks" {
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.20.0"
+
+ cluster_name = "your-cluster-name"
+ nrn = "your-nrn"
+ traffic_manager_version = "latest"
+}
+```
+
+### Usage with Pinned Release Version
+
+```hcl
+module "eks" {
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.20.0"
+
+ cluster_name = "your-cluster-name"
+ nrn = "your-nrn"
+ traffic_manager_version = "main"
+}
+```
+
+### Usage with Pinned Release Version
+
+```hcl
+module "eks" {
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.20.0"
+
+ cluster_name = "your-cluster-name"
+ nrn = "your-nrn"
+ traffic_manager_version = "master"
}
```
@@ -79,23 +116,23 @@ resource "example_resource" "this" {
| [public\_balancer\_name](#input\_public\_balancer\_name) | The name of the public-facing load balancer for external traffic routing | `string` | `""` | no |
| [service\_account\_name](#input\_service\_account\_name) | The name of the Kubernetes service account used for deployments | `string` | `""` | no |
| [traffic\_manager\_port](#input\_traffic\_manager\_port) | Port the traffic manager sidecar binds inside the pod. Defaults to 80 when unset. Set a different port (10080 recommended) when the cluster does not allow pod-to-pod traffic on port 80, which surfaces as a healthy pod that receives no traffic because kubelet probes are node-local and bypass the filtering. Open the port for pod-to-pod traffic before setting this value | `number` | `null` | no |
-| [traffic\_manager\_version](#input\_traffic\_manager\_version) | Tag for the traffic manager sidecar container | `string` | `"latest"` | no |
+| [traffic\_manager\_version](#input\_traffic\_manager\_version) | No default: every install pins this deliberately — see VERSIONS.md. Pinned rather than tracking latest: a moving tag means a pod restart can pull a different build with no apply in between. Tag for the traffic manager sidecar container | `string` | n/a | yes |
| [use\_nullplatform\_namespace](#input\_use\_nullplatform\_namespace) | When enabled, uses the nullplatform system namespace instead of a custom namespace | `bool` | `false` | no |
diff --git a/nullplatform/container_orchestration/gke/README.md b/nullplatform/container_orchestration/gke/README.md
index 6cd1dc9f..b55dc39c 100644
--- a/nullplatform/container_orchestration/gke/README.md
+++ b/nullplatform/container_orchestration/gke/README.md
@@ -2,32 +2,75 @@
## Description
-Configures a GKE provider configuration resource in Nullplatform by encoding cluster, gateway, resource management, and security settings as a typed provider config
+Configures a GKE cluster provider in Nullplatform by creating a nullplatform_provider_config resource with cluster, gateway, resource management, security, and traffic manager settings
## Architecture
-The module constructs a structured attributes object using locals that merge cluster identity, gateway configuration, optional resource management ratios, security settings, and object modifiers. A single nullplatform_provider_config resource of type 'gke-configuration' is created, binding the NRN and dimensions to the JSON-encoded attributes. Input variables flow into conditional merges within locals so that optional fields like private_gateway_name, service_account_name, and traffic_manager_version are only included when non-empty. The resulting resource acts as a configuration record in the Nullplatform platform for GKE cluster integration.
+The module constructs a set of locals that merge optional inputs (gateway namespace, private gateway, resource management ratios, image pull secrets, service account, object modifiers) into a structured attributes map. A single nullplatform_provider_config resource of type 'gke-configuration' is created, binding the NRN and optional dimensions to the JSON-encoded attributes map. The cluster identity (name, location, namespace), gateway configuration, traffic manager version, and security settings all flow through locals into the jsonencode(local.attributes) argument of the provider config resource.
## Features
-- Creates a nullplatform_provider_config resource of type gke-configuration with cluster identity and location
-- Configures public and optional private gateway references with namespace support
-- Encodes resource management settings including memory/CPU ratios and max milicores when provided
-- Attaches image pull secrets and Kubernetes service account name for secure workload identity
-- Includes optional traffic manager sidecar version tagging
-- Supports dynamic Kubernetes object modifiers for patching deployed resources
-- Conditionally omits optional fields from the encoded attributes when left as empty defaults
+- Creates a nullplatform_provider_config resource of type 'gke-configuration' scoped to a specific NRN
+- Configures GKE cluster identity including name, location, and default application namespace
+- Configures public and optionally private Istio gateway references with a configurable namespace
+- Sets resource management parameters including memory-to-CPU ratio, request-to-limit ratios, and max milicores
+- Pins traffic manager sidecar container to an explicit fixed version tag, rejecting moving references like latest/main/master
+- Supports image pull secrets and custom Kubernetes service account name for secure workload deployments
+- Applies dynamic Kubernetes object modifiers via a structured list of selector, action, type, and value entries
## Basic Usage
```hcl
module "gke" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.20.0"
- cluster_name = "your-cluster-name"
- location = "your-location"
- nrn = "your-nrn"
- public_gateway_name = "your-public-gateway-name"
+ cluster_name = "your-cluster-name"
+ location = "your-location"
+ nrn = "your-nrn"
+ public_gateway_name = "your-public-gateway-name"
+ traffic_manager_version = "your-traffic-manager-version"
+}
+```
+
+### Usage with Latest Version (Disallowed)
+
+```hcl
+module "gke" {
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.20.0"
+
+ cluster_name = "your-cluster-name"
+ location = "your-location"
+ nrn = "your-nrn"
+ public_gateway_name = "your-public-gateway-name"
+ traffic_manager_version = "latest"
+}
+```
+
+### Usage with Main Branch (Disallowed)
+
+```hcl
+module "gke" {
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.20.0"
+
+ cluster_name = "your-cluster-name"
+ location = "your-location"
+ nrn = "your-nrn"
+ public_gateway_name = "your-public-gateway-name"
+ traffic_manager_version = "main"
+}
+```
+
+### Usage with Master Branch (Disallowed)
+
+```hcl
+module "gke" {
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.20.0"
+
+ cluster_name = "your-cluster-name"
+ location = "your-location"
+ nrn = "your-nrn"
+ public_gateway_name = "your-public-gateway-name"
+ traffic_manager_version = "master"
}
```
@@ -78,22 +121,22 @@ resource "example_resource" "this" {
| [private\_gateway\_name](#input\_private\_gateway\_name) | Name of the private gateway | `string` | `""` | no |
| [public\_gateway\_name](#input\_public\_gateway\_name) | Name of the public gateway | `string` | n/a | yes |
| [service\_account\_name](#input\_service\_account\_name) | The name of the Kubernetes service account used for deployments | `string` | `""` | no |
-| [traffic\_manager\_version](#input\_traffic\_manager\_version) | Tag for the traffic manager sidecar container | `string` | `""` | no |
+| [traffic\_manager\_version](#input\_traffic\_manager\_version) | No default: every install pins this deliberately — see VERSIONS.md. Tag for the traffic manager sidecar container | `string` | n/a | yes |
diff --git a/nullplatform/container_orchestration/oke/README.md b/nullplatform/container_orchestration/oke/README.md
index 67a1dd88..7eb21489 100644
--- a/nullplatform/container_orchestration/oke/README.md
+++ b/nullplatform/container_orchestration/oke/README.md
@@ -19,7 +19,7 @@ Creates a single nullplatform_provider_config resource of type 'oke' that stores
```hcl
module "oke" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/oke?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/oke?ref=v6.20.0"
cluster_name = "your-cluster-name"
nrn = "your-nrn"
diff --git a/nullplatform/dimension/README.md b/nullplatform/dimension/README.md
index ebebba33..77bca040 100644
--- a/nullplatform/dimension/README.md
+++ b/nullplatform/dimension/README.md
@@ -19,7 +19,7 @@ The module creates a nullplatform_dimension resource using the provided name, or
```hcl
module "dimension" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension?ref=v6.20.0"
name = "your-name"
nrn = "your-nrn"
diff --git a/nullplatform/dimension_value/README.md b/nullplatform/dimension_value/README.md
index c52bd819..3c81f60c 100644
--- a/nullplatform/dimension_value/README.md
+++ b/nullplatform/dimension_value/README.md
@@ -19,7 +19,7 @@ The module uses a terraform_data resource to enforce mutual-exclusivity and pres
```hcl
module "dimension_value" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension_value?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension_value?ref=v6.20.0"
dimension_id = "your-dimension-id"
name = "your-name"
diff --git a/nullplatform/identity-access-control/README.md b/nullplatform/identity-access-control/README.md
index 28428dee..9833b9e9 100644
--- a/nullplatform/identity-access-control/README.md
+++ b/nullplatform/identity-access-control/README.md
@@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource named identity
```hcl
module "identity-access-control" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/identity-access-control?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/identity-access-control?ref=v6.20.0"
attributes = "your-attributes"
nrn = "your-nrn"
diff --git a/nullplatform/metrics/README.md b/nullplatform/metrics/README.md
index 6f727769..5234161b 100644
--- a/nullplatform/metrics/README.md
+++ b/nullplatform/metrics/README.md
@@ -21,7 +21,7 @@ The module creates a single nullplatform_provider_config resource of type 'prome
```hcl
module "metrics" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/metrics?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/metrics?ref=v6.20.0"
nrn = "your-nrn"
}
diff --git a/nullplatform/packaged_service/README.md b/nullplatform/packaged_service/README.md
index 00ef5638..c3b13959 100644
--- a/nullplatform/packaged_service/README.md
+++ b/nullplatform/packaged_service/README.md
@@ -17,7 +17,7 @@ spec updates / republish correctly.
```hcl
module "packaged_service" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/packaged_service?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/packaged_service?ref=v6.20.0"
nrn = "organization=…:account=…:namespace=…"
diff --git a/nullplatform/parameter_storage_configuration/README.md b/nullplatform/parameter_storage_configuration/README.md
index b09866f4..6fef70a5 100644
--- a/nullplatform/parameter_storage_configuration/README.md
+++ b/nullplatform/parameter_storage_configuration/README.md
@@ -20,7 +20,7 @@ The module delegates entirely to a remote `scope_configuration` module sourced f
```hcl
module "parameter_storage_configuration" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_configuration?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_configuration?ref=v6.20.0"
attributes = "your-attributes"
np_api_key = "your-np-api-key"
diff --git a/nullplatform/parameter_storage_definition/README.md b/nullplatform/parameter_storage_definition/README.md
index c89fb334..28ec37ce 100644
--- a/nullplatform/parameter_storage_definition/README.md
+++ b/nullplatform/parameter_storage_definition/README.md
@@ -20,7 +20,7 @@ A data.http resource fetches the raw specification template from a configurable
```hcl
module "parameter_storage_definition" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition?ref=v6.20.0"
np_api_key = "your-np-api-key"
nrn = "your-nrn"
diff --git a/nullplatform/parameter_storage_definition_agent_association/README.md b/nullplatform/parameter_storage_definition_agent_association/README.md
index 7b0275dd..2863f483 100644
--- a/nullplatform/parameter_storage_definition_agent_association/README.md
+++ b/nullplatform/parameter_storage_definition_agent_association/README.md
@@ -21,7 +21,7 @@ The module creates a terraform_data resource to track API key changes and a null
```hcl
module "parameter_storage_definition_agent_association" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition_agent_association?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition_agent_association?ref=v6.20.0"
api_key = "your-api-key"
nrn = "your-nrn"
diff --git a/nullplatform/scope_configuration/README.md b/nullplatform/scope_configuration/README.md
index 817aecc2..f6477861 100644
--- a/nullplatform/scope_configuration/README.md
+++ b/nullplatform/scope_configuration/README.md
@@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource that binds a N
```hcl
module "scope_configuration" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_configuration?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_configuration?ref=v6.20.0"
attributes = "your-attributes"
np_api_key = "your-np-api-key"
diff --git a/nullplatform/scope_definition/README.md b/nullplatform/scope_definition/README.md
index e500a80a..ec9ee812 100644
--- a/nullplatform/scope_definition/README.md
+++ b/nullplatform/scope_definition/README.md
@@ -22,7 +22,7 @@ The module fetches JSON templates via data.http resources from a configurable Gi
```hcl
module "scope_definition" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition?ref=v6.20.0"
np_api_key = "your-np-api-key"
nrn = "your-nrn"
diff --git a/nullplatform/scope_definition_agent_association/README.md b/nullplatform/scope_definition_agent_association/README.md
index 368beff8..3a40f7f7 100644
--- a/nullplatform/scope_definition_agent_association/README.md
+++ b/nullplatform/scope_definition_agent_association/README.md
@@ -22,7 +22,7 @@ The module fetches a notification channel JSON template via the `data.http` prov
```hcl
module "scope_definition_agent_association" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition_agent_association?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition_agent_association?ref=v6.20.0"
api_key = "your-api-key"
nrn = "your-nrn"
diff --git a/nullplatform/service_definition/README.md b/nullplatform/service_definition/README.md
index ff3842cb..7df99d7c 100644
--- a/nullplatform/service_definition/README.md
+++ b/nullplatform/service_definition/README.md
@@ -2,31 +2,60 @@
## Description
-Provisions a Nullplatform service specification with its associated action and link specifications by fetching JSON templates from GitHub, GitLab, Bitbucket, or a local filesystem
+Provisions nullplatform service, action, and link specifications by fetching JSON template files from a Git repository (GitHub, GitLab, Bitbucket) or local filesystem
## Architecture
-The module uses data.http resources to fetch service-spec, action, and link JSON templates from a remote git provider (GitHub, GitLab, or Bitbucket) or reads them from local files when git_provider is set to 'local'. Parsed template data flows into a nullplatform_service_specification resource, which is created first and provides its ID to nullplatform_action_specification and nullplatform_link_specification resources via depends_on. Authentication headers are constructed per-provider in locals (Bearer for GitHub, PRIVATE-TOKEN for GitLab, Basic or Bearer for Bitbucket) and passed to each data.http request.
+The module uses `data.http` resources to fetch `service-spec.json.tpl`, `actions/*.json.tpl`, and `links/*.json.tpl` template files from the configured Git provider using provider-specific raw content URLs and authentication headers built in locals. Parsed JSON from these HTTP responses (or local files when `git_provider = local`) flows into a `nullplatform_service_specification` resource, with dependent `nullplatform_action_specification` and `nullplatform_link_specification` resources created via `for_each` over the available action and link name lists. The service specification ID output from the primary resource is wired as input to both action and link specification resources via an explicit `depends_on` and the `service_specification_id` local.
## Features
-- Creates a nullplatform_service_specification resource from a JSON template with configurable name, type, attributes, selectors, and dimensions
-- Fetches service, action, and link spec templates from GitHub, GitLab, Bitbucket, or local filesystem based on git_provider
-- Creates nullplatform_action_specification resources for each entry in available_actions list using fetched templates
-- Creates nullplatform_link_specification resources for each entry in available_links list using fetched templates
-- Configures provider-specific authentication headers including Bearer tokens, GitLab PRIVATE-TOKEN, and Bitbucket HTTP Basic auth
-- Supports visibility scoping via NRN list combining the required nrn with optional extra_visibile_to_nrns
-- Outputs service specification ID and slug for use by downstream modules
+- Creates nullplatform_service_specification from a remote or local JSON template with configurable visibility via NRN list
+- Creates nullplatform_action_specification resources for each named action template fetched from the repository
+- Creates nullplatform_link_specification resources for each named link template fetched from the repository
+- Supports GitHub, GitLab, Bitbucket, and local filesystem as template sources with provider-specific URL construction and auth headers
+- Constructs GitHub raw content URLs with configurable ref namespace (heads, tags, or raw commit SHA) via repository_ref_type
+- Authenticates to Bitbucket using either HTTP Basic (Atlassian API token) or Bearer (workspace access token) depending on bitbucket_email presence
+- Validates HTTP responses with lifecycle postconditions to surface 401/403/404 errors as meaningful Terraform errors
## Basic Usage
```hcl
module "service_definition" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.20.0"
- nrn = "your-nrn"
- service_name = "your-service-name"
- service_path = "your-service-path"
+ nrn = "your-nrn"
+ repository_branch = "your-repository-branch"
+ service_name = "your-service-name"
+ service_path = "your-service-path"
+}
+```
+
+### Usage with GitHub Provider
+
+```hcl
+module "service_definition" {
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.20.0"
+
+ nrn = "your-nrn"
+ repository_branch = "main"
+ service_name = "your-service-name"
+ service_path = "your-service-path"
+}
+```
+
+### Usage with Pinned Branch or Tag
+
+```hcl
+module "service_definition" {
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.20.0"
+
+ git_provider = "your-git-provider" # Required when repository_branch = "v1.4.0"
+ nrn = "your-nrn"
+ repository_branch = "v1.4.0"
+ repository_ref_type = "your-repository-ref-type" # Required when repository_branch = "v1.4.0"
+ service_name = "your-service-name"
+ service_path = "your-service-path"
}
```
@@ -75,10 +104,10 @@ resource "example_resource" "this" {
| [gitlab\_host](#input\_gitlab\_host) | GitLab host. Only used when git\_provider = "gitlab". Override for self-hosted instances (e.g. "gitlab.mycompany.com"). | `string` | `"gitlab.com"` | no |
| [local\_specs\_path](#input\_local\_specs\_path) | Absolute path to the local service directory containing specs/. Required when git\_provider = "local". The directory must contain specs/service-spec.json.tpl and optionally specs/links/*.json.tpl and specs/actions/*.json.tpl. | `string` | `null` | no |
| [nrn](#input\_nrn) | Nullplatform Resource Name (organization:account format) | `string` | n/a | yes |
-| [repository\_branch](#input\_repository\_branch) | Branch of the service spec repository to use. Must be a short branch name (e.g. "main"), not a full ref. | `string` | `"main"` | no |
+| [repository\_branch](#input\_repository\_branch) | Git ref of the service spec repository to read, as a short name and not a full ref
(e.g. "v1.4.0"). No default and no recommended value: which spec repository an install
points at is its own choice, so there is no version anyone could pick for it.
Combine with repository\_ref\_type, which selects the namespace this name lives in. | `string` | n/a | yes |
| [repository\_name](#input\_repository\_name) | Repository name containing the service spec templates. | `string` | `"service"` | no |
| [repository\_org](#input\_repository\_org) | GitHub organization or GitLab group owning the service spec repository. | `string` | `"nullplatform"` | no |
-| [repository\_ref\_type](#input\_repository\_ref\_type) | Git ref namespace for `repository_branch` on GitHub: "heads" for a branch, "tags" for a tag, or "" to treat it as a raw commit SHA. Defaults to "heads", preserving previous behaviour. | `string` | `"heads"` | no |
+| [repository\_ref\_type](#input\_repository\_ref\_type) | Git ref namespace for `repository_branch` on GitHub: "heads" for a branch, "tags" for a tag, or "" to treat it as a raw commit SHA. Defaults to "heads", preserving previous behaviour. | `string` | `"tags"` | no |
| [repository\_token](#input\_repository\_token) | Access token for private repositories. GitHub: personal access token or fine-grained token. GitLab: Personal Access Token (PAT) with read\_api scope. | `string` | `null` | no |
| [service\_name](#input\_service\_name) | Name of the scope type to be created | `string` | n/a | yes |
| [service\_path](#input\_service\_path) | Path within the repository for the specific service (e.g., databases/postgres/k8s) | `string` | n/a | yes |
@@ -94,16 +123,16 @@ resource "example_resource" "this" {
diff --git a/nullplatform/service_definition_agent_association/README.md b/nullplatform/service_definition_agent_association/README.md
index c3b96eca..3a62f0e8 100644
--- a/nullplatform/service_definition_agent_association/README.md
+++ b/nullplatform/service_definition_agent_association/README.md
@@ -22,7 +22,7 @@ The module creates a terraform_data resource to track API key changes as a lifec
```hcl
module "service_definition_agent_association" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition_agent_association?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition_agent_association?ref=v6.20.0"
api_key = "your-api-key"
repository_service_spec_repo = "your-repository-service-spec-repo"
diff --git a/nullplatform/users/README.md b/nullplatform/users/README.md
index 4d3db281..30b4b0e1 100644
--- a/nullplatform/users/README.md
+++ b/nullplatform/users/README.md
@@ -21,7 +21,7 @@ The module iterates over a map of user definitions using `nullplatform_user` res
```hcl
module "users" {
- source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/users?ref=v6.19.1"
+ source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/users?ref=v6.20.0"
nullplatform_users = "your-nullplatform-users"
}