From 8d07ed22635586a4e30baec79fcbbe994b78ddf3 Mon Sep 17 00:00:00 2001 From: Gonzalo Rojas Date: Tue, 11 Aug 2026 11:11:06 -0300 Subject: [PATCH 01/81] fix(azure/aks_route_table): stable trigger instead of timestamp() (#474) (#493) `terraform_data.trigger` used `triggers_replace = timestamp()`, so it replaced on every plan and dragged `azapi_update_resource.aks_subnet_route_table` with it through `replace_triggered_by`. Combined with the vnet AVM subnet proposing `routeTable -> null` every plan, the azure stack never reached `No changes` (#474) and every apply detached/re-attached the route table on a live kubenet cluster. Key the trigger on the values that actually matter -- the node subnet id and the discovered route table id -- so it re-attaches only when the attachment really changes. The other half of #474 (the vnet detaching the route table) is already addressed by the `route_table` passthrough on `subnets_definition` (#475); document it here as the preferred, converging approach. Co-authored-by: Claude Opus 4.8 --- infrastructure/azure/aks_route_table/README.md | 10 ++++++---- infrastructure/azure/aks_route_table/main.tf | 4 +++- 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/infrastructure/azure/aks_route_table/README.md b/infrastructure/azure/aks_route_table/README.md index 89da8fdb3..6f76fe72e 100644 --- a/infrastructure/azure/aks_route_table/README.md +++ b/infrastructure/azure/aks_route_table/README.md @@ -2,17 +2,19 @@ ## Description -Associates the AKS-managed kubenet route table with a specified subnet by discovering and attaching it on every apply +Associates the AKS-managed kubenet route table with a specified subnet by discovering and attaching it. + +> **Prefer the vnet `route_table` passthrough.** When you control the node subnet through the `infrastructure/azure/vnet` module, declare the route table on that subnet via `subnets_definition[*].route_table` (#475) instead of using this module. That lets the subnet own the route table so the vnet stops proposing `routeTable -> null` on every plan, and the stack converges without a separate attach. This module remains for cases where the subnet is not managed through that vnet module. ## Architecture -The module uses an azurerm_resources data source to discover the route table created by AKS in the node resource group. A terraform_data resource with a timestamp trigger forces re-evaluation on every apply. The azapi_update_resource resource then patches the subnet identified by subnet_id using the Azure Network API to attach the discovered route table, with its lifecycle tied to the terraform_data trigger. +The module uses an azurerm_resources data source to discover the route table created by AKS in the node resource group. A terraform_data resource, keyed on the subnet id and the discovered route table id, triggers re-attachment only when that attachment actually changes. The azapi_update_resource resource then patches the subnet identified by subnet_id using the Azure Network API to attach the discovered route table, with its lifecycle tied to the terraform_data trigger. ## Features - Discovers the AKS-managed kubenet route table dynamically from the node resource group using azurerm_resources -- Patches the target subnet via azapi_update_resource to associate the route table on every Terraform apply -- Forces re-association on every apply using a timestamp-based terraform_data trigger to prevent drift +- Patches the target subnet via azapi_update_resource to associate the route table +- Re-attaches only when the subnet id or route table id changes, via a terraform_data trigger keyed on those values (not a per-plan `timestamp()`), so it no longer prevents the stack from converging - Outputs the resource ID of the discovered AKS-managed route table for downstream use ## Basic Usage diff --git a/infrastructure/azure/aks_route_table/main.tf b/infrastructure/azure/aks_route_table/main.tf index 27cde6e73..47c85a078 100644 --- a/infrastructure/azure/aks_route_table/main.tf +++ b/infrastructure/azure/aks_route_table/main.tf @@ -4,7 +4,9 @@ data "azurerm_resources" "aks_route_table" { } resource "terraform_data" "trigger" { - triggers_replace = timestamp() + # Key on the actual attachment (subnet + route table id), not timestamp(), + # which replaced every plan and kept the stack from converging (#474). + triggers_replace = [var.subnet_id, data.azurerm_resources.aks_route_table.resources[0].id] } resource "azapi_update_resource" "aks_subnet_route_table" { From 36f45406a7bde29126939739a19f7a9139f2d31a Mon Sep 17 00:00:00 2001 From: Gonzalo Rojas Date: Tue, 11 Aug 2026 11:23:35 -0300 Subject: [PATCH 02/81] fix(azure): make the internal gateway LB subnet configurable and grantable (#494) An AKS internal gateway sat at PROGRAMMED=False for days on a real install, with the service-controller retrying 582 times. Two module defects, and the first one disguises itself as the second. `internal_azure_load_balancer_subnet` defaulted to "load_balancer". That is the key a subnet typically has in a `subnets_definition` map, not its resource name, so the internal gateway got annotated with a subnet that does not exist. Azure answers a missing scope with 403 AuthorizationFailed ... over scope '.../subnets/load_balancer' or the scope is invalid which reads like missing RBAC and is not. Default to "" instead, matching the sibling `gateway_public_azure_load_balancer_subnet` ("empty by default, in which case Azure picks the subnet automatically"). The two variables disagreed. Also quote the value in the values template, like the public one already is, so an empty subnet renders `azure_load_balancer_subnet: ""` rather than a YAML null. And fixing the name alone still 403s, for real: the aks module hardcoded `network_contributor_role_assigned_subnet_ids` to the node subnet, so any other subnet the cloud-provider must write into -- the one an internal LB is pinned to -- had no permissions. Callers can now pass extra subnet IDs; the node subnet is still granted automatically and the default is empty, so nothing changes for existing callers. Tests: two runs mirroring the public-subnet ones, asserting the empty default and that a set value reaches the rendered internal block. 20 passed, 0 failed. Needs nullplatform/helm-charts#172 to ship first: the chart emits the subnet annotation unconditionally, so an empty value would render a null annotation until that guard lands. Co-authored-by: Claude Opus 5 (1M context) Co-authored-by: Sebastian Correa --- infrastructure/azure/aks/main.tf | 11 ++++++-- infrastructure/azure/aks/variables.tf | 6 +++++ .../nullplatform_base_values.tmpl.yaml | 2 +- .../base/tests/base_values.tftest.hcl | 27 +++++++++++++++++++ nullplatform/base/variables.tf | 4 +-- 5 files changed, 45 insertions(+), 5 deletions(-) diff --git a/infrastructure/azure/aks/main.tf b/infrastructure/azure/aks/main.tf index cddb69662..cff490c16 100644 --- a/infrastructure/azure/aks/main.tf +++ b/infrastructure/azure/aks/main.tf @@ -76,8 +76,15 @@ module "aks" { # attach_acr null (default) keeps the legacy "attach iff acr_id is non-null" behaviour; # setting it true makes the for_each key set plan-stable when acr_id is known-after-apply. - attached_acr_id_map = (var.attach_acr != null ? var.attach_acr : var.acr_id != null) ? { acr = var.acr_id } : {} - network_contributor_role_assigned_subnet_ids = { subnet = var.vnet_subnet_id } + attached_acr_id_map = (var.attach_acr != null ? var.attach_acr : var.acr_id != null) ? { acr = var.acr_id } : {} + # The node subnet is always needed. Anything else the cloud-provider has to + # write into -- typically the subnet an internal load balancer is pinned to -- + # has to be passed in, or provisioning that LB fails with a 403 on + # `virtualNetworks/subnets/read`. + network_contributor_role_assigned_subnet_ids = merge( + { subnet = var.vnet_subnet_id }, + var.additional_network_contributor_subnet_ids, + ) ############################################ # Tags diff --git a/infrastructure/azure/aks/variables.tf b/infrastructure/azure/aks/variables.tf index 8ab97999c..6655a868d 100644 --- a/infrastructure/azure/aks/variables.tf +++ b/infrastructure/azure/aks/variables.tf @@ -34,6 +34,12 @@ variable "vnet_subnet_id" { description = "The ID of the subnet where AKS nodes will be deployed" } +variable "additional_network_contributor_subnet_ids" { + type = map(string) + description = "Extra subnet IDs, keyed by an arbitrary stable name, where the cluster identity also needs Network Contributor. The node subnet is granted automatically; add an entry for any other subnet the cloud-provider must write into -- typically the one an internal load balancer is pinned to via service.beta.kubernetes.io/azure-load-balancer-internal-subnet, which otherwise fails to provision with a 403 on virtualNetworks/subnets/read." + default = {} +} + ############################################################################### # OPTIONAL VARIABLES - KUBERNETES CONFIGURATION ############################################################################### diff --git a/nullplatform/base/templates/nullplatform_base_values.tmpl.yaml b/nullplatform/base/templates/nullplatform_base_values.tmpl.yaml index 310f768ea..852d4c845 100644 --- a/nullplatform/base/templates/nullplatform_base_values.tmpl.yaml +++ b/nullplatform/base/templates/nullplatform_base_values.tmpl.yaml @@ -46,7 +46,7 @@ gateway: oci: securityListManagementMode: "${gateway_private_oci_security_list_management_mode}" subnet: "${gateway_private_oci_subnet}" - azure_load_balancer_subnet: ${gateway_internal_azure_load_balancer_subnet} + azure_load_balancer_subnet: "${gateway_internal_azure_load_balancer_subnet}" loadBalancerSourceRanges: [] addresses: {} autoscaling: diff --git a/nullplatform/base/tests/base_values.tftest.hcl b/nullplatform/base/tests/base_values.tftest.hcl index 7ed689f20..fb129d113 100644 --- a/nullplatform/base/tests/base_values.tftest.hcl +++ b/nullplatform/base/tests/base_values.tftest.hcl @@ -283,3 +283,30 @@ run "gateway_public_azure_load_balancer_subnet" { error_message = "public gateway azure subnet should be wired into the rendered public.azure block" } } + +run "internal_azure_load_balancer_subnet_defaults_to_empty" { + command = plan + + # The old default was the literal "load_balancer", which is the key a subnet + # usually has in a subnets_definition map rather than its resource name. That + # annotated the internal gateway with a subnet that does not exist, and Azure + # answers a missing scope with 403 AuthorizationFailed, which reads like an + # RBAC problem instead of a wrong name. Empty lets Azure pick the subnet. + assert { + condition = strcontains(output.rendered_values, "azure_load_balancer_subnet: \"\"") + error_message = "internal gateway azure subnet should default to empty so Azure selects the subnet" + } +} + +run "internal_azure_load_balancer_subnet" { + command = plan + + variables { + internal_azure_load_balancer_subnet = "subnet-4" + } + + assert { + condition = strcontains(output.rendered_values, "azure_load_balancer_subnet: \"subnet-4\"") + error_message = "internal gateway azure subnet should be wired into the rendered internal block" + } +} diff --git a/nullplatform/base/variables.tf b/nullplatform/base/variables.tf index 992932760..599de86db 100644 --- a/nullplatform/base/variables.tf +++ b/nullplatform/base/variables.tf @@ -76,9 +76,9 @@ variable "gateway_public_name" { } variable "internal_azure_load_balancer_subnet" { - description = "The name of the subnet to use in azure private load balancer" + description = "Name of the subnet for the internal gateway's Azure load balancer. Empty by default, in which case Azure picks the subnet automatically. Must be the subnet's resource name (e.g. \"subnet-4\"), not the key it has in a subnets_definition map." type = string - default = "load_balancer" + default = "" } variable "gateway_public_load_balancer_type" { From e322e091f6abeb9ad7c2e8e1276ad8ebd0a9a556 Mon Sep 17 00:00:00 2001 From: Sebastian Correa Date: Tue, 11 Aug 2026 15:06:35 -0300 Subject: [PATCH 03/81] ci: temporary dual release line (package -> 7.x, resto -> 6.x) (#498) * ci: allow package/* branches and enable checks on 6.x line * ci: enforce correct base branch per branch type (package vs 6.x) * ci: temporarily block breaking-change commits on all branches * chore: allow package/* branches and exempt 6.x in local pre-commit hook * ci: run release-please on both main and 6.x lines * ci: auto-merge release PRs from either the main or 6.x release line Co-Authored-By: Claude Sonnet 5 * fix(ci): prevent script injection in auto-merge-release workflow Move github.event.workflow_run.head_branch into env block to prevent direct interpolation into bash script. Aligns with patterns used in commitlint.yml and no-breaking-changes.yml. Co-Authored-By: Claude Sonnet 5 * ci: run tofu lint on PRs targeting 6.x too * ci: run tofu tests on PRs targeting 6.x too Co-Authored-By: Claude Sonnet 5 * ci: run trivy scan on the 6.x line too * ci: run unused-declaration check on PRs targeting 6.x too * docs: add executable rollback runbook for the temporary dual release line --------- Co-authored-by: sebas_correa Co-authored-by: Claude Sonnet 5 --- .github/workflows/auto-merge-release.yml | 3 +- .github/workflows/commitlint.yml | 57 +++++++- .github/workflows/linter.yml | 2 +- .github/workflows/release.yml | 9 +- .github/workflows/tflint-unused.yml | 2 +- .github/workflows/tofu-test.yml | 2 +- .github/workflows/trivy.yml | 2 + .husky/pre-commit | 8 +- docs/ci/dual-release-line-rollback.md | 157 +++++++++++++++++++++++ 9 files changed, 229 insertions(+), 13 deletions(-) create mode 100644 docs/ci/dual-release-line-rollback.md diff --git a/.github/workflows/auto-merge-release.yml b/.github/workflows/auto-merge-release.yml index a55e909a0..fc2c328bd 100644 --- a/.github/workflows/auto-merge-release.yml +++ b/.github/workflows/auto-merge-release.yml @@ -40,11 +40,12 @@ jobs: env: GH_TOKEN: ${{ github.token }} REPO_OWNER: ${{ github.repository_owner }} + HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }} run: | PR_JSON=$(gh api "repos/${{ github.repository }}/pulls" \ -X GET \ -f state=open \ - -f "head=${REPO_OWNER}:release-please--branches--main" \ + -f "head=${REPO_OWNER}:release-please--branches--${HEAD_BRANCH}" \ --jq '.[0] // empty') if [ -z "$PR_JSON" ]; then diff --git a/.github/workflows/commitlint.yml b/.github/workflows/commitlint.yml index b6fb2b13b..d3e1f07f0 100644 --- a/.github/workflows/commitlint.yml +++ b/.github/workflows/commitlint.yml @@ -2,14 +2,69 @@ name: Commitlint on: pull_request: - branches: [ main ] + branches: [ main, 6.x ] types: [opened, synchronize, reopened] jobs: branch-name: if: ${{ !startsWith(github.head_ref, 'release-please--') && !startsWith(github.head_ref, 'dependabot/') }} uses: nullplatform/actions-nullplatform/.github/workflows/branch-validation.yml@main + with: + pattern: '^(feat|feature|fix|docs|style|refactor|perf|test|build|ci|chore|revert|package)/.+$' commitlint: if: ${{ !startsWith(github.head_ref, 'release-please--') && !startsWith(github.head_ref, 'dependabot/') }} uses: nullplatform/actions-nullplatform/.github/workflows/conventional-commit.yml@main + + base-branch-check: + name: Validate base branch for branch type + if: ${{ !startsWith(github.head_ref, 'release-please--') && !startsWith(github.head_ref, 'dependabot/') }} + runs-on: ubuntu-24.04 + steps: + - name: Check base branch matches branch type + env: + HEAD_BRANCH: ${{ github.head_ref }} + BASE_BRANCH: ${{ github.base_ref }} + run: | + # ci/* queda exceptuada: los cambios de infraestructura de CI no + # están atados a una línea de versión, se propagan a mano entre + # main y 6.x cuando hace falta (ver Tarea 14 del plan de este cambio). + if [[ "$HEAD_BRANCH" == ci/* ]]; then + echo "Branch '$HEAD_BRANCH' is a CI/infra branch — base branch rule not enforced." + exit 0 + fi + + if [[ "$HEAD_BRANCH" == package/* ]]; then + if [[ "$BASE_BRANCH" != "main" ]]; then + echo "::error::package/* branches must target 'main', not '$BASE_BRANCH'." + exit 1 + fi + else + if [[ "$BASE_BRANCH" != "6.x" ]]; then + echo "::error::Only package/* branches may target 'main'. '$HEAD_BRANCH' must target '6.x', not '$BASE_BRANCH'." + exit 1 + fi + fi + + echo "Base branch '$BASE_BRANCH' is correct for '$HEAD_BRANCH'." + + no-breaking-changes: + name: Block breaking changes (temporary policy) + if: ${{ !startsWith(github.head_ref, 'release-please--') && !startsWith(github.head_ref, 'dependabot/') }} + runs-on: ubuntu-24.04 + permissions: + pull-requests: read + steps: + - name: Scan PR commits for breaking-change markers + env: + GH_TOKEN: ${{ github.token }} + PR_NUMBER: ${{ github.event.pull_request.number }} + run: | + gh api "repos/${{ github.repository }}/pulls/$PR_NUMBER/commits" --jq '.[].commit.message' > commit_messages.txt + + if grep -qE '^[a-zA-Z]+(\([^)]*\))?!:' commit_messages.txt || grep -qE 'BREAKING[ -]CHANGE:' commit_messages.txt; then + echo "::error::Breaking changes are temporarily blocked on this repository (no '!:' headers or 'BREAKING CHANGE:'/'BREAKING-CHANGE:' footers allowed on any branch)." + exit 1 + fi + + echo "No breaking-change markers found." diff --git a/.github/workflows/linter.yml b/.github/workflows/linter.yml index 174f1ad41..6b8a44c12 100644 --- a/.github/workflows/linter.yml +++ b/.github/workflows/linter.yml @@ -2,7 +2,7 @@ name: OpenTofu on: pull_request: - branches: [ main ] + branches: [ main, 6.x ] types: [opened, synchronize, reopened] jobs: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index bff94b789..53da53cdc 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -4,9 +4,10 @@ on: push: branches: - main + - 6.x concurrency: - group: main-branch-push + group: release-${{ github.ref_name }} cancel-in-progress: false jobs: @@ -33,7 +34,7 @@ jobs: run: | PR_NUMBER=$(gh pr list \ --repo ${{ github.repository }} \ - --head release-please--branches--main \ + --head release-please--branches--${{ github.ref_name }} \ --state open \ --json number \ --jq '.[0].number // empty') @@ -51,7 +52,7 @@ jobs: if: steps.check_pr.outputs.pr_exists == 'true' uses: actions/checkout@v6 with: - ref: release-please--branches--main + ref: release-please--branches--${{ github.ref_name }} fetch-depth: 0 - name: Detect changed modules @@ -166,7 +167,7 @@ jobs: else git commit -m "docs: update version references in READMEs" fi - git push origin release-please--branches--main + git push origin release-please--branches--${{ github.ref_name }} echo "READMEs updated in Release PR #${{ steps.check_pr.outputs.pr_number }}" fi env: diff --git a/.github/workflows/tflint-unused.yml b/.github/workflows/tflint-unused.yml index 61e169ce3..b2be4f8f5 100644 --- a/.github/workflows/tflint-unused.yml +++ b/.github/workflows/tflint-unused.yml @@ -2,7 +2,7 @@ name: tflint-unused-declarations on: pull_request: - branches: [ main ] + branches: [ main, 6.x ] types: [opened, synchronize, reopened] jobs: diff --git a/.github/workflows/tofu-test.yml b/.github/workflows/tofu-test.yml index 9ad421932..8e4e97e7f 100644 --- a/.github/workflows/tofu-test.yml +++ b/.github/workflows/tofu-test.yml @@ -2,7 +2,7 @@ name: Tofu Unit Tests on: pull_request: - branches: [ main ] + branches: [ main, 6.x ] types: [opened, synchronize, reopened] jobs: diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml index ae956986f..e1b51c93a 100644 --- a/.github/workflows/trivy.yml +++ b/.github/workflows/trivy.yml @@ -4,9 +4,11 @@ on: pull_request: branches: - main + - 6.x push: branches: - main + - 6.x paths: - '**/*.tf' diff --git a/.husky/pre-commit b/.husky/pre-commit index 652d36178..de7000db7 100755 --- a/.husky/pre-commit +++ b/.husky/pre-commit @@ -22,14 +22,14 @@ fi # Validate branch name BRANCH=$(git rev-parse --abbrev-ref HEAD) -PATTERN="^(feat|feature|fix|docs|style|refactor|perf|test|build|ci|chore|revert)/.+$" +PATTERN="^(feat|feature|fix|docs|style|refactor|perf|test|build|ci|chore|revert|package)/.+$" -if [ "$BRANCH" != "main" ] && ! echo "$BRANCH" | grep -Eq "$PATTERN"; then +if [ "$BRANCH" != "main" ] && [ "$BRANCH" != "6.x" ] && ! echo "$BRANCH" | grep -Eq "$PATTERN"; then echo "Invalid branch name: $BRANCH" echo "" echo "Branch name must follow the pattern: type/description" - echo " Examples: feat/add-login, fix/bug-123, docs/readme" + echo " Examples: feat/add-login, fix/bug-123, docs/readme, package/add-lambda" echo "" - echo "Valid types: feat, feature, fix, docs, style, refactor, perf, test, build, ci, chore, revert" + echo "Valid types: feat, feature, fix, docs, style, refactor, perf, test, build, ci, chore, revert, package" exit 1 fi diff --git a/docs/ci/dual-release-line-rollback.md b/docs/ci/dual-release-line-rollback.md new file mode 100644 index 000000000..f7e4567c7 --- /dev/null +++ b/docs/ci/dual-release-line-rollback.md @@ -0,0 +1,157 @@ +# Rollback runbook: dual release line (`package` → 7.x, resto → 6.x) + +> **Para un agente (Claude u otro) que llega a este archivo sin contexto previo de la conversación en la que se creó:** este documento es autosuficiente. Seguí los pasos en orden. Antes de ejecutar CUALQUIER paso marcado como destructivo o visible para otros (push, merge, borrar una rama), **confirmá explícitamente con la persona que te pidió el rollback** — no asumas autorización solo por la existencia de este archivo. + +## Qué es esto y por qué existe + +En 2026-08 se introdujo un esquema temporal de doble línea de versión en este +repo: +- Ramas `package/*` → mergean a `main` → tagean sobre la línea `7.x`. +- Cualquier otra rama (`feat/*`, `fix/*`, `docs/*`, etc.) → mergean a una + rama larga `6.x` (forkeada del tag `v6.11.2`) → tagean sobre la línea + `6.x`. +- Breaking changes bloqueados en ambas líneas (sin excepción). + +El motivo: `main` ya tenía publicado `v7.0.0` con un breaking change real +(PR #491), y se necesitaba seguir dando soporte/lanzando fixes y features +normales sin forzar a esos consumidores a saltar de major, mientras el +trabajo que sí requería la nueva major avanzaba de forma aislada en +`package/*`. + +**Esto es temporal por diseño.** Este runbook describe cómo desarmarlo +cuando el equipo decida que ya no hace falta. + +## Lo que este rollback SÍ hace y lo que NO hace + +- **SÍ**: elimina los checks y triggers de CI agregados (el chequeo de base + branch, el bloqueo de breaking changes, el `package` en el pattern de + branch-validation, los triggers extra de `6.x` en todos los workflows). +- **NO**: borra la rama `6.x` ni ninguno de sus commits/tags/releases. Todo + el trabajo real (fixes, features, releases 6.x.x) que se haya mergeado a + `6.x` mientras este esquema estuvo activo queda intacto — revertir la + infraestructura de CI no revierte el trabajo de producto hecho sobre esa + línea. +- La decisión de **qué hacer con la rama `6.x` en sí** (archivarla, seguir + manteniéndola, mergearla hacia `main`, promoverla a nuevo `main`, etc.) es + una decisión de negocio/arquitectura que este runbook NO toma por vos — + ver la sección "Decisión pendiente: destino de `6.x`" al final. + +## Paso 1: Encontrar el commit que introdujo este esquema + +El PR que introdujo esto se tituló `"ci: temporary dual release line +(package -> 7.x, resto -> 6.x)"` y se mergeó con `--squash`, por lo que en +`main` quedó como un único commit con ese texto. El mismo commit se +propagó a `6.x` vía `cherry-pick` (mismo mensaje, otro SHA). + +Run: +```bash +git fetch origin -q +git log --oneline --all --grep="dual release line" +``` +Esto debería mostrar dos commits: uno alcanzable desde `main`, otro desde +`6.x`. Anotá ambos SHAs. + +## Paso 2: Revertir en `main` + +Run: +```bash +git checkout main && git pull origin main -q +git revert --no-edit +``` +Si el revert aplica limpio, seguí al Paso 4. Si hay conflictos (porque +alguno de estos archivos se modificó después por otro motivo), resolvelos +usando la sección "Fallback manual" de abajo como referencia de qué +contenido final se espera en cada archivo, y después: +```bash +git add +git revert --continue +``` + +## Paso 3: Revertir en `6.x` + +Run: +```bash +git checkout 6.x && git pull origin 6.x -q +git revert --no-edit +``` +Mismo criterio que el Paso 2 si hay conflictos. + +## Paso 4: Push (requiere confirmación explícita antes de ejecutar) + +```bash +git push origin main +git push origin 6.x +``` + +## Fallback manual (si `git revert` no aplica limpio) + +Si por conflictos preferís revertir a mano, estos son los cambios exactos a +deshacer, archivo por archivo: + +### `.github/workflows/commitlint.yml` +- Volver `on.pull_request.branches` a `[ main ]` (sacar `6.x`). +- Sacar el bloque `with: pattern: ...` del job `branch-name` (que vuelva a + usar el pattern default de la reusable workflow, sin `package`). +- Borrar los jobs `base-branch-check` y `no-breaking-changes` completos. + +### `.husky/pre-commit` +- Volver `PATTERN` a: + `"^(feat|feature|fix|docs|style|refactor|perf|test|build|ci|chore|revert)/.+$"` + (sacar `|package`). +- Volver la condición a: + `if [ "$BRANCH" != "main" ] && ! echo "$BRANCH" | grep -Eq "$PATTERN"; then` + (sacar `&& [ "$BRANCH" != "6.x" ]`). +- Sacar `package` de la lista impresa de "Valid types". + +### `.github/workflows/release.yml` +- Volver el trigger a: + ```yaml + on: + push: + branches: + - main + ``` +- Volver la concurrency a: + ```yaml + concurrency: + group: main-branch-push + cancel-in-progress: false + ``` +- Volver las 3 referencias `release-please--branches--${{ github.ref_name }}` + a `release-please--branches--main` (literal). + +### `.github/workflows/auto-merge-release.yml` +- Volver `-f "head=${REPO_OWNER}:release-please--branches--${{ github.event.workflow_run.head_branch }}"` + a `-f "head=${REPO_OWNER}:release-please--branches--main"` (literal). + +### `.github/workflows/linter.yml`, `.github/workflows/tofu-test.yml`, `.github/workflows/tflint-unused.yml` +- Volver `branches: [ main, 6.x ]` a `branches: [ main ]` en cada uno. + +### `.github/workflows/trivy.yml` +- Volver ambos triggers (`pull_request.branches` y `push.branches`) de + `[main, 6.x]` a `[main]`. + +### Este mismo archivo y su compañero de diseño +- Este runbook puede borrarse del repo una vez completado el rollback, o + dejarse como registro histórico — a criterio del equipo. + +## Decisión pendiente: destino de la rama `6.x` + +Este runbook deliberadamente NO incluye pasos automáticos para esto, porque +depende de una decisión de producto/arquitectura que no se puede inferir +del código: + +- **Si `7.x`/`package` convergió y es la única línea futura**: comunicar al + equipo que `6.x` queda congelada/deprecada. Evaluar si conviene mergear + el historial de `6.x` hacia `main` primero (para no perder fixes que solo + existan ahí) antes de archivar o borrar la rama. Borrar una rama con + historial real requiere confirmación explícita — no lo hagas sin + preguntar. +- **Si se decide mantener `6.x` como línea de soporte de largo plazo**: este + rollback de CI puede no ser lo que se quiere — replantear con quien pidió + el rollback si realmente quiere sacar el mecanismo o solo ajustarlo. +- **Si se decide que `6.x` pasa a ser la línea principal** (descartando el + trabajo de `7.x`/`package`): esto es un cambio mucho más invasivo + (reescribir qué rama es el default branch del repo, qué pasa con los + tags `7.x` ya publicados, etc.) — fuera del alcance de este runbook, + pedir instrucciones explícitas antes de tocar nada. From 895385ee0c76802b1773d07cf80ba5420d766ddf Mon Sep 17 00:00:00 2001 From: Sebastian Correa Date: Tue, 11 Aug 2026 16:05:45 -0300 Subject: [PATCH 04/81] fix(ci): correct release-please target-branch resolution for the dual release line scheme (#504) * fix(ci): correct release-please target-branch resolution for the dual release line scheme release-please-action's target-branch input defaults to the repository's default branch, not github.ref_name, so pushes to 6.x were silently computing versions against main's history instead of 6.x's. Also hardens the breaking-change scanner (paginate past 30 commits, also check the PR title since this repo squash-merges using it) and hoists github.ref_name out of two run: blocks into env vars. * fix(docs): scope rollback runbook's commit search to main/6.x only Paso 1's git log --all --grep picked up a false positive from a stale pre-squash feature branch, with no way for an unsupervised agent to tell it apart from the real main/6.x commits. Scope the search per-branch instead, and clarify Paso 2's "repetir por cada SHA" flow accordingly. --------- Co-authored-by: sebas_correa --- .github/workflows/commitlint.yml | 8 ++-- .github/workflows/release.yml | 27 ++++++++--- docs/ci/dual-release-line-rollback.md | 65 ++++++++++++++++++++------- 3 files changed, 75 insertions(+), 25 deletions(-) diff --git a/.github/workflows/commitlint.yml b/.github/workflows/commitlint.yml index d3e1f07f0..e94bfe433 100644 --- a/.github/workflows/commitlint.yml +++ b/.github/workflows/commitlint.yml @@ -55,15 +55,17 @@ jobs: permissions: pull-requests: read steps: - - name: Scan PR commits for breaking-change markers + - name: Scan PR commits and title for breaking-change markers env: GH_TOKEN: ${{ github.token }} PR_NUMBER: ${{ github.event.pull_request.number }} + PR_TITLE: ${{ github.event.pull_request.title }} run: | - gh api "repos/${{ github.repository }}/pulls/$PR_NUMBER/commits" --jq '.[].commit.message' > commit_messages.txt + gh api --paginate "repos/${{ github.repository }}/pulls/$PR_NUMBER/commits" --jq '.[].commit.message' > commit_messages.txt + echo "$PR_TITLE" >> commit_messages.txt if grep -qE '^[a-zA-Z]+(\([^)]*\))?!:' commit_messages.txt || grep -qE 'BREAKING[ -]CHANGE:' commit_messages.txt; then - echo "::error::Breaking changes are temporarily blocked on this repository (no '!:' headers or 'BREAKING CHANGE:'/'BREAKING-CHANGE:' footers allowed on any branch)." + echo "::error::Breaking changes are temporarily blocked on this repository (no '!:' headers or 'BREAKING CHANGE:'/'BREAKING-CHANGE:' footers allowed on any branch, in commit messages OR in the PR title — this repo squash-merges using the PR title as the final commit message)." exit 1 fi diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 53da53cdc..5e9ffde37 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -12,12 +12,23 @@ concurrency: jobs: release: - uses: nullplatform/actions-nullplatform/.github/workflows/release.yml@main + name: Release Please + runs-on: ubuntu-24.04 permissions: contents: write pull-requests: write - with: - update_readme_versions: false + env: + FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true + steps: + - name: Checkout repository + uses: actions/checkout@v6 + + - name: Release + id: release + uses: googleapis/release-please-action@v5 + with: + release-type: terraform-module + target-branch: ${{ github.ref_name }} generate-readmes: name: Generate READMEs for Release PR @@ -31,10 +42,11 @@ jobs: id: check_pr env: GH_TOKEN: ${{ github.token }} + REF_NAME: ${{ github.ref_name }} run: | PR_NUMBER=$(gh pr list \ --repo ${{ github.repository }} \ - --head release-please--branches--${{ github.ref_name }} \ + --head "release-please--branches--${REF_NAME}" \ --state open \ --json number \ --jq '.[0].number // empty') @@ -153,6 +165,9 @@ jobs: - name: Commit and push if: steps.check_pr.outputs.pr_exists == 'true' + env: + HUSKY: 0 + REF_NAME: ${{ github.ref_name }} run: | git config user.email "github-actions[bot]@users.noreply.github.com" git config user.name "github-actions[bot]" @@ -167,8 +182,6 @@ jobs: else git commit -m "docs: update version references in READMEs" fi - git push origin release-please--branches--${{ github.ref_name }} + git push origin "release-please--branches--${REF_NAME}" echo "READMEs updated in Release PR #${{ steps.check_pr.outputs.pr_number }}" fi - env: - HUSKY: 0 diff --git a/docs/ci/dual-release-line-rollback.md b/docs/ci/dual-release-line-rollback.md index f7e4567c7..3b886ab9b 100644 --- a/docs/ci/dual-release-line-rollback.md +++ b/docs/ci/dual-release-line-rollback.md @@ -21,6 +21,17 @@ trabajo que sí requería la nueva major avanzaba de forma aislada en **Esto es temporal por diseño.** Este runbook describe cómo desarmarlo cuando el equipo decida que ya no hace falta. +**Nota de un fix de seguimiento:** la primera versión de este esquema tenía +un bug real — `release-please-action` no calculaba versión sobre `6.x`, +sino sobre `main`, porque `target-branch` no se pasaba explícito y por +default cae en la rama default del repo (no en la rama que disparó el +workflow, como se asumió originalmente). Un commit de seguimiento (mismo +substring "dual release line" en el título) lo corrigió pasando +`target-branch: ${{ github.ref_name }}`, y de paso separó el job `release` +de este repo del workflow reusable de `actions-nullplatform` (que no +expone ese input) para poder setearlo. Ver Paso 1 para encontrar todos los +commits relevantes. + ## Lo que este rollback SÍ hace y lo que NO hace - **SÍ**: elimina los checks y triggers de CI agregados (el chequeo de base @@ -36,29 +47,35 @@ cuando el equipo decida que ya no hace falta. una decisión de negocio/arquitectura que este runbook NO toma por vos — ver la sección "Decisión pendiente: destino de `6.x`" al final. -## Paso 1: Encontrar el commit que introdujo este esquema +## Paso 1: Encontrar los commits que introdujeron/ajustaron este esquema -El PR que introdujo esto se tituló `"ci: temporary dual release line -(package -> 7.x, resto -> 6.x)"` y se mergeó con `--squash`, por lo que en -`main` quedó como un único commit con ese texto. El mismo commit se -propagó a `6.x` vía `cherry-pick` (mismo mensaje, otro SHA). +El esquema se introdujo en un PR titulado `"ci: temporary dual release line +(package -> 7.x, resto -> 6.x)"`, mergeado con `--squash` (un único commit +en `main`, propagado a `6.x` vía `cherry-pick`). Después recibió un fix de +seguimiento (mismo substring "dual release line" en el título) que corrige +el cálculo de versión de la línea `6.x` (ver más abajo) y agrega hardening +adicional. Puede haber más de un commit relevante por rama — buscá todos: -Run: +Run (por separado en cada rama, para no mezclar commits que no pertenecen +a ninguna de las dos líneas): ```bash git fetch origin -q -git log --oneline --all --grep="dual release line" +git log --oneline origin/main --grep="dual release line" +git log --oneline origin/6.x --grep="dual release line" ``` -Esto debería mostrar dos commits: uno alcanzable desde `main`, otro desde -`6.x`. Anotá ambos SHAs. +Anotá los SHAs de cada comando por separado. Si hay más de uno por rama, +revertilos en los Pasos 2/3 **del más nuevo al más viejo** (un `git revert` +por SHA, en ese orden). ## Paso 2: Revertir en `main` -Run: +Run (repetir por cada SHA encontrado en `main`, del más nuevo al más viejo): ```bash git checkout main && git pull origin main -q git revert --no-edit ``` -Si el revert aplica limpio, seguí al Paso 4. Si hay conflictos (porque +Cuando termines de revertir todos los SHAs encontrados en `main`, seguí al +Paso 3/4. Si algún revert tiene conflictos (porque alguno de estos archivos se modificó después por otro motivo), resolvelos usando la sección "Fallback manual" de abajo como referencia de qué contenido final se espera en cada archivo, y después: @@ -69,7 +86,7 @@ git revert --continue ## Paso 3: Revertir en `6.x` -Run: +Run (repetir por cada SHA encontrado en `6.x`, del más nuevo al más viejo): ```bash git checkout 6.x && git pull origin 6.x -q git revert --no-edit @@ -117,11 +134,29 @@ deshacer, archivo por archivo: group: main-branch-push cancel-in-progress: false ``` -- Volver las 3 referencias `release-please--branches--${{ github.ref_name }}` - a `release-please--branches--main` (literal). +- Volver el job `release` a delegar en el workflow reusable (un fix de + seguimiento lo cambió para llamar a `googleapis/release-please-action@v5` + directo, porque necesitaba pasarle `target-branch` y el workflow reusable + de `actions-nullplatform` no expone ese input): + ```yaml + release: + uses: nullplatform/actions-nullplatform/.github/workflows/release.yml@main + permissions: + contents: write + pull-requests: write + with: + update_readme_versions: false + ``` +- En el job `generate-readmes`, sacar los `env: REF_NAME: ${{ github.ref_name }}` + que el fix de seguimiento agregó en los steps "Check if Release Please PR + exists" y "Commit and push", y volver a interpolar `${{ github.ref_name }}` + directo en esos dos `run:`, con el valor final literal + `release-please--branches--main` en ambos. ### `.github/workflows/auto-merge-release.yml` -- Volver `-f "head=${REPO_OWNER}:release-please--branches--${{ github.event.workflow_run.head_branch }}"` +- Sacar `HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}` del + bloque `env:` del step (quedan solo `GH_TOKEN` y `REPO_OWNER`). +- Volver `-f "head=${REPO_OWNER}:release-please--branches--${HEAD_BRANCH}"` a `-f "head=${REPO_OWNER}:release-please--branches--main"` (literal). ### `.github/workflows/linter.yml`, `.github/workflows/tofu-test.yml`, `.github/workflows/tflint-unused.yml` From d927286ec705e907bf96b3d751ea0cc9921e50f8 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 11 Aug 2026 19:07:27 +0000 Subject: [PATCH 05/81] chore(6.x): release 6.11.3 --- CHANGELOG.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 199a4e207..e2c77e8d2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,14 @@ # Changelog +## [6.11.3](https://github.com/nullplatform/tofu-modules/compare/v6.11.2...v6.11.3) (2026-08-11) + + +### Bug Fixes + +* **azure/aks_route_table:** stable trigger instead of timestamp() ([#474](https://github.com/nullplatform/tofu-modules/issues/474)) ([#493](https://github.com/nullplatform/tofu-modules/issues/493)) ([8d07ed2](https://github.com/nullplatform/tofu-modules/commit/8d07ed22635586a4e30baec79fcbbe994b78ddf3)) +* **azure:** make the internal gateway LB subnet configurable and grantable ([#494](https://github.com/nullplatform/tofu-modules/issues/494)) ([36f4540](https://github.com/nullplatform/tofu-modules/commit/36f45406a7bde29126939739a19f7a9139f2d31a)) +* **ci:** correct release-please target-branch resolution for the dual release line scheme ([#504](https://github.com/nullplatform/tofu-modules/issues/504)) ([895385e](https://github.com/nullplatform/tofu-modules/commit/895385ee0c76802b1773d07cf80ba5420d766ddf)) + ## [6.11.2](https://github.com/nullplatform/tofu-modules/compare/v6.11.1...v6.11.2) (2026-08-07) From ddd10192dc3790dbcd86f91b5d8fb89bf0e57ba7 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Tue, 11 Aug 2026 19:08:33 +0000 Subject: [PATCH 06/81] docs: regenerate READMEs for changed modules and update versions --- infrastructure/aws/acm/README.md | 2 +- .../aws_load_balancer_controller/README.md | 2 +- infrastructure/aws/backend/README.md | 2 +- infrastructure/aws/dns/README.md | 2 +- infrastructure/aws/eks/README.md | 2 +- infrastructure/aws/iam/agent/README.md | 2 +- .../README.md | 2 +- infrastructure/aws/iam/cert_manager/README.md | 2 +- .../aws/iam/ci-build-workflow-user/README.md | 2 +- infrastructure/aws/iam/cloudwatch/README.md | 2 +- infrastructure/aws/iam/ecr/README.md | 2 +- infrastructure/aws/iam/external_dns/README.md | 2 +- infrastructure/aws/iam/s3/README.md | 2 +- infrastructure/aws/ingress/README.md | 2 +- infrastructure/aws/security/README.md | 2 +- infrastructure/aws/vpc/README.md | 2 +- infrastructure/azure/acr/README.md | 2 +- infrastructure/azure/aks/README.md | 42 ++++++++------ .../azure/aks_route_table/README.md | 30 +++++----- infrastructure/azure/dns/README.md | 2 +- infrastructure/azure/iam/README.md | 2 +- infrastructure/azure/private_dns/README.md | 2 +- infrastructure/azure/resource_group/README.md | 2 +- infrastructure/azure/security/README.md | 2 +- infrastructure/azure/vnet/README.md | 2 +- infrastructure/commons/cert_manager/README.md | 12 ++-- infrastructure/commons/external_dns/README.md | 12 ++-- infrastructure/commons/istio/README.md | 2 +- infrastructure/commons/prometheus/README.md | 2 +- .../gcp/artifact-registry/README.md | 2 +- infrastructure/gcp/cloud-dns/README.md | 2 +- infrastructure/gcp/cloud-nat/README.md | 2 +- infrastructure/gcp/gke/README.md | 2 +- infrastructure/gcp/iam/README.md | 2 +- infrastructure/gcp/security/README.md | 2 +- infrastructure/gcp/vpc/README.md | 2 +- infrastructure/oci/backend/README.md | 2 +- infrastructure/oci/dns/README.md | 2 +- infrastructure/oci/dynamic_groups/README.md | 2 +- infrastructure/oci/oke/README.md | 2 +- infrastructure/oci/vcn/README.md | 2 +- nullplatform/account/README.md | 2 +- nullplatform/agent/README.md | 10 ++-- nullplatform/api_key/README.md | 10 ++-- nullplatform/asset/docker_server/README.md | 2 +- nullplatform/asset/ecr/README.md | 2 +- nullplatform/asset/s3/README.md | 2 +- nullplatform/base/README.md | 56 +++++++++---------- nullplatform/cloud/aws/cloud/README.md | 2 +- nullplatform/cloud/aws/vpc/README.md | 2 +- nullplatform/cloud/azure/cloud/README.md | 2 +- nullplatform/cloud/gcp/cloud/README.md | 2 +- nullplatform/cloud/oci/cloud/README.md | 2 +- nullplatform/code_repository/README.md | 10 ++-- .../container_orchestration/aks/README.md | 2 +- .../container_orchestration/eks/README.md | 2 +- .../container_orchestration/gke/README.md | 2 +- .../container_orchestration/oke/README.md | 2 +- nullplatform/dimension/README.md | 2 +- nullplatform/dimension_value/README.md | 2 +- .../identity-access-control/README.md | 2 +- nullplatform/metrics/README.md | 2 +- nullplatform/packaged_service/README.md | 2 +- .../parameter_storage_configuration/README.md | 2 +- .../parameter_storage_definition/README.md | 2 +- .../README.md | 2 +- nullplatform/scope_configuration/README.md | 2 +- nullplatform/scope_definition/README.md | 2 +- .../README.md | 2 +- nullplatform/service_definition/README.md | 2 +- .../README.md | 2 +- nullplatform/users/README.md | 2 +- 72 files changed, 157 insertions(+), 153 deletions(-) diff --git a/infrastructure/aws/acm/README.md b/infrastructure/aws/acm/README.md index b2b7ccefd..886bd4b1d 100644 --- a/infrastructure/aws/acm/README.md +++ b/infrastructure/aws/acm/README.md @@ -18,7 +18,7 @@ The module creates an aws_acm_certificate resource with DNS validation, which is ```hcl module "acm" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/acm?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/acm?ref=v6.11.3" domain_name = "your-domain-name" zone_id = "your-zone-id" diff --git a/infrastructure/aws/aws_load_balancer_controller/README.md b/infrastructure/aws/aws_load_balancer_controller/README.md index a85595f59..7ea89e2ba 100644 --- a/infrastructure/aws/aws_load_balancer_controller/README.md +++ b/infrastructure/aws/aws_load_balancer_controller/README.md @@ -18,7 +18,7 @@ This module creates a helm_release resource to deploy the AWS Load Balancer Cont ```hcl module "aws_load_balancer_controller" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/aws_load_balancer_controller?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/aws_load_balancer_controller?ref=v6.11.3" cluster_name = "your-cluster-name" vpc_id = "your-vpc-id" diff --git a/infrastructure/aws/backend/README.md b/infrastructure/aws/backend/README.md index 3dced0cf6..a4cd9df40 100644 --- a/infrastructure/aws/backend/README.md +++ b/infrastructure/aws/backend/README.md @@ -20,7 +20,7 @@ This module creates an S3 bucket with versioning and server-side encryption enab ```hcl module "backend" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/backend?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/backend?ref=v6.11.3" } ``` diff --git a/infrastructure/aws/dns/README.md b/infrastructure/aws/dns/README.md index c800ef48a..f0734de8f 100644 --- a/infrastructure/aws/dns/README.md +++ b/infrastructure/aws/dns/README.md @@ -21,7 +21,7 @@ The module conditionally creates an aws_route53_zone resource for a public hoste ```hcl module "dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/dns?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/dns?ref=v6.11.3" domain_name = "your-domain-name" vpc_id = "your-vpc-id" diff --git a/infrastructure/aws/eks/README.md b/infrastructure/aws/eks/README.md index 321291297..a0cac553f 100644 --- a/infrastructure/aws/eks/README.md +++ b/infrastructure/aws/eks/README.md @@ -22,7 +22,7 @@ The module wraps terraform-aws-modules/eks to create the EKS cluster (aws_eks_cl ```hcl module "eks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/eks?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/eks?ref=v6.11.3" aws_subnets_private_ids = "your-aws-subnets-private-ids" aws_vpc_vpc_id = "your-aws-vpc-vpc-id" diff --git a/infrastructure/aws/iam/agent/README.md b/infrastructure/aws/iam/agent/README.md index 676c20049..936ace709 100644 --- a/infrastructure/aws/iam/agent/README.md +++ b/infrastructure/aws/iam/agent/README.md @@ -21,7 +21,7 @@ The module uses the terraform-aws-modules/iam//modules/iam-role-for-service-acco ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/agent?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/agent?ref=v6.11.3" agent_namespace = "your-agent-namespace" aws_iam_openid_connect_provider_arn = "your-aws-iam-openid-connect-provider-arn" diff --git a/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md b/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md index 1bd0ac72c..c05b9ff96 100644 --- a/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md +++ b/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md @@ -19,7 +19,7 @@ This module creates an IAM role for the AWS Load Balancer Controller using the t ```hcl module "aws_load_balancer_controller_iam" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/aws_load_balancer_controller_iam?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/aws_load_balancer_controller_iam?ref=v6.11.3" aws_iam_openid_connect_provider_arn = "your-aws-iam-openid-connect-provider-arn" cluster_name = "your-cluster-name" diff --git a/infrastructure/aws/iam/cert_manager/README.md b/infrastructure/aws/iam/cert_manager/README.md index 4545a134e..10feb89cc 100644 --- a/infrastructure/aws/iam/cert_manager/README.md +++ b/infrastructure/aws/iam/cert_manager/README.md @@ -20,7 +20,7 @@ An aws_iam_policy resource is always created granting route53:GetChange, route53 ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cert_manager?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cert_manager?ref=v6.11.3" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/ci-build-workflow-user/README.md b/infrastructure/aws/iam/ci-build-workflow-user/README.md index 4c242b90e..845905228 100644 --- a/infrastructure/aws/iam/ci-build-workflow-user/README.md +++ b/infrastructure/aws/iam/ci-build-workflow-user/README.md @@ -21,7 +21,7 @@ The module creates an aws_iam_user named with the cluster_name prefix and genera ```hcl module "ci-build-workflow-user" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ci-build-workflow-user?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ci-build-workflow-user?ref=v6.11.3" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/cloudwatch/README.md b/infrastructure/aws/iam/cloudwatch/README.md index 8f7367d3a..cca1d182b 100644 --- a/infrastructure/aws/iam/cloudwatch/README.md +++ b/infrastructure/aws/iam/cloudwatch/README.md @@ -20,7 +20,7 @@ The module creates an aws_iam_policy granting CloudWatch Logs and Metrics write ```hcl module "cloudwatch" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cloudwatch?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cloudwatch?ref=v6.11.3" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/ecr/README.md b/infrastructure/aws/iam/ecr/README.md index c7c675445..4f99741ab 100644 --- a/infrastructure/aws/iam/ecr/README.md +++ b/infrastructure/aws/iam/ecr/README.md @@ -20,7 +20,7 @@ The module creates an aws_iam_role named nullplatform-{cluster_name}-application ```hcl module "ecr" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ecr?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ecr?ref=v6.11.3" build_workflow_group_name = "your-build-workflow-group-name" cluster_name = "your-cluster-name" diff --git a/infrastructure/aws/iam/external_dns/README.md b/infrastructure/aws/iam/external_dns/README.md index e209144b2..b944871e1 100644 --- a/infrastructure/aws/iam/external_dns/README.md +++ b/infrastructure/aws/iam/external_dns/README.md @@ -20,7 +20,7 @@ An aws_iam_policy resource named nullplatform_external_dns_policy is always crea ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/external_dns?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/external_dns?ref=v6.11.3" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/s3/README.md b/infrastructure/aws/iam/s3/README.md index 56cd18221..965822b02 100644 --- a/infrastructure/aws/iam/s3/README.md +++ b/infrastructure/aws/iam/s3/README.md @@ -18,7 +18,7 @@ The module creates an aws_iam_policy resource that allows s3:PutObject and s3:Ge ```hcl module "s3" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/s3?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/s3?ref=v6.11.3" bucket = "your-bucket" build_workflow_group_name = "your-build-workflow-group-name" diff --git a/infrastructure/aws/ingress/README.md b/infrastructure/aws/ingress/README.md index ccd313fc1..a3a2e3f1f 100644 --- a/infrastructure/aws/ingress/README.md +++ b/infrastructure/aws/ingress/README.md @@ -22,7 +22,7 @@ The module creates up to two kubernetes_ingress_v1 resources — one for an inte ```hcl module "ingress" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/ingress?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/ingress?ref=v6.11.3" certificate_arn = "your-certificate-arn" } diff --git a/infrastructure/aws/security/README.md b/infrastructure/aws/security/README.md index 9957dad2b..84d226712 100644 --- a/infrastructure/aws/security/README.md +++ b/infrastructure/aws/security/README.md @@ -22,7 +22,7 @@ The module uses data sources (aws_eks_cluster, aws_vpc) to automatically derive ```hcl module "security" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/security?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/security?ref=v6.11.3" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/vpc/README.md b/infrastructure/aws/vpc/README.md index 82f5c8567..a9e98b3b2 100644 --- a/infrastructure/aws/vpc/README.md +++ b/infrastructure/aws/vpc/README.md @@ -22,7 +22,7 @@ This module creates a terraform-aws-modules/vpc/aws module resource with DNS hos ```hcl module "vpc" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/vpc?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/vpc?ref=v6.11.3" account = "your-account" organization = "your-organization" diff --git a/infrastructure/azure/acr/README.md b/infrastructure/azure/acr/README.md index 2952a472b..b515f686a 100644 --- a/infrastructure/azure/acr/README.md +++ b/infrastructure/azure/acr/README.md @@ -18,7 +18,7 @@ The module uses the azurerm_container_registry resource to create the container ```hcl module "acr" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/acr?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/acr?ref=v6.11.3" containerregistry_name = "your-containerregistry-name" location = "your-location" diff --git a/infrastructure/azure/aks/README.md b/infrastructure/azure/aks/README.md index c451129f2..63c441ca9 100644 --- a/infrastructure/azure/aks/README.md +++ b/infrastructure/azure/aks/README.md @@ -2,27 +2,27 @@ ## Description -Deploys an Azure Kubernetes Service (AKS) cluster with a system node pool, an autoscaling user node pool, workload identity, OIDC issuer, and optional ACR integration using the Azure/aks/azurerm community module +Deploys an Azure Kubernetes Service (AKS) cluster with configurable system and user node pools, workload identity, OIDC issuer, and optional ACR integration using the Azure/aks/azurerm upstream module ## Architecture -The module wraps the Azure/aks/azurerm community module (version 11.0.0) and passes all inputs into it, which internally creates an azurerm_kubernetes_cluster resource with a system agent pool and a separate user node pool via azurerm_kubernetes_cluster_node_pool. Network contributor role assignment is applied to the provided subnet, and when ACR integration is enabled the module creates an azurerm_role_assignment granting AcrPull to the cluster's managed identity. Outputs such as host, cluster_ca_certificate, client credentials, and oidc_issuer_url are surfaced directly from the inner module. +The module wraps the Azure/aks/azurerm community module (version 11.0.0) and feeds all input variables into it, creating an AKS cluster with a system node pool and a separate autoscaling user node pool both attached to the provided vnet_subnet_id. It retrieves the current Azure client config via azurerm_client_config to wire the tenant_id into AAD RBAC settings and enables workload_identity and oidc_issuer on the cluster. Network Contributor role assignments are applied to the node subnet and any additional subnets supplied via additional_network_contributor_subnet_ids, and an optional AcrPull role binding is conditionally created on the supplied ACR when acr_id is provided. ## Features -- Creates AKS cluster with separate system and autoscaling user node pools on a specified VNet subnet -- Enables workload identity and OIDC issuer for pod-level Azure authentication -- Assigns Network Contributor role to the AKS managed identity on the provided subnet -- Optionally attaches an Azure Container Registry by granting the AcrPull role to the cluster identity -- Configures availability zone distribution for both system and user node pools -- Exposes kubeconfig credentials, OIDC issuer URL, and node resource group as outputs +- Creates AKS cluster with RBAC, AAD integration, OIDC issuer, and workload identity enabled +- Configures a fixed system node pool with configurable VM size, node count, and availability zones +- Deploys an autoscaling user node pool with configurable min/max counts and availability zone spread +- Grants Network Contributor role on the node subnet and any additional load-balancer subnets to the cluster identity +- Optionally attaches an Azure Container Registry by granting AcrPull role to the cluster identity +- Exposes cluster credentials and OIDC issuer URL as outputs for downstream Kubernetes provider configuration - Supports private cluster mode and API server authorized IP range restrictions ## Basic Usage ```hcl module "aks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks?ref=v6.11.3" cluster_name = "your-cluster-name" location = "your-location" @@ -73,6 +73,7 @@ resource "example_resource" "this" { | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| | [acr\_id](#input\_acr\_id) | The ID of the Azure Container Registry. If provided, AKS will be granted AcrPull role to pull images. | `string` | `null` | no | +| [additional\_network\_contributor\_subnet\_ids](#input\_additional\_network\_contributor\_subnet\_ids) | Extra subnet IDs, keyed by an arbitrary stable name, where the cluster identity also needs Network Contributor. The node subnet is granted automatically; add an entry for any other subnet the cloud-provider must write into -- typically the one an internal load balancer is pinned to via service.beta.kubernetes.io/azure-load-balancer-internal-subnet, which otherwise fails to provision with a 403 on virtualNetworks/subnets/read. | `map(string)` | `{}` | no | | [attach\_acr](#input\_attach\_acr) | Whether to grant AKS the AcrPull role on acr\_id. Null (default) preserves the legacy behaviour of attaching whenever acr\_id is non-null. Set to true for a greenfield single-apply where acr\_id is known only after apply (keeps the for\_each key set plan-stable); set to false to disable. | `bool` | `null` | no | | [authorized\_ip\_ranges](#input\_authorized\_ip\_ranges) | The set of authorized IP ranges allowed to access the Kubernetes API server | `set(string)` | `null` | no | | [cluster\_name](#input\_cluster\_name) | The name of the AKS cluster | `string` | n/a | yes | @@ -112,15 +113,15 @@ resource "example_resource" "this" { diff --git a/infrastructure/azure/aks_route_table/README.md b/infrastructure/azure/aks_route_table/README.md index 6f76fe72e..00469714c 100644 --- a/infrastructure/azure/aks_route_table/README.md +++ b/infrastructure/azure/aks_route_table/README.md @@ -2,26 +2,24 @@ ## Description -Associates the AKS-managed kubenet route table with a specified subnet by discovering and attaching it. - -> **Prefer the vnet `route_table` passthrough.** When you control the node subnet through the `infrastructure/azure/vnet` module, declare the route table on that subnet via `subnets_definition[*].route_table` (#475) instead of using this module. That lets the subnet own the route table so the vnet stops proposing `routeTable -> null` on every plan, and the stack converges without a separate attach. This module remains for cases where the subnet is not managed through that vnet module. +Attaches the AKS-managed kubenet route table to a specified subnet by discovering the route table from the node resource group and updating the subnet via the Azure API ## Architecture -The module uses an azurerm_resources data source to discover the route table created by AKS in the node resource group. A terraform_data resource, keyed on the subnet id and the discovered route table id, triggers re-attachment only when that attachment actually changes. The azapi_update_resource resource then patches the subnet identified by subnet_id using the Azure Network API to attach the discovered route table, with its lifecycle tied to the terraform_data trigger. +The module uses an azurerm_resources data source to discover the AKS-managed route table within the node resource group by filtering for Microsoft.Network/routeTables resources. A terraform_data trigger resource tracks the subnet ID and route table ID pair to detect real attachment changes without drifting on timestamps. An azapi_update_resource targets the Microsoft.Network/virtualNetworks/subnets resource at the provided subnet_id and patches its routeTable property to point to the discovered route table ID. The replace_triggered_by lifecycle hook ensures the subnet update is re-applied whenever the trigger detects a change in the attachment pairing. ## Features -- Discovers the AKS-managed kubenet route table dynamically from the node resource group using azurerm_resources -- Patches the target subnet via azapi_update_resource to associate the route table -- Re-attaches only when the subnet id or route table id changes, via a terraform_data trigger keyed on those values (not a per-plan `timestamp()`), so it no longer prevents the stack from converging -- Outputs the resource ID of the discovered AKS-managed route table for downstream use +- Discovers AKS-managed kubenet route table automatically from the node resource group using azurerm_resources data source +- Attaches the discovered route table to the specified AKS node subnet via azapi_update_resource with the 2024-01-01 API version +- Implements stable change detection using a terraform_data trigger keyed on subnet and route table IDs to prevent unnecessary replacements +- Outputs the discovered route table resource ID for downstream module consumption ## Basic Usage ```hcl module "aks_route_table" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks_route_table?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks_route_table?ref=v6.11.3" node_resource_group = "your-node-resource-group" subnet_id = "your-subnet-id" @@ -78,13 +76,13 @@ resource "example_resource" "this" { diff --git a/infrastructure/azure/dns/README.md b/infrastructure/azure/dns/README.md index 6e45ff6cc..804ac82bf 100644 --- a/infrastructure/azure/dns/README.md +++ b/infrastructure/azure/dns/README.md @@ -18,7 +18,7 @@ This module creates an azurerm_dns_zone resource and configures it with the prov ```hcl module "dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/dns?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/dns?ref=v6.11.3" domain_name = "your-domain-name" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/iam/README.md b/infrastructure/azure/iam/README.md index 5945ca02f..d7bb29b56 100644 --- a/infrastructure/azure/iam/README.md +++ b/infrastructure/azure/iam/README.md @@ -21,7 +21,7 @@ The module creates an azurerm_user_assigned_identity resource in the specified r ```hcl module "iam" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/iam?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/iam?ref=v6.11.3" location = "your-location" name = "your-name" diff --git a/infrastructure/azure/private_dns/README.md b/infrastructure/azure/private_dns/README.md index afb6a6b5c..20d530408 100644 --- a/infrastructure/azure/private_dns/README.md +++ b/infrastructure/azure/private_dns/README.md @@ -18,7 +18,7 @@ This module creates an azurerm_private_dns_zone resource and optionally multiple ```hcl module "private_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/private_dns?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/private_dns?ref=v6.11.3" domain_name = "your-domain-name" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/resource_group/README.md b/infrastructure/azure/resource_group/README.md index 8025f0dbf..e4f6def9b 100644 --- a/infrastructure/azure/resource_group/README.md +++ b/infrastructure/azure/resource_group/README.md @@ -18,7 +18,7 @@ This module creates an azurerm_resource_group resource and outputs its name and ```hcl module "resource_group" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/resource_group?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/resource_group?ref=v6.11.3" location = "your-location" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/security/README.md b/infrastructure/azure/security/README.md index f8a974448..314063e5f 100644 --- a/infrastructure/azure/security/README.md +++ b/infrastructure/azure/security/README.md @@ -21,7 +21,7 @@ The module uses azurerm_kubernetes_cluster and azurerm_virtual_network data sour ```hcl module "security" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/security?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/security?ref=v6.11.3" cluster_name = "your-cluster-name" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/vnet/README.md b/infrastructure/azure/vnet/README.md index 11825cfaf..549979540 100644 --- a/infrastructure/azure/vnet/README.md +++ b/infrastructure/azure/vnet/README.md @@ -18,7 +18,7 @@ This module creates an Azure virtual network using the azurerm provider and conf ```hcl module "vnet" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/vnet?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/vnet?ref=v6.11.3" address_space = "your-address-space" location = "your-location" diff --git a/infrastructure/commons/cert_manager/README.md b/infrastructure/commons/cert_manager/README.md index 7ccd03211..b5b2614f8 100644 --- a/infrastructure/commons/cert_manager/README.md +++ b/infrastructure/commons/cert_manager/README.md @@ -22,7 +22,7 @@ Two primary helm_release resources are created: cert-manager from the Jetstack c ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.11.3" account_slug = "your-account-slug" cloud_provider = "your-cloud-provider" @@ -35,7 +35,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.11.3" account_slug = "your-account-slug" cloud_provider = "gcp" @@ -50,7 +50,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.11.3" account_slug = "your-account-slug" azure_client_id = "your-azure-client-id" # Required when cloud_provider = "azure" @@ -68,7 +68,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.11.3" account_slug = "your-account-slug" cloud_provider = "cloudflare" @@ -83,7 +83,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.11.3" account_slug = "your-account-slug" aws_identity_mode = "your-aws-identity-mode" # Required when cloud_provider = "aws" @@ -99,7 +99,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.11.3" account_slug = "your-account-slug" cert_manager_webhook_oci_namespace = "your-cert-manager-webhook-oci-namespace" # Required when cloud_provider = "oci" diff --git a/infrastructure/commons/external_dns/README.md b/infrastructure/commons/external_dns/README.md index 12184d7c0..da3d2a241 100644 --- a/infrastructure/commons/external_dns/README.md +++ b/infrastructure/commons/external_dns/README.md @@ -22,7 +22,7 @@ The module creates an optional kubernetes_namespace_v1 resource when create_name ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.11.3" dns_provider_name = "your-dns-provider-name" domain_filters = "your-domain-filters" @@ -33,7 +33,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.11.3" cloudflare_token = "your-cloudflare-token" # Required when dns_provider_name = "cloudflare" dns_provider_name = "cloudflare" @@ -45,7 +45,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.11.3" aws_iam_role_arn = "your-aws-iam-role-arn" # Required when dns_provider_name = "aws" aws_identity_mode = "your-aws-identity-mode" # Required when dns_provider_name = "aws" @@ -61,7 +61,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.11.3" dns_provider_name = "oci" domain_filters = "your-domain-filters" @@ -77,7 +77,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.11.3" azure_client_id = "your-azure-client-id" # Required when dns_provider_name = "azure" azure_federated_credential_id = "your-azure-federated-credential-id" # Required when dns_provider_name = "azure" @@ -94,7 +94,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.11.3" azure_client_id = "your-azure-client-id" # Required when dns_provider_name = "azure-private-dns" azure_federated_credential_id = "your-azure-federated-credential-id" # Required when dns_provider_name = "azure-private-dns" diff --git a/infrastructure/commons/istio/README.md b/infrastructure/commons/istio/README.md index c2072ef4b..ef9133333 100644 --- a/infrastructure/commons/istio/README.md +++ b/infrastructure/commons/istio/README.md @@ -21,7 +21,7 @@ Three helm_release resources are created in a strict dependency chain: istio-bas ```hcl module "istio" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/istio?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/istio?ref=v6.11.3" } ``` diff --git a/infrastructure/commons/prometheus/README.md b/infrastructure/commons/prometheus/README.md index 19611afed..dc654bf86 100644 --- a/infrastructure/commons/prometheus/README.md +++ b/infrastructure/commons/prometheus/README.md @@ -18,7 +18,7 @@ This module creates a helm_release resource to deploy the Prometheus chart from ```hcl module "prometheus" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.11.3" } ``` diff --git a/infrastructure/gcp/artifact-registry/README.md b/infrastructure/gcp/artifact-registry/README.md index a1bdf9264..e8e6e2e97 100644 --- a/infrastructure/gcp/artifact-registry/README.md +++ b/infrastructure/gcp/artifact-registry/README.md @@ -21,7 +21,7 @@ The module provisions a google_artifact_registry_repository resource in the spec ```hcl module "artifact-registry" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/artifact-registry?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/artifact-registry?ref=v6.11.3" location = "your-location" project_id = "your-project-id" diff --git a/infrastructure/gcp/cloud-dns/README.md b/infrastructure/gcp/cloud-dns/README.md index 31d9ff478..8d139fef9 100644 --- a/infrastructure/gcp/cloud-dns/README.md +++ b/infrastructure/gcp/cloud-dns/README.md @@ -21,7 +21,7 @@ The module creates a single google_dns_managed_zone resource in the specified GC ```hcl module "cloud-dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-dns?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-dns?ref=v6.11.3" domain_name = "your-domain-name" project_id = "your-project-id" diff --git a/infrastructure/gcp/cloud-nat/README.md b/infrastructure/gcp/cloud-nat/README.md index c30e3bf91..202738140 100644 --- a/infrastructure/gcp/cloud-nat/README.md +++ b/infrastructure/gcp/cloud-nat/README.md @@ -19,7 +19,7 @@ This module creates a google_compute_router resource in a specified region and n ```hcl module "cloud-nat" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-nat?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-nat?ref=v6.11.3" nat_name = "your-nat-name" network_id = "your-network-id" diff --git a/infrastructure/gcp/gke/README.md b/infrastructure/gcp/gke/README.md index 1b26ca7a2..ddd4b6204 100644 --- a/infrastructure/gcp/gke/README.md +++ b/infrastructure/gcp/gke/README.md @@ -20,7 +20,7 @@ The module uses the google-modules/kubernetes-engine/google//modules/private-clu ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.11.3" cluster_name = "your-cluster-name" ip_range_pods = "your-ip-range-pods" diff --git a/infrastructure/gcp/iam/README.md b/infrastructure/gcp/iam/README.md index c5495453c..f140cec8b 100644 --- a/infrastructure/gcp/iam/README.md +++ b/infrastructure/gcp/iam/README.md @@ -19,7 +19,7 @@ The module creates google_service_account resources for each service account spe ```hcl module "iam" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/iam?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/iam?ref=v6.11.3" project_id = "your-project-id" } diff --git a/infrastructure/gcp/security/README.md b/infrastructure/gcp/security/README.md index 4ae9076f6..582a9d4b3 100644 --- a/infrastructure/gcp/security/README.md +++ b/infrastructure/gcp/security/README.md @@ -19,7 +19,7 @@ This module uses Terraform to create GCP firewall rules for public and private I ```hcl module "security" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/security?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/security?ref=v6.11.3" cluster_name = "your-cluster-name" gcp_project_id = "your-gcp-project-id" diff --git a/infrastructure/gcp/vpc/README.md b/infrastructure/gcp/vpc/README.md index efaf8ac06..2d410297a 100644 --- a/infrastructure/gcp/vpc/README.md +++ b/infrastructure/gcp/vpc/README.md @@ -20,7 +20,7 @@ The module invokes the terraform-google-modules/network/google module to create ```hcl module "vpc" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/vpc?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/vpc?ref=v6.11.3" network_name = "your-network-name" project_id = "your-project-id" diff --git a/infrastructure/oci/backend/README.md b/infrastructure/oci/backend/README.md index ec976adb5..a387ad96a 100644 --- a/infrastructure/oci/backend/README.md +++ b/infrastructure/oci/backend/README.md @@ -18,7 +18,7 @@ The module creates an oci_objectstorage_bucket resource, which is configured wit ```hcl module "backend" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/backend?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/backend?ref=v6.11.3" compartment_id = "your-compartment-id" namespace = "your-namespace" diff --git a/infrastructure/oci/dns/README.md b/infrastructure/oci/dns/README.md index a9679f235..2582745fb 100644 --- a/infrastructure/oci/dns/README.md +++ b/infrastructure/oci/dns/README.md @@ -18,7 +18,7 @@ This module creates oci_dns_zone resources for each DNS zone defined in the dns_ ```hcl module "dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dns?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dns?ref=v6.11.3" compartment_id = "your-compartment-id" } diff --git a/infrastructure/oci/dynamic_groups/README.md b/infrastructure/oci/dynamic_groups/README.md index c9ded8335..d1cda7d23 100644 --- a/infrastructure/oci/dynamic_groups/README.md +++ b/infrastructure/oci/dynamic_groups/README.md @@ -19,7 +19,7 @@ This module creates an OCI dynamic group and an OCI identity policy, connecting ```hcl module "dynamic_groups" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dynamic_groups?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dynamic_groups?ref=v6.11.3" cluster_id = "your-cluster-id" compartment_id = "your-compartment-id" diff --git a/infrastructure/oci/oke/README.md b/infrastructure/oci/oke/README.md index c74a34b70..6e2be3edb 100644 --- a/infrastructure/oci/oke/README.md +++ b/infrastructure/oci/oke/README.md @@ -21,7 +21,7 @@ The module instantiates the oracle-terraform-modules/oke/oci module to create an ```hcl module "oke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/oke?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/oke?ref=v6.11.3" api_endpoint_subnet_id = "your-api-endpoint-subnet-id" cluster_name = "your-cluster-name" diff --git a/infrastructure/oci/vcn/README.md b/infrastructure/oci/vcn/README.md index 0a6678d59..a81b28c1e 100644 --- a/infrastructure/oci/vcn/README.md +++ b/infrastructure/oci/vcn/README.md @@ -19,7 +19,7 @@ The module instantiates oci_core_subnet resources for public and private subnets ```hcl module "vcn" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/vcn?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/vcn?ref=v6.11.3" } ``` diff --git a/nullplatform/account/README.md b/nullplatform/account/README.md index 588478582..6fd33002b 100644 --- a/nullplatform/account/README.md +++ b/nullplatform/account/README.md @@ -19,7 +19,7 @@ The module iterates over the `nullplatform_accounts` input map using `for_each` ```hcl module "account" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/account?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/account?ref=v6.11.3" nullplatform_accounts = "your-nullplatform-accounts" } diff --git a/nullplatform/agent/README.md b/nullplatform/agent/README.md index 695e25408..1eb59c88b 100644 --- a/nullplatform/agent/README.md +++ b/nullplatform/agent/README.md @@ -22,7 +22,7 @@ The module renders a Helm values file using a templatefile() call that merges de ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.11.3" api_key = "your-api-key" cloud_provider = "your-cloud-provider" @@ -37,7 +37,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.11.3" api_key = "your-api-key" aws_iam_role_arn = "your-aws-iam-role-arn" # Required when cloud_provider = "aws" @@ -53,7 +53,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.11.3" api_key = "your-api-key" cloud_provider = "gcp" @@ -68,7 +68,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.11.3" api_key = "your-api-key" azure_client_id = "your-azure-client-id" # Required when cloud_provider = "azure" @@ -91,7 +91,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.11.3" api_key = "your-api-key" cloud_provider = "oci" diff --git a/nullplatform/api_key/README.md b/nullplatform/api_key/README.md index a05cde664..7a53c08f5 100644 --- a/nullplatform/api_key/README.md +++ b/nullplatform/api_key/README.md @@ -21,7 +21,7 @@ The module creates a single nullplatform_api_key resource whose name, grants, an ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.11.3" type = "your-type" } @@ -31,7 +31,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.11.3" nrn = "your-nrn" # Required when type = "agent" type = "agent" @@ -42,7 +42,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.11.3" nrn = "your-nrn" # Required when type = "scope_notification" specification_slug = "your-specification-slug" # Required when type = "scope_notification" @@ -54,7 +54,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.11.3" nrn = "your-nrn" # Required when type = "service_notification" specification_slug = "your-specification-slug" # Required when type = "service_notification" @@ -66,7 +66,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.11.3" custom_grants = "your-custom-grants" # Required when type = "custom" custom_name = "your-custom-name" # Required when type = "custom" diff --git a/nullplatform/asset/docker_server/README.md b/nullplatform/asset/docker_server/README.md index dcbeb0118..24493eeb4 100644 --- a/nullplatform/asset/docker_server/README.md +++ b/nullplatform/asset/docker_server/README.md @@ -21,7 +21,7 @@ Creates a nullplatform_provider_config resource of type 'docker-server' with enc ```hcl module "docker_server" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/docker_server?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/docker_server?ref=v6.11.3" login_server = "your-login-server" nrn = "your-nrn" diff --git a/nullplatform/asset/ecr/README.md b/nullplatform/asset/ecr/README.md index 9699f2762..b54e288a6 100644 --- a/nullplatform/asset/ecr/README.md +++ b/nullplatform/asset/ecr/README.md @@ -21,7 +21,7 @@ The module reads the current AWS region via the aws_region data source and combi ```hcl module "ecr" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/ecr?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/ecr?ref=v6.11.3" application_role_arn = "your-application-role-arn" build_workflow_access_key_id = "your-build-workflow-access-key-id" diff --git a/nullplatform/asset/s3/README.md b/nullplatform/asset/s3/README.md index 355a1d631..c589ea757 100644 --- a/nullplatform/asset/s3/README.md +++ b/nullplatform/asset/s3/README.md @@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type s3-con ```hcl module "s3" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/s3?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/s3?ref=v6.11.3" bucket_name = "your-bucket-name" nrn = "your-nrn" diff --git a/nullplatform/base/README.md b/nullplatform/base/README.md index ce3268ff1..62f539b8f 100644 --- a/nullplatform/base/README.md +++ b/nullplatform/base/README.md @@ -2,27 +2,27 @@ ## Description -Deploys the nullplatform base Helm chart onto a Kubernetes cluster with support for multi-cloud providers, configurable gateways, ingress controllers, and observability integrations +Deploys the nullplatform-base Helm chart onto a Kubernetes cluster with pre-created namespaces, configuring gateways, ingress controllers, logging pipelines, and observability integrations for supported cloud providers ## Architecture -The module creates two kubernetes_namespace_v1 resources (nullplatform-tools and nullplatform) as prerequisites, then deploys a helm_release resource pointing to the nullplatform-base chart from the nullplatform GitHub Helm registry. A templatefile local renders all input variables into a YAML values file that is passed directly to the helm_release, wiring provider-specific gateway security group IDs, NSG IDs, firewall names, and OCI subnet OCIDs into the chart. Outputs surface the rendered values and cloud-specific security resource identifiers for downstream consumption. +The module first creates two kubernetes_namespace_v1 resources ('nullplatform-tools' and 'nullplatform') to avoid race conditions with the Helm chart's lookup functions. A locals block renders a YAML values file via templatefile() from all input variables, which is then passed directly to a helm_release resource targeting the 'nullplatform-base' chart from the nullplatform GitHub Helm repository. The helm_release depends on both namespaces and outputs the rendered values as a sensitive output, while cloud-provider-specific security resource IDs (AWS security groups, Azure NSGs, GCP firewall names) flow through as passthrough outputs. ## Features -- Creates kubernetes_namespace_v1 resources for nullplatform-tools and nullplatform to prevent Helm race conditions -- Deploys nullplatform-base helm_release with fully templated values supporting EKS, GKE, AKS, OKE, and ARO providers -- Configures public and private gateways with per-cloud security attachments including AWS security groups, Azure NSGs, GCP firewall rules, and OCI security lists -- Enables multi-provider observability integrations including Prometheus, Loki, GELF, Dynatrace, Datadog, New Relic, and CloudWatch -- Supports configurable ingress controllers with public and private scopes, custom domains, and enable/disable toggles -- Configures image pull secrets for private container registries with username and password authentication -- Manages Gateway API CRD installation and gateway resource lifecycle including public load balancer type selection +- Creates two Kubernetes namespaces ('nullplatform-tools' and 'nullplatform') with Helm-compatible labels and annotations before chart installation +- Deploys the nullplatform-base helm_release with configurable version, timeout, and dependency update support +- Configures public and internal gateway resources with per-cloud-provider security group, NSG, firewall, and OCI subnet settings +- Supports multiple observability integrations including Prometheus, Datadog, Dynatrace, New Relic, Loki, GELF, and CloudWatch with per-integration enable flags +- Renders a templated Helm values YAML file combining all inputs for multi-cloud providers: EKS, GKE, AKS, OKE, and ARO +- Manages image pull secrets and ingress controller configuration for public and private traffic scopes +- Exposes cloud-provider security resource IDs as outputs for use by downstream security submodules ## Basic Usage ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.11.3" k8s_provider = "your-k8s-provider" np_api_key = "your-np-api-key" @@ -33,7 +33,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.11.3" k8s_provider = "eks" np_api_key = "your-np-api-key" @@ -44,7 +44,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.11.3" k8s_provider = "gke" np_api_key = "your-np-api-key" @@ -55,7 +55,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.11.3" k8s_provider = "aks" np_api_key = "your-np-api-key" @@ -66,18 +66,18 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.11.3" k8s_provider = "oke" np_api_key = "your-np-api-key" } ``` -### Usage with Azure Red Hat OpenShift ARO +### Usage with Azure Red Hat OpenShift (ARO) ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.11.3" k8s_provider = "aro" np_api_key = "your-np-api-key" @@ -172,7 +172,7 @@ resource "example_resource" "this" { | [image\_pull\_secrets\_username](#input\_image\_pull\_secrets\_username) | Registry username. | `string` | `""` | no | | [ingressControllers](#input\_ingressControllers) | Configuración de los IngressControllers públicos y privados | 
object({
    public = object({
      name    = string
      enabled = bool
      scope   = string
      domain  = string
    })
    private = object({
      name    = string
      enabled = bool
      scope   = string
      domain  = string
    })
  })
| 
{
  "private": {
    "domain": "",
    "enabled": false,
    "name": "internal",
    "scope": "Internal"
  },
  "public": {
    "domain": "",
    "enabled": false,
    "name": "internet-facing",
    "scope": "External"
  }
}
| no | | [install\_gateway\_v2\_crd](#input\_install\_gateway\_v2\_crd) | Install Gateway API v2 CRDs. | `bool` | `false` | no | -| [internal\_azure\_load\_balancer\_subnet](#input\_internal\_azure\_load\_balancer\_subnet) | The name of the subnet to use in azure private load balancer | `string` | `"load_balancer"` | no | +| [internal\_azure\_load\_balancer\_subnet](#input\_internal\_azure\_load\_balancer\_subnet) | Name of the subnet for the internal gateway's Azure load balancer. Empty by default, in which case Azure picks the subnet automatically. Must be the subnet's resource name (e.g. "subnet-4"), not the key it has in a subnets\_definition map. | `string` | `""` | no | | [k8s\_provider](#input\_k8s\_provider) | Cloud provider (eks, gke, aks, oke and aro). | `string` | n/a | yes | | [logging\_application\_logs\_enabled](#input\_logging\_application\_logs\_enabled) | Enable application log forwarding. Set to false to keep only http/sys metrics pipelines active across all providers. | `bool` | `true` | no | | [logging\_enabled](#input\_logging\_enabled) | Enable the logging layer. | `bool` | `true` | no | @@ -211,16 +211,16 @@ resource "example_resource" "this" { diff --git a/nullplatform/cloud/aws/cloud/README.md b/nullplatform/cloud/aws/cloud/README.md index 326048b39..26b51059b 100644 --- a/nullplatform/cloud/aws/cloud/README.md +++ b/nullplatform/cloud/aws/cloud/README.md @@ -21,7 +21,7 @@ The module uses data sources aws_caller_identity and aws_region to dynamically r ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/cloud?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/cloud?ref=v6.11.3" domain_name = "your-domain-name" hosted_private_zone_id = "your-hosted-private-zone-id" diff --git a/nullplatform/cloud/aws/vpc/README.md b/nullplatform/cloud/aws/vpc/README.md index 69bf8c472..2b0b45865 100644 --- a/nullplatform/cloud/aws/vpc/README.md +++ b/nullplatform/cloud/aws/vpc/README.md @@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource of type aws-ne ```hcl module "vpc" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/vpc?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/vpc?ref=v6.11.3" nrn = "your-nrn" vpc_id = "your-vpc-id" diff --git a/nullplatform/cloud/azure/cloud/README.md b/nullplatform/cloud/azure/cloud/README.md index a5bbc07e7..ea6fcbdb0 100644 --- a/nullplatform/cloud/azure/cloud/README.md +++ b/nullplatform/cloud/azure/cloud/README.md @@ -22,7 +22,7 @@ The module creates a single nullplatform_provider_config resource of type 'azure ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/azure/cloud?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/azure/cloud?ref=v6.11.3" azure_resource_group_name = "your-azure-resource-group-name" nrn = "your-nrn" diff --git a/nullplatform/cloud/gcp/cloud/README.md b/nullplatform/cloud/gcp/cloud/README.md index 64be37f80..a85d4dc7c 100644 --- a/nullplatform/cloud/gcp/cloud/README.md +++ b/nullplatform/cloud/gcp/cloud/README.md @@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type 'googl ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/gcp/cloud?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/gcp/cloud?ref=v6.11.3" domain_name = "your-domain-name" location = "your-location" diff --git a/nullplatform/cloud/oci/cloud/README.md b/nullplatform/cloud/oci/cloud/README.md index 55babc47b..f3745fdc9 100644 --- a/nullplatform/cloud/oci/cloud/README.md +++ b/nullplatform/cloud/oci/cloud/README.md @@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type 'oci-c ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/oci/cloud?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/oci/cloud?ref=v6.11.3" account_id = "your-account-id" account_name = "your-account-name" diff --git a/nullplatform/code_repository/README.md b/nullplatform/code_repository/README.md index b1148834d..f73ca5a30 100644 --- a/nullplatform/code_repository/README.md +++ b/nullplatform/code_repository/README.md @@ -22,7 +22,7 @@ The module uses local boolean flags (is_gitlab, is_github, is_azure, is_bitbucke ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.11.3" git_provider = "your-git-provider" nrn = "your-nrn" @@ -33,7 +33,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.11.3" git_provider = "github" github_installation_id = "your-github-installation-id" # Required when git_provider = "github" @@ -46,7 +46,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.11.3" git_provider = "gitlab" gitlab_access_token = "your-gitlab-access-token" # Required when git_provider = "gitlab" @@ -62,7 +62,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.11.3" azure_access_token = "your-azure-access-token" # Required when git_provider = "azure" azure_agent_pool = "your-azure-agent-pool" # Required when git_provider = "azure" @@ -76,7 +76,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.11.3" bitbucket_collaborators = "your-bitbucket-collaborators" # Required when git_provider = "bitbucket" bitbucket_installation_url = "your-bitbucket-installation-url" # Required when git_provider = "bitbucket" diff --git a/nullplatform/container_orchestration/aks/README.md b/nullplatform/container_orchestration/aks/README.md index e16707ef5..db2622aae 100644 --- a/nullplatform/container_orchestration/aks/README.md +++ b/nullplatform/container_orchestration/aks/README.md @@ -21,7 +21,7 @@ The module builds a local.attributes map that aggregates cluster metadata, gatew ```hcl module "aks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.11.3" cluster_name = "your-cluster-name" nrn = "your-nrn" diff --git a/nullplatform/container_orchestration/eks/README.md b/nullplatform/container_orchestration/eks/README.md index 2575e1692..f07c51039 100644 --- a/nullplatform/container_orchestration/eks/README.md +++ b/nullplatform/container_orchestration/eks/README.md @@ -21,7 +21,7 @@ Creates a nullplatform_provider_config resource with type 'eks-configuration' th ```hcl module "eks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.11.3" cluster_name = "your-cluster-name" nrn = "your-nrn" diff --git a/nullplatform/container_orchestration/gke/README.md b/nullplatform/container_orchestration/gke/README.md index 8dd648a36..388479b71 100644 --- a/nullplatform/container_orchestration/gke/README.md +++ b/nullplatform/container_orchestration/gke/README.md @@ -22,7 +22,7 @@ The module constructs a structured attributes object using locals that merge clu ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.11.3" cluster_name = "your-cluster-name" location = "your-location" diff --git a/nullplatform/container_orchestration/oke/README.md b/nullplatform/container_orchestration/oke/README.md index 26d406807..7404709d5 100644 --- a/nullplatform/container_orchestration/oke/README.md +++ b/nullplatform/container_orchestration/oke/README.md @@ -19,7 +19,7 @@ Creates a single nullplatform_provider_config resource of type 'oke' that stores ```hcl module "oke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/oke?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/oke?ref=v6.11.3" cluster_name = "your-cluster-name" nrn = "your-nrn" diff --git a/nullplatform/dimension/README.md b/nullplatform/dimension/README.md index c5577a4c4..2234de09f 100644 --- a/nullplatform/dimension/README.md +++ b/nullplatform/dimension/README.md @@ -19,7 +19,7 @@ The module creates a nullplatform_dimension resource using the provided name, or ```hcl module "dimension" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension?ref=v6.11.3" name = "your-name" nrn = "your-nrn" diff --git a/nullplatform/dimension_value/README.md b/nullplatform/dimension_value/README.md index cb6741c12..4687ff879 100644 --- a/nullplatform/dimension_value/README.md +++ b/nullplatform/dimension_value/README.md @@ -19,7 +19,7 @@ The module uses a terraform_data resource to enforce mutual-exclusivity and pres ```hcl module "dimension_value" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension_value?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension_value?ref=v6.11.3" dimension_id = "your-dimension-id" name = "your-name" diff --git a/nullplatform/identity-access-control/README.md b/nullplatform/identity-access-control/README.md index 0a221706f..131de059b 100644 --- a/nullplatform/identity-access-control/README.md +++ b/nullplatform/identity-access-control/README.md @@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource named identity ```hcl module "identity-access-control" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/identity-access-control?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/identity-access-control?ref=v6.11.3" attributes = "your-attributes" nrn = "your-nrn" diff --git a/nullplatform/metrics/README.md b/nullplatform/metrics/README.md index 4e8ce788c..f4518a3b3 100644 --- a/nullplatform/metrics/README.md +++ b/nullplatform/metrics/README.md @@ -21,7 +21,7 @@ The module creates a single nullplatform_provider_config resource of type 'prome ```hcl module "metrics" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/metrics?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/metrics?ref=v6.11.3" nrn = "your-nrn" } diff --git a/nullplatform/packaged_service/README.md b/nullplatform/packaged_service/README.md index 2f0392ea3..488ef171b 100644 --- a/nullplatform/packaged_service/README.md +++ b/nullplatform/packaged_service/README.md @@ -17,7 +17,7 @@ spec updates / republish correctly. ```hcl module "packaged_service" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/packaged_service?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/packaged_service?ref=v6.11.3" nrn = "organization=…:account=…:namespace=…" diff --git a/nullplatform/parameter_storage_configuration/README.md b/nullplatform/parameter_storage_configuration/README.md index e15579ecb..426a67f3b 100644 --- a/nullplatform/parameter_storage_configuration/README.md +++ b/nullplatform/parameter_storage_configuration/README.md @@ -20,7 +20,7 @@ The module delegates entirely to a remote `scope_configuration` module sourced f ```hcl module "parameter_storage_configuration" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_configuration?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_configuration?ref=v6.11.3" attributes = "your-attributes" np_api_key = "your-np-api-key" diff --git a/nullplatform/parameter_storage_definition/README.md b/nullplatform/parameter_storage_definition/README.md index 9d2f4a430..dc83cb24f 100644 --- a/nullplatform/parameter_storage_definition/README.md +++ b/nullplatform/parameter_storage_definition/README.md @@ -20,7 +20,7 @@ A data.http resource fetches the raw specification template from a configurable ```hcl module "parameter_storage_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition?ref=v6.11.3" np_api_key = "your-np-api-key" nrn = "your-nrn" diff --git a/nullplatform/parameter_storage_definition_agent_association/README.md b/nullplatform/parameter_storage_definition_agent_association/README.md index 1b059cad3..22cccc6f0 100644 --- a/nullplatform/parameter_storage_definition_agent_association/README.md +++ b/nullplatform/parameter_storage_definition_agent_association/README.md @@ -21,7 +21,7 @@ The module creates a terraform_data resource to track API key changes and a null ```hcl module "parameter_storage_definition_agent_association" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition_agent_association?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition_agent_association?ref=v6.11.3" api_key = "your-api-key" nrn = "your-nrn" diff --git a/nullplatform/scope_configuration/README.md b/nullplatform/scope_configuration/README.md index c75cf4b8f..f96befcb7 100644 --- a/nullplatform/scope_configuration/README.md +++ b/nullplatform/scope_configuration/README.md @@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource that binds a N ```hcl module "scope_configuration" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_configuration?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_configuration?ref=v6.11.3" attributes = "your-attributes" np_api_key = "your-np-api-key" diff --git a/nullplatform/scope_definition/README.md b/nullplatform/scope_definition/README.md index 1014357e4..4c99930e6 100644 --- a/nullplatform/scope_definition/README.md +++ b/nullplatform/scope_definition/README.md @@ -22,7 +22,7 @@ The module fetches JSON templates via data.http resources from a configurable Gi ```hcl module "scope_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition?ref=v6.11.3" np_api_key = "your-np-api-key" nrn = "your-nrn" diff --git a/nullplatform/scope_definition_agent_association/README.md b/nullplatform/scope_definition_agent_association/README.md index 9e9ec9041..d2e8840b1 100644 --- a/nullplatform/scope_definition_agent_association/README.md +++ b/nullplatform/scope_definition_agent_association/README.md @@ -22,7 +22,7 @@ The module fetches a notification channel template via the `data.http` data sour ```hcl module "scope_definition_agent_association" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition_agent_association?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition_agent_association?ref=v6.11.3" api_key = "your-api-key" nrn = "your-nrn" diff --git a/nullplatform/service_definition/README.md b/nullplatform/service_definition/README.md index 33c36a67f..20156d6cc 100644 --- a/nullplatform/service_definition/README.md +++ b/nullplatform/service_definition/README.md @@ -22,7 +22,7 @@ The module uses data.http resources to fetch service-spec, action, and link JSON ```hcl module "service_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.11.3" nrn = "your-nrn" service_name = "your-service-name" diff --git a/nullplatform/service_definition_agent_association/README.md b/nullplatform/service_definition_agent_association/README.md index a62f00542..e08b41594 100644 --- a/nullplatform/service_definition_agent_association/README.md +++ b/nullplatform/service_definition_agent_association/README.md @@ -22,7 +22,7 @@ The module creates a terraform_data resource to track API key changes as a lifec ```hcl module "service_definition_agent_association" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition_agent_association?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition_agent_association?ref=v6.11.3" api_key = "your-api-key" repository_service_spec_repo = "your-repository-service-spec-repo" diff --git a/nullplatform/users/README.md b/nullplatform/users/README.md index 2bb01cd93..e24d2528b 100644 --- a/nullplatform/users/README.md +++ b/nullplatform/users/README.md @@ -21,7 +21,7 @@ The module iterates over a map of user definitions using `nullplatform_user` res ```hcl module "users" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/users?ref=v6.11.2" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/users?ref=v6.11.3" nullplatform_users = "your-nullplatform-users" } From 11684790da73b279a16a2359effa1658c0521795 Mon Sep 17 00:00:00 2001 From: Sebastian Correa Date: Tue, 11 Aug 2026 16:47:31 -0300 Subject: [PATCH 07/81] ci: verify a branch actually forked from its declared base line (#507) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * ci: verify a branch actually forked from its declared base line base-branch-check only validates that a branch's NAME is paired with the right base — a feat/* branch created from main (instead of 6.x) still passes that check, but merging it would smuggle every main-only change (including the breaking change 6.x is meant to be free of) into 6.x. This adds a job that checks the real git ancestry via merge-base. * fix(ci): use the branch's real fork point in the rebase hint, not the historical fork point Using $(git merge-base origin/main origin/6.x) in the remediation message replayed every main-only commit onto 6.x -- exactly what the check exists to prevent -- and made the check pass afterward. Use the already-computed $MB_OTHER instead. Also derives OTHER_BRANCH from BASE_BRANCH rather than from HEAD_BRANCH's name (avoids a vacuous pass if this ever runs on a branch type not covered by the naming rule), drops the now-unnecessary ci/* exemption, adds least-privilege permissions, and rewords the error to describe the observation rather than assert a cause. * docs(ci): clarify fork-point-check's ci/* comment --------- Co-authored-by: sebas_correa --- .github/workflows/commitlint.yml | 44 +++++++++++++++++++++++++++ docs/ci/dual-release-line-rollback.md | 6 ++-- 2 files changed, 48 insertions(+), 2 deletions(-) diff --git a/.github/workflows/commitlint.yml b/.github/workflows/commitlint.yml index e94bfe433..4f2c46742 100644 --- a/.github/workflows/commitlint.yml +++ b/.github/workflows/commitlint.yml @@ -48,6 +48,50 @@ jobs: echo "Base branch '$BASE_BRANCH' is correct for '$HEAD_BRANCH'." + fork-point-check: + name: Validate branch actually forked from the correct line + if: ${{ !startsWith(github.head_ref, 'release-please--') && !startsWith(github.head_ref, 'dependabot/') }} + runs-on: ubuntu-24.04 + permissions: + contents: read + steps: + - name: Checkout head commit with full history + uses: actions/checkout@v6 + with: + ref: ${{ github.event.pull_request.head.sha }} + fetch-depth: 0 + + - name: Check head diverges from its declared base, not from the other line + env: + HEAD_BRANCH: ${{ github.head_ref }} + BASE_BRANCH: ${{ github.base_ref }} + run: | + # base-branch-check only validates that the branch NAME is paired + # with the right base — it can't see where the branch actually + # forked from. A feat/* branch created from main (instead of 6.x) + # would still pass that check, but merging it would smuggle every + # main-only change (including the breaking change 6.x is meant to + # be free of) into 6.x. This job checks the real git ancestry. + # OTHER_BRANCH is derived from BASE_BRANCH (not from HEAD_BRANCH's + # name) so this check stays sound on ci/* branches too, which + # base-branch-check deliberately doesn't gate (it may target + # either line). + if [[ "$BASE_BRANCH" == "main" ]]; then + OTHER_BRANCH="6.x" + else + OTHER_BRANCH="main" + fi + + MB_BASE=$(git merge-base HEAD "origin/${BASE_BRANCH}") + MB_OTHER=$(git merge-base HEAD "origin/${OTHER_BRANCH}") + + if git merge-base --is-ancestor "$MB_OTHER" "$MB_BASE"; then + echo "OK: '$HEAD_BRANCH' diverges from '$BASE_BRANCH', not from '$OTHER_BRANCH'." + else + echo "::error::'$HEAD_BRANCH' (targeting '$BASE_BRANCH') contains commits from '$OTHER_BRANCH' that are not in '$BASE_BRANCH' — either it was created from '$OTHER_BRANCH' instead of '$BASE_BRANCH', or '$OTHER_BRANCH' was merged into it deliberately. Either way, merging this PR as-is would pull those changes (including any breaking changes '$OTHER_BRANCH' has that '$BASE_BRANCH' doesn't) into '$BASE_BRANCH'. Fix: rebase onto 'origin/$BASE_BRANCH' from this branch's real fork point — git rebase --onto origin/$BASE_BRANCH $MB_OTHER $HEAD_BRANCH — or, if '$OTHER_BRANCH' was merged in on purpose, drop that merge first." + exit 1 + fi + no-breaking-changes: name: Block breaking changes (temporary policy) if: ${{ !startsWith(github.head_ref, 'release-please--') && !startsWith(github.head_ref, 'dependabot/') }} diff --git a/docs/ci/dual-release-line-rollback.md b/docs/ci/dual-release-line-rollback.md index 3b886ab9b..f4ae9e77b 100644 --- a/docs/ci/dual-release-line-rollback.md +++ b/docs/ci/dual-release-line-rollback.md @@ -35,7 +35,8 @@ commits relevantes. ## Lo que este rollback SÍ hace y lo que NO hace - **SÍ**: elimina los checks y triggers de CI agregados (el chequeo de base - branch, el bloqueo de breaking changes, el `package` en el pattern de + branch, el chequeo de que la rama realmente forkeó de la línea correcta, + el bloqueo de breaking changes, el `package` en el pattern de branch-validation, los triggers extra de `6.x` en todos los workflows). - **NO**: borra la rama `6.x` ni ninguno de sus commits/tags/releases. Todo el trabajo real (fixes, features, releases 6.x.x) que se haya mergeado a @@ -109,7 +110,8 @@ deshacer, archivo por archivo: - Volver `on.pull_request.branches` a `[ main ]` (sacar `6.x`). - Sacar el bloque `with: pattern: ...` del job `branch-name` (que vuelva a usar el pattern default de la reusable workflow, sin `package`). -- Borrar los jobs `base-branch-check` y `no-breaking-changes` completos. +- Borrar los jobs `base-branch-check`, `fork-point-check` y + `no-breaking-changes` completos. ### `.husky/pre-commit` - Volver `PATTERN` a: From a7b3a0a9be44069b4ba98f9b0748a0850dfc4c01 Mon Sep 17 00:00:00 2001 From: Federico Maleh Date: Wed, 12 Aug 2026 08:50:33 -0300 Subject: [PATCH 08/81] feat(eks): add traffic_manager_port variable (#509) --- .../container_orchestration/eks/main.tf | 7 +++++- .../eks/tests/eks.tftest.hcl | 23 +++++++++++++++++++ .../container_orchestration/eks/variables.tf | 11 +++++++++ 3 files changed, 40 insertions(+), 1 deletion(-) diff --git a/nullplatform/container_orchestration/eks/main.tf b/nullplatform/container_orchestration/eks/main.tf index 6a3842cac..cb3747b30 100644 --- a/nullplatform/container_orchestration/eks/main.tf +++ b/nullplatform/container_orchestration/eks/main.tf @@ -33,6 +33,11 @@ locals { var.service_account_name != "" ? { service_account_name = var.service_account_name } : {}, ) + traffic_manager = merge( + var.traffic_manager_version != "" ? { version = var.traffic_manager_version } : {}, + var.traffic_manager_port != null ? { port = var.traffic_manager_port } : {}, + ) + attributes = merge( { cluster = local.cluster @@ -41,7 +46,7 @@ locals { length(local.network) > 0 ? { network = local.network } : {}, length(local.resource_management) > 0 ? { resource_management = local.resource_management } : {}, length(local.security) > 0 ? { security = local.security } : {}, - var.traffic_manager_version != "" ? { traffic_manager = { version = var.traffic_manager_version } } : {}, + length(local.traffic_manager) > 0 ? { traffic_manager = local.traffic_manager } : {}, length(var.object_modifiers) > 0 ? { object_modifiers = { modifiers = var.object_modifiers } } : {}, ) } diff --git a/nullplatform/container_orchestration/eks/tests/eks.tftest.hcl b/nullplatform/container_orchestration/eks/tests/eks.tftest.hcl index 681d1b40f..fb53d0ae5 100644 --- a/nullplatform/container_orchestration/eks/tests/eks.tftest.hcl +++ b/nullplatform/container_orchestration/eks/tests/eks.tftest.hcl @@ -196,6 +196,29 @@ run "with_traffic_manager" { condition = strcontains(nullplatform_provider_config.eks_config.attributes, "latest") error_message = "Attributes should contain traffic manager version" } + + assert { + condition = !strcontains(nullplatform_provider_config.eks_config.attributes, "\"port\"") + error_message = "Attributes should not contain traffic manager port when not set" + } +} + +run "with_traffic_manager_port" { + command = plan + + variables { + traffic_manager_port = 10080 + } + + assert { + condition = strcontains(nullplatform_provider_config.eks_config.attributes, "\"port\":10080") + error_message = "Attributes should contain the traffic manager port" + } + + assert { + condition = strcontains(nullplatform_provider_config.eks_config.attributes, "\"version\":\"latest\"") + error_message = "Setting the port must not drop the traffic manager version" + } } run "with_object_modifiers" { diff --git a/nullplatform/container_orchestration/eks/variables.tf b/nullplatform/container_orchestration/eks/variables.tf index 61934b2c7..4ac57957b 100644 --- a/nullplatform/container_orchestration/eks/variables.tf +++ b/nullplatform/container_orchestration/eks/variables.tf @@ -117,6 +117,17 @@ variable "traffic_manager_version" { default = "latest" } +variable "traffic_manager_port" { + description = "Port the traffic manager sidecar binds inside the pod. Defaults to 80 when unset. Set a different port (10080 recommended) when the cluster does not allow pod-to-pod traffic on port 80, which surfaces as a healthy pod that receives no traffic because kubelet probes are node-local and bypass the filtering. Open the port for pod-to-pod traffic before setting this value" + type = number + default = null + nullable = true + validation { + condition = var.traffic_manager_port == null || (var.traffic_manager_port >= 1 && var.traffic_manager_port <= 65535) + error_message = "traffic_manager_port must be between 1 and 65535." + } +} + variable "object_modifiers" { description = "List of modifications to dynamically modify k8s objects" type = list(object({ From d749dd46ceb8a87951f2d59929e6a477d20f4648 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 12 Aug 2026 08:53:35 -0300 Subject: [PATCH 09/81] chore(6.x): release 6.12.0 (#510) * chore(6.x): release 6.12.0 * docs: regenerate READMEs for changed modules and update versions --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] --- CHANGELOG.md | 7 +++ infrastructure/aws/acm/README.md | 2 +- .../aws_load_balancer_controller/README.md | 2 +- infrastructure/aws/backend/README.md | 2 +- infrastructure/aws/dns/README.md | 2 +- infrastructure/aws/eks/README.md | 2 +- infrastructure/aws/iam/agent/README.md | 2 +- .../README.md | 2 +- infrastructure/aws/iam/cert_manager/README.md | 2 +- .../aws/iam/ci-build-workflow-user/README.md | 2 +- infrastructure/aws/iam/cloudwatch/README.md | 2 +- infrastructure/aws/iam/ecr/README.md | 2 +- infrastructure/aws/iam/external_dns/README.md | 2 +- infrastructure/aws/iam/s3/README.md | 2 +- infrastructure/aws/ingress/README.md | 2 +- infrastructure/aws/security/README.md | 2 +- infrastructure/aws/vpc/README.md | 2 +- infrastructure/azure/acr/README.md | 2 +- infrastructure/azure/aks/README.md | 2 +- .../azure/aks_route_table/README.md | 2 +- infrastructure/azure/dns/README.md | 2 +- infrastructure/azure/iam/README.md | 2 +- infrastructure/azure/private_dns/README.md | 2 +- infrastructure/azure/resource_group/README.md | 2 +- infrastructure/azure/security/README.md | 2 +- infrastructure/azure/vnet/README.md | 2 +- infrastructure/commons/cert_manager/README.md | 12 ++--- infrastructure/commons/external_dns/README.md | 12 ++--- infrastructure/commons/istio/README.md | 2 +- infrastructure/commons/prometheus/README.md | 2 +- .../gcp/artifact-registry/README.md | 2 +- infrastructure/gcp/cloud-dns/README.md | 2 +- infrastructure/gcp/cloud-nat/README.md | 2 +- infrastructure/gcp/gke/README.md | 2 +- infrastructure/gcp/iam/README.md | 2 +- infrastructure/gcp/security/README.md | 2 +- infrastructure/gcp/vpc/README.md | 2 +- infrastructure/oci/backend/README.md | 2 +- infrastructure/oci/dns/README.md | 2 +- infrastructure/oci/dynamic_groups/README.md | 2 +- infrastructure/oci/oke/README.md | 2 +- infrastructure/oci/vcn/README.md | 2 +- nullplatform/account/README.md | 2 +- nullplatform/agent/README.md | 10 ++--- nullplatform/api_key/README.md | 10 ++--- nullplatform/asset/docker_server/README.md | 2 +- nullplatform/asset/ecr/README.md | 2 +- nullplatform/asset/s3/README.md | 2 +- nullplatform/base/README.md | 12 ++--- nullplatform/cloud/aws/cloud/README.md | 2 +- nullplatform/cloud/aws/vpc/README.md | 2 +- nullplatform/cloud/azure/cloud/README.md | 2 +- nullplatform/cloud/gcp/cloud/README.md | 2 +- nullplatform/cloud/oci/cloud/README.md | 2 +- nullplatform/code_repository/README.md | 10 ++--- .../container_orchestration/aks/README.md | 2 +- .../container_orchestration/eks/README.md | 44 +++++++++++-------- .../container_orchestration/gke/README.md | 2 +- .../container_orchestration/oke/README.md | 2 +- nullplatform/dimension/README.md | 2 +- nullplatform/dimension_value/README.md | 2 +- .../identity-access-control/README.md | 2 +- nullplatform/metrics/README.md | 2 +- nullplatform/packaged_service/README.md | 2 +- .../parameter_storage_configuration/README.md | 2 +- .../parameter_storage_definition/README.md | 2 +- .../README.md | 2 +- nullplatform/scope_configuration/README.md | 2 +- nullplatform/scope_definition/README.md | 2 +- .../README.md | 2 +- nullplatform/service_definition/README.md | 2 +- .../README.md | 2 +- nullplatform/users/README.md | 2 +- 73 files changed, 131 insertions(+), 116 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index e2c77e8d2..4260cecad 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,12 @@ # Changelog +## [6.12.0](https://github.com/nullplatform/tofu-modules/compare/v6.11.3...v6.12.0) (2026-08-12) + + +### Features + +* **eks:** add traffic_manager_port variable ([#509](https://github.com/nullplatform/tofu-modules/issues/509)) ([b2165b2](https://github.com/nullplatform/tofu-modules/commit/b2165b2e0cdd922922b4eb029c9f69512c8d0e62)) + ## [6.11.3](https://github.com/nullplatform/tofu-modules/compare/v6.11.2...v6.11.3) (2026-08-11) diff --git a/infrastructure/aws/acm/README.md b/infrastructure/aws/acm/README.md index 886bd4b1d..ca14fc00c 100644 --- a/infrastructure/aws/acm/README.md +++ b/infrastructure/aws/acm/README.md @@ -18,7 +18,7 @@ The module creates an aws_acm_certificate resource with DNS validation, which is ```hcl module "acm" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/acm?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/acm?ref=v6.12.0" domain_name = "your-domain-name" zone_id = "your-zone-id" diff --git a/infrastructure/aws/aws_load_balancer_controller/README.md b/infrastructure/aws/aws_load_balancer_controller/README.md index 7ea89e2ba..00feeff06 100644 --- a/infrastructure/aws/aws_load_balancer_controller/README.md +++ b/infrastructure/aws/aws_load_balancer_controller/README.md @@ -18,7 +18,7 @@ This module creates a helm_release resource to deploy the AWS Load Balancer Cont ```hcl module "aws_load_balancer_controller" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/aws_load_balancer_controller?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/aws_load_balancer_controller?ref=v6.12.0" cluster_name = "your-cluster-name" vpc_id = "your-vpc-id" diff --git a/infrastructure/aws/backend/README.md b/infrastructure/aws/backend/README.md index a4cd9df40..8403fb565 100644 --- a/infrastructure/aws/backend/README.md +++ b/infrastructure/aws/backend/README.md @@ -20,7 +20,7 @@ This module creates an S3 bucket with versioning and server-side encryption enab ```hcl module "backend" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/backend?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/backend?ref=v6.12.0" } ``` diff --git a/infrastructure/aws/dns/README.md b/infrastructure/aws/dns/README.md index f0734de8f..64aaa5e92 100644 --- a/infrastructure/aws/dns/README.md +++ b/infrastructure/aws/dns/README.md @@ -21,7 +21,7 @@ The module conditionally creates an aws_route53_zone resource for a public hoste ```hcl module "dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/dns?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/dns?ref=v6.12.0" domain_name = "your-domain-name" vpc_id = "your-vpc-id" diff --git a/infrastructure/aws/eks/README.md b/infrastructure/aws/eks/README.md index a0cac553f..4786f699e 100644 --- a/infrastructure/aws/eks/README.md +++ b/infrastructure/aws/eks/README.md @@ -22,7 +22,7 @@ The module wraps terraform-aws-modules/eks to create the EKS cluster (aws_eks_cl ```hcl module "eks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/eks?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/eks?ref=v6.12.0" aws_subnets_private_ids = "your-aws-subnets-private-ids" aws_vpc_vpc_id = "your-aws-vpc-vpc-id" diff --git a/infrastructure/aws/iam/agent/README.md b/infrastructure/aws/iam/agent/README.md index 936ace709..8ccdf7bcc 100644 --- a/infrastructure/aws/iam/agent/README.md +++ b/infrastructure/aws/iam/agent/README.md @@ -21,7 +21,7 @@ The module uses the terraform-aws-modules/iam//modules/iam-role-for-service-acco ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/agent?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/agent?ref=v6.12.0" agent_namespace = "your-agent-namespace" aws_iam_openid_connect_provider_arn = "your-aws-iam-openid-connect-provider-arn" diff --git a/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md b/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md index c05b9ff96..60cf835f8 100644 --- a/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md +++ b/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md @@ -19,7 +19,7 @@ This module creates an IAM role for the AWS Load Balancer Controller using the t ```hcl module "aws_load_balancer_controller_iam" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/aws_load_balancer_controller_iam?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/aws_load_balancer_controller_iam?ref=v6.12.0" aws_iam_openid_connect_provider_arn = "your-aws-iam-openid-connect-provider-arn" cluster_name = "your-cluster-name" diff --git a/infrastructure/aws/iam/cert_manager/README.md b/infrastructure/aws/iam/cert_manager/README.md index 10feb89cc..42a2d1d38 100644 --- a/infrastructure/aws/iam/cert_manager/README.md +++ b/infrastructure/aws/iam/cert_manager/README.md @@ -20,7 +20,7 @@ An aws_iam_policy resource is always created granting route53:GetChange, route53 ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cert_manager?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cert_manager?ref=v6.12.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/ci-build-workflow-user/README.md b/infrastructure/aws/iam/ci-build-workflow-user/README.md index 845905228..d01ed62e7 100644 --- a/infrastructure/aws/iam/ci-build-workflow-user/README.md +++ b/infrastructure/aws/iam/ci-build-workflow-user/README.md @@ -21,7 +21,7 @@ The module creates an aws_iam_user named with the cluster_name prefix and genera ```hcl module "ci-build-workflow-user" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ci-build-workflow-user?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ci-build-workflow-user?ref=v6.12.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/cloudwatch/README.md b/infrastructure/aws/iam/cloudwatch/README.md index cca1d182b..7039f8db3 100644 --- a/infrastructure/aws/iam/cloudwatch/README.md +++ b/infrastructure/aws/iam/cloudwatch/README.md @@ -20,7 +20,7 @@ The module creates an aws_iam_policy granting CloudWatch Logs and Metrics write ```hcl module "cloudwatch" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cloudwatch?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cloudwatch?ref=v6.12.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/ecr/README.md b/infrastructure/aws/iam/ecr/README.md index 4f99741ab..f75b74d37 100644 --- a/infrastructure/aws/iam/ecr/README.md +++ b/infrastructure/aws/iam/ecr/README.md @@ -20,7 +20,7 @@ The module creates an aws_iam_role named nullplatform-{cluster_name}-application ```hcl module "ecr" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ecr?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ecr?ref=v6.12.0" build_workflow_group_name = "your-build-workflow-group-name" cluster_name = "your-cluster-name" diff --git a/infrastructure/aws/iam/external_dns/README.md b/infrastructure/aws/iam/external_dns/README.md index b944871e1..f75494605 100644 --- a/infrastructure/aws/iam/external_dns/README.md +++ b/infrastructure/aws/iam/external_dns/README.md @@ -20,7 +20,7 @@ An aws_iam_policy resource named nullplatform_external_dns_policy is always crea ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/external_dns?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/external_dns?ref=v6.12.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/s3/README.md b/infrastructure/aws/iam/s3/README.md index 965822b02..24648e45a 100644 --- a/infrastructure/aws/iam/s3/README.md +++ b/infrastructure/aws/iam/s3/README.md @@ -18,7 +18,7 @@ The module creates an aws_iam_policy resource that allows s3:PutObject and s3:Ge ```hcl module "s3" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/s3?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/s3?ref=v6.12.0" bucket = "your-bucket" build_workflow_group_name = "your-build-workflow-group-name" diff --git a/infrastructure/aws/ingress/README.md b/infrastructure/aws/ingress/README.md index a3a2e3f1f..155590b98 100644 --- a/infrastructure/aws/ingress/README.md +++ b/infrastructure/aws/ingress/README.md @@ -22,7 +22,7 @@ The module creates up to two kubernetes_ingress_v1 resources — one for an inte ```hcl module "ingress" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/ingress?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/ingress?ref=v6.12.0" certificate_arn = "your-certificate-arn" } diff --git a/infrastructure/aws/security/README.md b/infrastructure/aws/security/README.md index 84d226712..82bf4e559 100644 --- a/infrastructure/aws/security/README.md +++ b/infrastructure/aws/security/README.md @@ -22,7 +22,7 @@ The module uses data sources (aws_eks_cluster, aws_vpc) to automatically derive ```hcl module "security" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/security?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/security?ref=v6.12.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/vpc/README.md b/infrastructure/aws/vpc/README.md index a9e98b3b2..8ac9ef3e4 100644 --- a/infrastructure/aws/vpc/README.md +++ b/infrastructure/aws/vpc/README.md @@ -22,7 +22,7 @@ This module creates a terraform-aws-modules/vpc/aws module resource with DNS hos ```hcl module "vpc" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/vpc?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/vpc?ref=v6.12.0" account = "your-account" organization = "your-organization" diff --git a/infrastructure/azure/acr/README.md b/infrastructure/azure/acr/README.md index b515f686a..3dc44cdeb 100644 --- a/infrastructure/azure/acr/README.md +++ b/infrastructure/azure/acr/README.md @@ -18,7 +18,7 @@ The module uses the azurerm_container_registry resource to create the container ```hcl module "acr" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/acr?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/acr?ref=v6.12.0" containerregistry_name = "your-containerregistry-name" location = "your-location" diff --git a/infrastructure/azure/aks/README.md b/infrastructure/azure/aks/README.md index 63c441ca9..8a7c1452a 100644 --- a/infrastructure/azure/aks/README.md +++ b/infrastructure/azure/aks/README.md @@ -22,7 +22,7 @@ The module wraps the Azure/aks/azurerm community module (version 11.0.0) and fee ```hcl module "aks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks?ref=v6.12.0" cluster_name = "your-cluster-name" location = "your-location" diff --git a/infrastructure/azure/aks_route_table/README.md b/infrastructure/azure/aks_route_table/README.md index 00469714c..d2fe32161 100644 --- a/infrastructure/azure/aks_route_table/README.md +++ b/infrastructure/azure/aks_route_table/README.md @@ -19,7 +19,7 @@ The module uses an azurerm_resources data source to discover the AKS-managed rou ```hcl module "aks_route_table" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks_route_table?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks_route_table?ref=v6.12.0" node_resource_group = "your-node-resource-group" subnet_id = "your-subnet-id" diff --git a/infrastructure/azure/dns/README.md b/infrastructure/azure/dns/README.md index 804ac82bf..b33b179f8 100644 --- a/infrastructure/azure/dns/README.md +++ b/infrastructure/azure/dns/README.md @@ -18,7 +18,7 @@ This module creates an azurerm_dns_zone resource and configures it with the prov ```hcl module "dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/dns?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/dns?ref=v6.12.0" domain_name = "your-domain-name" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/iam/README.md b/infrastructure/azure/iam/README.md index d7bb29b56..d3b03a16a 100644 --- a/infrastructure/azure/iam/README.md +++ b/infrastructure/azure/iam/README.md @@ -21,7 +21,7 @@ The module creates an azurerm_user_assigned_identity resource in the specified r ```hcl module "iam" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/iam?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/iam?ref=v6.12.0" location = "your-location" name = "your-name" diff --git a/infrastructure/azure/private_dns/README.md b/infrastructure/azure/private_dns/README.md index 20d530408..54ce648ef 100644 --- a/infrastructure/azure/private_dns/README.md +++ b/infrastructure/azure/private_dns/README.md @@ -18,7 +18,7 @@ This module creates an azurerm_private_dns_zone resource and optionally multiple ```hcl module "private_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/private_dns?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/private_dns?ref=v6.12.0" domain_name = "your-domain-name" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/resource_group/README.md b/infrastructure/azure/resource_group/README.md index e4f6def9b..6237c1f0d 100644 --- a/infrastructure/azure/resource_group/README.md +++ b/infrastructure/azure/resource_group/README.md @@ -18,7 +18,7 @@ This module creates an azurerm_resource_group resource and outputs its name and ```hcl module "resource_group" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/resource_group?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/resource_group?ref=v6.12.0" location = "your-location" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/security/README.md b/infrastructure/azure/security/README.md index 314063e5f..9e6a837c4 100644 --- a/infrastructure/azure/security/README.md +++ b/infrastructure/azure/security/README.md @@ -21,7 +21,7 @@ The module uses azurerm_kubernetes_cluster and azurerm_virtual_network data sour ```hcl module "security" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/security?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/security?ref=v6.12.0" cluster_name = "your-cluster-name" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/vnet/README.md b/infrastructure/azure/vnet/README.md index 549979540..cc35cc472 100644 --- a/infrastructure/azure/vnet/README.md +++ b/infrastructure/azure/vnet/README.md @@ -18,7 +18,7 @@ This module creates an Azure virtual network using the azurerm provider and conf ```hcl module "vnet" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/vnet?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/vnet?ref=v6.12.0" address_space = "your-address-space" location = "your-location" diff --git a/infrastructure/commons/cert_manager/README.md b/infrastructure/commons/cert_manager/README.md index b5b2614f8..c713f3e45 100644 --- a/infrastructure/commons/cert_manager/README.md +++ b/infrastructure/commons/cert_manager/README.md @@ -22,7 +22,7 @@ Two primary helm_release resources are created: cert-manager from the Jetstack c ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.12.0" account_slug = "your-account-slug" cloud_provider = "your-cloud-provider" @@ -35,7 +35,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.12.0" account_slug = "your-account-slug" cloud_provider = "gcp" @@ -50,7 +50,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.12.0" account_slug = "your-account-slug" azure_client_id = "your-azure-client-id" # Required when cloud_provider = "azure" @@ -68,7 +68,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.12.0" account_slug = "your-account-slug" cloud_provider = "cloudflare" @@ -83,7 +83,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.12.0" account_slug = "your-account-slug" aws_identity_mode = "your-aws-identity-mode" # Required when cloud_provider = "aws" @@ -99,7 +99,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.12.0" account_slug = "your-account-slug" cert_manager_webhook_oci_namespace = "your-cert-manager-webhook-oci-namespace" # Required when cloud_provider = "oci" diff --git a/infrastructure/commons/external_dns/README.md b/infrastructure/commons/external_dns/README.md index da3d2a241..a1a72ddcf 100644 --- a/infrastructure/commons/external_dns/README.md +++ b/infrastructure/commons/external_dns/README.md @@ -22,7 +22,7 @@ The module creates an optional kubernetes_namespace_v1 resource when create_name ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.12.0" dns_provider_name = "your-dns-provider-name" domain_filters = "your-domain-filters" @@ -33,7 +33,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.12.0" cloudflare_token = "your-cloudflare-token" # Required when dns_provider_name = "cloudflare" dns_provider_name = "cloudflare" @@ -45,7 +45,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.12.0" aws_iam_role_arn = "your-aws-iam-role-arn" # Required when dns_provider_name = "aws" aws_identity_mode = "your-aws-identity-mode" # Required when dns_provider_name = "aws" @@ -61,7 +61,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.12.0" dns_provider_name = "oci" domain_filters = "your-domain-filters" @@ -77,7 +77,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.12.0" azure_client_id = "your-azure-client-id" # Required when dns_provider_name = "azure" azure_federated_credential_id = "your-azure-federated-credential-id" # Required when dns_provider_name = "azure" @@ -94,7 +94,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.12.0" azure_client_id = "your-azure-client-id" # Required when dns_provider_name = "azure-private-dns" azure_federated_credential_id = "your-azure-federated-credential-id" # Required when dns_provider_name = "azure-private-dns" diff --git a/infrastructure/commons/istio/README.md b/infrastructure/commons/istio/README.md index ef9133333..9be00e09e 100644 --- a/infrastructure/commons/istio/README.md +++ b/infrastructure/commons/istio/README.md @@ -21,7 +21,7 @@ Three helm_release resources are created in a strict dependency chain: istio-bas ```hcl module "istio" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/istio?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/istio?ref=v6.12.0" } ``` diff --git a/infrastructure/commons/prometheus/README.md b/infrastructure/commons/prometheus/README.md index dc654bf86..bd1e12433 100644 --- a/infrastructure/commons/prometheus/README.md +++ b/infrastructure/commons/prometheus/README.md @@ -18,7 +18,7 @@ This module creates a helm_release resource to deploy the Prometheus chart from ```hcl module "prometheus" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.12.0" } ``` diff --git a/infrastructure/gcp/artifact-registry/README.md b/infrastructure/gcp/artifact-registry/README.md index e8e6e2e97..6eb9af7d3 100644 --- a/infrastructure/gcp/artifact-registry/README.md +++ b/infrastructure/gcp/artifact-registry/README.md @@ -21,7 +21,7 @@ The module provisions a google_artifact_registry_repository resource in the spec ```hcl module "artifact-registry" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/artifact-registry?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/artifact-registry?ref=v6.12.0" location = "your-location" project_id = "your-project-id" diff --git a/infrastructure/gcp/cloud-dns/README.md b/infrastructure/gcp/cloud-dns/README.md index 8d139fef9..0f82ae314 100644 --- a/infrastructure/gcp/cloud-dns/README.md +++ b/infrastructure/gcp/cloud-dns/README.md @@ -21,7 +21,7 @@ The module creates a single google_dns_managed_zone resource in the specified GC ```hcl module "cloud-dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-dns?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-dns?ref=v6.12.0" domain_name = "your-domain-name" project_id = "your-project-id" diff --git a/infrastructure/gcp/cloud-nat/README.md b/infrastructure/gcp/cloud-nat/README.md index 202738140..592a37248 100644 --- a/infrastructure/gcp/cloud-nat/README.md +++ b/infrastructure/gcp/cloud-nat/README.md @@ -19,7 +19,7 @@ This module creates a google_compute_router resource in a specified region and n ```hcl module "cloud-nat" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-nat?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-nat?ref=v6.12.0" nat_name = "your-nat-name" network_id = "your-network-id" diff --git a/infrastructure/gcp/gke/README.md b/infrastructure/gcp/gke/README.md index ddd4b6204..64619094b 100644 --- a/infrastructure/gcp/gke/README.md +++ b/infrastructure/gcp/gke/README.md @@ -20,7 +20,7 @@ The module uses the google-modules/kubernetes-engine/google//modules/private-clu ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.12.0" cluster_name = "your-cluster-name" ip_range_pods = "your-ip-range-pods" diff --git a/infrastructure/gcp/iam/README.md b/infrastructure/gcp/iam/README.md index f140cec8b..20aa56406 100644 --- a/infrastructure/gcp/iam/README.md +++ b/infrastructure/gcp/iam/README.md @@ -19,7 +19,7 @@ The module creates google_service_account resources for each service account spe ```hcl module "iam" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/iam?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/iam?ref=v6.12.0" project_id = "your-project-id" } diff --git a/infrastructure/gcp/security/README.md b/infrastructure/gcp/security/README.md index 582a9d4b3..f37b31a9d 100644 --- a/infrastructure/gcp/security/README.md +++ b/infrastructure/gcp/security/README.md @@ -19,7 +19,7 @@ This module uses Terraform to create GCP firewall rules for public and private I ```hcl module "security" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/security?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/security?ref=v6.12.0" cluster_name = "your-cluster-name" gcp_project_id = "your-gcp-project-id" diff --git a/infrastructure/gcp/vpc/README.md b/infrastructure/gcp/vpc/README.md index 2d410297a..cb59e30f9 100644 --- a/infrastructure/gcp/vpc/README.md +++ b/infrastructure/gcp/vpc/README.md @@ -20,7 +20,7 @@ The module invokes the terraform-google-modules/network/google module to create ```hcl module "vpc" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/vpc?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/vpc?ref=v6.12.0" network_name = "your-network-name" project_id = "your-project-id" diff --git a/infrastructure/oci/backend/README.md b/infrastructure/oci/backend/README.md index a387ad96a..4b0523bd0 100644 --- a/infrastructure/oci/backend/README.md +++ b/infrastructure/oci/backend/README.md @@ -18,7 +18,7 @@ The module creates an oci_objectstorage_bucket resource, which is configured wit ```hcl module "backend" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/backend?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/backend?ref=v6.12.0" compartment_id = "your-compartment-id" namespace = "your-namespace" diff --git a/infrastructure/oci/dns/README.md b/infrastructure/oci/dns/README.md index 2582745fb..426ffcfe1 100644 --- a/infrastructure/oci/dns/README.md +++ b/infrastructure/oci/dns/README.md @@ -18,7 +18,7 @@ This module creates oci_dns_zone resources for each DNS zone defined in the dns_ ```hcl module "dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dns?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dns?ref=v6.12.0" compartment_id = "your-compartment-id" } diff --git a/infrastructure/oci/dynamic_groups/README.md b/infrastructure/oci/dynamic_groups/README.md index d1cda7d23..0a23433cd 100644 --- a/infrastructure/oci/dynamic_groups/README.md +++ b/infrastructure/oci/dynamic_groups/README.md @@ -19,7 +19,7 @@ This module creates an OCI dynamic group and an OCI identity policy, connecting ```hcl module "dynamic_groups" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dynamic_groups?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dynamic_groups?ref=v6.12.0" cluster_id = "your-cluster-id" compartment_id = "your-compartment-id" diff --git a/infrastructure/oci/oke/README.md b/infrastructure/oci/oke/README.md index 6e2be3edb..10b7b811f 100644 --- a/infrastructure/oci/oke/README.md +++ b/infrastructure/oci/oke/README.md @@ -21,7 +21,7 @@ The module instantiates the oracle-terraform-modules/oke/oci module to create an ```hcl module "oke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/oke?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/oke?ref=v6.12.0" api_endpoint_subnet_id = "your-api-endpoint-subnet-id" cluster_name = "your-cluster-name" diff --git a/infrastructure/oci/vcn/README.md b/infrastructure/oci/vcn/README.md index a81b28c1e..5ae81c453 100644 --- a/infrastructure/oci/vcn/README.md +++ b/infrastructure/oci/vcn/README.md @@ -19,7 +19,7 @@ The module instantiates oci_core_subnet resources for public and private subnets ```hcl module "vcn" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/vcn?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/vcn?ref=v6.12.0" } ``` diff --git a/nullplatform/account/README.md b/nullplatform/account/README.md index 6fd33002b..bd5d3eca5 100644 --- a/nullplatform/account/README.md +++ b/nullplatform/account/README.md @@ -19,7 +19,7 @@ The module iterates over the `nullplatform_accounts` input map using `for_each` ```hcl module "account" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/account?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/account?ref=v6.12.0" nullplatform_accounts = "your-nullplatform-accounts" } diff --git a/nullplatform/agent/README.md b/nullplatform/agent/README.md index 1eb59c88b..82e402233 100644 --- a/nullplatform/agent/README.md +++ b/nullplatform/agent/README.md @@ -22,7 +22,7 @@ The module renders a Helm values file using a templatefile() call that merges de ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.12.0" api_key = "your-api-key" cloud_provider = "your-cloud-provider" @@ -37,7 +37,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.12.0" api_key = "your-api-key" aws_iam_role_arn = "your-aws-iam-role-arn" # Required when cloud_provider = "aws" @@ -53,7 +53,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.12.0" api_key = "your-api-key" cloud_provider = "gcp" @@ -68,7 +68,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.12.0" api_key = "your-api-key" azure_client_id = "your-azure-client-id" # Required when cloud_provider = "azure" @@ -91,7 +91,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.12.0" api_key = "your-api-key" cloud_provider = "oci" diff --git a/nullplatform/api_key/README.md b/nullplatform/api_key/README.md index 7a53c08f5..09d1bd91a 100644 --- a/nullplatform/api_key/README.md +++ b/nullplatform/api_key/README.md @@ -21,7 +21,7 @@ The module creates a single nullplatform_api_key resource whose name, grants, an ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.12.0" type = "your-type" } @@ -31,7 +31,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.12.0" nrn = "your-nrn" # Required when type = "agent" type = "agent" @@ -42,7 +42,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.12.0" nrn = "your-nrn" # Required when type = "scope_notification" specification_slug = "your-specification-slug" # Required when type = "scope_notification" @@ -54,7 +54,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.12.0" nrn = "your-nrn" # Required when type = "service_notification" specification_slug = "your-specification-slug" # Required when type = "service_notification" @@ -66,7 +66,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.12.0" custom_grants = "your-custom-grants" # Required when type = "custom" custom_name = "your-custom-name" # Required when type = "custom" diff --git a/nullplatform/asset/docker_server/README.md b/nullplatform/asset/docker_server/README.md index 24493eeb4..9cdcec409 100644 --- a/nullplatform/asset/docker_server/README.md +++ b/nullplatform/asset/docker_server/README.md @@ -21,7 +21,7 @@ Creates a nullplatform_provider_config resource of type 'docker-server' with enc ```hcl module "docker_server" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/docker_server?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/docker_server?ref=v6.12.0" login_server = "your-login-server" nrn = "your-nrn" diff --git a/nullplatform/asset/ecr/README.md b/nullplatform/asset/ecr/README.md index b54e288a6..2e0c48a6b 100644 --- a/nullplatform/asset/ecr/README.md +++ b/nullplatform/asset/ecr/README.md @@ -21,7 +21,7 @@ The module reads the current AWS region via the aws_region data source and combi ```hcl module "ecr" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/ecr?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/ecr?ref=v6.12.0" application_role_arn = "your-application-role-arn" build_workflow_access_key_id = "your-build-workflow-access-key-id" diff --git a/nullplatform/asset/s3/README.md b/nullplatform/asset/s3/README.md index c589ea757..97c0fcab6 100644 --- a/nullplatform/asset/s3/README.md +++ b/nullplatform/asset/s3/README.md @@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type s3-con ```hcl module "s3" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/s3?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/s3?ref=v6.12.0" bucket_name = "your-bucket-name" nrn = "your-nrn" diff --git a/nullplatform/base/README.md b/nullplatform/base/README.md index 62f539b8f..5adb23aed 100644 --- a/nullplatform/base/README.md +++ b/nullplatform/base/README.md @@ -22,7 +22,7 @@ The module first creates two kubernetes_namespace_v1 resources ('nullplatform-to ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.12.0" k8s_provider = "your-k8s-provider" np_api_key = "your-np-api-key" @@ -33,7 +33,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.12.0" k8s_provider = "eks" np_api_key = "your-np-api-key" @@ -44,7 +44,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.12.0" k8s_provider = "gke" np_api_key = "your-np-api-key" @@ -55,7 +55,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.12.0" k8s_provider = "aks" np_api_key = "your-np-api-key" @@ -66,7 +66,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.12.0" k8s_provider = "oke" np_api_key = "your-np-api-key" @@ -77,7 +77,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.12.0" k8s_provider = "aro" np_api_key = "your-np-api-key" diff --git a/nullplatform/cloud/aws/cloud/README.md b/nullplatform/cloud/aws/cloud/README.md index 26b51059b..ea057327f 100644 --- a/nullplatform/cloud/aws/cloud/README.md +++ b/nullplatform/cloud/aws/cloud/README.md @@ -21,7 +21,7 @@ The module uses data sources aws_caller_identity and aws_region to dynamically r ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/cloud?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/cloud?ref=v6.12.0" domain_name = "your-domain-name" hosted_private_zone_id = "your-hosted-private-zone-id" diff --git a/nullplatform/cloud/aws/vpc/README.md b/nullplatform/cloud/aws/vpc/README.md index 2b0b45865..a5571690c 100644 --- a/nullplatform/cloud/aws/vpc/README.md +++ b/nullplatform/cloud/aws/vpc/README.md @@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource of type aws-ne ```hcl module "vpc" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/vpc?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/vpc?ref=v6.12.0" nrn = "your-nrn" vpc_id = "your-vpc-id" diff --git a/nullplatform/cloud/azure/cloud/README.md b/nullplatform/cloud/azure/cloud/README.md index ea6fcbdb0..dcbb3b9c2 100644 --- a/nullplatform/cloud/azure/cloud/README.md +++ b/nullplatform/cloud/azure/cloud/README.md @@ -22,7 +22,7 @@ The module creates a single nullplatform_provider_config resource of type 'azure ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/azure/cloud?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/azure/cloud?ref=v6.12.0" azure_resource_group_name = "your-azure-resource-group-name" nrn = "your-nrn" diff --git a/nullplatform/cloud/gcp/cloud/README.md b/nullplatform/cloud/gcp/cloud/README.md index a85d4dc7c..e1c907182 100644 --- a/nullplatform/cloud/gcp/cloud/README.md +++ b/nullplatform/cloud/gcp/cloud/README.md @@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type 'googl ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/gcp/cloud?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/gcp/cloud?ref=v6.12.0" domain_name = "your-domain-name" location = "your-location" diff --git a/nullplatform/cloud/oci/cloud/README.md b/nullplatform/cloud/oci/cloud/README.md index f3745fdc9..72295ead4 100644 --- a/nullplatform/cloud/oci/cloud/README.md +++ b/nullplatform/cloud/oci/cloud/README.md @@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type 'oci-c ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/oci/cloud?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/oci/cloud?ref=v6.12.0" account_id = "your-account-id" account_name = "your-account-name" diff --git a/nullplatform/code_repository/README.md b/nullplatform/code_repository/README.md index f73ca5a30..99d378fe8 100644 --- a/nullplatform/code_repository/README.md +++ b/nullplatform/code_repository/README.md @@ -22,7 +22,7 @@ The module uses local boolean flags (is_gitlab, is_github, is_azure, is_bitbucke ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.12.0" git_provider = "your-git-provider" nrn = "your-nrn" @@ -33,7 +33,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.12.0" git_provider = "github" github_installation_id = "your-github-installation-id" # Required when git_provider = "github" @@ -46,7 +46,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.12.0" git_provider = "gitlab" gitlab_access_token = "your-gitlab-access-token" # Required when git_provider = "gitlab" @@ -62,7 +62,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.12.0" azure_access_token = "your-azure-access-token" # Required when git_provider = "azure" azure_agent_pool = "your-azure-agent-pool" # Required when git_provider = "azure" @@ -76,7 +76,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.12.0" bitbucket_collaborators = "your-bitbucket-collaborators" # Required when git_provider = "bitbucket" bitbucket_installation_url = "your-bitbucket-installation-url" # Required when git_provider = "bitbucket" diff --git a/nullplatform/container_orchestration/aks/README.md b/nullplatform/container_orchestration/aks/README.md index db2622aae..24499228c 100644 --- a/nullplatform/container_orchestration/aks/README.md +++ b/nullplatform/container_orchestration/aks/README.md @@ -21,7 +21,7 @@ The module builds a local.attributes map that aggregates cluster metadata, gatew ```hcl module "aks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.12.0" cluster_name = "your-cluster-name" nrn = "your-nrn" diff --git a/nullplatform/container_orchestration/eks/README.md b/nullplatform/container_orchestration/eks/README.md index f07c51039..89e7c121d 100644 --- a/nullplatform/container_orchestration/eks/README.md +++ b/nullplatform/container_orchestration/eks/README.md @@ -2,26 +2,27 @@ ## Description -Configures Nullplatform provider settings for Amazon EKS clusters with application deployment, load balancing, and resource management capabilities +Configures a Nullplatform EKS provider configuration resource with cluster, load balancer, networking, resource management, security, and traffic manager settings ## Architecture -Creates a nullplatform_provider_config resource with type 'eks-configuration' that aggregates cluster, balancer, network, resource management, and security settings. The module accepts EKS cluster configuration through input variables, constructs nested attribute maps using conditional logic to filter empty values, and encodes them as JSON attributes for the provider configuration. Internal locals merge cluster identity, load balancer names (public/private with additional balancers), namespace settings, resource quotas, and security configurations before passing them to the provider resource. +The module assembles a set of structured locals by merging optional variables into nested maps for cluster, balancer, network, resource_management, security, and traffic_manager configurations. All assembled locals are merged into a single attributes map and JSON-encoded before being passed to a single nullplatform_provider_config resource of type eks-configuration. Input variables flow directly into the locals merge logic, where empty strings and null values are conditionally excluded to avoid sending unset fields to the provider API. The nrn and dimensions variables are passed directly to the nullplatform_provider_config resource to identify and scope the configuration. ## Features -- Configures EKS cluster identity and default Kubernetes namespace for application deployments -- Manages public and private Application Load Balancer naming with support for additional balancers beyond the 100-rule limit -- Sets ALB capacity thresholds (50-99%) to reserve slots for concurrent deployments -- Controls resource allocation ratios for memory-to-CPU, memory request-to-limit, and CPU multipliers -- Configures image pull secrets and service account associations for secure container image access -- Supports traffic manager sidecar versioning and dynamic Kubernetes object modifications +- Creates a nullplatform_provider_config resource of type eks-configuration to register EKS cluster settings with the Nullplatform platform +- Configures public and private ALB load balancers with support for additional balancers to scale beyond the 100-rule ALB limit +- Enforces ALB naming validation ensuring names are 1-32 alphanumeric characters with hyphens and no leading or trailing hyphens +- Configures traffic manager sidecar container version and pod-binding port with range validation between 1 and 65535 +- Supports resource management tuning via memory-to-CPU ratio, memory request-to-limit ratio, max CPU cores multiplier, and max milicores +- Configures Kubernetes security settings including image pull secrets and a custom service account name +- Supports dynamic Kubernetes object modifiers for patching deployed k8s resources via selector, action, type, and value ## Basic Usage ```hcl module "eks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.12.0" cluster_name = "your-cluster-name" nrn = "your-nrn" @@ -77,6 +78,7 @@ resource "example_resource" "this" { | [private\_balancer\_name](#input\_private\_balancer\_name) | The name of the private load balancer for internal traffic routing | `string` | `""` | no | | [public\_balancer\_name](#input\_public\_balancer\_name) | The name of the public-facing load balancer for external traffic routing | `string` | `""` | no | | [service\_account\_name](#input\_service\_account\_name) | The name of the Kubernetes service account used for deployments | `string` | `""` | no | +| [traffic\_manager\_port](#input\_traffic\_manager\_port) | Port the traffic manager sidecar binds inside the pod. Defaults to 80 when unset. Set a different port (10080 recommended) when the cluster does not allow pod-to-pod traffic on port 80, which surfaces as a healthy pod that receives no traffic because kubelet probes are node-local and bypass the filtering. Open the port for pod-to-pod traffic before setting this value | `number` | `null` | no | | [traffic\_manager\_version](#input\_traffic\_manager\_version) | Tag for the traffic manager sidecar container | `string` | `"latest"` | no | | [use\_nullplatform\_namespace](#input\_use\_nullplatform\_namespace) | When enabled, uses the nullplatform system namespace instead of a custom namespace | `bool` | `false` | no | @@ -84,15 +86,16 @@ resource "example_resource" "this" { diff --git a/nullplatform/container_orchestration/gke/README.md b/nullplatform/container_orchestration/gke/README.md index 388479b71..396218663 100644 --- a/nullplatform/container_orchestration/gke/README.md +++ b/nullplatform/container_orchestration/gke/README.md @@ -22,7 +22,7 @@ The module constructs a structured attributes object using locals that merge clu ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.12.0" cluster_name = "your-cluster-name" location = "your-location" diff --git a/nullplatform/container_orchestration/oke/README.md b/nullplatform/container_orchestration/oke/README.md index 7404709d5..bcc5b0d94 100644 --- a/nullplatform/container_orchestration/oke/README.md +++ b/nullplatform/container_orchestration/oke/README.md @@ -19,7 +19,7 @@ Creates a single nullplatform_provider_config resource of type 'oke' that stores ```hcl module "oke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/oke?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/oke?ref=v6.12.0" cluster_name = "your-cluster-name" nrn = "your-nrn" diff --git a/nullplatform/dimension/README.md b/nullplatform/dimension/README.md index 2234de09f..3b1d30678 100644 --- a/nullplatform/dimension/README.md +++ b/nullplatform/dimension/README.md @@ -19,7 +19,7 @@ The module creates a nullplatform_dimension resource using the provided name, or ```hcl module "dimension" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension?ref=v6.12.0" name = "your-name" nrn = "your-nrn" diff --git a/nullplatform/dimension_value/README.md b/nullplatform/dimension_value/README.md index 4687ff879..2e751649b 100644 --- a/nullplatform/dimension_value/README.md +++ b/nullplatform/dimension_value/README.md @@ -19,7 +19,7 @@ The module uses a terraform_data resource to enforce mutual-exclusivity and pres ```hcl module "dimension_value" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension_value?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension_value?ref=v6.12.0" dimension_id = "your-dimension-id" name = "your-name" diff --git a/nullplatform/identity-access-control/README.md b/nullplatform/identity-access-control/README.md index 131de059b..cb78de80c 100644 --- a/nullplatform/identity-access-control/README.md +++ b/nullplatform/identity-access-control/README.md @@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource named identity ```hcl module "identity-access-control" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/identity-access-control?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/identity-access-control?ref=v6.12.0" attributes = "your-attributes" nrn = "your-nrn" diff --git a/nullplatform/metrics/README.md b/nullplatform/metrics/README.md index f4518a3b3..1e538dd47 100644 --- a/nullplatform/metrics/README.md +++ b/nullplatform/metrics/README.md @@ -21,7 +21,7 @@ The module creates a single nullplatform_provider_config resource of type 'prome ```hcl module "metrics" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/metrics?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/metrics?ref=v6.12.0" nrn = "your-nrn" } diff --git a/nullplatform/packaged_service/README.md b/nullplatform/packaged_service/README.md index 488ef171b..453a9d868 100644 --- a/nullplatform/packaged_service/README.md +++ b/nullplatform/packaged_service/README.md @@ -17,7 +17,7 @@ spec updates / republish correctly. ```hcl module "packaged_service" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/packaged_service?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/packaged_service?ref=v6.12.0" nrn = "organization=…:account=…:namespace=…" diff --git a/nullplatform/parameter_storage_configuration/README.md b/nullplatform/parameter_storage_configuration/README.md index 426a67f3b..5ff22fad8 100644 --- a/nullplatform/parameter_storage_configuration/README.md +++ b/nullplatform/parameter_storage_configuration/README.md @@ -20,7 +20,7 @@ The module delegates entirely to a remote `scope_configuration` module sourced f ```hcl module "parameter_storage_configuration" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_configuration?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_configuration?ref=v6.12.0" attributes = "your-attributes" np_api_key = "your-np-api-key" diff --git a/nullplatform/parameter_storage_definition/README.md b/nullplatform/parameter_storage_definition/README.md index dc83cb24f..691e0a5e7 100644 --- a/nullplatform/parameter_storage_definition/README.md +++ b/nullplatform/parameter_storage_definition/README.md @@ -20,7 +20,7 @@ A data.http resource fetches the raw specification template from a configurable ```hcl module "parameter_storage_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition?ref=v6.12.0" np_api_key = "your-np-api-key" nrn = "your-nrn" diff --git a/nullplatform/parameter_storage_definition_agent_association/README.md b/nullplatform/parameter_storage_definition_agent_association/README.md index 22cccc6f0..05dbbff11 100644 --- a/nullplatform/parameter_storage_definition_agent_association/README.md +++ b/nullplatform/parameter_storage_definition_agent_association/README.md @@ -21,7 +21,7 @@ The module creates a terraform_data resource to track API key changes and a null ```hcl module "parameter_storage_definition_agent_association" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition_agent_association?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition_agent_association?ref=v6.12.0" api_key = "your-api-key" nrn = "your-nrn" diff --git a/nullplatform/scope_configuration/README.md b/nullplatform/scope_configuration/README.md index f96befcb7..e6af3301e 100644 --- a/nullplatform/scope_configuration/README.md +++ b/nullplatform/scope_configuration/README.md @@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource that binds a N ```hcl module "scope_configuration" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_configuration?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_configuration?ref=v6.12.0" attributes = "your-attributes" np_api_key = "your-np-api-key" diff --git a/nullplatform/scope_definition/README.md b/nullplatform/scope_definition/README.md index 4c99930e6..91c8c4c75 100644 --- a/nullplatform/scope_definition/README.md +++ b/nullplatform/scope_definition/README.md @@ -22,7 +22,7 @@ The module fetches JSON templates via data.http resources from a configurable Gi ```hcl module "scope_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition?ref=v6.12.0" np_api_key = "your-np-api-key" nrn = "your-nrn" diff --git a/nullplatform/scope_definition_agent_association/README.md b/nullplatform/scope_definition_agent_association/README.md index d2e8840b1..f3d77a862 100644 --- a/nullplatform/scope_definition_agent_association/README.md +++ b/nullplatform/scope_definition_agent_association/README.md @@ -22,7 +22,7 @@ The module fetches a notification channel template via the `data.http` data sour ```hcl module "scope_definition_agent_association" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition_agent_association?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition_agent_association?ref=v6.12.0" api_key = "your-api-key" nrn = "your-nrn" diff --git a/nullplatform/service_definition/README.md b/nullplatform/service_definition/README.md index 20156d6cc..c86aa2877 100644 --- a/nullplatform/service_definition/README.md +++ b/nullplatform/service_definition/README.md @@ -22,7 +22,7 @@ The module uses data.http resources to fetch service-spec, action, and link JSON ```hcl module "service_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.12.0" nrn = "your-nrn" service_name = "your-service-name" diff --git a/nullplatform/service_definition_agent_association/README.md b/nullplatform/service_definition_agent_association/README.md index e08b41594..adb2f1bf6 100644 --- a/nullplatform/service_definition_agent_association/README.md +++ b/nullplatform/service_definition_agent_association/README.md @@ -22,7 +22,7 @@ The module creates a terraform_data resource to track API key changes as a lifec ```hcl module "service_definition_agent_association" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition_agent_association?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition_agent_association?ref=v6.12.0" api_key = "your-api-key" repository_service_spec_repo = "your-repository-service-spec-repo" diff --git a/nullplatform/users/README.md b/nullplatform/users/README.md index e24d2528b..4b3fb9231 100644 --- a/nullplatform/users/README.md +++ b/nullplatform/users/README.md @@ -21,7 +21,7 @@ The module iterates over a map of user definitions using `nullplatform_user` res ```hcl module "users" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/users?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/users?ref=v6.12.0" nullplatform_users = "your-nullplatform-users" } From ee4ec16a421432df1292480662b763660b301ea3 Mon Sep 17 00:00:00 2001 From: Javier Castiarena Date: Wed, 12 Aug 2026 11:54:52 -0300 Subject: [PATCH 10/81] chore(nullplatform): refresh provider lockfiles for the >= 0.0.99 constraint (#490) scope_definition and scope_definition_agent_association require nullplatform >= 0.0.99, but their committed .terraform.lock.hcl still pinned 0.0.95. The tofu-validate pre-commit hook runs `tofu init` with -lockfile=readonly, so it could not reconcile the two and failed for anyone committing a change in either module: Could not resolve provider nullplatform/nullplatform: locked provider registry.opentofu.org/nullplatform/nullplatform 0.0.95 does not match configured version constraint >= 0.0.99 CI was unaffected, so this only showed up locally. Re-locked with `tofu providers lock` scoped to that provider, keeping the three platforms the files already covered (linux_amd64, darwin_amd64, darwin_arm64). Plain `tofu init -upgrade` would also have bumped http and external, which is unrelated here, and would have narrowed the hashes to the local platform. --- .../scope_definition/.terraform.lock.hcl | 36 +++++++++---------- .../.terraform.lock.hcl | 36 +++++++++---------- 2 files changed, 36 insertions(+), 36 deletions(-) diff --git a/nullplatform/scope_definition/.terraform.lock.hcl b/nullplatform/scope_definition/.terraform.lock.hcl index 4d44513cb..b5f0882de 100644 --- a/nullplatform/scope_definition/.terraform.lock.hcl +++ b/nullplatform/scope_definition/.terraform.lock.hcl @@ -55,25 +55,25 @@ provider "registry.opentofu.org/hashicorp/null" { } provider "registry.opentofu.org/nullplatform/nullplatform" { - version = "0.0.95" - constraints = "~> 0.0.86" + version = "0.0.99" + constraints = ">= 0.0.99" hashes = [ - "h1:CwWF67wR7+i4kIqtQ6t6wDwJTCnnfwbK60B5zH2xMCo=", - "h1:TOKlvQhgsNAlXDVB9jNfTUTMIOgxgMJgHsr7AqTVtdA=", - "h1:UYs+ehJD8m3YGSb1vZUfFbYBHBRBj/Kn15Lp6OK2M5Y=", - "zh:02ec1e02e738e5f138e919d17391966e4b92d6933b6cd318eaed85e908f5cc8c", - "zh:1b2015fa088a40c4dcaef803d71942909ec45036524c12ca18272bf37dbf9283", - "zh:213f5ab10cc4c95e4568fdd10fec55886615978617b5815c9a900f233b4dca6e", - "zh:2a0ae4273515079385926beedeaf034257c4ee08e78733e19676fac9db4fd8d1", - "zh:356c2f91085ac397c419650a55c2ec8551da811db503a3dc0e510e05ca8fba42", - "zh:40bbd8163228b1ae88d515c643922c0565b015559b01023bc2ababdb3ad13e5c", - "zh:42ab71a0675b06fe3f661704142be8ddb029f052e3a001115fbb3ad0ee5e97f4", - "zh:46c6130dd7688a372a244c388f8568ddd12512e6d70d16b924495a4088f5ed4a", - "zh:5d862aa4ffa4f452a03e9a8ad3922a25674aff0a9770b674e09a68a087db17bb", - "zh:94cfe1a3446c4ea48d16b10c0b50f99bee89218f0a054514a97215c3af43c427", - "zh:aef3d42714928ca4099768efdaaf0d6eedab717d2b133ccb5de67167dfc24332", - "zh:e28d2e0a9b297c84dd18f1ab0a4f986108d2e1571523b15389473be4c267e917", - "zh:f1dd95be9f23c5602fcfca965832984f6d4411258c4ea87f69177a4604a5f39a", + "h1:Nw3pJ81u3FB10ODdT0sOIJxudlff9dJJd4ByYaAp6Eg=", + "h1:ecet/9nXRW2p+GlDwxrCRcpctrW783+BmRIA8zZ8poA=", + "h1:uQnumjTqtTYMEKQu8zS6oZLkLQA2VWaIXUlAA0hvfRQ=", + "zh:051c1090c1c974e08a9d2afcce06526a0e885946dfc313c9fca5b78686e847bd", + "zh:0a616dfe25c18dfdb53587b1513e2a74045eb4f3ae8b95972fb59dbba02837fa", + "zh:0f35146746ac00e489dae197d60001850d95cc4f6ffd69a7a043e1d7e7ccf0fe", + "zh:10fd7c9da8e03e84c036d0a6a42e638038e3b8109b3043e39d1a1a513fd869ee", + "zh:478b1f565686c2980f9852fc17140836c617bdb165c506d7eb31f49279e6bfdf", + "zh:59678c1ba91ec5745d864a1f740ab4bafa910d1f2f567031f04dc1bc4aabd8ec", + "zh:5fa4085fe12204f89800cfe8f83ec32722f734f15f687a12540158d84c805304", + "zh:889add641aa0bebf3170ff09cadda08bbf36b779a932e97f7c191d2b49dc9bd7", + "zh:9149e36721d58ec27656fa9a622f0f8a5fa36dceed5863e8b19e8f63c5e9d324", + "zh:b3a6407edf0afc8aad5a5ec34e0da14e35beb0667e44ec6178763b3bf176bfd7", + "zh:b8f216e27bfcb63dcb64e0e7459a2ecc80b3dd28a79f953bffc689ab252b56cb", + "zh:ba1c8cf16220cebf95d9a1515ddec2cceba93cb2c8c5eb8dfc143d5bab691cf5", + "zh:e0f8caf72b5974c8e849b57f3bcce2c2ffbbabe9829328915824ab34501f870e", "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c", ] } diff --git a/nullplatform/scope_definition_agent_association/.terraform.lock.hcl b/nullplatform/scope_definition_agent_association/.terraform.lock.hcl index a5513ea3d..9a488d03c 100644 --- a/nullplatform/scope_definition_agent_association/.terraform.lock.hcl +++ b/nullplatform/scope_definition_agent_association/.terraform.lock.hcl @@ -36,25 +36,25 @@ provider "registry.opentofu.org/hashicorp/http" { } provider "registry.opentofu.org/nullplatform/nullplatform" { - version = "0.0.95" - constraints = "~> 0.0.86" + version = "0.0.99" + constraints = ">= 0.0.99" hashes = [ - "h1:CwWF67wR7+i4kIqtQ6t6wDwJTCnnfwbK60B5zH2xMCo=", - "h1:TOKlvQhgsNAlXDVB9jNfTUTMIOgxgMJgHsr7AqTVtdA=", - "h1:UYs+ehJD8m3YGSb1vZUfFbYBHBRBj/Kn15Lp6OK2M5Y=", - "zh:02ec1e02e738e5f138e919d17391966e4b92d6933b6cd318eaed85e908f5cc8c", - "zh:1b2015fa088a40c4dcaef803d71942909ec45036524c12ca18272bf37dbf9283", - "zh:213f5ab10cc4c95e4568fdd10fec55886615978617b5815c9a900f233b4dca6e", - "zh:2a0ae4273515079385926beedeaf034257c4ee08e78733e19676fac9db4fd8d1", - "zh:356c2f91085ac397c419650a55c2ec8551da811db503a3dc0e510e05ca8fba42", - "zh:40bbd8163228b1ae88d515c643922c0565b015559b01023bc2ababdb3ad13e5c", - "zh:42ab71a0675b06fe3f661704142be8ddb029f052e3a001115fbb3ad0ee5e97f4", - "zh:46c6130dd7688a372a244c388f8568ddd12512e6d70d16b924495a4088f5ed4a", - "zh:5d862aa4ffa4f452a03e9a8ad3922a25674aff0a9770b674e09a68a087db17bb", - "zh:94cfe1a3446c4ea48d16b10c0b50f99bee89218f0a054514a97215c3af43c427", - "zh:aef3d42714928ca4099768efdaaf0d6eedab717d2b133ccb5de67167dfc24332", - "zh:e28d2e0a9b297c84dd18f1ab0a4f986108d2e1571523b15389473be4c267e917", - "zh:f1dd95be9f23c5602fcfca965832984f6d4411258c4ea87f69177a4604a5f39a", + "h1:Nw3pJ81u3FB10ODdT0sOIJxudlff9dJJd4ByYaAp6Eg=", + "h1:ecet/9nXRW2p+GlDwxrCRcpctrW783+BmRIA8zZ8poA=", + "h1:uQnumjTqtTYMEKQu8zS6oZLkLQA2VWaIXUlAA0hvfRQ=", + "zh:051c1090c1c974e08a9d2afcce06526a0e885946dfc313c9fca5b78686e847bd", + "zh:0a616dfe25c18dfdb53587b1513e2a74045eb4f3ae8b95972fb59dbba02837fa", + "zh:0f35146746ac00e489dae197d60001850d95cc4f6ffd69a7a043e1d7e7ccf0fe", + "zh:10fd7c9da8e03e84c036d0a6a42e638038e3b8109b3043e39d1a1a513fd869ee", + "zh:478b1f565686c2980f9852fc17140836c617bdb165c506d7eb31f49279e6bfdf", + "zh:59678c1ba91ec5745d864a1f740ab4bafa910d1f2f567031f04dc1bc4aabd8ec", + "zh:5fa4085fe12204f89800cfe8f83ec32722f734f15f687a12540158d84c805304", + "zh:889add641aa0bebf3170ff09cadda08bbf36b779a932e97f7c191d2b49dc9bd7", + "zh:9149e36721d58ec27656fa9a622f0f8a5fa36dceed5863e8b19e8f63c5e9d324", + "zh:b3a6407edf0afc8aad5a5ec34e0da14e35beb0667e44ec6178763b3bf176bfd7", + "zh:b8f216e27bfcb63dcb64e0e7459a2ecc80b3dd28a79f953bffc689ab252b56cb", + "zh:ba1c8cf16220cebf95d9a1515ddec2cceba93cb2c8c5eb8dfc143d5bab691cf5", + "zh:e0f8caf72b5974c8e849b57f3bcce2c2ffbbabe9829328915824ab34501f870e", "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c", ] } From 6dd502122e99f45ad509c1183e9cbef5b5f2c3e7 Mon Sep 17 00:00:00 2001 From: Javier Castiarena Date: Thu, 13 Aug 2026 10:33:22 -0300 Subject: [PATCH 11/81] feat(aks): support disabling local accounts with an Entra ID authorization path (#461) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The module hardcoded rbac_aad_azure_rbac_enabled = false and exposed neither local_account_disabled nor the admin group ids, so a cluster whose local accounts were disabled to meet a security baseline could not be expressed in configuration. Consumers hit two problems: a plan reverts the hardening back to the provider default, and the admin_* outputs go empty, which surfaces as "x509: apiserver certificate is not trusted" rather than as a missing credential. Adds local_account_disabled, azure_rbac_enabled and admin_group_object_ids, all passed through to the upstream module. Defaults preserve today's behaviour: local_account_disabled is null and azure_rbac_enabled keeps the previous hardcoded false. A precondition rejects local_account_disabled = true unless Azure RBAC or an admin group is configured. Without one of those, no identity is authorized against the API server, and the cluster is reachable only through an admin kubeconfig issued beforehand — unrecoverable from configuration once that credential stops working. The README documents the hardened setup, including the kubelogin exec block consumers need once the admin_* outputs are empty. --- infrastructure/azure/aks/README.md | 61 +++++++++++++++++++++++++ infrastructure/azure/aks/main.tf | 4 +- infrastructure/azure/aks/validations.tf | 9 ++++ infrastructure/azure/aks/variables.tf | 23 ++++++++++ 4 files changed, 96 insertions(+), 1 deletion(-) diff --git a/infrastructure/azure/aks/README.md b/infrastructure/azure/aks/README.md index 8a7c1452a..361917d74 100644 --- a/infrastructure/azure/aks/README.md +++ b/infrastructure/azure/aks/README.md @@ -11,6 +11,7 @@ The module wraps the Azure/aks/azurerm community module (version 11.0.0) and fee ## Features - Creates AKS cluster with RBAC, AAD integration, OIDC issuer, and workload identity enabled +- Supports disabling local admin accounts, guarded by a precondition that requires an Entra ID authorization path - Configures a fixed system node pool with configurable VM size, node count, and availability zones - Deploys an autoscaling user node pool with configurable min/max counts and availability zone spread - Grants Network Contributor role on the node subnet and any additional load-balancer subnets to the cluster identity @@ -32,6 +33,47 @@ module "aks" { } ``` +## Hardened Access + +Local admin accounts are certificate-based and bypass Entra ID, so security baselines often require +them off. Disabling them removes the only credential that works without Entra ID, which means an +authorization path has to be configured in the same change — the module enforces this with a +precondition rather than letting the cluster become unreachable. + +```hcl +module "aks" { + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks?ref=v6.12.0" + + cluster_name = "your-cluster-name" + location = "your-location" + resource_group_name = "your-resource-group-name" + subscription_id = "your-subscription-id" + vnet_subnet_id = "your-vnet-subnet-id" + + local_account_disabled = true + azure_rbac_enabled = true # grant access with Azure role assignments + # admin_group_object_ids = [""] # or keep authorization in Kubernetes RBAC +} +``` + +With `azure_rbac_enabled = true`, cluster access is granted outside this module with Azure role +assignments such as `Azure Kubernetes Service RBAC Cluster Admin`. Consumers reaching the API server +from Terraform must also authenticate through Entra ID, since the `admin_*` outputs are empty once +local accounts are disabled: + +```hcl +provider "kubernetes" { + host = module.aks.host + cluster_ca_certificate = base64decode(module.aks.cluster_ca_certificate) + + exec { + api_version = "client.authentication.k8s.io/v1beta1" + command = "kubelogin" + args = ["get-token", "--login", "azurecli", "--server-id", "6dae42f8-4368-4678-94ff-3960e28e3630"] + } +} +``` + ## Using Outputs ```hcl @@ -74,11 +116,14 @@ resource "example_resource" "this" { |------|-------------|------|---------|:--------:| | [acr\_id](#input\_acr\_id) | The ID of the Azure Container Registry. If provided, AKS will be granted AcrPull role to pull images. | `string` | `null` | no | | [additional\_network\_contributor\_subnet\_ids](#input\_additional\_network\_contributor\_subnet\_ids) | Extra subnet IDs, keyed by an arbitrary stable name, where the cluster identity also needs Network Contributor. The node subnet is granted automatically; add an entry for any other subnet the cloud-provider must write into -- typically the one an internal load balancer is pinned to via service.beta.kubernetes.io/azure-load-balancer-internal-subnet, which otherwise fails to provision with a 403 on virtualNetworks/subnets/read. | `map(string)` | `{}` | no | +| [admin\_group\_object\_ids](#input\_admin\_group\_object\_ids) | Entra ID group object IDs whose members get cluster-admin through Kubernetes RBAC. The alternative to azure\_rbac\_enabled when authorization should stay in-cluster. | `list(string)` | `null` | no | | [attach\_acr](#input\_attach\_acr) | Whether to grant AKS the AcrPull role on acr\_id. Null (default) preserves the legacy behaviour of attaching whenever acr\_id is non-null. Set to true for a greenfield single-apply where acr\_id is known only after apply (keeps the for\_each key set plan-stable); set to false to disable. | `bool` | `null` | no | | [authorized\_ip\_ranges](#input\_authorized\_ip\_ranges) | The set of authorized IP ranges allowed to access the Kubernetes API server | `set(string)` | `null` | no | +| [azure\_rbac\_enabled](#input\_azure\_rbac\_enabled) | Whether Kubernetes authorization is delegated to Azure RBAC, so cluster access is granted with Azure role assignments such as 'Azure Kubernetes Service RBAC Cluster Admin'. Defaults to false, which keeps authorization inside Kubernetes RBAC. | `bool` | `false` | no | | [cluster\_name](#input\_cluster\_name) | The name of the AKS cluster | `string` | n/a | yes | | [environment](#input\_environment) | The environment name used for tagging and naming purposes | `string` | `"nullplatform"` | no | | [kubernetes\_version](#input\_kubernetes\_version) | The version of Kubernetes to use for the AKS cluster | `string` | `"1.32.7"` | no | +| [local\_account\_disabled](#input\_local\_account\_disabled) | Whether to disable the AKS local (certificate-based) admin accounts. Null (default) leaves the Azure default, which keeps them enabled. When true, Entra ID becomes the only way into the API server, so an authorization path must be configured as well — see azure\_rbac\_enabled and admin\_group\_object\_ids. | `bool` | `null` | no | | [location](#input\_location) | The Azure region where the AKS cluster will be deployed (e.g., eastus, westus2) | `string` | n/a | yes | | [node\_pool\_zones](#input\_node\_pool\_zones) | Availability zones for the user node pool, e.g. ["1", "2", "3"].
Null (default) leaves the pool unzoned. Set it deliberately on a live
cluster: Azure treats a pool's zones as immutable, and upstream rotates the
pool through `temporary_name_for_rotation` to honour the change. | `set(string)` | `null` | no | | [prefix](#input\_prefix) | The prefix for resources created by the AKS module | `string` | `"aks"` | no | @@ -117,6 +162,7 @@ resource "example_resource" "this" { "architecture": "The module wraps the Azure/aks/azurerm community module (version 11.0.0) and feeds all input variables into it, creating an AKS cluster with a system node pool and a separate autoscaling user node pool both attached to the provided vnet_subnet_id. It retrieves the current Azure client config via azurerm_client_config to wire the tenant_id into AAD RBAC settings and enables workload_identity and oidc_issuer on the cluster. Network Contributor role assignments are applied to the node subnet and any additional subnets supplied via additional_network_contributor_subnet_ids, and an optional AcrPull role binding is conditionally created on the supplied ACR when acr_id is provided.", "features": [ "Creates AKS cluster with RBAC, AAD integration, OIDC issuer, and workload identity enabled", + "Supports disabling local admin accounts, guarded by a precondition that requires an Entra ID authorization path", "Configures a fixed system node pool with configurable VM size, node count, and availability zones", "Deploys an autoscaling user node pool with configurable min/max counts and availability zone spread", "Grants Network Contributor role on the node subnet and any additional load-balancer subnets to the cluster identity", @@ -229,6 +275,21 @@ resource "example_resource" "this" { "name": "system_pool_node_count", "description": "Fixed node count for the system pool. Defaults to 2, the upstream default this module relied on implicitly.", "required": false + }, + { + "name": "local_account_disabled", + "description": "Whether to disable the AKS local (certificate-based) admin accounts. Null (default) leaves the Azure default, which keeps them enabled. When true, Entra ID becomes the only way into the API server, so an authorization path must be configured as well — see azure_rbac_enabled and admin_group_object_ids.", + "required": false + }, + { + "name": "azure_rbac_enabled", + "description": "Whether Kubernetes authorization is delegated to Azure RBAC, so cluster access is granted with Azure role assignments such as 'Azure Kubernetes Service RBAC Cluster Admin'. Defaults to false, which keeps authorization inside Kubernetes RBAC.", + "required": false + }, + { + "name": "admin_group_object_ids", + "description": "Entra ID group object IDs whose members get cluster-admin through Kubernetes RBAC. The alternative to azure_rbac_enabled when authorization should stay in-cluster.", + "required": false } ], "outputs": [ diff --git a/infrastructure/azure/aks/main.tf b/infrastructure/azure/aks/main.tf index cff490c16..7d24c162f 100644 --- a/infrastructure/azure/aks/main.tf +++ b/infrastructure/azure/aks/main.tf @@ -30,8 +30,10 @@ module "aks" { # RBAC / AAD / OIDC / Workload Identity ############################################ role_based_access_control_enabled = true - rbac_aad_azure_rbac_enabled = false + rbac_aad_azure_rbac_enabled = var.azure_rbac_enabled + rbac_aad_admin_group_object_ids = var.admin_group_object_ids rbac_aad_tenant_id = data.azurerm_client_config.current.tenant_id + local_account_disabled = var.local_account_disabled workload_identity_enabled = true oidc_issuer_enabled = true diff --git a/infrastructure/azure/aks/validations.tf b/infrastructure/azure/aks/validations.tf index 974228a50..bc1985b35 100644 --- a/infrastructure/azure/aks/validations.tf +++ b/infrastructure/azure/aks/validations.tf @@ -9,5 +9,14 @@ resource "terraform_data" "validations" { condition = var.attach_acr != true || var.acr_id != null error_message = "acr_id is required when attach_acr is true. Leave attach_acr null (legacy) or set it false for clusters without an ACR." } + + # Disabling local accounts removes the certificate-based admin path, leaving Entra ID as the only + # way in. Without Azure RBAC or an admin group, no identity is authorized against the API server: + # the cluster stays reachable only through whatever admin kubeconfig was issued beforehand, and + # becomes unrecoverable from configuration once that credential stops working. + precondition { + condition = var.local_account_disabled != true || var.azure_rbac_enabled || try(length(var.admin_group_object_ids), 0) > 0 + error_message = "local_account_disabled = true removes the only certificate-based path into the cluster. Set azure_rbac_enabled = true, or provide admin_group_object_ids, so at least one Entra ID identity stays authorized." + } } } diff --git a/infrastructure/azure/aks/variables.tf b/infrastructure/azure/aks/variables.tf index 6655a868d..74eb1cc47 100644 --- a/infrastructure/azure/aks/variables.tf +++ b/infrastructure/azure/aks/variables.tf @@ -200,3 +200,26 @@ variable "system_pool_node_count" { type = number default = 2 } + +############################################################################### +# OPTIONAL VARIABLES - CLUSTER ACCESS AND AUTHORIZATION +############################################################################### + +variable "local_account_disabled" { + type = bool + description = "Whether to disable the AKS local (certificate-based) admin accounts. Null (default) leaves the Azure default, which keeps them enabled. When true, Entra ID becomes the only way into the API server, so an authorization path must be configured as well — see azure_rbac_enabled and admin_group_object_ids." + default = null +} + +variable "azure_rbac_enabled" { + type = bool + description = "Whether Kubernetes authorization is delegated to Azure RBAC, so cluster access is granted with Azure role assignments such as 'Azure Kubernetes Service RBAC Cluster Admin'. Defaults to false, which keeps authorization inside Kubernetes RBAC." + default = false + nullable = false +} + +variable "admin_group_object_ids" { + type = list(string) + description = "Entra ID group object IDs whose members get cluster-admin through Kubernetes RBAC. The alternative to azure_rbac_enabled when authorization should stay in-cluster." + default = null +} From 53efd562a058a6ce0f35c26b95d7c82fb8bb991b Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Fri, 14 Aug 2026 10:17:28 -0300 Subject: [PATCH 12/81] chore(6.x): release 6.13.0 (#516) * chore(6.x): release 6.13.0 * docs: regenerate READMEs for changed modules and update versions --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] --- CHANGELOG.md | 7 ++ infrastructure/aws/acm/README.md | 2 +- .../aws_load_balancer_controller/README.md | 2 +- infrastructure/aws/backend/README.md | 2 +- infrastructure/aws/dns/README.md | 2 +- infrastructure/aws/eks/README.md | 2 +- infrastructure/aws/iam/agent/README.md | 2 +- .../README.md | 2 +- infrastructure/aws/iam/cert_manager/README.md | 2 +- .../aws/iam/ci-build-workflow-user/README.md | 2 +- infrastructure/aws/iam/cloudwatch/README.md | 2 +- infrastructure/aws/iam/ecr/README.md | 2 +- infrastructure/aws/iam/external_dns/README.md | 2 +- infrastructure/aws/iam/s3/README.md | 2 +- infrastructure/aws/ingress/README.md | 2 +- infrastructure/aws/security/README.md | 2 +- infrastructure/aws/vpc/README.md | 2 +- infrastructure/azure/acr/README.md | 2 +- infrastructure/azure/aks/README.md | 83 +++++-------------- .../azure/aks_route_table/README.md | 2 +- infrastructure/azure/dns/README.md | 2 +- infrastructure/azure/iam/README.md | 2 +- infrastructure/azure/private_dns/README.md | 2 +- infrastructure/azure/resource_group/README.md | 2 +- infrastructure/azure/security/README.md | 2 +- infrastructure/azure/vnet/README.md | 2 +- infrastructure/commons/cert_manager/README.md | 12 +-- infrastructure/commons/external_dns/README.md | 12 +-- infrastructure/commons/istio/README.md | 2 +- infrastructure/commons/prometheus/README.md | 2 +- .../gcp/artifact-registry/README.md | 2 +- infrastructure/gcp/cloud-dns/README.md | 2 +- infrastructure/gcp/cloud-nat/README.md | 2 +- infrastructure/gcp/gke/README.md | 2 +- infrastructure/gcp/iam/README.md | 2 +- infrastructure/gcp/security/README.md | 2 +- infrastructure/gcp/vpc/README.md | 2 +- infrastructure/oci/backend/README.md | 2 +- infrastructure/oci/dns/README.md | 2 +- infrastructure/oci/dynamic_groups/README.md | 2 +- infrastructure/oci/oke/README.md | 2 +- infrastructure/oci/vcn/README.md | 2 +- nullplatform/account/README.md | 2 +- nullplatform/agent/README.md | 10 +-- nullplatform/api_key/README.md | 10 +-- nullplatform/asset/docker_server/README.md | 2 +- nullplatform/asset/ecr/README.md | 2 +- nullplatform/asset/s3/README.md | 2 +- nullplatform/base/README.md | 12 +-- nullplatform/cloud/aws/cloud/README.md | 2 +- nullplatform/cloud/aws/vpc/README.md | 2 +- nullplatform/cloud/azure/cloud/README.md | 2 +- nullplatform/cloud/gcp/cloud/README.md | 2 +- nullplatform/cloud/oci/cloud/README.md | 2 +- nullplatform/code_repository/README.md | 10 +-- .../container_orchestration/aks/README.md | 2 +- .../container_orchestration/eks/README.md | 2 +- .../container_orchestration/gke/README.md | 2 +- .../container_orchestration/oke/README.md | 2 +- nullplatform/dimension/README.md | 2 +- nullplatform/dimension_value/README.md | 2 +- .../identity-access-control/README.md | 2 +- nullplatform/metrics/README.md | 2 +- nullplatform/packaged_service/README.md | 2 +- .../parameter_storage_configuration/README.md | 2 +- .../parameter_storage_definition/README.md | 2 +- .../README.md | 2 +- nullplatform/scope_configuration/README.md | 2 +- nullplatform/scope_definition/README.md | 4 +- .../README.md | 4 +- nullplatform/service_definition/README.md | 2 +- .../README.md | 2 +- nullplatform/users/README.md | 2 +- 73 files changed, 127 insertions(+), 163 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 4260cecad..97b069647 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,12 @@ # Changelog +## [6.13.0](https://github.com/nullplatform/tofu-modules/compare/v6.12.0...v6.13.0) (2026-08-13) + + +### Features + +* **aks:** support disabling local accounts with an Entra ID authorization path ([#461](https://github.com/nullplatform/tofu-modules/issues/461)) ([3e3c412](https://github.com/nullplatform/tofu-modules/commit/3e3c412b5a996241da6a904f9e86b3faf51c6487)) + ## [6.12.0](https://github.com/nullplatform/tofu-modules/compare/v6.11.3...v6.12.0) (2026-08-12) diff --git a/infrastructure/aws/acm/README.md b/infrastructure/aws/acm/README.md index ca14fc00c..07f26c680 100644 --- a/infrastructure/aws/acm/README.md +++ b/infrastructure/aws/acm/README.md @@ -18,7 +18,7 @@ The module creates an aws_acm_certificate resource with DNS validation, which is ```hcl module "acm" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/acm?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/acm?ref=v6.13.0" domain_name = "your-domain-name" zone_id = "your-zone-id" diff --git a/infrastructure/aws/aws_load_balancer_controller/README.md b/infrastructure/aws/aws_load_balancer_controller/README.md index 00feeff06..c72605287 100644 --- a/infrastructure/aws/aws_load_balancer_controller/README.md +++ b/infrastructure/aws/aws_load_balancer_controller/README.md @@ -18,7 +18,7 @@ This module creates a helm_release resource to deploy the AWS Load Balancer Cont ```hcl module "aws_load_balancer_controller" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/aws_load_balancer_controller?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/aws_load_balancer_controller?ref=v6.13.0" cluster_name = "your-cluster-name" vpc_id = "your-vpc-id" diff --git a/infrastructure/aws/backend/README.md b/infrastructure/aws/backend/README.md index 8403fb565..acd6fb220 100644 --- a/infrastructure/aws/backend/README.md +++ b/infrastructure/aws/backend/README.md @@ -20,7 +20,7 @@ This module creates an S3 bucket with versioning and server-side encryption enab ```hcl module "backend" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/backend?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/backend?ref=v6.13.0" } ``` diff --git a/infrastructure/aws/dns/README.md b/infrastructure/aws/dns/README.md index 64aaa5e92..ad20e8055 100644 --- a/infrastructure/aws/dns/README.md +++ b/infrastructure/aws/dns/README.md @@ -21,7 +21,7 @@ The module conditionally creates an aws_route53_zone resource for a public hoste ```hcl module "dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/dns?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/dns?ref=v6.13.0" domain_name = "your-domain-name" vpc_id = "your-vpc-id" diff --git a/infrastructure/aws/eks/README.md b/infrastructure/aws/eks/README.md index 4786f699e..7f9185328 100644 --- a/infrastructure/aws/eks/README.md +++ b/infrastructure/aws/eks/README.md @@ -22,7 +22,7 @@ The module wraps terraform-aws-modules/eks to create the EKS cluster (aws_eks_cl ```hcl module "eks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/eks?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/eks?ref=v6.13.0" aws_subnets_private_ids = "your-aws-subnets-private-ids" aws_vpc_vpc_id = "your-aws-vpc-vpc-id" diff --git a/infrastructure/aws/iam/agent/README.md b/infrastructure/aws/iam/agent/README.md index 8ccdf7bcc..5c5b84464 100644 --- a/infrastructure/aws/iam/agent/README.md +++ b/infrastructure/aws/iam/agent/README.md @@ -21,7 +21,7 @@ The module uses the terraform-aws-modules/iam//modules/iam-role-for-service-acco ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/agent?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/agent?ref=v6.13.0" agent_namespace = "your-agent-namespace" aws_iam_openid_connect_provider_arn = "your-aws-iam-openid-connect-provider-arn" diff --git a/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md b/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md index 60cf835f8..6bbb9790a 100644 --- a/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md +++ b/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md @@ -19,7 +19,7 @@ This module creates an IAM role for the AWS Load Balancer Controller using the t ```hcl module "aws_load_balancer_controller_iam" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/aws_load_balancer_controller_iam?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/aws_load_balancer_controller_iam?ref=v6.13.0" aws_iam_openid_connect_provider_arn = "your-aws-iam-openid-connect-provider-arn" cluster_name = "your-cluster-name" diff --git a/infrastructure/aws/iam/cert_manager/README.md b/infrastructure/aws/iam/cert_manager/README.md index 42a2d1d38..179ae91e5 100644 --- a/infrastructure/aws/iam/cert_manager/README.md +++ b/infrastructure/aws/iam/cert_manager/README.md @@ -20,7 +20,7 @@ An aws_iam_policy resource is always created granting route53:GetChange, route53 ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cert_manager?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cert_manager?ref=v6.13.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/ci-build-workflow-user/README.md b/infrastructure/aws/iam/ci-build-workflow-user/README.md index d01ed62e7..dbe6cc55e 100644 --- a/infrastructure/aws/iam/ci-build-workflow-user/README.md +++ b/infrastructure/aws/iam/ci-build-workflow-user/README.md @@ -21,7 +21,7 @@ The module creates an aws_iam_user named with the cluster_name prefix and genera ```hcl module "ci-build-workflow-user" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ci-build-workflow-user?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ci-build-workflow-user?ref=v6.13.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/cloudwatch/README.md b/infrastructure/aws/iam/cloudwatch/README.md index 7039f8db3..9511ebc81 100644 --- a/infrastructure/aws/iam/cloudwatch/README.md +++ b/infrastructure/aws/iam/cloudwatch/README.md @@ -20,7 +20,7 @@ The module creates an aws_iam_policy granting CloudWatch Logs and Metrics write ```hcl module "cloudwatch" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cloudwatch?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cloudwatch?ref=v6.13.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/ecr/README.md b/infrastructure/aws/iam/ecr/README.md index f75b74d37..c49e85a86 100644 --- a/infrastructure/aws/iam/ecr/README.md +++ b/infrastructure/aws/iam/ecr/README.md @@ -20,7 +20,7 @@ The module creates an aws_iam_role named nullplatform-{cluster_name}-application ```hcl module "ecr" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ecr?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ecr?ref=v6.13.0" build_workflow_group_name = "your-build-workflow-group-name" cluster_name = "your-cluster-name" diff --git a/infrastructure/aws/iam/external_dns/README.md b/infrastructure/aws/iam/external_dns/README.md index f75494605..6d28f1532 100644 --- a/infrastructure/aws/iam/external_dns/README.md +++ b/infrastructure/aws/iam/external_dns/README.md @@ -20,7 +20,7 @@ An aws_iam_policy resource named nullplatform_external_dns_policy is always crea ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/external_dns?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/external_dns?ref=v6.13.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/s3/README.md b/infrastructure/aws/iam/s3/README.md index 24648e45a..6c0a6059c 100644 --- a/infrastructure/aws/iam/s3/README.md +++ b/infrastructure/aws/iam/s3/README.md @@ -18,7 +18,7 @@ The module creates an aws_iam_policy resource that allows s3:PutObject and s3:Ge ```hcl module "s3" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/s3?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/s3?ref=v6.13.0" bucket = "your-bucket" build_workflow_group_name = "your-build-workflow-group-name" diff --git a/infrastructure/aws/ingress/README.md b/infrastructure/aws/ingress/README.md index 155590b98..581491017 100644 --- a/infrastructure/aws/ingress/README.md +++ b/infrastructure/aws/ingress/README.md @@ -22,7 +22,7 @@ The module creates up to two kubernetes_ingress_v1 resources — one for an inte ```hcl module "ingress" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/ingress?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/ingress?ref=v6.13.0" certificate_arn = "your-certificate-arn" } diff --git a/infrastructure/aws/security/README.md b/infrastructure/aws/security/README.md index 82bf4e559..68953310d 100644 --- a/infrastructure/aws/security/README.md +++ b/infrastructure/aws/security/README.md @@ -22,7 +22,7 @@ The module uses data sources (aws_eks_cluster, aws_vpc) to automatically derive ```hcl module "security" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/security?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/security?ref=v6.13.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/vpc/README.md b/infrastructure/aws/vpc/README.md index 8ac9ef3e4..5823a3d8c 100644 --- a/infrastructure/aws/vpc/README.md +++ b/infrastructure/aws/vpc/README.md @@ -22,7 +22,7 @@ This module creates a terraform-aws-modules/vpc/aws module resource with DNS hos ```hcl module "vpc" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/vpc?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/vpc?ref=v6.13.0" account = "your-account" organization = "your-organization" diff --git a/infrastructure/azure/acr/README.md b/infrastructure/azure/acr/README.md index 3dc44cdeb..c994ee975 100644 --- a/infrastructure/azure/acr/README.md +++ b/infrastructure/azure/acr/README.md @@ -18,7 +18,7 @@ The module uses the azurerm_container_registry resource to create the container ```hcl module "acr" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/acr?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/acr?ref=v6.13.0" containerregistry_name = "your-containerregistry-name" location = "your-location" diff --git a/infrastructure/azure/aks/README.md b/infrastructure/azure/aks/README.md index 361917d74..3e1e8b032 100644 --- a/infrastructure/azure/aks/README.md +++ b/infrastructure/azure/aks/README.md @@ -2,28 +2,27 @@ ## Description -Deploys an Azure Kubernetes Service (AKS) cluster with configurable system and user node pools, workload identity, OIDC issuer, and optional ACR integration using the Azure/aks/azurerm upstream module +Deploys an Azure Kubernetes Service (AKS) cluster using the Azure/aks/azurerm module with system and user node pools, OIDC/workload identity, Azure RBAC integration, and optional ACR attachment ## Architecture -The module wraps the Azure/aks/azurerm community module (version 11.0.0) and feeds all input variables into it, creating an AKS cluster with a system node pool and a separate autoscaling user node pool both attached to the provided vnet_subnet_id. It retrieves the current Azure client config via azurerm_client_config to wire the tenant_id into AAD RBAC settings and enables workload_identity and oidc_issuer on the cluster. Network Contributor role assignments are applied to the node subnet and any additional subnets supplied via additional_network_contributor_subnet_ids, and an optional AcrPull role binding is conditionally created on the supplied ACR when acr_id is provided. +The module wraps the Azure/aks/azurerm community module (version 11.0.0) and uses a data source (azurerm_client_config) to retrieve the current tenant ID for AAD RBAC configuration. It provisions a system node pool via the module's top-level agents_* arguments and a separate user node pool via the node_pools map, both attached to the provided vnet_subnet_id with Network Contributor role assignments handled internally. OIDC issuer and workload identity are unconditionally enabled, and ACR attachment is controlled by a conditional attached_acr_id_map derived from the attach_acr and acr_id variables. Outputs expose cluster credentials, OIDC issuer URL, and node resource group for downstream consumption. ## Features -- Creates AKS cluster with RBAC, AAD integration, OIDC issuer, and workload identity enabled -- Supports disabling local admin accounts, guarded by a precondition that requires an Entra ID authorization path -- Configures a fixed system node pool with configurable VM size, node count, and availability zones -- Deploys an autoscaling user node pool with configurable min/max counts and availability zone spread -- Grants Network Contributor role on the node subnet and any additional load-balancer subnets to the cluster identity -- Optionally attaches an Azure Container Registry by granting AcrPull role to the cluster identity -- Exposes cluster credentials and OIDC issuer URL as outputs for downstream Kubernetes provider configuration -- Supports private cluster mode and API server authorized IP range restrictions +- Creates an AKS cluster with a dedicated system node pool and an autoscaling user node pool in the specified VNet subnet +- Enables OIDC issuer and workload identity unconditionally for Kubernetes service account federation +- Configures Azure RBAC and Entra ID admin group integration for cluster authorization +- Assigns Network Contributor role to node subnet and any additional subnets required for internal load balancers +- Attaches an Azure Container Registry with AcrPull role when acr_id is provided +- Supports availability zone spread for both system and user node pools via configurable zone variables +- Exposes cluster CA certificate, client credentials, and OIDC issuer URL as sensitive outputs ## Basic Usage ```hcl module "aks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks?ref=v6.13.0" cluster_name = "your-cluster-name" location = "your-location" @@ -33,47 +32,6 @@ module "aks" { } ``` -## Hardened Access - -Local admin accounts are certificate-based and bypass Entra ID, so security baselines often require -them off. Disabling them removes the only credential that works without Entra ID, which means an -authorization path has to be configured in the same change — the module enforces this with a -precondition rather than letting the cluster become unreachable. - -```hcl -module "aks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks?ref=v6.12.0" - - cluster_name = "your-cluster-name" - location = "your-location" - resource_group_name = "your-resource-group-name" - subscription_id = "your-subscription-id" - vnet_subnet_id = "your-vnet-subnet-id" - - local_account_disabled = true - azure_rbac_enabled = true # grant access with Azure role assignments - # admin_group_object_ids = [""] # or keep authorization in Kubernetes RBAC -} -``` - -With `azure_rbac_enabled = true`, cluster access is granted outside this module with Azure role -assignments such as `Azure Kubernetes Service RBAC Cluster Admin`. Consumers reaching the API server -from Terraform must also authenticate through Entra ID, since the `admin_*` outputs are empty once -local accounts are disabled: - -```hcl -provider "kubernetes" { - host = module.aks.host - cluster_ca_certificate = base64decode(module.aks.cluster_ca_certificate) - - exec { - api_version = "client.authentication.k8s.io/v1beta1" - command = "kubelogin" - args = ["get-token", "--login", "azurecli", "--server-id", "6dae42f8-4368-4678-94ff-3960e28e3630"] - } -} -``` - ## Using Outputs ```hcl @@ -158,17 +116,16 @@ resource "example_resource" "this" { diff --git a/infrastructure/azure/aks_route_table/README.md b/infrastructure/azure/aks_route_table/README.md index d2fe32161..0359fd8ba 100644 --- a/infrastructure/azure/aks_route_table/README.md +++ b/infrastructure/azure/aks_route_table/README.md @@ -19,7 +19,7 @@ The module uses an azurerm_resources data source to discover the AKS-managed rou ```hcl module "aks_route_table" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks_route_table?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks_route_table?ref=v6.13.0" node_resource_group = "your-node-resource-group" subnet_id = "your-subnet-id" diff --git a/infrastructure/azure/dns/README.md b/infrastructure/azure/dns/README.md index b33b179f8..c7a2217ef 100644 --- a/infrastructure/azure/dns/README.md +++ b/infrastructure/azure/dns/README.md @@ -18,7 +18,7 @@ This module creates an azurerm_dns_zone resource and configures it with the prov ```hcl module "dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/dns?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/dns?ref=v6.13.0" domain_name = "your-domain-name" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/iam/README.md b/infrastructure/azure/iam/README.md index d3b03a16a..6fd0e86f3 100644 --- a/infrastructure/azure/iam/README.md +++ b/infrastructure/azure/iam/README.md @@ -21,7 +21,7 @@ The module creates an azurerm_user_assigned_identity resource in the specified r ```hcl module "iam" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/iam?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/iam?ref=v6.13.0" location = "your-location" name = "your-name" diff --git a/infrastructure/azure/private_dns/README.md b/infrastructure/azure/private_dns/README.md index 54ce648ef..eba15f256 100644 --- a/infrastructure/azure/private_dns/README.md +++ b/infrastructure/azure/private_dns/README.md @@ -18,7 +18,7 @@ This module creates an azurerm_private_dns_zone resource and optionally multiple ```hcl module "private_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/private_dns?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/private_dns?ref=v6.13.0" domain_name = "your-domain-name" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/resource_group/README.md b/infrastructure/azure/resource_group/README.md index 6237c1f0d..e459d340d 100644 --- a/infrastructure/azure/resource_group/README.md +++ b/infrastructure/azure/resource_group/README.md @@ -18,7 +18,7 @@ This module creates an azurerm_resource_group resource and outputs its name and ```hcl module "resource_group" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/resource_group?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/resource_group?ref=v6.13.0" location = "your-location" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/security/README.md b/infrastructure/azure/security/README.md index 9e6a837c4..4b662fa0c 100644 --- a/infrastructure/azure/security/README.md +++ b/infrastructure/azure/security/README.md @@ -21,7 +21,7 @@ The module uses azurerm_kubernetes_cluster and azurerm_virtual_network data sour ```hcl module "security" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/security?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/security?ref=v6.13.0" cluster_name = "your-cluster-name" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/vnet/README.md b/infrastructure/azure/vnet/README.md index cc35cc472..71f67e24d 100644 --- a/infrastructure/azure/vnet/README.md +++ b/infrastructure/azure/vnet/README.md @@ -18,7 +18,7 @@ This module creates an Azure virtual network using the azurerm provider and conf ```hcl module "vnet" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/vnet?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/vnet?ref=v6.13.0" address_space = "your-address-space" location = "your-location" diff --git a/infrastructure/commons/cert_manager/README.md b/infrastructure/commons/cert_manager/README.md index c713f3e45..9c075103c 100644 --- a/infrastructure/commons/cert_manager/README.md +++ b/infrastructure/commons/cert_manager/README.md @@ -22,7 +22,7 @@ Two primary helm_release resources are created: cert-manager from the Jetstack c ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.13.0" account_slug = "your-account-slug" cloud_provider = "your-cloud-provider" @@ -35,7 +35,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.13.0" account_slug = "your-account-slug" cloud_provider = "gcp" @@ -50,7 +50,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.13.0" account_slug = "your-account-slug" azure_client_id = "your-azure-client-id" # Required when cloud_provider = "azure" @@ -68,7 +68,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.13.0" account_slug = "your-account-slug" cloud_provider = "cloudflare" @@ -83,7 +83,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.13.0" account_slug = "your-account-slug" aws_identity_mode = "your-aws-identity-mode" # Required when cloud_provider = "aws" @@ -99,7 +99,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.13.0" account_slug = "your-account-slug" cert_manager_webhook_oci_namespace = "your-cert-manager-webhook-oci-namespace" # Required when cloud_provider = "oci" diff --git a/infrastructure/commons/external_dns/README.md b/infrastructure/commons/external_dns/README.md index a1a72ddcf..7cbdf86a1 100644 --- a/infrastructure/commons/external_dns/README.md +++ b/infrastructure/commons/external_dns/README.md @@ -22,7 +22,7 @@ The module creates an optional kubernetes_namespace_v1 resource when create_name ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.13.0" dns_provider_name = "your-dns-provider-name" domain_filters = "your-domain-filters" @@ -33,7 +33,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.13.0" cloudflare_token = "your-cloudflare-token" # Required when dns_provider_name = "cloudflare" dns_provider_name = "cloudflare" @@ -45,7 +45,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.13.0" aws_iam_role_arn = "your-aws-iam-role-arn" # Required when dns_provider_name = "aws" aws_identity_mode = "your-aws-identity-mode" # Required when dns_provider_name = "aws" @@ -61,7 +61,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.13.0" dns_provider_name = "oci" domain_filters = "your-domain-filters" @@ -77,7 +77,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.13.0" azure_client_id = "your-azure-client-id" # Required when dns_provider_name = "azure" azure_federated_credential_id = "your-azure-federated-credential-id" # Required when dns_provider_name = "azure" @@ -94,7 +94,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.13.0" azure_client_id = "your-azure-client-id" # Required when dns_provider_name = "azure-private-dns" azure_federated_credential_id = "your-azure-federated-credential-id" # Required when dns_provider_name = "azure-private-dns" diff --git a/infrastructure/commons/istio/README.md b/infrastructure/commons/istio/README.md index 9be00e09e..565c16832 100644 --- a/infrastructure/commons/istio/README.md +++ b/infrastructure/commons/istio/README.md @@ -21,7 +21,7 @@ Three helm_release resources are created in a strict dependency chain: istio-bas ```hcl module "istio" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/istio?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/istio?ref=v6.13.0" } ``` diff --git a/infrastructure/commons/prometheus/README.md b/infrastructure/commons/prometheus/README.md index bd1e12433..c73da8ae6 100644 --- a/infrastructure/commons/prometheus/README.md +++ b/infrastructure/commons/prometheus/README.md @@ -18,7 +18,7 @@ This module creates a helm_release resource to deploy the Prometheus chart from ```hcl module "prometheus" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.13.0" } ``` diff --git a/infrastructure/gcp/artifact-registry/README.md b/infrastructure/gcp/artifact-registry/README.md index 6eb9af7d3..0b555df41 100644 --- a/infrastructure/gcp/artifact-registry/README.md +++ b/infrastructure/gcp/artifact-registry/README.md @@ -21,7 +21,7 @@ The module provisions a google_artifact_registry_repository resource in the spec ```hcl module "artifact-registry" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/artifact-registry?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/artifact-registry?ref=v6.13.0" location = "your-location" project_id = "your-project-id" diff --git a/infrastructure/gcp/cloud-dns/README.md b/infrastructure/gcp/cloud-dns/README.md index 0f82ae314..99d161197 100644 --- a/infrastructure/gcp/cloud-dns/README.md +++ b/infrastructure/gcp/cloud-dns/README.md @@ -21,7 +21,7 @@ The module creates a single google_dns_managed_zone resource in the specified GC ```hcl module "cloud-dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-dns?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-dns?ref=v6.13.0" domain_name = "your-domain-name" project_id = "your-project-id" diff --git a/infrastructure/gcp/cloud-nat/README.md b/infrastructure/gcp/cloud-nat/README.md index 592a37248..cc78ceab6 100644 --- a/infrastructure/gcp/cloud-nat/README.md +++ b/infrastructure/gcp/cloud-nat/README.md @@ -19,7 +19,7 @@ This module creates a google_compute_router resource in a specified region and n ```hcl module "cloud-nat" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-nat?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-nat?ref=v6.13.0" nat_name = "your-nat-name" network_id = "your-network-id" diff --git a/infrastructure/gcp/gke/README.md b/infrastructure/gcp/gke/README.md index 64619094b..a7c80efb2 100644 --- a/infrastructure/gcp/gke/README.md +++ b/infrastructure/gcp/gke/README.md @@ -20,7 +20,7 @@ The module uses the google-modules/kubernetes-engine/google//modules/private-clu ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.13.0" cluster_name = "your-cluster-name" ip_range_pods = "your-ip-range-pods" diff --git a/infrastructure/gcp/iam/README.md b/infrastructure/gcp/iam/README.md index 20aa56406..46f3d416a 100644 --- a/infrastructure/gcp/iam/README.md +++ b/infrastructure/gcp/iam/README.md @@ -19,7 +19,7 @@ The module creates google_service_account resources for each service account spe ```hcl module "iam" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/iam?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/iam?ref=v6.13.0" project_id = "your-project-id" } diff --git a/infrastructure/gcp/security/README.md b/infrastructure/gcp/security/README.md index f37b31a9d..7db29ab79 100644 --- a/infrastructure/gcp/security/README.md +++ b/infrastructure/gcp/security/README.md @@ -19,7 +19,7 @@ This module uses Terraform to create GCP firewall rules for public and private I ```hcl module "security" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/security?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/security?ref=v6.13.0" cluster_name = "your-cluster-name" gcp_project_id = "your-gcp-project-id" diff --git a/infrastructure/gcp/vpc/README.md b/infrastructure/gcp/vpc/README.md index cb59e30f9..b3c653422 100644 --- a/infrastructure/gcp/vpc/README.md +++ b/infrastructure/gcp/vpc/README.md @@ -20,7 +20,7 @@ The module invokes the terraform-google-modules/network/google module to create ```hcl module "vpc" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/vpc?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/vpc?ref=v6.13.0" network_name = "your-network-name" project_id = "your-project-id" diff --git a/infrastructure/oci/backend/README.md b/infrastructure/oci/backend/README.md index 4b0523bd0..28a39a275 100644 --- a/infrastructure/oci/backend/README.md +++ b/infrastructure/oci/backend/README.md @@ -18,7 +18,7 @@ The module creates an oci_objectstorage_bucket resource, which is configured wit ```hcl module "backend" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/backend?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/backend?ref=v6.13.0" compartment_id = "your-compartment-id" namespace = "your-namespace" diff --git a/infrastructure/oci/dns/README.md b/infrastructure/oci/dns/README.md index 426ffcfe1..09e68d9f2 100644 --- a/infrastructure/oci/dns/README.md +++ b/infrastructure/oci/dns/README.md @@ -18,7 +18,7 @@ This module creates oci_dns_zone resources for each DNS zone defined in the dns_ ```hcl module "dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dns?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dns?ref=v6.13.0" compartment_id = "your-compartment-id" } diff --git a/infrastructure/oci/dynamic_groups/README.md b/infrastructure/oci/dynamic_groups/README.md index 0a23433cd..cbaa53050 100644 --- a/infrastructure/oci/dynamic_groups/README.md +++ b/infrastructure/oci/dynamic_groups/README.md @@ -19,7 +19,7 @@ This module creates an OCI dynamic group and an OCI identity policy, connecting ```hcl module "dynamic_groups" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dynamic_groups?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dynamic_groups?ref=v6.13.0" cluster_id = "your-cluster-id" compartment_id = "your-compartment-id" diff --git a/infrastructure/oci/oke/README.md b/infrastructure/oci/oke/README.md index 10b7b811f..ab2f29734 100644 --- a/infrastructure/oci/oke/README.md +++ b/infrastructure/oci/oke/README.md @@ -21,7 +21,7 @@ The module instantiates the oracle-terraform-modules/oke/oci module to create an ```hcl module "oke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/oke?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/oke?ref=v6.13.0" api_endpoint_subnet_id = "your-api-endpoint-subnet-id" cluster_name = "your-cluster-name" diff --git a/infrastructure/oci/vcn/README.md b/infrastructure/oci/vcn/README.md index 5ae81c453..97c6cddb0 100644 --- a/infrastructure/oci/vcn/README.md +++ b/infrastructure/oci/vcn/README.md @@ -19,7 +19,7 @@ The module instantiates oci_core_subnet resources for public and private subnets ```hcl module "vcn" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/vcn?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/vcn?ref=v6.13.0" } ``` diff --git a/nullplatform/account/README.md b/nullplatform/account/README.md index bd5d3eca5..59665d556 100644 --- a/nullplatform/account/README.md +++ b/nullplatform/account/README.md @@ -19,7 +19,7 @@ The module iterates over the `nullplatform_accounts` input map using `for_each` ```hcl module "account" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/account?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/account?ref=v6.13.0" nullplatform_accounts = "your-nullplatform-accounts" } diff --git a/nullplatform/agent/README.md b/nullplatform/agent/README.md index 82e402233..babc38fce 100644 --- a/nullplatform/agent/README.md +++ b/nullplatform/agent/README.md @@ -22,7 +22,7 @@ The module renders a Helm values file using a templatefile() call that merges de ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.13.0" api_key = "your-api-key" cloud_provider = "your-cloud-provider" @@ -37,7 +37,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.13.0" api_key = "your-api-key" aws_iam_role_arn = "your-aws-iam-role-arn" # Required when cloud_provider = "aws" @@ -53,7 +53,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.13.0" api_key = "your-api-key" cloud_provider = "gcp" @@ -68,7 +68,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.13.0" api_key = "your-api-key" azure_client_id = "your-azure-client-id" # Required when cloud_provider = "azure" @@ -91,7 +91,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.13.0" api_key = "your-api-key" cloud_provider = "oci" diff --git a/nullplatform/api_key/README.md b/nullplatform/api_key/README.md index 09d1bd91a..f0d2f95d4 100644 --- a/nullplatform/api_key/README.md +++ b/nullplatform/api_key/README.md @@ -21,7 +21,7 @@ The module creates a single nullplatform_api_key resource whose name, grants, an ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.13.0" type = "your-type" } @@ -31,7 +31,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.13.0" nrn = "your-nrn" # Required when type = "agent" type = "agent" @@ -42,7 +42,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.13.0" nrn = "your-nrn" # Required when type = "scope_notification" specification_slug = "your-specification-slug" # Required when type = "scope_notification" @@ -54,7 +54,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.13.0" nrn = "your-nrn" # Required when type = "service_notification" specification_slug = "your-specification-slug" # Required when type = "service_notification" @@ -66,7 +66,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.13.0" custom_grants = "your-custom-grants" # Required when type = "custom" custom_name = "your-custom-name" # Required when type = "custom" diff --git a/nullplatform/asset/docker_server/README.md b/nullplatform/asset/docker_server/README.md index 9cdcec409..76a2cffc1 100644 --- a/nullplatform/asset/docker_server/README.md +++ b/nullplatform/asset/docker_server/README.md @@ -21,7 +21,7 @@ Creates a nullplatform_provider_config resource of type 'docker-server' with enc ```hcl module "docker_server" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/docker_server?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/docker_server?ref=v6.13.0" login_server = "your-login-server" nrn = "your-nrn" diff --git a/nullplatform/asset/ecr/README.md b/nullplatform/asset/ecr/README.md index 2e0c48a6b..77ded6f8f 100644 --- a/nullplatform/asset/ecr/README.md +++ b/nullplatform/asset/ecr/README.md @@ -21,7 +21,7 @@ The module reads the current AWS region via the aws_region data source and combi ```hcl module "ecr" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/ecr?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/ecr?ref=v6.13.0" application_role_arn = "your-application-role-arn" build_workflow_access_key_id = "your-build-workflow-access-key-id" diff --git a/nullplatform/asset/s3/README.md b/nullplatform/asset/s3/README.md index 97c0fcab6..e4027e800 100644 --- a/nullplatform/asset/s3/README.md +++ b/nullplatform/asset/s3/README.md @@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type s3-con ```hcl module "s3" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/s3?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/s3?ref=v6.13.0" bucket_name = "your-bucket-name" nrn = "your-nrn" diff --git a/nullplatform/base/README.md b/nullplatform/base/README.md index 5adb23aed..97e3ddf4c 100644 --- a/nullplatform/base/README.md +++ b/nullplatform/base/README.md @@ -22,7 +22,7 @@ The module first creates two kubernetes_namespace_v1 resources ('nullplatform-to ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.13.0" k8s_provider = "your-k8s-provider" np_api_key = "your-np-api-key" @@ -33,7 +33,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.13.0" k8s_provider = "eks" np_api_key = "your-np-api-key" @@ -44,7 +44,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.13.0" k8s_provider = "gke" np_api_key = "your-np-api-key" @@ -55,7 +55,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.13.0" k8s_provider = "aks" np_api_key = "your-np-api-key" @@ -66,7 +66,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.13.0" k8s_provider = "oke" np_api_key = "your-np-api-key" @@ -77,7 +77,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.13.0" k8s_provider = "aro" np_api_key = "your-np-api-key" diff --git a/nullplatform/cloud/aws/cloud/README.md b/nullplatform/cloud/aws/cloud/README.md index ea057327f..86c546640 100644 --- a/nullplatform/cloud/aws/cloud/README.md +++ b/nullplatform/cloud/aws/cloud/README.md @@ -21,7 +21,7 @@ The module uses data sources aws_caller_identity and aws_region to dynamically r ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/cloud?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/cloud?ref=v6.13.0" domain_name = "your-domain-name" hosted_private_zone_id = "your-hosted-private-zone-id" diff --git a/nullplatform/cloud/aws/vpc/README.md b/nullplatform/cloud/aws/vpc/README.md index a5571690c..3061fc96b 100644 --- a/nullplatform/cloud/aws/vpc/README.md +++ b/nullplatform/cloud/aws/vpc/README.md @@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource of type aws-ne ```hcl module "vpc" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/vpc?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/vpc?ref=v6.13.0" nrn = "your-nrn" vpc_id = "your-vpc-id" diff --git a/nullplatform/cloud/azure/cloud/README.md b/nullplatform/cloud/azure/cloud/README.md index dcbb3b9c2..453a4b697 100644 --- a/nullplatform/cloud/azure/cloud/README.md +++ b/nullplatform/cloud/azure/cloud/README.md @@ -22,7 +22,7 @@ The module creates a single nullplatform_provider_config resource of type 'azure ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/azure/cloud?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/azure/cloud?ref=v6.13.0" azure_resource_group_name = "your-azure-resource-group-name" nrn = "your-nrn" diff --git a/nullplatform/cloud/gcp/cloud/README.md b/nullplatform/cloud/gcp/cloud/README.md index e1c907182..a140820ee 100644 --- a/nullplatform/cloud/gcp/cloud/README.md +++ b/nullplatform/cloud/gcp/cloud/README.md @@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type 'googl ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/gcp/cloud?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/gcp/cloud?ref=v6.13.0" domain_name = "your-domain-name" location = "your-location" diff --git a/nullplatform/cloud/oci/cloud/README.md b/nullplatform/cloud/oci/cloud/README.md index 72295ead4..8122f7916 100644 --- a/nullplatform/cloud/oci/cloud/README.md +++ b/nullplatform/cloud/oci/cloud/README.md @@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type 'oci-c ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/oci/cloud?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/oci/cloud?ref=v6.13.0" account_id = "your-account-id" account_name = "your-account-name" diff --git a/nullplatform/code_repository/README.md b/nullplatform/code_repository/README.md index 99d378fe8..99c8fe11f 100644 --- a/nullplatform/code_repository/README.md +++ b/nullplatform/code_repository/README.md @@ -22,7 +22,7 @@ The module uses local boolean flags (is_gitlab, is_github, is_azure, is_bitbucke ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.13.0" git_provider = "your-git-provider" nrn = "your-nrn" @@ -33,7 +33,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.13.0" git_provider = "github" github_installation_id = "your-github-installation-id" # Required when git_provider = "github" @@ -46,7 +46,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.13.0" git_provider = "gitlab" gitlab_access_token = "your-gitlab-access-token" # Required when git_provider = "gitlab" @@ -62,7 +62,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.13.0" azure_access_token = "your-azure-access-token" # Required when git_provider = "azure" azure_agent_pool = "your-azure-agent-pool" # Required when git_provider = "azure" @@ -76,7 +76,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.13.0" bitbucket_collaborators = "your-bitbucket-collaborators" # Required when git_provider = "bitbucket" bitbucket_installation_url = "your-bitbucket-installation-url" # Required when git_provider = "bitbucket" diff --git a/nullplatform/container_orchestration/aks/README.md b/nullplatform/container_orchestration/aks/README.md index 24499228c..821248ec4 100644 --- a/nullplatform/container_orchestration/aks/README.md +++ b/nullplatform/container_orchestration/aks/README.md @@ -21,7 +21,7 @@ The module builds a local.attributes map that aggregates cluster metadata, gatew ```hcl module "aks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.13.0" cluster_name = "your-cluster-name" nrn = "your-nrn" diff --git a/nullplatform/container_orchestration/eks/README.md b/nullplatform/container_orchestration/eks/README.md index 89e7c121d..6136b9cbc 100644 --- a/nullplatform/container_orchestration/eks/README.md +++ b/nullplatform/container_orchestration/eks/README.md @@ -22,7 +22,7 @@ The module assembles a set of structured locals by merging optional variables in ```hcl module "eks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.13.0" cluster_name = "your-cluster-name" nrn = "your-nrn" diff --git a/nullplatform/container_orchestration/gke/README.md b/nullplatform/container_orchestration/gke/README.md index 396218663..003d64af0 100644 --- a/nullplatform/container_orchestration/gke/README.md +++ b/nullplatform/container_orchestration/gke/README.md @@ -22,7 +22,7 @@ The module constructs a structured attributes object using locals that merge clu ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.13.0" cluster_name = "your-cluster-name" location = "your-location" diff --git a/nullplatform/container_orchestration/oke/README.md b/nullplatform/container_orchestration/oke/README.md index bcc5b0d94..b11a541d8 100644 --- a/nullplatform/container_orchestration/oke/README.md +++ b/nullplatform/container_orchestration/oke/README.md @@ -19,7 +19,7 @@ Creates a single nullplatform_provider_config resource of type 'oke' that stores ```hcl module "oke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/oke?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/oke?ref=v6.13.0" cluster_name = "your-cluster-name" nrn = "your-nrn" diff --git a/nullplatform/dimension/README.md b/nullplatform/dimension/README.md index 3b1d30678..b053e2e97 100644 --- a/nullplatform/dimension/README.md +++ b/nullplatform/dimension/README.md @@ -19,7 +19,7 @@ The module creates a nullplatform_dimension resource using the provided name, or ```hcl module "dimension" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension?ref=v6.13.0" name = "your-name" nrn = "your-nrn" diff --git a/nullplatform/dimension_value/README.md b/nullplatform/dimension_value/README.md index 2e751649b..8f94b4fe6 100644 --- a/nullplatform/dimension_value/README.md +++ b/nullplatform/dimension_value/README.md @@ -19,7 +19,7 @@ The module uses a terraform_data resource to enforce mutual-exclusivity and pres ```hcl module "dimension_value" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension_value?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension_value?ref=v6.13.0" dimension_id = "your-dimension-id" name = "your-name" diff --git a/nullplatform/identity-access-control/README.md b/nullplatform/identity-access-control/README.md index cb78de80c..62caf73fc 100644 --- a/nullplatform/identity-access-control/README.md +++ b/nullplatform/identity-access-control/README.md @@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource named identity ```hcl module "identity-access-control" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/identity-access-control?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/identity-access-control?ref=v6.13.0" attributes = "your-attributes" nrn = "your-nrn" diff --git a/nullplatform/metrics/README.md b/nullplatform/metrics/README.md index 1e538dd47..6f985d158 100644 --- a/nullplatform/metrics/README.md +++ b/nullplatform/metrics/README.md @@ -21,7 +21,7 @@ The module creates a single nullplatform_provider_config resource of type 'prome ```hcl module "metrics" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/metrics?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/metrics?ref=v6.13.0" nrn = "your-nrn" } diff --git a/nullplatform/packaged_service/README.md b/nullplatform/packaged_service/README.md index 453a9d868..dfee39a41 100644 --- a/nullplatform/packaged_service/README.md +++ b/nullplatform/packaged_service/README.md @@ -17,7 +17,7 @@ spec updates / republish correctly. ```hcl module "packaged_service" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/packaged_service?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/packaged_service?ref=v6.13.0" nrn = "organization=…:account=…:namespace=…" diff --git a/nullplatform/parameter_storage_configuration/README.md b/nullplatform/parameter_storage_configuration/README.md index 5ff22fad8..f0ca219f7 100644 --- a/nullplatform/parameter_storage_configuration/README.md +++ b/nullplatform/parameter_storage_configuration/README.md @@ -20,7 +20,7 @@ The module delegates entirely to a remote `scope_configuration` module sourced f ```hcl module "parameter_storage_configuration" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_configuration?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_configuration?ref=v6.13.0" attributes = "your-attributes" np_api_key = "your-np-api-key" diff --git a/nullplatform/parameter_storage_definition/README.md b/nullplatform/parameter_storage_definition/README.md index 691e0a5e7..8c325cb5d 100644 --- a/nullplatform/parameter_storage_definition/README.md +++ b/nullplatform/parameter_storage_definition/README.md @@ -20,7 +20,7 @@ A data.http resource fetches the raw specification template from a configurable ```hcl module "parameter_storage_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition?ref=v6.13.0" np_api_key = "your-np-api-key" nrn = "your-nrn" diff --git a/nullplatform/parameter_storage_definition_agent_association/README.md b/nullplatform/parameter_storage_definition_agent_association/README.md index 05dbbff11..3e0ac4701 100644 --- a/nullplatform/parameter_storage_definition_agent_association/README.md +++ b/nullplatform/parameter_storage_definition_agent_association/README.md @@ -21,7 +21,7 @@ The module creates a terraform_data resource to track API key changes and a null ```hcl module "parameter_storage_definition_agent_association" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition_agent_association?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition_agent_association?ref=v6.13.0" api_key = "your-api-key" nrn = "your-nrn" diff --git a/nullplatform/scope_configuration/README.md b/nullplatform/scope_configuration/README.md index e6af3301e..bb97e7526 100644 --- a/nullplatform/scope_configuration/README.md +++ b/nullplatform/scope_configuration/README.md @@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource that binds a N ```hcl module "scope_configuration" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_configuration?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_configuration?ref=v6.13.0" attributes = "your-attributes" np_api_key = "your-np-api-key" diff --git a/nullplatform/scope_definition/README.md b/nullplatform/scope_definition/README.md index 91c8c4c75..b27d4bbce 100644 --- a/nullplatform/scope_definition/README.md +++ b/nullplatform/scope_definition/README.md @@ -22,7 +22,7 @@ The module fetches JSON templates via data.http resources from a configurable Gi ```hcl module "scope_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition?ref=v6.13.0" np_api_key = "your-np-api-key" nrn = "your-nrn" @@ -54,7 +54,7 @@ resource "example_resource" "this" { | [external](#provider\_external) | 2.3.5 | | [http](#provider\_http) | 3.5.0 | | [null](#provider\_null) | 3.2.4 | -| [nullplatform](#provider\_nullplatform) | 0.0.95 | +| [nullplatform](#provider\_nullplatform) | 0.0.99 | ## Resources diff --git a/nullplatform/scope_definition_agent_association/README.md b/nullplatform/scope_definition_agent_association/README.md index f3d77a862..d2a826274 100644 --- a/nullplatform/scope_definition_agent_association/README.md +++ b/nullplatform/scope_definition_agent_association/README.md @@ -22,7 +22,7 @@ The module fetches a notification channel template via the `data.http` data sour ```hcl module "scope_definition_agent_association" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition_agent_association?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition_agent_association?ref=v6.13.0" api_key = "your-api-key" nrn = "your-nrn" @@ -54,7 +54,7 @@ resource "example_resource" "this" { |------|---------| | [external](#provider\_external) | 2.3.5 | | [http](#provider\_http) | 3.5.0 | -| [nullplatform](#provider\_nullplatform) | 0.0.95 | +| [nullplatform](#provider\_nullplatform) | 0.0.99 | | [terraform](#provider\_terraform) | n/a | ## Resources diff --git a/nullplatform/service_definition/README.md b/nullplatform/service_definition/README.md index c86aa2877..89749f144 100644 --- a/nullplatform/service_definition/README.md +++ b/nullplatform/service_definition/README.md @@ -22,7 +22,7 @@ The module uses data.http resources to fetch service-spec, action, and link JSON ```hcl module "service_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.13.0" nrn = "your-nrn" service_name = "your-service-name" diff --git a/nullplatform/service_definition_agent_association/README.md b/nullplatform/service_definition_agent_association/README.md index adb2f1bf6..af8ff94cd 100644 --- a/nullplatform/service_definition_agent_association/README.md +++ b/nullplatform/service_definition_agent_association/README.md @@ -22,7 +22,7 @@ The module creates a terraform_data resource to track API key changes as a lifec ```hcl module "service_definition_agent_association" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition_agent_association?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition_agent_association?ref=v6.13.0" api_key = "your-api-key" repository_service_spec_repo = "your-repository-service-spec-repo" diff --git a/nullplatform/users/README.md b/nullplatform/users/README.md index 4b3fb9231..687f1c06a 100644 --- a/nullplatform/users/README.md +++ b/nullplatform/users/README.md @@ -21,7 +21,7 @@ The module iterates over a map of user definitions using `nullplatform_user` res ```hcl module "users" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/users?ref=v6.12.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/users?ref=v6.13.0" nullplatform_users = "your-nullplatform-users" } From 7a5006714f7f5067b68c7bbf63779fd0aad9227b Mon Sep 17 00:00:00 2001 From: Sebastian Correa Date: Fri, 14 Aug 2026 11:00:50 -0300 Subject: [PATCH 13/81] fix(gcp/security): handle full resource path in cluster subnetwork lookup (#512) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit data.google_container_cluster.this[0].subnetwork echoes back whatever format the cluster was created with. When the cluster comes from terraform-google-modules/kubernetes-engine (as in infrastructure/gcp/gke), that's a full "projects/.../regions/.../subnetworks/NAME" path, not a bare name — but data.google_compute_subnetwork.this only accepts a bare name in its `name` argument, so every apply combining infrastructure/gcp/gke with infrastructure/gcp/security failed with a 400 "Invalid value for field 'subnetwork'" error. This is 100% reproducible, not a race condition, and none of the module's existing override variables (gcp_network_name, network_cidr) avoid it, since the subnetwork data source's count doesn't depend on them. Take the last "/"-separated segment of the cluster's subnetwork attribute before using it, which is correct whether the value is already a bare name or a full path. Co-authored-by: sebas_correa Co-authored-by: Claude Sonnet 5 --- .github/workflows/tofu-test.yml | 2 +- .../gcp/security/.terraform.lock.hcl | 20 ++++++ infrastructure/gcp/security/main.tf | 15 +++- .../gcp/security/tests/security.tftest.hcl | 68 +++++++++++++++++++ 4 files changed, 103 insertions(+), 2 deletions(-) create mode 100644 infrastructure/gcp/security/.terraform.lock.hcl create mode 100644 infrastructure/gcp/security/tests/security.tftest.hcl diff --git a/.github/workflows/tofu-test.yml b/.github/workflows/tofu-test.yml index 8e4e97e7f..a83efb0e4 100644 --- a/.github/workflows/tofu-test.yml +++ b/.github/workflows/tofu-test.yml @@ -25,7 +25,7 @@ jobs: test-gcp-modules: uses: nullplatform/actions-nullplatform/.github/workflows/tofu-test.yml@main with: - modules: '["infrastructure/gcp/artifact-registry", "infrastructure/gcp/cloud-dns", "infrastructure/gcp/cloud-nat", "infrastructure/gcp/iam", "infrastructure/gcp/vpc"]' + modules: '["infrastructure/gcp/artifact-registry", "infrastructure/gcp/cloud-dns", "infrastructure/gcp/cloud-nat", "infrastructure/gcp/iam", "infrastructure/gcp/security", "infrastructure/gcp/vpc"]' test-nullplatform-modules: uses: nullplatform/actions-nullplatform/.github/workflows/tofu-test.yml@main diff --git a/infrastructure/gcp/security/.terraform.lock.hcl b/infrastructure/gcp/security/.terraform.lock.hcl new file mode 100644 index 000000000..37533dfdb --- /dev/null +++ b/infrastructure/gcp/security/.terraform.lock.hcl @@ -0,0 +1,20 @@ +# This file is maintained automatically by "tofu init". +# Manual edits may be lost in future updates. + +provider "registry.opentofu.org/hashicorp/google" { + version = "5.45.2" + constraints = "~> 5.0" + hashes = [ + "h1:YEQOp7Ou1+GtpcKyCX6Cr/mAGqKIogpi85MX51GuG4s=", + "zh:0931f08e81f220ae3132169cfa4ed8e9d8d2045f29ca914afd8ee9e3e9cf56e0", + "zh:31afa45a4c8a0fd4abff564ecff8b69a97ac1813ead61c12f5f0bf5d33cec7f1", + "zh:536979e437aad59ba41465c9398d8e3d7d3702bfe2a51d80571862d48c817959", + "zh:748e14614be32350ece4e9249e09bc1d20e54421983734ded3a0df6d6674ea71", + "zh:7c8fe641666603aad6693207c8eaac679b9be15246d77090c73a1a84326d6084", + "zh:8095a513a0662323d99c25466b5a291c80b2b0c1857c7c7a7b1159f25dbe4439", + "zh:9453db86d14611cab26dba30daf56d1cfef929918207e9e3e78b58299fc8c4fe", + "zh:adaa5df5d40060409b6b66136c0ac37b99fb35ac2cf554c584649c236a18d95b", + "zh:af2f659b4bd1f44e578f203830bdab829b5e635fcf2a59ffa7e997c16e6611ad", + "zh:b75184fe5c162821b0524fa941d6a934c452e815d82e62675bb21bbdc9046dfc", + ] +} diff --git a/infrastructure/gcp/security/main.tf b/infrastructure/gcp/security/main.tf index e12cd0e0b..8bc1eeaba 100644 --- a/infrastructure/gcp/security/main.tf +++ b/infrastructure/gcp/security/main.tf @@ -36,10 +36,23 @@ data "google_container_cluster" "this" { } } +locals { + # google_container_cluster.subnetwork is documented as the subnetwork name, + # but in practice it echoes back whatever format the cluster was created + # with — a bare name, or (e.g. when created via a module that passes a full + # reference, such as terraform-google-modules/kubernetes-engine) the full + # "projects/.../regions/.../subnetworks/NAME" path. google_compute_subnetwork + # only accepts a bare name, so take the last path segment either way. + cluster_subnetwork_name = var.cluster_name != "" ? element( + split("/", data.google_container_cluster.this[0].subnetwork), + length(split("/", data.google_container_cluster.this[0].subnetwork)) - 1 + ) : "" +} + # Get subnetwork info to derive CIDR data "google_compute_subnetwork" "this" { count = var.cluster_name != "" ? 1 : 0 - name = data.google_container_cluster.this[0].subnetwork + name = local.cluster_subnetwork_name region = var.gcp_region project = var.gcp_project_id } diff --git a/infrastructure/gcp/security/tests/security.tftest.hcl b/infrastructure/gcp/security/tests/security.tftest.hcl new file mode 100644 index 000000000..87f74233c --- /dev/null +++ b/infrastructure/gcp/security/tests/security.tftest.hcl @@ -0,0 +1,68 @@ +mock_provider "google" {} + +variables { + cluster_name = "myorg-cluster" + gcp_project_id = "myorg-project" + gcp_region = "us-central1" +} + +run "subnetwork_name_extracted_from_full_resource_path" { + command = plan + + override_data { + target = data.google_container_cluster.this + values = { + subnetwork = "projects/myorg-project/regions/us-central1/subnetworks/subnet-gke" + network = "myorg-vpc" + } + } + + assert { + condition = local.cluster_subnetwork_name == "subnet-gke" + error_message = "Should extract the bare subnetwork name when the cluster's subnetwork attribute is a full resource path" + } +} + +run "subnetwork_name_passthrough_when_already_bare" { + command = plan + + override_data { + target = data.google_container_cluster.this + values = { + subnetwork = "subnet-gke" + network = "myorg-vpc" + } + } + + assert { + condition = local.cluster_subnetwork_name == "subnet-gke" + error_message = "Should pass through an already-bare subnetwork name unchanged" + } +} + +run "firewall_rules_created_for_both_gateways" { + command = plan + + override_data { + target = data.google_container_cluster.this + values = { + subnetwork = "projects/myorg-project/regions/us-central1/subnetworks/subnet-gke" + network = "myorg-vpc" + } + } + + variables { + gateways_enabled = true + gateway_internal_enabled = true + } + + assert { + condition = length(google_compute_firewall.public_gateway_https) == 1 + error_message = "Public HTTPS firewall rule should be created when gateways_enabled is true" + } + + assert { + condition = length(google_compute_firewall.private_gateway_https) == 1 + error_message = "Private HTTPS firewall rule should be created when gateway_internal_enabled is true" + } +} From 97d10f9c60e65a8a08cde51cea3c38b086151791 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Fri, 14 Aug 2026 11:57:58 -0300 Subject: [PATCH 14/81] chore(6.x): release 6.13.1 (#517) * chore(6.x): release 6.13.1 * docs: regenerate READMEs for changed modules and update versions --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] --- CHANGELOG.md | 7 ++++ infrastructure/aws/acm/README.md | 2 +- .../aws_load_balancer_controller/README.md | 2 +- infrastructure/aws/backend/README.md | 2 +- infrastructure/aws/dns/README.md | 2 +- infrastructure/aws/eks/README.md | 2 +- infrastructure/aws/iam/agent/README.md | 2 +- .../README.md | 2 +- infrastructure/aws/iam/cert_manager/README.md | 2 +- .../aws/iam/ci-build-workflow-user/README.md | 2 +- infrastructure/aws/iam/cloudwatch/README.md | 2 +- infrastructure/aws/iam/ecr/README.md | 2 +- infrastructure/aws/iam/external_dns/README.md | 2 +- infrastructure/aws/iam/s3/README.md | 2 +- infrastructure/aws/ingress/README.md | 2 +- infrastructure/aws/security/README.md | 2 +- infrastructure/aws/vpc/README.md | 2 +- infrastructure/azure/acr/README.md | 2 +- infrastructure/azure/aks/README.md | 2 +- .../azure/aks_route_table/README.md | 2 +- infrastructure/azure/dns/README.md | 2 +- infrastructure/azure/iam/README.md | 2 +- infrastructure/azure/private_dns/README.md | 2 +- infrastructure/azure/resource_group/README.md | 2 +- infrastructure/azure/security/README.md | 2 +- infrastructure/azure/vnet/README.md | 2 +- infrastructure/commons/cert_manager/README.md | 12 +++---- infrastructure/commons/external_dns/README.md | 12 +++---- infrastructure/commons/istio/README.md | 2 +- infrastructure/commons/prometheus/README.md | 2 +- .../gcp/artifact-registry/README.md | 2 +- infrastructure/gcp/cloud-dns/README.md | 2 +- infrastructure/gcp/cloud-nat/README.md | 2 +- infrastructure/gcp/gke/README.md | 2 +- infrastructure/gcp/iam/README.md | 2 +- infrastructure/gcp/security/README.md | 34 +++++++++++-------- infrastructure/gcp/vpc/README.md | 2 +- infrastructure/oci/backend/README.md | 2 +- infrastructure/oci/dns/README.md | 2 +- infrastructure/oci/dynamic_groups/README.md | 2 +- infrastructure/oci/oke/README.md | 2 +- infrastructure/oci/vcn/README.md | 2 +- nullplatform/account/README.md | 2 +- nullplatform/agent/README.md | 10 +++--- nullplatform/api_key/README.md | 10 +++--- nullplatform/asset/docker_server/README.md | 2 +- nullplatform/asset/ecr/README.md | 2 +- nullplatform/asset/s3/README.md | 2 +- nullplatform/base/README.md | 12 +++---- nullplatform/cloud/aws/cloud/README.md | 2 +- nullplatform/cloud/aws/vpc/README.md | 2 +- nullplatform/cloud/azure/cloud/README.md | 2 +- nullplatform/cloud/gcp/cloud/README.md | 2 +- nullplatform/cloud/oci/cloud/README.md | 2 +- nullplatform/code_repository/README.md | 10 +++--- .../container_orchestration/aks/README.md | 2 +- .../container_orchestration/eks/README.md | 2 +- .../container_orchestration/gke/README.md | 2 +- .../container_orchestration/oke/README.md | 2 +- nullplatform/dimension/README.md | 2 +- nullplatform/dimension_value/README.md | 2 +- .../identity-access-control/README.md | 2 +- nullplatform/metrics/README.md | 2 +- nullplatform/packaged_service/README.md | 2 +- .../parameter_storage_configuration/README.md | 2 +- .../parameter_storage_definition/README.md | 2 +- .../README.md | 2 +- nullplatform/scope_configuration/README.md | 2 +- nullplatform/scope_definition/README.md | 2 +- .../README.md | 2 +- nullplatform/service_definition/README.md | 2 +- .../README.md | 2 +- nullplatform/users/README.md | 2 +- 73 files changed, 124 insertions(+), 113 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 97b069647..4eb112884 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,12 @@ # Changelog +## [6.13.1](https://github.com/nullplatform/tofu-modules/compare/v6.13.0...v6.13.1) (2026-08-14) + + +### Bug Fixes + +* **gcp/security:** handle full resource path in cluster subnetwork lookup ([#512](https://github.com/nullplatform/tofu-modules/issues/512)) ([e790af4](https://github.com/nullplatform/tofu-modules/commit/e790af437e4358a1e1254f00c3dba226fbc51b31)) + ## [6.13.0](https://github.com/nullplatform/tofu-modules/compare/v6.12.0...v6.13.0) (2026-08-13) diff --git a/infrastructure/aws/acm/README.md b/infrastructure/aws/acm/README.md index 07f26c680..83c603c0a 100644 --- a/infrastructure/aws/acm/README.md +++ b/infrastructure/aws/acm/README.md @@ -18,7 +18,7 @@ The module creates an aws_acm_certificate resource with DNS validation, which is ```hcl module "acm" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/acm?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/acm?ref=v6.13.1" domain_name = "your-domain-name" zone_id = "your-zone-id" diff --git a/infrastructure/aws/aws_load_balancer_controller/README.md b/infrastructure/aws/aws_load_balancer_controller/README.md index c72605287..1abd90f28 100644 --- a/infrastructure/aws/aws_load_balancer_controller/README.md +++ b/infrastructure/aws/aws_load_balancer_controller/README.md @@ -18,7 +18,7 @@ This module creates a helm_release resource to deploy the AWS Load Balancer Cont ```hcl module "aws_load_balancer_controller" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/aws_load_balancer_controller?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/aws_load_balancer_controller?ref=v6.13.1" cluster_name = "your-cluster-name" vpc_id = "your-vpc-id" diff --git a/infrastructure/aws/backend/README.md b/infrastructure/aws/backend/README.md index acd6fb220..f6c048480 100644 --- a/infrastructure/aws/backend/README.md +++ b/infrastructure/aws/backend/README.md @@ -20,7 +20,7 @@ This module creates an S3 bucket with versioning and server-side encryption enab ```hcl module "backend" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/backend?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/backend?ref=v6.13.1" } ``` diff --git a/infrastructure/aws/dns/README.md b/infrastructure/aws/dns/README.md index ad20e8055..7153f39a8 100644 --- a/infrastructure/aws/dns/README.md +++ b/infrastructure/aws/dns/README.md @@ -21,7 +21,7 @@ The module conditionally creates an aws_route53_zone resource for a public hoste ```hcl module "dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/dns?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/dns?ref=v6.13.1" domain_name = "your-domain-name" vpc_id = "your-vpc-id" diff --git a/infrastructure/aws/eks/README.md b/infrastructure/aws/eks/README.md index 7f9185328..216f5e970 100644 --- a/infrastructure/aws/eks/README.md +++ b/infrastructure/aws/eks/README.md @@ -22,7 +22,7 @@ The module wraps terraform-aws-modules/eks to create the EKS cluster (aws_eks_cl ```hcl module "eks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/eks?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/eks?ref=v6.13.1" aws_subnets_private_ids = "your-aws-subnets-private-ids" aws_vpc_vpc_id = "your-aws-vpc-vpc-id" diff --git a/infrastructure/aws/iam/agent/README.md b/infrastructure/aws/iam/agent/README.md index 5c5b84464..eeb8b583f 100644 --- a/infrastructure/aws/iam/agent/README.md +++ b/infrastructure/aws/iam/agent/README.md @@ -21,7 +21,7 @@ The module uses the terraform-aws-modules/iam//modules/iam-role-for-service-acco ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/agent?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/agent?ref=v6.13.1" agent_namespace = "your-agent-namespace" aws_iam_openid_connect_provider_arn = "your-aws-iam-openid-connect-provider-arn" diff --git a/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md b/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md index 6bbb9790a..7c7bcdc92 100644 --- a/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md +++ b/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md @@ -19,7 +19,7 @@ This module creates an IAM role for the AWS Load Balancer Controller using the t ```hcl module "aws_load_balancer_controller_iam" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/aws_load_balancer_controller_iam?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/aws_load_balancer_controller_iam?ref=v6.13.1" aws_iam_openid_connect_provider_arn = "your-aws-iam-openid-connect-provider-arn" cluster_name = "your-cluster-name" diff --git a/infrastructure/aws/iam/cert_manager/README.md b/infrastructure/aws/iam/cert_manager/README.md index 179ae91e5..43d9cebdc 100644 --- a/infrastructure/aws/iam/cert_manager/README.md +++ b/infrastructure/aws/iam/cert_manager/README.md @@ -20,7 +20,7 @@ An aws_iam_policy resource is always created granting route53:GetChange, route53 ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cert_manager?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cert_manager?ref=v6.13.1" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/ci-build-workflow-user/README.md b/infrastructure/aws/iam/ci-build-workflow-user/README.md index dbe6cc55e..8ecad8e0e 100644 --- a/infrastructure/aws/iam/ci-build-workflow-user/README.md +++ b/infrastructure/aws/iam/ci-build-workflow-user/README.md @@ -21,7 +21,7 @@ The module creates an aws_iam_user named with the cluster_name prefix and genera ```hcl module "ci-build-workflow-user" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ci-build-workflow-user?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ci-build-workflow-user?ref=v6.13.1" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/cloudwatch/README.md b/infrastructure/aws/iam/cloudwatch/README.md index 9511ebc81..b677b5045 100644 --- a/infrastructure/aws/iam/cloudwatch/README.md +++ b/infrastructure/aws/iam/cloudwatch/README.md @@ -20,7 +20,7 @@ The module creates an aws_iam_policy granting CloudWatch Logs and Metrics write ```hcl module "cloudwatch" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cloudwatch?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cloudwatch?ref=v6.13.1" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/ecr/README.md b/infrastructure/aws/iam/ecr/README.md index c49e85a86..6427a9d61 100644 --- a/infrastructure/aws/iam/ecr/README.md +++ b/infrastructure/aws/iam/ecr/README.md @@ -20,7 +20,7 @@ The module creates an aws_iam_role named nullplatform-{cluster_name}-application ```hcl module "ecr" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ecr?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ecr?ref=v6.13.1" build_workflow_group_name = "your-build-workflow-group-name" cluster_name = "your-cluster-name" diff --git a/infrastructure/aws/iam/external_dns/README.md b/infrastructure/aws/iam/external_dns/README.md index 6d28f1532..54c7e2f75 100644 --- a/infrastructure/aws/iam/external_dns/README.md +++ b/infrastructure/aws/iam/external_dns/README.md @@ -20,7 +20,7 @@ An aws_iam_policy resource named nullplatform_external_dns_policy is always crea ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/external_dns?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/external_dns?ref=v6.13.1" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/s3/README.md b/infrastructure/aws/iam/s3/README.md index 6c0a6059c..5e182b7ec 100644 --- a/infrastructure/aws/iam/s3/README.md +++ b/infrastructure/aws/iam/s3/README.md @@ -18,7 +18,7 @@ The module creates an aws_iam_policy resource that allows s3:PutObject and s3:Ge ```hcl module "s3" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/s3?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/s3?ref=v6.13.1" bucket = "your-bucket" build_workflow_group_name = "your-build-workflow-group-name" diff --git a/infrastructure/aws/ingress/README.md b/infrastructure/aws/ingress/README.md index 581491017..1e261a9a7 100644 --- a/infrastructure/aws/ingress/README.md +++ b/infrastructure/aws/ingress/README.md @@ -22,7 +22,7 @@ The module creates up to two kubernetes_ingress_v1 resources — one for an inte ```hcl module "ingress" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/ingress?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/ingress?ref=v6.13.1" certificate_arn = "your-certificate-arn" } diff --git a/infrastructure/aws/security/README.md b/infrastructure/aws/security/README.md index 68953310d..a7c202ac9 100644 --- a/infrastructure/aws/security/README.md +++ b/infrastructure/aws/security/README.md @@ -22,7 +22,7 @@ The module uses data sources (aws_eks_cluster, aws_vpc) to automatically derive ```hcl module "security" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/security?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/security?ref=v6.13.1" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/vpc/README.md b/infrastructure/aws/vpc/README.md index 5823a3d8c..8ccdea5e1 100644 --- a/infrastructure/aws/vpc/README.md +++ b/infrastructure/aws/vpc/README.md @@ -22,7 +22,7 @@ This module creates a terraform-aws-modules/vpc/aws module resource with DNS hos ```hcl module "vpc" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/vpc?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/vpc?ref=v6.13.1" account = "your-account" organization = "your-organization" diff --git a/infrastructure/azure/acr/README.md b/infrastructure/azure/acr/README.md index c994ee975..0a7dfe810 100644 --- a/infrastructure/azure/acr/README.md +++ b/infrastructure/azure/acr/README.md @@ -18,7 +18,7 @@ The module uses the azurerm_container_registry resource to create the container ```hcl module "acr" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/acr?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/acr?ref=v6.13.1" containerregistry_name = "your-containerregistry-name" location = "your-location" diff --git a/infrastructure/azure/aks/README.md b/infrastructure/azure/aks/README.md index 3e1e8b032..8853f946e 100644 --- a/infrastructure/azure/aks/README.md +++ b/infrastructure/azure/aks/README.md @@ -22,7 +22,7 @@ The module wraps the Azure/aks/azurerm community module (version 11.0.0) and use ```hcl module "aks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks?ref=v6.13.1" cluster_name = "your-cluster-name" location = "your-location" diff --git a/infrastructure/azure/aks_route_table/README.md b/infrastructure/azure/aks_route_table/README.md index 0359fd8ba..522761289 100644 --- a/infrastructure/azure/aks_route_table/README.md +++ b/infrastructure/azure/aks_route_table/README.md @@ -19,7 +19,7 @@ The module uses an azurerm_resources data source to discover the AKS-managed rou ```hcl module "aks_route_table" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks_route_table?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks_route_table?ref=v6.13.1" node_resource_group = "your-node-resource-group" subnet_id = "your-subnet-id" diff --git a/infrastructure/azure/dns/README.md b/infrastructure/azure/dns/README.md index c7a2217ef..868d033df 100644 --- a/infrastructure/azure/dns/README.md +++ b/infrastructure/azure/dns/README.md @@ -18,7 +18,7 @@ This module creates an azurerm_dns_zone resource and configures it with the prov ```hcl module "dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/dns?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/dns?ref=v6.13.1" domain_name = "your-domain-name" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/iam/README.md b/infrastructure/azure/iam/README.md index 6fd0e86f3..3e6ff5fe2 100644 --- a/infrastructure/azure/iam/README.md +++ b/infrastructure/azure/iam/README.md @@ -21,7 +21,7 @@ The module creates an azurerm_user_assigned_identity resource in the specified r ```hcl module "iam" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/iam?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/iam?ref=v6.13.1" location = "your-location" name = "your-name" diff --git a/infrastructure/azure/private_dns/README.md b/infrastructure/azure/private_dns/README.md index eba15f256..c0b407c4d 100644 --- a/infrastructure/azure/private_dns/README.md +++ b/infrastructure/azure/private_dns/README.md @@ -18,7 +18,7 @@ This module creates an azurerm_private_dns_zone resource and optionally multiple ```hcl module "private_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/private_dns?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/private_dns?ref=v6.13.1" domain_name = "your-domain-name" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/resource_group/README.md b/infrastructure/azure/resource_group/README.md index e459d340d..a666cbd5d 100644 --- a/infrastructure/azure/resource_group/README.md +++ b/infrastructure/azure/resource_group/README.md @@ -18,7 +18,7 @@ This module creates an azurerm_resource_group resource and outputs its name and ```hcl module "resource_group" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/resource_group?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/resource_group?ref=v6.13.1" location = "your-location" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/security/README.md b/infrastructure/azure/security/README.md index 4b662fa0c..c4d74ab53 100644 --- a/infrastructure/azure/security/README.md +++ b/infrastructure/azure/security/README.md @@ -21,7 +21,7 @@ The module uses azurerm_kubernetes_cluster and azurerm_virtual_network data sour ```hcl module "security" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/security?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/security?ref=v6.13.1" cluster_name = "your-cluster-name" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/vnet/README.md b/infrastructure/azure/vnet/README.md index 71f67e24d..630db78b4 100644 --- a/infrastructure/azure/vnet/README.md +++ b/infrastructure/azure/vnet/README.md @@ -18,7 +18,7 @@ This module creates an Azure virtual network using the azurerm provider and conf ```hcl module "vnet" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/vnet?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/vnet?ref=v6.13.1" address_space = "your-address-space" location = "your-location" diff --git a/infrastructure/commons/cert_manager/README.md b/infrastructure/commons/cert_manager/README.md index 9c075103c..7a1383606 100644 --- a/infrastructure/commons/cert_manager/README.md +++ b/infrastructure/commons/cert_manager/README.md @@ -22,7 +22,7 @@ Two primary helm_release resources are created: cert-manager from the Jetstack c ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.13.1" account_slug = "your-account-slug" cloud_provider = "your-cloud-provider" @@ -35,7 +35,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.13.1" account_slug = "your-account-slug" cloud_provider = "gcp" @@ -50,7 +50,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.13.1" account_slug = "your-account-slug" azure_client_id = "your-azure-client-id" # Required when cloud_provider = "azure" @@ -68,7 +68,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.13.1" account_slug = "your-account-slug" cloud_provider = "cloudflare" @@ -83,7 +83,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.13.1" account_slug = "your-account-slug" aws_identity_mode = "your-aws-identity-mode" # Required when cloud_provider = "aws" @@ -99,7 +99,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.13.1" account_slug = "your-account-slug" cert_manager_webhook_oci_namespace = "your-cert-manager-webhook-oci-namespace" # Required when cloud_provider = "oci" diff --git a/infrastructure/commons/external_dns/README.md b/infrastructure/commons/external_dns/README.md index 7cbdf86a1..daf98df8e 100644 --- a/infrastructure/commons/external_dns/README.md +++ b/infrastructure/commons/external_dns/README.md @@ -22,7 +22,7 @@ The module creates an optional kubernetes_namespace_v1 resource when create_name ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.13.1" dns_provider_name = "your-dns-provider-name" domain_filters = "your-domain-filters" @@ -33,7 +33,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.13.1" cloudflare_token = "your-cloudflare-token" # Required when dns_provider_name = "cloudflare" dns_provider_name = "cloudflare" @@ -45,7 +45,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.13.1" aws_iam_role_arn = "your-aws-iam-role-arn" # Required when dns_provider_name = "aws" aws_identity_mode = "your-aws-identity-mode" # Required when dns_provider_name = "aws" @@ -61,7 +61,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.13.1" dns_provider_name = "oci" domain_filters = "your-domain-filters" @@ -77,7 +77,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.13.1" azure_client_id = "your-azure-client-id" # Required when dns_provider_name = "azure" azure_federated_credential_id = "your-azure-federated-credential-id" # Required when dns_provider_name = "azure" @@ -94,7 +94,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.13.1" azure_client_id = "your-azure-client-id" # Required when dns_provider_name = "azure-private-dns" azure_federated_credential_id = "your-azure-federated-credential-id" # Required when dns_provider_name = "azure-private-dns" diff --git a/infrastructure/commons/istio/README.md b/infrastructure/commons/istio/README.md index 565c16832..a72df1411 100644 --- a/infrastructure/commons/istio/README.md +++ b/infrastructure/commons/istio/README.md @@ -21,7 +21,7 @@ Three helm_release resources are created in a strict dependency chain: istio-bas ```hcl module "istio" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/istio?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/istio?ref=v6.13.1" } ``` diff --git a/infrastructure/commons/prometheus/README.md b/infrastructure/commons/prometheus/README.md index c73da8ae6..9821a16ec 100644 --- a/infrastructure/commons/prometheus/README.md +++ b/infrastructure/commons/prometheus/README.md @@ -18,7 +18,7 @@ This module creates a helm_release resource to deploy the Prometheus chart from ```hcl module "prometheus" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.13.1" } ``` diff --git a/infrastructure/gcp/artifact-registry/README.md b/infrastructure/gcp/artifact-registry/README.md index 0b555df41..861150224 100644 --- a/infrastructure/gcp/artifact-registry/README.md +++ b/infrastructure/gcp/artifact-registry/README.md @@ -21,7 +21,7 @@ The module provisions a google_artifact_registry_repository resource in the spec ```hcl module "artifact-registry" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/artifact-registry?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/artifact-registry?ref=v6.13.1" location = "your-location" project_id = "your-project-id" diff --git a/infrastructure/gcp/cloud-dns/README.md b/infrastructure/gcp/cloud-dns/README.md index 99d161197..37a70b934 100644 --- a/infrastructure/gcp/cloud-dns/README.md +++ b/infrastructure/gcp/cloud-dns/README.md @@ -21,7 +21,7 @@ The module creates a single google_dns_managed_zone resource in the specified GC ```hcl module "cloud-dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-dns?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-dns?ref=v6.13.1" domain_name = "your-domain-name" project_id = "your-project-id" diff --git a/infrastructure/gcp/cloud-nat/README.md b/infrastructure/gcp/cloud-nat/README.md index cc78ceab6..323f4d278 100644 --- a/infrastructure/gcp/cloud-nat/README.md +++ b/infrastructure/gcp/cloud-nat/README.md @@ -19,7 +19,7 @@ This module creates a google_compute_router resource in a specified region and n ```hcl module "cloud-nat" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-nat?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-nat?ref=v6.13.1" nat_name = "your-nat-name" network_id = "your-network-id" diff --git a/infrastructure/gcp/gke/README.md b/infrastructure/gcp/gke/README.md index a7c80efb2..9df260276 100644 --- a/infrastructure/gcp/gke/README.md +++ b/infrastructure/gcp/gke/README.md @@ -20,7 +20,7 @@ The module uses the google-modules/kubernetes-engine/google//modules/private-clu ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.13.1" cluster_name = "your-cluster-name" ip_range_pods = "your-ip-range-pods" diff --git a/infrastructure/gcp/iam/README.md b/infrastructure/gcp/iam/README.md index 46f3d416a..7f2e8d1f7 100644 --- a/infrastructure/gcp/iam/README.md +++ b/infrastructure/gcp/iam/README.md @@ -19,7 +19,7 @@ The module creates google_service_account resources for each service account spe ```hcl module "iam" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/iam?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/iam?ref=v6.13.1" project_id = "your-project-id" } diff --git a/infrastructure/gcp/security/README.md b/infrastructure/gcp/security/README.md index 7db29ab79..d50f11e98 100644 --- a/infrastructure/gcp/security/README.md +++ b/infrastructure/gcp/security/README.md @@ -2,24 +2,26 @@ ## Description -Configures GCP firewall rules for Istio gateways in a GKE cluster +Manages GCP firewall rules for Istio public and private gateways on a GKE cluster, restricting health check and HTTPS traffic appropriately ## Architecture -This module uses Terraform to create GCP firewall rules for public and private Istio gateways in a GKE cluster. It utilizes the google_compute_firewall resource to define ingress rules for HTTPS and health check traffic. The module also derives the network and CIDR block from the GKE cluster information using data sources like google_container_cluster and google_compute_subnetwork. The firewall rules are then created based on the derived network and CIDR block, with specific rules for public and private gateways. The module also outputs the names of the created firewall rules for public and private gateways. +The module uses data sources google_container_cluster and google_compute_subnetwork to derive the VPC network name and subnet CIDR from the specified GKE cluster. These derived values feed into google_compute_firewall resources that control ingress traffic for Istio gateway nodes via network tags. For the public gateway, three google_compute_firewall rules are created: one allowing HTTPS from anywhere, one allowing health checks from VPC CIDR and GCP health check ranges (35.191.0.0/16, 130.211.0.0/22), and a lower-priority deny rule blocking health check port 15021 from the internet. For the private gateway, two google_compute_firewall rules restrict both HTTPS and health check traffic to the VPC CIDR and GCP health check ranges only. ## Features -- Creates GCP firewall rules for public and private Istio gateways -- Configures ingress rules for HTTPS and health check traffic -- Derives network and CIDR block from GKE cluster information -- Outputs firewall rule names for public and private gateways +- Creates public gateway firewall rules allowing HTTPS (443) from internet and health checks (15021) restricted to VPC CIDR and GCP health checker ranges +- Creates private gateway firewall rules restricting both HTTPS and health check traffic to internal VPC CIDR only +- Derives VPC network name and subnet CIDR automatically from the GKE cluster using google_container_cluster and google_compute_subnetwork data sources +- Supports overriding derived network name and CIDR with explicit input variables +- Applies network tags to firewall rules for precise targeting of Istio gateway node pools +- Adds explicit deny rule for health check port 15021 from internet at lower priority to block public health check exposure ## Basic Usage ```hcl module "security" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/security?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/security?ref=v6.13.1" cluster_name = "your-cluster-name" gcp_project_id = "your-gcp-project-id" @@ -47,7 +49,7 @@ resource "example_resource" "this" { | Name | Version | |------|---------| -| [google](#provider\_google) | ~> 5.0 | +| [google](#provider\_google) | 5.45.2 | ## Resources @@ -82,13 +84,15 @@ resource "example_resource" "this" { diff --git a/infrastructure/gcp/vpc/README.md b/infrastructure/gcp/vpc/README.md index b3c653422..7713a18ac 100644 --- a/infrastructure/gcp/vpc/README.md +++ b/infrastructure/gcp/vpc/README.md @@ -20,7 +20,7 @@ The module invokes the terraform-google-modules/network/google module to create ```hcl module "vpc" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/vpc?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/vpc?ref=v6.13.1" network_name = "your-network-name" project_id = "your-project-id" diff --git a/infrastructure/oci/backend/README.md b/infrastructure/oci/backend/README.md index 28a39a275..547670712 100644 --- a/infrastructure/oci/backend/README.md +++ b/infrastructure/oci/backend/README.md @@ -18,7 +18,7 @@ The module creates an oci_objectstorage_bucket resource, which is configured wit ```hcl module "backend" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/backend?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/backend?ref=v6.13.1" compartment_id = "your-compartment-id" namespace = "your-namespace" diff --git a/infrastructure/oci/dns/README.md b/infrastructure/oci/dns/README.md index 09e68d9f2..38336ea7c 100644 --- a/infrastructure/oci/dns/README.md +++ b/infrastructure/oci/dns/README.md @@ -18,7 +18,7 @@ This module creates oci_dns_zone resources for each DNS zone defined in the dns_ ```hcl module "dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dns?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dns?ref=v6.13.1" compartment_id = "your-compartment-id" } diff --git a/infrastructure/oci/dynamic_groups/README.md b/infrastructure/oci/dynamic_groups/README.md index cbaa53050..314c85714 100644 --- a/infrastructure/oci/dynamic_groups/README.md +++ b/infrastructure/oci/dynamic_groups/README.md @@ -19,7 +19,7 @@ This module creates an OCI dynamic group and an OCI identity policy, connecting ```hcl module "dynamic_groups" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dynamic_groups?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dynamic_groups?ref=v6.13.1" cluster_id = "your-cluster-id" compartment_id = "your-compartment-id" diff --git a/infrastructure/oci/oke/README.md b/infrastructure/oci/oke/README.md index ab2f29734..427faf305 100644 --- a/infrastructure/oci/oke/README.md +++ b/infrastructure/oci/oke/README.md @@ -21,7 +21,7 @@ The module instantiates the oracle-terraform-modules/oke/oci module to create an ```hcl module "oke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/oke?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/oke?ref=v6.13.1" api_endpoint_subnet_id = "your-api-endpoint-subnet-id" cluster_name = "your-cluster-name" diff --git a/infrastructure/oci/vcn/README.md b/infrastructure/oci/vcn/README.md index 97c6cddb0..c17c68acc 100644 --- a/infrastructure/oci/vcn/README.md +++ b/infrastructure/oci/vcn/README.md @@ -19,7 +19,7 @@ The module instantiates oci_core_subnet resources for public and private subnets ```hcl module "vcn" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/vcn?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/vcn?ref=v6.13.1" } ``` diff --git a/nullplatform/account/README.md b/nullplatform/account/README.md index 59665d556..dbfdd4ebf 100644 --- a/nullplatform/account/README.md +++ b/nullplatform/account/README.md @@ -19,7 +19,7 @@ The module iterates over the `nullplatform_accounts` input map using `for_each` ```hcl module "account" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/account?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/account?ref=v6.13.1" nullplatform_accounts = "your-nullplatform-accounts" } diff --git a/nullplatform/agent/README.md b/nullplatform/agent/README.md index babc38fce..081cf1df0 100644 --- a/nullplatform/agent/README.md +++ b/nullplatform/agent/README.md @@ -22,7 +22,7 @@ The module renders a Helm values file using a templatefile() call that merges de ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.13.1" api_key = "your-api-key" cloud_provider = "your-cloud-provider" @@ -37,7 +37,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.13.1" api_key = "your-api-key" aws_iam_role_arn = "your-aws-iam-role-arn" # Required when cloud_provider = "aws" @@ -53,7 +53,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.13.1" api_key = "your-api-key" cloud_provider = "gcp" @@ -68,7 +68,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.13.1" api_key = "your-api-key" azure_client_id = "your-azure-client-id" # Required when cloud_provider = "azure" @@ -91,7 +91,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.13.1" api_key = "your-api-key" cloud_provider = "oci" diff --git a/nullplatform/api_key/README.md b/nullplatform/api_key/README.md index f0d2f95d4..9fe7251c4 100644 --- a/nullplatform/api_key/README.md +++ b/nullplatform/api_key/README.md @@ -21,7 +21,7 @@ The module creates a single nullplatform_api_key resource whose name, grants, an ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.13.1" type = "your-type" } @@ -31,7 +31,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.13.1" nrn = "your-nrn" # Required when type = "agent" type = "agent" @@ -42,7 +42,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.13.1" nrn = "your-nrn" # Required when type = "scope_notification" specification_slug = "your-specification-slug" # Required when type = "scope_notification" @@ -54,7 +54,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.13.1" nrn = "your-nrn" # Required when type = "service_notification" specification_slug = "your-specification-slug" # Required when type = "service_notification" @@ -66,7 +66,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.13.1" custom_grants = "your-custom-grants" # Required when type = "custom" custom_name = "your-custom-name" # Required when type = "custom" diff --git a/nullplatform/asset/docker_server/README.md b/nullplatform/asset/docker_server/README.md index 76a2cffc1..04f1f181b 100644 --- a/nullplatform/asset/docker_server/README.md +++ b/nullplatform/asset/docker_server/README.md @@ -21,7 +21,7 @@ Creates a nullplatform_provider_config resource of type 'docker-server' with enc ```hcl module "docker_server" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/docker_server?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/docker_server?ref=v6.13.1" login_server = "your-login-server" nrn = "your-nrn" diff --git a/nullplatform/asset/ecr/README.md b/nullplatform/asset/ecr/README.md index 77ded6f8f..446afbd29 100644 --- a/nullplatform/asset/ecr/README.md +++ b/nullplatform/asset/ecr/README.md @@ -21,7 +21,7 @@ The module reads the current AWS region via the aws_region data source and combi ```hcl module "ecr" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/ecr?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/ecr?ref=v6.13.1" application_role_arn = "your-application-role-arn" build_workflow_access_key_id = "your-build-workflow-access-key-id" diff --git a/nullplatform/asset/s3/README.md b/nullplatform/asset/s3/README.md index e4027e800..3a3ef63c6 100644 --- a/nullplatform/asset/s3/README.md +++ b/nullplatform/asset/s3/README.md @@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type s3-con ```hcl module "s3" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/s3?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/s3?ref=v6.13.1" bucket_name = "your-bucket-name" nrn = "your-nrn" diff --git a/nullplatform/base/README.md b/nullplatform/base/README.md index 97e3ddf4c..fc8296311 100644 --- a/nullplatform/base/README.md +++ b/nullplatform/base/README.md @@ -22,7 +22,7 @@ The module first creates two kubernetes_namespace_v1 resources ('nullplatform-to ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.13.1" k8s_provider = "your-k8s-provider" np_api_key = "your-np-api-key" @@ -33,7 +33,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.13.1" k8s_provider = "eks" np_api_key = "your-np-api-key" @@ -44,7 +44,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.13.1" k8s_provider = "gke" np_api_key = "your-np-api-key" @@ -55,7 +55,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.13.1" k8s_provider = "aks" np_api_key = "your-np-api-key" @@ -66,7 +66,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.13.1" k8s_provider = "oke" np_api_key = "your-np-api-key" @@ -77,7 +77,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.13.1" k8s_provider = "aro" np_api_key = "your-np-api-key" diff --git a/nullplatform/cloud/aws/cloud/README.md b/nullplatform/cloud/aws/cloud/README.md index 86c546640..2b824d878 100644 --- a/nullplatform/cloud/aws/cloud/README.md +++ b/nullplatform/cloud/aws/cloud/README.md @@ -21,7 +21,7 @@ The module uses data sources aws_caller_identity and aws_region to dynamically r ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/cloud?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/cloud?ref=v6.13.1" domain_name = "your-domain-name" hosted_private_zone_id = "your-hosted-private-zone-id" diff --git a/nullplatform/cloud/aws/vpc/README.md b/nullplatform/cloud/aws/vpc/README.md index 3061fc96b..3757a10b2 100644 --- a/nullplatform/cloud/aws/vpc/README.md +++ b/nullplatform/cloud/aws/vpc/README.md @@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource of type aws-ne ```hcl module "vpc" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/vpc?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/vpc?ref=v6.13.1" nrn = "your-nrn" vpc_id = "your-vpc-id" diff --git a/nullplatform/cloud/azure/cloud/README.md b/nullplatform/cloud/azure/cloud/README.md index 453a4b697..763fc3f4b 100644 --- a/nullplatform/cloud/azure/cloud/README.md +++ b/nullplatform/cloud/azure/cloud/README.md @@ -22,7 +22,7 @@ The module creates a single nullplatform_provider_config resource of type 'azure ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/azure/cloud?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/azure/cloud?ref=v6.13.1" azure_resource_group_name = "your-azure-resource-group-name" nrn = "your-nrn" diff --git a/nullplatform/cloud/gcp/cloud/README.md b/nullplatform/cloud/gcp/cloud/README.md index a140820ee..44e1e7985 100644 --- a/nullplatform/cloud/gcp/cloud/README.md +++ b/nullplatform/cloud/gcp/cloud/README.md @@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type 'googl ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/gcp/cloud?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/gcp/cloud?ref=v6.13.1" domain_name = "your-domain-name" location = "your-location" diff --git a/nullplatform/cloud/oci/cloud/README.md b/nullplatform/cloud/oci/cloud/README.md index 8122f7916..f9d37016a 100644 --- a/nullplatform/cloud/oci/cloud/README.md +++ b/nullplatform/cloud/oci/cloud/README.md @@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type 'oci-c ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/oci/cloud?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/oci/cloud?ref=v6.13.1" account_id = "your-account-id" account_name = "your-account-name" diff --git a/nullplatform/code_repository/README.md b/nullplatform/code_repository/README.md index 99c8fe11f..1318b7862 100644 --- a/nullplatform/code_repository/README.md +++ b/nullplatform/code_repository/README.md @@ -22,7 +22,7 @@ The module uses local boolean flags (is_gitlab, is_github, is_azure, is_bitbucke ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.13.1" git_provider = "your-git-provider" nrn = "your-nrn" @@ -33,7 +33,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.13.1" git_provider = "github" github_installation_id = "your-github-installation-id" # Required when git_provider = "github" @@ -46,7 +46,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.13.1" git_provider = "gitlab" gitlab_access_token = "your-gitlab-access-token" # Required when git_provider = "gitlab" @@ -62,7 +62,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.13.1" azure_access_token = "your-azure-access-token" # Required when git_provider = "azure" azure_agent_pool = "your-azure-agent-pool" # Required when git_provider = "azure" @@ -76,7 +76,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.13.1" bitbucket_collaborators = "your-bitbucket-collaborators" # Required when git_provider = "bitbucket" bitbucket_installation_url = "your-bitbucket-installation-url" # Required when git_provider = "bitbucket" diff --git a/nullplatform/container_orchestration/aks/README.md b/nullplatform/container_orchestration/aks/README.md index 821248ec4..692502ef5 100644 --- a/nullplatform/container_orchestration/aks/README.md +++ b/nullplatform/container_orchestration/aks/README.md @@ -21,7 +21,7 @@ The module builds a local.attributes map that aggregates cluster metadata, gatew ```hcl module "aks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.13.1" cluster_name = "your-cluster-name" nrn = "your-nrn" diff --git a/nullplatform/container_orchestration/eks/README.md b/nullplatform/container_orchestration/eks/README.md index 6136b9cbc..03211ff79 100644 --- a/nullplatform/container_orchestration/eks/README.md +++ b/nullplatform/container_orchestration/eks/README.md @@ -22,7 +22,7 @@ The module assembles a set of structured locals by merging optional variables in ```hcl module "eks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.13.1" cluster_name = "your-cluster-name" nrn = "your-nrn" diff --git a/nullplatform/container_orchestration/gke/README.md b/nullplatform/container_orchestration/gke/README.md index 003d64af0..6e6e76cc4 100644 --- a/nullplatform/container_orchestration/gke/README.md +++ b/nullplatform/container_orchestration/gke/README.md @@ -22,7 +22,7 @@ The module constructs a structured attributes object using locals that merge clu ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.13.1" cluster_name = "your-cluster-name" location = "your-location" diff --git a/nullplatform/container_orchestration/oke/README.md b/nullplatform/container_orchestration/oke/README.md index b11a541d8..70dfbfde2 100644 --- a/nullplatform/container_orchestration/oke/README.md +++ b/nullplatform/container_orchestration/oke/README.md @@ -19,7 +19,7 @@ Creates a single nullplatform_provider_config resource of type 'oke' that stores ```hcl module "oke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/oke?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/oke?ref=v6.13.1" cluster_name = "your-cluster-name" nrn = "your-nrn" diff --git a/nullplatform/dimension/README.md b/nullplatform/dimension/README.md index b053e2e97..a6ab9ecb9 100644 --- a/nullplatform/dimension/README.md +++ b/nullplatform/dimension/README.md @@ -19,7 +19,7 @@ The module creates a nullplatform_dimension resource using the provided name, or ```hcl module "dimension" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension?ref=v6.13.1" name = "your-name" nrn = "your-nrn" diff --git a/nullplatform/dimension_value/README.md b/nullplatform/dimension_value/README.md index 8f94b4fe6..4426cfdfa 100644 --- a/nullplatform/dimension_value/README.md +++ b/nullplatform/dimension_value/README.md @@ -19,7 +19,7 @@ The module uses a terraform_data resource to enforce mutual-exclusivity and pres ```hcl module "dimension_value" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension_value?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension_value?ref=v6.13.1" dimension_id = "your-dimension-id" name = "your-name" diff --git a/nullplatform/identity-access-control/README.md b/nullplatform/identity-access-control/README.md index 62caf73fc..a6e7bf058 100644 --- a/nullplatform/identity-access-control/README.md +++ b/nullplatform/identity-access-control/README.md @@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource named identity ```hcl module "identity-access-control" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/identity-access-control?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/identity-access-control?ref=v6.13.1" attributes = "your-attributes" nrn = "your-nrn" diff --git a/nullplatform/metrics/README.md b/nullplatform/metrics/README.md index 6f985d158..021d43ef8 100644 --- a/nullplatform/metrics/README.md +++ b/nullplatform/metrics/README.md @@ -21,7 +21,7 @@ The module creates a single nullplatform_provider_config resource of type 'prome ```hcl module "metrics" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/metrics?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/metrics?ref=v6.13.1" nrn = "your-nrn" } diff --git a/nullplatform/packaged_service/README.md b/nullplatform/packaged_service/README.md index dfee39a41..7b5a0e0c1 100644 --- a/nullplatform/packaged_service/README.md +++ b/nullplatform/packaged_service/README.md @@ -17,7 +17,7 @@ spec updates / republish correctly. ```hcl module "packaged_service" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/packaged_service?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/packaged_service?ref=v6.13.1" nrn = "organization=…:account=…:namespace=…" diff --git a/nullplatform/parameter_storage_configuration/README.md b/nullplatform/parameter_storage_configuration/README.md index f0ca219f7..8ac051e1b 100644 --- a/nullplatform/parameter_storage_configuration/README.md +++ b/nullplatform/parameter_storage_configuration/README.md @@ -20,7 +20,7 @@ The module delegates entirely to a remote `scope_configuration` module sourced f ```hcl module "parameter_storage_configuration" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_configuration?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_configuration?ref=v6.13.1" attributes = "your-attributes" np_api_key = "your-np-api-key" diff --git a/nullplatform/parameter_storage_definition/README.md b/nullplatform/parameter_storage_definition/README.md index 8c325cb5d..2f7725201 100644 --- a/nullplatform/parameter_storage_definition/README.md +++ b/nullplatform/parameter_storage_definition/README.md @@ -20,7 +20,7 @@ A data.http resource fetches the raw specification template from a configurable ```hcl module "parameter_storage_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition?ref=v6.13.1" np_api_key = "your-np-api-key" nrn = "your-nrn" diff --git a/nullplatform/parameter_storage_definition_agent_association/README.md b/nullplatform/parameter_storage_definition_agent_association/README.md index 3e0ac4701..c01b6e191 100644 --- a/nullplatform/parameter_storage_definition_agent_association/README.md +++ b/nullplatform/parameter_storage_definition_agent_association/README.md @@ -21,7 +21,7 @@ The module creates a terraform_data resource to track API key changes and a null ```hcl module "parameter_storage_definition_agent_association" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition_agent_association?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition_agent_association?ref=v6.13.1" api_key = "your-api-key" nrn = "your-nrn" diff --git a/nullplatform/scope_configuration/README.md b/nullplatform/scope_configuration/README.md index bb97e7526..650f393de 100644 --- a/nullplatform/scope_configuration/README.md +++ b/nullplatform/scope_configuration/README.md @@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource that binds a N ```hcl module "scope_configuration" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_configuration?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_configuration?ref=v6.13.1" attributes = "your-attributes" np_api_key = "your-np-api-key" diff --git a/nullplatform/scope_definition/README.md b/nullplatform/scope_definition/README.md index b27d4bbce..56f990cab 100644 --- a/nullplatform/scope_definition/README.md +++ b/nullplatform/scope_definition/README.md @@ -22,7 +22,7 @@ The module fetches JSON templates via data.http resources from a configurable Gi ```hcl module "scope_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition?ref=v6.13.1" np_api_key = "your-np-api-key" nrn = "your-nrn" diff --git a/nullplatform/scope_definition_agent_association/README.md b/nullplatform/scope_definition_agent_association/README.md index d2a826274..96a5186ec 100644 --- a/nullplatform/scope_definition_agent_association/README.md +++ b/nullplatform/scope_definition_agent_association/README.md @@ -22,7 +22,7 @@ The module fetches a notification channel template via the `data.http` data sour ```hcl module "scope_definition_agent_association" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition_agent_association?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition_agent_association?ref=v6.13.1" api_key = "your-api-key" nrn = "your-nrn" diff --git a/nullplatform/service_definition/README.md b/nullplatform/service_definition/README.md index 89749f144..e773f2c9d 100644 --- a/nullplatform/service_definition/README.md +++ b/nullplatform/service_definition/README.md @@ -22,7 +22,7 @@ The module uses data.http resources to fetch service-spec, action, and link JSON ```hcl module "service_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.13.1" nrn = "your-nrn" service_name = "your-service-name" diff --git a/nullplatform/service_definition_agent_association/README.md b/nullplatform/service_definition_agent_association/README.md index af8ff94cd..3f907db7c 100644 --- a/nullplatform/service_definition_agent_association/README.md +++ b/nullplatform/service_definition_agent_association/README.md @@ -22,7 +22,7 @@ The module creates a terraform_data resource to track API key changes as a lifec ```hcl module "service_definition_agent_association" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition_agent_association?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition_agent_association?ref=v6.13.1" api_key = "your-api-key" repository_service_spec_repo = "your-repository-service-spec-repo" diff --git a/nullplatform/users/README.md b/nullplatform/users/README.md index 687f1c06a..a4eb1faf6 100644 --- a/nullplatform/users/README.md +++ b/nullplatform/users/README.md @@ -21,7 +21,7 @@ The module iterates over a map of user definitions using `nullplatform_user` res ```hcl module "users" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/users?ref=v6.13.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/users?ref=v6.13.1" nullplatform_users = "your-nullplatform-users" } From a1992af25fc13eb44fb01d5d32b35ba548576295 Mon Sep 17 00:00:00 2001 From: Sebastian Correa Date: Fri, 14 Aug 2026 12:38:15 -0300 Subject: [PATCH 15/81] feat(nullplatform/agent): require ingress templates for non-aws clouds (#515) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * feat(nullplatform/agent): require ingress templates for non-aws clouds The k8s scope's default ingress templates are AWS-specific (ALB Ingress annotations); on any other cloud they silently produce no working route. Add preconditions requiring service_template, initial_ingress_path, and blue_green_ingress_path whenever cloud_provider is not "aws", matching the existing cross_variable_validation pattern for aws/azure requirements. * fix(nullplatform/agent): key ingress-template requirement off INGRESS_TYPE, not cloud_provider cloud_provider was the wrong axis — a cluster can use Istio (or not) on any cloud, and cloud_provider != "aws" doesn't actually imply Istio routing. Require service_template, initial_ingress_path, and blue_green_ingress_path only when extra_envs.INGRESS_TYPE == "istio", matching the real signal that determines which ingress mechanism the k8s scope needs to target. * fix(nullplatform/agent): drop dead PRIVATE_DOMAIN, validate private_gateway_name for gcp/oci PRIVATE_DOMAIN was never read anywhere in the nullplatform/scopes k8s scope's scripts (only documented, never consumed) — removed from cloud_config.gcp and cloud_config.oci, and dropped the now-unused private_domain variable entirely. private_gateway_name, by contrast, is actively read by the k8s scope's DNS/gateway routing scripts for any private-visibility deployment — widen its existing precondition (previously azure-only) to also require it for gcp and oci. * feat(nullplatform/agent): default private/public gateway names, dedupe cloud_config private_gateway_name and public_gateway_name were duplicated identically across azure/gcp/oci despite not being cloud-specific behavior — moved to default_config (applies to every cloud provider) and given real defaults ("gateway-private"/"gateway-public") instead of null, matching the naming convention already used consistently across real deployments. Dropped the now-redundant azure/gcp/oci-scoped precondition requiring them, and cleaned up the resulting dead cloud_config entries (empty gcp block, duplicate oci PRIVATE_GATEWAY_NAME). * docs(nullplatform/agent): fix stale Azure-only comments on gateway name variables * refactor(nullplatform/agent): drop unused nrn variable nrn was kept only for "interface parity" with other nullplatform modules via a tflint-ignore, but the agent resolves its own scope from the API key and never actually read it. Removed outright instead of suppressing the lint warning — no caller-side behavior depends on it. * fix(nullplatform/agent): remove redundant public_gateway_name precondition public_gateway_name now defaults to "gateway-public" (same change already applied to private_gateway_name) — the azure-only precondition requiring it non-null is unreachable in practice, same reasoning as the private_gateway_name precondition removed earlier in this branch. * refactor(nullplatform/agent): reorganize variables.tf into coherent sections Group variables by what actually gates them, and fix descriptions that had drifted from reality: - image_tag and cloud_provider moved into Required Variables (no default, same as api_key/cluster_name/tags_selectors — they were previously buried mid-file among optional ones). - cluster_name's description said "EKS cluster" (AWS-only language) even though this module supports gcp/azure/oci too — generalized to "Kubernetes cluster". - private_gateway_name/public_gateway_name moved out of "Azure Configuration" into their own "Gateway Configuration" section — they're universal (in default_config), not azure-specific. - domain and use_account_slug's "(required when cloud_provider is 'azure')" comments were false — no precondition ever enforced that. Dropped the claim; use_account_slug moved to Agent configuration (naming behavior, not DNS). - service_template/initial_ingress_path/blue_green_ingress_path/extra_envs moved into a new "Ingress / Networking Configuration" section instead of trailing after "Image Configuration", and given the same one-line leading comment style as every other variable in the file. * fix(nullplatform/scope_definition_agent_association): default description non-empty Give the notification channel a sensible default description instead of an empty string. --------- Co-authored-by: sebas_correa --- .github/workflows/tofu-test.yml | 2 +- nullplatform/agent/README.md | 18 ++- nullplatform/agent/locals.tf | 14 +-- nullplatform/agent/main.tf | 29 ++--- nullplatform/agent/tests/agent.tftest.hcl | 97 +++++++++++++++ nullplatform/agent/variables.tf | 110 +++++++++--------- .../README.md | 2 +- .../variables.tf | 2 +- 8 files changed, 179 insertions(+), 95 deletions(-) create mode 100644 nullplatform/agent/tests/agent.tftest.hcl diff --git a/.github/workflows/tofu-test.yml b/.github/workflows/tofu-test.yml index a83efb0e4..f15157258 100644 --- a/.github/workflows/tofu-test.yml +++ b/.github/workflows/tofu-test.yml @@ -30,7 +30,7 @@ jobs: test-nullplatform-modules: uses: nullplatform/actions-nullplatform/.github/workflows/tofu-test.yml@main with: - modules: '["nullplatform/account", "nullplatform/api_key", "nullplatform/dimension", "nullplatform/dimension_value", "nullplatform/users", "nullplatform/metrics", "nullplatform/asset/docker_server", "nullplatform/cloud/azure/cloud", "nullplatform/cloud/gcp/cloud", "nullplatform/cloud/aws/cloud", "nullplatform/code_repository"]' + modules: '["nullplatform/account", "nullplatform/agent", "nullplatform/api_key", "nullplatform/dimension", "nullplatform/dimension_value", "nullplatform/users", "nullplatform/metrics", "nullplatform/asset/docker_server", "nullplatform/cloud/azure/cloud", "nullplatform/cloud/gcp/cloud", "nullplatform/cloud/aws/cloud", "nullplatform/code_repository"]' test-container-orchestration-modules: uses: nullplatform/actions-nullplatform/.github/workflows/tofu-test.yml@main diff --git a/nullplatform/agent/README.md b/nullplatform/agent/README.md index 081cf1df0..48b510c75 100644 --- a/nullplatform/agent/README.md +++ b/nullplatform/agent/README.md @@ -147,9 +147,9 @@ resource "example_resource" "this" { | [azure\_resource\_group](#input\_azure\_resource\_group) | Azure resource group name | `string` | `null` | no | | [azure\_subscription\_id](#input\_azure\_subscription\_id) | Azure subscription ID | `string` | `null` | no | | [azure\_tenant\_id](#input\_azure\_tenant\_id) | Azure tenant ID | `string` | `null` | no | -| [blue\_green\_ingress\_path](#input\_blue\_green\_ingress\_path) | Specifies the ingress path used for blue-green deployments to route traffic to the new version. | `string` | `""` | no | -| [cloud\_provider](#input\_cloud\_provider) | Cloud provider to use (aws, gcp, or azure) | `string` | n/a | yes | -| [cluster\_name](#input\_cluster\_name) | Name of the EKS cluster where the nullplatform agent will be deployed | `string` | n/a | yes | +| [blue\_green\_ingress\_path](#input\_blue\_green\_ingress\_path) | Specifies the ingress path used for blue-green deployments to route traffic to the new version. Required when extra\_envs.INGRESS\_TYPE is 'istio' — the k8s scope's default template is AWS ALB Ingress and won't route traffic correctly through Istio, so it must be pointed at an Istio HTTPRoute template instead. | `string` | `""` | no | +| [cloud\_provider](#input\_cloud\_provider) | Cloud provider to use ('aws', 'gcp', 'azure', or 'oci') | `string` | n/a | yes | +| [cluster\_name](#input\_cluster\_name) | Name of the Kubernetes cluster where the nullplatform agent will be deployed | `string` | n/a | yes | | [dns\_type](#input\_dns\_type) | Type of DNS Provider, ej: azure, route53, or external\_dns | `string` | `""` | no | | [domain](#input\_domain) | Base domain name used across resources | `string` | `""` | no | | [extra\_envs](#input\_extra\_envs) | Additional environment variables to pass to the agent | `map(string)` | `{}` | no | @@ -157,19 +157,17 @@ resource "example_resource" "this" { | [image\_repository](#input\_image\_repository) | Container image repository for the agent. Defaults to the official nullplatform image. | `string` | `""` | no | | [image\_tag](#input\_image\_tag) | Image tag for the agent container image | `string` | n/a | yes | | [init\_scripts](#input\_init\_scripts) | List of initialization scripts to execute during agent startup | `list(string)` | `[]` | no | -| [initial\_ingress\_path](#input\_initial\_ingress\_path) | Defines the initial ingress path used when deploying the application for the first time. | `string` | `""` | no | +| [initial\_ingress\_path](#input\_initial\_ingress\_path) | Defines the initial ingress path used when deploying the application for the first time. Required when extra\_envs.INGRESS\_TYPE is 'istio' — the k8s scope's default template is AWS ALB Ingress and won't route traffic correctly through Istio, so it must be pointed at an Istio HTTPRoute template instead. | `string` | `""` | no | | [namespace](#input\_namespace) | Kubernetes namespace where the nullplatform agent will run | `string` | `"nullplatform-tools"` | no | -| [nrn](#input\_nrn) | Nullplatform Resource Name - unique identifier for nullplatform resources | `string` | n/a | yes | | [nullplatform\_agent\_helm\_version](#input\_nullplatform\_agent\_helm\_version) | Version of the nullplatform agent Helm chart to deploy | `string` | `"2.37.0"` | no | -| [private\_domain](#input\_private\_domain) | Private domain name used for internal agent routing | `string` | `""` | no | -| [private\_gateway\_name](#input\_private\_gateway\_name) | Private gateway name for Azure networking | `string` | `null` | no | +| [private\_gateway\_name](#input\_private\_gateway\_name) | Name of the private/internal gateway used for routing | `string` | `"gateway-private"` | no | | [private\_hosted\_zone\_rg](#input\_private\_hosted\_zone\_rg) | Resource group for private hosted zone | `string` | `null` | no | -| [public\_gateway\_name](#input\_public\_gateway\_name) | Public gateway name for Azure networking | `string` | `null` | no | +| [public\_gateway\_name](#input\_public\_gateway\_name) | Name of the public gateway used for routing | `string` | `"gateway-public"` | no | | [release\_name](#input\_release\_name) | Override for the Helm release name. Defaults to nullplatform-agent | `string` | `"nullplatform-agent"` | no | | [service\_account\_name](#input\_service\_account\_name) | Override for the Kubernetes ServiceAccount name created by the Helm chart | `string` | `""` | no | -| [service\_template](#input\_service\_template) | Specifies the name or reference of the scope service template to be used for deployment. | `string` | `""` | no | +| [service\_template](#input\_service\_template) | Specifies the name or reference of the scope service template to be used for deployment. Required when extra\_envs.INGRESS\_TYPE is 'istio' — the k8s scope's default template is AWS ALB Ingress and won't route traffic correctly through Istio, so it must be pointed at an Istio-compatible template instead. | `string` | `""` | no | | [tags\_selectors](#input\_tags\_selectors) | Map of tags used to select and filter channels and agents | `map(string)` | n/a | yes | -| [use\_account\_slug](#input\_use\_account\_slug) | Flag to determine whether to use account slug in resource naming | `string` | `""` | no | +| [use\_account\_slug](#input\_use\_account\_slug) | Flag to determine whether to use the account slug in resource naming | `string` | `""` | no | | [worker](#input\_worker) | Worker-orchestration config, merged into the agent chart's `worker` block:
backend, security, allowedRegistries (deny-by-default registry guardrail),
patches (standard k8s patching of workers — the preferred way to shape them),
idleTTL (reap idle workers), and the legacy defaults/rules/pins. See the
nullplatform-agent chart values (>= 2.37.0) for the full shape. null = chart
defaults.

Example:
worker = {
allowedRegistries = ["public.ecr.aws/your-org/*"]
patches = [{ target = { package = "my-pkg" }, merge = { spec = { serviceAccountName = "np-agent-sa" } } }]
idleTTL = "30m"
} | `any` | `null` | no | diff --git a/nullplatform/agent/locals.tf b/nullplatform/agent/locals.tf index 6a40edb00..1a039b8ba 100644 --- a/nullplatform/agent/locals.tf +++ b/nullplatform/agent/locals.tf @@ -49,6 +49,8 @@ locals { SERVICE_TEMPLATE = var.service_template INITIAL_INGRESS_PATH = var.initial_ingress_path BLUE_GREEN_INGRESS_PATH = var.blue_green_ingress_path + PRIVATE_GATEWAY_NAME = var.private_gateway_name + PUBLIC_GATEWAY_NAME = var.public_gateway_name } cloud_config = { @@ -56,15 +58,8 @@ locals { AWS_IAM_ROLE_ARN = var.aws_iam_role_arn } - gcp = { - PRIVATE_GATEWAY_NAME = var.private_gateway_name - PRIVATE_DOMAIN = var.private_domain - } - azure = { PRIVATE_HOSTED_ZONE_RG = var.private_hosted_zone_rg - PRIVATE_GATEWAY_NAME = var.private_gateway_name - PUBLIC_GATEWAY_NAME = var.public_gateway_name RESOURCE_GROUP = var.azure_resource_group AZURE_SUBSCRIPTION_ID = var.azure_subscription_id AZURE_CLIENT_SECRET = var.azure_client_secret @@ -72,10 +67,7 @@ locals { AZURE_TENANT_ID = var.azure_tenant_id } - oci = { - PRIVATE_GATEWAY_NAME = var.private_gateway_name - PRIVATE_DOMAIN = var.private_domain - } + oci = {} } all_config = merge( diff --git a/nullplatform/agent/main.tf b/nullplatform/agent/main.tf index cc26ec895..78b5004ee 100644 --- a/nullplatform/agent/main.tf +++ b/nullplatform/agent/main.tf @@ -28,22 +28,26 @@ resource "terraform_data" "cross_variable_validation" { condition = var.cloud_provider != "azure" || var.azure_resource_group != null error_message = "azure_resource_group is required when cloud_provider is 'azure'." } - precondition { - condition = var.cloud_provider != "azure" || var.private_gateway_name != null - error_message = "private_gateway_name is required when cloud_provider is 'azure'." - } precondition { condition = var.cloud_provider != "azure" || var.private_hosted_zone_rg != null error_message = "private_hosted_zone_rg is required when cloud_provider is 'azure'." } - precondition { - condition = var.cloud_provider != "azure" || var.public_gateway_name != null - error_message = "public_gateway_name is required when cloud_provider is 'azure'." - } precondition { condition = var.cloud_provider != "azure" || var.azure_tenant_id != null error_message = "azure_tenant_id is required when cloud_provider is 'azure'." } + precondition { + condition = lookup(var.extra_envs, "INGRESS_TYPE", "") != "istio" || var.service_template != "" + error_message = "service_template is required when extra_envs.INGRESS_TYPE is 'istio' — the k8s scope's default template is AWS ALB Ingress and won't route traffic correctly through Istio." + } + precondition { + condition = lookup(var.extra_envs, "INGRESS_TYPE", "") != "istio" || var.initial_ingress_path != "" + error_message = "initial_ingress_path is required when extra_envs.INGRESS_TYPE is 'istio' — the k8s scope's default template is AWS ALB Ingress and won't route traffic correctly through Istio." + } + precondition { + condition = lookup(var.extra_envs, "INGRESS_TYPE", "") != "istio" || var.blue_green_ingress_path != "" + error_message = "blue_green_ingress_path is required when extra_envs.INGRESS_TYPE is 'istio' — the k8s scope's default template is AWS ALB Ingress and won't route traffic correctly through Istio." + } } } @@ -55,18 +59,9 @@ resource "helm_release" "agent" { namespace = var.namespace version = var.nullplatform_agent_helm_version - create_namespace = true - disable_webhooks = false - force_update = true - wait = true wait_for_jobs = true timeout = 600 - atomic = true - cleanup_on_fail = true - replace = true - recreate_pods = true reset_values = true - reuse_values = false dependency_update = true max_history = 10 diff --git a/nullplatform/agent/tests/agent.tftest.hcl b/nullplatform/agent/tests/agent.tftest.hcl new file mode 100644 index 000000000..8174cef1c --- /dev/null +++ b/nullplatform/agent/tests/agent.tftest.hcl @@ -0,0 +1,97 @@ +mock_provider "nullplatform" {} +mock_provider "helm" {} + +variables { + api_key = "test-api-key" + cluster_name = "test-cluster" + tags_selectors = { environment = "test" } + image_tag = "latest" + cloud_provider = "gcp" +} + +run "no_extra_envs_does_not_require_ingress_templates" { + command = plan +} + +run "ingress_type_not_istio_does_not_require_ingress_templates" { + command = plan + + variables { + extra_envs = { INGRESS_TYPE = "nginx" } + } +} + +run "ingress_type_istio_requires_service_template" { + command = plan + + variables { + extra_envs = { INGRESS_TYPE = "istio" } + initial_ingress_path = "/root/.np/nullplatform/scopes/k8s/deployment/templates/istio/initial-httproute.yaml.tpl" + blue_green_ingress_path = "/root/.np/nullplatform/scopes/k8s/deployment/templates/istio/blue-green-httproute.yaml.tpl" + } + + expect_failures = [ + terraform_data.cross_variable_validation, + ] +} + +run "ingress_type_istio_requires_initial_ingress_path" { + command = plan + + variables { + extra_envs = { INGRESS_TYPE = "istio" } + service_template = "/root/.np/nullplatform/scopes/k8s/deployment/templates/istio/service.yaml.tpl" + blue_green_ingress_path = "/root/.np/nullplatform/scopes/k8s/deployment/templates/istio/blue-green-httproute.yaml.tpl" + } + + expect_failures = [ + terraform_data.cross_variable_validation, + ] +} + +run "ingress_type_istio_requires_blue_green_ingress_path" { + command = plan + + variables { + extra_envs = { INGRESS_TYPE = "istio" } + service_template = "/root/.np/nullplatform/scopes/k8s/deployment/templates/istio/service.yaml.tpl" + initial_ingress_path = "/root/.np/nullplatform/scopes/k8s/deployment/templates/istio/initial-httproute.yaml.tpl" + } + + expect_failures = [ + terraform_data.cross_variable_validation, + ] +} + +run "ingress_type_istio_with_all_ingress_templates_succeeds" { + command = plan + + variables { + extra_envs = { INGRESS_TYPE = "istio" } + service_template = "/root/.np/nullplatform/scopes/k8s/deployment/templates/istio/service.yaml.tpl" + initial_ingress_path = "/root/.np/nullplatform/scopes/k8s/deployment/templates/istio/initial-httproute.yaml.tpl" + blue_green_ingress_path = "/root/.np/nullplatform/scopes/k8s/deployment/templates/istio/blue-green-httproute.yaml.tpl" + } +} + +run "aws_with_ingress_type_istio_still_requires_ingress_templates" { + command = plan + + variables { + cloud_provider = "aws" + aws_iam_role_arn = "arn:aws:iam::123456789012:role/test-role" + extra_envs = { INGRESS_TYPE = "istio" } + } + + expect_failures = [ + terraform_data.cross_variable_validation, + ] +} + +run "oci_succeeds_with_default_gateway_names" { + command = plan + + variables { + cloud_provider = "oci" + } +} diff --git a/nullplatform/agent/variables.tf b/nullplatform/agent/variables.tf index 07724f3d2..105d1d2e2 100644 --- a/nullplatform/agent/variables.tf +++ b/nullplatform/agent/variables.tf @@ -9,20 +9,26 @@ variable "api_key" { sensitive = true } -# Name of the EKS cluster where the nullplatform agent will be deployed +# Name of the Kubernetes cluster where the nullplatform agent will be deployed variable "cluster_name" { - description = "Name of the EKS cluster where the nullplatform agent will be deployed" + description = "Name of the Kubernetes cluster where the nullplatform agent will be deployed" type = string } -# Nullplatform Resource Name - unique identifier for nullplatform resources. -# Kept as a required input for interface parity with the other nullplatform -# modules; the agent resolves its own scope from the API key, so this module does -# not consume the value directly. -# tflint-ignore: terraform_unused_declarations -variable "nrn" { - description = "Nullplatform Resource Name - unique identifier for nullplatform resources" +# Image tag for the agent container image +variable "image_tag" { + description = "Image tag for the agent container image" + type = string +} + +# Cloud provider the cluster runs on +variable "cloud_provider" { + description = "Cloud provider to use ('aws', 'gcp', 'azure', or 'oci')" type = string + validation { + condition = contains(["aws", "gcp", "azure", "oci"], var.cloud_provider) + error_message = "cloud_provider must be either 'aws' , 'gcp', 'oci' or 'azure'." + } } # Map of tags used to select and filter channels and agents @@ -106,18 +112,24 @@ variable "init_scripts" { default = [] } -# Image tag for the agent container image -variable "image_tag" { - description = "Image tag for the agent container image" +# Container image repository for the agent. Defaults to the official nullplatform image. +variable "image_repository" { + description = "Container image repository for the agent. Defaults to the official nullplatform image." type = string + default = "" } -variable "image_repository" { - description = "Container image repository for the agent. Defaults to the official nullplatform image." +# Flag to determine whether to use the account slug in resource naming +variable "use_account_slug" { + description = "Flag to determine whether to use the account slug in resource naming" type = string default = "" } +################################################################################ +# AWS Configuration +################################################################################ + # ARN of the AWS IAM role assigned to the agent (required when cloud_provider is 'aws') variable "aws_iam_role_arn" { description = "ARN of the AWS IAM role assigned to the agent" @@ -125,16 +137,6 @@ variable "aws_iam_role_arn" { default = "" } -# Cloud provider to use (aws, gcp, or azure) -variable "cloud_provider" { - description = "Cloud provider to use (aws, gcp, or azure)" - type = string - validation { - condition = contains(["aws", "gcp", "azure", "oci"], var.cloud_provider) - error_message = "cloud_provider must be either 'aws' , 'gcp', 'oci' or 'azure'." - } -} - ################################################################################ # Azure Configuration ################################################################################ @@ -168,13 +170,6 @@ variable "azure_resource_group" { default = null } -# Private gateway name for Azure networking (required when cloud_provider is 'azure') -variable "private_gateway_name" { - description = "Private gateway name for Azure networking" - type = string - default = null -} - # Resource group for private hosted zone (required when cloud_provider is 'azure') variable "private_hosted_zone_rg" { description = "Resource group for private hosted zone" @@ -182,13 +177,6 @@ variable "private_hosted_zone_rg" { default = null } -# Public gateway name for Azure networking (required when cloud_provider is 'azure') -variable "public_gateway_name" { - description = "Public gateway name for Azure networking" - type = string - default = null -} - # Azure tenant ID (required when cloud_provider is 'azure') variable "azure_tenant_id" { description = "Azure tenant ID" @@ -196,6 +184,24 @@ variable "azure_tenant_id" { default = null } +################################################################################ +# Gateway Configuration +################################################################################ + +# Name of the private/internal gateway used for routing +variable "private_gateway_name" { + description = "Name of the private/internal gateway used for routing" + type = string + default = "gateway-private" +} + +# Name of the public gateway used for routing +variable "public_gateway_name" { + description = "Name of the public gateway used for routing" + type = string + default = "gateway-public" +} + ################################################################################ # DNS and Domain Configuration ################################################################################ @@ -207,25 +213,13 @@ variable "dns_type" { default = "" } -# Base domain name used across resources (required when cloud_provider is 'azure') +# Base domain name used across resources variable "domain" { description = "Base domain name used across resources" type = string default = "" } -variable "private_domain" { - description = "Private domain name used for internal agent routing" - default = "" - type = string -} -# Flag to determine whether to use account slug in resource naming (required when cloud_provider is 'azure') -variable "use_account_slug" { - description = "Flag to determine whether to use account slug in resource naming" - type = string - default = "" -} - ################################################################################ # Image Configuration ################################################################################ @@ -237,24 +231,32 @@ variable "image_pull_secrets" { default = "" } +################################################################################ +# Ingress / Networking Configuration +################################################################################ + +# Scope service template to use for deployment (required when extra_envs.INGRESS_TYPE is 'istio') variable "service_template" { - description = "Specifies the name or reference of the scope service template to be used for deployment." + description = "Specifies the name or reference of the scope service template to be used for deployment. Required when extra_envs.INGRESS_TYPE is 'istio' — the k8s scope's default template is AWS ALB Ingress and won't route traffic correctly through Istio, so it must be pointed at an Istio-compatible template instead." type = string default = "" } +# Initial ingress path used on first deploy (required when extra_envs.INGRESS_TYPE is 'istio') variable "initial_ingress_path" { - description = "Defines the initial ingress path used when deploying the application for the first time." + description = "Defines the initial ingress path used when deploying the application for the first time. Required when extra_envs.INGRESS_TYPE is 'istio' — the k8s scope's default template is AWS ALB Ingress and won't route traffic correctly through Istio, so it must be pointed at an Istio HTTPRoute template instead." type = string default = "" } +# Blue-green ingress path used to route traffic to the new version (required when extra_envs.INGRESS_TYPE is 'istio') variable "blue_green_ingress_path" { - description = "Specifies the ingress path used for blue-green deployments to route traffic to the new version." + description = "Specifies the ingress path used for blue-green deployments to route traffic to the new version. Required when extra_envs.INGRESS_TYPE is 'istio' — the k8s scope's default template is AWS ALB Ingress and won't route traffic correctly through Istio, so it must be pointed at an Istio HTTPRoute template instead." type = string default = "" } +# Additional environment variables to pass to the agent variable "extra_envs" { description = "Additional environment variables to pass to the agent" type = map(string) diff --git a/nullplatform/scope_definition_agent_association/README.md b/nullplatform/scope_definition_agent_association/README.md index 96a5186ec..6f1f275dc 100644 --- a/nullplatform/scope_definition_agent_association/README.md +++ b/nullplatform/scope_definition_agent_association/README.md @@ -69,7 +69,7 @@ resource "example_resource" "this" { | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| | [api\_key](#input\_api\_key) | API key for authenticating with the nullplatform API | `string` | n/a | yes | -| [description](#input\_description) | Description shown for the notification channel. | `string` | `""` | no | +| [description](#input\_description) | Description shown for the notification channel. | `string` | `"Routes Containers deployments agent"` | no | | [enabled\_override](#input\_enabled\_override) | Enable custom overrides for scope configurations via command line | `bool` | `false` | no | | [entrypoint](#input\_entrypoint) | Override the worker's baked entrypoint path. Defaults to /app/packages//entrypoint. | `string` | `""` | no | | [extra\_filters](#input\_extra\_filters) | Additional filter expression to merge with the base template filters using $and.
Accepts any valid MongoDB-style filter expression, including logical operators
($and, $or, $nor, $not) and comparison operators ($eq, $ne, $in, $nin, $gt,
$gte, $lt, $lte, $regex). If null, only the base template filters are applied.

Examples:
Simple equality: { "dimensions.environment" = "production" }
Comparison: { "action" = { "$in" = ["deployment:create", "deployment:update"] } }
Logical OR: { "$or" = [{ "details.namespace.slug" = "prod" }, { "details.namespace.slug" = "staging" }] }
Negation: { "$not" = { "entity\_data.status" = "failed" } }
Combined: { "$and" = [{ "action" = { "$regex" = "^deployment" } }, { "$or" = [...] }] } | `any` | `null` | no | diff --git a/nullplatform/scope_definition_agent_association/variables.tf b/nullplatform/scope_definition_agent_association/variables.tf index 405ab6487..5bc743f18 100644 --- a/nullplatform/scope_definition_agent_association/variables.tf +++ b/nullplatform/scope_definition_agent_association/variables.tf @@ -113,7 +113,7 @@ variable "tags_selectors" { variable "description" { description = "Description shown for the notification channel." type = string - default = "" + default = "Routes Containers deployments agent" } variable "extra_filters" { From cee7a979b2c8e2679e25293bad5119613c51f4a3 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Fri, 14 Aug 2026 15:38:55 +0000 Subject: [PATCH 16/81] chore(6.x): release 6.14.0 --- CHANGELOG.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 4eb112884..19e951262 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,12 @@ # Changelog +## [6.14.0](https://github.com/nullplatform/tofu-modules/compare/v6.13.1...v6.14.0) (2026-08-14) + + +### Features + +* **nullplatform/agent:** require ingress templates for non-aws clouds ([#515](https://github.com/nullplatform/tofu-modules/issues/515)) ([fbb4198](https://github.com/nullplatform/tofu-modules/commit/fbb4198d33b1da084e033e7b371d35d9509c6ed9)) + ## [6.13.1](https://github.com/nullplatform/tofu-modules/compare/v6.13.0...v6.13.1) (2026-08-14) From 5e6e1b2f2796e63cd0216d35c888d6fea4ea7f1d Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Fri, 14 Aug 2026 15:39:45 +0000 Subject: [PATCH 17/81] docs: regenerate READMEs for changed modules and update versions --- infrastructure/aws/acm/README.md | 2 +- .../aws_load_balancer_controller/README.md | 2 +- infrastructure/aws/backend/README.md | 2 +- infrastructure/aws/dns/README.md | 2 +- infrastructure/aws/eks/README.md | 2 +- infrastructure/aws/iam/agent/README.md | 2 +- .../README.md | 2 +- infrastructure/aws/iam/cert_manager/README.md | 2 +- .../aws/iam/ci-build-workflow-user/README.md | 2 +- infrastructure/aws/iam/cloudwatch/README.md | 2 +- infrastructure/aws/iam/ecr/README.md | 2 +- infrastructure/aws/iam/external_dns/README.md | 2 +- infrastructure/aws/iam/s3/README.md | 2 +- infrastructure/aws/ingress/README.md | 2 +- infrastructure/aws/security/README.md | 2 +- infrastructure/aws/vpc/README.md | 2 +- infrastructure/azure/acr/README.md | 2 +- infrastructure/azure/aks/README.md | 2 +- .../azure/aks_route_table/README.md | 2 +- infrastructure/azure/dns/README.md | 2 +- infrastructure/azure/iam/README.md | 2 +- infrastructure/azure/private_dns/README.md | 2 +- infrastructure/azure/resource_group/README.md | 2 +- infrastructure/azure/security/README.md | 2 +- infrastructure/azure/vnet/README.md | 2 +- infrastructure/commons/cert_manager/README.md | 12 +- infrastructure/commons/external_dns/README.md | 12 +- infrastructure/commons/istio/README.md | 2 +- infrastructure/commons/prometheus/README.md | 2 +- .../gcp/artifact-registry/README.md | 2 +- infrastructure/gcp/cloud-dns/README.md | 2 +- infrastructure/gcp/cloud-nat/README.md | 2 +- infrastructure/gcp/gke/README.md | 2 +- infrastructure/gcp/iam/README.md | 2 +- infrastructure/gcp/security/README.md | 2 +- infrastructure/gcp/vpc/README.md | 2 +- infrastructure/oci/backend/README.md | 2 +- infrastructure/oci/dns/README.md | 2 +- infrastructure/oci/dynamic_groups/README.md | 2 +- infrastructure/oci/oke/README.md | 2 +- infrastructure/oci/vcn/README.md | 2 +- nullplatform/account/README.md | 2 +- nullplatform/agent/README.md | 118 ++++++++---------- nullplatform/api_key/README.md | 10 +- nullplatform/asset/docker_server/README.md | 2 +- nullplatform/asset/ecr/README.md | 2 +- nullplatform/asset/s3/README.md | 2 +- nullplatform/base/README.md | 12 +- nullplatform/cloud/aws/cloud/README.md | 2 +- nullplatform/cloud/aws/vpc/README.md | 2 +- nullplatform/cloud/azure/cloud/README.md | 2 +- nullplatform/cloud/gcp/cloud/README.md | 2 +- nullplatform/cloud/oci/cloud/README.md | 2 +- nullplatform/code_repository/README.md | 10 +- .../container_orchestration/aks/README.md | 2 +- .../container_orchestration/eks/README.md | 2 +- .../container_orchestration/gke/README.md | 2 +- .../container_orchestration/oke/README.md | 2 +- nullplatform/dimension/README.md | 2 +- nullplatform/dimension_value/README.md | 2 +- .../identity-access-control/README.md | 2 +- nullplatform/metrics/README.md | 2 +- nullplatform/packaged_service/README.md | 2 +- .../parameter_storage_configuration/README.md | 2 +- .../parameter_storage_definition/README.md | 2 +- .../README.md | 2 +- nullplatform/scope_configuration/README.md | 2 +- nullplatform/scope_definition/README.md | 2 +- .../README.md | 55 +++++--- nullplatform/service_definition/README.md | 2 +- .../README.md | 2 +- nullplatform/users/README.md | 2 +- 72 files changed, 181 insertions(+), 178 deletions(-) diff --git a/infrastructure/aws/acm/README.md b/infrastructure/aws/acm/README.md index 83c603c0a..2ea7a37cb 100644 --- a/infrastructure/aws/acm/README.md +++ b/infrastructure/aws/acm/README.md @@ -18,7 +18,7 @@ The module creates an aws_acm_certificate resource with DNS validation, which is ```hcl module "acm" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/acm?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/acm?ref=v6.14.0" domain_name = "your-domain-name" zone_id = "your-zone-id" diff --git a/infrastructure/aws/aws_load_balancer_controller/README.md b/infrastructure/aws/aws_load_balancer_controller/README.md index 1abd90f28..020587600 100644 --- a/infrastructure/aws/aws_load_balancer_controller/README.md +++ b/infrastructure/aws/aws_load_balancer_controller/README.md @@ -18,7 +18,7 @@ This module creates a helm_release resource to deploy the AWS Load Balancer Cont ```hcl module "aws_load_balancer_controller" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/aws_load_balancer_controller?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/aws_load_balancer_controller?ref=v6.14.0" cluster_name = "your-cluster-name" vpc_id = "your-vpc-id" diff --git a/infrastructure/aws/backend/README.md b/infrastructure/aws/backend/README.md index f6c048480..45bcd86a0 100644 --- a/infrastructure/aws/backend/README.md +++ b/infrastructure/aws/backend/README.md @@ -20,7 +20,7 @@ This module creates an S3 bucket with versioning and server-side encryption enab ```hcl module "backend" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/backend?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/backend?ref=v6.14.0" } ``` diff --git a/infrastructure/aws/dns/README.md b/infrastructure/aws/dns/README.md index 7153f39a8..180524a67 100644 --- a/infrastructure/aws/dns/README.md +++ b/infrastructure/aws/dns/README.md @@ -21,7 +21,7 @@ The module conditionally creates an aws_route53_zone resource for a public hoste ```hcl module "dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/dns?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/dns?ref=v6.14.0" domain_name = "your-domain-name" vpc_id = "your-vpc-id" diff --git a/infrastructure/aws/eks/README.md b/infrastructure/aws/eks/README.md index 216f5e970..bc05ee228 100644 --- a/infrastructure/aws/eks/README.md +++ b/infrastructure/aws/eks/README.md @@ -22,7 +22,7 @@ The module wraps terraform-aws-modules/eks to create the EKS cluster (aws_eks_cl ```hcl module "eks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/eks?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/eks?ref=v6.14.0" aws_subnets_private_ids = "your-aws-subnets-private-ids" aws_vpc_vpc_id = "your-aws-vpc-vpc-id" diff --git a/infrastructure/aws/iam/agent/README.md b/infrastructure/aws/iam/agent/README.md index eeb8b583f..fc5fba2c6 100644 --- a/infrastructure/aws/iam/agent/README.md +++ b/infrastructure/aws/iam/agent/README.md @@ -21,7 +21,7 @@ The module uses the terraform-aws-modules/iam//modules/iam-role-for-service-acco ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/agent?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/agent?ref=v6.14.0" agent_namespace = "your-agent-namespace" aws_iam_openid_connect_provider_arn = "your-aws-iam-openid-connect-provider-arn" diff --git a/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md b/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md index 7c7bcdc92..42e4381c2 100644 --- a/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md +++ b/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md @@ -19,7 +19,7 @@ This module creates an IAM role for the AWS Load Balancer Controller using the t ```hcl module "aws_load_balancer_controller_iam" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/aws_load_balancer_controller_iam?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/aws_load_balancer_controller_iam?ref=v6.14.0" aws_iam_openid_connect_provider_arn = "your-aws-iam-openid-connect-provider-arn" cluster_name = "your-cluster-name" diff --git a/infrastructure/aws/iam/cert_manager/README.md b/infrastructure/aws/iam/cert_manager/README.md index 43d9cebdc..fa0336fbf 100644 --- a/infrastructure/aws/iam/cert_manager/README.md +++ b/infrastructure/aws/iam/cert_manager/README.md @@ -20,7 +20,7 @@ An aws_iam_policy resource is always created granting route53:GetChange, route53 ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cert_manager?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cert_manager?ref=v6.14.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/ci-build-workflow-user/README.md b/infrastructure/aws/iam/ci-build-workflow-user/README.md index 8ecad8e0e..b590240f8 100644 --- a/infrastructure/aws/iam/ci-build-workflow-user/README.md +++ b/infrastructure/aws/iam/ci-build-workflow-user/README.md @@ -21,7 +21,7 @@ The module creates an aws_iam_user named with the cluster_name prefix and genera ```hcl module "ci-build-workflow-user" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ci-build-workflow-user?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ci-build-workflow-user?ref=v6.14.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/cloudwatch/README.md b/infrastructure/aws/iam/cloudwatch/README.md index b677b5045..d62545d77 100644 --- a/infrastructure/aws/iam/cloudwatch/README.md +++ b/infrastructure/aws/iam/cloudwatch/README.md @@ -20,7 +20,7 @@ The module creates an aws_iam_policy granting CloudWatch Logs and Metrics write ```hcl module "cloudwatch" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cloudwatch?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cloudwatch?ref=v6.14.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/ecr/README.md b/infrastructure/aws/iam/ecr/README.md index 6427a9d61..a3c8f64af 100644 --- a/infrastructure/aws/iam/ecr/README.md +++ b/infrastructure/aws/iam/ecr/README.md @@ -20,7 +20,7 @@ The module creates an aws_iam_role named nullplatform-{cluster_name}-application ```hcl module "ecr" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ecr?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ecr?ref=v6.14.0" build_workflow_group_name = "your-build-workflow-group-name" cluster_name = "your-cluster-name" diff --git a/infrastructure/aws/iam/external_dns/README.md b/infrastructure/aws/iam/external_dns/README.md index 54c7e2f75..0d0312c4f 100644 --- a/infrastructure/aws/iam/external_dns/README.md +++ b/infrastructure/aws/iam/external_dns/README.md @@ -20,7 +20,7 @@ An aws_iam_policy resource named nullplatform_external_dns_policy is always crea ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/external_dns?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/external_dns?ref=v6.14.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/s3/README.md b/infrastructure/aws/iam/s3/README.md index 5e182b7ec..456698a47 100644 --- a/infrastructure/aws/iam/s3/README.md +++ b/infrastructure/aws/iam/s3/README.md @@ -18,7 +18,7 @@ The module creates an aws_iam_policy resource that allows s3:PutObject and s3:Ge ```hcl module "s3" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/s3?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/s3?ref=v6.14.0" bucket = "your-bucket" build_workflow_group_name = "your-build-workflow-group-name" diff --git a/infrastructure/aws/ingress/README.md b/infrastructure/aws/ingress/README.md index 1e261a9a7..3715dbc3e 100644 --- a/infrastructure/aws/ingress/README.md +++ b/infrastructure/aws/ingress/README.md @@ -22,7 +22,7 @@ The module creates up to two kubernetes_ingress_v1 resources — one for an inte ```hcl module "ingress" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/ingress?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/ingress?ref=v6.14.0" certificate_arn = "your-certificate-arn" } diff --git a/infrastructure/aws/security/README.md b/infrastructure/aws/security/README.md index a7c202ac9..19ae7cf1e 100644 --- a/infrastructure/aws/security/README.md +++ b/infrastructure/aws/security/README.md @@ -22,7 +22,7 @@ The module uses data sources (aws_eks_cluster, aws_vpc) to automatically derive ```hcl module "security" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/security?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/security?ref=v6.14.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/vpc/README.md b/infrastructure/aws/vpc/README.md index 8ccdea5e1..3b730488d 100644 --- a/infrastructure/aws/vpc/README.md +++ b/infrastructure/aws/vpc/README.md @@ -22,7 +22,7 @@ This module creates a terraform-aws-modules/vpc/aws module resource with DNS hos ```hcl module "vpc" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/vpc?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/vpc?ref=v6.14.0" account = "your-account" organization = "your-organization" diff --git a/infrastructure/azure/acr/README.md b/infrastructure/azure/acr/README.md index 0a7dfe810..cf1c2e842 100644 --- a/infrastructure/azure/acr/README.md +++ b/infrastructure/azure/acr/README.md @@ -18,7 +18,7 @@ The module uses the azurerm_container_registry resource to create the container ```hcl module "acr" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/acr?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/acr?ref=v6.14.0" containerregistry_name = "your-containerregistry-name" location = "your-location" diff --git a/infrastructure/azure/aks/README.md b/infrastructure/azure/aks/README.md index 8853f946e..61a39b278 100644 --- a/infrastructure/azure/aks/README.md +++ b/infrastructure/azure/aks/README.md @@ -22,7 +22,7 @@ The module wraps the Azure/aks/azurerm community module (version 11.0.0) and use ```hcl module "aks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks?ref=v6.14.0" cluster_name = "your-cluster-name" location = "your-location" diff --git a/infrastructure/azure/aks_route_table/README.md b/infrastructure/azure/aks_route_table/README.md index 522761289..e165e9c14 100644 --- a/infrastructure/azure/aks_route_table/README.md +++ b/infrastructure/azure/aks_route_table/README.md @@ -19,7 +19,7 @@ The module uses an azurerm_resources data source to discover the AKS-managed rou ```hcl module "aks_route_table" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks_route_table?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks_route_table?ref=v6.14.0" node_resource_group = "your-node-resource-group" subnet_id = "your-subnet-id" diff --git a/infrastructure/azure/dns/README.md b/infrastructure/azure/dns/README.md index 868d033df..00e020bba 100644 --- a/infrastructure/azure/dns/README.md +++ b/infrastructure/azure/dns/README.md @@ -18,7 +18,7 @@ This module creates an azurerm_dns_zone resource and configures it with the prov ```hcl module "dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/dns?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/dns?ref=v6.14.0" domain_name = "your-domain-name" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/iam/README.md b/infrastructure/azure/iam/README.md index 3e6ff5fe2..7202705d7 100644 --- a/infrastructure/azure/iam/README.md +++ b/infrastructure/azure/iam/README.md @@ -21,7 +21,7 @@ The module creates an azurerm_user_assigned_identity resource in the specified r ```hcl module "iam" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/iam?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/iam?ref=v6.14.0" location = "your-location" name = "your-name" diff --git a/infrastructure/azure/private_dns/README.md b/infrastructure/azure/private_dns/README.md index c0b407c4d..dcf2f2475 100644 --- a/infrastructure/azure/private_dns/README.md +++ b/infrastructure/azure/private_dns/README.md @@ -18,7 +18,7 @@ This module creates an azurerm_private_dns_zone resource and optionally multiple ```hcl module "private_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/private_dns?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/private_dns?ref=v6.14.0" domain_name = "your-domain-name" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/resource_group/README.md b/infrastructure/azure/resource_group/README.md index a666cbd5d..91cf20645 100644 --- a/infrastructure/azure/resource_group/README.md +++ b/infrastructure/azure/resource_group/README.md @@ -18,7 +18,7 @@ This module creates an azurerm_resource_group resource and outputs its name and ```hcl module "resource_group" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/resource_group?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/resource_group?ref=v6.14.0" location = "your-location" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/security/README.md b/infrastructure/azure/security/README.md index c4d74ab53..69dca6fdc 100644 --- a/infrastructure/azure/security/README.md +++ b/infrastructure/azure/security/README.md @@ -21,7 +21,7 @@ The module uses azurerm_kubernetes_cluster and azurerm_virtual_network data sour ```hcl module "security" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/security?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/security?ref=v6.14.0" cluster_name = "your-cluster-name" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/vnet/README.md b/infrastructure/azure/vnet/README.md index 630db78b4..f20774b88 100644 --- a/infrastructure/azure/vnet/README.md +++ b/infrastructure/azure/vnet/README.md @@ -18,7 +18,7 @@ This module creates an Azure virtual network using the azurerm provider and conf ```hcl module "vnet" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/vnet?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/vnet?ref=v6.14.0" address_space = "your-address-space" location = "your-location" diff --git a/infrastructure/commons/cert_manager/README.md b/infrastructure/commons/cert_manager/README.md index 7a1383606..1e7385aed 100644 --- a/infrastructure/commons/cert_manager/README.md +++ b/infrastructure/commons/cert_manager/README.md @@ -22,7 +22,7 @@ Two primary helm_release resources are created: cert-manager from the Jetstack c ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.14.0" account_slug = "your-account-slug" cloud_provider = "your-cloud-provider" @@ -35,7 +35,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.14.0" account_slug = "your-account-slug" cloud_provider = "gcp" @@ -50,7 +50,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.14.0" account_slug = "your-account-slug" azure_client_id = "your-azure-client-id" # Required when cloud_provider = "azure" @@ -68,7 +68,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.14.0" account_slug = "your-account-slug" cloud_provider = "cloudflare" @@ -83,7 +83,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.14.0" account_slug = "your-account-slug" aws_identity_mode = "your-aws-identity-mode" # Required when cloud_provider = "aws" @@ -99,7 +99,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.14.0" account_slug = "your-account-slug" cert_manager_webhook_oci_namespace = "your-cert-manager-webhook-oci-namespace" # Required when cloud_provider = "oci" diff --git a/infrastructure/commons/external_dns/README.md b/infrastructure/commons/external_dns/README.md index daf98df8e..ba7226985 100644 --- a/infrastructure/commons/external_dns/README.md +++ b/infrastructure/commons/external_dns/README.md @@ -22,7 +22,7 @@ The module creates an optional kubernetes_namespace_v1 resource when create_name ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.14.0" dns_provider_name = "your-dns-provider-name" domain_filters = "your-domain-filters" @@ -33,7 +33,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.14.0" cloudflare_token = "your-cloudflare-token" # Required when dns_provider_name = "cloudflare" dns_provider_name = "cloudflare" @@ -45,7 +45,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.14.0" aws_iam_role_arn = "your-aws-iam-role-arn" # Required when dns_provider_name = "aws" aws_identity_mode = "your-aws-identity-mode" # Required when dns_provider_name = "aws" @@ -61,7 +61,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.14.0" dns_provider_name = "oci" domain_filters = "your-domain-filters" @@ -77,7 +77,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.14.0" azure_client_id = "your-azure-client-id" # Required when dns_provider_name = "azure" azure_federated_credential_id = "your-azure-federated-credential-id" # Required when dns_provider_name = "azure" @@ -94,7 +94,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.14.0" azure_client_id = "your-azure-client-id" # Required when dns_provider_name = "azure-private-dns" azure_federated_credential_id = "your-azure-federated-credential-id" # Required when dns_provider_name = "azure-private-dns" diff --git a/infrastructure/commons/istio/README.md b/infrastructure/commons/istio/README.md index a72df1411..d9a2637ad 100644 --- a/infrastructure/commons/istio/README.md +++ b/infrastructure/commons/istio/README.md @@ -21,7 +21,7 @@ Three helm_release resources are created in a strict dependency chain: istio-bas ```hcl module "istio" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/istio?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/istio?ref=v6.14.0" } ``` diff --git a/infrastructure/commons/prometheus/README.md b/infrastructure/commons/prometheus/README.md index 9821a16ec..f5255fdf1 100644 --- a/infrastructure/commons/prometheus/README.md +++ b/infrastructure/commons/prometheus/README.md @@ -18,7 +18,7 @@ This module creates a helm_release resource to deploy the Prometheus chart from ```hcl module "prometheus" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.14.0" } ``` diff --git a/infrastructure/gcp/artifact-registry/README.md b/infrastructure/gcp/artifact-registry/README.md index 861150224..7d1c32f8d 100644 --- a/infrastructure/gcp/artifact-registry/README.md +++ b/infrastructure/gcp/artifact-registry/README.md @@ -21,7 +21,7 @@ The module provisions a google_artifact_registry_repository resource in the spec ```hcl module "artifact-registry" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/artifact-registry?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/artifact-registry?ref=v6.14.0" location = "your-location" project_id = "your-project-id" diff --git a/infrastructure/gcp/cloud-dns/README.md b/infrastructure/gcp/cloud-dns/README.md index 37a70b934..9b826908b 100644 --- a/infrastructure/gcp/cloud-dns/README.md +++ b/infrastructure/gcp/cloud-dns/README.md @@ -21,7 +21,7 @@ The module creates a single google_dns_managed_zone resource in the specified GC ```hcl module "cloud-dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-dns?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-dns?ref=v6.14.0" domain_name = "your-domain-name" project_id = "your-project-id" diff --git a/infrastructure/gcp/cloud-nat/README.md b/infrastructure/gcp/cloud-nat/README.md index 323f4d278..3e653767c 100644 --- a/infrastructure/gcp/cloud-nat/README.md +++ b/infrastructure/gcp/cloud-nat/README.md @@ -19,7 +19,7 @@ This module creates a google_compute_router resource in a specified region and n ```hcl module "cloud-nat" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-nat?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-nat?ref=v6.14.0" nat_name = "your-nat-name" network_id = "your-network-id" diff --git a/infrastructure/gcp/gke/README.md b/infrastructure/gcp/gke/README.md index 9df260276..798cf4df9 100644 --- a/infrastructure/gcp/gke/README.md +++ b/infrastructure/gcp/gke/README.md @@ -20,7 +20,7 @@ The module uses the google-modules/kubernetes-engine/google//modules/private-clu ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.14.0" cluster_name = "your-cluster-name" ip_range_pods = "your-ip-range-pods" diff --git a/infrastructure/gcp/iam/README.md b/infrastructure/gcp/iam/README.md index 7f2e8d1f7..3bb3b5bb7 100644 --- a/infrastructure/gcp/iam/README.md +++ b/infrastructure/gcp/iam/README.md @@ -19,7 +19,7 @@ The module creates google_service_account resources for each service account spe ```hcl module "iam" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/iam?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/iam?ref=v6.14.0" project_id = "your-project-id" } diff --git a/infrastructure/gcp/security/README.md b/infrastructure/gcp/security/README.md index d50f11e98..f3be9a89f 100644 --- a/infrastructure/gcp/security/README.md +++ b/infrastructure/gcp/security/README.md @@ -21,7 +21,7 @@ The module uses data sources google_container_cluster and google_compute_subnetw ```hcl module "security" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/security?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/security?ref=v6.14.0" cluster_name = "your-cluster-name" gcp_project_id = "your-gcp-project-id" diff --git a/infrastructure/gcp/vpc/README.md b/infrastructure/gcp/vpc/README.md index 7713a18ac..d72e8f874 100644 --- a/infrastructure/gcp/vpc/README.md +++ b/infrastructure/gcp/vpc/README.md @@ -20,7 +20,7 @@ The module invokes the terraform-google-modules/network/google module to create ```hcl module "vpc" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/vpc?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/vpc?ref=v6.14.0" network_name = "your-network-name" project_id = "your-project-id" diff --git a/infrastructure/oci/backend/README.md b/infrastructure/oci/backend/README.md index 547670712..3755429d3 100644 --- a/infrastructure/oci/backend/README.md +++ b/infrastructure/oci/backend/README.md @@ -18,7 +18,7 @@ The module creates an oci_objectstorage_bucket resource, which is configured wit ```hcl module "backend" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/backend?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/backend?ref=v6.14.0" compartment_id = "your-compartment-id" namespace = "your-namespace" diff --git a/infrastructure/oci/dns/README.md b/infrastructure/oci/dns/README.md index 38336ea7c..4743d13e2 100644 --- a/infrastructure/oci/dns/README.md +++ b/infrastructure/oci/dns/README.md @@ -18,7 +18,7 @@ This module creates oci_dns_zone resources for each DNS zone defined in the dns_ ```hcl module "dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dns?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dns?ref=v6.14.0" compartment_id = "your-compartment-id" } diff --git a/infrastructure/oci/dynamic_groups/README.md b/infrastructure/oci/dynamic_groups/README.md index 314c85714..ea17d2da9 100644 --- a/infrastructure/oci/dynamic_groups/README.md +++ b/infrastructure/oci/dynamic_groups/README.md @@ -19,7 +19,7 @@ This module creates an OCI dynamic group and an OCI identity policy, connecting ```hcl module "dynamic_groups" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dynamic_groups?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dynamic_groups?ref=v6.14.0" cluster_id = "your-cluster-id" compartment_id = "your-compartment-id" diff --git a/infrastructure/oci/oke/README.md b/infrastructure/oci/oke/README.md index 427faf305..c14c2cd48 100644 --- a/infrastructure/oci/oke/README.md +++ b/infrastructure/oci/oke/README.md @@ -21,7 +21,7 @@ The module instantiates the oracle-terraform-modules/oke/oci module to create an ```hcl module "oke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/oke?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/oke?ref=v6.14.0" api_endpoint_subnet_id = "your-api-endpoint-subnet-id" cluster_name = "your-cluster-name" diff --git a/infrastructure/oci/vcn/README.md b/infrastructure/oci/vcn/README.md index c17c68acc..b56b4ffb4 100644 --- a/infrastructure/oci/vcn/README.md +++ b/infrastructure/oci/vcn/README.md @@ -19,7 +19,7 @@ The module instantiates oci_core_subnet resources for public and private subnets ```hcl module "vcn" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/vcn?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/vcn?ref=v6.14.0" } ``` diff --git a/nullplatform/account/README.md b/nullplatform/account/README.md index dbfdd4ebf..b88beade2 100644 --- a/nullplatform/account/README.md +++ b/nullplatform/account/README.md @@ -19,7 +19,7 @@ The module iterates over the `nullplatform_accounts` input map using `for_each` ```hcl module "account" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/account?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/account?ref=v6.14.0" nullplatform_accounts = "your-nullplatform-accounts" } diff --git a/nullplatform/agent/README.md b/nullplatform/agent/README.md index 48b510c75..9f28206c7 100644 --- a/nullplatform/agent/README.md +++ b/nullplatform/agent/README.md @@ -2,73 +2,70 @@ ## Description -Deploys the Nullplatform agent to a Kubernetes cluster via a Helm release with multi-cloud provider support +Deploys the nullplatform agent to a Kubernetes cluster via a Helm chart, supporting AWS, GCP, Azure, and OCI cloud providers ## Architecture -The module renders a Helm values file using a templatefile() call that merges default configuration, cloud-specific environment variables, and extra envs into a single locals map. A helm_release resource named 'agent' deploys the 'nullplatform-agent' chart from the official Nullplatform Helm repository into the specified Kubernetes namespace, consuming the rendered values. A terraform_data resource tracks the api_key as a replace trigger, forcing pod recreation when the API key changes. Cross-provider variable validation is enforced via terraform_data preconditions that gate cloud-specific required inputs like aws_iam_role_arn and azure_* credentials before the Helm release proceeds. +The module creates a helm_release resource targeting the nullplatform-agent chart from the official nullplatform Helm repository, with chart values rendered from a templatefile into a YAML values document. A terraform_data resource tracks the api_key input and triggers helm_release replacement when the key changes, while a second terraform_data resource enforces cross-variable preconditions (e.g., aws_iam_role_arn for AWS, Azure credentials for Azure). Cloud-provider-specific configuration is merged into the agent's environment variables via locals, and an optional worker orchestration block is encoded as a second Helm values layer when the worker variable is non-null. ## Features -- Deploys nullplatform-agent Helm chart with atomic install and automatic cleanup on failure -- Configures multi-cloud provider support for AWS, GCP, Azure, and OCI with provider-specific environment variable injection -- Creates Kubernetes namespace automatically if it does not already exist -- Injects NRN-parsed organization, account, and namespace tags into the agent configuration -- Merges scope repository, extra Git repositories, and deduplicates the final agent repo list -- Forces pod recreation via terraform_data trigger when the API key is rotated -- Supports custom init scripts, image pull secrets, and additional environment variables for agent customization +- Deploys nullplatform-agent Helm chart with cloud-provider-specific environment variable injection for AWS, GCP, Azure, and OCI +- Enforces cross-variable preconditions at plan time using terraform_data lifecycle blocks for required provider credentials +- Triggers full Helm release replacement when the API key changes via a terraform_data input tracker +- Configures agent Git repository scope and extra repositories by merging and deduplicating entries into a comma-separated list +- Supports optional worker orchestration configuration including allowedRegistries, patches, idleTTL, and rules passed as a second Helm values layer +- Renders agent arguments and environment variables from a YAML template supporting tags, API key, cluster name, domain, DNS type, and ingress paths +- Supports Istio ingress with required service_template, initial_ingress_path, and blue_green_ingress_path via precondition validation ## Basic Usage ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.14.0" api_key = "your-api-key" cloud_provider = "your-cloud-provider" cluster_name = "your-cluster-name" image_tag = "your-image-tag" - nrn = "your-nrn" tags_selectors = "your-tags-selectors" } ``` -### Usage with AWS Cloud Provider +### Usage with AWS ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.14.0" api_key = "your-api-key" aws_iam_role_arn = "your-aws-iam-role-arn" # Required when cloud_provider = "aws" cloud_provider = "aws" cluster_name = "your-cluster-name" image_tag = "your-image-tag" - nrn = "your-nrn" tags_selectors = "your-tags-selectors" } ``` -### Usage with GCP Cloud Provider +### Usage with GCP ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.14.0" api_key = "your-api-key" cloud_provider = "gcp" cluster_name = "your-cluster-name" image_tag = "your-image-tag" - nrn = "your-nrn" tags_selectors = "your-tags-selectors" } ``` -### Usage with Azure Cloud Provider +### Usage with Azure ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.14.0" api_key = "your-api-key" azure_client_id = "your-azure-client-id" # Required when cloud_provider = "azure" @@ -79,25 +76,21 @@ module "agent" { cloud_provider = "azure" cluster_name = "your-cluster-name" image_tag = "your-image-tag" - nrn = "your-nrn" - private_gateway_name = "your-private-gateway-name" # Required when cloud_provider = "azure" private_hosted_zone_rg = "your-private-hosted-zone-rg" # Required when cloud_provider = "azure" - public_gateway_name = "your-public-gateway-name" # Required when cloud_provider = "azure" tags_selectors = "your-tags-selectors" } ``` -### Usage with OCI Cloud Provider +### Usage with OCI ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.14.0" api_key = "your-api-key" cloud_provider = "oci" cluster_name = "your-cluster-name" image_tag = "your-image-tag" - nrn = "your-nrn" tags_selectors = "your-tags-selectors" } ``` @@ -174,16 +167,16 @@ resource "example_resource" "this" { diff --git a/nullplatform/api_key/README.md b/nullplatform/api_key/README.md index 9fe7251c4..d8818fd54 100644 --- a/nullplatform/api_key/README.md +++ b/nullplatform/api_key/README.md @@ -21,7 +21,7 @@ The module creates a single nullplatform_api_key resource whose name, grants, an ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.14.0" type = "your-type" } @@ -31,7 +31,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.14.0" nrn = "your-nrn" # Required when type = "agent" type = "agent" @@ -42,7 +42,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.14.0" nrn = "your-nrn" # Required when type = "scope_notification" specification_slug = "your-specification-slug" # Required when type = "scope_notification" @@ -54,7 +54,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.14.0" nrn = "your-nrn" # Required when type = "service_notification" specification_slug = "your-specification-slug" # Required when type = "service_notification" @@ -66,7 +66,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.14.0" custom_grants = "your-custom-grants" # Required when type = "custom" custom_name = "your-custom-name" # Required when type = "custom" diff --git a/nullplatform/asset/docker_server/README.md b/nullplatform/asset/docker_server/README.md index 04f1f181b..9a3859d2d 100644 --- a/nullplatform/asset/docker_server/README.md +++ b/nullplatform/asset/docker_server/README.md @@ -21,7 +21,7 @@ Creates a nullplatform_provider_config resource of type 'docker-server' with enc ```hcl module "docker_server" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/docker_server?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/docker_server?ref=v6.14.0" login_server = "your-login-server" nrn = "your-nrn" diff --git a/nullplatform/asset/ecr/README.md b/nullplatform/asset/ecr/README.md index 446afbd29..c22fcc83a 100644 --- a/nullplatform/asset/ecr/README.md +++ b/nullplatform/asset/ecr/README.md @@ -21,7 +21,7 @@ The module reads the current AWS region via the aws_region data source and combi ```hcl module "ecr" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/ecr?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/ecr?ref=v6.14.0" application_role_arn = "your-application-role-arn" build_workflow_access_key_id = "your-build-workflow-access-key-id" diff --git a/nullplatform/asset/s3/README.md b/nullplatform/asset/s3/README.md index 3a3ef63c6..0d35029ee 100644 --- a/nullplatform/asset/s3/README.md +++ b/nullplatform/asset/s3/README.md @@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type s3-con ```hcl module "s3" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/s3?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/s3?ref=v6.14.0" bucket_name = "your-bucket-name" nrn = "your-nrn" diff --git a/nullplatform/base/README.md b/nullplatform/base/README.md index fc8296311..e066d04d6 100644 --- a/nullplatform/base/README.md +++ b/nullplatform/base/README.md @@ -22,7 +22,7 @@ The module first creates two kubernetes_namespace_v1 resources ('nullplatform-to ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.14.0" k8s_provider = "your-k8s-provider" np_api_key = "your-np-api-key" @@ -33,7 +33,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.14.0" k8s_provider = "eks" np_api_key = "your-np-api-key" @@ -44,7 +44,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.14.0" k8s_provider = "gke" np_api_key = "your-np-api-key" @@ -55,7 +55,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.14.0" k8s_provider = "aks" np_api_key = "your-np-api-key" @@ -66,7 +66,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.14.0" k8s_provider = "oke" np_api_key = "your-np-api-key" @@ -77,7 +77,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.14.0" k8s_provider = "aro" np_api_key = "your-np-api-key" diff --git a/nullplatform/cloud/aws/cloud/README.md b/nullplatform/cloud/aws/cloud/README.md index 2b824d878..0c87d2b01 100644 --- a/nullplatform/cloud/aws/cloud/README.md +++ b/nullplatform/cloud/aws/cloud/README.md @@ -21,7 +21,7 @@ The module uses data sources aws_caller_identity and aws_region to dynamically r ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/cloud?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/cloud?ref=v6.14.0" domain_name = "your-domain-name" hosted_private_zone_id = "your-hosted-private-zone-id" diff --git a/nullplatform/cloud/aws/vpc/README.md b/nullplatform/cloud/aws/vpc/README.md index 3757a10b2..d3f0f21ee 100644 --- a/nullplatform/cloud/aws/vpc/README.md +++ b/nullplatform/cloud/aws/vpc/README.md @@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource of type aws-ne ```hcl module "vpc" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/vpc?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/vpc?ref=v6.14.0" nrn = "your-nrn" vpc_id = "your-vpc-id" diff --git a/nullplatform/cloud/azure/cloud/README.md b/nullplatform/cloud/azure/cloud/README.md index 763fc3f4b..19a995cde 100644 --- a/nullplatform/cloud/azure/cloud/README.md +++ b/nullplatform/cloud/azure/cloud/README.md @@ -22,7 +22,7 @@ The module creates a single nullplatform_provider_config resource of type 'azure ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/azure/cloud?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/azure/cloud?ref=v6.14.0" azure_resource_group_name = "your-azure-resource-group-name" nrn = "your-nrn" diff --git a/nullplatform/cloud/gcp/cloud/README.md b/nullplatform/cloud/gcp/cloud/README.md index 44e1e7985..a6a1a67bc 100644 --- a/nullplatform/cloud/gcp/cloud/README.md +++ b/nullplatform/cloud/gcp/cloud/README.md @@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type 'googl ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/gcp/cloud?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/gcp/cloud?ref=v6.14.0" domain_name = "your-domain-name" location = "your-location" diff --git a/nullplatform/cloud/oci/cloud/README.md b/nullplatform/cloud/oci/cloud/README.md index f9d37016a..6bf4a0816 100644 --- a/nullplatform/cloud/oci/cloud/README.md +++ b/nullplatform/cloud/oci/cloud/README.md @@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type 'oci-c ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/oci/cloud?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/oci/cloud?ref=v6.14.0" account_id = "your-account-id" account_name = "your-account-name" diff --git a/nullplatform/code_repository/README.md b/nullplatform/code_repository/README.md index 1318b7862..285fe4426 100644 --- a/nullplatform/code_repository/README.md +++ b/nullplatform/code_repository/README.md @@ -22,7 +22,7 @@ The module uses local boolean flags (is_gitlab, is_github, is_azure, is_bitbucke ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.14.0" git_provider = "your-git-provider" nrn = "your-nrn" @@ -33,7 +33,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.14.0" git_provider = "github" github_installation_id = "your-github-installation-id" # Required when git_provider = "github" @@ -46,7 +46,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.14.0" git_provider = "gitlab" gitlab_access_token = "your-gitlab-access-token" # Required when git_provider = "gitlab" @@ -62,7 +62,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.14.0" azure_access_token = "your-azure-access-token" # Required when git_provider = "azure" azure_agent_pool = "your-azure-agent-pool" # Required when git_provider = "azure" @@ -76,7 +76,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.14.0" bitbucket_collaborators = "your-bitbucket-collaborators" # Required when git_provider = "bitbucket" bitbucket_installation_url = "your-bitbucket-installation-url" # Required when git_provider = "bitbucket" diff --git a/nullplatform/container_orchestration/aks/README.md b/nullplatform/container_orchestration/aks/README.md index 692502ef5..c449b3b4f 100644 --- a/nullplatform/container_orchestration/aks/README.md +++ b/nullplatform/container_orchestration/aks/README.md @@ -21,7 +21,7 @@ The module builds a local.attributes map that aggregates cluster metadata, gatew ```hcl module "aks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.14.0" cluster_name = "your-cluster-name" nrn = "your-nrn" diff --git a/nullplatform/container_orchestration/eks/README.md b/nullplatform/container_orchestration/eks/README.md index 03211ff79..34323b2f3 100644 --- a/nullplatform/container_orchestration/eks/README.md +++ b/nullplatform/container_orchestration/eks/README.md @@ -22,7 +22,7 @@ The module assembles a set of structured locals by merging optional variables in ```hcl module "eks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.14.0" cluster_name = "your-cluster-name" nrn = "your-nrn" diff --git a/nullplatform/container_orchestration/gke/README.md b/nullplatform/container_orchestration/gke/README.md index 6e6e76cc4..579f7929e 100644 --- a/nullplatform/container_orchestration/gke/README.md +++ b/nullplatform/container_orchestration/gke/README.md @@ -22,7 +22,7 @@ The module constructs a structured attributes object using locals that merge clu ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.14.0" cluster_name = "your-cluster-name" location = "your-location" diff --git a/nullplatform/container_orchestration/oke/README.md b/nullplatform/container_orchestration/oke/README.md index 70dfbfde2..e6f2283d1 100644 --- a/nullplatform/container_orchestration/oke/README.md +++ b/nullplatform/container_orchestration/oke/README.md @@ -19,7 +19,7 @@ Creates a single nullplatform_provider_config resource of type 'oke' that stores ```hcl module "oke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/oke?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/oke?ref=v6.14.0" cluster_name = "your-cluster-name" nrn = "your-nrn" diff --git a/nullplatform/dimension/README.md b/nullplatform/dimension/README.md index a6ab9ecb9..6fbd4d7e4 100644 --- a/nullplatform/dimension/README.md +++ b/nullplatform/dimension/README.md @@ -19,7 +19,7 @@ The module creates a nullplatform_dimension resource using the provided name, or ```hcl module "dimension" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension?ref=v6.14.0" name = "your-name" nrn = "your-nrn" diff --git a/nullplatform/dimension_value/README.md b/nullplatform/dimension_value/README.md index 4426cfdfa..299fa8ff6 100644 --- a/nullplatform/dimension_value/README.md +++ b/nullplatform/dimension_value/README.md @@ -19,7 +19,7 @@ The module uses a terraform_data resource to enforce mutual-exclusivity and pres ```hcl module "dimension_value" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension_value?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension_value?ref=v6.14.0" dimension_id = "your-dimension-id" name = "your-name" diff --git a/nullplatform/identity-access-control/README.md b/nullplatform/identity-access-control/README.md index a6e7bf058..acdad3f90 100644 --- a/nullplatform/identity-access-control/README.md +++ b/nullplatform/identity-access-control/README.md @@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource named identity ```hcl module "identity-access-control" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/identity-access-control?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/identity-access-control?ref=v6.14.0" attributes = "your-attributes" nrn = "your-nrn" diff --git a/nullplatform/metrics/README.md b/nullplatform/metrics/README.md index 021d43ef8..3f78bb63b 100644 --- a/nullplatform/metrics/README.md +++ b/nullplatform/metrics/README.md @@ -21,7 +21,7 @@ The module creates a single nullplatform_provider_config resource of type 'prome ```hcl module "metrics" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/metrics?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/metrics?ref=v6.14.0" nrn = "your-nrn" } diff --git a/nullplatform/packaged_service/README.md b/nullplatform/packaged_service/README.md index 7b5a0e0c1..ce8de9e72 100644 --- a/nullplatform/packaged_service/README.md +++ b/nullplatform/packaged_service/README.md @@ -17,7 +17,7 @@ spec updates / republish correctly. ```hcl module "packaged_service" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/packaged_service?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/packaged_service?ref=v6.14.0" nrn = "organization=…:account=…:namespace=…" diff --git a/nullplatform/parameter_storage_configuration/README.md b/nullplatform/parameter_storage_configuration/README.md index 8ac051e1b..ba77930ea 100644 --- a/nullplatform/parameter_storage_configuration/README.md +++ b/nullplatform/parameter_storage_configuration/README.md @@ -20,7 +20,7 @@ The module delegates entirely to a remote `scope_configuration` module sourced f ```hcl module "parameter_storage_configuration" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_configuration?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_configuration?ref=v6.14.0" attributes = "your-attributes" np_api_key = "your-np-api-key" diff --git a/nullplatform/parameter_storage_definition/README.md b/nullplatform/parameter_storage_definition/README.md index 2f7725201..300421846 100644 --- a/nullplatform/parameter_storage_definition/README.md +++ b/nullplatform/parameter_storage_definition/README.md @@ -20,7 +20,7 @@ A data.http resource fetches the raw specification template from a configurable ```hcl module "parameter_storage_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition?ref=v6.14.0" np_api_key = "your-np-api-key" nrn = "your-nrn" diff --git a/nullplatform/parameter_storage_definition_agent_association/README.md b/nullplatform/parameter_storage_definition_agent_association/README.md index c01b6e191..c019310ab 100644 --- a/nullplatform/parameter_storage_definition_agent_association/README.md +++ b/nullplatform/parameter_storage_definition_agent_association/README.md @@ -21,7 +21,7 @@ The module creates a terraform_data resource to track API key changes and a null ```hcl module "parameter_storage_definition_agent_association" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition_agent_association?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition_agent_association?ref=v6.14.0" api_key = "your-api-key" nrn = "your-nrn" diff --git a/nullplatform/scope_configuration/README.md b/nullplatform/scope_configuration/README.md index 650f393de..69501b06c 100644 --- a/nullplatform/scope_configuration/README.md +++ b/nullplatform/scope_configuration/README.md @@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource that binds a N ```hcl module "scope_configuration" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_configuration?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_configuration?ref=v6.14.0" attributes = "your-attributes" np_api_key = "your-np-api-key" diff --git a/nullplatform/scope_definition/README.md b/nullplatform/scope_definition/README.md index 56f990cab..571ed3157 100644 --- a/nullplatform/scope_definition/README.md +++ b/nullplatform/scope_definition/README.md @@ -22,7 +22,7 @@ The module fetches JSON templates via data.http resources from a configurable Gi ```hcl module "scope_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition?ref=v6.14.0" np_api_key = "your-np-api-key" nrn = "your-nrn" diff --git a/nullplatform/scope_definition_agent_association/README.md b/nullplatform/scope_definition_agent_association/README.md index 6f1f275dc..44fdac1d4 100644 --- a/nullplatform/scope_definition_agent_association/README.md +++ b/nullplatform/scope_definition_agent_association/README.md @@ -2,27 +2,27 @@ ## Description -Creates and configures a nullplatform notification channel by fetching and processing a JSON template from a remote repository using gomplate and registering it via the nullplatform provider +Creates and configures a nullplatform notification channel resource by fetching and processing a template from a remote repository, supporting both legacy git-clone exec and worker-orchestrator (package-exec) agent modes ## Architecture -The module fetches a notification channel template via the `data.http` data source from a configurable raw GitHub URL, then processes it using a `data.external` shell script that invokes gomplate with NRN, API key, and service context variables injected as environment variables. The rendered JSON is decoded in locals to extract type, source, filters, and configuration, which are passed into a `nullplatform_notification_channel` resource along with a dynamic `agent` block that conditionally injects override flags and environment variables into command data. A `terraform_data` resource tracks the API key and triggers replacement of the notification channel when it changes. +The module fetches a notification channel JSON template via the `data.http` provider from a configurable GitHub raw URL, then processes it through `data.external` using `gomplate` and `jq` to interpolate NRN, API key, and scope variables. The processed template drives a `nullplatform_notification_channel` resource with dynamic `agent` configuration blocks that conditionally wire either a legacy git-clone exec command or a worker-orchestrator package-exec command based on the `worker_orchestrator` flag. A `terraform_data` resource keyed on `api_key` triggers replacement of the notification channel whenever the API key changes. Filter expressions from the template are optionally merged with caller-supplied `extra_filters` using a MongoDB-style `$and` operator before being applied to the resource. ## Features -- Fetches notification channel templates dynamically from a configurable remote GitHub repository branch -- Processes templates with gomplate to inject NRN, API key, scope specification ID, and slug at render time -- Creates a nullplatform_notification_channel resource with dynamic agent configuration including command data and tag-based selectors -- Merges base template filters with optional extra MongoDB-style filter expressions using $and composition -- Injects NP_ACTION_CONTEXT environment variable and optional overrides CLI flag into agent command data when override mode is enabled -- Triggers automatic replacement of the notification channel resource when the API key changes via terraform_data lifecycle dependency -- Supports configurable repository URL, branch reference, and service path for flexible template sourcing +- Fetches and processes notification channel templates remotely using gomplate for variable interpolation +- Creates nullplatform_notification_channel resources with dynamic agent configuration blocks +- Supports worker-orchestrator (package-exec) mode for spawning package worker images with baked entrypoints +- Merges template base filters with caller-supplied extra_filters using MongoDB-style $and logic +- Enables custom override configurations via command-line flags when enabled_override is set +- Triggers automatic notification channel replacement when the API key changes via terraform_data +- Configures agent selectors using tag-based maps to route deployments to specific agents ## Basic Usage ```hcl module "scope_definition_agent_association" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition_agent_association?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition_agent_association?ref=v6.14.0" api_key = "your-api-key" nrn = "your-nrn" @@ -98,16 +98,16 @@ resource "example_resource" "this" { diff --git a/nullplatform/service_definition/README.md b/nullplatform/service_definition/README.md index e773f2c9d..21f7a75b3 100644 --- a/nullplatform/service_definition/README.md +++ b/nullplatform/service_definition/README.md @@ -22,7 +22,7 @@ The module uses data.http resources to fetch service-spec, action, and link JSON ```hcl module "service_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.14.0" nrn = "your-nrn" service_name = "your-service-name" diff --git a/nullplatform/service_definition_agent_association/README.md b/nullplatform/service_definition_agent_association/README.md index 3f907db7c..0325787d6 100644 --- a/nullplatform/service_definition_agent_association/README.md +++ b/nullplatform/service_definition_agent_association/README.md @@ -22,7 +22,7 @@ The module creates a terraform_data resource to track API key changes as a lifec ```hcl module "service_definition_agent_association" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition_agent_association?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition_agent_association?ref=v6.14.0" api_key = "your-api-key" repository_service_spec_repo = "your-repository-service-spec-repo" diff --git a/nullplatform/users/README.md b/nullplatform/users/README.md index a4eb1faf6..a946ff0ac 100644 --- a/nullplatform/users/README.md +++ b/nullplatform/users/README.md @@ -21,7 +21,7 @@ The module iterates over a map of user definitions using `nullplatform_user` res ```hcl module "users" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/users?ref=v6.13.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/users?ref=v6.14.0" nullplatform_users = "your-nullplatform-users" } From 552adf1376335da4b93bed3da792bb15007e64af Mon Sep 17 00:00:00 2001 From: Sebastian Correa Date: Fri, 14 Aug 2026 16:03:57 -0300 Subject: [PATCH 18/81] feat(gcp/artifact-registry): optional static service account key (#514) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * feat(gcp/artifact-registry): optional static service account key Add generate_key to create a google_service_account_key and expose it via service_account_key_base64, for Docker clients outside the cluster (e.g. a nullplatform docker-server provider config) that can't use Workload Identity. * fix(gcp/artifact-registry): pin the key output, add a rotation lever, document the exposure Review follow-ups on the static service account key. No change to the default behavior: generate_key still defaults to false and creates nothing. - The test suite did not pin which key attribute the output exposes. Swapping `private_key` for `public_key` in outputs.tf — a real, also-base64, also-computed attribute on the same resource — kept all 7 runs green while shipping a public key as the Docker password, which only fails at runtime. `key_created_when_requested` now compares the output against `private_key` directly and runs as `apply`, since both sides are computed. - `nullable = false` on `generate_key`. It was unset, so a consumer threading an optional root variable (`generate_key = var.maybe_key`) hit `Error: Null condition` at plan instead of the default. - Added `key_rotation_token`, wired to the resource's `keepers`. GCP user-managed keys never expire and there was no supported way to rotate — a consumer had to know to run `tofu apply -replace`. Left unset by default so the key stays deterministic; three tests cover unset, empty and provided. - Documented what the key costs before you enable it: the private key is stored in plaintext in state (`sensitive = true` redacts display, not state); the credential is project-scoped, so a leak can overwrite tags in every Artifact Registry repository in the project, not just this one; rotation is manual; and the key is unrecoverable after state loss because the provider only populates `private_key` on create, so the output silently becomes empty rather than erroring. - Noted that `_json_key` (as opposed to `_json_key_base64`) needs `base64decode()`. The existing GCP stack uses that form, so this was a real footgun. - Aligned the new usage example's `?ref=` with the rest of the README (v6.14.0); the 6.x merge had updated the other block and left this one behind. Mutation-tested: the `public_key` swap, inverting the `count` guard, making `keepers` unconditional, and dropping `sensitive` from the output each fail the suite now. 7 runs to 10. --------- Co-authored-by: sebas_correa Co-authored-by: Gonzalo Rojas --- .../gcp/artifact-registry/README.md | 36 ++++++++- infrastructure/gcp/artifact-registry/main.tf | 12 +++ .../gcp/artifact-registry/outputs.tf | 6 ++ .../tests/artifact_registry.tftest.hcl | 78 +++++++++++++++++++ .../gcp/artifact-registry/variables.tf | 13 ++++ 5 files changed, 144 insertions(+), 1 deletion(-) diff --git a/infrastructure/gcp/artifact-registry/README.md b/infrastructure/gcp/artifact-registry/README.md index 7d1c32f8d..72879fbc5 100644 --- a/infrastructure/gcp/artifact-registry/README.md +++ b/infrastructure/gcp/artifact-registry/README.md @@ -6,7 +6,7 @@ Creates a Google Artifact Registry repository with an associated service account ## Architecture -The module provisions a google_artifact_registry_repository resource in the specified GCP project and location. A google_service_account is created and granted roles/artifactregistry.writer permissions via google_project_iam_member to enable push/pull operations. For each entry in workload_identity_bindings, a google_service_account_iam_member resource grants roles/iam.workloadIdentityUser to the corresponding Kubernetes service account, establishing the Workload Identity federation link between GKE pods and the GCP service account. +The module provisions a google_artifact_registry_repository resource in the specified GCP project and location. A google_service_account is created and granted roles/artifactregistry.writer permissions via google_project_iam_member to enable push/pull operations. For each entry in workload_identity_bindings, a google_service_account_iam_member resource grants roles/iam.workloadIdentityUser to the corresponding Kubernetes service account, establishing the Workload Identity federation link between GKE pods and the GCP service account. When generate_key is true, a google_service_account_key is also created and its base64-encoded private key exposed via service_account_key_base64, for callers outside the cluster that can't use Workload Identity and need to authenticate as a Docker client instead. ## Features @@ -16,6 +16,7 @@ The module provisions a google_artifact_registry_repository resource in the spec - Outputs fully-qualified Docker-compatible repository URL for image push/pull operations - Supports custom labels/tags on the Artifact Registry repository - Enables multi-namespace Kubernetes service account bindings through dynamic for_each configuration +- Optionally generates a static JSON key for the service account, for non-cluster Docker clients that can't use Workload Identity ## Basic Usage @@ -29,6 +30,35 @@ module "artifact-registry" { } ``` +### Usage with a Static Docker Credential + +```hcl +module "artifact-registry" { + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/artifact-registry?ref=v6.14.0" + + location = "your-location" + project_id = "your-project-id" + repository_id = "your-repository-id" + + generate_key = true +} + +# module.artifact-registry.service_account_key_base64 is the password for a +# Docker client authenticating with username "_json_key_base64". +``` + +The output is the key exactly as the provider returns it: base64-encoded JSON. That is what the `_json_key_base64` username expects, so pass it through unchanged. Docker clients using the older `_json_key` username need the decoded form instead — wrap it in `base64decode()`. + +#### Before enabling `generate_key` + +**The key material is stored in plaintext in state.** `sensitive = true` on the output redacts CLI display, not state. Anyone who can read the state backend obtains a working credential, so `generate_key = true` requires a state bucket restricted to operators. Prefer `workload_identity_bindings` for anything running in-cluster — it needs no key at all. + +**The credential is project-scoped, not repository-scoped.** The service account holds `roles/artifactregistry.writer` on the whole project (`google_project_iam_member`), so a leaked key can push and overwrite tags in *every* Artifact Registry repository in `project_id`, not just this one. Size the blast radius accordingly; a repository-scoped grant would need `google_artifact_registry_repository_iam_member` instead. + +**Rotation is manual.** GCP user-managed service account keys do not expire. Set `key_rotation_token` to any value and change it to force a new key — that is the supported rotation path. Do not derive it from `timestamp()` or `uuid()`, which would reissue the key on every apply. + +**The key cannot be recovered after state loss.** The provider only populates `private_key` when it creates the key, so a `state rm` plus import, or a state restore, brings the attribute back empty and the output silently becomes empty rather than erroring. Recover by forcing a new key (change `key_rotation_token`, or `tofu apply -replace`) and redistributing it. + ## Using Outputs ```hcl @@ -60,12 +90,15 @@ resource "example_resource" "this" { | [google_project_iam_member.artifact_sa_role](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/project_iam_member) | resource | | [google_service_account.artifact_sa](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/service_account) | resource | | [google_service_account_iam_member.workload_identity](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/service_account_iam_member) | resource | +| [google_service_account_key.artifact_sa_key](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/service_account_key) | resource | ## Inputs | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| | [format](#input\_format) | The format (DOCKER, NPM, PYTHON, etc) | `string` | `"DOCKER"` | no | +| [generate\_key](#input\_generate\_key) | Generate a static JSON key for the Artifact Registry service account, exposed via the service\_account\_key\_base64 output. Only needed for callers outside the cluster (e.g. an external system authenticating as a Docker registry client) that can't use Workload Identity. Leave false when every consumer runs in-cluster. Note that the key material is stored in plaintext in Terraform/OpenTofu state, and the service account holds roles/artifactregistry.writer at PROJECT scope. | `bool` | `false` | no | +| [key\_rotation\_token](#input\_key\_rotation\_token) | Arbitrary value wired to the service account key's keepers. Changing it forces a new key to be issued, which is the supported way to rotate: GCP user-managed keys do not expire on their own. Leave null to never rotate. Do not derive this from timestamp() or uuid() — the key would be reissued on every apply | `string` | `null` | no | | [location](#input\_location) | The location for the repository | `string` | n/a | yes | | [project\_id](#input\_project\_id) | The GCP project ID | `string` | n/a | yes | | [repository\_id](#input\_repository\_id) | The repository ID (name) | `string` | n/a | yes | @@ -79,6 +112,7 @@ resource "example_resource" "this" { | [repository\_id](#output\_repository\_id) | The Artifact Registry repository ID | | [repository\_url](#output\_repository\_url) | The fully-qualified Docker-compatible URL of the Artifact Registry repository | | [service\_account\_email](#output\_service\_account\_email) | GCP Service Account email. Annotate the Kubernetes ServiceAccount bound via workload\_identity\_bindings with iam.gke.io/gcp-service-account= to impersonate this account from pods. | +| [service\_account\_key\_base64](#output\_service\_account\_key\_base64) | Base64-encoded JSON key for the Artifact Registry service account, for Docker clients that authenticate with username '\_json\_key\_base64' and this value as the password. Null unless generate\_key is true. | diff --git a/infrastructure/gcp/cloud-dns/README.md b/infrastructure/gcp/cloud-dns/README.md index 9b826908b..775e97536 100644 --- a/infrastructure/gcp/cloud-dns/README.md +++ b/infrastructure/gcp/cloud-dns/README.md @@ -21,7 +21,7 @@ The module creates a single google_dns_managed_zone resource in the specified GC ```hcl module "cloud-dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-dns?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-dns?ref=v6.15.0" domain_name = "your-domain-name" project_id = "your-project-id" diff --git a/infrastructure/gcp/cloud-nat/README.md b/infrastructure/gcp/cloud-nat/README.md index 3e653767c..57e310db8 100644 --- a/infrastructure/gcp/cloud-nat/README.md +++ b/infrastructure/gcp/cloud-nat/README.md @@ -19,7 +19,7 @@ This module creates a google_compute_router resource in a specified region and n ```hcl module "cloud-nat" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-nat?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-nat?ref=v6.15.0" nat_name = "your-nat-name" network_id = "your-network-id" diff --git a/infrastructure/gcp/gke/README.md b/infrastructure/gcp/gke/README.md index 798cf4df9..7a28cd663 100644 --- a/infrastructure/gcp/gke/README.md +++ b/infrastructure/gcp/gke/README.md @@ -20,7 +20,7 @@ The module uses the google-modules/kubernetes-engine/google//modules/private-clu ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.15.0" cluster_name = "your-cluster-name" ip_range_pods = "your-ip-range-pods" diff --git a/infrastructure/gcp/iam/README.md b/infrastructure/gcp/iam/README.md index 3bb3b5bb7..fec8ef1ca 100644 --- a/infrastructure/gcp/iam/README.md +++ b/infrastructure/gcp/iam/README.md @@ -19,7 +19,7 @@ The module creates google_service_account resources for each service account spe ```hcl module "iam" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/iam?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/iam?ref=v6.15.0" project_id = "your-project-id" } diff --git a/infrastructure/gcp/security/README.md b/infrastructure/gcp/security/README.md index f3be9a89f..d83159bc9 100644 --- a/infrastructure/gcp/security/README.md +++ b/infrastructure/gcp/security/README.md @@ -21,7 +21,7 @@ The module uses data sources google_container_cluster and google_compute_subnetw ```hcl module "security" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/security?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/security?ref=v6.15.0" cluster_name = "your-cluster-name" gcp_project_id = "your-gcp-project-id" diff --git a/infrastructure/gcp/vpc/README.md b/infrastructure/gcp/vpc/README.md index d72e8f874..a6a90b89c 100644 --- a/infrastructure/gcp/vpc/README.md +++ b/infrastructure/gcp/vpc/README.md @@ -20,7 +20,7 @@ The module invokes the terraform-google-modules/network/google module to create ```hcl module "vpc" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/vpc?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/vpc?ref=v6.15.0" network_name = "your-network-name" project_id = "your-project-id" diff --git a/infrastructure/oci/backend/README.md b/infrastructure/oci/backend/README.md index 3755429d3..1827beea2 100644 --- a/infrastructure/oci/backend/README.md +++ b/infrastructure/oci/backend/README.md @@ -18,7 +18,7 @@ The module creates an oci_objectstorage_bucket resource, which is configured wit ```hcl module "backend" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/backend?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/backend?ref=v6.15.0" compartment_id = "your-compartment-id" namespace = "your-namespace" diff --git a/infrastructure/oci/dns/README.md b/infrastructure/oci/dns/README.md index 4743d13e2..643dc606d 100644 --- a/infrastructure/oci/dns/README.md +++ b/infrastructure/oci/dns/README.md @@ -18,7 +18,7 @@ This module creates oci_dns_zone resources for each DNS zone defined in the dns_ ```hcl module "dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dns?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dns?ref=v6.15.0" compartment_id = "your-compartment-id" } diff --git a/infrastructure/oci/dynamic_groups/README.md b/infrastructure/oci/dynamic_groups/README.md index ea17d2da9..87af68428 100644 --- a/infrastructure/oci/dynamic_groups/README.md +++ b/infrastructure/oci/dynamic_groups/README.md @@ -19,7 +19,7 @@ This module creates an OCI dynamic group and an OCI identity policy, connecting ```hcl module "dynamic_groups" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dynamic_groups?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dynamic_groups?ref=v6.15.0" cluster_id = "your-cluster-id" compartment_id = "your-compartment-id" diff --git a/infrastructure/oci/oke/README.md b/infrastructure/oci/oke/README.md index c14c2cd48..4144c7c08 100644 --- a/infrastructure/oci/oke/README.md +++ b/infrastructure/oci/oke/README.md @@ -21,7 +21,7 @@ The module instantiates the oracle-terraform-modules/oke/oci module to create an ```hcl module "oke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/oke?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/oke?ref=v6.15.0" api_endpoint_subnet_id = "your-api-endpoint-subnet-id" cluster_name = "your-cluster-name" diff --git a/infrastructure/oci/vcn/README.md b/infrastructure/oci/vcn/README.md index b56b4ffb4..c5269fa2e 100644 --- a/infrastructure/oci/vcn/README.md +++ b/infrastructure/oci/vcn/README.md @@ -19,7 +19,7 @@ The module instantiates oci_core_subnet resources for public and private subnets ```hcl module "vcn" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/vcn?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/vcn?ref=v6.15.0" } ``` diff --git a/nullplatform/account/README.md b/nullplatform/account/README.md index b88beade2..d589cda60 100644 --- a/nullplatform/account/README.md +++ b/nullplatform/account/README.md @@ -19,7 +19,7 @@ The module iterates over the `nullplatform_accounts` input map using `for_each` ```hcl module "account" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/account?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/account?ref=v6.15.0" nullplatform_accounts = "your-nullplatform-accounts" } diff --git a/nullplatform/agent/README.md b/nullplatform/agent/README.md index 9f28206c7..9b02d4153 100644 --- a/nullplatform/agent/README.md +++ b/nullplatform/agent/README.md @@ -22,7 +22,7 @@ The module creates a helm_release resource targeting the nullplatform-agent char ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.15.0" api_key = "your-api-key" cloud_provider = "your-cloud-provider" @@ -36,7 +36,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.15.0" api_key = "your-api-key" aws_iam_role_arn = "your-aws-iam-role-arn" # Required when cloud_provider = "aws" @@ -51,7 +51,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.15.0" api_key = "your-api-key" cloud_provider = "gcp" @@ -65,7 +65,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.15.0" api_key = "your-api-key" azure_client_id = "your-azure-client-id" # Required when cloud_provider = "azure" @@ -85,7 +85,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.15.0" api_key = "your-api-key" cloud_provider = "oci" diff --git a/nullplatform/api_key/README.md b/nullplatform/api_key/README.md index d8818fd54..c49fe1dde 100644 --- a/nullplatform/api_key/README.md +++ b/nullplatform/api_key/README.md @@ -21,7 +21,7 @@ The module creates a single nullplatform_api_key resource whose name, grants, an ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.15.0" type = "your-type" } @@ -31,7 +31,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.15.0" nrn = "your-nrn" # Required when type = "agent" type = "agent" @@ -42,7 +42,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.15.0" nrn = "your-nrn" # Required when type = "scope_notification" specification_slug = "your-specification-slug" # Required when type = "scope_notification" @@ -54,7 +54,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.15.0" nrn = "your-nrn" # Required when type = "service_notification" specification_slug = "your-specification-slug" # Required when type = "service_notification" @@ -66,7 +66,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.15.0" custom_grants = "your-custom-grants" # Required when type = "custom" custom_name = "your-custom-name" # Required when type = "custom" diff --git a/nullplatform/asset/docker_server/README.md b/nullplatform/asset/docker_server/README.md index 9a3859d2d..5bf447468 100644 --- a/nullplatform/asset/docker_server/README.md +++ b/nullplatform/asset/docker_server/README.md @@ -21,7 +21,7 @@ Creates a nullplatform_provider_config resource of type 'docker-server' with enc ```hcl module "docker_server" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/docker_server?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/docker_server?ref=v6.15.0" login_server = "your-login-server" nrn = "your-nrn" diff --git a/nullplatform/asset/ecr/README.md b/nullplatform/asset/ecr/README.md index c22fcc83a..c60233594 100644 --- a/nullplatform/asset/ecr/README.md +++ b/nullplatform/asset/ecr/README.md @@ -21,7 +21,7 @@ The module reads the current AWS region via the aws_region data source and combi ```hcl module "ecr" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/ecr?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/ecr?ref=v6.15.0" application_role_arn = "your-application-role-arn" build_workflow_access_key_id = "your-build-workflow-access-key-id" diff --git a/nullplatform/asset/s3/README.md b/nullplatform/asset/s3/README.md index 0d35029ee..191e66f8a 100644 --- a/nullplatform/asset/s3/README.md +++ b/nullplatform/asset/s3/README.md @@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type s3-con ```hcl module "s3" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/s3?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/s3?ref=v6.15.0" bucket_name = "your-bucket-name" nrn = "your-nrn" diff --git a/nullplatform/base/README.md b/nullplatform/base/README.md index e066d04d6..3312d9401 100644 --- a/nullplatform/base/README.md +++ b/nullplatform/base/README.md @@ -22,7 +22,7 @@ The module first creates two kubernetes_namespace_v1 resources ('nullplatform-to ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.15.0" k8s_provider = "your-k8s-provider" np_api_key = "your-np-api-key" @@ -33,7 +33,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.15.0" k8s_provider = "eks" np_api_key = "your-np-api-key" @@ -44,7 +44,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.15.0" k8s_provider = "gke" np_api_key = "your-np-api-key" @@ -55,7 +55,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.15.0" k8s_provider = "aks" np_api_key = "your-np-api-key" @@ -66,7 +66,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.15.0" k8s_provider = "oke" np_api_key = "your-np-api-key" @@ -77,7 +77,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.15.0" k8s_provider = "aro" np_api_key = "your-np-api-key" diff --git a/nullplatform/cloud/aws/cloud/README.md b/nullplatform/cloud/aws/cloud/README.md index 0c87d2b01..104c69cf8 100644 --- a/nullplatform/cloud/aws/cloud/README.md +++ b/nullplatform/cloud/aws/cloud/README.md @@ -21,7 +21,7 @@ The module uses data sources aws_caller_identity and aws_region to dynamically r ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/cloud?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/cloud?ref=v6.15.0" domain_name = "your-domain-name" hosted_private_zone_id = "your-hosted-private-zone-id" diff --git a/nullplatform/cloud/aws/vpc/README.md b/nullplatform/cloud/aws/vpc/README.md index d3f0f21ee..f1ffde4ba 100644 --- a/nullplatform/cloud/aws/vpc/README.md +++ b/nullplatform/cloud/aws/vpc/README.md @@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource of type aws-ne ```hcl module "vpc" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/vpc?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/vpc?ref=v6.15.0" nrn = "your-nrn" vpc_id = "your-vpc-id" diff --git a/nullplatform/cloud/azure/cloud/README.md b/nullplatform/cloud/azure/cloud/README.md index 19a995cde..867865f77 100644 --- a/nullplatform/cloud/azure/cloud/README.md +++ b/nullplatform/cloud/azure/cloud/README.md @@ -22,7 +22,7 @@ The module creates a single nullplatform_provider_config resource of type 'azure ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/azure/cloud?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/azure/cloud?ref=v6.15.0" azure_resource_group_name = "your-azure-resource-group-name" nrn = "your-nrn" diff --git a/nullplatform/cloud/gcp/cloud/README.md b/nullplatform/cloud/gcp/cloud/README.md index a6a1a67bc..ba1a4b532 100644 --- a/nullplatform/cloud/gcp/cloud/README.md +++ b/nullplatform/cloud/gcp/cloud/README.md @@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type 'googl ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/gcp/cloud?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/gcp/cloud?ref=v6.15.0" domain_name = "your-domain-name" location = "your-location" diff --git a/nullplatform/cloud/oci/cloud/README.md b/nullplatform/cloud/oci/cloud/README.md index 6bf4a0816..f3024f162 100644 --- a/nullplatform/cloud/oci/cloud/README.md +++ b/nullplatform/cloud/oci/cloud/README.md @@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type 'oci-c ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/oci/cloud?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/oci/cloud?ref=v6.15.0" account_id = "your-account-id" account_name = "your-account-name" diff --git a/nullplatform/code_repository/README.md b/nullplatform/code_repository/README.md index 285fe4426..d367dc537 100644 --- a/nullplatform/code_repository/README.md +++ b/nullplatform/code_repository/README.md @@ -22,7 +22,7 @@ The module uses local boolean flags (is_gitlab, is_github, is_azure, is_bitbucke ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.15.0" git_provider = "your-git-provider" nrn = "your-nrn" @@ -33,7 +33,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.15.0" git_provider = "github" github_installation_id = "your-github-installation-id" # Required when git_provider = "github" @@ -46,7 +46,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.15.0" git_provider = "gitlab" gitlab_access_token = "your-gitlab-access-token" # Required when git_provider = "gitlab" @@ -62,7 +62,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.15.0" azure_access_token = "your-azure-access-token" # Required when git_provider = "azure" azure_agent_pool = "your-azure-agent-pool" # Required when git_provider = "azure" @@ -76,7 +76,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.15.0" bitbucket_collaborators = "your-bitbucket-collaborators" # Required when git_provider = "bitbucket" bitbucket_installation_url = "your-bitbucket-installation-url" # Required when git_provider = "bitbucket" diff --git a/nullplatform/container_orchestration/aks/README.md b/nullplatform/container_orchestration/aks/README.md index c449b3b4f..fc50fe3c9 100644 --- a/nullplatform/container_orchestration/aks/README.md +++ b/nullplatform/container_orchestration/aks/README.md @@ -21,7 +21,7 @@ The module builds a local.attributes map that aggregates cluster metadata, gatew ```hcl module "aks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.15.0" cluster_name = "your-cluster-name" nrn = "your-nrn" diff --git a/nullplatform/container_orchestration/eks/README.md b/nullplatform/container_orchestration/eks/README.md index 34323b2f3..5f0a3ff51 100644 --- a/nullplatform/container_orchestration/eks/README.md +++ b/nullplatform/container_orchestration/eks/README.md @@ -22,7 +22,7 @@ The module assembles a set of structured locals by merging optional variables in ```hcl module "eks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.15.0" cluster_name = "your-cluster-name" nrn = "your-nrn" diff --git a/nullplatform/container_orchestration/gke/README.md b/nullplatform/container_orchestration/gke/README.md index 579f7929e..1e93dd5b6 100644 --- a/nullplatform/container_orchestration/gke/README.md +++ b/nullplatform/container_orchestration/gke/README.md @@ -22,7 +22,7 @@ The module constructs a structured attributes object using locals that merge clu ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.15.0" cluster_name = "your-cluster-name" location = "your-location" diff --git a/nullplatform/container_orchestration/oke/README.md b/nullplatform/container_orchestration/oke/README.md index e6f2283d1..565e04899 100644 --- a/nullplatform/container_orchestration/oke/README.md +++ b/nullplatform/container_orchestration/oke/README.md @@ -19,7 +19,7 @@ Creates a single nullplatform_provider_config resource of type 'oke' that stores ```hcl module "oke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/oke?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/oke?ref=v6.15.0" cluster_name = "your-cluster-name" nrn = "your-nrn" diff --git a/nullplatform/dimension/README.md b/nullplatform/dimension/README.md index 6fbd4d7e4..3a1f69ae6 100644 --- a/nullplatform/dimension/README.md +++ b/nullplatform/dimension/README.md @@ -19,7 +19,7 @@ The module creates a nullplatform_dimension resource using the provided name, or ```hcl module "dimension" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension?ref=v6.15.0" name = "your-name" nrn = "your-nrn" diff --git a/nullplatform/dimension_value/README.md b/nullplatform/dimension_value/README.md index 299fa8ff6..d5b020993 100644 --- a/nullplatform/dimension_value/README.md +++ b/nullplatform/dimension_value/README.md @@ -19,7 +19,7 @@ The module uses a terraform_data resource to enforce mutual-exclusivity and pres ```hcl module "dimension_value" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension_value?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension_value?ref=v6.15.0" dimension_id = "your-dimension-id" name = "your-name" diff --git a/nullplatform/identity-access-control/README.md b/nullplatform/identity-access-control/README.md index acdad3f90..3db0f88a9 100644 --- a/nullplatform/identity-access-control/README.md +++ b/nullplatform/identity-access-control/README.md @@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource named identity ```hcl module "identity-access-control" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/identity-access-control?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/identity-access-control?ref=v6.15.0" attributes = "your-attributes" nrn = "your-nrn" diff --git a/nullplatform/metrics/README.md b/nullplatform/metrics/README.md index 3f78bb63b..26bf3794b 100644 --- a/nullplatform/metrics/README.md +++ b/nullplatform/metrics/README.md @@ -21,7 +21,7 @@ The module creates a single nullplatform_provider_config resource of type 'prome ```hcl module "metrics" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/metrics?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/metrics?ref=v6.15.0" nrn = "your-nrn" } diff --git a/nullplatform/packaged_service/README.md b/nullplatform/packaged_service/README.md index ce8de9e72..7f1cfe13f 100644 --- a/nullplatform/packaged_service/README.md +++ b/nullplatform/packaged_service/README.md @@ -17,7 +17,7 @@ spec updates / republish correctly. ```hcl module "packaged_service" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/packaged_service?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/packaged_service?ref=v6.15.0" nrn = "organization=…:account=…:namespace=…" diff --git a/nullplatform/parameter_storage_configuration/README.md b/nullplatform/parameter_storage_configuration/README.md index ba77930ea..13b7ac5dc 100644 --- a/nullplatform/parameter_storage_configuration/README.md +++ b/nullplatform/parameter_storage_configuration/README.md @@ -20,7 +20,7 @@ The module delegates entirely to a remote `scope_configuration` module sourced f ```hcl module "parameter_storage_configuration" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_configuration?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_configuration?ref=v6.15.0" attributes = "your-attributes" np_api_key = "your-np-api-key" diff --git a/nullplatform/parameter_storage_definition/README.md b/nullplatform/parameter_storage_definition/README.md index 300421846..cb92ad8e3 100644 --- a/nullplatform/parameter_storage_definition/README.md +++ b/nullplatform/parameter_storage_definition/README.md @@ -20,7 +20,7 @@ A data.http resource fetches the raw specification template from a configurable ```hcl module "parameter_storage_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition?ref=v6.15.0" np_api_key = "your-np-api-key" nrn = "your-nrn" diff --git a/nullplatform/parameter_storage_definition_agent_association/README.md b/nullplatform/parameter_storage_definition_agent_association/README.md index c019310ab..269cffc0f 100644 --- a/nullplatform/parameter_storage_definition_agent_association/README.md +++ b/nullplatform/parameter_storage_definition_agent_association/README.md @@ -21,7 +21,7 @@ The module creates a terraform_data resource to track API key changes and a null ```hcl module "parameter_storage_definition_agent_association" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition_agent_association?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition_agent_association?ref=v6.15.0" api_key = "your-api-key" nrn = "your-nrn" diff --git a/nullplatform/scope_configuration/README.md b/nullplatform/scope_configuration/README.md index 69501b06c..2e0f718dd 100644 --- a/nullplatform/scope_configuration/README.md +++ b/nullplatform/scope_configuration/README.md @@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource that binds a N ```hcl module "scope_configuration" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_configuration?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_configuration?ref=v6.15.0" attributes = "your-attributes" np_api_key = "your-np-api-key" diff --git a/nullplatform/scope_definition/README.md b/nullplatform/scope_definition/README.md index 571ed3157..eae970c1d 100644 --- a/nullplatform/scope_definition/README.md +++ b/nullplatform/scope_definition/README.md @@ -22,7 +22,7 @@ The module fetches JSON templates via data.http resources from a configurable Gi ```hcl module "scope_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition?ref=v6.15.0" np_api_key = "your-np-api-key" nrn = "your-nrn" diff --git a/nullplatform/scope_definition_agent_association/README.md b/nullplatform/scope_definition_agent_association/README.md index 44fdac1d4..5da92994a 100644 --- a/nullplatform/scope_definition_agent_association/README.md +++ b/nullplatform/scope_definition_agent_association/README.md @@ -22,7 +22,7 @@ The module fetches a notification channel JSON template via the `data.http` prov ```hcl module "scope_definition_agent_association" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition_agent_association?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition_agent_association?ref=v6.15.0" api_key = "your-api-key" nrn = "your-nrn" diff --git a/nullplatform/service_definition/README.md b/nullplatform/service_definition/README.md index 21f7a75b3..e3df98cd1 100644 --- a/nullplatform/service_definition/README.md +++ b/nullplatform/service_definition/README.md @@ -22,7 +22,7 @@ The module uses data.http resources to fetch service-spec, action, and link JSON ```hcl module "service_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.15.0" nrn = "your-nrn" service_name = "your-service-name" diff --git a/nullplatform/service_definition_agent_association/README.md b/nullplatform/service_definition_agent_association/README.md index 0325787d6..2ffc99f69 100644 --- a/nullplatform/service_definition_agent_association/README.md +++ b/nullplatform/service_definition_agent_association/README.md @@ -22,7 +22,7 @@ The module creates a terraform_data resource to track API key changes as a lifec ```hcl module "service_definition_agent_association" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition_agent_association?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition_agent_association?ref=v6.15.0" api_key = "your-api-key" repository_service_spec_repo = "your-repository-service-spec-repo" diff --git a/nullplatform/users/README.md b/nullplatform/users/README.md index a946ff0ac..4e89cf7c8 100644 --- a/nullplatform/users/README.md +++ b/nullplatform/users/README.md @@ -21,7 +21,7 @@ The module iterates over a map of user definitions using `nullplatform_user` res ```hcl module "users" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/users?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/users?ref=v6.15.0" nullplatform_users = "your-nullplatform-users" } From 4105184fbf2c5e8ce6cf5faa112fad05c5239684 Mon Sep 17 00:00:00 2001 From: Sebastian Correa Date: Fri, 14 Aug 2026 16:07:38 -0300 Subject: [PATCH 21/81] feat(gcp/gke): support Autopilot mode and flexible/spot node pools (#513) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * feat(gcp/gke): support Autopilot mode and flexible/spot node pools Add autopilot_enabled to switch between a standard cluster with manually managed node pools and a GKE Autopilot cluster. Widen node_pools to allow either an autoscaling min/max range or a fixed node_count, and spot or preemptible VMs per pool, with a validation guarding against setting both. Also wire the previously-unused tags variable into cluster_resource_labels on both submodules. * fix(gcp/gke): add moved block, declare google-beta, cover both modes with tests Review follow-ups. The first item is a data-loss bug on a default-config upgrade. - Adding `count` to the pre-existing `module "gke"` moves its state address from `module.gke` to `module.gke[0]`, and nothing migrated it. A consumer who bumped only the module ref, leaving `autopilot_enabled` at its default false, would get a plan that DESTROYS the live cluster, every node pool and the service account, because the old address reads as "not in configuration" — and `deletion_protection_enabled` defaults to false, so nothing blocks it. Added a `moved` block. Verified with a state-migration harness on OpenTofu 1.10.7: the old shape applied, then the new shape planned `1 to add, 1 to destroy` without the block and `0 to add, 0 to change, 0 to destroy` with it. - Declared `google-beta` in `providers.tf`. The Autopilot submodule creates its cluster with `provider = google-beta`, and provider requirements are static — `count = 0` does not suppress them — so it was being resolved unpinned and with an empty default configuration, meaning the root's credentials or impersonation never reached it. It was also resolving to a different major than `google` (6.50.0 alongside 5.45.2). Constrained to `~> 5.0` and regenerated the lock; both now resolve to 5.45.2 and a clean `init` succeeds, which it did not before this commit once the constraint was added. - `total_min_count`/`total_max_count` are now accepted per pool, because `min_count`/`max_count`/`node_count` are PER ZONE and this module always creates regional clusters — a pool asking for `node_count = 1` in a three-zone region gets three nodes, so the README's own examples understated capacity and cost by 3x. They must be set together, which is validated. Note the subtlety this required: a declared `optional(number)` with no default is present as a key holding null, and the wrapped module decides with `contains(keys(autoscaling.value), "total_min_count")`, not a null check (private-cluster/cluster.tf:558). Passing the nulls through would read as "set" for every pool and null out both the per-zone and total counts, leaving autoscaling unbounded. `local.node_pools` strips null-valued keys; a test guards it. - Exposed `node_pools_taints`. GKE adds only labels to Spot nodes in standard clusters — the `cloud.google.com/gke-spot` NoSchedule taint comes solely from node auto-provisioning, which is not this path — so the README's spot example let any pod without a nodeSelector, including nullplatform system workloads, be scheduled onto capacity that is reclaimed on 15 seconds' notice. The standard "critical workloads on on-demand only" pattern was inexpressible through this module. - README: the Architecture and Features sections claimed the module "sets up logging and monitoring", qualified as "(standard mode)". Both were backwards. Standard mode sets `logging_service = "none"` (logging DISABLED); the Autopilot submodule has no `logging_service` input at all and Autopilot cannot disable logging, so flipping the flag adds ingestion cost. Also documented that switching modes destroys the cluster, added `authorized_ip_ranges` to the Autopilot example (without it the public control-plane endpoint accepts 0.0.0.0/0), and aligned the stale `?ref=`. Tests: the module had none and was in no `tofu-test.yml` allowlist, so the green "All module tests passed" check was vacuous for this path. Added `infrastructure/gcp/gke` to `test-gcp-modules` and a 13-run suite covering both modes, the two validations, the null-stripping, and taint passthrough. The PR body said plan-level tests were impractical because the wrapped module's internal `google_compute_zones`/`google_container_engine_versions` need API-shaped responses — they are reachable with `mock_data`, plus a `mock_resource` default for `google_service_account.member`, which the provider validates. --------- Co-authored-by: sebas_correa Co-authored-by: Gonzalo Rojas --- .github/workflows/tofu-test.yml | 2 +- infrastructure/gcp/gke/.terraform.lock.hcl | 73 ++++-- infrastructure/gcp/gke/README.md | 121 ++++++++- infrastructure/gcp/gke/locals.tf | 13 + infrastructure/gcp/gke/main.tf | 55 +++- infrastructure/gcp/gke/outputs.tf | 6 +- infrastructure/gcp/gke/providers.tf | 9 + infrastructure/gcp/gke/tests/gke.tftest.hcl | 271 ++++++++++++++++++++ infrastructure/gcp/gke/variables.tf | 61 ++++- 9 files changed, 570 insertions(+), 41 deletions(-) create mode 100644 infrastructure/gcp/gke/locals.tf create mode 100644 infrastructure/gcp/gke/tests/gke.tftest.hcl diff --git a/.github/workflows/tofu-test.yml b/.github/workflows/tofu-test.yml index f15157258..3d83139e9 100644 --- a/.github/workflows/tofu-test.yml +++ b/.github/workflows/tofu-test.yml @@ -25,7 +25,7 @@ jobs: test-gcp-modules: uses: nullplatform/actions-nullplatform/.github/workflows/tofu-test.yml@main with: - modules: '["infrastructure/gcp/artifact-registry", "infrastructure/gcp/cloud-dns", "infrastructure/gcp/cloud-nat", "infrastructure/gcp/iam", "infrastructure/gcp/security", "infrastructure/gcp/vpc"]' + modules: '["infrastructure/gcp/artifact-registry", "infrastructure/gcp/cloud-dns", "infrastructure/gcp/cloud-nat", "infrastructure/gcp/gke", "infrastructure/gcp/iam", "infrastructure/gcp/security", "infrastructure/gcp/vpc"]' test-nullplatform-modules: uses: nullplatform/actions-nullplatform/.github/workflows/tofu-test.yml@main diff --git a/infrastructure/gcp/gke/.terraform.lock.hcl b/infrastructure/gcp/gke/.terraform.lock.hcl index 0640fe96c..a1d1024a2 100644 --- a/infrastructure/gcp/gke/.terraform.lock.hcl +++ b/infrastructure/gcp/gke/.terraform.lock.hcl @@ -2,20 +2,38 @@ # Manual edits may be lost in future updates. provider "registry.opentofu.org/hashicorp/google" { - version = "6.50.0" - constraints = ">= 5.0.0, >= 5.40.0, < 7.0.0" + version = "5.45.2" + constraints = "~> 5.0, >= 5.40.0, != 5.44.0, != 6.2.0, != 6.3.0, < 7.0.0" hashes = [ - "h1:MAAe4zFFdqS9M5rpmJK/vKgdb6ZMD/s/0Xd97yTDipA=", - "zh:1d4695f807d998f11fcdcfa174766287b82a8093513af857bcdad2d81c642480", - "zh:3173ac5df0294624d113812e49e2a55714aff7db617488168cecdf4168df9e29", - "zh:34d2b3d44c23bd6354fc4ab5917b302872ea1ab8de107034567f955b1717fa5b", - "zh:3a77f3cc2f3664cd5aaeeef4d044e6ec1695a079588fffec3ca03953664e5f04", - "zh:6b444e4b629ea8dc8cb112a39dde098dc5584d26d6de4177558f556a9a226696", - "zh:96545c8cd4d3a57069c5d1799eab5aedd887e16d98b5559a195f6d2c2d9bc674", - "zh:ba464caafde95ee16671d6b5ec90f053ed77a9d06c567456db6efd9160fa3165", - "zh:d876938e5b0d3f57a984d9be72467995f87fef6569968623415dc51d9f54d30b", - "zh:dfd908d873e314ab807d0abc9cfd42d2611cd06dc1b9ec719ebdbb738e8e68d6", - "zh:f9f16819a7738d564afd45fd169ba61004ec4e4e7089d2a4950cb8895be1fe1f", + "h1:YEQOp7Ou1+GtpcKyCX6Cr/mAGqKIogpi85MX51GuG4s=", + "zh:0931f08e81f220ae3132169cfa4ed8e9d8d2045f29ca914afd8ee9e3e9cf56e0", + "zh:31afa45a4c8a0fd4abff564ecff8b69a97ac1813ead61c12f5f0bf5d33cec7f1", + "zh:536979e437aad59ba41465c9398d8e3d7d3702bfe2a51d80571862d48c817959", + "zh:748e14614be32350ece4e9249e09bc1d20e54421983734ded3a0df6d6674ea71", + "zh:7c8fe641666603aad6693207c8eaac679b9be15246d77090c73a1a84326d6084", + "zh:8095a513a0662323d99c25466b5a291c80b2b0c1857c7c7a7b1159f25dbe4439", + "zh:9453db86d14611cab26dba30daf56d1cfef929918207e9e3e78b58299fc8c4fe", + "zh:adaa5df5d40060409b6b66136c0ac37b99fb35ac2cf554c584649c236a18d95b", + "zh:af2f659b4bd1f44e578f203830bdab829b5e635fcf2a59ffa7e997c16e6611ad", + "zh:b75184fe5c162821b0524fa941d6a934c452e815d82e62675bb21bbdc9046dfc", + ] +} + +provider "registry.opentofu.org/hashicorp/google-beta" { + version = "5.45.2" + constraints = "~> 5.0, >= 5.40.0, != 5.44.0, != 6.2.0, != 6.3.0, < 7.0.0" + hashes = [ + "h1:D157MMCsE8DIpK60goSgECYMsWfJb+E2ZH7bDSLSVG4=", + "zh:2df6e40591ceee7ee77d429ea072c9d51fef2dd04015b2604ff332a2af4ac819", + "zh:4096af21991ba76ab81c8cb00c0eb0bd4f22619f7e491d60023fb10b8b33bfb1", + "zh:44ded286956fff5668f1acbf152b62ca8e6a03abc8df12c5c181bc2ca05b4df7", + "zh:7ae19e1b53a0e26bea0acb9a96b4b44038d7c182c3fdd496148fd20e40aa78e1", + "zh:81c9812823b78fd1b12bc0acd6dae35bc573944950e09eaf237b2e83b6b587d7", + "zh:9db6101421b53b9533807928c651e779f5b8129f4a57ff892bf256c84ba6ed29", + "zh:b779729cb08829f621a718ecdfdb503c310ef5411e694996c7cfda7227221134", + "zh:c43edb31aee354317a6181272a961965b93722fd18637f38c395af013aa65617", + "zh:dbb93970a85f2fe84f650b6a4da694ecb1023a99c3b9bbf6953dccd074fa49ce", + "zh:df9d13853269e98651d495571b4d58c883b4386247d0b9c5495c2e82ef721f45", ] } @@ -37,19 +55,24 @@ provider "registry.opentofu.org/hashicorp/kubernetes" { } provider "registry.opentofu.org/hashicorp/random" { - version = "3.7.2" + version = "3.9.0" constraints = ">= 2.1.0" hashes = [ - "h1:cFGCdxTlsrteTiaOV/iOQdql7eJkD3F/vtJxenkj9IE=", - "zh:2ffeb1058bd7b21a9e15a5301abb863053a2d42dffa3f6cf654a1667e10f4727", - "zh:519319ed8f4312ed76519652ad6cd9f98bc75cf4ec7990a5684c072cf5dd0a5d", - "zh:7371c2cc28c94deb9dba62fbac2685f7dde47f93019273a758dd5a2794f72919", - "zh:9b0ac4c1d8e36a86b59ced94fa517ae9b015b1d044b3455465cc6f0eab70915d", - "zh:c6336d7196f1318e1cbb120b3de8426ce43d4cacd2c75f45dba2dbdba666ce00", - "zh:c71f18b0cb5d55a103ea81e346fb56db15b144459123f1be1b0209cffc1deb4e", - "zh:d2dc49a6cac2d156e91b0506d6d756809e36bf390844a187f305094336d3e8d8", - "zh:d5b5fc881ccc41b268f952dae303501d6ec9f9d24ee11fe2fa56eed7478e15d0", - "zh:db9723eaca26d58c930e13fde221d93501529a5cd036b1f167ef8cff6f1a03cc", - "zh:fe3359f733f3ab518c6f85f3a9cd89322a7143463263f30321de0973a52d4ad8", + "h1:U8KXqGCoNI9/guYbTvzgdtVk3fRthoG0UXwm1JoEpIs=", + "zh:03f1114cc20b8913523735ab76e0f0a2b16ce13c92923a53304bf85f07fc0dbc", + "zh:105b678ee72322a3067f105d7e05e940f6143238f377f6e87ff4ec909246ac2a", + "zh:55f3bbf13ea18cbace61a706566a80f25f33fe2b1780b6f3d7b582af2a05b6d2", + "zh:63adf996db48f082f7a6351eb485e219cd88795fc71e6ec60a837263ab0d2cb1", + "zh:7e99550738a4e3cc68b8a467714b0d69371025fe95e3326d5323d026d55653e9", + "zh:8342b54af3a18a37e075eeae61be57f4de2ba71b35d95c5075d402dd2c1f289d", + "zh:83ee18e32ac9dd5fc91298554b7c4cfa4c3a1db50f4c797945637cc93c0844ae", + "zh:993ecc0adbf6bd535a59fbc9b735d8c33950e6f6eb5e621d750da9b71d65d80a", + "zh:ad722bc59d4edbf1415e827fc007c0efe6e0e9462d5568bae20b34be1058a261", + "zh:ae9448e1f87b2f9a6c5197a0e9862162ec6b137cb3a3835e11522995d8939e7c", + "zh:bc9cdd3aac784f759125c6627f6f6416e8726a1c184eb9cf3e55b9edbc94c627", + "zh:c8e35b89572ba1c40a9b20022e033a3395fb8d42e7604d50c900f193ba10382e", + "zh:e2deaa8a9975ef81d9f62baed12c41286918b0a10908e0e031f13f69a3b730a1", + "zh:ee39707557210a0ab1098aa357d2cdfe502e5a312d0dbdffb09d08facc4d3fc5", + "zh:f81afe4eb63e8aa9e0ea71be6c990f0dc69cb360e7191c0742a991f4a5081b64", ] } diff --git a/infrastructure/gcp/gke/README.md b/infrastructure/gcp/gke/README.md index 798cf4df9..cf34010c8 100644 --- a/infrastructure/gcp/gke/README.md +++ b/infrastructure/gcp/gke/README.md @@ -2,19 +2,21 @@ ## Description -Deploys a private GKE cluster with a public endpoint and configures node pools and security defaults +Deploys a private GKE cluster with a public endpoint, either as a standard cluster with manually managed node pools or as a GKE Autopilot cluster, with configurable node pools and security defaults ## Architecture -The module uses the google-modules/kubernetes-engine/google//modules/private-cluster Terraform module to create a GKE cluster with a private endpoint and public access, and configures node pools and security defaults using variables such as node_pools, authorized_ip_ranges, and deletion_protection_enabled, the module also creates a service account with Artifact Registry access and sets up logging and monitoring +The module conditionally creates one of two mutually-exclusive submodules based on `autopilot_enabled`: `terraform-google-modules/kubernetes-engine/google//modules/private-cluster` for a standard cluster with manually managed `node_pools`, or `terraform-google-modules/kubernetes-engine/google//modules/beta-autopilot-private-cluster` for a GKE Autopilot cluster (which has no `node_pools` concept — GCP provisions and scales nodes automatically per workload). Both submodules are configured with a private endpoint and public access, `authorized_ip_ranges`, and `deletion_protection_enabled`. The standard-mode `node_pools` entries accept `autoscaling`/`min_count`/`max_count` or a fixed `node_count`, plus `spot`/`preemptible` for lower-cost VMs. The module also creates a service account with Artifact Registry access. Standard clusters set `logging_service = "none"`, so Cloud Logging is disabled; the Autopilot submodule exposes no `logging_service` input and Autopilot does not permit disabling it, so an Autopilot cluster ingests system and workload logs. Outputs are sourced from whichever of the two submodules was actually created. ## Features -- Creates GKE cluster with private endpoint and public access -- Configures node pools with machine type, min and max count, and disk size +- Creates GKE cluster with private endpoint and public access, in either standard or Autopilot mode via `autopilot_enabled` +- Configures node pools (standard mode) with machine type, disk size, and either an autoscaling min/max range or a fixed node count +- Supports spot and preemptible VMs per node pool for lower-cost, interruptible capacity, with `node_pools_taints` to keep workloads off them +- Accepts cluster-wide autoscaling bounds via `total_min_count`/`total_max_count`, since `min_count`/`max_count` are per zone - Sets up security defaults including deletion protection and authorized IP ranges - Creates service account with Artifact Registry access -- Configures logging and monitoring for the GKE cluster +- Disables Cloud Logging on standard clusters (`logging_service = "none"`); Autopilot clusters always ingest system and workload logs and cannot disable it ## Basic Usage @@ -32,6 +34,109 @@ module "gke" { } ``` +## Usage with Autopilot + +```hcl +module "gke" { + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.14.0" + + cluster_name = "your-cluster-name" + ip_range_pods = "your-ip-range-pods" + ip_range_services = "your-ip-range-services" + location = "your-location" + project_id = "your-project-id" + vpc_name = "your-vpc-name" + vpc_subnet_name = "your-vpc-subnet-name" + + autopilot_enabled = true + # node_pools is ignored in this mode — GCP provisions and scales nodes per workload. + + # Without this the public control-plane endpoint accepts 0.0.0.0/0. + authorized_ip_ranges = [{ + cidr_block = "203.0.113.0/24" + display_name = "office" + }] +} +``` + +> **Switching an existing cluster into or out of Autopilot destroys it.** The two +> modes are different submodules, so flipping `autopilot_enabled` plans a destroy +> of the live cluster and a create of the new one. `deletion_protection_enabled` +> defaults to `false`, so nothing stops it. Treat the mode as fixed for the life of +> the cluster; to migrate, stand up a second cluster and move workloads across. + +> **Autopilot clusters ingest system and workload logs.** Standard clusters here run +> with `logging_service = "none"`, but Autopilot does not allow disabling logging, so +> enabling it adds Cloud Logging ingestion cost the standard clusters never had. + +## Usage with Mixed On-Demand and Spot Node Pools + +```hcl +module "gke" { + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.14.0" + + cluster_name = "your-cluster-name" + ip_range_pods = "your-ip-range-pods" + ip_range_services = "your-ip-range-services" + location = "your-location" + project_id = "your-project-id" + vpc_name = "your-vpc-name" + vpc_subnet_name = "your-vpc-subnet-name" + + node_pools = [ + { + name = "pool-default" + machine_type = "e2-medium" + autoscaling = false + node_count = 1 + }, + { + name = "pool-spot" + machine_type = "e2-medium" + autoscaling = true + # Cluster-wide, not per zone. See the note below. + total_min_count = 0 + total_max_count = 2 + spot = true + }, + ] + + # GKE does not taint spot nodes in standard clusters, so without this any pod + # lacking a nodeSelector can be scheduled onto preemptible capacity. + node_pools_taints = { + pool-spot = [{ + key = "cloud.google.com/gke-spot" + value = "true" + effect = "NO_SCHEDULE" + }] + } +} +``` + +### Node counts are per zone + +`location` is passed to the wrapped module as `region`, so every cluster this module +creates is **regional**. `min_count`, `max_count` and `node_count` map onto per-zone +provider attributes, so the effective cluster-wide size is the value multiplied by the +number of zones in the region — three, in most regions. A pool asking for +`node_count = 1` in `us-central1` gets three nodes. + +Use `total_min_count`/`total_max_count` (set together) to express cluster-wide bounds +instead; when present they replace the per-zone pair. + +### Keeping workloads off spot capacity + +In **standard** clusters GKE adds only labels to Spot nodes +(`cloud.google.com/gke-spot=true`, `cloud.google.com/gke-provisioning=spot`) — it does +**not** add a `NoSchedule` taint. That taint is applied only to pools created by node +auto-provisioning, which is not this path. So a spot pool accepts any pod that does not +explicitly avoid it, including nullplatform system workloads, and those pods get +evicted on 15 seconds' notice when GCP reclaims the VM. + +Taint the pool via `node_pools_taints` (as above) and add a matching toleration to the +workloads you actually want on spot. Autopilot handles taints and tolerations itself, so +this does not apply in Autopilot mode. + ## Using Outputs ```hcl @@ -48,25 +153,29 @@ resource "example_resource" "this" { |------|---------| | [terraform](#requirement\_terraform) | >= 1.3 | | [google](#requirement\_google) | ~> 5.0 | +| [google-beta](#requirement\_google-beta) | ~> 5.0 | ## Modules | Name | Source | Version | |------|--------|---------| | [gke](#module\_gke) | terraform-google-modules/kubernetes-engine/google//modules/private-cluster | ~> 33.0 | +| [gke\_autopilot](#module\_gke\_autopilot) | terraform-google-modules/kubernetes-engine/google//modules/beta-autopilot-private-cluster | ~> 33.0 | ## Inputs | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| | [authorized\_ip\_ranges](#input\_authorized\_ip\_ranges) | List of authorized IP ranges allowed to access the Kubernetes API server | 
list(object({
    cidr_block   = string
    display_name = string
  }))
| `[]` | no | +| [autopilot\_enabled](#input\_autopilot\_enabled) | Create a GKE Autopilot cluster instead of a standard cluster with manually managed node pools. When true, node\_pools is ignored — Autopilot provisions and scales nodes automatically per workload. | `bool` | `false` | no | | [cluster\_name](#input\_cluster\_name) | The name of the GKE cluster | `string` | n/a | yes | | [deletion\_protection\_enabled](#input\_deletion\_protection\_enabled) | Whether to enable deletion protection for the GKE cluster | `bool` | `false` | no | | [ip\_range\_pods](#input\_ip\_range\_pods) | The name of the secondary IP range for pods | `string` | n/a | yes | | [ip\_range\_services](#input\_ip\_range\_services) | The name of the secondary IP range for services | `string` | n/a | yes | | [location](#input\_location) | The GCP region where the GKE cluster will be deployed (e.g., us-central1, europe-west1) | `string` | n/a | yes | | [master\_ipv4\_cidr\_block](#input\_master\_ipv4\_cidr\_block) | The IP range in CIDR notation for the hosted master network (e.g., 172.16.0.0/28) | `string` | `"172.16.0.0/28"` | no | -| [node\_pools](#input\_node\_pools) | List of node pools to create in the GKE cluster | 
list(object({
    name         = string
    machine_type = optional(string, "e2-medium")
    min_count    = optional(number, 1)
    max_count    = optional(number, 3)
    disk_size_gb = optional(number, 100)
  }))
| 
[
  {
    "name": "default"
  }
]
| no | +| [node\_pools](#input\_node\_pools) | List of node pools to create in the GKE cluster (ignored when autopilot\_enabled is true). min\_count, max\_count and node\_count are PER ZONE and the cluster is regional, so they are multiplied by the number of zones in the region; use total\_min\_count/total\_max\_count for cluster-wide bounds | 
list(object({
    name         = string
    machine_type = optional(string, "e2-medium")
    disk_size_gb = optional(number, 100)
    # When autoscaling is true (the default), the pool scales between
    # min_count and max_count. When false, it holds a fixed node_count.
    autoscaling = optional(bool, true)
    # PER ZONE. This module creates regional clusters (location is passed as
    # region), so the effective cluster-wide count is these values multiplied by
    # the number of zones in the region — three, in most regions. Use
    # total_min_count/total_max_count instead to express cluster-wide bounds.
    min_count = optional(number, 1)
    max_count = optional(number, 3)
    # PER ZONE, same multiplication as above. Only used when autoscaling is false.
    node_count = optional(number, 1)
    # Cluster-wide autoscaling bounds. When set, they replace the per-zone
    # min_count/max_count. Must be set together.
    total_min_count = optional(number)
    total_max_count = optional(number)
    # spot and preemptible are mutually exclusive lower-cost VM options;
    # leave both false for regular on-demand nodes. Note that GKE does NOT taint
    # spot nodes in standard clusters — it only labels them — so any pod without
    # a nodeSelector can land on preemptible capacity. Use node_pools_taints to
    # keep workloads off them.
    spot        = optional(bool, false)
    preemptible = optional(bool, false)
  }))
| 
[
  {
    "name": "default"
  }
]
| no | +| [node\_pools\_taints](#input\_node\_pools\_taints) | Node taints by node-pool name, plus an optional 'all' key applied to every pool. Needed to keep ordinary workloads off spot/preemptible pools: GKE adds only labels to Spot nodes in standard clusters, and applies the cloud.google.com/gke-spot NoSchedule taint solely through node auto-provisioning, which is not this path. Pools absent from the map get no taints | 
map(list(object({
    key    = string
    value  = string
    effect = string
  })))
| `{}` | no | | [project\_id](#input\_project\_id) | The GCP project ID | `string` | n/a | yes | | [tags](#input\_tags) | A mapping of labels to assign to the GKE cluster and related resources | `map(string)` | `{}` | no | | [vpc\_name](#input\_vpc\_name) | The name of the virtual private network | `string` | n/a | yes | diff --git a/infrastructure/gcp/gke/locals.tf b/infrastructure/gcp/gke/locals.tf new file mode 100644 index 000000000..1fb6be101 --- /dev/null +++ b/infrastructure/gcp/gke/locals.tf @@ -0,0 +1,13 @@ +locals { + # Strip null-valued attributes before handing the pools to the wrapped module. + # + # A declared `optional(...)` attribute with no default is not absent — it is + # present as a key holding null. The wrapped module decides whether the caller + # opted into cluster-wide autoscaling with `contains(keys(autoscaling.value), + # "total_min_count")` rather than a null check (private-cluster/cluster.tf:558), + # so passing the nulls through would read as "set" for every pool and null out + # both the per-zone and the total node counts, leaving autoscaling unbounded. + node_pools = [ + for pool in var.node_pools : { for k, v in pool : k => v if v != null } + ] +} diff --git a/infrastructure/gcp/gke/main.tf b/infrastructure/gcp/gke/main.tf index 92fc7a920..2b1f20341 100644 --- a/infrastructure/gcp/gke/main.tf +++ b/infrastructure/gcp/gke/main.tf @@ -1,4 +1,17 @@ +# Adding `count` to a module that shipped without one moves its state address +# from module.gke to module.gke[0]. Without this block, a consumer who only bumps +# the module ref — leaving autopilot_enabled at its default false — gets a plan +# that destroys and recreates the cluster, every node pool and the service +# account, because the old address is "not in configuration". +moved { + from = module.gke + to = module.gke[0] +} + +# Standard cluster with manually managed node pools (default mode) module "gke" { + count = var.autopilot_enabled ? 0 : 1 + source = "terraform-google-modules/kubernetes-engine/google//modules/private-cluster" version = "~> 33.0" @@ -23,10 +36,48 @@ module "gke" { master_authorized_networks = var.authorized_ip_ranges - node_pools = var.node_pools + node_pools = local.node_pools + node_pools_taints = var.node_pools_taints + + cluster_resource_labels = var.tags + + # Service account with Artifact Registry access + grant_registry_access = true + create_service_account = true + + # Cloud Logging is disabled for standard clusters. Autopilot cannot disable it, + # so an Autopilot cluster ingests system and workload logs — see the README. + logging_service = "none" +} + +# Autopilot cluster — GCP manages node provisioning/scaling per workload, +# so there is no node_pools equivalent here. +module "gke_autopilot" { + count = var.autopilot_enabled ? 1 : 0 + + source = "terraform-google-modules/kubernetes-engine/google//modules/beta-autopilot-private-cluster" + version = "~> 33.0" + + project_id = var.project_id + name = var.cluster_name + region = var.location + deletion_protection = var.deletion_protection_enabled + + network = var.vpc_name + subnetwork = var.vpc_subnet_name + ip_range_pods = var.ip_range_pods + ip_range_services = var.ip_range_services + + # Private cluster with public endpoint + enable_private_endpoint = false + enable_private_nodes = true + master_ipv4_cidr_block = var.master_ipv4_cidr_block + + master_authorized_networks = var.authorized_ip_ranges + + cluster_resource_labels = var.tags # Service account with Artifact Registry access grant_registry_access = true create_service_account = true - logging_service = "none" } diff --git a/infrastructure/gcp/gke/outputs.tf b/infrastructure/gcp/gke/outputs.tf index 19da734ec..7dd70910e 100644 --- a/infrastructure/gcp/gke/outputs.tf +++ b/infrastructure/gcp/gke/outputs.tf @@ -1,16 +1,16 @@ output "cluster_name" { description = "The name of the GKE cluster" - value = module.gke.name + value = var.autopilot_enabled ? module.gke_autopilot[0].name : module.gke[0].name } output "host" { description = "The API server endpoint" - value = module.gke.endpoint + value = var.autopilot_enabled ? module.gke_autopilot[0].endpoint : module.gke[0].endpoint sensitive = true } output "cluster_ca_certificate" { description = "The cluster CA certificate in base64" - value = module.gke.ca_certificate + value = var.autopilot_enabled ? module.gke_autopilot[0].ca_certificate : module.gke[0].ca_certificate sensitive = true } diff --git a/infrastructure/gcp/gke/providers.tf b/infrastructure/gcp/gke/providers.tf index f9740720f..41c6de4b0 100644 --- a/infrastructure/gcp/gke/providers.tf +++ b/infrastructure/gcp/gke/providers.tf @@ -6,5 +6,14 @@ terraform { source = "hashicorp/google" version = "~> 5.0" } + # The Autopilot path creates its cluster with `provider = google-beta` + # (beta-autopilot-private-cluster/cluster.tf:23). Provider requirements are + # static — count = 0 does not suppress them — so this must be declared and + # constrained to the same major as google, or a fresh init resolves an + # unpinned google-beta and the root's provider credentials never reach it. + google-beta = { + source = "hashicorp/google-beta" + version = "~> 5.0" + } } } diff --git a/infrastructure/gcp/gke/tests/gke.tftest.hcl b/infrastructure/gcp/gke/tests/gke.tftest.hcl new file mode 100644 index 000000000..9d8ee9418 --- /dev/null +++ b/infrastructure/gcp/gke/tests/gke.tftest.hcl @@ -0,0 +1,271 @@ +mock_provider "google" { + mock_resource "google_service_account" { + defaults = { + email = "mock-sa@myorg-project.iam.gserviceaccount.com" + member = "serviceAccount:mock-sa@myorg-project.iam.gserviceaccount.com" + } + } + mock_data "google_compute_zones" { + defaults = { + names = ["us-central1-a", "us-central1-b", "us-central1-c"] + } + } + mock_data "google_container_engine_versions" { + defaults = { + latest_master_version = "1.30.5-gke.1443001" + latest_node_version = "1.30.5-gke.1443001" + valid_master_versions = ["1.30.5-gke.1443001"] + valid_node_versions = ["1.30.5-gke.1443001"] + } + } +} +mock_provider "google-beta" { + mock_resource "google_service_account" { + defaults = { + email = "mock-sa@myorg-project.iam.gserviceaccount.com" + member = "serviceAccount:mock-sa@myorg-project.iam.gserviceaccount.com" + } + } + mock_data "google_compute_zones" { + defaults = { + names = ["us-central1-a", "us-central1-b", "us-central1-c"] + } + } + mock_data "google_container_engine_versions" { + defaults = { + latest_master_version = "1.30.5-gke.1443001" + latest_node_version = "1.30.5-gke.1443001" + } + } +} +mock_provider "kubernetes" {} + +variables { + project_id = "myorg-project" + cluster_name = "myorg-gke" + location = "us-central1" + vpc_name = "myorg-vpc" + vpc_subnet_name = "myorg-subnet" + ip_range_pods = "pods" + ip_range_services = "services" +} + +############################################################################### +# Mode selection +############################################################################### + +run "standard_mode_by_default" { + command = plan + + assert { + condition = length(module.gke) == 1 && length(module.gke_autopilot) == 0 + error_message = "autopilot_enabled defaults to false, so only the standard cluster should be planned" + } +} + +run "autopilot_mode_selects_the_other_module" { + command = plan + + variables { + autopilot_enabled = true + } + + assert { + condition = length(module.gke) == 0 && length(module.gke_autopilot) == 1 + error_message = "autopilot_enabled should plan the Autopilot cluster and nothing else" + } +} + +############################################################################### +# node_pools: null stripping +# +# The wrapped module decides whether the caller opted into cluster-wide +# autoscaling with contains(keys(...)), not a null check, so a declared-but-unset +# optional attribute must not reach it. +############################################################################### + +run "unset_total_counts_do_not_reach_the_wrapped_module" { + command = plan + + assert { + condition = !contains(keys(local.node_pools[0]), "total_min_count") + error_message = "An unset total_min_count must be stripped: the wrapped module reads contains(keys(...)) and would null out the per-zone autoscaling bounds for every pool" + } + + assert { + condition = !contains(keys(local.node_pools[0]), "total_max_count") + error_message = "An unset total_max_count must be stripped for the same reason" + } + + assert { + condition = local.node_pools[0]["min_count"] == 1 + error_message = "Attributes that do have a default must survive the stripping" + } +} + +run "set_total_counts_do_reach_the_wrapped_module" { + command = plan + + variables { + node_pools = [{ + name = "pool-wide" + total_min_count = 3 + total_max_count = 9 + }] + } + + assert { + condition = local.node_pools[0]["total_min_count"] == 3 && local.node_pools[0]["total_max_count"] == 9 + error_message = "Explicit total counts must be passed through" + } +} + +run "total_counts_must_be_set_together" { + command = plan + + variables { + node_pools = [{ + name = "pool-half" + total_min_count = 3 + }] + } + + expect_failures = [var.node_pools] +} + +############################################################################### +# node_pools: spot and preemptible +############################################################################### + +run "spot_and_preemptible_together_is_rejected" { + command = plan + + variables { + node_pools = [{ + name = "pool-both" + spot = true + preemptible = true + }] + } + + expect_failures = [var.node_pools] +} + +run "spot_alone_is_accepted" { + command = plan + + variables { + node_pools = [{ + name = "pool-spot" + spot = true + }] + } + + assert { + condition = local.node_pools[0]["spot"] == true + error_message = "A pool may set spot on its own" + } +} + +run "preemptible_alone_is_accepted" { + command = plan + + variables { + node_pools = [{ + name = "pool-preempt" + preemptible = true + }] + } + + assert { + condition = local.node_pools[0]["preemptible"] == true + error_message = "A pool may set preemptible on its own" + } +} + +run "mixed_on_demand_and_spot_pools_plan" { + command = plan + + variables { + node_pools = [ + { + name = "pool-default" + node_count = 1 + autoscaling = false + }, + { + name = "pool-spot" + spot = true + min_count = 0 + max_count = 2 + }, + ] + } + + assert { + condition = length(local.node_pools) == 2 + error_message = "Both pools should be passed through" + } +} + +############################################################################### +# node_pools_taints +############################################################################### + +run "no_taints_by_default" { + command = plan + + assert { + condition = length(var.node_pools_taints) == 0 + error_message = "node_pools_taints should default to empty so existing pools are untouched" + } +} + +run "spot_pool_can_be_tainted" { + command = plan + + variables { + node_pools = [{ + name = "pool-spot" + spot = true + }] + node_pools_taints = { + pool-spot = [{ + key = "cloud.google.com/gke-spot" + value = "true" + effect = "NO_SCHEDULE" + }] + } + } + + assert { + condition = var.node_pools_taints["pool-spot"][0].effect == "NO_SCHEDULE" + error_message = "Taints must be expressible per pool, so workloads can be kept off preemptible capacity" + } +} + +############################################################################### +# Outputs resolve in both modes +############################################################################### + +run "outputs_resolve_in_standard_mode" { + command = apply + + assert { + condition = output.cluster_name != null && output.cluster_name != "" + error_message = "cluster_name must resolve from the standard module when autopilot is off, not index a zero-count module" + } +} + +run "outputs_resolve_in_autopilot_mode" { + command = apply + + variables { + autopilot_enabled = true + } + + assert { + condition = output.cluster_name != null && output.cluster_name != "" + error_message = "cluster_name must resolve from the Autopilot module when autopilot is on, not index a zero-count module" + } +} diff --git a/infrastructure/gcp/gke/variables.tf b/infrastructure/gcp/gke/variables.tf index b5bd3cfdb..0e3fe49d4 100644 --- a/infrastructure/gcp/gke/variables.tf +++ b/infrastructure/gcp/gke/variables.tf @@ -38,21 +38,74 @@ variable "ip_range_services" { } ############################################################################### -# OPTIONAL VARIABLES - NODE POOLS +# OPTIONAL VARIABLES - AUTOPILOT +############################################################################### + +variable "autopilot_enabled" { + type = bool + description = "Create a GKE Autopilot cluster instead of a standard cluster with manually managed node pools. When true, node_pools is ignored — Autopilot provisions and scales nodes automatically per workload." + default = false +} + +############################################################################### +# OPTIONAL VARIABLES - NODE POOLS (ignored when autopilot_enabled is true) ############################################################################### variable "node_pools" { type = list(object({ name = string machine_type = optional(string, "e2-medium") - min_count = optional(number, 1) - max_count = optional(number, 3) disk_size_gb = optional(number, 100) + # When autoscaling is true (the default), the pool scales between + # min_count and max_count. When false, it holds a fixed node_count. + autoscaling = optional(bool, true) + # PER ZONE. This module creates regional clusters (location is passed as + # region), so the effective cluster-wide count is these values multiplied by + # the number of zones in the region — three, in most regions. Use + # total_min_count/total_max_count instead to express cluster-wide bounds. + min_count = optional(number, 1) + max_count = optional(number, 3) + # PER ZONE, same multiplication as above. Only used when autoscaling is false. + node_count = optional(number, 1) + # Cluster-wide autoscaling bounds. When set, they replace the per-zone + # min_count/max_count. Must be set together. + total_min_count = optional(number) + total_max_count = optional(number) + # spot and preemptible are mutually exclusive lower-cost VM options; + # leave both false for regular on-demand nodes. Note that GKE does NOT taint + # spot nodes in standard clusters — it only labels them — so any pod without + # a nodeSelector can land on preemptible capacity. Use node_pools_taints to + # keep workloads off them. + spot = optional(bool, false) + preemptible = optional(bool, false) })) - description = "List of node pools to create in the GKE cluster" + description = "List of node pools to create in the GKE cluster (ignored when autopilot_enabled is true). min_count, max_count and node_count are PER ZONE and the cluster is regional, so they are multiplied by the number of zones in the region; use total_min_count/total_max_count for cluster-wide bounds" default = [{ name = "default" }] + + validation { + condition = alltrue([for pool in var.node_pools : !(pool.spot && pool.preemptible)]) + error_message = "Each node pool must not set both spot and preemptible to true — they are mutually exclusive lower-cost VM options." + } + + validation { + condition = alltrue([ + for pool in var.node_pools : + (pool.total_min_count == null) == (pool.total_max_count == null) + ]) + error_message = "total_min_count and total_max_count must be set together: setting only one leaves the other bound per-zone, which silently mixes the two scales." + } +} + +variable "node_pools_taints" { + type = map(list(object({ + key = string + value = string + effect = string + }))) + description = "Node taints by node-pool name, plus an optional 'all' key applied to every pool. Needed to keep ordinary workloads off spot/preemptible pools: GKE adds only labels to Spot nodes in standard clusters, and applies the cloud.google.com/gke-spot NoSchedule taint solely through node auto-provisioning, which is not this path. Pools absent from the map get no taints" + default = {} } variable "authorized_ip_ranges" { From c15e1954f85a2abee3696ebcf75f224a4cd8fe88 Mon Sep 17 00:00:00 2001 From: Sebastian Correa Date: Fri, 14 Aug 2026 16:30:50 -0300 Subject: [PATCH 22/81] feat(gcp/backend): add GCS terraform state bucket module (#511) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * feat(gcp/backend): add module for GCS terraform state bucket Fills a gap in the GCP module set: infrastructure/aws/backend and infrastructure/oci/backend both have a state-bucket module, but there was no GCP equivalent. Creates a google_storage_bucket with a random suffix (bucket names must be globally unique across GCP), versioning and uniform bucket-level access enabled by default, force_destroy defaulted to false to protect state, optional customer-managed encryption via an existing KMS key, and optional IAM member restrictions via roles/storage.objectAdmin bindings. Co-Authored-By: Claude Sonnet 5 * docs(gcp/backend): fix usage example version ref to match the 6.x line Was v7.0.0 (from when this branch was based on main); this branch is now based on 6.x, whose current release is v6.11.3. Co-Authored-By: Claude Sonnet 5 * fix(gcp/backend): validate inputs, lowercase the prefix, cover the security defaults Review follow-ups on the new module. All plan-time correctness, no change to the resource surface except two optional additions. - `lower()` wrapped `random_id.bucket_suffix.hex`, which is already lowercase by construction, instead of `bucket_prefix`. An uppercase prefix planned clean and failed at apply with an invalid GCS bucket name. - `kms_key_name = ""` still emitted an `encryption` block with an empty key instead of falling back to Google-managed encryption as documented. An empty string reaches the module whenever the value is wired from another module's output or a TF_VAR. - No validation on `bucket_prefix` (a prefix over 46 chars pushed the name past the GCS 63-char limit; illegal characters and the reserved `goog`/`google` names passed), `storage_class`, or `public_access_prevention` (`"enforce"` planned fine and failed at apply, leaving the operator believing PAP was set). - `allowed_members` was documented as restricting bucket access. `google_storage_bucket_iam_member` is additive: every project-level `roles/editor` or `roles/storage.admin` holder keeps full read on state. The resource choice is correct — `_iam_binding` would be authoritative and wipe unmanaged bindings — so the docs were the defect. - Added optional `log_bucket` for access logging, so reads of state objects leave an audit trail. Closes the Trivy GCP-0077 finding on this module. - `nullable = false` on every input with a non-null default, so an explicit `null` cannot bypass the default. - Renamed `labels` to `tags`, matching gke, artifact-registry and cloud-dns. Free to do while the module is unreleased. Tests: 10 runs to 26, and the suite now has teeth. The security defaults were untested — deleting `uniform_bucket_level_access` from main.tf kept all 10 runs green, and the provider default is false. Every new assertion was mutation-tested: reverting each fix above, dropping either validation, and flipping the `public_access_prevention` and `versioning_enabled` defaults each fail the suite. Docs: added a bootstrap section (the name embeds a random suffix, so it cannot feed a `backend "gcs"` block directly), the CMEK service-agent grant prerequisite this module does not create, the versioning/secret-retention caveat, and the fact that changing `bucket_prefix` replaces the bucket. Regenerated the terraform-docs block, which also picks up the pinned provider versions the committed lock file implies — matching artifact-registry and cloud-dns. * docs(gcp/backend): explain why Trivy still flags logging and CMEK Corrects the record: the previous commit claimed adding the optional `log_bucket` closes the Trivy GCP-0077 finding. It does not. Trivy evaluates the static configuration with default variable values, and both `log_bucket` and `kms_key_name` default to null, so the `dynamic` blocks produce nothing and the scanner correctly sees a bucket with neither logging nor CMEK. GCP-0077 and GCP-0066 are still reported on this module. Documented rather than suppressed. The repo's .trivyignore is a flat ID list with no path scoping, so adding GCP-0077 would silence bucket-logging findings for every module including infrastructure/aws/backend. Making either control mandatory is not an option either: each needs a resource this module does not create (an existing log bucket, an existing KMS key). --------- Co-authored-by: sebas_correa Co-authored-by: Claude Sonnet 5 Co-authored-by: Gonzalo Rojas --- .../gcp/backend/.terraform.lock.hcl | 43 +++ infrastructure/gcp/backend/README.md | 118 +++++++ infrastructure/gcp/backend/main.tf | 45 +++ infrastructure/gcp/backend/outputs.tf | 19 ++ .../gcp/backend/tests/backend.tftest.hcl | 313 ++++++++++++++++++ infrastructure/gcp/backend/variables.tf | 111 +++++++ infrastructure/gcp/backend/versions.tf | 14 + 7 files changed, 663 insertions(+) create mode 100644 infrastructure/gcp/backend/.terraform.lock.hcl create mode 100644 infrastructure/gcp/backend/README.md create mode 100644 infrastructure/gcp/backend/main.tf create mode 100644 infrastructure/gcp/backend/outputs.tf create mode 100644 infrastructure/gcp/backend/tests/backend.tftest.hcl create mode 100644 infrastructure/gcp/backend/variables.tf create mode 100644 infrastructure/gcp/backend/versions.tf diff --git a/infrastructure/gcp/backend/.terraform.lock.hcl b/infrastructure/gcp/backend/.terraform.lock.hcl new file mode 100644 index 000000000..800175d7f --- /dev/null +++ b/infrastructure/gcp/backend/.terraform.lock.hcl @@ -0,0 +1,43 @@ +# This file is maintained automatically by "tofu init". +# Manual edits may be lost in future updates. + +provider "registry.opentofu.org/hashicorp/google" { + version = "6.50.0" + constraints = ">= 5.0.0, < 7.0.0" + hashes = [ + "h1:MAAe4zFFdqS9M5rpmJK/vKgdb6ZMD/s/0Xd97yTDipA=", + "zh:1d4695f807d998f11fcdcfa174766287b82a8093513af857bcdad2d81c642480", + "zh:3173ac5df0294624d113812e49e2a55714aff7db617488168cecdf4168df9e29", + "zh:34d2b3d44c23bd6354fc4ab5917b302872ea1ab8de107034567f955b1717fa5b", + "zh:3a77f3cc2f3664cd5aaeeef4d044e6ec1695a079588fffec3ca03953664e5f04", + "zh:6b444e4b629ea8dc8cb112a39dde098dc5584d26d6de4177558f556a9a226696", + "zh:96545c8cd4d3a57069c5d1799eab5aedd887e16d98b5559a195f6d2c2d9bc674", + "zh:ba464caafde95ee16671d6b5ec90f053ed77a9d06c567456db6efd9160fa3165", + "zh:d876938e5b0d3f57a984d9be72467995f87fef6569968623415dc51d9f54d30b", + "zh:dfd908d873e314ab807d0abc9cfd42d2611cd06dc1b9ec719ebdbb738e8e68d6", + "zh:f9f16819a7738d564afd45fd169ba61004ec4e4e7089d2a4950cb8895be1fe1f", + ] +} + +provider "registry.opentofu.org/hashicorp/random" { + version = "3.9.0" + constraints = ">= 3.0.0" + hashes = [ + "h1:U8KXqGCoNI9/guYbTvzgdtVk3fRthoG0UXwm1JoEpIs=", + "zh:03f1114cc20b8913523735ab76e0f0a2b16ce13c92923a53304bf85f07fc0dbc", + "zh:105b678ee72322a3067f105d7e05e940f6143238f377f6e87ff4ec909246ac2a", + "zh:55f3bbf13ea18cbace61a706566a80f25f33fe2b1780b6f3d7b582af2a05b6d2", + "zh:63adf996db48f082f7a6351eb485e219cd88795fc71e6ec60a837263ab0d2cb1", + "zh:7e99550738a4e3cc68b8a467714b0d69371025fe95e3326d5323d026d55653e9", + "zh:8342b54af3a18a37e075eeae61be57f4de2ba71b35d95c5075d402dd2c1f289d", + "zh:83ee18e32ac9dd5fc91298554b7c4cfa4c3a1db50f4c797945637cc93c0844ae", + "zh:993ecc0adbf6bd535a59fbc9b735d8c33950e6f6eb5e621d750da9b71d65d80a", + "zh:ad722bc59d4edbf1415e827fc007c0efe6e0e9462d5568bae20b34be1058a261", + "zh:ae9448e1f87b2f9a6c5197a0e9862162ec6b137cb3a3835e11522995d8939e7c", + "zh:bc9cdd3aac784f759125c6627f6f6416e8726a1c184eb9cf3e55b9edbc94c627", + "zh:c8e35b89572ba1c40a9b20022e033a3395fb8d42e7604d50c900f193ba10382e", + "zh:e2deaa8a9975ef81d9f62baed12c41286918b0a10908e0e031f13f69a3b730a1", + "zh:ee39707557210a0ab1098aa357d2cdfe502e5a312d0dbdffb09d08facc4d3fc5", + "zh:f81afe4eb63e8aa9e0ea71be6c990f0dc69cb360e7191c0742a991f4a5081b64", + ] +} diff --git a/infrastructure/gcp/backend/README.md b/infrastructure/gcp/backend/README.md new file mode 100644 index 000000000..4fec3b7e8 --- /dev/null +++ b/infrastructure/gcp/backend/README.md @@ -0,0 +1,118 @@ +# Module: backend + +## Description + +Creates a Google Cloud Storage bucket for Terraform/OpenTofu remote state, with optional customer-managed encryption, access logging, and additional IAM grants + +## Architecture + +The module provisions a `google_storage_bucket` resource named by appending a random hex suffix (via `random_id`) to a lowercased `bucket_prefix`, since GCS bucket names must be globally unique across all of GCP and cannot contain uppercase characters. Uniform bucket-level access and public access prevention are enabled by default, and object versioning is enabled by default so previous state revisions can be recovered. A dynamic `encryption` block is conditionally injected when `kms_key_name` is set, to encrypt bucket contents with an existing Cloud KMS key instead of Google-managed keys, and a dynamic `logging` block is injected when `log_bucket` is set. For each entry in `allowed_members`, a `google_storage_bucket_iam_member` resource grants `roles/storage.objectAdmin` on the bucket to that principal — these bindings are additive and do not restrict or revoke access inherited from the project's IAM. + +## Features + +- Creates a GCS bucket with a globally-unique name (configurable prefix plus random suffix) +- Enables object versioning by default to protect against accidental state corruption +- Enables uniform bucket-level access and enforced public access prevention by default +- Supports optional customer-managed encryption via an existing Cloud KMS key +- Supports optional access logging to an existing log bucket, so reads of state objects leave an audit trail +- Grants `roles/storage.objectAdmin` to additional IAM members (additive, on top of project-inherited access) +- Defaults `force_destroy` to false to protect Terraform/OpenTofu state from accidental deletion +- Validates `bucket_prefix`, `storage_class` and `public_access_prevention` at plan time, so an illegal value fails before apply + +## Basic Usage + +```hcl +module "backend" { + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/backend?ref=v6.11.3" + + project_id = "your-project-id" +} +``` + +## Using Outputs + +```hcl +# Reference outputs in other resources +resource "example_resource" "this" { + example_attribute = module.backend.bucket_name +} +``` + +## Bootstrapping the backend + +The bucket name is only known after apply, because it embeds a `random_id` suffix. A `backend "gcs"` block requires a literal bucket name, so adopting this module is a two-phase operation: + +1. Apply this module with a local state file and read `bucket_name` from the output. +2. Add the `backend "gcs"` block with that literal name and run `tofu init -migrate-state`. + +```hcl +terraform { + backend "gcs" { + bucket = "tofu-state-a1b2c3d4e5f6a7b8" # from module.backend.bucket_name + prefix = "your-stack" + } +} +``` + +## Operational notes + +**Access is additive, not restricted.** `allowed_members` only grants. Every principal that already holds `roles/editor`, `roles/storage.admin` or `roles/storage.objectViewer` on the project keeps full read access to the bucket, and state contains secrets in plaintext. Restricting access to state means tightening project-level IAM; this module cannot do it for you. (`google_storage_bucket_iam_member` is used deliberately over `google_storage_bucket_iam_binding`, which is authoritative and would wipe bindings the module does not manage.) + +**Versioning retains secrets after rotation.** With `versioning_enabled = true` (the default), removing or rotating a secret in state leaves the previous value readable as a non-current object version. There is no lifecycle rule to age those out — add one if your threat model requires that rotated credentials become unrecoverable. + +**Customer-managed encryption has a prerequisite this module does not create.** Before `kms_key_name` can be set, the project's GCS service agent (`service-@gs-project-accounts.iam.gserviceaccount.com`) must hold `roles/cloudkms.cryptoKeyEncrypterDecrypter` on the key. Grant it separately — for example with a `google_kms_crypto_key_iam_member` alongside this module — or apply fails with `permission denied on Cloud KMS key`. + +**Changing `bucket_prefix` replaces the bucket.** The name is the only forces-replacement attribute. With `force_destroy = false` the destroy fails on a non-empty bucket, leaving a half-applied bootstrap to untangle by hand. Treat the prefix as immutable once state lives in the bucket. + +**Trivy reports GCP-0077 and GCP-0066 against this module, by design.** Access logging (`log_bucket`) and customer-managed encryption (`kms_key_name`) are both opt-in, because each needs a resource this module does not create — an existing log bucket and an existing KMS key. Trivy evaluates the configuration with default variable values, so it sees a bucket with neither and flags both. Setting the two inputs is the fix for a given deployment; the findings are deliberately not suppressed in `.trivyignore`, since that file is a flat ID list and would silence bucket-logging findings for every other module in the repo. + + +## Requirements + +| Name | Version | +|------|---------| +| [terraform](#requirement\_terraform) | >= 1.3 | +| [google](#requirement\_google) | >= 5.0, < 7.0 | +| [random](#requirement\_random) | >= 3.0 | + +## Providers + +| Name | Version | +|------|---------| +| [google](#provider\_google) | 6.50.0 | +| [random](#provider\_random) | 3.9.0 | + +## Resources + +| Name | Type | +|------|------| +| [google_storage_bucket.tf_state](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/storage_bucket) | resource | +| [google_storage_bucket_iam_member.allowed_members](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/storage_bucket_iam_member) | resource | +| [random_id.bucket_suffix](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/id) | resource | + +## Inputs + +| Name | Description | Type | Default | Required | +|------|-------------|------|---------|:--------:| +| [allowed\_members](#input\_allowed\_members) | IAM members (e.g. user:..., serviceAccount:..., group:...) additionally granted roles/storage.objectAdmin on the bucket. These bindings are additive: they grant access on top of whatever the project's IAM already allows, and do not restrict or revoke inherited access | `list(string)` | `[]` | no | +| [bucket\_prefix](#input\_bucket\_prefix) | Prefix for the GCS bucket name. A random suffix will be appended since bucket names must be globally unique across all of GCP. Lowercased automatically, since GCS bucket names cannot contain uppercase characters | `string` | `"tofu-state"` | no | +| [force\_destroy](#input\_force\_destroy) | Allow destruction of the bucket even if it contains objects. Leave false to protect Terraform/OpenTofu state from accidental deletion | `bool` | `false` | no | +| [kms\_key\_name](#input\_kms\_key\_name) | Full resource name of an existing Cloud KMS key used to encrypt the bucket's contents. Leave null or empty to use Google-managed encryption. When set, the project's GCS service agent must already hold roles/cloudkms.cryptoKeyEncrypterDecrypter on the key — this module does not grant it | `string` | `null` | no | +| [location](#input\_location) | GCS location for the bucket (e.g. a multi-region like US, or a region like us-central1) | `string` | `"US"` | no | +| [log\_bucket](#input\_log\_bucket) | Name of an existing GCS bucket to receive this bucket's access logs. Leave null or empty to disable access logging. Recommended for a state bucket, so reads of state objects leave an audit trail | `string` | `null` | no | +| [project\_id](#input\_project\_id) | The GCP project ID where the state bucket will be created | `string` | n/a | yes | +| [public\_access\_prevention](#input\_public\_access\_prevention) | Public access prevention setting for the bucket (enforced or inherited) | `string` | `"enforced"` | no | +| [storage\_class](#input\_storage\_class) | Storage class for the bucket | `string` | `"STANDARD"` | no | +| [tags](#input\_tags) | A mapping of labels to assign to the bucket | `map(string)` | `{}` | no | +| [uniform\_bucket\_level\_access](#input\_uniform\_bucket\_level\_access) | Enable uniform bucket-level access (IAM-only, no legacy ACLs) | `bool` | `true` | no | +| [versioning\_enabled](#input\_versioning\_enabled) | Enable object versioning on the bucket, so previous state revisions can be recovered. Note that prior revisions persist as non-current object versions until a lifecycle rule removes them, so any secret that ever passed through state remains readable in the bucket | `bool` | `true` | no | + +## Outputs + +| Name | Description | +|------|-------------| +| [bucket\_name](#output\_bucket\_name) | Name of the GCS bucket for Terraform/OpenTofu state | +| [bucket\_self\_link](#output\_bucket\_self\_link) | Self-link of the GCS bucket | +| [bucket\_url](#output\_bucket\_url) | gs:// URL of the GCS bucket | +| [location](#output\_location) | Location of the GCS bucket | + diff --git a/infrastructure/gcp/backend/main.tf b/infrastructure/gcp/backend/main.tf new file mode 100644 index 000000000..91cac07f0 --- /dev/null +++ b/infrastructure/gcp/backend/main.tf @@ -0,0 +1,45 @@ +resource "random_id" "bucket_suffix" { + byte_length = 8 +} + +resource "google_storage_bucket" "tf_state" { + # GCS rejects uppercase bucket names, so the caller-supplied prefix is lowercased. + name = "${lower(var.bucket_prefix)}-${random_id.bucket_suffix.hex}" + project = var.project_id + location = var.location + storage_class = var.storage_class + force_destroy = var.force_destroy + + uniform_bucket_level_access = var.uniform_bucket_level_access + public_access_prevention = var.public_access_prevention + + versioning { + enabled = var.versioning_enabled + } + + # Empty string as well as null: an empty value reaches here whenever the key is + # wired from another module's output or a TF_VAR, and would emit an empty key. + dynamic "encryption" { + for_each = var.kms_key_name != null && var.kms_key_name != "" ? [var.kms_key_name] : [] + content { + default_kms_key_name = encryption.value + } + } + + dynamic "logging" { + for_each = var.log_bucket != null && var.log_bucket != "" ? [var.log_bucket] : [] + content { + log_bucket = logging.value + } + } + + labels = var.tags +} + +resource "google_storage_bucket_iam_member" "allowed_members" { + for_each = toset(var.allowed_members) + + bucket = google_storage_bucket.tf_state.name + role = "roles/storage.objectAdmin" + member = each.value +} diff --git a/infrastructure/gcp/backend/outputs.tf b/infrastructure/gcp/backend/outputs.tf new file mode 100644 index 000000000..e7d839abf --- /dev/null +++ b/infrastructure/gcp/backend/outputs.tf @@ -0,0 +1,19 @@ +output "bucket_name" { + description = "Name of the GCS bucket for Terraform/OpenTofu state" + value = google_storage_bucket.tf_state.name +} + +output "bucket_url" { + description = "gs:// URL of the GCS bucket" + value = google_storage_bucket.tf_state.url +} + +output "bucket_self_link" { + description = "Self-link of the GCS bucket" + value = google_storage_bucket.tf_state.self_link +} + +output "location" { + description = "Location of the GCS bucket" + value = google_storage_bucket.tf_state.location +} diff --git a/infrastructure/gcp/backend/tests/backend.tftest.hcl b/infrastructure/gcp/backend/tests/backend.tftest.hcl new file mode 100644 index 000000000..bf81b894b --- /dev/null +++ b/infrastructure/gcp/backend/tests/backend.tftest.hcl @@ -0,0 +1,313 @@ +mock_provider "google" {} + +variables { + project_id = "myorg-project" +} + +run "bucket_uses_default_prefix" { + # random_id.bucket_suffix is unknown until apply, so the bucket name can't + # be asserted on during plan. + command = apply + + assert { + condition = can(regex("^tofu-state-[0-9a-f]{16}$", google_storage_bucket.tf_state.name)) + error_message = "Bucket name should be bucket_prefix followed by a 16-character random hex suffix" + } +} + +run "custom_bucket_prefix" { + command = apply + + variables { + bucket_prefix = "myorg-tfstate" + } + + assert { + condition = can(regex("^myorg-tfstate-[0-9a-f]{16}$", google_storage_bucket.tf_state.name)) + error_message = "Bucket name should use the custom prefix" + } +} + +run "uppercase_bucket_prefix_is_lowercased" { + command = apply + + variables { + bucket_prefix = "MyOrg-TFState" + } + + assert { + condition = google_storage_bucket.tf_state.name == lower(google_storage_bucket.tf_state.name) + error_message = "Bucket name must be entirely lowercase: GCS rejects uppercase bucket names" + } + + assert { + condition = can(regex("^myorg-tfstate-[0-9a-f]{16}$", google_storage_bucket.tf_state.name)) + error_message = "An uppercase bucket_prefix should be lowercased, not passed through" + } +} + +run "bucket_prefix_over_46_chars_is_rejected" { + command = plan + + variables { + # 47 characters: with the 17-character suffix this would exceed the GCS limit of 63. + bucket_prefix = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + + expect_failures = [var.bucket_prefix] +} + +run "bucket_prefix_with_illegal_characters_is_rejected" { + command = plan + + variables { + bucket_prefix = "myorg tfstate!" + } + + expect_failures = [var.bucket_prefix] +} + +run "bucket_prefix_with_trailing_hyphen_is_rejected" { + command = plan + + variables { + bucket_prefix = "myorg-tfstate-" + } + + expect_failures = [var.bucket_prefix] +} + +run "bucket_prefix_using_reserved_google_name_is_rejected" { + command = plan + + variables { + bucket_prefix = "google-tfstate" + } + + expect_failures = [var.bucket_prefix] +} + +run "location_and_storage_class_defaults" { + command = plan + + assert { + condition = google_storage_bucket.tf_state.location == "US" + error_message = "Location should default to the US multi-region" + } + + assert { + condition = google_storage_bucket.tf_state.storage_class == "STANDARD" + error_message = "Storage class should default to STANDARD" + } +} + +run "invalid_storage_class_is_rejected" { + command = plan + + variables { + storage_class = "SUPERCOLD" + } + + expect_failures = [var.storage_class] +} + +run "uniform_bucket_level_access_enabled_by_default" { + command = plan + + assert { + condition = google_storage_bucket.tf_state.uniform_bucket_level_access == true + error_message = "Uniform bucket-level access should be enabled by default: legacy ACLs must not be reachable on a bucket holding state" + } +} + +run "uniform_bucket_level_access_can_be_disabled" { + command = plan + + variables { + uniform_bucket_level_access = false + } + + assert { + condition = google_storage_bucket.tf_state.uniform_bucket_level_access == false + error_message = "uniform_bucket_level_access should be settable to false" + } +} + +run "versioning_enabled_by_default" { + command = plan + + assert { + condition = google_storage_bucket.tf_state.versioning[0].enabled == true + error_message = "Versioning should be enabled by default" + } +} + +run "versioning_can_be_disabled" { + command = plan + + variables { + versioning_enabled = false + } + + assert { + condition = google_storage_bucket.tf_state.versioning[0].enabled == false + error_message = "versioning_enabled should be settable to false" + } +} + +run "force_destroy_disabled_by_default" { + command = plan + + assert { + condition = google_storage_bucket.tf_state.force_destroy == false + error_message = "force_destroy should default to false to protect state" + } +} + +run "public_access_prevention_enforced_by_default" { + command = plan + + assert { + condition = google_storage_bucket.tf_state.public_access_prevention == "enforced" + error_message = "Public access prevention should be enforced by default" + } +} + +run "public_access_prevention_accepts_inherited" { + command = plan + + variables { + public_access_prevention = "inherited" + } + + assert { + condition = google_storage_bucket.tf_state.public_access_prevention == "inherited" + error_message = "public_access_prevention should accept the documented 'inherited' value" + } +} + +run "invalid_public_access_prevention_is_rejected" { + command = plan + + variables { + # One character off the legal value; without validation this passes plan and + # only fails at apply, leaving the operator believing PAP is set. + public_access_prevention = "enforce" + } + + expect_failures = [var.public_access_prevention] +} + +run "no_encryption_block_by_default" { + command = plan + + assert { + condition = length(google_storage_bucket.tf_state.encryption) == 0 + error_message = "No customer-managed encryption should be configured when kms_key_name is not set" + } +} + +run "empty_kms_key_name_emits_no_encryption_block" { + command = plan + + variables { + # An empty string reaches the module whenever the key is wired from another + # module's output or a TF_VAR; it must fall back to Google-managed encryption. + kms_key_name = "" + } + + assert { + condition = length(google_storage_bucket.tf_state.encryption) == 0 + error_message = "An empty kms_key_name must not emit an encryption block with an empty key" + } +} + +run "encryption_block_when_kms_key_provided" { + command = plan + + variables { + kms_key_name = "projects/myorg-project/locations/us-central1/keyRings/myorg-ring/cryptoKeys/myorg-key" + } + + assert { + condition = google_storage_bucket.tf_state.encryption[0].default_kms_key_name == "projects/myorg-project/locations/us-central1/keyRings/myorg-ring/cryptoKeys/myorg-key" + error_message = "Encryption block should use the provided KMS key" + } +} + +run "no_logging_block_by_default" { + command = plan + + assert { + condition = length(google_storage_bucket.tf_state.logging) == 0 + error_message = "Access logging should not be configured when log_bucket is not set" + } +} + +run "empty_log_bucket_emits_no_logging_block" { + command = plan + + variables { + log_bucket = "" + } + + assert { + condition = length(google_storage_bucket.tf_state.logging) == 0 + error_message = "An empty log_bucket must not emit a logging block with an empty target" + } +} + +run "logging_block_when_log_bucket_provided" { + command = plan + + variables { + log_bucket = "myorg-access-logs" + } + + assert { + condition = google_storage_bucket.tf_state.logging[0].log_bucket == "myorg-access-logs" + error_message = "Logging block should target the provided log bucket" + } +} + +run "no_iam_bindings_by_default" { + command = plan + + assert { + condition = length(google_storage_bucket_iam_member.allowed_members) == 0 + error_message = "No IAM bindings should be created when allowed_members is empty" + } +} + +run "iam_binding_for_allowed_member" { + command = plan + + variables { + allowed_members = ["user:admin@example.com"] + } + + assert { + condition = google_storage_bucket_iam_member.allowed_members["user:admin@example.com"].role == "roles/storage.objectAdmin" + error_message = "Allowed member should be granted storage.objectAdmin role" + } + + assert { + condition = length(google_storage_bucket_iam_member.allowed_members) == 1 + error_message = "One binding should be created per allowed member" + } +} + +run "tags_applied" { + command = plan + + variables { + tags = { + env = "test" + } + } + + assert { + condition = google_storage_bucket.tf_state.labels["env"] == "test" + error_message = "Labels should be applied from the tags variable" + } +} diff --git a/infrastructure/gcp/backend/variables.tf b/infrastructure/gcp/backend/variables.tf new file mode 100644 index 000000000..73d49dcc0 --- /dev/null +++ b/infrastructure/gcp/backend/variables.tf @@ -0,0 +1,111 @@ +variable "project_id" { + description = "The GCP project ID where the state bucket will be created" + type = string +} + +variable "bucket_prefix" { + description = "Prefix for the GCS bucket name. A random suffix will be appended since bucket names must be globally unique across all of GCP. Lowercased automatically, since GCS bucket names cannot contain uppercase characters" + type = string + default = "tofu-state" + nullable = false + + # The random suffix adds 17 characters ("-" plus 16 hex), and a GCS bucket + # name is capped at 63. + validation { + condition = length(var.bucket_prefix) >= 1 && length(var.bucket_prefix) <= 46 + error_message = "bucket_prefix must be 1-46 characters: the module appends a 17-character random suffix and GCS caps bucket names at 63." + } + + # Dots are legal in GCS names but turn the bucket into a domain-named bucket, + # which requires verified domain ownership — excluded rather than silently failing at apply. + validation { + condition = can(regex("^[a-z0-9]([a-z0-9_-]*[a-z0-9])?$", lower(var.bucket_prefix))) + error_message = "bucket_prefix may contain only letters, numbers, hyphens and underscores, and must start and end with a letter or number." + } + + validation { + condition = !can(regex("^goog", lower(var.bucket_prefix))) && !can(regex("google", lower(var.bucket_prefix))) + error_message = "bucket_prefix cannot start with 'goog' or contain 'google': GCS reserves those names." + } +} + +variable "location" { + description = "GCS location for the bucket (e.g. a multi-region like US, or a region like us-central1)" + type = string + default = "US" + nullable = false +} + +variable "storage_class" { + description = "Storage class for the bucket" + type = string + default = "STANDARD" + nullable = false + + validation { + condition = contains([ + "STANDARD", "NEARLINE", "COLDLINE", "ARCHIVE", + "MULTI_REGIONAL", "REGIONAL", "DURABLE_REDUCED_AVAILABILITY", + ], var.storage_class) + error_message = "storage_class must be one of STANDARD, NEARLINE, COLDLINE, ARCHIVE, or the legacy MULTI_REGIONAL, REGIONAL, DURABLE_REDUCED_AVAILABILITY." + } +} + +variable "force_destroy" { + description = "Allow destruction of the bucket even if it contains objects. Leave false to protect Terraform/OpenTofu state from accidental deletion" + type = bool + default = false + nullable = false +} + +variable "versioning_enabled" { + description = "Enable object versioning on the bucket, so previous state revisions can be recovered. Note that prior revisions persist as non-current object versions until a lifecycle rule removes them, so any secret that ever passed through state remains readable in the bucket" + type = bool + default = true + nullable = false +} + +variable "uniform_bucket_level_access" { + description = "Enable uniform bucket-level access (IAM-only, no legacy ACLs)" + type = bool + default = true + nullable = false +} + +variable "public_access_prevention" { + description = "Public access prevention setting for the bucket (enforced or inherited)" + type = string + default = "enforced" + nullable = false + + validation { + condition = contains(["enforced", "inherited"], var.public_access_prevention) + error_message = "public_access_prevention must be either 'enforced' or 'inherited'." + } +} + +variable "kms_key_name" { + description = "Full resource name of an existing Cloud KMS key used to encrypt the bucket's contents. Leave null or empty to use Google-managed encryption. When set, the project's GCS service agent must already hold roles/cloudkms.cryptoKeyEncrypterDecrypter on the key — this module does not grant it" + type = string + default = null +} + +variable "log_bucket" { + description = "Name of an existing GCS bucket to receive this bucket's access logs. Leave null or empty to disable access logging. Recommended for a state bucket, so reads of state objects leave an audit trail" + type = string + default = null +} + +variable "allowed_members" { + description = "IAM members (e.g. user:..., serviceAccount:..., group:...) additionally granted roles/storage.objectAdmin on the bucket. These bindings are additive: they grant access on top of whatever the project's IAM already allows, and do not restrict or revoke inherited access" + type = list(string) + default = [] + nullable = false +} + +variable "tags" { + description = "A mapping of labels to assign to the bucket" + type = map(string) + default = {} + nullable = false +} diff --git a/infrastructure/gcp/backend/versions.tf b/infrastructure/gcp/backend/versions.tf new file mode 100644 index 000000000..903842095 --- /dev/null +++ b/infrastructure/gcp/backend/versions.tf @@ -0,0 +1,14 @@ +terraform { + required_version = ">= 1.3" + + required_providers { + google = { + source = "hashicorp/google" + version = ">= 5.0, < 7.0" + } + random = { + source = "hashicorp/random" + version = ">= 3.0" + } + } +} From 3307beed2f20342968293cc6003db1d09ce61550 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Fri, 14 Aug 2026 19:31:32 +0000 Subject: [PATCH 23/81] chore(6.x): release 6.16.0 --- CHANGELOG.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index de73732be..ca76b1e4c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,12 @@ # Changelog +## [6.16.0](https://github.com/nullplatform/tofu-modules/compare/v6.15.0...v6.16.0) (2026-08-14) + + +### Features + +* **gcp/backend:** add GCS terraform state bucket module ([#511](https://github.com/nullplatform/tofu-modules/issues/511)) ([9355c6e](https://github.com/nullplatform/tofu-modules/commit/9355c6e4fcb6cb38be04f01fea264a54f7ac3c9c)) + ## [6.15.0](https://github.com/nullplatform/tofu-modules/compare/v6.14.0...v6.15.0) (2026-08-14) From df3b4801bd0480b5c8a500232598ab58fce8cfb9 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Fri, 14 Aug 2026 19:32:03 +0000 Subject: [PATCH 24/81] docs: regenerate READMEs for changed modules and update versions --- infrastructure/aws/acm/README.md | 2 +- .../aws_load_balancer_controller/README.md | 2 +- infrastructure/aws/backend/README.md | 2 +- infrastructure/aws/dns/README.md | 2 +- infrastructure/aws/eks/README.md | 2 +- infrastructure/aws/iam/agent/README.md | 2 +- .../README.md | 2 +- infrastructure/aws/iam/cert_manager/README.md | 2 +- .../aws/iam/ci-build-workflow-user/README.md | 2 +- infrastructure/aws/iam/cloudwatch/README.md | 2 +- infrastructure/aws/iam/ecr/README.md | 2 +- infrastructure/aws/iam/external_dns/README.md | 2 +- infrastructure/aws/iam/s3/README.md | 2 +- infrastructure/aws/ingress/README.md | 2 +- infrastructure/aws/security/README.md | 2 +- infrastructure/aws/vpc/README.md | 2 +- infrastructure/azure/acr/README.md | 2 +- infrastructure/azure/aks/README.md | 2 +- .../azure/aks_route_table/README.md | 2 +- infrastructure/azure/dns/README.md | 2 +- infrastructure/azure/iam/README.md | 2 +- infrastructure/azure/private_dns/README.md | 2 +- infrastructure/azure/resource_group/README.md | 2 +- infrastructure/azure/security/README.md | 2 +- infrastructure/azure/vnet/README.md | 2 +- infrastructure/commons/cert_manager/README.md | 12 +- infrastructure/commons/external_dns/README.md | 12 +- infrastructure/commons/istio/README.md | 2 +- infrastructure/commons/prometheus/README.md | 2 +- .../gcp/artifact-registry/README.md | 2 +- infrastructure/gcp/backend/README.md | 135 +++++++++++++----- infrastructure/gcp/cloud-dns/README.md | 2 +- infrastructure/gcp/cloud-nat/README.md | 2 +- infrastructure/gcp/gke/README.md | 6 +- infrastructure/gcp/iam/README.md | 2 +- infrastructure/gcp/security/README.md | 2 +- infrastructure/gcp/vpc/README.md | 2 +- infrastructure/oci/backend/README.md | 2 +- infrastructure/oci/dns/README.md | 2 +- infrastructure/oci/dynamic_groups/README.md | 2 +- infrastructure/oci/oke/README.md | 2 +- infrastructure/oci/vcn/README.md | 2 +- nullplatform/account/README.md | 2 +- nullplatform/agent/README.md | 10 +- nullplatform/api_key/README.md | 10 +- nullplatform/asset/docker_server/README.md | 2 +- nullplatform/asset/ecr/README.md | 2 +- nullplatform/asset/s3/README.md | 2 +- nullplatform/base/README.md | 12 +- nullplatform/cloud/aws/cloud/README.md | 2 +- nullplatform/cloud/aws/vpc/README.md | 2 +- nullplatform/cloud/azure/cloud/README.md | 2 +- nullplatform/cloud/gcp/cloud/README.md | 2 +- nullplatform/cloud/oci/cloud/README.md | 2 +- nullplatform/code_repository/README.md | 10 +- .../container_orchestration/aks/README.md | 2 +- .../container_orchestration/eks/README.md | 2 +- .../container_orchestration/gke/README.md | 2 +- .../container_orchestration/oke/README.md | 2 +- nullplatform/dimension/README.md | 2 +- nullplatform/dimension_value/README.md | 2 +- .../identity-access-control/README.md | 2 +- nullplatform/metrics/README.md | 2 +- nullplatform/packaged_service/README.md | 2 +- .../parameter_storage_configuration/README.md | 2 +- .../parameter_storage_definition/README.md | 2 +- .../README.md | 2 +- nullplatform/scope_configuration/README.md | 2 +- nullplatform/scope_definition/README.md | 2 +- .../README.md | 2 +- nullplatform/service_definition/README.md | 2 +- .../README.md | 2 +- nullplatform/users/README.md | 2 +- 73 files changed, 197 insertions(+), 140 deletions(-) diff --git a/infrastructure/aws/acm/README.md b/infrastructure/aws/acm/README.md index 7df9db413..26560e314 100644 --- a/infrastructure/aws/acm/README.md +++ b/infrastructure/aws/acm/README.md @@ -18,7 +18,7 @@ The module creates an aws_acm_certificate resource with DNS validation, which is ```hcl module "acm" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/acm?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/acm?ref=v6.16.0" domain_name = "your-domain-name" zone_id = "your-zone-id" diff --git a/infrastructure/aws/aws_load_balancer_controller/README.md b/infrastructure/aws/aws_load_balancer_controller/README.md index 07bec5639..977467182 100644 --- a/infrastructure/aws/aws_load_balancer_controller/README.md +++ b/infrastructure/aws/aws_load_balancer_controller/README.md @@ -18,7 +18,7 @@ This module creates a helm_release resource to deploy the AWS Load Balancer Cont ```hcl module "aws_load_balancer_controller" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/aws_load_balancer_controller?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/aws_load_balancer_controller?ref=v6.16.0" cluster_name = "your-cluster-name" vpc_id = "your-vpc-id" diff --git a/infrastructure/aws/backend/README.md b/infrastructure/aws/backend/README.md index ffad37982..7b5c9a567 100644 --- a/infrastructure/aws/backend/README.md +++ b/infrastructure/aws/backend/README.md @@ -20,7 +20,7 @@ This module creates an S3 bucket with versioning and server-side encryption enab ```hcl module "backend" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/backend?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/backend?ref=v6.16.0" } ``` diff --git a/infrastructure/aws/dns/README.md b/infrastructure/aws/dns/README.md index f5714ed6c..8dd150749 100644 --- a/infrastructure/aws/dns/README.md +++ b/infrastructure/aws/dns/README.md @@ -21,7 +21,7 @@ The module conditionally creates an aws_route53_zone resource for a public hoste ```hcl module "dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/dns?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/dns?ref=v6.16.0" domain_name = "your-domain-name" vpc_id = "your-vpc-id" diff --git a/infrastructure/aws/eks/README.md b/infrastructure/aws/eks/README.md index 02ef2a35f..7c7545d91 100644 --- a/infrastructure/aws/eks/README.md +++ b/infrastructure/aws/eks/README.md @@ -22,7 +22,7 @@ The module wraps terraform-aws-modules/eks to create the EKS cluster (aws_eks_cl ```hcl module "eks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/eks?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/eks?ref=v6.16.0" aws_subnets_private_ids = "your-aws-subnets-private-ids" aws_vpc_vpc_id = "your-aws-vpc-vpc-id" diff --git a/infrastructure/aws/iam/agent/README.md b/infrastructure/aws/iam/agent/README.md index 01f0f4fd7..02ddacf95 100644 --- a/infrastructure/aws/iam/agent/README.md +++ b/infrastructure/aws/iam/agent/README.md @@ -21,7 +21,7 @@ The module uses the terraform-aws-modules/iam//modules/iam-role-for-service-acco ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/agent?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/agent?ref=v6.16.0" agent_namespace = "your-agent-namespace" aws_iam_openid_connect_provider_arn = "your-aws-iam-openid-connect-provider-arn" diff --git a/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md b/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md index a151e497d..d560e47b9 100644 --- a/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md +++ b/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md @@ -19,7 +19,7 @@ This module creates an IAM role for the AWS Load Balancer Controller using the t ```hcl module "aws_load_balancer_controller_iam" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/aws_load_balancer_controller_iam?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/aws_load_balancer_controller_iam?ref=v6.16.0" aws_iam_openid_connect_provider_arn = "your-aws-iam-openid-connect-provider-arn" cluster_name = "your-cluster-name" diff --git a/infrastructure/aws/iam/cert_manager/README.md b/infrastructure/aws/iam/cert_manager/README.md index 9cc3a7326..b335b37be 100644 --- a/infrastructure/aws/iam/cert_manager/README.md +++ b/infrastructure/aws/iam/cert_manager/README.md @@ -20,7 +20,7 @@ An aws_iam_policy resource is always created granting route53:GetChange, route53 ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cert_manager?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cert_manager?ref=v6.16.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/ci-build-workflow-user/README.md b/infrastructure/aws/iam/ci-build-workflow-user/README.md index 675b7f9dc..8e3dd044d 100644 --- a/infrastructure/aws/iam/ci-build-workflow-user/README.md +++ b/infrastructure/aws/iam/ci-build-workflow-user/README.md @@ -21,7 +21,7 @@ The module creates an aws_iam_user named with the cluster_name prefix and genera ```hcl module "ci-build-workflow-user" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ci-build-workflow-user?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ci-build-workflow-user?ref=v6.16.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/cloudwatch/README.md b/infrastructure/aws/iam/cloudwatch/README.md index 9c512ee9f..9903e07e6 100644 --- a/infrastructure/aws/iam/cloudwatch/README.md +++ b/infrastructure/aws/iam/cloudwatch/README.md @@ -20,7 +20,7 @@ The module creates an aws_iam_policy granting CloudWatch Logs and Metrics write ```hcl module "cloudwatch" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cloudwatch?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cloudwatch?ref=v6.16.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/ecr/README.md b/infrastructure/aws/iam/ecr/README.md index 1fb68c7da..041e27342 100644 --- a/infrastructure/aws/iam/ecr/README.md +++ b/infrastructure/aws/iam/ecr/README.md @@ -20,7 +20,7 @@ The module creates an aws_iam_role named nullplatform-{cluster_name}-application ```hcl module "ecr" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ecr?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ecr?ref=v6.16.0" build_workflow_group_name = "your-build-workflow-group-name" cluster_name = "your-cluster-name" diff --git a/infrastructure/aws/iam/external_dns/README.md b/infrastructure/aws/iam/external_dns/README.md index 8d6446c7f..9b02157d4 100644 --- a/infrastructure/aws/iam/external_dns/README.md +++ b/infrastructure/aws/iam/external_dns/README.md @@ -20,7 +20,7 @@ An aws_iam_policy resource named nullplatform_external_dns_policy is always crea ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/external_dns?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/external_dns?ref=v6.16.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/s3/README.md b/infrastructure/aws/iam/s3/README.md index a3e389751..0931867ff 100644 --- a/infrastructure/aws/iam/s3/README.md +++ b/infrastructure/aws/iam/s3/README.md @@ -18,7 +18,7 @@ The module creates an aws_iam_policy resource that allows s3:PutObject and s3:Ge ```hcl module "s3" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/s3?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/s3?ref=v6.16.0" bucket = "your-bucket" build_workflow_group_name = "your-build-workflow-group-name" diff --git a/infrastructure/aws/ingress/README.md b/infrastructure/aws/ingress/README.md index 47d22e3a7..a4d963415 100644 --- a/infrastructure/aws/ingress/README.md +++ b/infrastructure/aws/ingress/README.md @@ -22,7 +22,7 @@ The module creates up to two kubernetes_ingress_v1 resources — one for an inte ```hcl module "ingress" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/ingress?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/ingress?ref=v6.16.0" certificate_arn = "your-certificate-arn" } diff --git a/infrastructure/aws/security/README.md b/infrastructure/aws/security/README.md index 7972b6aae..c0aa85339 100644 --- a/infrastructure/aws/security/README.md +++ b/infrastructure/aws/security/README.md @@ -22,7 +22,7 @@ The module uses data sources (aws_eks_cluster, aws_vpc) to automatically derive ```hcl module "security" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/security?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/security?ref=v6.16.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/vpc/README.md b/infrastructure/aws/vpc/README.md index d86bc5fcf..ec27a10e1 100644 --- a/infrastructure/aws/vpc/README.md +++ b/infrastructure/aws/vpc/README.md @@ -22,7 +22,7 @@ This module creates a terraform-aws-modules/vpc/aws module resource with DNS hos ```hcl module "vpc" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/vpc?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/vpc?ref=v6.16.0" account = "your-account" organization = "your-organization" diff --git a/infrastructure/azure/acr/README.md b/infrastructure/azure/acr/README.md index 6c649c549..b74c3f296 100644 --- a/infrastructure/azure/acr/README.md +++ b/infrastructure/azure/acr/README.md @@ -18,7 +18,7 @@ The module uses the azurerm_container_registry resource to create the container ```hcl module "acr" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/acr?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/acr?ref=v6.16.0" containerregistry_name = "your-containerregistry-name" location = "your-location" diff --git a/infrastructure/azure/aks/README.md b/infrastructure/azure/aks/README.md index 76c3e3ea3..72849d435 100644 --- a/infrastructure/azure/aks/README.md +++ b/infrastructure/azure/aks/README.md @@ -22,7 +22,7 @@ The module wraps the Azure/aks/azurerm community module (version 11.0.0) and use ```hcl module "aks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks?ref=v6.16.0" cluster_name = "your-cluster-name" location = "your-location" diff --git a/infrastructure/azure/aks_route_table/README.md b/infrastructure/azure/aks_route_table/README.md index 5ebefe7fa..4b5ea642e 100644 --- a/infrastructure/azure/aks_route_table/README.md +++ b/infrastructure/azure/aks_route_table/README.md @@ -19,7 +19,7 @@ The module uses an azurerm_resources data source to discover the AKS-managed rou ```hcl module "aks_route_table" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks_route_table?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks_route_table?ref=v6.16.0" node_resource_group = "your-node-resource-group" subnet_id = "your-subnet-id" diff --git a/infrastructure/azure/dns/README.md b/infrastructure/azure/dns/README.md index 030a076ae..c055fadaf 100644 --- a/infrastructure/azure/dns/README.md +++ b/infrastructure/azure/dns/README.md @@ -18,7 +18,7 @@ This module creates an azurerm_dns_zone resource and configures it with the prov ```hcl module "dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/dns?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/dns?ref=v6.16.0" domain_name = "your-domain-name" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/iam/README.md b/infrastructure/azure/iam/README.md index 657f74145..970d59693 100644 --- a/infrastructure/azure/iam/README.md +++ b/infrastructure/azure/iam/README.md @@ -21,7 +21,7 @@ The module creates an azurerm_user_assigned_identity resource in the specified r ```hcl module "iam" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/iam?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/iam?ref=v6.16.0" location = "your-location" name = "your-name" diff --git a/infrastructure/azure/private_dns/README.md b/infrastructure/azure/private_dns/README.md index 97535a9ba..7c4bcc61b 100644 --- a/infrastructure/azure/private_dns/README.md +++ b/infrastructure/azure/private_dns/README.md @@ -18,7 +18,7 @@ This module creates an azurerm_private_dns_zone resource and optionally multiple ```hcl module "private_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/private_dns?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/private_dns?ref=v6.16.0" domain_name = "your-domain-name" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/resource_group/README.md b/infrastructure/azure/resource_group/README.md index 48b526319..ca03c42ac 100644 --- a/infrastructure/azure/resource_group/README.md +++ b/infrastructure/azure/resource_group/README.md @@ -18,7 +18,7 @@ This module creates an azurerm_resource_group resource and outputs its name and ```hcl module "resource_group" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/resource_group?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/resource_group?ref=v6.16.0" location = "your-location" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/security/README.md b/infrastructure/azure/security/README.md index 9c8340d11..2f2867b18 100644 --- a/infrastructure/azure/security/README.md +++ b/infrastructure/azure/security/README.md @@ -21,7 +21,7 @@ The module uses azurerm_kubernetes_cluster and azurerm_virtual_network data sour ```hcl module "security" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/security?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/security?ref=v6.16.0" cluster_name = "your-cluster-name" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/vnet/README.md b/infrastructure/azure/vnet/README.md index 3d5cee0e5..94364d095 100644 --- a/infrastructure/azure/vnet/README.md +++ b/infrastructure/azure/vnet/README.md @@ -18,7 +18,7 @@ This module creates an Azure virtual network using the azurerm provider and conf ```hcl module "vnet" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/vnet?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/vnet?ref=v6.16.0" address_space = "your-address-space" location = "your-location" diff --git a/infrastructure/commons/cert_manager/README.md b/infrastructure/commons/cert_manager/README.md index 2a9c30e95..125f4c22b 100644 --- a/infrastructure/commons/cert_manager/README.md +++ b/infrastructure/commons/cert_manager/README.md @@ -22,7 +22,7 @@ Two primary helm_release resources are created: cert-manager from the Jetstack c ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.16.0" account_slug = "your-account-slug" cloud_provider = "your-cloud-provider" @@ -35,7 +35,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.16.0" account_slug = "your-account-slug" cloud_provider = "gcp" @@ -50,7 +50,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.16.0" account_slug = "your-account-slug" azure_client_id = "your-azure-client-id" # Required when cloud_provider = "azure" @@ -68,7 +68,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.16.0" account_slug = "your-account-slug" cloud_provider = "cloudflare" @@ -83,7 +83,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.16.0" account_slug = "your-account-slug" aws_identity_mode = "your-aws-identity-mode" # Required when cloud_provider = "aws" @@ -99,7 +99,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.16.0" account_slug = "your-account-slug" cert_manager_webhook_oci_namespace = "your-cert-manager-webhook-oci-namespace" # Required when cloud_provider = "oci" diff --git a/infrastructure/commons/external_dns/README.md b/infrastructure/commons/external_dns/README.md index 789ed6cc6..db4a6ef5e 100644 --- a/infrastructure/commons/external_dns/README.md +++ b/infrastructure/commons/external_dns/README.md @@ -22,7 +22,7 @@ The module creates an optional kubernetes_namespace_v1 resource when create_name ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.16.0" dns_provider_name = "your-dns-provider-name" domain_filters = "your-domain-filters" @@ -33,7 +33,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.16.0" cloudflare_token = "your-cloudflare-token" # Required when dns_provider_name = "cloudflare" dns_provider_name = "cloudflare" @@ -45,7 +45,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.16.0" aws_iam_role_arn = "your-aws-iam-role-arn" # Required when dns_provider_name = "aws" aws_identity_mode = "your-aws-identity-mode" # Required when dns_provider_name = "aws" @@ -61,7 +61,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.16.0" dns_provider_name = "oci" domain_filters = "your-domain-filters" @@ -77,7 +77,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.16.0" azure_client_id = "your-azure-client-id" # Required when dns_provider_name = "azure" azure_federated_credential_id = "your-azure-federated-credential-id" # Required when dns_provider_name = "azure" @@ -94,7 +94,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.16.0" azure_client_id = "your-azure-client-id" # Required when dns_provider_name = "azure-private-dns" azure_federated_credential_id = "your-azure-federated-credential-id" # Required when dns_provider_name = "azure-private-dns" diff --git a/infrastructure/commons/istio/README.md b/infrastructure/commons/istio/README.md index 14d9b51fd..977ba1bec 100644 --- a/infrastructure/commons/istio/README.md +++ b/infrastructure/commons/istio/README.md @@ -21,7 +21,7 @@ Three helm_release resources are created in a strict dependency chain: istio-bas ```hcl module "istio" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/istio?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/istio?ref=v6.16.0" } ``` diff --git a/infrastructure/commons/prometheus/README.md b/infrastructure/commons/prometheus/README.md index 5c79e75eb..514f41f2f 100644 --- a/infrastructure/commons/prometheus/README.md +++ b/infrastructure/commons/prometheus/README.md @@ -18,7 +18,7 @@ This module creates a helm_release resource to deploy the Prometheus chart from ```hcl module "prometheus" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.16.0" } ``` diff --git a/infrastructure/gcp/artifact-registry/README.md b/infrastructure/gcp/artifact-registry/README.md index 5e6353fbf..9f1bcc5fb 100644 --- a/infrastructure/gcp/artifact-registry/README.md +++ b/infrastructure/gcp/artifact-registry/README.md @@ -21,7 +21,7 @@ The module creates a google_artifact_registry_repository resource configured wit ```hcl module "artifact-registry" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/artifact-registry?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/artifact-registry?ref=v6.16.0" location = "your-location" project_id = "your-project-id" diff --git a/infrastructure/gcp/backend/README.md b/infrastructure/gcp/backend/README.md index 4fec3b7e8..1e869178c 100644 --- a/infrastructure/gcp/backend/README.md +++ b/infrastructure/gcp/backend/README.md @@ -2,28 +2,27 @@ ## Description -Creates a Google Cloud Storage bucket for Terraform/OpenTofu remote state, with optional customer-managed encryption, access logging, and additional IAM grants +Creates a GCS bucket for storing Terraform/OpenTofu remote state with configurable storage class, versioning, encryption, access control, and audit logging ## Architecture -The module provisions a `google_storage_bucket` resource named by appending a random hex suffix (via `random_id`) to a lowercased `bucket_prefix`, since GCS bucket names must be globally unique across all of GCP and cannot contain uppercase characters. Uniform bucket-level access and public access prevention are enabled by default, and object versioning is enabled by default so previous state revisions can be recovered. A dynamic `encryption` block is conditionally injected when `kms_key_name` is set, to encrypt bucket contents with an existing Cloud KMS key instead of Google-managed keys, and a dynamic `logging` block is injected when `log_bucket` is set. For each entry in `allowed_members`, a `google_storage_bucket_iam_member` resource grants `roles/storage.objectAdmin` on the bucket to that principal — these bindings are additive and do not restrict or revoke access inherited from the project's IAM. +The module creates a random_id resource to generate a unique 8-byte hex suffix, which is appended to the lowercased bucket_prefix to form the globally unique name of a google_storage_bucket resource. Optional CMEK encryption is wired via a dynamic encryption block that activates only when kms_key_name is non-null and non-empty, and optional access logging is wired via a dynamic logging block that activates only when log_bucket is non-null and non-empty. Zero or more google_storage_bucket_iam_member resources are created via for_each over the allowed_members list, each granting roles/storage.objectAdmin on the bucket. Outputs expose the bucket name, gs:// URL, self-link, and location for use by remote state backend configurations. ## Features -- Creates a GCS bucket with a globally-unique name (configurable prefix plus random suffix) -- Enables object versioning by default to protect against accidental state corruption -- Enables uniform bucket-level access and enforced public access prevention by default -- Supports optional customer-managed encryption via an existing Cloud KMS key -- Supports optional access logging to an existing log bucket, so reads of state objects leave an audit trail -- Grants `roles/storage.objectAdmin` to additional IAM members (additive, on top of project-inherited access) -- Defaults `force_destroy` to false to protect Terraform/OpenTofu state from accidental deletion -- Validates `bucket_prefix`, `storage_class` and `public_access_prevention` at plan time, so an illegal value fails before apply +- Creates a google_storage_bucket with a globally unique name by appending a random 16-character hex suffix to a caller-supplied prefix +- Enables object versioning on the bucket so previous Terraform state revisions can be recovered +- Configures uniform bucket-level access and public access prevention to enforce IAM-only access controls +- Attaches optional Cloud KMS customer-managed encryption key via a dynamic encryption block on the bucket +- Enables optional GCS access logging to a separate audit log bucket via a dynamic logging block +- Grants roles/storage.objectAdmin to an arbitrary list of IAM members via google_storage_bucket_iam_member resources +- Supports configurable storage class across standard, nearline, coldline, archive, and legacy GCS storage tiers ## Basic Usage ```hcl module "backend" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/backend?ref=v6.11.3" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/backend?ref=v6.16.0" project_id = "your-project-id" } @@ -38,34 +37,6 @@ resource "example_resource" "this" { } ``` -## Bootstrapping the backend - -The bucket name is only known after apply, because it embeds a `random_id` suffix. A `backend "gcs"` block requires a literal bucket name, so adopting this module is a two-phase operation: - -1. Apply this module with a local state file and read `bucket_name` from the output. -2. Add the `backend "gcs"` block with that literal name and run `tofu init -migrate-state`. - -```hcl -terraform { - backend "gcs" { - bucket = "tofu-state-a1b2c3d4e5f6a7b8" # from module.backend.bucket_name - prefix = "your-stack" - } -} -``` - -## Operational notes - -**Access is additive, not restricted.** `allowed_members` only grants. Every principal that already holds `roles/editor`, `roles/storage.admin` or `roles/storage.objectViewer` on the project keeps full read access to the bucket, and state contains secrets in plaintext. Restricting access to state means tightening project-level IAM; this module cannot do it for you. (`google_storage_bucket_iam_member` is used deliberately over `google_storage_bucket_iam_binding`, which is authoritative and would wipe bindings the module does not manage.) - -**Versioning retains secrets after rotation.** With `versioning_enabled = true` (the default), removing or rotating a secret in state leaves the previous value readable as a non-current object version. There is no lifecycle rule to age those out — add one if your threat model requires that rotated credentials become unrecoverable. - -**Customer-managed encryption has a prerequisite this module does not create.** Before `kms_key_name` can be set, the project's GCS service agent (`service-@gs-project-accounts.iam.gserviceaccount.com`) must hold `roles/cloudkms.cryptoKeyEncrypterDecrypter` on the key. Grant it separately — for example with a `google_kms_crypto_key_iam_member` alongside this module — or apply fails with `permission denied on Cloud KMS key`. - -**Changing `bucket_prefix` replaces the bucket.** The name is the only forces-replacement attribute. With `force_destroy = false` the destroy fails on a non-empty bucket, leaving a half-applied bootstrap to untangle by hand. Treat the prefix as immutable once state lives in the bucket. - -**Trivy reports GCP-0077 and GCP-0066 against this module, by design.** Access logging (`log_bucket`) and customer-managed encryption (`kms_key_name`) are both opt-in, because each needs a resource this module does not create — an existing log bucket and an existing KMS key. Trivy evaluates the configuration with default variable values, so it sees a bucket with neither and flags both. Setting the two inputs is the fix for a given deployment; the findings are deliberately not suppressed in `.trivyignore`, since that file is a flat ID list and would silence bucket-logging findings for every other module in the repo. - ## Requirements @@ -116,3 +87,89 @@ terraform { | [bucket\_url](#output\_bucket\_url) | gs:// URL of the GCS bucket | | [location](#output\_location) | Location of the GCS bucket | + + diff --git a/infrastructure/gcp/cloud-dns/README.md b/infrastructure/gcp/cloud-dns/README.md index 775e97536..e670761cc 100644 --- a/infrastructure/gcp/cloud-dns/README.md +++ b/infrastructure/gcp/cloud-dns/README.md @@ -21,7 +21,7 @@ The module creates a single google_dns_managed_zone resource in the specified GC ```hcl module "cloud-dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-dns?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-dns?ref=v6.16.0" domain_name = "your-domain-name" project_id = "your-project-id" diff --git a/infrastructure/gcp/cloud-nat/README.md b/infrastructure/gcp/cloud-nat/README.md index 57e310db8..60ad779cb 100644 --- a/infrastructure/gcp/cloud-nat/README.md +++ b/infrastructure/gcp/cloud-nat/README.md @@ -19,7 +19,7 @@ This module creates a google_compute_router resource in a specified region and n ```hcl module "cloud-nat" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-nat?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-nat?ref=v6.16.0" nat_name = "your-nat-name" network_id = "your-network-id" diff --git a/infrastructure/gcp/gke/README.md b/infrastructure/gcp/gke/README.md index 02e3cbc32..30eba6f8f 100644 --- a/infrastructure/gcp/gke/README.md +++ b/infrastructure/gcp/gke/README.md @@ -22,7 +22,7 @@ The module conditionally creates one of two mutually-exclusive submodules based ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.16.0" cluster_name = "your-cluster-name" ip_range_pods = "your-ip-range-pods" @@ -38,7 +38,7 @@ module "gke" { ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.16.0" cluster_name = "your-cluster-name" ip_range_pods = "your-ip-range-pods" @@ -73,7 +73,7 @@ module "gke" { ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.14.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.16.0" cluster_name = "your-cluster-name" ip_range_pods = "your-ip-range-pods" diff --git a/infrastructure/gcp/iam/README.md b/infrastructure/gcp/iam/README.md index fec8ef1ca..cd02be3b2 100644 --- a/infrastructure/gcp/iam/README.md +++ b/infrastructure/gcp/iam/README.md @@ -19,7 +19,7 @@ The module creates google_service_account resources for each service account spe ```hcl module "iam" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/iam?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/iam?ref=v6.16.0" project_id = "your-project-id" } diff --git a/infrastructure/gcp/security/README.md b/infrastructure/gcp/security/README.md index d83159bc9..36dfd06a6 100644 --- a/infrastructure/gcp/security/README.md +++ b/infrastructure/gcp/security/README.md @@ -21,7 +21,7 @@ The module uses data sources google_container_cluster and google_compute_subnetw ```hcl module "security" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/security?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/security?ref=v6.16.0" cluster_name = "your-cluster-name" gcp_project_id = "your-gcp-project-id" diff --git a/infrastructure/gcp/vpc/README.md b/infrastructure/gcp/vpc/README.md index a6a90b89c..3d20b654e 100644 --- a/infrastructure/gcp/vpc/README.md +++ b/infrastructure/gcp/vpc/README.md @@ -20,7 +20,7 @@ The module invokes the terraform-google-modules/network/google module to create ```hcl module "vpc" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/vpc?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/vpc?ref=v6.16.0" network_name = "your-network-name" project_id = "your-project-id" diff --git a/infrastructure/oci/backend/README.md b/infrastructure/oci/backend/README.md index 1827beea2..2674e95e6 100644 --- a/infrastructure/oci/backend/README.md +++ b/infrastructure/oci/backend/README.md @@ -18,7 +18,7 @@ The module creates an oci_objectstorage_bucket resource, which is configured wit ```hcl module "backend" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/backend?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/backend?ref=v6.16.0" compartment_id = "your-compartment-id" namespace = "your-namespace" diff --git a/infrastructure/oci/dns/README.md b/infrastructure/oci/dns/README.md index 643dc606d..ea6f6af72 100644 --- a/infrastructure/oci/dns/README.md +++ b/infrastructure/oci/dns/README.md @@ -18,7 +18,7 @@ This module creates oci_dns_zone resources for each DNS zone defined in the dns_ ```hcl module "dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dns?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dns?ref=v6.16.0" compartment_id = "your-compartment-id" } diff --git a/infrastructure/oci/dynamic_groups/README.md b/infrastructure/oci/dynamic_groups/README.md index 87af68428..a8f37087f 100644 --- a/infrastructure/oci/dynamic_groups/README.md +++ b/infrastructure/oci/dynamic_groups/README.md @@ -19,7 +19,7 @@ This module creates an OCI dynamic group and an OCI identity policy, connecting ```hcl module "dynamic_groups" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dynamic_groups?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dynamic_groups?ref=v6.16.0" cluster_id = "your-cluster-id" compartment_id = "your-compartment-id" diff --git a/infrastructure/oci/oke/README.md b/infrastructure/oci/oke/README.md index 4144c7c08..b45b6ad0c 100644 --- a/infrastructure/oci/oke/README.md +++ b/infrastructure/oci/oke/README.md @@ -21,7 +21,7 @@ The module instantiates the oracle-terraform-modules/oke/oci module to create an ```hcl module "oke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/oke?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/oke?ref=v6.16.0" api_endpoint_subnet_id = "your-api-endpoint-subnet-id" cluster_name = "your-cluster-name" diff --git a/infrastructure/oci/vcn/README.md b/infrastructure/oci/vcn/README.md index c5269fa2e..ec61458ac 100644 --- a/infrastructure/oci/vcn/README.md +++ b/infrastructure/oci/vcn/README.md @@ -19,7 +19,7 @@ The module instantiates oci_core_subnet resources for public and private subnets ```hcl module "vcn" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/vcn?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/vcn?ref=v6.16.0" } ``` diff --git a/nullplatform/account/README.md b/nullplatform/account/README.md index d589cda60..47f6d0638 100644 --- a/nullplatform/account/README.md +++ b/nullplatform/account/README.md @@ -19,7 +19,7 @@ The module iterates over the `nullplatform_accounts` input map using `for_each` ```hcl module "account" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/account?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/account?ref=v6.16.0" nullplatform_accounts = "your-nullplatform-accounts" } diff --git a/nullplatform/agent/README.md b/nullplatform/agent/README.md index 9b02d4153..3b6b8e36a 100644 --- a/nullplatform/agent/README.md +++ b/nullplatform/agent/README.md @@ -22,7 +22,7 @@ The module creates a helm_release resource targeting the nullplatform-agent char ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.16.0" api_key = "your-api-key" cloud_provider = "your-cloud-provider" @@ -36,7 +36,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.16.0" api_key = "your-api-key" aws_iam_role_arn = "your-aws-iam-role-arn" # Required when cloud_provider = "aws" @@ -51,7 +51,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.16.0" api_key = "your-api-key" cloud_provider = "gcp" @@ -65,7 +65,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.16.0" api_key = "your-api-key" azure_client_id = "your-azure-client-id" # Required when cloud_provider = "azure" @@ -85,7 +85,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.16.0" api_key = "your-api-key" cloud_provider = "oci" diff --git a/nullplatform/api_key/README.md b/nullplatform/api_key/README.md index c49fe1dde..a4e7e4355 100644 --- a/nullplatform/api_key/README.md +++ b/nullplatform/api_key/README.md @@ -21,7 +21,7 @@ The module creates a single nullplatform_api_key resource whose name, grants, an ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.16.0" type = "your-type" } @@ -31,7 +31,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.16.0" nrn = "your-nrn" # Required when type = "agent" type = "agent" @@ -42,7 +42,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.16.0" nrn = "your-nrn" # Required when type = "scope_notification" specification_slug = "your-specification-slug" # Required when type = "scope_notification" @@ -54,7 +54,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.16.0" nrn = "your-nrn" # Required when type = "service_notification" specification_slug = "your-specification-slug" # Required when type = "service_notification" @@ -66,7 +66,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.16.0" custom_grants = "your-custom-grants" # Required when type = "custom" custom_name = "your-custom-name" # Required when type = "custom" diff --git a/nullplatform/asset/docker_server/README.md b/nullplatform/asset/docker_server/README.md index 5bf447468..e8c8f8497 100644 --- a/nullplatform/asset/docker_server/README.md +++ b/nullplatform/asset/docker_server/README.md @@ -21,7 +21,7 @@ Creates a nullplatform_provider_config resource of type 'docker-server' with enc ```hcl module "docker_server" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/docker_server?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/docker_server?ref=v6.16.0" login_server = "your-login-server" nrn = "your-nrn" diff --git a/nullplatform/asset/ecr/README.md b/nullplatform/asset/ecr/README.md index c60233594..404079b35 100644 --- a/nullplatform/asset/ecr/README.md +++ b/nullplatform/asset/ecr/README.md @@ -21,7 +21,7 @@ The module reads the current AWS region via the aws_region data source and combi ```hcl module "ecr" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/ecr?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/ecr?ref=v6.16.0" application_role_arn = "your-application-role-arn" build_workflow_access_key_id = "your-build-workflow-access-key-id" diff --git a/nullplatform/asset/s3/README.md b/nullplatform/asset/s3/README.md index 191e66f8a..2f4800a2a 100644 --- a/nullplatform/asset/s3/README.md +++ b/nullplatform/asset/s3/README.md @@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type s3-con ```hcl module "s3" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/s3?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/s3?ref=v6.16.0" bucket_name = "your-bucket-name" nrn = "your-nrn" diff --git a/nullplatform/base/README.md b/nullplatform/base/README.md index 3312d9401..d2bcf494a 100644 --- a/nullplatform/base/README.md +++ b/nullplatform/base/README.md @@ -22,7 +22,7 @@ The module first creates two kubernetes_namespace_v1 resources ('nullplatform-to ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.16.0" k8s_provider = "your-k8s-provider" np_api_key = "your-np-api-key" @@ -33,7 +33,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.16.0" k8s_provider = "eks" np_api_key = "your-np-api-key" @@ -44,7 +44,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.16.0" k8s_provider = "gke" np_api_key = "your-np-api-key" @@ -55,7 +55,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.16.0" k8s_provider = "aks" np_api_key = "your-np-api-key" @@ -66,7 +66,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.16.0" k8s_provider = "oke" np_api_key = "your-np-api-key" @@ -77,7 +77,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.16.0" k8s_provider = "aro" np_api_key = "your-np-api-key" diff --git a/nullplatform/cloud/aws/cloud/README.md b/nullplatform/cloud/aws/cloud/README.md index 104c69cf8..303cc5df2 100644 --- a/nullplatform/cloud/aws/cloud/README.md +++ b/nullplatform/cloud/aws/cloud/README.md @@ -21,7 +21,7 @@ The module uses data sources aws_caller_identity and aws_region to dynamically r ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/cloud?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/cloud?ref=v6.16.0" domain_name = "your-domain-name" hosted_private_zone_id = "your-hosted-private-zone-id" diff --git a/nullplatform/cloud/aws/vpc/README.md b/nullplatform/cloud/aws/vpc/README.md index f1ffde4ba..e1955ddb4 100644 --- a/nullplatform/cloud/aws/vpc/README.md +++ b/nullplatform/cloud/aws/vpc/README.md @@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource of type aws-ne ```hcl module "vpc" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/vpc?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/vpc?ref=v6.16.0" nrn = "your-nrn" vpc_id = "your-vpc-id" diff --git a/nullplatform/cloud/azure/cloud/README.md b/nullplatform/cloud/azure/cloud/README.md index 867865f77..6349a0ec2 100644 --- a/nullplatform/cloud/azure/cloud/README.md +++ b/nullplatform/cloud/azure/cloud/README.md @@ -22,7 +22,7 @@ The module creates a single nullplatform_provider_config resource of type 'azure ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/azure/cloud?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/azure/cloud?ref=v6.16.0" azure_resource_group_name = "your-azure-resource-group-name" nrn = "your-nrn" diff --git a/nullplatform/cloud/gcp/cloud/README.md b/nullplatform/cloud/gcp/cloud/README.md index ba1a4b532..056bef508 100644 --- a/nullplatform/cloud/gcp/cloud/README.md +++ b/nullplatform/cloud/gcp/cloud/README.md @@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type 'googl ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/gcp/cloud?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/gcp/cloud?ref=v6.16.0" domain_name = "your-domain-name" location = "your-location" diff --git a/nullplatform/cloud/oci/cloud/README.md b/nullplatform/cloud/oci/cloud/README.md index f3024f162..92032fd27 100644 --- a/nullplatform/cloud/oci/cloud/README.md +++ b/nullplatform/cloud/oci/cloud/README.md @@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type 'oci-c ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/oci/cloud?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/oci/cloud?ref=v6.16.0" account_id = "your-account-id" account_name = "your-account-name" diff --git a/nullplatform/code_repository/README.md b/nullplatform/code_repository/README.md index d367dc537..3dec5fb47 100644 --- a/nullplatform/code_repository/README.md +++ b/nullplatform/code_repository/README.md @@ -22,7 +22,7 @@ The module uses local boolean flags (is_gitlab, is_github, is_azure, is_bitbucke ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.16.0" git_provider = "your-git-provider" nrn = "your-nrn" @@ -33,7 +33,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.16.0" git_provider = "github" github_installation_id = "your-github-installation-id" # Required when git_provider = "github" @@ -46,7 +46,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.16.0" git_provider = "gitlab" gitlab_access_token = "your-gitlab-access-token" # Required when git_provider = "gitlab" @@ -62,7 +62,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.16.0" azure_access_token = "your-azure-access-token" # Required when git_provider = "azure" azure_agent_pool = "your-azure-agent-pool" # Required when git_provider = "azure" @@ -76,7 +76,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.16.0" bitbucket_collaborators = "your-bitbucket-collaborators" # Required when git_provider = "bitbucket" bitbucket_installation_url = "your-bitbucket-installation-url" # Required when git_provider = "bitbucket" diff --git a/nullplatform/container_orchestration/aks/README.md b/nullplatform/container_orchestration/aks/README.md index fc50fe3c9..4b2574e6f 100644 --- a/nullplatform/container_orchestration/aks/README.md +++ b/nullplatform/container_orchestration/aks/README.md @@ -21,7 +21,7 @@ The module builds a local.attributes map that aggregates cluster metadata, gatew ```hcl module "aks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.16.0" cluster_name = "your-cluster-name" nrn = "your-nrn" diff --git a/nullplatform/container_orchestration/eks/README.md b/nullplatform/container_orchestration/eks/README.md index 5f0a3ff51..96d8f8793 100644 --- a/nullplatform/container_orchestration/eks/README.md +++ b/nullplatform/container_orchestration/eks/README.md @@ -22,7 +22,7 @@ The module assembles a set of structured locals by merging optional variables in ```hcl module "eks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.16.0" cluster_name = "your-cluster-name" nrn = "your-nrn" diff --git a/nullplatform/container_orchestration/gke/README.md b/nullplatform/container_orchestration/gke/README.md index 1e93dd5b6..96c6545d2 100644 --- a/nullplatform/container_orchestration/gke/README.md +++ b/nullplatform/container_orchestration/gke/README.md @@ -22,7 +22,7 @@ The module constructs a structured attributes object using locals that merge clu ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.16.0" cluster_name = "your-cluster-name" location = "your-location" diff --git a/nullplatform/container_orchestration/oke/README.md b/nullplatform/container_orchestration/oke/README.md index 565e04899..28fffdb7e 100644 --- a/nullplatform/container_orchestration/oke/README.md +++ b/nullplatform/container_orchestration/oke/README.md @@ -19,7 +19,7 @@ Creates a single nullplatform_provider_config resource of type 'oke' that stores ```hcl module "oke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/oke?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/oke?ref=v6.16.0" cluster_name = "your-cluster-name" nrn = "your-nrn" diff --git a/nullplatform/dimension/README.md b/nullplatform/dimension/README.md index 3a1f69ae6..ad5ba6380 100644 --- a/nullplatform/dimension/README.md +++ b/nullplatform/dimension/README.md @@ -19,7 +19,7 @@ The module creates a nullplatform_dimension resource using the provided name, or ```hcl module "dimension" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension?ref=v6.16.0" name = "your-name" nrn = "your-nrn" diff --git a/nullplatform/dimension_value/README.md b/nullplatform/dimension_value/README.md index d5b020993..e47e13bda 100644 --- a/nullplatform/dimension_value/README.md +++ b/nullplatform/dimension_value/README.md @@ -19,7 +19,7 @@ The module uses a terraform_data resource to enforce mutual-exclusivity and pres ```hcl module "dimension_value" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension_value?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension_value?ref=v6.16.0" dimension_id = "your-dimension-id" name = "your-name" diff --git a/nullplatform/identity-access-control/README.md b/nullplatform/identity-access-control/README.md index 3db0f88a9..4690c62df 100644 --- a/nullplatform/identity-access-control/README.md +++ b/nullplatform/identity-access-control/README.md @@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource named identity ```hcl module "identity-access-control" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/identity-access-control?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/identity-access-control?ref=v6.16.0" attributes = "your-attributes" nrn = "your-nrn" diff --git a/nullplatform/metrics/README.md b/nullplatform/metrics/README.md index 26bf3794b..5689c761d 100644 --- a/nullplatform/metrics/README.md +++ b/nullplatform/metrics/README.md @@ -21,7 +21,7 @@ The module creates a single nullplatform_provider_config resource of type 'prome ```hcl module "metrics" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/metrics?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/metrics?ref=v6.16.0" nrn = "your-nrn" } diff --git a/nullplatform/packaged_service/README.md b/nullplatform/packaged_service/README.md index 7f1cfe13f..467d40f46 100644 --- a/nullplatform/packaged_service/README.md +++ b/nullplatform/packaged_service/README.md @@ -17,7 +17,7 @@ spec updates / republish correctly. ```hcl module "packaged_service" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/packaged_service?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/packaged_service?ref=v6.16.0" nrn = "organization=…:account=…:namespace=…" diff --git a/nullplatform/parameter_storage_configuration/README.md b/nullplatform/parameter_storage_configuration/README.md index 13b7ac5dc..17b8b1371 100644 --- a/nullplatform/parameter_storage_configuration/README.md +++ b/nullplatform/parameter_storage_configuration/README.md @@ -20,7 +20,7 @@ The module delegates entirely to a remote `scope_configuration` module sourced f ```hcl module "parameter_storage_configuration" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_configuration?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_configuration?ref=v6.16.0" attributes = "your-attributes" np_api_key = "your-np-api-key" diff --git a/nullplatform/parameter_storage_definition/README.md b/nullplatform/parameter_storage_definition/README.md index cb92ad8e3..af435eb51 100644 --- a/nullplatform/parameter_storage_definition/README.md +++ b/nullplatform/parameter_storage_definition/README.md @@ -20,7 +20,7 @@ A data.http resource fetches the raw specification template from a configurable ```hcl module "parameter_storage_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition?ref=v6.16.0" np_api_key = "your-np-api-key" nrn = "your-nrn" diff --git a/nullplatform/parameter_storage_definition_agent_association/README.md b/nullplatform/parameter_storage_definition_agent_association/README.md index 269cffc0f..af0a3bad5 100644 --- a/nullplatform/parameter_storage_definition_agent_association/README.md +++ b/nullplatform/parameter_storage_definition_agent_association/README.md @@ -21,7 +21,7 @@ The module creates a terraform_data resource to track API key changes and a null ```hcl module "parameter_storage_definition_agent_association" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition_agent_association?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition_agent_association?ref=v6.16.0" api_key = "your-api-key" nrn = "your-nrn" diff --git a/nullplatform/scope_configuration/README.md b/nullplatform/scope_configuration/README.md index 2e0f718dd..0f929e825 100644 --- a/nullplatform/scope_configuration/README.md +++ b/nullplatform/scope_configuration/README.md @@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource that binds a N ```hcl module "scope_configuration" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_configuration?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_configuration?ref=v6.16.0" attributes = "your-attributes" np_api_key = "your-np-api-key" diff --git a/nullplatform/scope_definition/README.md b/nullplatform/scope_definition/README.md index eae970c1d..aae43f371 100644 --- a/nullplatform/scope_definition/README.md +++ b/nullplatform/scope_definition/README.md @@ -22,7 +22,7 @@ The module fetches JSON templates via data.http resources from a configurable Gi ```hcl module "scope_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition?ref=v6.16.0" np_api_key = "your-np-api-key" nrn = "your-nrn" diff --git a/nullplatform/scope_definition_agent_association/README.md b/nullplatform/scope_definition_agent_association/README.md index 5da92994a..4f8bcb0f9 100644 --- a/nullplatform/scope_definition_agent_association/README.md +++ b/nullplatform/scope_definition_agent_association/README.md @@ -22,7 +22,7 @@ The module fetches a notification channel JSON template via the `data.http` prov ```hcl module "scope_definition_agent_association" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition_agent_association?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition_agent_association?ref=v6.16.0" api_key = "your-api-key" nrn = "your-nrn" diff --git a/nullplatform/service_definition/README.md b/nullplatform/service_definition/README.md index e3df98cd1..d95cc64eb 100644 --- a/nullplatform/service_definition/README.md +++ b/nullplatform/service_definition/README.md @@ -22,7 +22,7 @@ The module uses data.http resources to fetch service-spec, action, and link JSON ```hcl module "service_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.16.0" nrn = "your-nrn" service_name = "your-service-name" diff --git a/nullplatform/service_definition_agent_association/README.md b/nullplatform/service_definition_agent_association/README.md index 2ffc99f69..6516a9f59 100644 --- a/nullplatform/service_definition_agent_association/README.md +++ b/nullplatform/service_definition_agent_association/README.md @@ -22,7 +22,7 @@ The module creates a terraform_data resource to track API key changes as a lifec ```hcl module "service_definition_agent_association" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition_agent_association?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition_agent_association?ref=v6.16.0" api_key = "your-api-key" repository_service_spec_repo = "your-repository-service-spec-repo" diff --git a/nullplatform/users/README.md b/nullplatform/users/README.md index 4e89cf7c8..1aa5f0231 100644 --- a/nullplatform/users/README.md +++ b/nullplatform/users/README.md @@ -21,7 +21,7 @@ The module iterates over a map of user definitions using `nullplatform_user` res ```hcl module "users" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/users?ref=v6.15.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/users?ref=v6.16.0" nullplatform_users = "your-nullplatform-users" } From ded62147a45a86575469353eea5c70ff6c257329 Mon Sep 17 00:00:00 2001 From: Gonzalo Rojas Date: Fri, 14 Aug 2026 17:43:54 -0300 Subject: [PATCH 25/81] fix(gcp/security): resolve the subnetwork in its own project and region (#520) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Follow-up to #512, which fixed the shape of the subnetwork reference but kept resolving it against the configured project and region. The parse reduced `projects/P/regions/R/subnetworks/NAME` to `NAME` and then handed it to `google_compute_subnetwork` with `project = var.gcp_project_id` and `region = var.gcp_region`, discarding the authoritative pair the string carried. Two cases still 404 after #512: - A zonal cluster. `gcp_region` must hold the ZONE, because the same variable is the cluster data source's `location`. The path says `regions/us-central1`; the lookup asks for `us-central1-a`. - A Shared VPC subnet. The path names the host project; the lookup asks the cluster project. The comment's justification for discarding them was also wrong on both counts. It said the attribute "echoes back whatever format the cluster was created with", but the provider normalizes any input through `RelativeLink()` before the call and reads it back from `cluster.NetworkConfig.Subnetwork` — the field even carries `DiffSuppressFunc: CompareSelfLinkOrResourceName` because config and read shapes differ. So it is always the path form, which means #512 fixed a total outage for every consumer with `cluster_name` set, not just clusters created by terraform-google-modules. It also said `google_compute_subnetwork` "only accepts a bare name"; the data source has an optional `self_link`, and its read path derives project, region and name from the link. Now one regex captures all three segments (and tolerates a self_link, since the leading group absorbs the API prefix), with the configured project and region as the fallback for a bare name. Replaces the double `split()` whose two lines had to keep their index arithmetic in sync, and whose null input failed inside `locals` with `argument must not be null`. Also gates the data sources on whether their results are actually needed. Both were gated only on `cluster_name != ""`, so the documented `gcp_network_name` and `network_cidr` overrides did not avoid the reads — every consumer had to hold container.clusters.get and compute.subnetworks.get even when supplying all derived values, and a consumer hitting a shape the parse mishandles had no escape hatch. `network_cidr` now skips the subnetwork read, and both overrides together skip the cluster read as well. Tests: 3 runs to 8. One of the three was vacuous — its two assertions were `length(...) == 1` on values that depend only on the enable flags, so reverting the parse left it green (verified). Nothing asserted `source_ranges` or `network`, which are what the CIDR derivation actually produces, so a regression there would have shipped: `source_ranges = concat([""], ...)` plans fine under mock_provider and only fails at apply — exactly how the original bug escaped. Now asserts the derived CIDR reaches both health-check and private-HTTPS rules, that the network reference passes through unparsed (`google_compute_firewall.network` runs it through `ParseGlobalFieldValue`, so a full path is valid there and must not be trimmed), both override paths, and the self_link and bare-name shapes. Mutation-tested: reverting to the name-only parse, ungating either data source, inverting the network-name override precedence, and trimming the network reference each fail the suite. Co-authored-by: Sebastian Correa --- infrastructure/gcp/security/README.md | 4 +- infrastructure/gcp/security/main.tf | 71 +++++-- .../gcp/security/tests/security.tftest.hcl | 191 +++++++++++++++++- infrastructure/gcp/security/variables.tf | 4 +- 4 files changed, 236 insertions(+), 34 deletions(-) diff --git a/infrastructure/gcp/security/README.md b/infrastructure/gcp/security/README.md index 36dfd06a6..f0a06ae5c 100644 --- a/infrastructure/gcp/security/README.md +++ b/infrastructure/gcp/security/README.md @@ -68,10 +68,10 @@ resource "example_resource" "this" { | [cluster\_name](#input\_cluster\_name) | The GKE cluster name, used for naming firewall rules and deriving network. | `string` | n/a | yes | | [gateway\_internal\_enabled](#input\_gateway\_internal\_enabled) | Whether the internal (private) gateway is enabled. | `bool` | `false` | no | | [gateways\_enabled](#input\_gateways\_enabled) | Whether public gateways are enabled. | `bool` | `true` | no | -| [gcp\_network\_name](#input\_gcp\_network\_name) | Override: The VPC network name. If empty, derived from cluster. | `string` | `""` | no | +| [gcp\_network\_name](#input\_gcp\_network\_name) | Override: The VPC network name. If empty, derived from the cluster. Supplying this together with network\_cidr skips the cluster and subnetwork lookups entirely, so the caller does not need container.clusters.get or compute.subnetworks.get. Accepts a bare name or a full projects/P/global/networks/N path — google\_compute\_firewall normalizes either | `string` | `""` | no | | [gcp\_project\_id](#input\_gcp\_project\_id) | The GCP project ID. | `string` | n/a | yes | | [gcp\_region](#input\_gcp\_region) | The GCP region where the GKE cluster is located. | `string` | n/a | yes | -| [network\_cidr](#input\_network\_cidr) | Override: The network CIDR block. If empty, derived from subnet. | `string` | `""` | no | +| [network\_cidr](#input\_network\_cidr) | Override: The network CIDR block. If empty, derived from the cluster's subnetwork. Supplying it skips the subnetwork lookup. Needed when the derived path cannot be resolved by the caller's credentials, e.g. a Shared VPC subnet in a host project the module cannot read | `string` | `""` | no | ## Outputs diff --git a/infrastructure/gcp/security/main.tf b/infrastructure/gcp/security/main.tf index 8bc1eeaba..2c22ffd68 100644 --- a/infrastructure/gcp/security/main.tf +++ b/infrastructure/gcp/security/main.tf @@ -13,9 +13,13 @@ locals { # DATA SOURCES - Derive network and CIDR from cluster name ############################################################################### -# Get GKE cluster info +# Get GKE cluster info. +# +# Skipped entirely when the caller supplies both derived values, so the module does +# not require container.clusters.get / compute.subnetworks.get just to build firewall +# rules from values it was handed. data "google_container_cluster" "this" { - count = var.cluster_name != "" ? 1 : 0 + count = var.cluster_name != "" && (var.gcp_network_name == "" || var.network_cidr == "") ? 1 : 0 name = var.cluster_name location = var.gcp_region project = var.gcp_project_id @@ -37,32 +41,59 @@ data "google_container_cluster" "this" { } locals { - # google_container_cluster.subnetwork is documented as the subnetwork name, - # but in practice it echoes back whatever format the cluster was created - # with — a bare name, or (e.g. when created via a module that passes a full - # reference, such as terraform-google-modules/kubernetes-engine) the full - # "projects/.../regions/.../subnetworks/NAME" path. google_compute_subnetwork - # only accepts a bare name, so take the last path segment either way. - cluster_subnetwork_name = var.cluster_name != "" ? element( - split("/", data.google_container_cluster.this[0].subnetwork), - length(split("/", data.google_container_cluster.this[0].subnetwork)) - 1 - ) : "" + subnetwork_ref = try(one(data.google_container_cluster.this[*].subnetwork), null) + + # The GKE API always returns networkConfig.subnetwork as a RELATIVE RESOURCE PATH + # (projects/P/regions/R/subnetworks/NAME): the provider normalizes whatever the + # config supplied through RelativeLink() before the call and reads the value back + # from cluster.NetworkConfig.Subnetwork. The field even carries + # DiffSuppressFunc: CompareSelfLinkOrResourceName precisely because the config and + # read shapes differ. So this is not "whatever format the cluster was created + # with" — every cluster with cluster_name set hits the path form. + # + # Capture all three segments rather than only the name. The name alone is not + # enough: google_compute_subnetwork resolves it against the project and region it + # is given, and the path may legitimately name a different region (a zonal cluster + # passes its ZONE as gcp_region, since that doubles as the cluster's location) or a + # different project (Shared VPC, where the subnet lives in the host project). + # Discarding them turns those cases into a 404. + # + # The regex also matches a self_link (the leading (?:.*/)? absorbs the + # https://www.googleapis.com/compute/v1/ prefix). A bare name matches nothing and + # falls through to the configured project/region below. + subnetwork_parts = local.subnetwork_ref == null ? null : try( + regex("^(?:.*/)?projects/(?P[^/]+)/regions/(?P[^/]+)/subnetworks/(?P[^/]+)$", local.subnetwork_ref), + null + ) + + cluster_subnetwork_name = try(local.subnetwork_parts.name, local.subnetwork_ref, "") + cluster_subnetwork_region = try(local.subnetwork_parts.region, var.gcp_region) + cluster_subnetwork_project = try(local.subnetwork_parts.project, var.gcp_project_id) } # Get subnetwork info to derive CIDR data "google_compute_subnetwork" "this" { - count = var.cluster_name != "" ? 1 : 0 + count = var.cluster_name != "" && var.network_cidr == "" ? 1 : 0 name = local.cluster_subnetwork_name - region = var.gcp_region - project = var.gcp_project_id + region = local.cluster_subnetwork_region + project = local.cluster_subnetwork_project } locals { - # Derived values from data sources - gcp_network_name = var.cluster_name != "" ? data.google_container_cluster.this[0].network : "" - gcp_subnet_cidr = var.cluster_name != "" ? data.google_compute_subnetwork.this[0].ip_cidr_range : "" - - # Use override if provided, otherwise use derived value + # Derived values from data sources. one() yields null when the data source was + # skipped, so the override branches below stay reachable. + # Not coalesce(): it discards empty strings as well as nulls and errors when every + # argument is empty. + derived_network_name = try(one(data.google_container_cluster.this[*].network), null) + derived_subnet_cidr = try(one(data.google_compute_subnetwork.this[*].ip_cidr_range), null) + + gcp_network_name = local.derived_network_name != null ? local.derived_network_name : "" + gcp_subnet_cidr = local.derived_subnet_cidr != null ? local.derived_subnet_cidr : "" + + # Use override if provided, otherwise use derived value. + # google_compute_firewall.network runs its value through ParseGlobalFieldValue, so + # a full projects/P/global/networks/N path is accepted here and deliberately left + # unparsed — only the subnetwork data source lacks that normalization. effective_network_name = var.gcp_network_name != "" ? var.gcp_network_name : local.gcp_network_name effective_network_cidr = var.network_cidr != "" ? var.network_cidr : local.gcp_subnet_cidr } diff --git a/infrastructure/gcp/security/tests/security.tftest.hcl b/infrastructure/gcp/security/tests/security.tftest.hcl index 87f74233c..fa1ad9587 100644 --- a/infrastructure/gcp/security/tests/security.tftest.hcl +++ b/infrastructure/gcp/security/tests/security.tftest.hcl @@ -6,24 +6,67 @@ variables { gcp_region = "us-central1" } -run "subnetwork_name_extracted_from_full_resource_path" { +############################################################################### +# Subnetwork reference parsing +# +# The GKE API always returns a relative resource path, so that is the shape that +# matters. The other two are covered so a later "simplification" to a fixed index +# or basename() cannot pass silently. +############################################################################### + +run "relative_resource_path_yields_name_region_and_project" { command = plan override_data { target = data.google_container_cluster.this values = { - subnetwork = "projects/myorg-project/regions/us-central1/subnetworks/subnet-gke" + subnetwork = "projects/host-project/regions/europe-west4/subnetworks/subnet-gke" + network = "myorg-vpc" + } + } + + assert { + condition = local.cluster_subnetwork_name == "subnet-gke" + error_message = "Should extract the bare subnetwork name from a full resource path" + } + + # These two are the point of the change: the path names a project and region that + # differ from the configured ones, and resolving the subnetwork against the + # configured pair would 404. + assert { + condition = local.cluster_subnetwork_region == "europe-west4" + error_message = "The region from the resource path must win over gcp_region, or a zonal cluster (whose gcp_region is a zone) and a cross-region subnet both 404" + } + + assert { + condition = local.cluster_subnetwork_project == "host-project" + error_message = "The project from the resource path must win over gcp_project_id, or a Shared VPC subnet in the host project 404s" + } +} + +run "self_link_is_parsed_too" { + command = plan + + override_data { + target = data.google_container_cluster.this + values = { + subnetwork = "https://www.googleapis.com/compute/v1/projects/host-project/regions/europe-west4/subnetworks/subnet-gke" network = "myorg-vpc" } } assert { condition = local.cluster_subnetwork_name == "subnet-gke" - error_message = "Should extract the bare subnetwork name when the cluster's subnetwork attribute is a full resource path" + error_message = "A self_link must parse to the same name" + } + + assert { + condition = local.cluster_subnetwork_region == "europe-west4" && local.cluster_subnetwork_project == "host-project" + error_message = "A self_link must yield the same region and project as the relative path" } } -run "subnetwork_name_passthrough_when_already_bare" { +run "bare_name_falls_back_to_the_configured_project_and_region" { command = plan override_data { @@ -36,13 +79,103 @@ run "subnetwork_name_passthrough_when_already_bare" { assert { condition = local.cluster_subnetwork_name == "subnet-gke" - error_message = "Should pass through an already-bare subnetwork name unchanged" + error_message = "A bare subnetwork name must pass through unchanged" + } + + assert { + condition = local.cluster_subnetwork_region == "us-central1" && local.cluster_subnetwork_project == "myorg-project" + error_message = "With no path to parse, the configured region and project must be used" } } -run "firewall_rules_created_for_both_gateways" { +############################################################################### +# Firewall wiring +# +# Asserting on counts alone is vacuous: they depend only on the enable flags, so +# reverting the parse leaves them green. These assert the values the derivation +# actually produces. +############################################################################### + +run "public_health_check_allows_the_subnet_cidr_and_gcp_probes" { command = plan + variables { + gateways_enabled = true + gateway_internal_enabled = true + } + + override_data { + target = data.google_container_cluster.this + values = { + subnetwork = "projects/myorg-project/regions/us-central1/subnetworks/subnet-gke" + network = "projects/myorg-project/global/networks/myorg-vpc" + } + } + + override_data { + target = data.google_compute_subnetwork.this + values = { + ip_cidr_range = "10.20.0.0/20" + } + } + + assert { + condition = google_compute_firewall.public_gateway_health_check[0].source_ranges == toset(["10.20.0.0/20", "35.191.0.0/16", "130.211.0.0/22"]) + error_message = "The health-check rule must allow the derived subnet CIDR plus both GCP health check ranges" + } + + assert { + condition = google_compute_firewall.private_gateway_https[0].source_ranges == toset(["10.20.0.0/20"]) + error_message = "The private HTTPS rule must be restricted to the derived subnet CIDR" + } + + # The network value is deliberately NOT parsed: google_compute_firewall.network + # runs it through ParseGlobalFieldValue, so a full path is valid there. + assert { + condition = google_compute_firewall.public_gateway_https[0].network == "projects/myorg-project/global/networks/myorg-vpc" + error_message = "The network reference must pass through unparsed" + } + + assert { + condition = length(google_compute_firewall.public_gateway_https) == 1 && length(google_compute_firewall.private_gateway_https) == 1 + error_message = "Both gateways' rules should be created when both flags are true" + } +} + +run "gateways_can_be_disabled_independently" { + command = plan + + variables { + gateways_enabled = false + gateway_internal_enabled = true + } + + override_data { + target = data.google_container_cluster.this + values = { + subnetwork = "projects/myorg-project/regions/us-central1/subnetworks/subnet-gke" + network = "myorg-vpc" + } + } + + assert { + condition = length(google_compute_firewall.public_gateway_https) == 0 && length(google_compute_firewall.private_gateway_https) == 1 + error_message = "gateways_enabled must gate only the public rules" + } +} + +############################################################################### +# Overrides +############################################################################### + +run "network_cidr_override_wins_and_skips_the_subnetwork_lookup" { + command = plan + + variables { + gateway_internal_enabled = true + network_cidr = "192.168.0.0/24" + } + override_data { target = data.google_container_cluster.this values = { @@ -51,18 +184,56 @@ run "firewall_rules_created_for_both_gateways" { } } + assert { + condition = local.effective_network_cidr == "192.168.0.0/24" + error_message = "An explicit network_cidr must win over the derived value" + } + + assert { + condition = length(data.google_compute_subnetwork.this) == 0 + error_message = "With network_cidr supplied there is nothing to derive, so the subnetwork lookup must be skipped rather than requiring compute.subnetworks.get" + } +} + +run "both_overrides_skip_the_cluster_lookup_entirely" { + command = plan + variables { gateways_enabled = true gateway_internal_enabled = true + gcp_network_name = "myorg-vpc" + network_cidr = "192.168.0.0/24" + } + + assert { + condition = length(data.google_container_cluster.this) == 0 && length(data.google_compute_subnetwork.this) == 0 + error_message = "With both values supplied the module must not read the cluster at all, so it does not need container.clusters.get" } assert { - condition = length(google_compute_firewall.public_gateway_https) == 1 - error_message = "Public HTTPS firewall rule should be created when gateways_enabled is true" + condition = google_compute_firewall.private_gateway_https[0].source_ranges == toset(["192.168.0.0/24"]) + error_message = "The rules must still be built from the supplied values" + } +} + +run "gcp_network_name_override_wins" { + command = plan + + variables { + gateways_enabled = true + gcp_network_name = "override-vpc" + } + + override_data { + target = data.google_container_cluster.this + values = { + subnetwork = "projects/myorg-project/regions/us-central1/subnetworks/subnet-gke" + network = "derived-vpc" + } } assert { - condition = length(google_compute_firewall.private_gateway_https) == 1 - error_message = "Private HTTPS firewall rule should be created when gateway_internal_enabled is true" + condition = google_compute_firewall.public_gateway_https[0].network == "override-vpc" + error_message = "An explicit gcp_network_name must win over the derived network" } } diff --git a/infrastructure/gcp/security/variables.tf b/infrastructure/gcp/security/variables.tf index a888f7702..bd17189fc 100644 --- a/infrastructure/gcp/security/variables.tf +++ b/infrastructure/gcp/security/variables.tf @@ -27,12 +27,12 @@ variable "gateway_internal_enabled" { variable "gcp_network_name" { type = string - description = "Override: The VPC network name. If empty, derived from cluster." + description = "Override: The VPC network name. If empty, derived from the cluster. Supplying this together with network_cidr skips the cluster and subnetwork lookups entirely, so the caller does not need container.clusters.get or compute.subnetworks.get. Accepts a bare name or a full projects/P/global/networks/N path — google_compute_firewall normalizes either" default = "" } variable "network_cidr" { type = string - description = "Override: The network CIDR block. If empty, derived from subnet." + description = "Override: The network CIDR block. If empty, derived from the cluster's subnetwork. Supplying it skips the subnetwork lookup. Needed when the derived path cannot be resolved by the caller's credentials, e.g. a Shared VPC subnet in a host project the module cannot read" default = "" } From f9dcb8122dac9122160cacf9a68dbcc89dc3f537 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Fri, 14 Aug 2026 20:44:39 +0000 Subject: [PATCH 26/81] chore(6.x): release 6.16.1 --- CHANGELOG.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index ca76b1e4c..ac11b3a69 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,12 @@ # Changelog +## [6.16.1](https://github.com/nullplatform/tofu-modules/compare/v6.16.0...v6.16.1) (2026-08-14) + + +### Bug Fixes + +* **gcp/security:** resolve the subnetwork in its own project and region ([#520](https://github.com/nullplatform/tofu-modules/issues/520)) ([0b8f322](https://github.com/nullplatform/tofu-modules/commit/0b8f322f600de9e80630bd09764a421cc5249c20)) + ## [6.16.0](https://github.com/nullplatform/tofu-modules/compare/v6.15.0...v6.16.0) (2026-08-14) From f48399b45e79aa84a25e9c42ca10efa9badc7c2a Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Fri, 14 Aug 2026 20:45:14 +0000 Subject: [PATCH 27/81] docs: regenerate READMEs for changed modules and update versions --- infrastructure/aws/acm/README.md | 2 +- .../aws_load_balancer_controller/README.md | 2 +- infrastructure/aws/backend/README.md | 2 +- infrastructure/aws/dns/README.md | 2 +- infrastructure/aws/eks/README.md | 2 +- infrastructure/aws/iam/agent/README.md | 2 +- .../README.md | 2 +- infrastructure/aws/iam/cert_manager/README.md | 2 +- .../aws/iam/ci-build-workflow-user/README.md | 2 +- infrastructure/aws/iam/cloudwatch/README.md | 2 +- infrastructure/aws/iam/ecr/README.md | 2 +- infrastructure/aws/iam/external_dns/README.md | 2 +- infrastructure/aws/iam/s3/README.md | 2 +- infrastructure/aws/ingress/README.md | 2 +- infrastructure/aws/security/README.md | 2 +- infrastructure/aws/vpc/README.md | 2 +- infrastructure/azure/acr/README.md | 2 +- infrastructure/azure/aks/README.md | 2 +- .../azure/aks_route_table/README.md | 2 +- infrastructure/azure/dns/README.md | 2 +- infrastructure/azure/iam/README.md | 2 +- infrastructure/azure/private_dns/README.md | 2 +- infrastructure/azure/resource_group/README.md | 2 +- infrastructure/azure/security/README.md | 2 +- infrastructure/azure/vnet/README.md | 2 +- infrastructure/commons/cert_manager/README.md | 12 +++--- infrastructure/commons/external_dns/README.md | 12 +++--- infrastructure/commons/istio/README.md | 2 +- infrastructure/commons/prometheus/README.md | 2 +- .../gcp/artifact-registry/README.md | 2 +- infrastructure/gcp/backend/README.md | 2 +- infrastructure/gcp/cloud-dns/README.md | 2 +- infrastructure/gcp/cloud-nat/README.md | 2 +- infrastructure/gcp/gke/README.md | 6 +-- infrastructure/gcp/iam/README.md | 2 +- infrastructure/gcp/security/README.md | 42 ++++++++++--------- infrastructure/gcp/vpc/README.md | 2 +- infrastructure/oci/backend/README.md | 2 +- infrastructure/oci/dns/README.md | 2 +- infrastructure/oci/dynamic_groups/README.md | 2 +- infrastructure/oci/oke/README.md | 2 +- infrastructure/oci/vcn/README.md | 2 +- nullplatform/account/README.md | 2 +- nullplatform/agent/README.md | 10 ++--- nullplatform/api_key/README.md | 10 ++--- nullplatform/asset/docker_server/README.md | 2 +- nullplatform/asset/ecr/README.md | 2 +- nullplatform/asset/s3/README.md | 2 +- nullplatform/base/README.md | 12 +++--- nullplatform/cloud/aws/cloud/README.md | 2 +- nullplatform/cloud/aws/vpc/README.md | 2 +- nullplatform/cloud/azure/cloud/README.md | 2 +- nullplatform/cloud/gcp/cloud/README.md | 2 +- nullplatform/cloud/oci/cloud/README.md | 2 +- nullplatform/code_repository/README.md | 10 ++--- .../container_orchestration/aks/README.md | 2 +- .../container_orchestration/eks/README.md | 2 +- .../container_orchestration/gke/README.md | 2 +- .../container_orchestration/oke/README.md | 2 +- nullplatform/dimension/README.md | 2 +- nullplatform/dimension_value/README.md | 2 +- .../identity-access-control/README.md | 2 +- nullplatform/metrics/README.md | 2 +- nullplatform/packaged_service/README.md | 2 +- .../parameter_storage_configuration/README.md | 2 +- .../parameter_storage_definition/README.md | 2 +- .../README.md | 2 +- nullplatform/scope_configuration/README.md | 2 +- nullplatform/scope_definition/README.md | 2 +- .../README.md | 2 +- nullplatform/service_definition/README.md | 2 +- .../README.md | 2 +- nullplatform/users/README.md | 2 +- 73 files changed, 123 insertions(+), 121 deletions(-) diff --git a/infrastructure/aws/acm/README.md b/infrastructure/aws/acm/README.md index 26560e314..f8a0c26d7 100644 --- a/infrastructure/aws/acm/README.md +++ b/infrastructure/aws/acm/README.md @@ -18,7 +18,7 @@ The module creates an aws_acm_certificate resource with DNS validation, which is ```hcl module "acm" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/acm?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/acm?ref=v6.16.1" domain_name = "your-domain-name" zone_id = "your-zone-id" diff --git a/infrastructure/aws/aws_load_balancer_controller/README.md b/infrastructure/aws/aws_load_balancer_controller/README.md index 977467182..e6d8b09ea 100644 --- a/infrastructure/aws/aws_load_balancer_controller/README.md +++ b/infrastructure/aws/aws_load_balancer_controller/README.md @@ -18,7 +18,7 @@ This module creates a helm_release resource to deploy the AWS Load Balancer Cont ```hcl module "aws_load_balancer_controller" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/aws_load_balancer_controller?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/aws_load_balancer_controller?ref=v6.16.1" cluster_name = "your-cluster-name" vpc_id = "your-vpc-id" diff --git a/infrastructure/aws/backend/README.md b/infrastructure/aws/backend/README.md index 7b5c9a567..dc57e5455 100644 --- a/infrastructure/aws/backend/README.md +++ b/infrastructure/aws/backend/README.md @@ -20,7 +20,7 @@ This module creates an S3 bucket with versioning and server-side encryption enab ```hcl module "backend" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/backend?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/backend?ref=v6.16.1" } ``` diff --git a/infrastructure/aws/dns/README.md b/infrastructure/aws/dns/README.md index 8dd150749..d7e6b1979 100644 --- a/infrastructure/aws/dns/README.md +++ b/infrastructure/aws/dns/README.md @@ -21,7 +21,7 @@ The module conditionally creates an aws_route53_zone resource for a public hoste ```hcl module "dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/dns?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/dns?ref=v6.16.1" domain_name = "your-domain-name" vpc_id = "your-vpc-id" diff --git a/infrastructure/aws/eks/README.md b/infrastructure/aws/eks/README.md index 7c7545d91..8d9ca74b6 100644 --- a/infrastructure/aws/eks/README.md +++ b/infrastructure/aws/eks/README.md @@ -22,7 +22,7 @@ The module wraps terraform-aws-modules/eks to create the EKS cluster (aws_eks_cl ```hcl module "eks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/eks?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/eks?ref=v6.16.1" aws_subnets_private_ids = "your-aws-subnets-private-ids" aws_vpc_vpc_id = "your-aws-vpc-vpc-id" diff --git a/infrastructure/aws/iam/agent/README.md b/infrastructure/aws/iam/agent/README.md index 02ddacf95..e15b27ae6 100644 --- a/infrastructure/aws/iam/agent/README.md +++ b/infrastructure/aws/iam/agent/README.md @@ -21,7 +21,7 @@ The module uses the terraform-aws-modules/iam//modules/iam-role-for-service-acco ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/agent?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/agent?ref=v6.16.1" agent_namespace = "your-agent-namespace" aws_iam_openid_connect_provider_arn = "your-aws-iam-openid-connect-provider-arn" diff --git a/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md b/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md index d560e47b9..e1b2dd4d4 100644 --- a/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md +++ b/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md @@ -19,7 +19,7 @@ This module creates an IAM role for the AWS Load Balancer Controller using the t ```hcl module "aws_load_balancer_controller_iam" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/aws_load_balancer_controller_iam?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/aws_load_balancer_controller_iam?ref=v6.16.1" aws_iam_openid_connect_provider_arn = "your-aws-iam-openid-connect-provider-arn" cluster_name = "your-cluster-name" diff --git a/infrastructure/aws/iam/cert_manager/README.md b/infrastructure/aws/iam/cert_manager/README.md index b335b37be..8e0ac9ef8 100644 --- a/infrastructure/aws/iam/cert_manager/README.md +++ b/infrastructure/aws/iam/cert_manager/README.md @@ -20,7 +20,7 @@ An aws_iam_policy resource is always created granting route53:GetChange, route53 ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cert_manager?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cert_manager?ref=v6.16.1" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/ci-build-workflow-user/README.md b/infrastructure/aws/iam/ci-build-workflow-user/README.md index 8e3dd044d..b4df8470c 100644 --- a/infrastructure/aws/iam/ci-build-workflow-user/README.md +++ b/infrastructure/aws/iam/ci-build-workflow-user/README.md @@ -21,7 +21,7 @@ The module creates an aws_iam_user named with the cluster_name prefix and genera ```hcl module "ci-build-workflow-user" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ci-build-workflow-user?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ci-build-workflow-user?ref=v6.16.1" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/cloudwatch/README.md b/infrastructure/aws/iam/cloudwatch/README.md index 9903e07e6..a51ffac8e 100644 --- a/infrastructure/aws/iam/cloudwatch/README.md +++ b/infrastructure/aws/iam/cloudwatch/README.md @@ -20,7 +20,7 @@ The module creates an aws_iam_policy granting CloudWatch Logs and Metrics write ```hcl module "cloudwatch" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cloudwatch?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cloudwatch?ref=v6.16.1" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/ecr/README.md b/infrastructure/aws/iam/ecr/README.md index 041e27342..610849d5d 100644 --- a/infrastructure/aws/iam/ecr/README.md +++ b/infrastructure/aws/iam/ecr/README.md @@ -20,7 +20,7 @@ The module creates an aws_iam_role named nullplatform-{cluster_name}-application ```hcl module "ecr" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ecr?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ecr?ref=v6.16.1" build_workflow_group_name = "your-build-workflow-group-name" cluster_name = "your-cluster-name" diff --git a/infrastructure/aws/iam/external_dns/README.md b/infrastructure/aws/iam/external_dns/README.md index 9b02157d4..5eccb3d74 100644 --- a/infrastructure/aws/iam/external_dns/README.md +++ b/infrastructure/aws/iam/external_dns/README.md @@ -20,7 +20,7 @@ An aws_iam_policy resource named nullplatform_external_dns_policy is always crea ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/external_dns?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/external_dns?ref=v6.16.1" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/s3/README.md b/infrastructure/aws/iam/s3/README.md index 0931867ff..caf2b7cbc 100644 --- a/infrastructure/aws/iam/s3/README.md +++ b/infrastructure/aws/iam/s3/README.md @@ -18,7 +18,7 @@ The module creates an aws_iam_policy resource that allows s3:PutObject and s3:Ge ```hcl module "s3" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/s3?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/s3?ref=v6.16.1" bucket = "your-bucket" build_workflow_group_name = "your-build-workflow-group-name" diff --git a/infrastructure/aws/ingress/README.md b/infrastructure/aws/ingress/README.md index a4d963415..e62816735 100644 --- a/infrastructure/aws/ingress/README.md +++ b/infrastructure/aws/ingress/README.md @@ -22,7 +22,7 @@ The module creates up to two kubernetes_ingress_v1 resources — one for an inte ```hcl module "ingress" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/ingress?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/ingress?ref=v6.16.1" certificate_arn = "your-certificate-arn" } diff --git a/infrastructure/aws/security/README.md b/infrastructure/aws/security/README.md index c0aa85339..617789f4e 100644 --- a/infrastructure/aws/security/README.md +++ b/infrastructure/aws/security/README.md @@ -22,7 +22,7 @@ The module uses data sources (aws_eks_cluster, aws_vpc) to automatically derive ```hcl module "security" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/security?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/security?ref=v6.16.1" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/vpc/README.md b/infrastructure/aws/vpc/README.md index ec27a10e1..61fca657a 100644 --- a/infrastructure/aws/vpc/README.md +++ b/infrastructure/aws/vpc/README.md @@ -22,7 +22,7 @@ This module creates a terraform-aws-modules/vpc/aws module resource with DNS hos ```hcl module "vpc" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/vpc?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/vpc?ref=v6.16.1" account = "your-account" organization = "your-organization" diff --git a/infrastructure/azure/acr/README.md b/infrastructure/azure/acr/README.md index b74c3f296..ff424862f 100644 --- a/infrastructure/azure/acr/README.md +++ b/infrastructure/azure/acr/README.md @@ -18,7 +18,7 @@ The module uses the azurerm_container_registry resource to create the container ```hcl module "acr" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/acr?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/acr?ref=v6.16.1" containerregistry_name = "your-containerregistry-name" location = "your-location" diff --git a/infrastructure/azure/aks/README.md b/infrastructure/azure/aks/README.md index 72849d435..5266d95fa 100644 --- a/infrastructure/azure/aks/README.md +++ b/infrastructure/azure/aks/README.md @@ -22,7 +22,7 @@ The module wraps the Azure/aks/azurerm community module (version 11.0.0) and use ```hcl module "aks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks?ref=v6.16.1" cluster_name = "your-cluster-name" location = "your-location" diff --git a/infrastructure/azure/aks_route_table/README.md b/infrastructure/azure/aks_route_table/README.md index 4b5ea642e..73da8e0ee 100644 --- a/infrastructure/azure/aks_route_table/README.md +++ b/infrastructure/azure/aks_route_table/README.md @@ -19,7 +19,7 @@ The module uses an azurerm_resources data source to discover the AKS-managed rou ```hcl module "aks_route_table" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks_route_table?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks_route_table?ref=v6.16.1" node_resource_group = "your-node-resource-group" subnet_id = "your-subnet-id" diff --git a/infrastructure/azure/dns/README.md b/infrastructure/azure/dns/README.md index c055fadaf..fdf7f3d07 100644 --- a/infrastructure/azure/dns/README.md +++ b/infrastructure/azure/dns/README.md @@ -18,7 +18,7 @@ This module creates an azurerm_dns_zone resource and configures it with the prov ```hcl module "dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/dns?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/dns?ref=v6.16.1" domain_name = "your-domain-name" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/iam/README.md b/infrastructure/azure/iam/README.md index 970d59693..6d39f44d3 100644 --- a/infrastructure/azure/iam/README.md +++ b/infrastructure/azure/iam/README.md @@ -21,7 +21,7 @@ The module creates an azurerm_user_assigned_identity resource in the specified r ```hcl module "iam" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/iam?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/iam?ref=v6.16.1" location = "your-location" name = "your-name" diff --git a/infrastructure/azure/private_dns/README.md b/infrastructure/azure/private_dns/README.md index 7c4bcc61b..b0957bf13 100644 --- a/infrastructure/azure/private_dns/README.md +++ b/infrastructure/azure/private_dns/README.md @@ -18,7 +18,7 @@ This module creates an azurerm_private_dns_zone resource and optionally multiple ```hcl module "private_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/private_dns?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/private_dns?ref=v6.16.1" domain_name = "your-domain-name" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/resource_group/README.md b/infrastructure/azure/resource_group/README.md index ca03c42ac..b606c330a 100644 --- a/infrastructure/azure/resource_group/README.md +++ b/infrastructure/azure/resource_group/README.md @@ -18,7 +18,7 @@ This module creates an azurerm_resource_group resource and outputs its name and ```hcl module "resource_group" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/resource_group?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/resource_group?ref=v6.16.1" location = "your-location" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/security/README.md b/infrastructure/azure/security/README.md index 2f2867b18..9c8437022 100644 --- a/infrastructure/azure/security/README.md +++ b/infrastructure/azure/security/README.md @@ -21,7 +21,7 @@ The module uses azurerm_kubernetes_cluster and azurerm_virtual_network data sour ```hcl module "security" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/security?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/security?ref=v6.16.1" cluster_name = "your-cluster-name" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/vnet/README.md b/infrastructure/azure/vnet/README.md index 94364d095..8d310c2e3 100644 --- a/infrastructure/azure/vnet/README.md +++ b/infrastructure/azure/vnet/README.md @@ -18,7 +18,7 @@ This module creates an Azure virtual network using the azurerm provider and conf ```hcl module "vnet" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/vnet?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/vnet?ref=v6.16.1" address_space = "your-address-space" location = "your-location" diff --git a/infrastructure/commons/cert_manager/README.md b/infrastructure/commons/cert_manager/README.md index 125f4c22b..216e7e1c4 100644 --- a/infrastructure/commons/cert_manager/README.md +++ b/infrastructure/commons/cert_manager/README.md @@ -22,7 +22,7 @@ Two primary helm_release resources are created: cert-manager from the Jetstack c ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.16.1" account_slug = "your-account-slug" cloud_provider = "your-cloud-provider" @@ -35,7 +35,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.16.1" account_slug = "your-account-slug" cloud_provider = "gcp" @@ -50,7 +50,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.16.1" account_slug = "your-account-slug" azure_client_id = "your-azure-client-id" # Required when cloud_provider = "azure" @@ -68,7 +68,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.16.1" account_slug = "your-account-slug" cloud_provider = "cloudflare" @@ -83,7 +83,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.16.1" account_slug = "your-account-slug" aws_identity_mode = "your-aws-identity-mode" # Required when cloud_provider = "aws" @@ -99,7 +99,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.16.1" account_slug = "your-account-slug" cert_manager_webhook_oci_namespace = "your-cert-manager-webhook-oci-namespace" # Required when cloud_provider = "oci" diff --git a/infrastructure/commons/external_dns/README.md b/infrastructure/commons/external_dns/README.md index db4a6ef5e..3073d037c 100644 --- a/infrastructure/commons/external_dns/README.md +++ b/infrastructure/commons/external_dns/README.md @@ -22,7 +22,7 @@ The module creates an optional kubernetes_namespace_v1 resource when create_name ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.16.1" dns_provider_name = "your-dns-provider-name" domain_filters = "your-domain-filters" @@ -33,7 +33,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.16.1" cloudflare_token = "your-cloudflare-token" # Required when dns_provider_name = "cloudflare" dns_provider_name = "cloudflare" @@ -45,7 +45,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.16.1" aws_iam_role_arn = "your-aws-iam-role-arn" # Required when dns_provider_name = "aws" aws_identity_mode = "your-aws-identity-mode" # Required when dns_provider_name = "aws" @@ -61,7 +61,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.16.1" dns_provider_name = "oci" domain_filters = "your-domain-filters" @@ -77,7 +77,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.16.1" azure_client_id = "your-azure-client-id" # Required when dns_provider_name = "azure" azure_federated_credential_id = "your-azure-federated-credential-id" # Required when dns_provider_name = "azure" @@ -94,7 +94,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.16.1" azure_client_id = "your-azure-client-id" # Required when dns_provider_name = "azure-private-dns" azure_federated_credential_id = "your-azure-federated-credential-id" # Required when dns_provider_name = "azure-private-dns" diff --git a/infrastructure/commons/istio/README.md b/infrastructure/commons/istio/README.md index 977ba1bec..8d7c094d8 100644 --- a/infrastructure/commons/istio/README.md +++ b/infrastructure/commons/istio/README.md @@ -21,7 +21,7 @@ Three helm_release resources are created in a strict dependency chain: istio-bas ```hcl module "istio" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/istio?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/istio?ref=v6.16.1" } ``` diff --git a/infrastructure/commons/prometheus/README.md b/infrastructure/commons/prometheus/README.md index 514f41f2f..42ac5fbf5 100644 --- a/infrastructure/commons/prometheus/README.md +++ b/infrastructure/commons/prometheus/README.md @@ -18,7 +18,7 @@ This module creates a helm_release resource to deploy the Prometheus chart from ```hcl module "prometheus" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.16.1" } ``` diff --git a/infrastructure/gcp/artifact-registry/README.md b/infrastructure/gcp/artifact-registry/README.md index 9f1bcc5fb..14ffe7a36 100644 --- a/infrastructure/gcp/artifact-registry/README.md +++ b/infrastructure/gcp/artifact-registry/README.md @@ -21,7 +21,7 @@ The module creates a google_artifact_registry_repository resource configured wit ```hcl module "artifact-registry" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/artifact-registry?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/artifact-registry?ref=v6.16.1" location = "your-location" project_id = "your-project-id" diff --git a/infrastructure/gcp/backend/README.md b/infrastructure/gcp/backend/README.md index 1e869178c..90b331e20 100644 --- a/infrastructure/gcp/backend/README.md +++ b/infrastructure/gcp/backend/README.md @@ -22,7 +22,7 @@ The module creates a random_id resource to generate a unique 8-byte hex suffix, ```hcl module "backend" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/backend?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/backend?ref=v6.16.1" project_id = "your-project-id" } diff --git a/infrastructure/gcp/cloud-dns/README.md b/infrastructure/gcp/cloud-dns/README.md index e670761cc..da93ceb79 100644 --- a/infrastructure/gcp/cloud-dns/README.md +++ b/infrastructure/gcp/cloud-dns/README.md @@ -21,7 +21,7 @@ The module creates a single google_dns_managed_zone resource in the specified GC ```hcl module "cloud-dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-dns?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-dns?ref=v6.16.1" domain_name = "your-domain-name" project_id = "your-project-id" diff --git a/infrastructure/gcp/cloud-nat/README.md b/infrastructure/gcp/cloud-nat/README.md index 60ad779cb..750c0af78 100644 --- a/infrastructure/gcp/cloud-nat/README.md +++ b/infrastructure/gcp/cloud-nat/README.md @@ -19,7 +19,7 @@ This module creates a google_compute_router resource in a specified region and n ```hcl module "cloud-nat" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-nat?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-nat?ref=v6.16.1" nat_name = "your-nat-name" network_id = "your-network-id" diff --git a/infrastructure/gcp/gke/README.md b/infrastructure/gcp/gke/README.md index 30eba6f8f..9ecf08c07 100644 --- a/infrastructure/gcp/gke/README.md +++ b/infrastructure/gcp/gke/README.md @@ -22,7 +22,7 @@ The module conditionally creates one of two mutually-exclusive submodules based ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.16.1" cluster_name = "your-cluster-name" ip_range_pods = "your-ip-range-pods" @@ -38,7 +38,7 @@ module "gke" { ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.16.1" cluster_name = "your-cluster-name" ip_range_pods = "your-ip-range-pods" @@ -73,7 +73,7 @@ module "gke" { ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.16.1" cluster_name = "your-cluster-name" ip_range_pods = "your-ip-range-pods" diff --git a/infrastructure/gcp/iam/README.md b/infrastructure/gcp/iam/README.md index cd02be3b2..7e3f12821 100644 --- a/infrastructure/gcp/iam/README.md +++ b/infrastructure/gcp/iam/README.md @@ -19,7 +19,7 @@ The module creates google_service_account resources for each service account spe ```hcl module "iam" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/iam?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/iam?ref=v6.16.1" project_id = "your-project-id" } diff --git a/infrastructure/gcp/security/README.md b/infrastructure/gcp/security/README.md index f0a06ae5c..53a274111 100644 --- a/infrastructure/gcp/security/README.md +++ b/infrastructure/gcp/security/README.md @@ -2,26 +2,27 @@ ## Description -Manages GCP firewall rules for Istio public and private gateways on a GKE cluster, restricting health check and HTTPS traffic appropriately +Creates GCP firewall rules to control ingress traffic for Istio public and private gateways on a GKE cluster, restricting health check ports to VPC CIDR and GCP health check ranges while allowing HTTPS traffic ## Architecture -The module uses data sources google_container_cluster and google_compute_subnetwork to derive the VPC network name and subnet CIDR from the specified GKE cluster. These derived values feed into google_compute_firewall resources that control ingress traffic for Istio gateway nodes via network tags. For the public gateway, three google_compute_firewall rules are created: one allowing HTTPS from anywhere, one allowing health checks from VPC CIDR and GCP health check ranges (35.191.0.0/16, 130.211.0.0/22), and a lower-priority deny rule blocking health check port 15021 from the internet. For the private gateway, two google_compute_firewall rules restrict both HTTPS and health check traffic to the VPC CIDR and GCP health check ranges only. +The module uses data.google_container_cluster and data.google_compute_subnetwork to derive the VPC network name and subnet CIDR from the GKE cluster when not explicitly provided. These derived or override values feed into google_compute_firewall resources that are conditionally created based on gateways_enabled and gateway_internal_enabled boolean flags. For the public gateway, three google_compute_firewall rules are created: one allowing port 443 from 0.0.0.0/0, one allowing port 15021 from VPC CIDR plus GCP health check ranges (35.191.0.0/16, 130.211.0.0/22), and a lower-priority deny rule blocking port 15021 from the internet. For the private gateway, two google_compute_firewall rules restrict both port 443 and port 15021 to VPC CIDR plus GCP health check ranges, with target_tags scoped to cluster-specific gateway node tags. ## Features -- Creates public gateway firewall rules allowing HTTPS (443) from internet and health checks (15021) restricted to VPC CIDR and GCP health checker ranges -- Creates private gateway firewall rules restricting both HTTPS and health check traffic to internal VPC CIDR only -- Derives VPC network name and subnet CIDR automatically from the GKE cluster using google_container_cluster and google_compute_subnetwork data sources -- Supports overriding derived network name and CIDR with explicit input variables -- Applies network tags to firewall rules for precise targeting of Istio gateway node pools -- Adds explicit deny rule for health check port 15021 from internet at lower priority to block public health check exposure +- Creates google_compute_firewall rules for Istio public gateway allowing HTTPS on port 443 from the internet +- Creates google_compute_firewall health check rules restricting port 15021 to VPC CIDR and GCP health checker ranges (35.191.0.0/16, 130.211.0.0/22) +- Creates google_compute_firewall deny rule for port 15021 at lower priority to block internet health check access on public gateway +- Creates google_compute_firewall rules for private gateway restricting both HTTPS and health check traffic to VPC CIDR only +- Derives VPC network name and subnet CIDR automatically via data.google_container_cluster and data.google_compute_subnetwork when overrides are not supplied +- Supports explicit network name and CIDR overrides to skip cluster and subnetwork lookups, enabling use with Shared VPC or restricted IAM credentials +- Scopes all firewall rules to cluster-specific target_tags for precise gateway node targeting ## Basic Usage ```hcl module "security" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/security?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/security?ref=v6.16.1" cluster_name = "your-cluster-name" gcp_project_id = "your-gcp-project-id" @@ -84,15 +85,16 @@ resource "example_resource" "this" { diff --git a/infrastructure/gcp/vpc/README.md b/infrastructure/gcp/vpc/README.md index 3d20b654e..6878c8237 100644 --- a/infrastructure/gcp/vpc/README.md +++ b/infrastructure/gcp/vpc/README.md @@ -20,7 +20,7 @@ The module invokes the terraform-google-modules/network/google module to create ```hcl module "vpc" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/vpc?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/vpc?ref=v6.16.1" network_name = "your-network-name" project_id = "your-project-id" diff --git a/infrastructure/oci/backend/README.md b/infrastructure/oci/backend/README.md index 2674e95e6..0a86448a6 100644 --- a/infrastructure/oci/backend/README.md +++ b/infrastructure/oci/backend/README.md @@ -18,7 +18,7 @@ The module creates an oci_objectstorage_bucket resource, which is configured wit ```hcl module "backend" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/backend?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/backend?ref=v6.16.1" compartment_id = "your-compartment-id" namespace = "your-namespace" diff --git a/infrastructure/oci/dns/README.md b/infrastructure/oci/dns/README.md index ea6f6af72..fb6586814 100644 --- a/infrastructure/oci/dns/README.md +++ b/infrastructure/oci/dns/README.md @@ -18,7 +18,7 @@ This module creates oci_dns_zone resources for each DNS zone defined in the dns_ ```hcl module "dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dns?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dns?ref=v6.16.1" compartment_id = "your-compartment-id" } diff --git a/infrastructure/oci/dynamic_groups/README.md b/infrastructure/oci/dynamic_groups/README.md index a8f37087f..093ca3c79 100644 --- a/infrastructure/oci/dynamic_groups/README.md +++ b/infrastructure/oci/dynamic_groups/README.md @@ -19,7 +19,7 @@ This module creates an OCI dynamic group and an OCI identity policy, connecting ```hcl module "dynamic_groups" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dynamic_groups?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dynamic_groups?ref=v6.16.1" cluster_id = "your-cluster-id" compartment_id = "your-compartment-id" diff --git a/infrastructure/oci/oke/README.md b/infrastructure/oci/oke/README.md index b45b6ad0c..45128b908 100644 --- a/infrastructure/oci/oke/README.md +++ b/infrastructure/oci/oke/README.md @@ -21,7 +21,7 @@ The module instantiates the oracle-terraform-modules/oke/oci module to create an ```hcl module "oke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/oke?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/oke?ref=v6.16.1" api_endpoint_subnet_id = "your-api-endpoint-subnet-id" cluster_name = "your-cluster-name" diff --git a/infrastructure/oci/vcn/README.md b/infrastructure/oci/vcn/README.md index ec61458ac..0672627c2 100644 --- a/infrastructure/oci/vcn/README.md +++ b/infrastructure/oci/vcn/README.md @@ -19,7 +19,7 @@ The module instantiates oci_core_subnet resources for public and private subnets ```hcl module "vcn" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/vcn?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/vcn?ref=v6.16.1" } ``` diff --git a/nullplatform/account/README.md b/nullplatform/account/README.md index 47f6d0638..5511d53cf 100644 --- a/nullplatform/account/README.md +++ b/nullplatform/account/README.md @@ -19,7 +19,7 @@ The module iterates over the `nullplatform_accounts` input map using `for_each` ```hcl module "account" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/account?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/account?ref=v6.16.1" nullplatform_accounts = "your-nullplatform-accounts" } diff --git a/nullplatform/agent/README.md b/nullplatform/agent/README.md index 3b6b8e36a..0e89f0b1a 100644 --- a/nullplatform/agent/README.md +++ b/nullplatform/agent/README.md @@ -22,7 +22,7 @@ The module creates a helm_release resource targeting the nullplatform-agent char ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.16.1" api_key = "your-api-key" cloud_provider = "your-cloud-provider" @@ -36,7 +36,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.16.1" api_key = "your-api-key" aws_iam_role_arn = "your-aws-iam-role-arn" # Required when cloud_provider = "aws" @@ -51,7 +51,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.16.1" api_key = "your-api-key" cloud_provider = "gcp" @@ -65,7 +65,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.16.1" api_key = "your-api-key" azure_client_id = "your-azure-client-id" # Required when cloud_provider = "azure" @@ -85,7 +85,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.16.1" api_key = "your-api-key" cloud_provider = "oci" diff --git a/nullplatform/api_key/README.md b/nullplatform/api_key/README.md index a4e7e4355..0bdc5230f 100644 --- a/nullplatform/api_key/README.md +++ b/nullplatform/api_key/README.md @@ -21,7 +21,7 @@ The module creates a single nullplatform_api_key resource whose name, grants, an ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.16.1" type = "your-type" } @@ -31,7 +31,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.16.1" nrn = "your-nrn" # Required when type = "agent" type = "agent" @@ -42,7 +42,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.16.1" nrn = "your-nrn" # Required when type = "scope_notification" specification_slug = "your-specification-slug" # Required when type = "scope_notification" @@ -54,7 +54,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.16.1" nrn = "your-nrn" # Required when type = "service_notification" specification_slug = "your-specification-slug" # Required when type = "service_notification" @@ -66,7 +66,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.16.1" custom_grants = "your-custom-grants" # Required when type = "custom" custom_name = "your-custom-name" # Required when type = "custom" diff --git a/nullplatform/asset/docker_server/README.md b/nullplatform/asset/docker_server/README.md index e8c8f8497..2783847e1 100644 --- a/nullplatform/asset/docker_server/README.md +++ b/nullplatform/asset/docker_server/README.md @@ -21,7 +21,7 @@ Creates a nullplatform_provider_config resource of type 'docker-server' with enc ```hcl module "docker_server" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/docker_server?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/docker_server?ref=v6.16.1" login_server = "your-login-server" nrn = "your-nrn" diff --git a/nullplatform/asset/ecr/README.md b/nullplatform/asset/ecr/README.md index 404079b35..867c6620e 100644 --- a/nullplatform/asset/ecr/README.md +++ b/nullplatform/asset/ecr/README.md @@ -21,7 +21,7 @@ The module reads the current AWS region via the aws_region data source and combi ```hcl module "ecr" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/ecr?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/ecr?ref=v6.16.1" application_role_arn = "your-application-role-arn" build_workflow_access_key_id = "your-build-workflow-access-key-id" diff --git a/nullplatform/asset/s3/README.md b/nullplatform/asset/s3/README.md index 2f4800a2a..9057af76f 100644 --- a/nullplatform/asset/s3/README.md +++ b/nullplatform/asset/s3/README.md @@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type s3-con ```hcl module "s3" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/s3?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/s3?ref=v6.16.1" bucket_name = "your-bucket-name" nrn = "your-nrn" diff --git a/nullplatform/base/README.md b/nullplatform/base/README.md index d2bcf494a..f277abab4 100644 --- a/nullplatform/base/README.md +++ b/nullplatform/base/README.md @@ -22,7 +22,7 @@ The module first creates two kubernetes_namespace_v1 resources ('nullplatform-to ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.16.1" k8s_provider = "your-k8s-provider" np_api_key = "your-np-api-key" @@ -33,7 +33,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.16.1" k8s_provider = "eks" np_api_key = "your-np-api-key" @@ -44,7 +44,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.16.1" k8s_provider = "gke" np_api_key = "your-np-api-key" @@ -55,7 +55,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.16.1" k8s_provider = "aks" np_api_key = "your-np-api-key" @@ -66,7 +66,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.16.1" k8s_provider = "oke" np_api_key = "your-np-api-key" @@ -77,7 +77,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.16.1" k8s_provider = "aro" np_api_key = "your-np-api-key" diff --git a/nullplatform/cloud/aws/cloud/README.md b/nullplatform/cloud/aws/cloud/README.md index 303cc5df2..18ae993c8 100644 --- a/nullplatform/cloud/aws/cloud/README.md +++ b/nullplatform/cloud/aws/cloud/README.md @@ -21,7 +21,7 @@ The module uses data sources aws_caller_identity and aws_region to dynamically r ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/cloud?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/cloud?ref=v6.16.1" domain_name = "your-domain-name" hosted_private_zone_id = "your-hosted-private-zone-id" diff --git a/nullplatform/cloud/aws/vpc/README.md b/nullplatform/cloud/aws/vpc/README.md index e1955ddb4..2ead36205 100644 --- a/nullplatform/cloud/aws/vpc/README.md +++ b/nullplatform/cloud/aws/vpc/README.md @@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource of type aws-ne ```hcl module "vpc" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/vpc?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/vpc?ref=v6.16.1" nrn = "your-nrn" vpc_id = "your-vpc-id" diff --git a/nullplatform/cloud/azure/cloud/README.md b/nullplatform/cloud/azure/cloud/README.md index 6349a0ec2..e4134163a 100644 --- a/nullplatform/cloud/azure/cloud/README.md +++ b/nullplatform/cloud/azure/cloud/README.md @@ -22,7 +22,7 @@ The module creates a single nullplatform_provider_config resource of type 'azure ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/azure/cloud?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/azure/cloud?ref=v6.16.1" azure_resource_group_name = "your-azure-resource-group-name" nrn = "your-nrn" diff --git a/nullplatform/cloud/gcp/cloud/README.md b/nullplatform/cloud/gcp/cloud/README.md index 056bef508..c4fab970b 100644 --- a/nullplatform/cloud/gcp/cloud/README.md +++ b/nullplatform/cloud/gcp/cloud/README.md @@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type 'googl ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/gcp/cloud?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/gcp/cloud?ref=v6.16.1" domain_name = "your-domain-name" location = "your-location" diff --git a/nullplatform/cloud/oci/cloud/README.md b/nullplatform/cloud/oci/cloud/README.md index 92032fd27..a6925f64e 100644 --- a/nullplatform/cloud/oci/cloud/README.md +++ b/nullplatform/cloud/oci/cloud/README.md @@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type 'oci-c ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/oci/cloud?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/oci/cloud?ref=v6.16.1" account_id = "your-account-id" account_name = "your-account-name" diff --git a/nullplatform/code_repository/README.md b/nullplatform/code_repository/README.md index 3dec5fb47..7343dc4b5 100644 --- a/nullplatform/code_repository/README.md +++ b/nullplatform/code_repository/README.md @@ -22,7 +22,7 @@ The module uses local boolean flags (is_gitlab, is_github, is_azure, is_bitbucke ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.16.1" git_provider = "your-git-provider" nrn = "your-nrn" @@ -33,7 +33,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.16.1" git_provider = "github" github_installation_id = "your-github-installation-id" # Required when git_provider = "github" @@ -46,7 +46,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.16.1" git_provider = "gitlab" gitlab_access_token = "your-gitlab-access-token" # Required when git_provider = "gitlab" @@ -62,7 +62,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.16.1" azure_access_token = "your-azure-access-token" # Required when git_provider = "azure" azure_agent_pool = "your-azure-agent-pool" # Required when git_provider = "azure" @@ -76,7 +76,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.16.1" bitbucket_collaborators = "your-bitbucket-collaborators" # Required when git_provider = "bitbucket" bitbucket_installation_url = "your-bitbucket-installation-url" # Required when git_provider = "bitbucket" diff --git a/nullplatform/container_orchestration/aks/README.md b/nullplatform/container_orchestration/aks/README.md index 4b2574e6f..b39e485f2 100644 --- a/nullplatform/container_orchestration/aks/README.md +++ b/nullplatform/container_orchestration/aks/README.md @@ -21,7 +21,7 @@ The module builds a local.attributes map that aggregates cluster metadata, gatew ```hcl module "aks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.16.1" cluster_name = "your-cluster-name" nrn = "your-nrn" diff --git a/nullplatform/container_orchestration/eks/README.md b/nullplatform/container_orchestration/eks/README.md index 96d8f8793..589f9626b 100644 --- a/nullplatform/container_orchestration/eks/README.md +++ b/nullplatform/container_orchestration/eks/README.md @@ -22,7 +22,7 @@ The module assembles a set of structured locals by merging optional variables in ```hcl module "eks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.16.1" cluster_name = "your-cluster-name" nrn = "your-nrn" diff --git a/nullplatform/container_orchestration/gke/README.md b/nullplatform/container_orchestration/gke/README.md index 96c6545d2..de96ca4f1 100644 --- a/nullplatform/container_orchestration/gke/README.md +++ b/nullplatform/container_orchestration/gke/README.md @@ -22,7 +22,7 @@ The module constructs a structured attributes object using locals that merge clu ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.16.1" cluster_name = "your-cluster-name" location = "your-location" diff --git a/nullplatform/container_orchestration/oke/README.md b/nullplatform/container_orchestration/oke/README.md index 28fffdb7e..4c8515831 100644 --- a/nullplatform/container_orchestration/oke/README.md +++ b/nullplatform/container_orchestration/oke/README.md @@ -19,7 +19,7 @@ Creates a single nullplatform_provider_config resource of type 'oke' that stores ```hcl module "oke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/oke?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/oke?ref=v6.16.1" cluster_name = "your-cluster-name" nrn = "your-nrn" diff --git a/nullplatform/dimension/README.md b/nullplatform/dimension/README.md index ad5ba6380..4c6f4b0cb 100644 --- a/nullplatform/dimension/README.md +++ b/nullplatform/dimension/README.md @@ -19,7 +19,7 @@ The module creates a nullplatform_dimension resource using the provided name, or ```hcl module "dimension" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension?ref=v6.16.1" name = "your-name" nrn = "your-nrn" diff --git a/nullplatform/dimension_value/README.md b/nullplatform/dimension_value/README.md index e47e13bda..3a2fc23f3 100644 --- a/nullplatform/dimension_value/README.md +++ b/nullplatform/dimension_value/README.md @@ -19,7 +19,7 @@ The module uses a terraform_data resource to enforce mutual-exclusivity and pres ```hcl module "dimension_value" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension_value?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension_value?ref=v6.16.1" dimension_id = "your-dimension-id" name = "your-name" diff --git a/nullplatform/identity-access-control/README.md b/nullplatform/identity-access-control/README.md index 4690c62df..97adcf038 100644 --- a/nullplatform/identity-access-control/README.md +++ b/nullplatform/identity-access-control/README.md @@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource named identity ```hcl module "identity-access-control" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/identity-access-control?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/identity-access-control?ref=v6.16.1" attributes = "your-attributes" nrn = "your-nrn" diff --git a/nullplatform/metrics/README.md b/nullplatform/metrics/README.md index 5689c761d..6be8ab7b6 100644 --- a/nullplatform/metrics/README.md +++ b/nullplatform/metrics/README.md @@ -21,7 +21,7 @@ The module creates a single nullplatform_provider_config resource of type 'prome ```hcl module "metrics" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/metrics?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/metrics?ref=v6.16.1" nrn = "your-nrn" } diff --git a/nullplatform/packaged_service/README.md b/nullplatform/packaged_service/README.md index 467d40f46..98d9fd80e 100644 --- a/nullplatform/packaged_service/README.md +++ b/nullplatform/packaged_service/README.md @@ -17,7 +17,7 @@ spec updates / republish correctly. ```hcl module "packaged_service" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/packaged_service?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/packaged_service?ref=v6.16.1" nrn = "organization=…:account=…:namespace=…" diff --git a/nullplatform/parameter_storage_configuration/README.md b/nullplatform/parameter_storage_configuration/README.md index 17b8b1371..73cac83e8 100644 --- a/nullplatform/parameter_storage_configuration/README.md +++ b/nullplatform/parameter_storage_configuration/README.md @@ -20,7 +20,7 @@ The module delegates entirely to a remote `scope_configuration` module sourced f ```hcl module "parameter_storage_configuration" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_configuration?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_configuration?ref=v6.16.1" attributes = "your-attributes" np_api_key = "your-np-api-key" diff --git a/nullplatform/parameter_storage_definition/README.md b/nullplatform/parameter_storage_definition/README.md index af435eb51..d7ba817eb 100644 --- a/nullplatform/parameter_storage_definition/README.md +++ b/nullplatform/parameter_storage_definition/README.md @@ -20,7 +20,7 @@ A data.http resource fetches the raw specification template from a configurable ```hcl module "parameter_storage_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition?ref=v6.16.1" np_api_key = "your-np-api-key" nrn = "your-nrn" diff --git a/nullplatform/parameter_storage_definition_agent_association/README.md b/nullplatform/parameter_storage_definition_agent_association/README.md index af0a3bad5..36368bb01 100644 --- a/nullplatform/parameter_storage_definition_agent_association/README.md +++ b/nullplatform/parameter_storage_definition_agent_association/README.md @@ -21,7 +21,7 @@ The module creates a terraform_data resource to track API key changes and a null ```hcl module "parameter_storage_definition_agent_association" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition_agent_association?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition_agent_association?ref=v6.16.1" api_key = "your-api-key" nrn = "your-nrn" diff --git a/nullplatform/scope_configuration/README.md b/nullplatform/scope_configuration/README.md index 0f929e825..5939eeef5 100644 --- a/nullplatform/scope_configuration/README.md +++ b/nullplatform/scope_configuration/README.md @@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource that binds a N ```hcl module "scope_configuration" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_configuration?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_configuration?ref=v6.16.1" attributes = "your-attributes" np_api_key = "your-np-api-key" diff --git a/nullplatform/scope_definition/README.md b/nullplatform/scope_definition/README.md index aae43f371..1a9d4746b 100644 --- a/nullplatform/scope_definition/README.md +++ b/nullplatform/scope_definition/README.md @@ -22,7 +22,7 @@ The module fetches JSON templates via data.http resources from a configurable Gi ```hcl module "scope_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition?ref=v6.16.1" np_api_key = "your-np-api-key" nrn = "your-nrn" diff --git a/nullplatform/scope_definition_agent_association/README.md b/nullplatform/scope_definition_agent_association/README.md index 4f8bcb0f9..ac21368f9 100644 --- a/nullplatform/scope_definition_agent_association/README.md +++ b/nullplatform/scope_definition_agent_association/README.md @@ -22,7 +22,7 @@ The module fetches a notification channel JSON template via the `data.http` prov ```hcl module "scope_definition_agent_association" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition_agent_association?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition_agent_association?ref=v6.16.1" api_key = "your-api-key" nrn = "your-nrn" diff --git a/nullplatform/service_definition/README.md b/nullplatform/service_definition/README.md index d95cc64eb..d55fb2243 100644 --- a/nullplatform/service_definition/README.md +++ b/nullplatform/service_definition/README.md @@ -22,7 +22,7 @@ The module uses data.http resources to fetch service-spec, action, and link JSON ```hcl module "service_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.16.1" nrn = "your-nrn" service_name = "your-service-name" diff --git a/nullplatform/service_definition_agent_association/README.md b/nullplatform/service_definition_agent_association/README.md index 6516a9f59..587c0c9c1 100644 --- a/nullplatform/service_definition_agent_association/README.md +++ b/nullplatform/service_definition_agent_association/README.md @@ -22,7 +22,7 @@ The module creates a terraform_data resource to track API key changes as a lifec ```hcl module "service_definition_agent_association" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition_agent_association?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition_agent_association?ref=v6.16.1" api_key = "your-api-key" repository_service_spec_repo = "your-repository-service-spec-repo" diff --git a/nullplatform/users/README.md b/nullplatform/users/README.md index 1aa5f0231..7ddd31f01 100644 --- a/nullplatform/users/README.md +++ b/nullplatform/users/README.md @@ -21,7 +21,7 @@ The module iterates over a map of user definitions using `nullplatform_user` res ```hcl module "users" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/users?ref=v6.16.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/users?ref=v6.16.1" nullplatform_users = "your-nullplatform-users" } From f1d85053406b215489de5b69662953c728a3a687 Mon Sep 17 00:00:00 2001 From: Sebastian Correa Date: Tue, 18 Aug 2026 21:02:39 -0300 Subject: [PATCH 28/81] feat(base): make logs controller and control plane agent image tags configurable (#527) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Both images were rendered as a hardcoded ":latest" in the values template, so every apply could silently change which build a cluster runs, with no way to override the tag without editing the .tmpl.yaml file directly. Adds logging_controller_image_repository/_tag and control_plane_agent_image_repository/_tag variables, following the same image_repository/image_tag pattern the sibling agent module already uses. The template composes them into the same flat "repo:tag" string the base chart already expects, so this stays entirely on the tofu side — no change to the nullplatform-base chart's values contract. Defaults pin to the tag already running today, verified against public.ecr.aws before choosing them: - controlplane-agent: ":latest" and ":0.9.2" resolve to the SAME digest (sha256:95b7b13b...), so the default is a no-op for existing installs. - k8s-logs-controller: ":latest" (sha256:2fde6c39...) matched NO released version tag when checked against all 82 tags in the repo, and its image config was built 2025-12-15, vs 1.6.0 built 2026-08-12 -- the tag the base chart itself already pins in its own values.yaml. Clusters have been running an ~8-month-old orphan build. Defaulting to 1.6.0 is therefore a real image change on the next apply, and an upgrade rather than a downgrade (v2.0.2 also exists but is older, built 2026-02-09). Co-authored-by: sebas_correa Co-authored-by: Claude Sonnet 5 --- nullplatform/base/locals.tf | 12 ++-- .../nullplatform_base_values.tmpl.yaml | 4 +- .../base/tests/base_values.tftest.hcl | 63 +++++++++++++++++++ nullplatform/base/variables.tf | 24 +++++++ 4 files changed, 97 insertions(+), 6 deletions(-) diff --git a/nullplatform/base/locals.tf b/nullplatform/base/locals.tf index 74ccbf7ff..2d14f26fd 100644 --- a/nullplatform/base/locals.tf +++ b/nullplatform/base/locals.tf @@ -58,12 +58,16 @@ locals { # You left secretName empty in the template; if you want to make it configurable, add var.nullplatform_secret_name # ---- controlPlane ---- - controlPlane_enabled = var.control_plane_enabled ? "true" : "false" + controlPlane_enabled = var.control_plane_enabled ? "true" : "false" + control_plane_agent_image_repository = var.control_plane_agent_image_repository + control_plane_agent_image_tag = var.control_plane_agent_image_tag # ---- logging ---- - logging_enabled = var.logging_enabled ? "true" : "false" - logging_application_logs_enabled = var.logging_application_logs_enabled ? "true" : "false" - logging_mount_docker_containers = var.logging_mount_docker_containers ? "true" : "false" + logging_enabled = var.logging_enabled ? "true" : "false" + logging_application_logs_enabled = var.logging_application_logs_enabled ? "true" : "false" + logging_mount_docker_containers = var.logging_mount_docker_containers ? "true" : "false" + logging_controller_image_repository = var.logging_controller_image_repository + logging_controller_image_tag = var.logging_controller_image_tag prometheus_enabled = var.prometheus_enabled ? "true" : "false" exporter_prometheus_port = var.exporter_prometheus_port diff --git a/nullplatform/base/templates/nullplatform_base_values.tmpl.yaml b/nullplatform/base/templates/nullplatform_base_values.tmpl.yaml index 852d4c845..fd048b768 100644 --- a/nullplatform/base/templates/nullplatform_base_values.tmpl.yaml +++ b/nullplatform/base/templates/nullplatform_base_values.tmpl.yaml @@ -82,7 +82,7 @@ nullplatform: controlPlane: enabled: ${controlPlane_enabled} agent: - image: "public.ecr.aws/nullplatform/controlplane-agent:latest" + image: "${control_plane_agent_image_repository}:${control_plane_agent_image_tag}" resources: requests: cpu: 50m @@ -96,7 +96,7 @@ logging: enabled: ${logging_application_logs_enabled} mountDockerContainers: ${logging_mount_docker_containers} controller: - image: "public.ecr.aws/nullplatform/k8s-logs-controller:latest" + image: "${logging_controller_image_repository}:${logging_controller_image_tag}" resources: requests: cpu: 100m diff --git a/nullplatform/base/tests/base_values.tftest.hcl b/nullplatform/base/tests/base_values.tftest.hcl index fb129d113..73419fd11 100644 --- a/nullplatform/base/tests/base_values.tftest.hcl +++ b/nullplatform/base/tests/base_values.tftest.hcl @@ -310,3 +310,66 @@ run "internal_azure_load_balancer_subnet" { error_message = "internal gateway azure subnet should be wired into the rendered internal block" } } + +############################################ +# Container image repository/tag overrides +############################################ + +run "logs_controller_image_defaults_to_pinned_tag" { + command = plan + + assert { + condition = strcontains(output.rendered_values, "image: \"public.ecr.aws/nullplatform/k8s-logs-controller:1.6.0\"") + error_message = "logs controller image should default to the pinned repository:tag" + } +} + +run "logs_controller_image_tag_overridden" { + command = plan + + variables { + logging_controller_image_tag = "1.7.0" + } + + assert { + condition = strcontains(output.rendered_values, "image: \"public.ecr.aws/nullplatform/k8s-logs-controller:1.7.0\"") + error_message = "logs controller tag should be overridable without touching the repository" + } +} + +run "logs_controller_image_repository_overridden" { + command = plan + + # Redirect to a private mirror/ECR pull-through cache without needing to also + # know or restate the tag. + variables { + logging_controller_image_repository = "123456789012.dkr.ecr.us-east-1.amazonaws.com/k8s-logs-controller" + } + + assert { + condition = strcontains(output.rendered_values, "image: \"123456789012.dkr.ecr.us-east-1.amazonaws.com/k8s-logs-controller:1.6.0\"") + error_message = "logs controller repository should be overridable without touching the tag" + } +} + +run "control_plane_agent_image_defaults_to_pinned_tag" { + command = plan + + assert { + condition = strcontains(output.rendered_values, "image: \"public.ecr.aws/nullplatform/controlplane-agent:0.9.2\"") + error_message = "control plane agent image should default to the pinned repository:tag" + } +} + +run "control_plane_agent_image_tag_overridden" { + command = plan + + variables { + control_plane_agent_image_tag = "0.9.3" + } + + assert { + condition = strcontains(output.rendered_values, "image: \"public.ecr.aws/nullplatform/controlplane-agent:0.9.3\"") + error_message = "control plane agent tag should be overridable without touching the repository" + } +} diff --git a/nullplatform/base/variables.tf b/nullplatform/base/variables.tf index 599de86db..9505caacd 100644 --- a/nullplatform/base/variables.tf +++ b/nullplatform/base/variables.tf @@ -124,6 +124,18 @@ variable "control_plane_enabled" { default = false } +variable "control_plane_agent_image_repository" { + type = string + description = "Container image repository for the control plane agent." + default = "public.ecr.aws/nullplatform/controlplane-agent" +} + +variable "control_plane_agent_image_tag" { + type = string + description = "Container image tag for the control plane agent." + default = "0.9.2" +} + ############################################ # Logging (global flag) ############################################ @@ -146,6 +158,18 @@ variable "logging_mount_docker_containers" { default = false } +variable "logging_controller_image_repository" { + type = string + description = "Container image repository for the logs controller DaemonSet." + default = "public.ecr.aws/nullplatform/k8s-logs-controller" +} + +variable "logging_controller_image_tag" { + type = string + description = "Container image tag for the logs controller DaemonSet." + default = "1.6.0" +} + ############################################ # Prometheus Exporter ############################################ From d8bb475126339ea3ffd9521009b0ae7bc0eb3a94 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 19 Aug 2026 00:03:16 +0000 Subject: [PATCH 29/81] chore(6.x): release 6.17.0 --- CHANGELOG.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index ac11b3a69..a7e0fb46e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,12 @@ # Changelog +## [6.17.0](https://github.com/nullplatform/tofu-modules/compare/v6.16.1...v6.17.0) (2026-08-19) + + +### Features + +* **base:** make logs controller and control plane agent image tags configurable ([#527](https://github.com/nullplatform/tofu-modules/issues/527)) ([1c892a5](https://github.com/nullplatform/tofu-modules/commit/1c892a566950b81a9201dc0d89e1c091dbbd6eb6)) + ## [6.16.1](https://github.com/nullplatform/tofu-modules/compare/v6.16.0...v6.16.1) (2026-08-14) From a56f6983bda76234b6dcf9c89dc776441379e873 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Wed, 19 Aug 2026 00:03:55 +0000 Subject: [PATCH 30/81] docs: regenerate READMEs for changed modules and update versions --- infrastructure/aws/acm/README.md | 2 +- .../aws_load_balancer_controller/README.md | 2 +- infrastructure/aws/backend/README.md | 2 +- infrastructure/aws/dns/README.md | 2 +- infrastructure/aws/eks/README.md | 2 +- infrastructure/aws/iam/agent/README.md | 2 +- .../README.md | 2 +- infrastructure/aws/iam/cert_manager/README.md | 2 +- .../aws/iam/ci-build-workflow-user/README.md | 2 +- infrastructure/aws/iam/cloudwatch/README.md | 2 +- infrastructure/aws/iam/ecr/README.md | 2 +- infrastructure/aws/iam/external_dns/README.md | 2 +- infrastructure/aws/iam/s3/README.md | 2 +- infrastructure/aws/ingress/README.md | 2 +- infrastructure/aws/security/README.md | 2 +- infrastructure/aws/vpc/README.md | 2 +- infrastructure/azure/acr/README.md | 2 +- infrastructure/azure/aks/README.md | 2 +- .../azure/aks_route_table/README.md | 2 +- infrastructure/azure/dns/README.md | 2 +- infrastructure/azure/iam/README.md | 2 +- infrastructure/azure/private_dns/README.md | 2 +- infrastructure/azure/resource_group/README.md | 2 +- infrastructure/azure/security/README.md | 2 +- infrastructure/azure/vnet/README.md | 2 +- infrastructure/commons/cert_manager/README.md | 12 +- infrastructure/commons/external_dns/README.md | 12 +- infrastructure/commons/istio/README.md | 2 +- infrastructure/commons/prometheus/README.md | 2 +- .../gcp/artifact-registry/README.md | 2 +- infrastructure/gcp/backend/README.md | 2 +- infrastructure/gcp/cloud-dns/README.md | 2 +- infrastructure/gcp/cloud-nat/README.md | 2 +- infrastructure/gcp/gke/README.md | 6 +- infrastructure/gcp/iam/README.md | 2 +- infrastructure/gcp/security/README.md | 2 +- infrastructure/gcp/vpc/README.md | 2 +- infrastructure/oci/backend/README.md | 2 +- infrastructure/oci/dns/README.md | 2 +- infrastructure/oci/dynamic_groups/README.md | 2 +- infrastructure/oci/oke/README.md | 2 +- infrastructure/oci/vcn/README.md | 2 +- nullplatform/account/README.md | 2 +- nullplatform/agent/README.md | 10 +- nullplatform/api_key/README.md | 10 +- nullplatform/asset/docker_server/README.md | 2 +- nullplatform/asset/ecr/README.md | 2 +- nullplatform/asset/s3/README.md | 2 +- nullplatform/base/README.md | 126 ++++++++++++------ nullplatform/cloud/aws/cloud/README.md | 2 +- nullplatform/cloud/aws/vpc/README.md | 2 +- nullplatform/cloud/azure/cloud/README.md | 2 +- nullplatform/cloud/gcp/cloud/README.md | 2 +- nullplatform/cloud/oci/cloud/README.md | 2 +- nullplatform/code_repository/README.md | 10 +- .../container_orchestration/aks/README.md | 2 +- .../container_orchestration/eks/README.md | 2 +- .../container_orchestration/gke/README.md | 2 +- .../container_orchestration/oke/README.md | 2 +- nullplatform/dimension/README.md | 2 +- nullplatform/dimension_value/README.md | 2 +- .../identity-access-control/README.md | 2 +- nullplatform/metrics/README.md | 2 +- nullplatform/packaged_service/README.md | 2 +- .../parameter_storage_configuration/README.md | 2 +- .../parameter_storage_definition/README.md | 2 +- .../README.md | 2 +- nullplatform/scope_configuration/README.md | 2 +- nullplatform/scope_definition/README.md | 2 +- .../README.md | 2 +- nullplatform/service_definition/README.md | 2 +- .../README.md | 2 +- nullplatform/users/README.md | 2 +- 73 files changed, 182 insertions(+), 136 deletions(-) diff --git a/infrastructure/aws/acm/README.md b/infrastructure/aws/acm/README.md index f8a0c26d7..a425379d3 100644 --- a/infrastructure/aws/acm/README.md +++ b/infrastructure/aws/acm/README.md @@ -18,7 +18,7 @@ The module creates an aws_acm_certificate resource with DNS validation, which is ```hcl module "acm" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/acm?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/acm?ref=v6.17.0" domain_name = "your-domain-name" zone_id = "your-zone-id" diff --git a/infrastructure/aws/aws_load_balancer_controller/README.md b/infrastructure/aws/aws_load_balancer_controller/README.md index e6d8b09ea..b0001cbf4 100644 --- a/infrastructure/aws/aws_load_balancer_controller/README.md +++ b/infrastructure/aws/aws_load_balancer_controller/README.md @@ -18,7 +18,7 @@ This module creates a helm_release resource to deploy the AWS Load Balancer Cont ```hcl module "aws_load_balancer_controller" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/aws_load_balancer_controller?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/aws_load_balancer_controller?ref=v6.17.0" cluster_name = "your-cluster-name" vpc_id = "your-vpc-id" diff --git a/infrastructure/aws/backend/README.md b/infrastructure/aws/backend/README.md index dc57e5455..83fb10826 100644 --- a/infrastructure/aws/backend/README.md +++ b/infrastructure/aws/backend/README.md @@ -20,7 +20,7 @@ This module creates an S3 bucket with versioning and server-side encryption enab ```hcl module "backend" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/backend?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/backend?ref=v6.17.0" } ``` diff --git a/infrastructure/aws/dns/README.md b/infrastructure/aws/dns/README.md index d7e6b1979..c62287105 100644 --- a/infrastructure/aws/dns/README.md +++ b/infrastructure/aws/dns/README.md @@ -21,7 +21,7 @@ The module conditionally creates an aws_route53_zone resource for a public hoste ```hcl module "dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/dns?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/dns?ref=v6.17.0" domain_name = "your-domain-name" vpc_id = "your-vpc-id" diff --git a/infrastructure/aws/eks/README.md b/infrastructure/aws/eks/README.md index 8d9ca74b6..d7d0c4b70 100644 --- a/infrastructure/aws/eks/README.md +++ b/infrastructure/aws/eks/README.md @@ -22,7 +22,7 @@ The module wraps terraform-aws-modules/eks to create the EKS cluster (aws_eks_cl ```hcl module "eks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/eks?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/eks?ref=v6.17.0" aws_subnets_private_ids = "your-aws-subnets-private-ids" aws_vpc_vpc_id = "your-aws-vpc-vpc-id" diff --git a/infrastructure/aws/iam/agent/README.md b/infrastructure/aws/iam/agent/README.md index e15b27ae6..9df446df8 100644 --- a/infrastructure/aws/iam/agent/README.md +++ b/infrastructure/aws/iam/agent/README.md @@ -21,7 +21,7 @@ The module uses the terraform-aws-modules/iam//modules/iam-role-for-service-acco ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/agent?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/agent?ref=v6.17.0" agent_namespace = "your-agent-namespace" aws_iam_openid_connect_provider_arn = "your-aws-iam-openid-connect-provider-arn" diff --git a/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md b/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md index e1b2dd4d4..84c3bd69c 100644 --- a/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md +++ b/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md @@ -19,7 +19,7 @@ This module creates an IAM role for the AWS Load Balancer Controller using the t ```hcl module "aws_load_balancer_controller_iam" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/aws_load_balancer_controller_iam?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/aws_load_balancer_controller_iam?ref=v6.17.0" aws_iam_openid_connect_provider_arn = "your-aws-iam-openid-connect-provider-arn" cluster_name = "your-cluster-name" diff --git a/infrastructure/aws/iam/cert_manager/README.md b/infrastructure/aws/iam/cert_manager/README.md index 8e0ac9ef8..5ad642dbc 100644 --- a/infrastructure/aws/iam/cert_manager/README.md +++ b/infrastructure/aws/iam/cert_manager/README.md @@ -20,7 +20,7 @@ An aws_iam_policy resource is always created granting route53:GetChange, route53 ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cert_manager?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cert_manager?ref=v6.17.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/ci-build-workflow-user/README.md b/infrastructure/aws/iam/ci-build-workflow-user/README.md index b4df8470c..073d0eb61 100644 --- a/infrastructure/aws/iam/ci-build-workflow-user/README.md +++ b/infrastructure/aws/iam/ci-build-workflow-user/README.md @@ -21,7 +21,7 @@ The module creates an aws_iam_user named with the cluster_name prefix and genera ```hcl module "ci-build-workflow-user" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ci-build-workflow-user?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ci-build-workflow-user?ref=v6.17.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/cloudwatch/README.md b/infrastructure/aws/iam/cloudwatch/README.md index a51ffac8e..e395ad8fb 100644 --- a/infrastructure/aws/iam/cloudwatch/README.md +++ b/infrastructure/aws/iam/cloudwatch/README.md @@ -20,7 +20,7 @@ The module creates an aws_iam_policy granting CloudWatch Logs and Metrics write ```hcl module "cloudwatch" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cloudwatch?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cloudwatch?ref=v6.17.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/ecr/README.md b/infrastructure/aws/iam/ecr/README.md index 610849d5d..cb982ecc9 100644 --- a/infrastructure/aws/iam/ecr/README.md +++ b/infrastructure/aws/iam/ecr/README.md @@ -20,7 +20,7 @@ The module creates an aws_iam_role named nullplatform-{cluster_name}-application ```hcl module "ecr" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ecr?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ecr?ref=v6.17.0" build_workflow_group_name = "your-build-workflow-group-name" cluster_name = "your-cluster-name" diff --git a/infrastructure/aws/iam/external_dns/README.md b/infrastructure/aws/iam/external_dns/README.md index 5eccb3d74..6df050c47 100644 --- a/infrastructure/aws/iam/external_dns/README.md +++ b/infrastructure/aws/iam/external_dns/README.md @@ -20,7 +20,7 @@ An aws_iam_policy resource named nullplatform_external_dns_policy is always crea ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/external_dns?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/external_dns?ref=v6.17.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/s3/README.md b/infrastructure/aws/iam/s3/README.md index caf2b7cbc..2b094b61a 100644 --- a/infrastructure/aws/iam/s3/README.md +++ b/infrastructure/aws/iam/s3/README.md @@ -18,7 +18,7 @@ The module creates an aws_iam_policy resource that allows s3:PutObject and s3:Ge ```hcl module "s3" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/s3?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/s3?ref=v6.17.0" bucket = "your-bucket" build_workflow_group_name = "your-build-workflow-group-name" diff --git a/infrastructure/aws/ingress/README.md b/infrastructure/aws/ingress/README.md index e62816735..af7f53b72 100644 --- a/infrastructure/aws/ingress/README.md +++ b/infrastructure/aws/ingress/README.md @@ -22,7 +22,7 @@ The module creates up to two kubernetes_ingress_v1 resources — one for an inte ```hcl module "ingress" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/ingress?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/ingress?ref=v6.17.0" certificate_arn = "your-certificate-arn" } diff --git a/infrastructure/aws/security/README.md b/infrastructure/aws/security/README.md index 617789f4e..d77b504bb 100644 --- a/infrastructure/aws/security/README.md +++ b/infrastructure/aws/security/README.md @@ -22,7 +22,7 @@ The module uses data sources (aws_eks_cluster, aws_vpc) to automatically derive ```hcl module "security" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/security?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/security?ref=v6.17.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/vpc/README.md b/infrastructure/aws/vpc/README.md index 61fca657a..b97ee5aac 100644 --- a/infrastructure/aws/vpc/README.md +++ b/infrastructure/aws/vpc/README.md @@ -22,7 +22,7 @@ This module creates a terraform-aws-modules/vpc/aws module resource with DNS hos ```hcl module "vpc" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/vpc?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/vpc?ref=v6.17.0" account = "your-account" organization = "your-organization" diff --git a/infrastructure/azure/acr/README.md b/infrastructure/azure/acr/README.md index ff424862f..7a4858391 100644 --- a/infrastructure/azure/acr/README.md +++ b/infrastructure/azure/acr/README.md @@ -18,7 +18,7 @@ The module uses the azurerm_container_registry resource to create the container ```hcl module "acr" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/acr?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/acr?ref=v6.17.0" containerregistry_name = "your-containerregistry-name" location = "your-location" diff --git a/infrastructure/azure/aks/README.md b/infrastructure/azure/aks/README.md index 5266d95fa..6301439e7 100644 --- a/infrastructure/azure/aks/README.md +++ b/infrastructure/azure/aks/README.md @@ -22,7 +22,7 @@ The module wraps the Azure/aks/azurerm community module (version 11.0.0) and use ```hcl module "aks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks?ref=v6.17.0" cluster_name = "your-cluster-name" location = "your-location" diff --git a/infrastructure/azure/aks_route_table/README.md b/infrastructure/azure/aks_route_table/README.md index 73da8e0ee..fec49957b 100644 --- a/infrastructure/azure/aks_route_table/README.md +++ b/infrastructure/azure/aks_route_table/README.md @@ -19,7 +19,7 @@ The module uses an azurerm_resources data source to discover the AKS-managed rou ```hcl module "aks_route_table" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks_route_table?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks_route_table?ref=v6.17.0" node_resource_group = "your-node-resource-group" subnet_id = "your-subnet-id" diff --git a/infrastructure/azure/dns/README.md b/infrastructure/azure/dns/README.md index fdf7f3d07..837d8e241 100644 --- a/infrastructure/azure/dns/README.md +++ b/infrastructure/azure/dns/README.md @@ -18,7 +18,7 @@ This module creates an azurerm_dns_zone resource and configures it with the prov ```hcl module "dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/dns?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/dns?ref=v6.17.0" domain_name = "your-domain-name" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/iam/README.md b/infrastructure/azure/iam/README.md index 6d39f44d3..6ff3de404 100644 --- a/infrastructure/azure/iam/README.md +++ b/infrastructure/azure/iam/README.md @@ -21,7 +21,7 @@ The module creates an azurerm_user_assigned_identity resource in the specified r ```hcl module "iam" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/iam?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/iam?ref=v6.17.0" location = "your-location" name = "your-name" diff --git a/infrastructure/azure/private_dns/README.md b/infrastructure/azure/private_dns/README.md index b0957bf13..19003d399 100644 --- a/infrastructure/azure/private_dns/README.md +++ b/infrastructure/azure/private_dns/README.md @@ -18,7 +18,7 @@ This module creates an azurerm_private_dns_zone resource and optionally multiple ```hcl module "private_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/private_dns?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/private_dns?ref=v6.17.0" domain_name = "your-domain-name" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/resource_group/README.md b/infrastructure/azure/resource_group/README.md index b606c330a..abdc518d1 100644 --- a/infrastructure/azure/resource_group/README.md +++ b/infrastructure/azure/resource_group/README.md @@ -18,7 +18,7 @@ This module creates an azurerm_resource_group resource and outputs its name and ```hcl module "resource_group" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/resource_group?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/resource_group?ref=v6.17.0" location = "your-location" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/security/README.md b/infrastructure/azure/security/README.md index 9c8437022..1b4332220 100644 --- a/infrastructure/azure/security/README.md +++ b/infrastructure/azure/security/README.md @@ -21,7 +21,7 @@ The module uses azurerm_kubernetes_cluster and azurerm_virtual_network data sour ```hcl module "security" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/security?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/security?ref=v6.17.0" cluster_name = "your-cluster-name" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/vnet/README.md b/infrastructure/azure/vnet/README.md index 8d310c2e3..c89695139 100644 --- a/infrastructure/azure/vnet/README.md +++ b/infrastructure/azure/vnet/README.md @@ -18,7 +18,7 @@ This module creates an Azure virtual network using the azurerm provider and conf ```hcl module "vnet" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/vnet?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/vnet?ref=v6.17.0" address_space = "your-address-space" location = "your-location" diff --git a/infrastructure/commons/cert_manager/README.md b/infrastructure/commons/cert_manager/README.md index 216e7e1c4..bccc81c85 100644 --- a/infrastructure/commons/cert_manager/README.md +++ b/infrastructure/commons/cert_manager/README.md @@ -22,7 +22,7 @@ Two primary helm_release resources are created: cert-manager from the Jetstack c ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.17.0" account_slug = "your-account-slug" cloud_provider = "your-cloud-provider" @@ -35,7 +35,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.17.0" account_slug = "your-account-slug" cloud_provider = "gcp" @@ -50,7 +50,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.17.0" account_slug = "your-account-slug" azure_client_id = "your-azure-client-id" # Required when cloud_provider = "azure" @@ -68,7 +68,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.17.0" account_slug = "your-account-slug" cloud_provider = "cloudflare" @@ -83,7 +83,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.17.0" account_slug = "your-account-slug" aws_identity_mode = "your-aws-identity-mode" # Required when cloud_provider = "aws" @@ -99,7 +99,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.17.0" account_slug = "your-account-slug" cert_manager_webhook_oci_namespace = "your-cert-manager-webhook-oci-namespace" # Required when cloud_provider = "oci" diff --git a/infrastructure/commons/external_dns/README.md b/infrastructure/commons/external_dns/README.md index 3073d037c..848325e60 100644 --- a/infrastructure/commons/external_dns/README.md +++ b/infrastructure/commons/external_dns/README.md @@ -22,7 +22,7 @@ The module creates an optional kubernetes_namespace_v1 resource when create_name ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.17.0" dns_provider_name = "your-dns-provider-name" domain_filters = "your-domain-filters" @@ -33,7 +33,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.17.0" cloudflare_token = "your-cloudflare-token" # Required when dns_provider_name = "cloudflare" dns_provider_name = "cloudflare" @@ -45,7 +45,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.17.0" aws_iam_role_arn = "your-aws-iam-role-arn" # Required when dns_provider_name = "aws" aws_identity_mode = "your-aws-identity-mode" # Required when dns_provider_name = "aws" @@ -61,7 +61,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.17.0" dns_provider_name = "oci" domain_filters = "your-domain-filters" @@ -77,7 +77,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.17.0" azure_client_id = "your-azure-client-id" # Required when dns_provider_name = "azure" azure_federated_credential_id = "your-azure-federated-credential-id" # Required when dns_provider_name = "azure" @@ -94,7 +94,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.17.0" azure_client_id = "your-azure-client-id" # Required when dns_provider_name = "azure-private-dns" azure_federated_credential_id = "your-azure-federated-credential-id" # Required when dns_provider_name = "azure-private-dns" diff --git a/infrastructure/commons/istio/README.md b/infrastructure/commons/istio/README.md index 8d7c094d8..c3dbd7727 100644 --- a/infrastructure/commons/istio/README.md +++ b/infrastructure/commons/istio/README.md @@ -21,7 +21,7 @@ Three helm_release resources are created in a strict dependency chain: istio-bas ```hcl module "istio" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/istio?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/istio?ref=v6.17.0" } ``` diff --git a/infrastructure/commons/prometheus/README.md b/infrastructure/commons/prometheus/README.md index 42ac5fbf5..9ad27cd89 100644 --- a/infrastructure/commons/prometheus/README.md +++ b/infrastructure/commons/prometheus/README.md @@ -18,7 +18,7 @@ This module creates a helm_release resource to deploy the Prometheus chart from ```hcl module "prometheus" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.17.0" } ``` diff --git a/infrastructure/gcp/artifact-registry/README.md b/infrastructure/gcp/artifact-registry/README.md index 14ffe7a36..8ca4df3f6 100644 --- a/infrastructure/gcp/artifact-registry/README.md +++ b/infrastructure/gcp/artifact-registry/README.md @@ -21,7 +21,7 @@ The module creates a google_artifact_registry_repository resource configured wit ```hcl module "artifact-registry" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/artifact-registry?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/artifact-registry?ref=v6.17.0" location = "your-location" project_id = "your-project-id" diff --git a/infrastructure/gcp/backend/README.md b/infrastructure/gcp/backend/README.md index 90b331e20..2115d43f4 100644 --- a/infrastructure/gcp/backend/README.md +++ b/infrastructure/gcp/backend/README.md @@ -22,7 +22,7 @@ The module creates a random_id resource to generate a unique 8-byte hex suffix, ```hcl module "backend" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/backend?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/backend?ref=v6.17.0" project_id = "your-project-id" } diff --git a/infrastructure/gcp/cloud-dns/README.md b/infrastructure/gcp/cloud-dns/README.md index da93ceb79..197656ea3 100644 --- a/infrastructure/gcp/cloud-dns/README.md +++ b/infrastructure/gcp/cloud-dns/README.md @@ -21,7 +21,7 @@ The module creates a single google_dns_managed_zone resource in the specified GC ```hcl module "cloud-dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-dns?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-dns?ref=v6.17.0" domain_name = "your-domain-name" project_id = "your-project-id" diff --git a/infrastructure/gcp/cloud-nat/README.md b/infrastructure/gcp/cloud-nat/README.md index 750c0af78..ade6d6b79 100644 --- a/infrastructure/gcp/cloud-nat/README.md +++ b/infrastructure/gcp/cloud-nat/README.md @@ -19,7 +19,7 @@ This module creates a google_compute_router resource in a specified region and n ```hcl module "cloud-nat" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-nat?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-nat?ref=v6.17.0" nat_name = "your-nat-name" network_id = "your-network-id" diff --git a/infrastructure/gcp/gke/README.md b/infrastructure/gcp/gke/README.md index 9ecf08c07..15579f043 100644 --- a/infrastructure/gcp/gke/README.md +++ b/infrastructure/gcp/gke/README.md @@ -22,7 +22,7 @@ The module conditionally creates one of two mutually-exclusive submodules based ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.17.0" cluster_name = "your-cluster-name" ip_range_pods = "your-ip-range-pods" @@ -38,7 +38,7 @@ module "gke" { ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.17.0" cluster_name = "your-cluster-name" ip_range_pods = "your-ip-range-pods" @@ -73,7 +73,7 @@ module "gke" { ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.17.0" cluster_name = "your-cluster-name" ip_range_pods = "your-ip-range-pods" diff --git a/infrastructure/gcp/iam/README.md b/infrastructure/gcp/iam/README.md index 7e3f12821..ca631445c 100644 --- a/infrastructure/gcp/iam/README.md +++ b/infrastructure/gcp/iam/README.md @@ -19,7 +19,7 @@ The module creates google_service_account resources for each service account spe ```hcl module "iam" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/iam?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/iam?ref=v6.17.0" project_id = "your-project-id" } diff --git a/infrastructure/gcp/security/README.md b/infrastructure/gcp/security/README.md index 53a274111..ab5d3bfd7 100644 --- a/infrastructure/gcp/security/README.md +++ b/infrastructure/gcp/security/README.md @@ -22,7 +22,7 @@ The module uses data.google_container_cluster and data.google_compute_subnetwork ```hcl module "security" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/security?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/security?ref=v6.17.0" cluster_name = "your-cluster-name" gcp_project_id = "your-gcp-project-id" diff --git a/infrastructure/gcp/vpc/README.md b/infrastructure/gcp/vpc/README.md index 6878c8237..7482dae6a 100644 --- a/infrastructure/gcp/vpc/README.md +++ b/infrastructure/gcp/vpc/README.md @@ -20,7 +20,7 @@ The module invokes the terraform-google-modules/network/google module to create ```hcl module "vpc" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/vpc?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/vpc?ref=v6.17.0" network_name = "your-network-name" project_id = "your-project-id" diff --git a/infrastructure/oci/backend/README.md b/infrastructure/oci/backend/README.md index 0a86448a6..014e937db 100644 --- a/infrastructure/oci/backend/README.md +++ b/infrastructure/oci/backend/README.md @@ -18,7 +18,7 @@ The module creates an oci_objectstorage_bucket resource, which is configured wit ```hcl module "backend" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/backend?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/backend?ref=v6.17.0" compartment_id = "your-compartment-id" namespace = "your-namespace" diff --git a/infrastructure/oci/dns/README.md b/infrastructure/oci/dns/README.md index fb6586814..b9af9eb0f 100644 --- a/infrastructure/oci/dns/README.md +++ b/infrastructure/oci/dns/README.md @@ -18,7 +18,7 @@ This module creates oci_dns_zone resources for each DNS zone defined in the dns_ ```hcl module "dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dns?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dns?ref=v6.17.0" compartment_id = "your-compartment-id" } diff --git a/infrastructure/oci/dynamic_groups/README.md b/infrastructure/oci/dynamic_groups/README.md index 093ca3c79..bf8e720eb 100644 --- a/infrastructure/oci/dynamic_groups/README.md +++ b/infrastructure/oci/dynamic_groups/README.md @@ -19,7 +19,7 @@ This module creates an OCI dynamic group and an OCI identity policy, connecting ```hcl module "dynamic_groups" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dynamic_groups?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dynamic_groups?ref=v6.17.0" cluster_id = "your-cluster-id" compartment_id = "your-compartment-id" diff --git a/infrastructure/oci/oke/README.md b/infrastructure/oci/oke/README.md index 45128b908..22916f27a 100644 --- a/infrastructure/oci/oke/README.md +++ b/infrastructure/oci/oke/README.md @@ -21,7 +21,7 @@ The module instantiates the oracle-terraform-modules/oke/oci module to create an ```hcl module "oke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/oke?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/oke?ref=v6.17.0" api_endpoint_subnet_id = "your-api-endpoint-subnet-id" cluster_name = "your-cluster-name" diff --git a/infrastructure/oci/vcn/README.md b/infrastructure/oci/vcn/README.md index 0672627c2..76e04a357 100644 --- a/infrastructure/oci/vcn/README.md +++ b/infrastructure/oci/vcn/README.md @@ -19,7 +19,7 @@ The module instantiates oci_core_subnet resources for public and private subnets ```hcl module "vcn" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/vcn?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/vcn?ref=v6.17.0" } ``` diff --git a/nullplatform/account/README.md b/nullplatform/account/README.md index 5511d53cf..aaa9825cd 100644 --- a/nullplatform/account/README.md +++ b/nullplatform/account/README.md @@ -19,7 +19,7 @@ The module iterates over the `nullplatform_accounts` input map using `for_each` ```hcl module "account" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/account?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/account?ref=v6.17.0" nullplatform_accounts = "your-nullplatform-accounts" } diff --git a/nullplatform/agent/README.md b/nullplatform/agent/README.md index 0e89f0b1a..549825b60 100644 --- a/nullplatform/agent/README.md +++ b/nullplatform/agent/README.md @@ -22,7 +22,7 @@ The module creates a helm_release resource targeting the nullplatform-agent char ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.17.0" api_key = "your-api-key" cloud_provider = "your-cloud-provider" @@ -36,7 +36,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.17.0" api_key = "your-api-key" aws_iam_role_arn = "your-aws-iam-role-arn" # Required when cloud_provider = "aws" @@ -51,7 +51,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.17.0" api_key = "your-api-key" cloud_provider = "gcp" @@ -65,7 +65,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.17.0" api_key = "your-api-key" azure_client_id = "your-azure-client-id" # Required when cloud_provider = "azure" @@ -85,7 +85,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.17.0" api_key = "your-api-key" cloud_provider = "oci" diff --git a/nullplatform/api_key/README.md b/nullplatform/api_key/README.md index 0bdc5230f..5ab3a880b 100644 --- a/nullplatform/api_key/README.md +++ b/nullplatform/api_key/README.md @@ -21,7 +21,7 @@ The module creates a single nullplatform_api_key resource whose name, grants, an ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.17.0" type = "your-type" } @@ -31,7 +31,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.17.0" nrn = "your-nrn" # Required when type = "agent" type = "agent" @@ -42,7 +42,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.17.0" nrn = "your-nrn" # Required when type = "scope_notification" specification_slug = "your-specification-slug" # Required when type = "scope_notification" @@ -54,7 +54,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.17.0" nrn = "your-nrn" # Required when type = "service_notification" specification_slug = "your-specification-slug" # Required when type = "service_notification" @@ -66,7 +66,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.17.0" custom_grants = "your-custom-grants" # Required when type = "custom" custom_name = "your-custom-name" # Required when type = "custom" diff --git a/nullplatform/asset/docker_server/README.md b/nullplatform/asset/docker_server/README.md index 2783847e1..2f79beeef 100644 --- a/nullplatform/asset/docker_server/README.md +++ b/nullplatform/asset/docker_server/README.md @@ -21,7 +21,7 @@ Creates a nullplatform_provider_config resource of type 'docker-server' with enc ```hcl module "docker_server" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/docker_server?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/docker_server?ref=v6.17.0" login_server = "your-login-server" nrn = "your-nrn" diff --git a/nullplatform/asset/ecr/README.md b/nullplatform/asset/ecr/README.md index 867c6620e..9b2e3220a 100644 --- a/nullplatform/asset/ecr/README.md +++ b/nullplatform/asset/ecr/README.md @@ -21,7 +21,7 @@ The module reads the current AWS region via the aws_region data source and combi ```hcl module "ecr" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/ecr?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/ecr?ref=v6.17.0" application_role_arn = "your-application-role-arn" build_workflow_access_key_id = "your-build-workflow-access-key-id" diff --git a/nullplatform/asset/s3/README.md b/nullplatform/asset/s3/README.md index 9057af76f..d6164492a 100644 --- a/nullplatform/asset/s3/README.md +++ b/nullplatform/asset/s3/README.md @@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type s3-con ```hcl module "s3" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/s3?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/s3?ref=v6.17.0" bucket_name = "your-bucket-name" nrn = "your-nrn" diff --git a/nullplatform/base/README.md b/nullplatform/base/README.md index f277abab4..70be74be6 100644 --- a/nullplatform/base/README.md +++ b/nullplatform/base/README.md @@ -2,27 +2,27 @@ ## Description -Deploys the nullplatform-base Helm chart onto a Kubernetes cluster with pre-created namespaces, configuring gateways, ingress controllers, logging pipelines, and observability integrations for supported cloud providers +Deploys the nullplatform base Helm chart onto a Kubernetes cluster across multiple cloud providers, configuring gateways, ingress controllers, logging integrations, and the control plane agent via a rendered values template ## Architecture -The module first creates two kubernetes_namespace_v1 resources ('nullplatform-tools' and 'nullplatform') to avoid race conditions with the Helm chart's lookup functions. A locals block renders a YAML values file via templatefile() from all input variables, which is then passed directly to a helm_release resource targeting the 'nullplatform-base' chart from the nullplatform GitHub Helm repository. The helm_release depends on both namespaces and outputs the rendered values as a sensitive output, while cloud-provider-specific security resource IDs (AWS security groups, Azure NSGs, GCP firewall names) flow through as passthrough outputs. +The module creates two kubernetes_namespace_v1 resources ('nullplatform-tools' and 'nullplatform') to avoid Helm lookup race conditions, then deploys a single helm_release resource ('nullplatform-base') from the nullplatform Helm repository with a templatefile-rendered values YAML. All input variables flow through the locals.tf templatefile into the helm_release values block, which configures sub-charts for gateways, ingress controllers, logging pipelines, metrics, and the control plane agent. Outputs expose cloud-specific security resource identifiers (AWS security group IDs, Azure NSG IDs, GCP firewall names) that were passed in from upstream security submodules. ## Features -- Creates two Kubernetes namespaces ('nullplatform-tools' and 'nullplatform') with Helm-compatible labels and annotations before chart installation -- Deploys the nullplatform-base helm_release with configurable version, timeout, and dependency update support -- Configures public and internal gateway resources with per-cloud-provider security group, NSG, firewall, and OCI subnet settings -- Supports multiple observability integrations including Prometheus, Datadog, Dynatrace, New Relic, Loki, GELF, and CloudWatch with per-integration enable flags -- Renders a templated Helm values YAML file combining all inputs for multi-cloud providers: EKS, GKE, AKS, OKE, and ARO -- Manages image pull secrets and ingress controller configuration for public and private traffic scopes -- Exposes cloud-provider security resource IDs as outputs for use by downstream security submodules +- Creates kubernetes_namespace_v1 resources for nullplatform-tools and nullplatform to prevent Helm chart race conditions +- Deploys nullplatform-base helm_release with fully rendered YAML values supporting EKS, GKE, AKS, OKE, and ARO providers +- Configures public and private Gateway API resources with per-cloud security group, NSG, firewall, and OCI subnet annotations +- Enables pluggable observability backends including Prometheus, Loki, GELF, Dynatrace, Datadog, New Relic, and CloudWatch +- Supports internal and external public load balancer modes for Cloudflare Tunnel / VPN or direct internet exposure +- Configures control plane agent deployment with configurable image repository and tag +- Creates image pull secrets and ingress controller resources for both public and private traffic scopes ## Basic Usage ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.17.0" k8s_provider = "your-k8s-provider" np_api_key = "your-np-api-key" @@ -33,10 +33,18 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.16.1" - - k8s_provider = "eks" - np_api_key = "your-np-api-key" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.17.0" + + aws_region = "your-aws-region" # Required when k8s_provider = "eks" + cloudwatch_service_account_annotations = "your-cloudwatch-service-account-annotations" # Required when k8s_provider = "eks" + gateway_internal_aws_name = "your-gateway-internal-aws-name" # Required when k8s_provider = "eks" + gateway_private_aws_dns_name = "your-gateway-private-aws-dns-name" # Required when k8s_provider = "eks" + gateway_private_aws_security_group_id = "your-gateway-private-aws-security-group-id" # Required when k8s_provider = "eks" + gateway_public_aws_dns_name = "your-gateway-public-aws-dns-name" # Required when k8s_provider = "eks" + gateway_public_aws_name = "your-gateway-public-aws-name" # Required when k8s_provider = "eks" + gateway_public_aws_security_group_id = "your-gateway-public-aws-security-group-id" # Required when k8s_provider = "eks" + k8s_provider = "eks" + np_api_key = "your-np-api-key" } ``` @@ -44,10 +52,12 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.17.0" - k8s_provider = "gke" - np_api_key = "your-np-api-key" + gateway_private_gcp_firewall_name = "your-gateway-private-gcp-firewall-name" # Required when k8s_provider = "gke" + gateway_public_gcp_firewall_name = "your-gateway-public-gcp-firewall-name" # Required when k8s_provider = "gke" + k8s_provider = "gke" + np_api_key = "your-np-api-key" } ``` @@ -55,10 +65,14 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.16.1" - - k8s_provider = "aks" - np_api_key = "your-np-api-key" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.17.0" + + gateway_private_azure_nsg_id = "your-gateway-private-azure-nsg-id" # Required when k8s_provider = "aks" + gateway_public_azure_load_balancer_subnet = "your-gateway-public-azure-load-balancer-subnet" # Required when k8s_provider = "aks" + gateway_public_azure_nsg_id = "your-gateway-public-azure-nsg-id" # Required when k8s_provider = "aks" + internal_azure_load_balancer_subnet = "your-internal-azure-load-balancer-subnet" # Required when k8s_provider = "aks" + k8s_provider = "aks" + np_api_key = "your-np-api-key" } ``` @@ -66,21 +80,29 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.16.1" - - k8s_provider = "oke" - np_api_key = "your-np-api-key" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.17.0" + + gateway_private_oci_security_list_management_mode = "your-gateway-private-oci-security-list-management-mode" # Required when k8s_provider = "oke" + gateway_private_oci_subnet = "your-gateway-private-oci-subnet" # Required when k8s_provider = "oke" + gateway_public_oci_security_list_management_mode = "your-gateway-public-oci-security-list-management-mode" # Required when k8s_provider = "oke" + gateway_public_oci_subnet = "your-gateway-public-oci-subnet" # Required when k8s_provider = "oke" + k8s_provider = "oke" + np_api_key = "your-np-api-key" } ``` -### Usage with Azure Red Hat OpenShift (ARO) +### Usage with Azure ARO ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.16.1" - - k8s_provider = "aro" - np_api_key = "your-np-api-key" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.17.0" + + gateway_private_azure_nsg_id = "your-gateway-private-azure-nsg-id" # Required when k8s_provider = "aro" + gateway_public_azure_load_balancer_subnet = "your-gateway-public-azure-load-balancer-subnet" # Required when k8s_provider = "aro" + gateway_public_azure_nsg_id = "your-gateway-public-azure-nsg-id" # Required when k8s_provider = "aro" + internal_azure_load_balancer_subnet = "your-internal-azure-load-balancer-subnet" # Required when k8s_provider = "aro" + k8s_provider = "aro" + np_api_key = "your-np-api-key" } ``` @@ -127,6 +149,8 @@ resource "example_resource" "this" { | [cloudwatch\_logs\_enabled](#input\_cloudwatch\_logs\_enabled) | Enable log forwarding to CloudWatch. | `bool` | `false` | no | | [cloudwatch\_performance\_metrics\_enabled](#input\_cloudwatch\_performance\_metrics\_enabled) | Enable performance metrics in CloudWatch. | `bool` | `false` | no | | [cloudwatch\_service\_account\_annotations](#input\_cloudwatch\_service\_account\_annotations) | Annotations for the logs controller ServiceAccount (nullplatform-pod-metadata-reader-sa). Rendered only when cloudwatch\_enabled is true. Set eks.amazonaws.com/role-arn here to use IRSA instead of the node instance role. | `map(string)` | `{}` | no | +| [control\_plane\_agent\_image\_repository](#input\_control\_plane\_agent\_image\_repository) | Container image repository for the control plane agent. | `string` | `"public.ecr.aws/nullplatform/controlplane-agent"` | no | +| [control\_plane\_agent\_image\_tag](#input\_control\_plane\_agent\_image\_tag) | Container image tag for the control plane agent. | `string` | `"0.9.2"` | no | | [control\_plane\_enabled](#input\_control\_plane\_enabled) | Enable the control plane. | `bool` | `false` | no | | [datadog\_api\_key](#input\_datadog\_api\_key) | Datadog API key. | `string` | `""` | no | | [datadog\_enabled](#input\_datadog\_enabled) | Enable Datadog integration. | `bool` | `false` | no | @@ -175,6 +199,8 @@ resource "example_resource" "this" { | [internal\_azure\_load\_balancer\_subnet](#input\_internal\_azure\_load\_balancer\_subnet) | Name of the subnet for the internal gateway's Azure load balancer. Empty by default, in which case Azure picks the subnet automatically. Must be the subnet's resource name (e.g. "subnet-4"), not the key it has in a subnets\_definition map. | `string` | `""` | no | | [k8s\_provider](#input\_k8s\_provider) | Cloud provider (eks, gke, aks, oke and aro). | `string` | n/a | yes | | [logging\_application\_logs\_enabled](#input\_logging\_application\_logs\_enabled) | Enable application log forwarding. Set to false to keep only http/sys metrics pipelines active across all providers. | `bool` | `true` | no | +| [logging\_controller\_image\_repository](#input\_logging\_controller\_image\_repository) | Container image repository for the logs controller DaemonSet. | `string` | `"public.ecr.aws/nullplatform/k8s-logs-controller"` | no | +| [logging\_controller\_image\_tag](#input\_logging\_controller\_image\_tag) | Container image tag for the logs controller DaemonSet. | `string` | `"1.6.0"` | no | | [logging\_enabled](#input\_logging\_enabled) | Enable the logging layer. | `bool` | `true` | no | | [logging\_mount\_docker\_containers](#input\_logging\_mount\_docker\_containers) | Mount Docker container log paths. Enable when using Docker container runtime (e.g. Minikube). | `bool` | `false` | no | | [loki\_bearer\_token](#input\_loki\_bearer\_token) | Loki bearer token (if applicable). | `string` | `""` | no | @@ -211,16 +237,16 @@ resource "example_resource" "this" { diff --git a/nullplatform/cloud/aws/cloud/README.md b/nullplatform/cloud/aws/cloud/README.md index 18ae993c8..09e4c48dc 100644 --- a/nullplatform/cloud/aws/cloud/README.md +++ b/nullplatform/cloud/aws/cloud/README.md @@ -21,7 +21,7 @@ The module uses data sources aws_caller_identity and aws_region to dynamically r ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/cloud?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/cloud?ref=v6.17.0" domain_name = "your-domain-name" hosted_private_zone_id = "your-hosted-private-zone-id" diff --git a/nullplatform/cloud/aws/vpc/README.md b/nullplatform/cloud/aws/vpc/README.md index 2ead36205..1521eed31 100644 --- a/nullplatform/cloud/aws/vpc/README.md +++ b/nullplatform/cloud/aws/vpc/README.md @@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource of type aws-ne ```hcl module "vpc" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/vpc?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/vpc?ref=v6.17.0" nrn = "your-nrn" vpc_id = "your-vpc-id" diff --git a/nullplatform/cloud/azure/cloud/README.md b/nullplatform/cloud/azure/cloud/README.md index e4134163a..96a58d184 100644 --- a/nullplatform/cloud/azure/cloud/README.md +++ b/nullplatform/cloud/azure/cloud/README.md @@ -22,7 +22,7 @@ The module creates a single nullplatform_provider_config resource of type 'azure ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/azure/cloud?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/azure/cloud?ref=v6.17.0" azure_resource_group_name = "your-azure-resource-group-name" nrn = "your-nrn" diff --git a/nullplatform/cloud/gcp/cloud/README.md b/nullplatform/cloud/gcp/cloud/README.md index c4fab970b..08652f036 100644 --- a/nullplatform/cloud/gcp/cloud/README.md +++ b/nullplatform/cloud/gcp/cloud/README.md @@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type 'googl ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/gcp/cloud?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/gcp/cloud?ref=v6.17.0" domain_name = "your-domain-name" location = "your-location" diff --git a/nullplatform/cloud/oci/cloud/README.md b/nullplatform/cloud/oci/cloud/README.md index a6925f64e..93f4c71cd 100644 --- a/nullplatform/cloud/oci/cloud/README.md +++ b/nullplatform/cloud/oci/cloud/README.md @@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type 'oci-c ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/oci/cloud?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/oci/cloud?ref=v6.17.0" account_id = "your-account-id" account_name = "your-account-name" diff --git a/nullplatform/code_repository/README.md b/nullplatform/code_repository/README.md index 7343dc4b5..b50b166a2 100644 --- a/nullplatform/code_repository/README.md +++ b/nullplatform/code_repository/README.md @@ -22,7 +22,7 @@ The module uses local boolean flags (is_gitlab, is_github, is_azure, is_bitbucke ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.17.0" git_provider = "your-git-provider" nrn = "your-nrn" @@ -33,7 +33,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.17.0" git_provider = "github" github_installation_id = "your-github-installation-id" # Required when git_provider = "github" @@ -46,7 +46,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.17.0" git_provider = "gitlab" gitlab_access_token = "your-gitlab-access-token" # Required when git_provider = "gitlab" @@ -62,7 +62,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.17.0" azure_access_token = "your-azure-access-token" # Required when git_provider = "azure" azure_agent_pool = "your-azure-agent-pool" # Required when git_provider = "azure" @@ -76,7 +76,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.17.0" bitbucket_collaborators = "your-bitbucket-collaborators" # Required when git_provider = "bitbucket" bitbucket_installation_url = "your-bitbucket-installation-url" # Required when git_provider = "bitbucket" diff --git a/nullplatform/container_orchestration/aks/README.md b/nullplatform/container_orchestration/aks/README.md index b39e485f2..ba22b492e 100644 --- a/nullplatform/container_orchestration/aks/README.md +++ b/nullplatform/container_orchestration/aks/README.md @@ -21,7 +21,7 @@ The module builds a local.attributes map that aggregates cluster metadata, gatew ```hcl module "aks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.17.0" cluster_name = "your-cluster-name" nrn = "your-nrn" diff --git a/nullplatform/container_orchestration/eks/README.md b/nullplatform/container_orchestration/eks/README.md index 589f9626b..b26a551c8 100644 --- a/nullplatform/container_orchestration/eks/README.md +++ b/nullplatform/container_orchestration/eks/README.md @@ -22,7 +22,7 @@ The module assembles a set of structured locals by merging optional variables in ```hcl module "eks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.17.0" cluster_name = "your-cluster-name" nrn = "your-nrn" diff --git a/nullplatform/container_orchestration/gke/README.md b/nullplatform/container_orchestration/gke/README.md index de96ca4f1..296326d86 100644 --- a/nullplatform/container_orchestration/gke/README.md +++ b/nullplatform/container_orchestration/gke/README.md @@ -22,7 +22,7 @@ The module constructs a structured attributes object using locals that merge clu ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.17.0" cluster_name = "your-cluster-name" location = "your-location" diff --git a/nullplatform/container_orchestration/oke/README.md b/nullplatform/container_orchestration/oke/README.md index 4c8515831..6fbc46307 100644 --- a/nullplatform/container_orchestration/oke/README.md +++ b/nullplatform/container_orchestration/oke/README.md @@ -19,7 +19,7 @@ Creates a single nullplatform_provider_config resource of type 'oke' that stores ```hcl module "oke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/oke?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/oke?ref=v6.17.0" cluster_name = "your-cluster-name" nrn = "your-nrn" diff --git a/nullplatform/dimension/README.md b/nullplatform/dimension/README.md index 4c6f4b0cb..a5493146e 100644 --- a/nullplatform/dimension/README.md +++ b/nullplatform/dimension/README.md @@ -19,7 +19,7 @@ The module creates a nullplatform_dimension resource using the provided name, or ```hcl module "dimension" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension?ref=v6.17.0" name = "your-name" nrn = "your-nrn" diff --git a/nullplatform/dimension_value/README.md b/nullplatform/dimension_value/README.md index 3a2fc23f3..82bb10354 100644 --- a/nullplatform/dimension_value/README.md +++ b/nullplatform/dimension_value/README.md @@ -19,7 +19,7 @@ The module uses a terraform_data resource to enforce mutual-exclusivity and pres ```hcl module "dimension_value" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension_value?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension_value?ref=v6.17.0" dimension_id = "your-dimension-id" name = "your-name" diff --git a/nullplatform/identity-access-control/README.md b/nullplatform/identity-access-control/README.md index 97adcf038..dbd5e1a41 100644 --- a/nullplatform/identity-access-control/README.md +++ b/nullplatform/identity-access-control/README.md @@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource named identity ```hcl module "identity-access-control" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/identity-access-control?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/identity-access-control?ref=v6.17.0" attributes = "your-attributes" nrn = "your-nrn" diff --git a/nullplatform/metrics/README.md b/nullplatform/metrics/README.md index 6be8ab7b6..dd9f2c4f7 100644 --- a/nullplatform/metrics/README.md +++ b/nullplatform/metrics/README.md @@ -21,7 +21,7 @@ The module creates a single nullplatform_provider_config resource of type 'prome ```hcl module "metrics" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/metrics?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/metrics?ref=v6.17.0" nrn = "your-nrn" } diff --git a/nullplatform/packaged_service/README.md b/nullplatform/packaged_service/README.md index 98d9fd80e..a7b306711 100644 --- a/nullplatform/packaged_service/README.md +++ b/nullplatform/packaged_service/README.md @@ -17,7 +17,7 @@ spec updates / republish correctly. ```hcl module "packaged_service" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/packaged_service?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/packaged_service?ref=v6.17.0" nrn = "organization=…:account=…:namespace=…" diff --git a/nullplatform/parameter_storage_configuration/README.md b/nullplatform/parameter_storage_configuration/README.md index 73cac83e8..72d9e3d0c 100644 --- a/nullplatform/parameter_storage_configuration/README.md +++ b/nullplatform/parameter_storage_configuration/README.md @@ -20,7 +20,7 @@ The module delegates entirely to a remote `scope_configuration` module sourced f ```hcl module "parameter_storage_configuration" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_configuration?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_configuration?ref=v6.17.0" attributes = "your-attributes" np_api_key = "your-np-api-key" diff --git a/nullplatform/parameter_storage_definition/README.md b/nullplatform/parameter_storage_definition/README.md index d7ba817eb..8ce2ecf7e 100644 --- a/nullplatform/parameter_storage_definition/README.md +++ b/nullplatform/parameter_storage_definition/README.md @@ -20,7 +20,7 @@ A data.http resource fetches the raw specification template from a configurable ```hcl module "parameter_storage_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition?ref=v6.17.0" np_api_key = "your-np-api-key" nrn = "your-nrn" diff --git a/nullplatform/parameter_storage_definition_agent_association/README.md b/nullplatform/parameter_storage_definition_agent_association/README.md index 36368bb01..44f49d950 100644 --- a/nullplatform/parameter_storage_definition_agent_association/README.md +++ b/nullplatform/parameter_storage_definition_agent_association/README.md @@ -21,7 +21,7 @@ The module creates a terraform_data resource to track API key changes and a null ```hcl module "parameter_storage_definition_agent_association" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition_agent_association?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition_agent_association?ref=v6.17.0" api_key = "your-api-key" nrn = "your-nrn" diff --git a/nullplatform/scope_configuration/README.md b/nullplatform/scope_configuration/README.md index 5939eeef5..d77f54ab3 100644 --- a/nullplatform/scope_configuration/README.md +++ b/nullplatform/scope_configuration/README.md @@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource that binds a N ```hcl module "scope_configuration" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_configuration?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_configuration?ref=v6.17.0" attributes = "your-attributes" np_api_key = "your-np-api-key" diff --git a/nullplatform/scope_definition/README.md b/nullplatform/scope_definition/README.md index 1a9d4746b..310e3e6d7 100644 --- a/nullplatform/scope_definition/README.md +++ b/nullplatform/scope_definition/README.md @@ -22,7 +22,7 @@ The module fetches JSON templates via data.http resources from a configurable Gi ```hcl module "scope_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition?ref=v6.17.0" np_api_key = "your-np-api-key" nrn = "your-nrn" diff --git a/nullplatform/scope_definition_agent_association/README.md b/nullplatform/scope_definition_agent_association/README.md index ac21368f9..cddca929f 100644 --- a/nullplatform/scope_definition_agent_association/README.md +++ b/nullplatform/scope_definition_agent_association/README.md @@ -22,7 +22,7 @@ The module fetches a notification channel JSON template via the `data.http` prov ```hcl module "scope_definition_agent_association" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition_agent_association?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition_agent_association?ref=v6.17.0" api_key = "your-api-key" nrn = "your-nrn" diff --git a/nullplatform/service_definition/README.md b/nullplatform/service_definition/README.md index d55fb2243..f5b592f50 100644 --- a/nullplatform/service_definition/README.md +++ b/nullplatform/service_definition/README.md @@ -22,7 +22,7 @@ The module uses data.http resources to fetch service-spec, action, and link JSON ```hcl module "service_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.17.0" nrn = "your-nrn" service_name = "your-service-name" diff --git a/nullplatform/service_definition_agent_association/README.md b/nullplatform/service_definition_agent_association/README.md index 587c0c9c1..29dc26419 100644 --- a/nullplatform/service_definition_agent_association/README.md +++ b/nullplatform/service_definition_agent_association/README.md @@ -22,7 +22,7 @@ The module creates a terraform_data resource to track API key changes as a lifec ```hcl module "service_definition_agent_association" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition_agent_association?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition_agent_association?ref=v6.17.0" api_key = "your-api-key" repository_service_spec_repo = "your-repository-service-spec-repo" diff --git a/nullplatform/users/README.md b/nullplatform/users/README.md index 7ddd31f01..579bfa7be 100644 --- a/nullplatform/users/README.md +++ b/nullplatform/users/README.md @@ -21,7 +21,7 @@ The module iterates over a map of user definitions using `nullplatform_user` res ```hcl module "users" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/users?ref=v6.16.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/users?ref=v6.17.0" nullplatform_users = "your-nullplatform-users" } From c5e65d637ced9bc83c8199c7fb1e1bb1390e08f6 Mon Sep 17 00:00:00 2001 From: Federico Maleh Date: Tue, 18 Aug 2026 22:29:30 -0300 Subject: [PATCH 31/81] feat(istio): expose istio_ingressgateway_replicas to guarantee HA for node drains (#379) * feat(istio): expose istio_ingressgateway_replicas to guarantee HA for node drains * chore(istio): drop verbose comment on ingressgateway HA set block --------- Co-authored-by: Sebastian Correa --- infrastructure/commons/istio/main.tf | 11 ++++++++++- infrastructure/commons/istio/variables.tf | 11 +++++++++++ 2 files changed, 21 insertions(+), 1 deletion(-) diff --git a/infrastructure/commons/istio/main.tf b/infrastructure/commons/istio/main.tf index 3f8c27c59..f3858e12f 100644 --- a/infrastructure/commons/istio/main.tf +++ b/infrastructure/commons/istio/main.tf @@ -88,5 +88,14 @@ resource "helm_release" "istio_ingressgateway" { values = [local.helm_values] - + set = [ + { + name = "replicaCount" + value = var.istio_ingressgateway_replicas + }, + { + name = "autoscaling.minReplicas" + value = var.istio_ingressgateway_replicas + }, + ] } diff --git a/infrastructure/commons/istio/variables.tf b/infrastructure/commons/istio/variables.tf index cc29466b7..87b6b1fcc 100644 --- a/infrastructure/commons/istio/variables.tf +++ b/infrastructure/commons/istio/variables.tf @@ -31,6 +31,17 @@ variable "istiod_replicas" { } } +variable "istio_ingressgateway_replicas" { + description = "Number of istio-ingressgateway replicas. Set to 2+ to avoid PDB blocking node drains. Applied to both replicaCount and autoscaling.minReplicas to prevent the HPA from scaling back to 1. The Istio gateway Helm chart installs the gateway with a default PodDisruptionBudget (minAvailable=1), so a single replica blocks node rolling updates with PodEvictionFailure — same class of bug as the istiod single-replica issue." + type = number + default = 2 + + validation { + condition = var.istio_ingressgateway_replicas >= 1 + error_message = "istio_ingressgateway_replicas must be at least 1." + } +} + ############################################################################### # SERVICE CONFIGURATION ############################################################################### From 98dfcff96aa1ebf53f54e8a4b2de95c4f58b3e38 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 19 Aug 2026 01:30:08 +0000 Subject: [PATCH 32/81] chore(6.x): release 6.18.0 --- CHANGELOG.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index a7e0fb46e..fee4eae6a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,12 @@ # Changelog +## [6.18.0](https://github.com/nullplatform/tofu-modules/compare/v6.17.0...v6.18.0) (2026-08-19) + + +### Features + +* **istio:** expose istio_ingressgateway_replicas to guarantee HA for node drains ([#379](https://github.com/nullplatform/tofu-modules/issues/379)) ([058986c](https://github.com/nullplatform/tofu-modules/commit/058986c7c5aaf8a998bd25bcf021fc40c2fd0dce)) + ## [6.17.0](https://github.com/nullplatform/tofu-modules/compare/v6.16.1...v6.17.0) (2026-08-19) From 6708003221789641e88ccefdc791720752934e3e Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Wed, 19 Aug 2026 01:30:47 +0000 Subject: [PATCH 33/81] docs: regenerate READMEs for changed modules and update versions --- infrastructure/aws/acm/README.md | 2 +- .../aws_load_balancer_controller/README.md | 2 +- infrastructure/aws/backend/README.md | 2 +- infrastructure/aws/dns/README.md | 2 +- infrastructure/aws/eks/README.md | 2 +- infrastructure/aws/iam/agent/README.md | 2 +- .../README.md | 2 +- infrastructure/aws/iam/cert_manager/README.md | 2 +- .../aws/iam/ci-build-workflow-user/README.md | 2 +- infrastructure/aws/iam/cloudwatch/README.md | 2 +- infrastructure/aws/iam/ecr/README.md | 2 +- infrastructure/aws/iam/external_dns/README.md | 2 +- infrastructure/aws/iam/s3/README.md | 2 +- infrastructure/aws/ingress/README.md | 2 +- infrastructure/aws/security/README.md | 2 +- infrastructure/aws/vpc/README.md | 2 +- infrastructure/azure/acr/README.md | 2 +- infrastructure/azure/aks/README.md | 2 +- .../azure/aks_route_table/README.md | 2 +- infrastructure/azure/dns/README.md | 2 +- infrastructure/azure/iam/README.md | 2 +- infrastructure/azure/private_dns/README.md | 2 +- infrastructure/azure/resource_group/README.md | 2 +- infrastructure/azure/security/README.md | 2 +- infrastructure/azure/vnet/README.md | 2 +- infrastructure/commons/cert_manager/README.md | 12 +++--- infrastructure/commons/external_dns/README.md | 12 +++--- infrastructure/commons/istio/README.md | 42 +++++++++++-------- infrastructure/commons/prometheus/README.md | 2 +- .../gcp/artifact-registry/README.md | 2 +- infrastructure/gcp/backend/README.md | 2 +- infrastructure/gcp/cloud-dns/README.md | 2 +- infrastructure/gcp/cloud-nat/README.md | 2 +- infrastructure/gcp/gke/README.md | 6 +-- infrastructure/gcp/iam/README.md | 2 +- infrastructure/gcp/security/README.md | 2 +- infrastructure/gcp/vpc/README.md | 2 +- infrastructure/oci/backend/README.md | 2 +- infrastructure/oci/dns/README.md | 2 +- infrastructure/oci/dynamic_groups/README.md | 2 +- infrastructure/oci/oke/README.md | 2 +- infrastructure/oci/vcn/README.md | 2 +- nullplatform/account/README.md | 2 +- nullplatform/agent/README.md | 10 ++--- nullplatform/api_key/README.md | 10 ++--- nullplatform/asset/docker_server/README.md | 2 +- nullplatform/asset/ecr/README.md | 2 +- nullplatform/asset/s3/README.md | 2 +- nullplatform/base/README.md | 12 +++--- nullplatform/cloud/aws/cloud/README.md | 2 +- nullplatform/cloud/aws/vpc/README.md | 2 +- nullplatform/cloud/azure/cloud/README.md | 2 +- nullplatform/cloud/gcp/cloud/README.md | 2 +- nullplatform/cloud/oci/cloud/README.md | 2 +- nullplatform/code_repository/README.md | 10 ++--- .../container_orchestration/aks/README.md | 2 +- .../container_orchestration/eks/README.md | 2 +- .../container_orchestration/gke/README.md | 2 +- .../container_orchestration/oke/README.md | 2 +- nullplatform/dimension/README.md | 2 +- nullplatform/dimension_value/README.md | 2 +- .../identity-access-control/README.md | 2 +- nullplatform/metrics/README.md | 2 +- nullplatform/packaged_service/README.md | 2 +- .../parameter_storage_configuration/README.md | 2 +- .../parameter_storage_definition/README.md | 2 +- .../README.md | 2 +- nullplatform/scope_configuration/README.md | 2 +- nullplatform/scope_definition/README.md | 2 +- .../README.md | 2 +- nullplatform/service_definition/README.md | 2 +- .../README.md | 2 +- nullplatform/users/README.md | 2 +- 73 files changed, 125 insertions(+), 119 deletions(-) diff --git a/infrastructure/aws/acm/README.md b/infrastructure/aws/acm/README.md index a425379d3..4e2a9215b 100644 --- a/infrastructure/aws/acm/README.md +++ b/infrastructure/aws/acm/README.md @@ -18,7 +18,7 @@ The module creates an aws_acm_certificate resource with DNS validation, which is ```hcl module "acm" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/acm?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/acm?ref=v6.18.0" domain_name = "your-domain-name" zone_id = "your-zone-id" diff --git a/infrastructure/aws/aws_load_balancer_controller/README.md b/infrastructure/aws/aws_load_balancer_controller/README.md index b0001cbf4..989ea45a7 100644 --- a/infrastructure/aws/aws_load_balancer_controller/README.md +++ b/infrastructure/aws/aws_load_balancer_controller/README.md @@ -18,7 +18,7 @@ This module creates a helm_release resource to deploy the AWS Load Balancer Cont ```hcl module "aws_load_balancer_controller" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/aws_load_balancer_controller?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/aws_load_balancer_controller?ref=v6.18.0" cluster_name = "your-cluster-name" vpc_id = "your-vpc-id" diff --git a/infrastructure/aws/backend/README.md b/infrastructure/aws/backend/README.md index 83fb10826..f6c1e54a3 100644 --- a/infrastructure/aws/backend/README.md +++ b/infrastructure/aws/backend/README.md @@ -20,7 +20,7 @@ This module creates an S3 bucket with versioning and server-side encryption enab ```hcl module "backend" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/backend?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/backend?ref=v6.18.0" } ``` diff --git a/infrastructure/aws/dns/README.md b/infrastructure/aws/dns/README.md index c62287105..367c82183 100644 --- a/infrastructure/aws/dns/README.md +++ b/infrastructure/aws/dns/README.md @@ -21,7 +21,7 @@ The module conditionally creates an aws_route53_zone resource for a public hoste ```hcl module "dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/dns?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/dns?ref=v6.18.0" domain_name = "your-domain-name" vpc_id = "your-vpc-id" diff --git a/infrastructure/aws/eks/README.md b/infrastructure/aws/eks/README.md index d7d0c4b70..89cf6f9e9 100644 --- a/infrastructure/aws/eks/README.md +++ b/infrastructure/aws/eks/README.md @@ -22,7 +22,7 @@ The module wraps terraform-aws-modules/eks to create the EKS cluster (aws_eks_cl ```hcl module "eks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/eks?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/eks?ref=v6.18.0" aws_subnets_private_ids = "your-aws-subnets-private-ids" aws_vpc_vpc_id = "your-aws-vpc-vpc-id" diff --git a/infrastructure/aws/iam/agent/README.md b/infrastructure/aws/iam/agent/README.md index 9df446df8..1ef5ca2e8 100644 --- a/infrastructure/aws/iam/agent/README.md +++ b/infrastructure/aws/iam/agent/README.md @@ -21,7 +21,7 @@ The module uses the terraform-aws-modules/iam//modules/iam-role-for-service-acco ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/agent?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/agent?ref=v6.18.0" agent_namespace = "your-agent-namespace" aws_iam_openid_connect_provider_arn = "your-aws-iam-openid-connect-provider-arn" diff --git a/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md b/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md index 84c3bd69c..550a9ed46 100644 --- a/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md +++ b/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md @@ -19,7 +19,7 @@ This module creates an IAM role for the AWS Load Balancer Controller using the t ```hcl module "aws_load_balancer_controller_iam" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/aws_load_balancer_controller_iam?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/aws_load_balancer_controller_iam?ref=v6.18.0" aws_iam_openid_connect_provider_arn = "your-aws-iam-openid-connect-provider-arn" cluster_name = "your-cluster-name" diff --git a/infrastructure/aws/iam/cert_manager/README.md b/infrastructure/aws/iam/cert_manager/README.md index 5ad642dbc..bca45498c 100644 --- a/infrastructure/aws/iam/cert_manager/README.md +++ b/infrastructure/aws/iam/cert_manager/README.md @@ -20,7 +20,7 @@ An aws_iam_policy resource is always created granting route53:GetChange, route53 ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cert_manager?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cert_manager?ref=v6.18.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/ci-build-workflow-user/README.md b/infrastructure/aws/iam/ci-build-workflow-user/README.md index 073d0eb61..66fc91d8b 100644 --- a/infrastructure/aws/iam/ci-build-workflow-user/README.md +++ b/infrastructure/aws/iam/ci-build-workflow-user/README.md @@ -21,7 +21,7 @@ The module creates an aws_iam_user named with the cluster_name prefix and genera ```hcl module "ci-build-workflow-user" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ci-build-workflow-user?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ci-build-workflow-user?ref=v6.18.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/cloudwatch/README.md b/infrastructure/aws/iam/cloudwatch/README.md index e395ad8fb..a97250dda 100644 --- a/infrastructure/aws/iam/cloudwatch/README.md +++ b/infrastructure/aws/iam/cloudwatch/README.md @@ -20,7 +20,7 @@ The module creates an aws_iam_policy granting CloudWatch Logs and Metrics write ```hcl module "cloudwatch" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cloudwatch?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cloudwatch?ref=v6.18.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/ecr/README.md b/infrastructure/aws/iam/ecr/README.md index cb982ecc9..9bee2421a 100644 --- a/infrastructure/aws/iam/ecr/README.md +++ b/infrastructure/aws/iam/ecr/README.md @@ -20,7 +20,7 @@ The module creates an aws_iam_role named nullplatform-{cluster_name}-application ```hcl module "ecr" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ecr?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ecr?ref=v6.18.0" build_workflow_group_name = "your-build-workflow-group-name" cluster_name = "your-cluster-name" diff --git a/infrastructure/aws/iam/external_dns/README.md b/infrastructure/aws/iam/external_dns/README.md index 6df050c47..af77f65fb 100644 --- a/infrastructure/aws/iam/external_dns/README.md +++ b/infrastructure/aws/iam/external_dns/README.md @@ -20,7 +20,7 @@ An aws_iam_policy resource named nullplatform_external_dns_policy is always crea ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/external_dns?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/external_dns?ref=v6.18.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/s3/README.md b/infrastructure/aws/iam/s3/README.md index 2b094b61a..901c8afc8 100644 --- a/infrastructure/aws/iam/s3/README.md +++ b/infrastructure/aws/iam/s3/README.md @@ -18,7 +18,7 @@ The module creates an aws_iam_policy resource that allows s3:PutObject and s3:Ge ```hcl module "s3" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/s3?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/s3?ref=v6.18.0" bucket = "your-bucket" build_workflow_group_name = "your-build-workflow-group-name" diff --git a/infrastructure/aws/ingress/README.md b/infrastructure/aws/ingress/README.md index af7f53b72..4d25ada59 100644 --- a/infrastructure/aws/ingress/README.md +++ b/infrastructure/aws/ingress/README.md @@ -22,7 +22,7 @@ The module creates up to two kubernetes_ingress_v1 resources — one for an inte ```hcl module "ingress" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/ingress?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/ingress?ref=v6.18.0" certificate_arn = "your-certificate-arn" } diff --git a/infrastructure/aws/security/README.md b/infrastructure/aws/security/README.md index d77b504bb..afdbced46 100644 --- a/infrastructure/aws/security/README.md +++ b/infrastructure/aws/security/README.md @@ -22,7 +22,7 @@ The module uses data sources (aws_eks_cluster, aws_vpc) to automatically derive ```hcl module "security" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/security?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/security?ref=v6.18.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/vpc/README.md b/infrastructure/aws/vpc/README.md index b97ee5aac..70b698901 100644 --- a/infrastructure/aws/vpc/README.md +++ b/infrastructure/aws/vpc/README.md @@ -22,7 +22,7 @@ This module creates a terraform-aws-modules/vpc/aws module resource with DNS hos ```hcl module "vpc" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/vpc?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/vpc?ref=v6.18.0" account = "your-account" organization = "your-organization" diff --git a/infrastructure/azure/acr/README.md b/infrastructure/azure/acr/README.md index 7a4858391..49ff1ee79 100644 --- a/infrastructure/azure/acr/README.md +++ b/infrastructure/azure/acr/README.md @@ -18,7 +18,7 @@ The module uses the azurerm_container_registry resource to create the container ```hcl module "acr" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/acr?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/acr?ref=v6.18.0" containerregistry_name = "your-containerregistry-name" location = "your-location" diff --git a/infrastructure/azure/aks/README.md b/infrastructure/azure/aks/README.md index 6301439e7..6afbc7c94 100644 --- a/infrastructure/azure/aks/README.md +++ b/infrastructure/azure/aks/README.md @@ -22,7 +22,7 @@ The module wraps the Azure/aks/azurerm community module (version 11.0.0) and use ```hcl module "aks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks?ref=v6.18.0" cluster_name = "your-cluster-name" location = "your-location" diff --git a/infrastructure/azure/aks_route_table/README.md b/infrastructure/azure/aks_route_table/README.md index fec49957b..a0fc3af76 100644 --- a/infrastructure/azure/aks_route_table/README.md +++ b/infrastructure/azure/aks_route_table/README.md @@ -19,7 +19,7 @@ The module uses an azurerm_resources data source to discover the AKS-managed rou ```hcl module "aks_route_table" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks_route_table?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks_route_table?ref=v6.18.0" node_resource_group = "your-node-resource-group" subnet_id = "your-subnet-id" diff --git a/infrastructure/azure/dns/README.md b/infrastructure/azure/dns/README.md index 837d8e241..9c36a0cd8 100644 --- a/infrastructure/azure/dns/README.md +++ b/infrastructure/azure/dns/README.md @@ -18,7 +18,7 @@ This module creates an azurerm_dns_zone resource and configures it with the prov ```hcl module "dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/dns?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/dns?ref=v6.18.0" domain_name = "your-domain-name" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/iam/README.md b/infrastructure/azure/iam/README.md index 6ff3de404..d3b048a8d 100644 --- a/infrastructure/azure/iam/README.md +++ b/infrastructure/azure/iam/README.md @@ -21,7 +21,7 @@ The module creates an azurerm_user_assigned_identity resource in the specified r ```hcl module "iam" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/iam?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/iam?ref=v6.18.0" location = "your-location" name = "your-name" diff --git a/infrastructure/azure/private_dns/README.md b/infrastructure/azure/private_dns/README.md index 19003d399..092f76f72 100644 --- a/infrastructure/azure/private_dns/README.md +++ b/infrastructure/azure/private_dns/README.md @@ -18,7 +18,7 @@ This module creates an azurerm_private_dns_zone resource and optionally multiple ```hcl module "private_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/private_dns?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/private_dns?ref=v6.18.0" domain_name = "your-domain-name" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/resource_group/README.md b/infrastructure/azure/resource_group/README.md index abdc518d1..3e473dc3a 100644 --- a/infrastructure/azure/resource_group/README.md +++ b/infrastructure/azure/resource_group/README.md @@ -18,7 +18,7 @@ This module creates an azurerm_resource_group resource and outputs its name and ```hcl module "resource_group" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/resource_group?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/resource_group?ref=v6.18.0" location = "your-location" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/security/README.md b/infrastructure/azure/security/README.md index 1b4332220..1a63117da 100644 --- a/infrastructure/azure/security/README.md +++ b/infrastructure/azure/security/README.md @@ -21,7 +21,7 @@ The module uses azurerm_kubernetes_cluster and azurerm_virtual_network data sour ```hcl module "security" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/security?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/security?ref=v6.18.0" cluster_name = "your-cluster-name" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/vnet/README.md b/infrastructure/azure/vnet/README.md index c89695139..e787268ea 100644 --- a/infrastructure/azure/vnet/README.md +++ b/infrastructure/azure/vnet/README.md @@ -18,7 +18,7 @@ This module creates an Azure virtual network using the azurerm provider and conf ```hcl module "vnet" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/vnet?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/vnet?ref=v6.18.0" address_space = "your-address-space" location = "your-location" diff --git a/infrastructure/commons/cert_manager/README.md b/infrastructure/commons/cert_manager/README.md index bccc81c85..b72f90cd8 100644 --- a/infrastructure/commons/cert_manager/README.md +++ b/infrastructure/commons/cert_manager/README.md @@ -22,7 +22,7 @@ Two primary helm_release resources are created: cert-manager from the Jetstack c ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.18.0" account_slug = "your-account-slug" cloud_provider = "your-cloud-provider" @@ -35,7 +35,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.18.0" account_slug = "your-account-slug" cloud_provider = "gcp" @@ -50,7 +50,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.18.0" account_slug = "your-account-slug" azure_client_id = "your-azure-client-id" # Required when cloud_provider = "azure" @@ -68,7 +68,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.18.0" account_slug = "your-account-slug" cloud_provider = "cloudflare" @@ -83,7 +83,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.18.0" account_slug = "your-account-slug" aws_identity_mode = "your-aws-identity-mode" # Required when cloud_provider = "aws" @@ -99,7 +99,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.18.0" account_slug = "your-account-slug" cert_manager_webhook_oci_namespace = "your-cert-manager-webhook-oci-namespace" # Required when cloud_provider = "oci" diff --git a/infrastructure/commons/external_dns/README.md b/infrastructure/commons/external_dns/README.md index 848325e60..cfc9c8200 100644 --- a/infrastructure/commons/external_dns/README.md +++ b/infrastructure/commons/external_dns/README.md @@ -22,7 +22,7 @@ The module creates an optional kubernetes_namespace_v1 resource when create_name ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.18.0" dns_provider_name = "your-dns-provider-name" domain_filters = "your-domain-filters" @@ -33,7 +33,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.18.0" cloudflare_token = "your-cloudflare-token" # Required when dns_provider_name = "cloudflare" dns_provider_name = "cloudflare" @@ -45,7 +45,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.18.0" aws_iam_role_arn = "your-aws-iam-role-arn" # Required when dns_provider_name = "aws" aws_identity_mode = "your-aws-identity-mode" # Required when dns_provider_name = "aws" @@ -61,7 +61,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.18.0" dns_provider_name = "oci" domain_filters = "your-domain-filters" @@ -77,7 +77,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.18.0" azure_client_id = "your-azure-client-id" # Required when dns_provider_name = "azure" azure_federated_credential_id = "your-azure-federated-credential-id" # Required when dns_provider_name = "azure" @@ -94,7 +94,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.18.0" azure_client_id = "your-azure-client-id" # Required when dns_provider_name = "azure-private-dns" azure_federated_credential_id = "your-azure-federated-credential-id" # Required when dns_provider_name = "azure-private-dns" diff --git a/infrastructure/commons/istio/README.md b/infrastructure/commons/istio/README.md index c3dbd7727..7daf14d9f 100644 --- a/infrastructure/commons/istio/README.md +++ b/infrastructure/commons/istio/README.md @@ -2,26 +2,26 @@ ## Description -Deploys a full Istio service mesh stack (istio-base, istiod, and istio-ingressgateway) on Kubernetes using sequenced Helm releases with cloud-provider-specific LoadBalancer annotations +Deploys a production-ready Istio service mesh on Kubernetes using three sequentially ordered Helm releases: istio-base, istiod, and istio-ingressgateway ## Architecture -Three helm_release resources are created in a strict dependency chain: istio-base is deployed first, istiod depends on istio-base and configures pilot.replicaCount and pilot.autoscaleMin via dynamic set blocks using var.istiod_replicas, and istio-ingressgateway depends on istiod and receives its configuration through a templatefile-rendered values YAML stored in locals.helm_values. The template injects service type, port mappings, HTTP2 settings, and cloud-provider-specific annotations (such as OCI subnet IDs) into the gateway Helm chart values. +The module creates three helm_release resources in a strict dependency chain: istio-base (CRDs and cluster-wide resources), istiod (control plane, dependent on istio-base), and istio-ingressgateway (data plane gateway, dependent on istiod). The istiod helm_release sets both pilot.replicaCount and pilot.autoscaleMin via the set block to prevent HPA from overriding the replica floor. The istio-ingressgateway helm_release merges a templatefile-rendered YAML (istio_ingressgateway.tmpl.yaml) with set blocks for replicaCount and autoscaling.minReplicas, and the template conditionally injects cloud-provider-specific LoadBalancer annotations based on the cloud_provider variable. ## Features -- Deploys istio-base, istiod, and istio-ingressgateway Helm charts in dependency order with atomic and cleanup-on-fail guarantees -- Configures istiod HA by setting both pilot.replicaCount and pilot.autoscaleMin to prevent the HPA from scaling below the desired replica floor -- Renders cloud-provider-specific LoadBalancer annotations for AWS, OCI, Azure, and GCP via a templatefile-based Helm values injection -- Exposes configurable HTTPS and optional HTTP2 ports with independently tunable service and container target ports -- Supports OCI-specific LoadBalancer subnet assignment via oci_load_balancer_subnet_ids annotation injection -- Allows namespace, Helm repository URL, and individual chart versions to be overridden independently for each Istio component +- Deploys istio-base, istiod, and istio-ingressgateway Helm charts in strict dependency order with atomic rollback on failure +- Configures istiod HA by setting both pilot.replicaCount and pilot.autoscaleMin to prevent PodDisruptionBudget from blocking node drains +- Configures istio-ingressgateway HA by locking both replicaCount and autoscaling.minReplicas to prevent single-replica PDB drain deadlocks +- Injects cloud-provider-specific LoadBalancer annotations for AWS, OCI, Azure, and GCP via a templated Helm values file +- Supports optional HTTP/2 port exposure on the ingress gateway alongside the default HTTPS port +- Allows OCI-specific subnet OCID injection for LoadBalancer Service configuration ## Basic Usage ```hcl module "istio" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/istio?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/istio?ref=v6.18.0" } ``` @@ -68,6 +68,7 @@ resource "example_resource" "this" { | [https\_port](#input\_https\_port) | The external HTTPS service port | `number` | `443` | no | | [https\_target\_port](#input\_https\_target\_port) | The container target port for HTTPS | `number` | `8443` | no | | [istio\_base\_version](#input\_istio\_base\_version) | Helm chart version for the istio-base component | `string` | `"1.27.1"` | no | +| [istio\_ingressgateway\_replicas](#input\_istio\_ingressgateway\_replicas) | Number of istio-ingressgateway replicas. Set to 2+ to avoid PDB blocking node drains. Applied to both replicaCount and autoscaling.minReplicas to prevent the HPA from scaling back to 1. The Istio gateway Helm chart installs the gateway with a default PodDisruptionBudget (minAvailable=1), so a single replica blocks node rolling updates with PodEvictionFailure — same class of bug as the istiod single-replica issue. | `number` | `2` | no | | [istio\_ingressgateway\_version](#input\_istio\_ingressgateway\_version) | Helm chart version for the Istio ingress gateway | `string` | `"1.27.1"` | no | | [istiod\_replicas](#input\_istiod\_replicas) | Number of istiod replicas. Set to 2+ to avoid PDB blocking node drains. Applied to both pilot.replicaCount and pilot.autoscaleMin to prevent the HPA from scaling back to 1. | `number` | `2` | no | | [istiod\_version](#input\_istiod\_version) | Helm chart version for istiod (Istio control plane) | `string` | `"1.27.1"` | no | @@ -81,15 +82,15 @@ resource "example_resource" "this" { diff --git a/infrastructure/commons/prometheus/README.md b/infrastructure/commons/prometheus/README.md index 9ad27cd89..7ee42d122 100644 --- a/infrastructure/commons/prometheus/README.md +++ b/infrastructure/commons/prometheus/README.md @@ -18,7 +18,7 @@ This module creates a helm_release resource to deploy the Prometheus chart from ```hcl module "prometheus" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.18.0" } ``` diff --git a/infrastructure/gcp/artifact-registry/README.md b/infrastructure/gcp/artifact-registry/README.md index 8ca4df3f6..814b9377c 100644 --- a/infrastructure/gcp/artifact-registry/README.md +++ b/infrastructure/gcp/artifact-registry/README.md @@ -21,7 +21,7 @@ The module creates a google_artifact_registry_repository resource configured wit ```hcl module "artifact-registry" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/artifact-registry?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/artifact-registry?ref=v6.18.0" location = "your-location" project_id = "your-project-id" diff --git a/infrastructure/gcp/backend/README.md b/infrastructure/gcp/backend/README.md index 2115d43f4..8afdf9c58 100644 --- a/infrastructure/gcp/backend/README.md +++ b/infrastructure/gcp/backend/README.md @@ -22,7 +22,7 @@ The module creates a random_id resource to generate a unique 8-byte hex suffix, ```hcl module "backend" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/backend?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/backend?ref=v6.18.0" project_id = "your-project-id" } diff --git a/infrastructure/gcp/cloud-dns/README.md b/infrastructure/gcp/cloud-dns/README.md index 197656ea3..2a9790da9 100644 --- a/infrastructure/gcp/cloud-dns/README.md +++ b/infrastructure/gcp/cloud-dns/README.md @@ -21,7 +21,7 @@ The module creates a single google_dns_managed_zone resource in the specified GC ```hcl module "cloud-dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-dns?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-dns?ref=v6.18.0" domain_name = "your-domain-name" project_id = "your-project-id" diff --git a/infrastructure/gcp/cloud-nat/README.md b/infrastructure/gcp/cloud-nat/README.md index ade6d6b79..a07420850 100644 --- a/infrastructure/gcp/cloud-nat/README.md +++ b/infrastructure/gcp/cloud-nat/README.md @@ -19,7 +19,7 @@ This module creates a google_compute_router resource in a specified region and n ```hcl module "cloud-nat" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-nat?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-nat?ref=v6.18.0" nat_name = "your-nat-name" network_id = "your-network-id" diff --git a/infrastructure/gcp/gke/README.md b/infrastructure/gcp/gke/README.md index 15579f043..5b0d27ac6 100644 --- a/infrastructure/gcp/gke/README.md +++ b/infrastructure/gcp/gke/README.md @@ -22,7 +22,7 @@ The module conditionally creates one of two mutually-exclusive submodules based ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.18.0" cluster_name = "your-cluster-name" ip_range_pods = "your-ip-range-pods" @@ -38,7 +38,7 @@ module "gke" { ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.18.0" cluster_name = "your-cluster-name" ip_range_pods = "your-ip-range-pods" @@ -73,7 +73,7 @@ module "gke" { ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.18.0" cluster_name = "your-cluster-name" ip_range_pods = "your-ip-range-pods" diff --git a/infrastructure/gcp/iam/README.md b/infrastructure/gcp/iam/README.md index ca631445c..b449e37b7 100644 --- a/infrastructure/gcp/iam/README.md +++ b/infrastructure/gcp/iam/README.md @@ -19,7 +19,7 @@ The module creates google_service_account resources for each service account spe ```hcl module "iam" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/iam?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/iam?ref=v6.18.0" project_id = "your-project-id" } diff --git a/infrastructure/gcp/security/README.md b/infrastructure/gcp/security/README.md index ab5d3bfd7..5d0d0b3d0 100644 --- a/infrastructure/gcp/security/README.md +++ b/infrastructure/gcp/security/README.md @@ -22,7 +22,7 @@ The module uses data.google_container_cluster and data.google_compute_subnetwork ```hcl module "security" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/security?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/security?ref=v6.18.0" cluster_name = "your-cluster-name" gcp_project_id = "your-gcp-project-id" diff --git a/infrastructure/gcp/vpc/README.md b/infrastructure/gcp/vpc/README.md index 7482dae6a..34ffdc1cb 100644 --- a/infrastructure/gcp/vpc/README.md +++ b/infrastructure/gcp/vpc/README.md @@ -20,7 +20,7 @@ The module invokes the terraform-google-modules/network/google module to create ```hcl module "vpc" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/vpc?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/vpc?ref=v6.18.0" network_name = "your-network-name" project_id = "your-project-id" diff --git a/infrastructure/oci/backend/README.md b/infrastructure/oci/backend/README.md index 014e937db..066220560 100644 --- a/infrastructure/oci/backend/README.md +++ b/infrastructure/oci/backend/README.md @@ -18,7 +18,7 @@ The module creates an oci_objectstorage_bucket resource, which is configured wit ```hcl module "backend" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/backend?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/backend?ref=v6.18.0" compartment_id = "your-compartment-id" namespace = "your-namespace" diff --git a/infrastructure/oci/dns/README.md b/infrastructure/oci/dns/README.md index b9af9eb0f..308c52d74 100644 --- a/infrastructure/oci/dns/README.md +++ b/infrastructure/oci/dns/README.md @@ -18,7 +18,7 @@ This module creates oci_dns_zone resources for each DNS zone defined in the dns_ ```hcl module "dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dns?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dns?ref=v6.18.0" compartment_id = "your-compartment-id" } diff --git a/infrastructure/oci/dynamic_groups/README.md b/infrastructure/oci/dynamic_groups/README.md index bf8e720eb..0241f8f1b 100644 --- a/infrastructure/oci/dynamic_groups/README.md +++ b/infrastructure/oci/dynamic_groups/README.md @@ -19,7 +19,7 @@ This module creates an OCI dynamic group and an OCI identity policy, connecting ```hcl module "dynamic_groups" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dynamic_groups?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dynamic_groups?ref=v6.18.0" cluster_id = "your-cluster-id" compartment_id = "your-compartment-id" diff --git a/infrastructure/oci/oke/README.md b/infrastructure/oci/oke/README.md index 22916f27a..460d5f9e7 100644 --- a/infrastructure/oci/oke/README.md +++ b/infrastructure/oci/oke/README.md @@ -21,7 +21,7 @@ The module instantiates the oracle-terraform-modules/oke/oci module to create an ```hcl module "oke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/oke?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/oke?ref=v6.18.0" api_endpoint_subnet_id = "your-api-endpoint-subnet-id" cluster_name = "your-cluster-name" diff --git a/infrastructure/oci/vcn/README.md b/infrastructure/oci/vcn/README.md index 76e04a357..a668247d3 100644 --- a/infrastructure/oci/vcn/README.md +++ b/infrastructure/oci/vcn/README.md @@ -19,7 +19,7 @@ The module instantiates oci_core_subnet resources for public and private subnets ```hcl module "vcn" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/vcn?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/vcn?ref=v6.18.0" } ``` diff --git a/nullplatform/account/README.md b/nullplatform/account/README.md index aaa9825cd..486810fec 100644 --- a/nullplatform/account/README.md +++ b/nullplatform/account/README.md @@ -19,7 +19,7 @@ The module iterates over the `nullplatform_accounts` input map using `for_each` ```hcl module "account" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/account?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/account?ref=v6.18.0" nullplatform_accounts = "your-nullplatform-accounts" } diff --git a/nullplatform/agent/README.md b/nullplatform/agent/README.md index 549825b60..3df52275f 100644 --- a/nullplatform/agent/README.md +++ b/nullplatform/agent/README.md @@ -22,7 +22,7 @@ The module creates a helm_release resource targeting the nullplatform-agent char ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.18.0" api_key = "your-api-key" cloud_provider = "your-cloud-provider" @@ -36,7 +36,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.18.0" api_key = "your-api-key" aws_iam_role_arn = "your-aws-iam-role-arn" # Required when cloud_provider = "aws" @@ -51,7 +51,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.18.0" api_key = "your-api-key" cloud_provider = "gcp" @@ -65,7 +65,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.18.0" api_key = "your-api-key" azure_client_id = "your-azure-client-id" # Required when cloud_provider = "azure" @@ -85,7 +85,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.18.0" api_key = "your-api-key" cloud_provider = "oci" diff --git a/nullplatform/api_key/README.md b/nullplatform/api_key/README.md index 5ab3a880b..13dcd2239 100644 --- a/nullplatform/api_key/README.md +++ b/nullplatform/api_key/README.md @@ -21,7 +21,7 @@ The module creates a single nullplatform_api_key resource whose name, grants, an ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.18.0" type = "your-type" } @@ -31,7 +31,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.18.0" nrn = "your-nrn" # Required when type = "agent" type = "agent" @@ -42,7 +42,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.18.0" nrn = "your-nrn" # Required when type = "scope_notification" specification_slug = "your-specification-slug" # Required when type = "scope_notification" @@ -54,7 +54,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.18.0" nrn = "your-nrn" # Required when type = "service_notification" specification_slug = "your-specification-slug" # Required when type = "service_notification" @@ -66,7 +66,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.18.0" custom_grants = "your-custom-grants" # Required when type = "custom" custom_name = "your-custom-name" # Required when type = "custom" diff --git a/nullplatform/asset/docker_server/README.md b/nullplatform/asset/docker_server/README.md index 2f79beeef..6cdcbf7e2 100644 --- a/nullplatform/asset/docker_server/README.md +++ b/nullplatform/asset/docker_server/README.md @@ -21,7 +21,7 @@ Creates a nullplatform_provider_config resource of type 'docker-server' with enc ```hcl module "docker_server" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/docker_server?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/docker_server?ref=v6.18.0" login_server = "your-login-server" nrn = "your-nrn" diff --git a/nullplatform/asset/ecr/README.md b/nullplatform/asset/ecr/README.md index 9b2e3220a..939b70a07 100644 --- a/nullplatform/asset/ecr/README.md +++ b/nullplatform/asset/ecr/README.md @@ -21,7 +21,7 @@ The module reads the current AWS region via the aws_region data source and combi ```hcl module "ecr" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/ecr?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/ecr?ref=v6.18.0" application_role_arn = "your-application-role-arn" build_workflow_access_key_id = "your-build-workflow-access-key-id" diff --git a/nullplatform/asset/s3/README.md b/nullplatform/asset/s3/README.md index d6164492a..356851abb 100644 --- a/nullplatform/asset/s3/README.md +++ b/nullplatform/asset/s3/README.md @@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type s3-con ```hcl module "s3" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/s3?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/s3?ref=v6.18.0" bucket_name = "your-bucket-name" nrn = "your-nrn" diff --git a/nullplatform/base/README.md b/nullplatform/base/README.md index 70be74be6..98aba196f 100644 --- a/nullplatform/base/README.md +++ b/nullplatform/base/README.md @@ -22,7 +22,7 @@ The module creates two kubernetes_namespace_v1 resources ('nullplatform-tools' a ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.18.0" k8s_provider = "your-k8s-provider" np_api_key = "your-np-api-key" @@ -33,7 +33,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.18.0" aws_region = "your-aws-region" # Required when k8s_provider = "eks" cloudwatch_service_account_annotations = "your-cloudwatch-service-account-annotations" # Required when k8s_provider = "eks" @@ -52,7 +52,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.18.0" gateway_private_gcp_firewall_name = "your-gateway-private-gcp-firewall-name" # Required when k8s_provider = "gke" gateway_public_gcp_firewall_name = "your-gateway-public-gcp-firewall-name" # Required when k8s_provider = "gke" @@ -65,7 +65,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.18.0" gateway_private_azure_nsg_id = "your-gateway-private-azure-nsg-id" # Required when k8s_provider = "aks" gateway_public_azure_load_balancer_subnet = "your-gateway-public-azure-load-balancer-subnet" # Required when k8s_provider = "aks" @@ -80,7 +80,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.18.0" gateway_private_oci_security_list_management_mode = "your-gateway-private-oci-security-list-management-mode" # Required when k8s_provider = "oke" gateway_private_oci_subnet = "your-gateway-private-oci-subnet" # Required when k8s_provider = "oke" @@ -95,7 +95,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.18.0" gateway_private_azure_nsg_id = "your-gateway-private-azure-nsg-id" # Required when k8s_provider = "aro" gateway_public_azure_load_balancer_subnet = "your-gateway-public-azure-load-balancer-subnet" # Required when k8s_provider = "aro" diff --git a/nullplatform/cloud/aws/cloud/README.md b/nullplatform/cloud/aws/cloud/README.md index 09e4c48dc..3ba5ae5c0 100644 --- a/nullplatform/cloud/aws/cloud/README.md +++ b/nullplatform/cloud/aws/cloud/README.md @@ -21,7 +21,7 @@ The module uses data sources aws_caller_identity and aws_region to dynamically r ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/cloud?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/cloud?ref=v6.18.0" domain_name = "your-domain-name" hosted_private_zone_id = "your-hosted-private-zone-id" diff --git a/nullplatform/cloud/aws/vpc/README.md b/nullplatform/cloud/aws/vpc/README.md index 1521eed31..227344db6 100644 --- a/nullplatform/cloud/aws/vpc/README.md +++ b/nullplatform/cloud/aws/vpc/README.md @@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource of type aws-ne ```hcl module "vpc" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/vpc?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/vpc?ref=v6.18.0" nrn = "your-nrn" vpc_id = "your-vpc-id" diff --git a/nullplatform/cloud/azure/cloud/README.md b/nullplatform/cloud/azure/cloud/README.md index 96a58d184..ce77faa1c 100644 --- a/nullplatform/cloud/azure/cloud/README.md +++ b/nullplatform/cloud/azure/cloud/README.md @@ -22,7 +22,7 @@ The module creates a single nullplatform_provider_config resource of type 'azure ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/azure/cloud?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/azure/cloud?ref=v6.18.0" azure_resource_group_name = "your-azure-resource-group-name" nrn = "your-nrn" diff --git a/nullplatform/cloud/gcp/cloud/README.md b/nullplatform/cloud/gcp/cloud/README.md index 08652f036..f190bce75 100644 --- a/nullplatform/cloud/gcp/cloud/README.md +++ b/nullplatform/cloud/gcp/cloud/README.md @@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type 'googl ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/gcp/cloud?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/gcp/cloud?ref=v6.18.0" domain_name = "your-domain-name" location = "your-location" diff --git a/nullplatform/cloud/oci/cloud/README.md b/nullplatform/cloud/oci/cloud/README.md index 93f4c71cd..aee66fcf2 100644 --- a/nullplatform/cloud/oci/cloud/README.md +++ b/nullplatform/cloud/oci/cloud/README.md @@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type 'oci-c ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/oci/cloud?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/oci/cloud?ref=v6.18.0" account_id = "your-account-id" account_name = "your-account-name" diff --git a/nullplatform/code_repository/README.md b/nullplatform/code_repository/README.md index b50b166a2..5bb8a1bc4 100644 --- a/nullplatform/code_repository/README.md +++ b/nullplatform/code_repository/README.md @@ -22,7 +22,7 @@ The module uses local boolean flags (is_gitlab, is_github, is_azure, is_bitbucke ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.18.0" git_provider = "your-git-provider" nrn = "your-nrn" @@ -33,7 +33,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.18.0" git_provider = "github" github_installation_id = "your-github-installation-id" # Required when git_provider = "github" @@ -46,7 +46,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.18.0" git_provider = "gitlab" gitlab_access_token = "your-gitlab-access-token" # Required when git_provider = "gitlab" @@ -62,7 +62,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.18.0" azure_access_token = "your-azure-access-token" # Required when git_provider = "azure" azure_agent_pool = "your-azure-agent-pool" # Required when git_provider = "azure" @@ -76,7 +76,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.18.0" bitbucket_collaborators = "your-bitbucket-collaborators" # Required when git_provider = "bitbucket" bitbucket_installation_url = "your-bitbucket-installation-url" # Required when git_provider = "bitbucket" diff --git a/nullplatform/container_orchestration/aks/README.md b/nullplatform/container_orchestration/aks/README.md index ba22b492e..fcebaad7c 100644 --- a/nullplatform/container_orchestration/aks/README.md +++ b/nullplatform/container_orchestration/aks/README.md @@ -21,7 +21,7 @@ The module builds a local.attributes map that aggregates cluster metadata, gatew ```hcl module "aks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.18.0" cluster_name = "your-cluster-name" nrn = "your-nrn" diff --git a/nullplatform/container_orchestration/eks/README.md b/nullplatform/container_orchestration/eks/README.md index b26a551c8..129da1a9e 100644 --- a/nullplatform/container_orchestration/eks/README.md +++ b/nullplatform/container_orchestration/eks/README.md @@ -22,7 +22,7 @@ The module assembles a set of structured locals by merging optional variables in ```hcl module "eks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.18.0" cluster_name = "your-cluster-name" nrn = "your-nrn" diff --git a/nullplatform/container_orchestration/gke/README.md b/nullplatform/container_orchestration/gke/README.md index 296326d86..2cbfc80f0 100644 --- a/nullplatform/container_orchestration/gke/README.md +++ b/nullplatform/container_orchestration/gke/README.md @@ -22,7 +22,7 @@ The module constructs a structured attributes object using locals that merge clu ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.18.0" cluster_name = "your-cluster-name" location = "your-location" diff --git a/nullplatform/container_orchestration/oke/README.md b/nullplatform/container_orchestration/oke/README.md index 6fbc46307..4de4b11d3 100644 --- a/nullplatform/container_orchestration/oke/README.md +++ b/nullplatform/container_orchestration/oke/README.md @@ -19,7 +19,7 @@ Creates a single nullplatform_provider_config resource of type 'oke' that stores ```hcl module "oke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/oke?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/oke?ref=v6.18.0" cluster_name = "your-cluster-name" nrn = "your-nrn" diff --git a/nullplatform/dimension/README.md b/nullplatform/dimension/README.md index a5493146e..f7eca4f42 100644 --- a/nullplatform/dimension/README.md +++ b/nullplatform/dimension/README.md @@ -19,7 +19,7 @@ The module creates a nullplatform_dimension resource using the provided name, or ```hcl module "dimension" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension?ref=v6.18.0" name = "your-name" nrn = "your-nrn" diff --git a/nullplatform/dimension_value/README.md b/nullplatform/dimension_value/README.md index 82bb10354..ec9b578b4 100644 --- a/nullplatform/dimension_value/README.md +++ b/nullplatform/dimension_value/README.md @@ -19,7 +19,7 @@ The module uses a terraform_data resource to enforce mutual-exclusivity and pres ```hcl module "dimension_value" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension_value?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension_value?ref=v6.18.0" dimension_id = "your-dimension-id" name = "your-name" diff --git a/nullplatform/identity-access-control/README.md b/nullplatform/identity-access-control/README.md index dbd5e1a41..51d3bcfd7 100644 --- a/nullplatform/identity-access-control/README.md +++ b/nullplatform/identity-access-control/README.md @@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource named identity ```hcl module "identity-access-control" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/identity-access-control?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/identity-access-control?ref=v6.18.0" attributes = "your-attributes" nrn = "your-nrn" diff --git a/nullplatform/metrics/README.md b/nullplatform/metrics/README.md index dd9f2c4f7..75df83134 100644 --- a/nullplatform/metrics/README.md +++ b/nullplatform/metrics/README.md @@ -21,7 +21,7 @@ The module creates a single nullplatform_provider_config resource of type 'prome ```hcl module "metrics" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/metrics?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/metrics?ref=v6.18.0" nrn = "your-nrn" } diff --git a/nullplatform/packaged_service/README.md b/nullplatform/packaged_service/README.md index a7b306711..87e3b0896 100644 --- a/nullplatform/packaged_service/README.md +++ b/nullplatform/packaged_service/README.md @@ -17,7 +17,7 @@ spec updates / republish correctly. ```hcl module "packaged_service" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/packaged_service?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/packaged_service?ref=v6.18.0" nrn = "organization=…:account=…:namespace=…" diff --git a/nullplatform/parameter_storage_configuration/README.md b/nullplatform/parameter_storage_configuration/README.md index 72d9e3d0c..4a1ce3cb5 100644 --- a/nullplatform/parameter_storage_configuration/README.md +++ b/nullplatform/parameter_storage_configuration/README.md @@ -20,7 +20,7 @@ The module delegates entirely to a remote `scope_configuration` module sourced f ```hcl module "parameter_storage_configuration" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_configuration?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_configuration?ref=v6.18.0" attributes = "your-attributes" np_api_key = "your-np-api-key" diff --git a/nullplatform/parameter_storage_definition/README.md b/nullplatform/parameter_storage_definition/README.md index 8ce2ecf7e..9d6b8c83d 100644 --- a/nullplatform/parameter_storage_definition/README.md +++ b/nullplatform/parameter_storage_definition/README.md @@ -20,7 +20,7 @@ A data.http resource fetches the raw specification template from a configurable ```hcl module "parameter_storage_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition?ref=v6.18.0" np_api_key = "your-np-api-key" nrn = "your-nrn" diff --git a/nullplatform/parameter_storage_definition_agent_association/README.md b/nullplatform/parameter_storage_definition_agent_association/README.md index 44f49d950..19056a31b 100644 --- a/nullplatform/parameter_storage_definition_agent_association/README.md +++ b/nullplatform/parameter_storage_definition_agent_association/README.md @@ -21,7 +21,7 @@ The module creates a terraform_data resource to track API key changes and a null ```hcl module "parameter_storage_definition_agent_association" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition_agent_association?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition_agent_association?ref=v6.18.0" api_key = "your-api-key" nrn = "your-nrn" diff --git a/nullplatform/scope_configuration/README.md b/nullplatform/scope_configuration/README.md index d77f54ab3..96c8e02f5 100644 --- a/nullplatform/scope_configuration/README.md +++ b/nullplatform/scope_configuration/README.md @@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource that binds a N ```hcl module "scope_configuration" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_configuration?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_configuration?ref=v6.18.0" attributes = "your-attributes" np_api_key = "your-np-api-key" diff --git a/nullplatform/scope_definition/README.md b/nullplatform/scope_definition/README.md index 310e3e6d7..ad4712974 100644 --- a/nullplatform/scope_definition/README.md +++ b/nullplatform/scope_definition/README.md @@ -22,7 +22,7 @@ The module fetches JSON templates via data.http resources from a configurable Gi ```hcl module "scope_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition?ref=v6.18.0" np_api_key = "your-np-api-key" nrn = "your-nrn" diff --git a/nullplatform/scope_definition_agent_association/README.md b/nullplatform/scope_definition_agent_association/README.md index cddca929f..ad14abab6 100644 --- a/nullplatform/scope_definition_agent_association/README.md +++ b/nullplatform/scope_definition_agent_association/README.md @@ -22,7 +22,7 @@ The module fetches a notification channel JSON template via the `data.http` prov ```hcl module "scope_definition_agent_association" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition_agent_association?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition_agent_association?ref=v6.18.0" api_key = "your-api-key" nrn = "your-nrn" diff --git a/nullplatform/service_definition/README.md b/nullplatform/service_definition/README.md index f5b592f50..6286990c1 100644 --- a/nullplatform/service_definition/README.md +++ b/nullplatform/service_definition/README.md @@ -22,7 +22,7 @@ The module uses data.http resources to fetch service-spec, action, and link JSON ```hcl module "service_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.18.0" nrn = "your-nrn" service_name = "your-service-name" diff --git a/nullplatform/service_definition_agent_association/README.md b/nullplatform/service_definition_agent_association/README.md index 29dc26419..7b96f5c63 100644 --- a/nullplatform/service_definition_agent_association/README.md +++ b/nullplatform/service_definition_agent_association/README.md @@ -22,7 +22,7 @@ The module creates a terraform_data resource to track API key changes as a lifec ```hcl module "service_definition_agent_association" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition_agent_association?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition_agent_association?ref=v6.18.0" api_key = "your-api-key" repository_service_spec_repo = "your-repository-service-spec-repo" diff --git a/nullplatform/users/README.md b/nullplatform/users/README.md index 579bfa7be..dc1efeb63 100644 --- a/nullplatform/users/README.md +++ b/nullplatform/users/README.md @@ -21,7 +21,7 @@ The module iterates over a map of user definitions using `nullplatform_user` res ```hcl module "users" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/users?ref=v6.17.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/users?ref=v6.18.0" nullplatform_users = "your-nullplatform-users" } From b8dd7cfdcb9300ecbf406687ef31021ede176171 Mon Sep 17 00:00:00 2001 From: Sebastian Correa Date: Fri, 21 Aug 2026 13:00:52 -0300 Subject: [PATCH 34/81] feat(external_dns): add google provider support (#532) * feat(external_dns): add google provider support * docs(external_dns): document google provider, cover it in cross-provider test * fix(external_dns): use --google-project chart flag instead of unsupported google.project value key --------- Co-authored-by: sebas_correa --- infrastructure/commons/external_dns/README.md | 14 ++ infrastructure/commons/external_dns/locals.tf | 16 ++ .../external_dns_cross_provider.tftest.hcl | 5 + .../tests/external_dns_google.tftest.hcl | 176 ++++++++++++++++++ .../commons/external_dns/validation.tf | 12 ++ .../commons/external_dns/variables.tf | 31 ++- 6 files changed, 251 insertions(+), 3 deletions(-) create mode 100644 infrastructure/commons/external_dns/tests/external_dns_google.tftest.hcl diff --git a/infrastructure/commons/external_dns/README.md b/infrastructure/commons/external_dns/README.md index cfc9c8200..252e90afd 100644 --- a/infrastructure/commons/external_dns/README.md +++ b/infrastructure/commons/external_dns/README.md @@ -107,6 +107,20 @@ module "external_dns" { } ``` +### Google Cloud DNS + +```hcl +module "external_dns" { + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.18.0" + + dns_provider_name = "google" + domain_filters = "your-domain-filters" + gcp_project_id = "your-gcp-project-id" # Required when dns_provider_name = "google" + gcp_service_account_email = "your-gcp-service-account-email" # Required when dns_provider_name = "google"; must already exist with Workload Identity bound to the external-dns Kubernetes ServiceAccount + zone_type = "public" # or "private" — required when dns_provider_name = "google" +} +``` + ## Using Outputs ```hcl diff --git a/infrastructure/commons/external_dns/locals.tf b/infrastructure/commons/external_dns/locals.tf index 0bd7d99cf..5c47dbaea 100644 --- a/infrastructure/commons/external_dns/locals.tf +++ b/infrastructure/commons/external_dns/locals.tf @@ -123,12 +123,28 @@ locals { ] } + google_config = { + provider = { name = "google" } + serviceAccount = { + create = true + name = var.gcp_service_account_name + annotations = { + "iam.gke.io/gcp-service-account" = var.gcp_service_account_email + } + } + extraArgs = [ + "--google-project=${var.gcp_project_id}", + "--google-zone-visibility=${lower(var.zone_type)}", + ] + } + provider_configs = { cloudflare = local.cloudflare_config aws = local.route53_config oci = local.oci_config azure = local.azure_config "azure-private-dns" = local.azure_config + google = local.google_config } external_dns_values = merge(local.base_config, local.provider_configs[var.dns_provider_name]) diff --git a/infrastructure/commons/external_dns/tests/external_dns_cross_provider.tftest.hcl b/infrastructure/commons/external_dns/tests/external_dns_cross_provider.tftest.hcl index 05d0896ee..0fb4841e7 100644 --- a/infrastructure/commons/external_dns/tests/external_dns_cross_provider.tftest.hcl +++ b/infrastructure/commons/external_dns/tests/external_dns_cross_provider.tftest.hcl @@ -111,4 +111,9 @@ run "all_providers_in_config_map" { condition = contains(keys(local.provider_configs), "oci") error_message = "provider_configs should contain oci" } + + assert { + condition = contains(keys(local.provider_configs), "google") + error_message = "provider_configs should contain google" + } } diff --git a/infrastructure/commons/external_dns/tests/external_dns_google.tftest.hcl b/infrastructure/commons/external_dns/tests/external_dns_google.tftest.hcl new file mode 100644 index 000000000..cc8e35773 --- /dev/null +++ b/infrastructure/commons/external_dns/tests/external_dns_google.tftest.hcl @@ -0,0 +1,176 @@ +mock_provider "helm" {} +mock_provider "kubernetes" {} + +variables { + dns_provider_name = "google" + domain_filters = "myorg.example.com" + external_dns_namespace = "external-dns" + gcp_project_id = "my-gcp-project" + gcp_service_account_email = "external-dns@my-gcp-project.iam.gserviceaccount.com" + zone_type = "public" +} + +run "google_full_config" { + command = plan + + assert { + condition = helm_release.external_dns.name == "external-dns-public" + error_message = "Helm release name should include type suffix" + } +} + +run "google_workload_identity_annotation" { + command = plan + + assert { + condition = local.google_config.serviceAccount.annotations["iam.gke.io/gcp-service-account"] == "external-dns@my-gcp-project.iam.gserviceaccount.com" + error_message = "GCP Workload Identity annotation should match gcp_service_account_email" + } +} + +run "google_project_in_values" { + command = plan + + assert { + condition = contains(local.google_config.extraArgs, "--google-project=my-gcp-project") + error_message = "extraArgs should include --google-project derived from gcp_project_id" + } +} + +run "google_values_reach_helm_release" { + command = plan + + assert { + condition = local.external_dns_values.provider.name == "google" + error_message = "external_dns_values should select the google provider config" + } + + assert { + condition = contains(local.external_dns_values.extraArgs, "--google-project=my-gcp-project") + error_message = "gcp_project_id must reach the chart via external_dns_values.extraArgs as --google-project" + } +} + +run "google_zone_visibility_lowercased" { + command = plan + + variables { + zone_type = "Public" + } + + assert { + condition = contains(local.google_config.extraArgs, "--google-zone-visibility=public") + error_message = "zone_type should be lowercased before being passed as --google-zone-visibility, even when the input has mixed case" + } +} + +run "google_zone_visibility_arg" { + command = plan + + assert { + condition = contains(local.google_config.extraArgs, "--google-zone-visibility=public") + error_message = "Extra args should include --google-zone-visibility" + } +} + +run "google_private_zone_visibility_arg" { + command = plan + + variables { + zone_type = "private" + } + + assert { + condition = contains(local.google_config.extraArgs, "--google-zone-visibility=private") + error_message = "Extra args should include --google-zone-visibility=private when zone_type is private" + } +} + +run "google_default_service_account_name" { + command = plan + + assert { + condition = local.google_config.serviceAccount.name == "external-dns" + error_message = "Default GCP service account name should be external-dns" + } +} + +run "google_custom_service_account_name" { + command = plan + + variables { + gcp_service_account_name = "external-dns-private" + } + + assert { + condition = local.google_config.serviceAccount.name == "external-dns-private" + error_message = "Custom gcp_service_account_name should be reflected in serviceAccount.name" + } +} + +run "no_cloudflare_secret_for_google" { + command = plan + + assert { + condition = length(kubernetes_secret_v1.external_dns_cloudflare) == 0 + error_message = "Cloudflare secret should not be created for google provider" + } +} + +run "no_azure_secret_for_google" { + command = plan + + assert { + condition = length(kubernetes_secret_v1.external_dns_azure_config) == 0 + error_message = "Azure secret should not be created for google provider" + } +} + +run "no_oci_secret_for_google" { + command = plan + + assert { + condition = length(kubernetes_secret_v1.external_dns_oci_config) == 0 + error_message = "OCI secret should not be created for google provider" + } +} + +run "google_requires_project_id" { + command = plan + + variables { + gcp_project_id = "" + } + + expect_failures = [terraform_data.provider_validation] +} + +run "google_requires_service_account_email" { + command = plan + + variables { + gcp_service_account_email = "" + } + + expect_failures = [terraform_data.provider_validation] +} + +run "google_requires_zone_type" { + command = plan + + variables { + zone_type = "" + } + + expect_failures = [terraform_data.provider_validation] +} + +run "google_rejects_invalid_zone_type" { + command = plan + + variables { + zone_type = "internal" + } + + expect_failures = [terraform_data.provider_validation] +} diff --git a/infrastructure/commons/external_dns/validation.tf b/infrastructure/commons/external_dns/validation.tf index 405af91db..4746aaf4c 100644 --- a/infrastructure/commons/external_dns/validation.tf +++ b/infrastructure/commons/external_dns/validation.tf @@ -28,6 +28,18 @@ resource "terraform_data" "provider_validation" { condition = var.dns_provider_name != "oci" || var.oci_region != "" error_message = "oci_region is required when dns_provider_name is 'oci'." } + precondition { + condition = var.dns_provider_name != "google" || length(var.gcp_project_id) > 0 + error_message = "gcp_project_id is required when dns_provider_name is 'google'." + } + precondition { + condition = var.dns_provider_name != "google" || length(var.gcp_service_account_email) > 0 + error_message = "gcp_service_account_email is required when dns_provider_name is 'google'." + } + precondition { + condition = var.dns_provider_name != "google" || (var.zone_type != "" && contains(["public", "private"], lower(var.zone_type))) + error_message = "When dns_provider_name is 'google', zone_type must be 'public' or 'private'." + } precondition { condition = !local.azure_family_active || length(var.azure_client_id) > 0 error_message = "azure_client_id is required when dns_provider_name is 'azure' or 'azure-private-dns'." diff --git a/infrastructure/commons/external_dns/variables.tf b/infrastructure/commons/external_dns/variables.tf index 159e40d7a..3a9519c6d 100644 --- a/infrastructure/commons/external_dns/variables.tf +++ b/infrastructure/commons/external_dns/variables.tf @@ -112,7 +112,7 @@ variable "zone_id_filter" { } variable "zone_type" { - description = "The Route53 hosted zone type for ExternalDNS to manage (public or private)" + description = "The DNS zone type/visibility for ExternalDNS to manage (public or private). Used by the 'aws' (--aws-zone-type) and 'google' (--google-zone-visibility) providers." type = string default = "" nullable = false @@ -164,8 +164,8 @@ variable "dns_provider_name" { type = string description = "The DNS provider to use with ExternalDNS. Use 'azure' for Azure Public DNS zones and 'azure-private-dns' for Azure Private DNS zones — both share the same auth, secret, and ServiceAccount wiring." validation { - condition = contains(["cloudflare", "aws", "oci", "azure", "azure-private-dns"], var.dns_provider_name) - error_message = "dns_provider_name must be one of: 'cloudflare', 'aws', 'oci', 'azure', 'azure-private-dns'." + condition = contains(["cloudflare", "aws", "oci", "azure", "azure-private-dns", "google"], var.dns_provider_name) + error_message = "dns_provider_name must be one of: 'cloudflare', 'aws', 'oci', 'azure', 'azure-private-dns', 'google'." } } @@ -216,3 +216,28 @@ variable "azure_tenant_id" { default = "" } +############################################################################### +# GCP CONFIGURATION +############################################################################### + +variable "gcp_project_id" { + description = "The GCP project ID where the Cloud DNS zones are located (required when dns_provider_name is 'google')" + type = string + default = "" + nullable = false +} + +variable "gcp_service_account_email" { + description = "Email of the GCP service account bound via Workload Identity for Cloud DNS access (required when dns_provider_name is 'google'). Create the service account and the Workload Identity binding outside this module (e.g. with infrastructure/gcp/iam) and pass its email here." + type = string + default = "" + nullable = false +} + +variable "gcp_service_account_name" { + description = "The Kubernetes service account name for GCP Workload Identity" + type = string + default = "external-dns" + nullable = false +} + From 4629ab620980c3f6875e33da1e57a26fe01cbd81 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Fri, 21 Aug 2026 16:01:33 +0000 Subject: [PATCH 35/81] chore(6.x): release 6.19.0 --- CHANGELOG.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index fee4eae6a..8fb827273 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,12 @@ # Changelog +## [6.19.0](https://github.com/nullplatform/tofu-modules/compare/v6.18.0...v6.19.0) (2026-08-21) + + +### Features + +* **external_dns:** add google provider support ([#532](https://github.com/nullplatform/tofu-modules/issues/532)) ([222ff52](https://github.com/nullplatform/tofu-modules/commit/222ff522601d3b4f5c85cc016e79981fa58cd5c4)) + ## [6.18.0](https://github.com/nullplatform/tofu-modules/compare/v6.17.0...v6.18.0) (2026-08-19) From 7ea83d5a7c6ceb09d2d979373e66c5b2675f0836 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Fri, 21 Aug 2026 16:02:13 +0000 Subject: [PATCH 36/81] docs: regenerate READMEs for changed modules and update versions --- infrastructure/aws/acm/README.md | 2 +- .../aws_load_balancer_controller/README.md | 2 +- infrastructure/aws/backend/README.md | 2 +- infrastructure/aws/dns/README.md | 2 +- infrastructure/aws/eks/README.md | 2 +- infrastructure/aws/iam/agent/README.md | 2 +- .../README.md | 2 +- infrastructure/aws/iam/cert_manager/README.md | 2 +- .../aws/iam/ci-build-workflow-user/README.md | 2 +- infrastructure/aws/iam/cloudwatch/README.md | 2 +- infrastructure/aws/iam/ecr/README.md | 2 +- infrastructure/aws/iam/external_dns/README.md | 2 +- infrastructure/aws/iam/s3/README.md | 2 +- infrastructure/aws/ingress/README.md | 2 +- infrastructure/aws/security/README.md | 2 +- infrastructure/aws/vpc/README.md | 2 +- infrastructure/azure/acr/README.md | 2 +- infrastructure/azure/aks/README.md | 2 +- .../azure/aks_route_table/README.md | 2 +- infrastructure/azure/dns/README.md | 2 +- infrastructure/azure/iam/README.md | 2 +- infrastructure/azure/private_dns/README.md | 2 +- infrastructure/azure/resource_group/README.md | 2 +- infrastructure/azure/security/README.md | 2 +- infrastructure/azure/vnet/README.md | 2 +- infrastructure/commons/cert_manager/README.md | 12 +-- infrastructure/commons/external_dns/README.md | 85 +++++++++++-------- infrastructure/commons/istio/README.md | 2 +- infrastructure/commons/prometheus/README.md | 2 +- .../gcp/artifact-registry/README.md | 2 +- infrastructure/gcp/backend/README.md | 2 +- infrastructure/gcp/cloud-dns/README.md | 2 +- infrastructure/gcp/cloud-nat/README.md | 2 +- infrastructure/gcp/gke/README.md | 6 +- infrastructure/gcp/iam/README.md | 2 +- infrastructure/gcp/security/README.md | 2 +- infrastructure/gcp/vpc/README.md | 2 +- infrastructure/oci/backend/README.md | 2 +- infrastructure/oci/dns/README.md | 2 +- infrastructure/oci/dynamic_groups/README.md | 2 +- infrastructure/oci/oke/README.md | 2 +- infrastructure/oci/vcn/README.md | 2 +- nullplatform/account/README.md | 2 +- nullplatform/agent/README.md | 10 +-- nullplatform/api_key/README.md | 10 +-- nullplatform/asset/docker_server/README.md | 2 +- nullplatform/asset/ecr/README.md | 2 +- nullplatform/asset/s3/README.md | 2 +- nullplatform/base/README.md | 12 +-- nullplatform/cloud/aws/cloud/README.md | 2 +- nullplatform/cloud/aws/vpc/README.md | 2 +- nullplatform/cloud/azure/cloud/README.md | 2 +- nullplatform/cloud/gcp/cloud/README.md | 2 +- nullplatform/cloud/oci/cloud/README.md | 2 +- nullplatform/code_repository/README.md | 10 +-- .../container_orchestration/aks/README.md | 2 +- .../container_orchestration/eks/README.md | 2 +- .../container_orchestration/gke/README.md | 2 +- .../container_orchestration/oke/README.md | 2 +- nullplatform/dimension/README.md | 2 +- nullplatform/dimension_value/README.md | 2 +- .../identity-access-control/README.md | 2 +- nullplatform/metrics/README.md | 2 +- nullplatform/packaged_service/README.md | 2 +- .../parameter_storage_configuration/README.md | 2 +- .../parameter_storage_definition/README.md | 2 +- .../README.md | 2 +- nullplatform/scope_configuration/README.md | 2 +- nullplatform/scope_definition/README.md | 2 +- .../README.md | 2 +- nullplatform/service_definition/README.md | 2 +- .../README.md | 2 +- nullplatform/users/README.md | 2 +- 73 files changed, 146 insertions(+), 131 deletions(-) diff --git a/infrastructure/aws/acm/README.md b/infrastructure/aws/acm/README.md index 4e2a9215b..5570c7143 100644 --- a/infrastructure/aws/acm/README.md +++ b/infrastructure/aws/acm/README.md @@ -18,7 +18,7 @@ The module creates an aws_acm_certificate resource with DNS validation, which is ```hcl module "acm" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/acm?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/acm?ref=v6.19.0" domain_name = "your-domain-name" zone_id = "your-zone-id" diff --git a/infrastructure/aws/aws_load_balancer_controller/README.md b/infrastructure/aws/aws_load_balancer_controller/README.md index 989ea45a7..164a29b44 100644 --- a/infrastructure/aws/aws_load_balancer_controller/README.md +++ b/infrastructure/aws/aws_load_balancer_controller/README.md @@ -18,7 +18,7 @@ This module creates a helm_release resource to deploy the AWS Load Balancer Cont ```hcl module "aws_load_balancer_controller" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/aws_load_balancer_controller?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/aws_load_balancer_controller?ref=v6.19.0" cluster_name = "your-cluster-name" vpc_id = "your-vpc-id" diff --git a/infrastructure/aws/backend/README.md b/infrastructure/aws/backend/README.md index f6c1e54a3..d89335540 100644 --- a/infrastructure/aws/backend/README.md +++ b/infrastructure/aws/backend/README.md @@ -20,7 +20,7 @@ This module creates an S3 bucket with versioning and server-side encryption enab ```hcl module "backend" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/backend?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/backend?ref=v6.19.0" } ``` diff --git a/infrastructure/aws/dns/README.md b/infrastructure/aws/dns/README.md index 367c82183..4f617d8c1 100644 --- a/infrastructure/aws/dns/README.md +++ b/infrastructure/aws/dns/README.md @@ -21,7 +21,7 @@ The module conditionally creates an aws_route53_zone resource for a public hoste ```hcl module "dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/dns?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/dns?ref=v6.19.0" domain_name = "your-domain-name" vpc_id = "your-vpc-id" diff --git a/infrastructure/aws/eks/README.md b/infrastructure/aws/eks/README.md index 89cf6f9e9..e76dc7291 100644 --- a/infrastructure/aws/eks/README.md +++ b/infrastructure/aws/eks/README.md @@ -22,7 +22,7 @@ The module wraps terraform-aws-modules/eks to create the EKS cluster (aws_eks_cl ```hcl module "eks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/eks?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/eks?ref=v6.19.0" aws_subnets_private_ids = "your-aws-subnets-private-ids" aws_vpc_vpc_id = "your-aws-vpc-vpc-id" diff --git a/infrastructure/aws/iam/agent/README.md b/infrastructure/aws/iam/agent/README.md index 1ef5ca2e8..b0e8abcd4 100644 --- a/infrastructure/aws/iam/agent/README.md +++ b/infrastructure/aws/iam/agent/README.md @@ -21,7 +21,7 @@ The module uses the terraform-aws-modules/iam//modules/iam-role-for-service-acco ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/agent?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/agent?ref=v6.19.0" agent_namespace = "your-agent-namespace" aws_iam_openid_connect_provider_arn = "your-aws-iam-openid-connect-provider-arn" diff --git a/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md b/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md index 550a9ed46..ad048420f 100644 --- a/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md +++ b/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md @@ -19,7 +19,7 @@ This module creates an IAM role for the AWS Load Balancer Controller using the t ```hcl module "aws_load_balancer_controller_iam" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/aws_load_balancer_controller_iam?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/aws_load_balancer_controller_iam?ref=v6.19.0" aws_iam_openid_connect_provider_arn = "your-aws-iam-openid-connect-provider-arn" cluster_name = "your-cluster-name" diff --git a/infrastructure/aws/iam/cert_manager/README.md b/infrastructure/aws/iam/cert_manager/README.md index bca45498c..86815c53b 100644 --- a/infrastructure/aws/iam/cert_manager/README.md +++ b/infrastructure/aws/iam/cert_manager/README.md @@ -20,7 +20,7 @@ An aws_iam_policy resource is always created granting route53:GetChange, route53 ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cert_manager?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cert_manager?ref=v6.19.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/ci-build-workflow-user/README.md b/infrastructure/aws/iam/ci-build-workflow-user/README.md index 66fc91d8b..a45d3b299 100644 --- a/infrastructure/aws/iam/ci-build-workflow-user/README.md +++ b/infrastructure/aws/iam/ci-build-workflow-user/README.md @@ -21,7 +21,7 @@ The module creates an aws_iam_user named with the cluster_name prefix and genera ```hcl module "ci-build-workflow-user" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ci-build-workflow-user?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ci-build-workflow-user?ref=v6.19.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/cloudwatch/README.md b/infrastructure/aws/iam/cloudwatch/README.md index a97250dda..00823149f 100644 --- a/infrastructure/aws/iam/cloudwatch/README.md +++ b/infrastructure/aws/iam/cloudwatch/README.md @@ -20,7 +20,7 @@ The module creates an aws_iam_policy granting CloudWatch Logs and Metrics write ```hcl module "cloudwatch" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cloudwatch?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cloudwatch?ref=v6.19.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/ecr/README.md b/infrastructure/aws/iam/ecr/README.md index 9bee2421a..f4faddc43 100644 --- a/infrastructure/aws/iam/ecr/README.md +++ b/infrastructure/aws/iam/ecr/README.md @@ -20,7 +20,7 @@ The module creates an aws_iam_role named nullplatform-{cluster_name}-application ```hcl module "ecr" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ecr?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ecr?ref=v6.19.0" build_workflow_group_name = "your-build-workflow-group-name" cluster_name = "your-cluster-name" diff --git a/infrastructure/aws/iam/external_dns/README.md b/infrastructure/aws/iam/external_dns/README.md index af77f65fb..6d12c6cf0 100644 --- a/infrastructure/aws/iam/external_dns/README.md +++ b/infrastructure/aws/iam/external_dns/README.md @@ -20,7 +20,7 @@ An aws_iam_policy resource named nullplatform_external_dns_policy is always crea ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/external_dns?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/external_dns?ref=v6.19.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/s3/README.md b/infrastructure/aws/iam/s3/README.md index 901c8afc8..a36105e27 100644 --- a/infrastructure/aws/iam/s3/README.md +++ b/infrastructure/aws/iam/s3/README.md @@ -18,7 +18,7 @@ The module creates an aws_iam_policy resource that allows s3:PutObject and s3:Ge ```hcl module "s3" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/s3?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/s3?ref=v6.19.0" bucket = "your-bucket" build_workflow_group_name = "your-build-workflow-group-name" diff --git a/infrastructure/aws/ingress/README.md b/infrastructure/aws/ingress/README.md index 4d25ada59..21148c4b5 100644 --- a/infrastructure/aws/ingress/README.md +++ b/infrastructure/aws/ingress/README.md @@ -22,7 +22,7 @@ The module creates up to two kubernetes_ingress_v1 resources — one for an inte ```hcl module "ingress" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/ingress?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/ingress?ref=v6.19.0" certificate_arn = "your-certificate-arn" } diff --git a/infrastructure/aws/security/README.md b/infrastructure/aws/security/README.md index afdbced46..57fec425a 100644 --- a/infrastructure/aws/security/README.md +++ b/infrastructure/aws/security/README.md @@ -22,7 +22,7 @@ The module uses data sources (aws_eks_cluster, aws_vpc) to automatically derive ```hcl module "security" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/security?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/security?ref=v6.19.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/vpc/README.md b/infrastructure/aws/vpc/README.md index 70b698901..d33d510f8 100644 --- a/infrastructure/aws/vpc/README.md +++ b/infrastructure/aws/vpc/README.md @@ -22,7 +22,7 @@ This module creates a terraform-aws-modules/vpc/aws module resource with DNS hos ```hcl module "vpc" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/vpc?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/vpc?ref=v6.19.0" account = "your-account" organization = "your-organization" diff --git a/infrastructure/azure/acr/README.md b/infrastructure/azure/acr/README.md index 49ff1ee79..e21c29aa8 100644 --- a/infrastructure/azure/acr/README.md +++ b/infrastructure/azure/acr/README.md @@ -18,7 +18,7 @@ The module uses the azurerm_container_registry resource to create the container ```hcl module "acr" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/acr?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/acr?ref=v6.19.0" containerregistry_name = "your-containerregistry-name" location = "your-location" diff --git a/infrastructure/azure/aks/README.md b/infrastructure/azure/aks/README.md index 6afbc7c94..5e37da49e 100644 --- a/infrastructure/azure/aks/README.md +++ b/infrastructure/azure/aks/README.md @@ -22,7 +22,7 @@ The module wraps the Azure/aks/azurerm community module (version 11.0.0) and use ```hcl module "aks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks?ref=v6.19.0" cluster_name = "your-cluster-name" location = "your-location" diff --git a/infrastructure/azure/aks_route_table/README.md b/infrastructure/azure/aks_route_table/README.md index a0fc3af76..ada12cb18 100644 --- a/infrastructure/azure/aks_route_table/README.md +++ b/infrastructure/azure/aks_route_table/README.md @@ -19,7 +19,7 @@ The module uses an azurerm_resources data source to discover the AKS-managed rou ```hcl module "aks_route_table" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks_route_table?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks_route_table?ref=v6.19.0" node_resource_group = "your-node-resource-group" subnet_id = "your-subnet-id" diff --git a/infrastructure/azure/dns/README.md b/infrastructure/azure/dns/README.md index 9c36a0cd8..93dc49bd9 100644 --- a/infrastructure/azure/dns/README.md +++ b/infrastructure/azure/dns/README.md @@ -18,7 +18,7 @@ This module creates an azurerm_dns_zone resource and configures it with the prov ```hcl module "dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/dns?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/dns?ref=v6.19.0" domain_name = "your-domain-name" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/iam/README.md b/infrastructure/azure/iam/README.md index d3b048a8d..0c355f451 100644 --- a/infrastructure/azure/iam/README.md +++ b/infrastructure/azure/iam/README.md @@ -21,7 +21,7 @@ The module creates an azurerm_user_assigned_identity resource in the specified r ```hcl module "iam" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/iam?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/iam?ref=v6.19.0" location = "your-location" name = "your-name" diff --git a/infrastructure/azure/private_dns/README.md b/infrastructure/azure/private_dns/README.md index 092f76f72..23d4feda4 100644 --- a/infrastructure/azure/private_dns/README.md +++ b/infrastructure/azure/private_dns/README.md @@ -18,7 +18,7 @@ This module creates an azurerm_private_dns_zone resource and optionally multiple ```hcl module "private_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/private_dns?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/private_dns?ref=v6.19.0" domain_name = "your-domain-name" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/resource_group/README.md b/infrastructure/azure/resource_group/README.md index 3e473dc3a..0183e7cc5 100644 --- a/infrastructure/azure/resource_group/README.md +++ b/infrastructure/azure/resource_group/README.md @@ -18,7 +18,7 @@ This module creates an azurerm_resource_group resource and outputs its name and ```hcl module "resource_group" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/resource_group?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/resource_group?ref=v6.19.0" location = "your-location" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/security/README.md b/infrastructure/azure/security/README.md index 1a63117da..2b75e0a2c 100644 --- a/infrastructure/azure/security/README.md +++ b/infrastructure/azure/security/README.md @@ -21,7 +21,7 @@ The module uses azurerm_kubernetes_cluster and azurerm_virtual_network data sour ```hcl module "security" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/security?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/security?ref=v6.19.0" cluster_name = "your-cluster-name" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/vnet/README.md b/infrastructure/azure/vnet/README.md index e787268ea..c8fa93963 100644 --- a/infrastructure/azure/vnet/README.md +++ b/infrastructure/azure/vnet/README.md @@ -18,7 +18,7 @@ This module creates an Azure virtual network using the azurerm provider and conf ```hcl module "vnet" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/vnet?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/vnet?ref=v6.19.0" address_space = "your-address-space" location = "your-location" diff --git a/infrastructure/commons/cert_manager/README.md b/infrastructure/commons/cert_manager/README.md index b72f90cd8..0bcc9c68c 100644 --- a/infrastructure/commons/cert_manager/README.md +++ b/infrastructure/commons/cert_manager/README.md @@ -22,7 +22,7 @@ Two primary helm_release resources are created: cert-manager from the Jetstack c ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.19.0" account_slug = "your-account-slug" cloud_provider = "your-cloud-provider" @@ -35,7 +35,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.19.0" account_slug = "your-account-slug" cloud_provider = "gcp" @@ -50,7 +50,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.19.0" account_slug = "your-account-slug" azure_client_id = "your-azure-client-id" # Required when cloud_provider = "azure" @@ -68,7 +68,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.19.0" account_slug = "your-account-slug" cloud_provider = "cloudflare" @@ -83,7 +83,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.19.0" account_slug = "your-account-slug" aws_identity_mode = "your-aws-identity-mode" # Required when cloud_provider = "aws" @@ -99,7 +99,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.19.0" account_slug = "your-account-slug" cert_manager_webhook_oci_namespace = "your-cert-manager-webhook-oci-namespace" # Required when cloud_provider = "oci" diff --git a/infrastructure/commons/external_dns/README.md b/infrastructure/commons/external_dns/README.md index 252e90afd..608a2bbba 100644 --- a/infrastructure/commons/external_dns/README.md +++ b/infrastructure/commons/external_dns/README.md @@ -2,27 +2,27 @@ ## Description -Deploys ExternalDNS via Helm on Kubernetes with multi-provider DNS support for Cloudflare, AWS Route53, OCI, Azure Public DNS, and Azure Private DNS +Deploys ExternalDNS on Kubernetes via Helm with multi-provider DNS management support for Cloudflare, AWS Route53, OCI, Azure, and Google Cloud DNS ## Architecture -The module creates an optional kubernetes_namespace_v1 resource when create_namespace is true, then deploys a helm_release resource for the external-dns chart using provider-specific values merged from locals. Provider-specific kubernetes_secret_v1 resources are created for Cloudflare API tokens, OCI config files, and Azure config files, and are referenced as explicit dependencies of the helm_release. The external_dns_values local merges a base_config (domainFilters, policy, txtOwnerId, sources) with a provider-specific config block selected by dns_provider_name, which controls the serviceAccount annotations (IRSA or Pod Identity for AWS, Workload Identity for Azure), extraArgs (zone filters, OCI compartment), extraVolumes/extraVolumeMounts (OCI and Azure secrets), and environment variables. +The module creates an optional kubernetes_namespace_v1 resource and a helm_release resource pointing to the official external-dns Helm chart. Provider-specific configuration is assembled in locals.tf by merging a base_config with a provider-specific config block (cloudflare_config, route53_config, oci_config, azure_config, or google_config) selected by dns_provider_name, then encoded as YAML values for the helm_release. Provider secrets are injected as kubernetes_secret_v1 resources (Cloudflare API token, OCI config, Azure config) that the helm_release depends on, while service account annotations wire cloud-native identity mechanisms like IRSA, OCI Workload Identity, Azure Workload Identity, and GKE Workload Identity. ## Features -- Deploys ExternalDNS Helm chart with provider-specific configuration for Cloudflare, AWS Route53, OCI, Azure Public DNS, and Azure Private DNS -- Configures AWS IRSA or EKS Pod Identity for Route53 access by conditionally annotating the Kubernetes ServiceAccount with the IAM role ARN -- Mounts OCI config and Azure config as Kubernetes secrets into the ExternalDNS pod via extraVolumes and extraVolumeMounts -- Supports Azure Workload Identity by annotating the ServiceAccount with the client ID and labeling pods with the workload identity use label -- Creates optional Kubernetes namespace for ExternalDNS to support single or multi-instance deployments in the same cluster -- Applies label-filter and zone-id-filter extraArgs for AWS Route53 to scope ExternalDNS to specific hosted zones or resource labels -- Configures DNS record management policy (sync, create-only, upsert-only) and TXT registry owner ID for record ownership tracking +- Deploys ExternalDNS via helm_release with atomic, cleanup-on-fail, and rolling-update semantics +- Creates provider-specific kubernetes_secret_v1 resources for Cloudflare API token, OCI config, and Azure credentials +- Configures IRSA or EKS Pod Identity for AWS Route53 access via service account annotations +- Configures Azure Workload Identity or Service Principal auth for Azure Public and Private DNS zones +- Configures GKE Workload Identity for Google Cloud DNS via iam.gke.io/gcp-service-account annotation +- Supports label-based filtering of Kubernetes resources processed by ExternalDNS +- Manages DNS record lifecycle policy with create-only, sync, or upsert-only modes ## Basic Usage ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.19.0" dns_provider_name = "your-dns-provider-name" domain_filters = "your-domain-filters" @@ -33,7 +33,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.19.0" cloudflare_token = "your-cloudflare-token" # Required when dns_provider_name = "cloudflare" dns_provider_name = "cloudflare" @@ -45,7 +45,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.19.0" aws_iam_role_arn = "your-aws-iam-role-arn" # Required when dns_provider_name = "aws" aws_identity_mode = "your-aws-identity-mode" # Required when dns_provider_name = "aws" @@ -61,7 +61,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.19.0" dns_provider_name = "oci" domain_filters = "your-domain-filters" @@ -69,7 +69,6 @@ module "external_dns" { oci_region = "your-oci-region" # Required when dns_provider_name = "oci" oci_service_account_name = "your-oci-service-account-name" # Required when dns_provider_name = "oci" oci_zone_scope = "your-oci-zone-scope" # Required when dns_provider_name = "oci" - oci_zones_cache_duration = "your-oci-zones-cache-duration" # Required when dns_provider_name = "oci" } ``` @@ -77,10 +76,9 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.19.0" azure_client_id = "your-azure-client-id" # Required when dns_provider_name = "azure" - azure_federated_credential_id = "your-azure-federated-credential-id" # Required when dns_provider_name = "azure" azure_resource_group = "your-azure-resource-group" # Required when dns_provider_name = "azure" azure_subscription_id = "your-azure-subscription-id" # Required when dns_provider_name = "azure" azure_tenant_id = "your-azure-tenant-id" # Required when dns_provider_name = "azure" @@ -94,10 +92,9 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.19.0" azure_client_id = "your-azure-client-id" # Required when dns_provider_name = "azure-private-dns" - azure_federated_credential_id = "your-azure-federated-credential-id" # Required when dns_provider_name = "azure-private-dns" azure_resource_group = "your-azure-resource-group" # Required when dns_provider_name = "azure-private-dns" azure_subscription_id = "your-azure-subscription-id" # Required when dns_provider_name = "azure-private-dns" azure_tenant_id = "your-azure-tenant-id" # Required when dns_provider_name = "azure-private-dns" @@ -107,17 +104,17 @@ module "external_dns" { } ``` -### Google Cloud DNS +### Usage with Google Cloud DNS ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.19.0" dns_provider_name = "google" domain_filters = "your-domain-filters" - gcp_project_id = "your-gcp-project-id" # Required when dns_provider_name = "google" - gcp_service_account_email = "your-gcp-service-account-email" # Required when dns_provider_name = "google"; must already exist with Workload Identity bound to the external-dns Kubernetes ServiceAccount - zone_type = "public" # or "private" — required when dns_provider_name = "google" + gcp_project_id = "your-gcp-project-id" # Required when dns_provider_name = "google" + gcp_service_account_email = "your-gcp-service-account-email" # Required when dns_provider_name = "google" + gcp_service_account_name = "your-gcp-service-account-name" # Required when dns_provider_name = "google" } ``` @@ -176,6 +173,9 @@ resource "example_resource" "this" { | [domain\_filters](#input\_domain\_filters) | The domain filter to limit ExternalDNS to manage DNS records only for specific domains | `string` | n/a | yes | | [external\_dns\_namespace](#input\_external\_dns\_namespace) | The Kubernetes namespace where ExternalDNS will be deployed | `string` | `"external-dns"` | no | | [external\_dns\_version](#input\_external\_dns\_version) | The version of ExternalDNS Helm chart to deploy | `string` | `"1.19.0"` | no | +| [gcp\_project\_id](#input\_gcp\_project\_id) | The GCP project ID where the Cloud DNS zones are located (required when dns\_provider\_name is 'google') | `string` | `""` | no | +| [gcp\_service\_account\_email](#input\_gcp\_service\_account\_email) | Email of the GCP service account bound via Workload Identity for Cloud DNS access (required when dns\_provider\_name is 'google'). Create the service account and the Workload Identity binding outside this module (e.g. with infrastructure/gcp/iam) and pass its email here. | `string` | `""` | no | +| [gcp\_service\_account\_name](#input\_gcp\_service\_account\_name) | The Kubernetes service account name for GCP Workload Identity | `string` | `"external-dns"` | no | | [label\_filter](#input\_label\_filter) | Kubernetes label selector to filter resources processed by ExternalDNS. Defaults to 'dns/zone-type=' when zone\_type is set. Pass an explicit value to override, or an empty string to disable filtering. | `string` | `null` | no | | [oci\_compartment\_ocid](#input\_oci\_compartment\_ocid) | The OCI compartment OCID where the DNS zones are located (required when dns\_provider\_name is 'oci') | `string` | `""` | no | | [oci\_region](#input\_oci\_region) | The OCI region for workload identity configuration (required when dns\_provider\_name is 'oci') | `string` | `""` | no | @@ -187,22 +187,22 @@ resource "example_resource" "this" { | [txt\_owner\_id](#input\_txt\_owner\_id) | The TXT owner ID used by ExternalDNS to identify DNS records it manages | `string` | `"external_dns"` | no | | [type](#input\_type) | Determines whether the external-dns deployment is public or private | `string` | `"public"` | no | | [zone\_id\_filter](#input\_zone\_id\_filter) | The Route53 public or private hosted zone ID for ExternalDNS to manage (required when dns\_provider\_name is 'aws') | `string` | `""` | no | -| [zone\_type](#input\_zone\_type) | The Route53 hosted zone type for ExternalDNS to manage (public or private) | `string` | `""` | no | +| [zone\_type](#input\_zone\_type) | The DNS zone type/visibility for ExternalDNS to manage (public or private). Used by the 'aws' (--aws-zone-type) and 'google' (--google-zone-visibility) providers. | `string` | `""` | no | diff --git a/infrastructure/commons/istio/README.md b/infrastructure/commons/istio/README.md index 7daf14d9f..862e677c9 100644 --- a/infrastructure/commons/istio/README.md +++ b/infrastructure/commons/istio/README.md @@ -21,7 +21,7 @@ The module creates three helm_release resources in a strict dependency chain: is ```hcl module "istio" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/istio?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/istio?ref=v6.19.0" } ``` diff --git a/infrastructure/commons/prometheus/README.md b/infrastructure/commons/prometheus/README.md index 7ee42d122..e7bb66122 100644 --- a/infrastructure/commons/prometheus/README.md +++ b/infrastructure/commons/prometheus/README.md @@ -18,7 +18,7 @@ This module creates a helm_release resource to deploy the Prometheus chart from ```hcl module "prometheus" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.19.0" } ``` diff --git a/infrastructure/gcp/artifact-registry/README.md b/infrastructure/gcp/artifact-registry/README.md index 814b9377c..dce8a0209 100644 --- a/infrastructure/gcp/artifact-registry/README.md +++ b/infrastructure/gcp/artifact-registry/README.md @@ -21,7 +21,7 @@ The module creates a google_artifact_registry_repository resource configured wit ```hcl module "artifact-registry" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/artifact-registry?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/artifact-registry?ref=v6.19.0" location = "your-location" project_id = "your-project-id" diff --git a/infrastructure/gcp/backend/README.md b/infrastructure/gcp/backend/README.md index 8afdf9c58..515dc02ab 100644 --- a/infrastructure/gcp/backend/README.md +++ b/infrastructure/gcp/backend/README.md @@ -22,7 +22,7 @@ The module creates a random_id resource to generate a unique 8-byte hex suffix, ```hcl module "backend" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/backend?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/backend?ref=v6.19.0" project_id = "your-project-id" } diff --git a/infrastructure/gcp/cloud-dns/README.md b/infrastructure/gcp/cloud-dns/README.md index 2a9790da9..238bb8b67 100644 --- a/infrastructure/gcp/cloud-dns/README.md +++ b/infrastructure/gcp/cloud-dns/README.md @@ -21,7 +21,7 @@ The module creates a single google_dns_managed_zone resource in the specified GC ```hcl module "cloud-dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-dns?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-dns?ref=v6.19.0" domain_name = "your-domain-name" project_id = "your-project-id" diff --git a/infrastructure/gcp/cloud-nat/README.md b/infrastructure/gcp/cloud-nat/README.md index a07420850..26f67529f 100644 --- a/infrastructure/gcp/cloud-nat/README.md +++ b/infrastructure/gcp/cloud-nat/README.md @@ -19,7 +19,7 @@ This module creates a google_compute_router resource in a specified region and n ```hcl module "cloud-nat" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-nat?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-nat?ref=v6.19.0" nat_name = "your-nat-name" network_id = "your-network-id" diff --git a/infrastructure/gcp/gke/README.md b/infrastructure/gcp/gke/README.md index 5b0d27ac6..8979ae779 100644 --- a/infrastructure/gcp/gke/README.md +++ b/infrastructure/gcp/gke/README.md @@ -22,7 +22,7 @@ The module conditionally creates one of two mutually-exclusive submodules based ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.19.0" cluster_name = "your-cluster-name" ip_range_pods = "your-ip-range-pods" @@ -38,7 +38,7 @@ module "gke" { ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.19.0" cluster_name = "your-cluster-name" ip_range_pods = "your-ip-range-pods" @@ -73,7 +73,7 @@ module "gke" { ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.19.0" cluster_name = "your-cluster-name" ip_range_pods = "your-ip-range-pods" diff --git a/infrastructure/gcp/iam/README.md b/infrastructure/gcp/iam/README.md index b449e37b7..4530fb451 100644 --- a/infrastructure/gcp/iam/README.md +++ b/infrastructure/gcp/iam/README.md @@ -19,7 +19,7 @@ The module creates google_service_account resources for each service account spe ```hcl module "iam" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/iam?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/iam?ref=v6.19.0" project_id = "your-project-id" } diff --git a/infrastructure/gcp/security/README.md b/infrastructure/gcp/security/README.md index 5d0d0b3d0..79c17513a 100644 --- a/infrastructure/gcp/security/README.md +++ b/infrastructure/gcp/security/README.md @@ -22,7 +22,7 @@ The module uses data.google_container_cluster and data.google_compute_subnetwork ```hcl module "security" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/security?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/security?ref=v6.19.0" cluster_name = "your-cluster-name" gcp_project_id = "your-gcp-project-id" diff --git a/infrastructure/gcp/vpc/README.md b/infrastructure/gcp/vpc/README.md index 34ffdc1cb..a33f4569f 100644 --- a/infrastructure/gcp/vpc/README.md +++ b/infrastructure/gcp/vpc/README.md @@ -20,7 +20,7 @@ The module invokes the terraform-google-modules/network/google module to create ```hcl module "vpc" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/vpc?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/vpc?ref=v6.19.0" network_name = "your-network-name" project_id = "your-project-id" diff --git a/infrastructure/oci/backend/README.md b/infrastructure/oci/backend/README.md index 066220560..47ec373be 100644 --- a/infrastructure/oci/backend/README.md +++ b/infrastructure/oci/backend/README.md @@ -18,7 +18,7 @@ The module creates an oci_objectstorage_bucket resource, which is configured wit ```hcl module "backend" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/backend?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/backend?ref=v6.19.0" compartment_id = "your-compartment-id" namespace = "your-namespace" diff --git a/infrastructure/oci/dns/README.md b/infrastructure/oci/dns/README.md index 308c52d74..d84546d34 100644 --- a/infrastructure/oci/dns/README.md +++ b/infrastructure/oci/dns/README.md @@ -18,7 +18,7 @@ This module creates oci_dns_zone resources for each DNS zone defined in the dns_ ```hcl module "dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dns?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dns?ref=v6.19.0" compartment_id = "your-compartment-id" } diff --git a/infrastructure/oci/dynamic_groups/README.md b/infrastructure/oci/dynamic_groups/README.md index 0241f8f1b..6a6fa6f9b 100644 --- a/infrastructure/oci/dynamic_groups/README.md +++ b/infrastructure/oci/dynamic_groups/README.md @@ -19,7 +19,7 @@ This module creates an OCI dynamic group and an OCI identity policy, connecting ```hcl module "dynamic_groups" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dynamic_groups?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dynamic_groups?ref=v6.19.0" cluster_id = "your-cluster-id" compartment_id = "your-compartment-id" diff --git a/infrastructure/oci/oke/README.md b/infrastructure/oci/oke/README.md index 460d5f9e7..bcac63e89 100644 --- a/infrastructure/oci/oke/README.md +++ b/infrastructure/oci/oke/README.md @@ -21,7 +21,7 @@ The module instantiates the oracle-terraform-modules/oke/oci module to create an ```hcl module "oke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/oke?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/oke?ref=v6.19.0" api_endpoint_subnet_id = "your-api-endpoint-subnet-id" cluster_name = "your-cluster-name" diff --git a/infrastructure/oci/vcn/README.md b/infrastructure/oci/vcn/README.md index a668247d3..5f5a7be16 100644 --- a/infrastructure/oci/vcn/README.md +++ b/infrastructure/oci/vcn/README.md @@ -19,7 +19,7 @@ The module instantiates oci_core_subnet resources for public and private subnets ```hcl module "vcn" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/vcn?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/vcn?ref=v6.19.0" } ``` diff --git a/nullplatform/account/README.md b/nullplatform/account/README.md index 486810fec..d49b5d0ad 100644 --- a/nullplatform/account/README.md +++ b/nullplatform/account/README.md @@ -19,7 +19,7 @@ The module iterates over the `nullplatform_accounts` input map using `for_each` ```hcl module "account" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/account?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/account?ref=v6.19.0" nullplatform_accounts = "your-nullplatform-accounts" } diff --git a/nullplatform/agent/README.md b/nullplatform/agent/README.md index 3df52275f..344666d54 100644 --- a/nullplatform/agent/README.md +++ b/nullplatform/agent/README.md @@ -22,7 +22,7 @@ The module creates a helm_release resource targeting the nullplatform-agent char ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.19.0" api_key = "your-api-key" cloud_provider = "your-cloud-provider" @@ -36,7 +36,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.19.0" api_key = "your-api-key" aws_iam_role_arn = "your-aws-iam-role-arn" # Required when cloud_provider = "aws" @@ -51,7 +51,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.19.0" api_key = "your-api-key" cloud_provider = "gcp" @@ -65,7 +65,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.19.0" api_key = "your-api-key" azure_client_id = "your-azure-client-id" # Required when cloud_provider = "azure" @@ -85,7 +85,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.19.0" api_key = "your-api-key" cloud_provider = "oci" diff --git a/nullplatform/api_key/README.md b/nullplatform/api_key/README.md index 13dcd2239..21abb5589 100644 --- a/nullplatform/api_key/README.md +++ b/nullplatform/api_key/README.md @@ -21,7 +21,7 @@ The module creates a single nullplatform_api_key resource whose name, grants, an ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.19.0" type = "your-type" } @@ -31,7 +31,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.19.0" nrn = "your-nrn" # Required when type = "agent" type = "agent" @@ -42,7 +42,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.19.0" nrn = "your-nrn" # Required when type = "scope_notification" specification_slug = "your-specification-slug" # Required when type = "scope_notification" @@ -54,7 +54,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.19.0" nrn = "your-nrn" # Required when type = "service_notification" specification_slug = "your-specification-slug" # Required when type = "service_notification" @@ -66,7 +66,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.19.0" custom_grants = "your-custom-grants" # Required when type = "custom" custom_name = "your-custom-name" # Required when type = "custom" diff --git a/nullplatform/asset/docker_server/README.md b/nullplatform/asset/docker_server/README.md index 6cdcbf7e2..4045aebdc 100644 --- a/nullplatform/asset/docker_server/README.md +++ b/nullplatform/asset/docker_server/README.md @@ -21,7 +21,7 @@ Creates a nullplatform_provider_config resource of type 'docker-server' with enc ```hcl module "docker_server" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/docker_server?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/docker_server?ref=v6.19.0" login_server = "your-login-server" nrn = "your-nrn" diff --git a/nullplatform/asset/ecr/README.md b/nullplatform/asset/ecr/README.md index 939b70a07..ef894fcfc 100644 --- a/nullplatform/asset/ecr/README.md +++ b/nullplatform/asset/ecr/README.md @@ -21,7 +21,7 @@ The module reads the current AWS region via the aws_region data source and combi ```hcl module "ecr" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/ecr?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/ecr?ref=v6.19.0" application_role_arn = "your-application-role-arn" build_workflow_access_key_id = "your-build-workflow-access-key-id" diff --git a/nullplatform/asset/s3/README.md b/nullplatform/asset/s3/README.md index 356851abb..f9676b05b 100644 --- a/nullplatform/asset/s3/README.md +++ b/nullplatform/asset/s3/README.md @@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type s3-con ```hcl module "s3" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/s3?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/s3?ref=v6.19.0" bucket_name = "your-bucket-name" nrn = "your-nrn" diff --git a/nullplatform/base/README.md b/nullplatform/base/README.md index 98aba196f..793c864a8 100644 --- a/nullplatform/base/README.md +++ b/nullplatform/base/README.md @@ -22,7 +22,7 @@ The module creates two kubernetes_namespace_v1 resources ('nullplatform-tools' a ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.19.0" k8s_provider = "your-k8s-provider" np_api_key = "your-np-api-key" @@ -33,7 +33,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.19.0" aws_region = "your-aws-region" # Required when k8s_provider = "eks" cloudwatch_service_account_annotations = "your-cloudwatch-service-account-annotations" # Required when k8s_provider = "eks" @@ -52,7 +52,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.19.0" gateway_private_gcp_firewall_name = "your-gateway-private-gcp-firewall-name" # Required when k8s_provider = "gke" gateway_public_gcp_firewall_name = "your-gateway-public-gcp-firewall-name" # Required when k8s_provider = "gke" @@ -65,7 +65,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.19.0" gateway_private_azure_nsg_id = "your-gateway-private-azure-nsg-id" # Required when k8s_provider = "aks" gateway_public_azure_load_balancer_subnet = "your-gateway-public-azure-load-balancer-subnet" # Required when k8s_provider = "aks" @@ -80,7 +80,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.19.0" gateway_private_oci_security_list_management_mode = "your-gateway-private-oci-security-list-management-mode" # Required when k8s_provider = "oke" gateway_private_oci_subnet = "your-gateway-private-oci-subnet" # Required when k8s_provider = "oke" @@ -95,7 +95,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.19.0" gateway_private_azure_nsg_id = "your-gateway-private-azure-nsg-id" # Required when k8s_provider = "aro" gateway_public_azure_load_balancer_subnet = "your-gateway-public-azure-load-balancer-subnet" # Required when k8s_provider = "aro" diff --git a/nullplatform/cloud/aws/cloud/README.md b/nullplatform/cloud/aws/cloud/README.md index 3ba5ae5c0..90d8ac4ee 100644 --- a/nullplatform/cloud/aws/cloud/README.md +++ b/nullplatform/cloud/aws/cloud/README.md @@ -21,7 +21,7 @@ The module uses data sources aws_caller_identity and aws_region to dynamically r ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/cloud?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/cloud?ref=v6.19.0" domain_name = "your-domain-name" hosted_private_zone_id = "your-hosted-private-zone-id" diff --git a/nullplatform/cloud/aws/vpc/README.md b/nullplatform/cloud/aws/vpc/README.md index 227344db6..c2449cd1b 100644 --- a/nullplatform/cloud/aws/vpc/README.md +++ b/nullplatform/cloud/aws/vpc/README.md @@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource of type aws-ne ```hcl module "vpc" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/vpc?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/vpc?ref=v6.19.0" nrn = "your-nrn" vpc_id = "your-vpc-id" diff --git a/nullplatform/cloud/azure/cloud/README.md b/nullplatform/cloud/azure/cloud/README.md index ce77faa1c..1e6acaf1f 100644 --- a/nullplatform/cloud/azure/cloud/README.md +++ b/nullplatform/cloud/azure/cloud/README.md @@ -22,7 +22,7 @@ The module creates a single nullplatform_provider_config resource of type 'azure ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/azure/cloud?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/azure/cloud?ref=v6.19.0" azure_resource_group_name = "your-azure-resource-group-name" nrn = "your-nrn" diff --git a/nullplatform/cloud/gcp/cloud/README.md b/nullplatform/cloud/gcp/cloud/README.md index f190bce75..6700b52e3 100644 --- a/nullplatform/cloud/gcp/cloud/README.md +++ b/nullplatform/cloud/gcp/cloud/README.md @@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type 'googl ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/gcp/cloud?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/gcp/cloud?ref=v6.19.0" domain_name = "your-domain-name" location = "your-location" diff --git a/nullplatform/cloud/oci/cloud/README.md b/nullplatform/cloud/oci/cloud/README.md index aee66fcf2..e958565aa 100644 --- a/nullplatform/cloud/oci/cloud/README.md +++ b/nullplatform/cloud/oci/cloud/README.md @@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type 'oci-c ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/oci/cloud?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/oci/cloud?ref=v6.19.0" account_id = "your-account-id" account_name = "your-account-name" diff --git a/nullplatform/code_repository/README.md b/nullplatform/code_repository/README.md index 5bb8a1bc4..c000525e9 100644 --- a/nullplatform/code_repository/README.md +++ b/nullplatform/code_repository/README.md @@ -22,7 +22,7 @@ The module uses local boolean flags (is_gitlab, is_github, is_azure, is_bitbucke ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.19.0" git_provider = "your-git-provider" nrn = "your-nrn" @@ -33,7 +33,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.19.0" git_provider = "github" github_installation_id = "your-github-installation-id" # Required when git_provider = "github" @@ -46,7 +46,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.19.0" git_provider = "gitlab" gitlab_access_token = "your-gitlab-access-token" # Required when git_provider = "gitlab" @@ -62,7 +62,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.19.0" azure_access_token = "your-azure-access-token" # Required when git_provider = "azure" azure_agent_pool = "your-azure-agent-pool" # Required when git_provider = "azure" @@ -76,7 +76,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.19.0" bitbucket_collaborators = "your-bitbucket-collaborators" # Required when git_provider = "bitbucket" bitbucket_installation_url = "your-bitbucket-installation-url" # Required when git_provider = "bitbucket" diff --git a/nullplatform/container_orchestration/aks/README.md b/nullplatform/container_orchestration/aks/README.md index fcebaad7c..63b6dbebe 100644 --- a/nullplatform/container_orchestration/aks/README.md +++ b/nullplatform/container_orchestration/aks/README.md @@ -21,7 +21,7 @@ The module builds a local.attributes map that aggregates cluster metadata, gatew ```hcl module "aks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.19.0" cluster_name = "your-cluster-name" nrn = "your-nrn" diff --git a/nullplatform/container_orchestration/eks/README.md b/nullplatform/container_orchestration/eks/README.md index 129da1a9e..f8450cc2d 100644 --- a/nullplatform/container_orchestration/eks/README.md +++ b/nullplatform/container_orchestration/eks/README.md @@ -22,7 +22,7 @@ The module assembles a set of structured locals by merging optional variables in ```hcl module "eks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.19.0" cluster_name = "your-cluster-name" nrn = "your-nrn" diff --git a/nullplatform/container_orchestration/gke/README.md b/nullplatform/container_orchestration/gke/README.md index 2cbfc80f0..80e73b1d5 100644 --- a/nullplatform/container_orchestration/gke/README.md +++ b/nullplatform/container_orchestration/gke/README.md @@ -22,7 +22,7 @@ The module constructs a structured attributes object using locals that merge clu ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.19.0" cluster_name = "your-cluster-name" location = "your-location" diff --git a/nullplatform/container_orchestration/oke/README.md b/nullplatform/container_orchestration/oke/README.md index 4de4b11d3..0928c8907 100644 --- a/nullplatform/container_orchestration/oke/README.md +++ b/nullplatform/container_orchestration/oke/README.md @@ -19,7 +19,7 @@ Creates a single nullplatform_provider_config resource of type 'oke' that stores ```hcl module "oke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/oke?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/oke?ref=v6.19.0" cluster_name = "your-cluster-name" nrn = "your-nrn" diff --git a/nullplatform/dimension/README.md b/nullplatform/dimension/README.md index f7eca4f42..2107f493a 100644 --- a/nullplatform/dimension/README.md +++ b/nullplatform/dimension/README.md @@ -19,7 +19,7 @@ The module creates a nullplatform_dimension resource using the provided name, or ```hcl module "dimension" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension?ref=v6.19.0" name = "your-name" nrn = "your-nrn" diff --git a/nullplatform/dimension_value/README.md b/nullplatform/dimension_value/README.md index ec9b578b4..a00fff152 100644 --- a/nullplatform/dimension_value/README.md +++ b/nullplatform/dimension_value/README.md @@ -19,7 +19,7 @@ The module uses a terraform_data resource to enforce mutual-exclusivity and pres ```hcl module "dimension_value" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension_value?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension_value?ref=v6.19.0" dimension_id = "your-dimension-id" name = "your-name" diff --git a/nullplatform/identity-access-control/README.md b/nullplatform/identity-access-control/README.md index 51d3bcfd7..c2fb76440 100644 --- a/nullplatform/identity-access-control/README.md +++ b/nullplatform/identity-access-control/README.md @@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource named identity ```hcl module "identity-access-control" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/identity-access-control?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/identity-access-control?ref=v6.19.0" attributes = "your-attributes" nrn = "your-nrn" diff --git a/nullplatform/metrics/README.md b/nullplatform/metrics/README.md index 75df83134..3db879177 100644 --- a/nullplatform/metrics/README.md +++ b/nullplatform/metrics/README.md @@ -21,7 +21,7 @@ The module creates a single nullplatform_provider_config resource of type 'prome ```hcl module "metrics" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/metrics?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/metrics?ref=v6.19.0" nrn = "your-nrn" } diff --git a/nullplatform/packaged_service/README.md b/nullplatform/packaged_service/README.md index 87e3b0896..234197d16 100644 --- a/nullplatform/packaged_service/README.md +++ b/nullplatform/packaged_service/README.md @@ -17,7 +17,7 @@ spec updates / republish correctly. ```hcl module "packaged_service" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/packaged_service?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/packaged_service?ref=v6.19.0" nrn = "organization=…:account=…:namespace=…" diff --git a/nullplatform/parameter_storage_configuration/README.md b/nullplatform/parameter_storage_configuration/README.md index 4a1ce3cb5..f0f9dfb03 100644 --- a/nullplatform/parameter_storage_configuration/README.md +++ b/nullplatform/parameter_storage_configuration/README.md @@ -20,7 +20,7 @@ The module delegates entirely to a remote `scope_configuration` module sourced f ```hcl module "parameter_storage_configuration" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_configuration?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_configuration?ref=v6.19.0" attributes = "your-attributes" np_api_key = "your-np-api-key" diff --git a/nullplatform/parameter_storage_definition/README.md b/nullplatform/parameter_storage_definition/README.md index 9d6b8c83d..a88e2554c 100644 --- a/nullplatform/parameter_storage_definition/README.md +++ b/nullplatform/parameter_storage_definition/README.md @@ -20,7 +20,7 @@ A data.http resource fetches the raw specification template from a configurable ```hcl module "parameter_storage_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition?ref=v6.19.0" np_api_key = "your-np-api-key" nrn = "your-nrn" diff --git a/nullplatform/parameter_storage_definition_agent_association/README.md b/nullplatform/parameter_storage_definition_agent_association/README.md index 19056a31b..eb8dcafda 100644 --- a/nullplatform/parameter_storage_definition_agent_association/README.md +++ b/nullplatform/parameter_storage_definition_agent_association/README.md @@ -21,7 +21,7 @@ The module creates a terraform_data resource to track API key changes and a null ```hcl module "parameter_storage_definition_agent_association" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition_agent_association?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition_agent_association?ref=v6.19.0" api_key = "your-api-key" nrn = "your-nrn" diff --git a/nullplatform/scope_configuration/README.md b/nullplatform/scope_configuration/README.md index 96c8e02f5..85282afab 100644 --- a/nullplatform/scope_configuration/README.md +++ b/nullplatform/scope_configuration/README.md @@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource that binds a N ```hcl module "scope_configuration" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_configuration?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_configuration?ref=v6.19.0" attributes = "your-attributes" np_api_key = "your-np-api-key" diff --git a/nullplatform/scope_definition/README.md b/nullplatform/scope_definition/README.md index ad4712974..ad93a743e 100644 --- a/nullplatform/scope_definition/README.md +++ b/nullplatform/scope_definition/README.md @@ -22,7 +22,7 @@ The module fetches JSON templates via data.http resources from a configurable Gi ```hcl module "scope_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition?ref=v6.19.0" np_api_key = "your-np-api-key" nrn = "your-nrn" diff --git a/nullplatform/scope_definition_agent_association/README.md b/nullplatform/scope_definition_agent_association/README.md index ad14abab6..284be26c4 100644 --- a/nullplatform/scope_definition_agent_association/README.md +++ b/nullplatform/scope_definition_agent_association/README.md @@ -22,7 +22,7 @@ The module fetches a notification channel JSON template via the `data.http` prov ```hcl module "scope_definition_agent_association" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition_agent_association?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition_agent_association?ref=v6.19.0" api_key = "your-api-key" nrn = "your-nrn" diff --git a/nullplatform/service_definition/README.md b/nullplatform/service_definition/README.md index 6286990c1..e9fc1469a 100644 --- a/nullplatform/service_definition/README.md +++ b/nullplatform/service_definition/README.md @@ -22,7 +22,7 @@ The module uses data.http resources to fetch service-spec, action, and link JSON ```hcl module "service_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.19.0" nrn = "your-nrn" service_name = "your-service-name" diff --git a/nullplatform/service_definition_agent_association/README.md b/nullplatform/service_definition_agent_association/README.md index 7b96f5c63..c28c98299 100644 --- a/nullplatform/service_definition_agent_association/README.md +++ b/nullplatform/service_definition_agent_association/README.md @@ -22,7 +22,7 @@ The module creates a terraform_data resource to track API key changes as a lifec ```hcl module "service_definition_agent_association" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition_agent_association?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition_agent_association?ref=v6.19.0" api_key = "your-api-key" repository_service_spec_repo = "your-repository-service-spec-repo" diff --git a/nullplatform/users/README.md b/nullplatform/users/README.md index dc1efeb63..73104336c 100644 --- a/nullplatform/users/README.md +++ b/nullplatform/users/README.md @@ -21,7 +21,7 @@ The module iterates over a map of user definitions using `nullplatform_user` res ```hcl module "users" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/users?ref=v6.18.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/users?ref=v6.19.0" nullplatform_users = "your-nullplatform-users" } From f712605b34b8b1c274c271a344f1d2fc2372d8d4 Mon Sep 17 00:00:00 2001 From: Sebastian Correa Date: Fri, 21 Aug 2026 14:22:31 -0300 Subject: [PATCH 37/81] fix(base): bump default nullplatform_base_helm_version to 2.44.0 (#534) 2.40.0 (the current default) predates commit ca796ca "fix(base): stop the namespaces from deleting themselves on upgrade" (first released in 2.43.1): the gateways namespace was only rendered into the chart's manifest while absent, with no protection against Helm pruning it once omitted on a later upgrade -- deleting it and everything inside (both Gateways, HPAs, PDBs, plus any cert-manager Certificates/Secrets a caller's cert-manager-config release targets at it). Hit this for real: upgrading a live GKE cluster from an older nullplatform/base ref to 6.x's default (2.40.0) wiped the gateways namespace on the second `helm upgrade`, taking down both public and private ingress and the TLS certificates with it. 2.44.0 includes the fix plus three more chart releases of unrelated, purely additive changes (PDB selector fix, logs controller image bumps, IRSA/azure annotation support) -- diffed against 2.40.0's values.yaml, nothing removed or renamed. Co-authored-by: sebas_correa --- nullplatform/base/variables.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nullplatform/base/variables.tf b/nullplatform/base/variables.tf index 9505caacd..e964fb573 100644 --- a/nullplatform/base/variables.tf +++ b/nullplatform/base/variables.tf @@ -1,7 +1,7 @@ variable "nullplatform_base_helm_version" { description = "Helm chart version for the nullplatform base." type = string - default = "2.40.0" + default = "2.44.0" } variable "namespace" { From 0e9737b6a669859c0d80a5c7732731d5815b7e61 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Fri, 21 Aug 2026 17:23:21 +0000 Subject: [PATCH 38/81] chore(6.x): release 6.19.1 --- CHANGELOG.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 8fb827273..ebb128da9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,12 @@ # Changelog +## [6.19.1](https://github.com/nullplatform/tofu-modules/compare/v6.19.0...v6.19.1) (2026-08-21) + + +### Bug Fixes + +* **base:** bump default nullplatform_base_helm_version to 2.44.0 ([#534](https://github.com/nullplatform/tofu-modules/issues/534)) ([a7e91b7](https://github.com/nullplatform/tofu-modules/commit/a7e91b7ad613da19de3a653c497152480e33f15d)) + ## [6.19.0](https://github.com/nullplatform/tofu-modules/compare/v6.18.0...v6.19.0) (2026-08-21) From 31f98283312df83a044cb3d5639930acbd29bb3f Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Fri, 21 Aug 2026 17:23:57 +0000 Subject: [PATCH 39/81] docs: regenerate READMEs for changed modules and update versions --- infrastructure/aws/acm/README.md | 2 +- .../aws_load_balancer_controller/README.md | 2 +- infrastructure/aws/backend/README.md | 2 +- infrastructure/aws/dns/README.md | 2 +- infrastructure/aws/eks/README.md | 2 +- infrastructure/aws/iam/agent/README.md | 2 +- .../README.md | 2 +- infrastructure/aws/iam/cert_manager/README.md | 2 +- .../aws/iam/ci-build-workflow-user/README.md | 2 +- infrastructure/aws/iam/cloudwatch/README.md | 2 +- infrastructure/aws/iam/ecr/README.md | 2 +- infrastructure/aws/iam/external_dns/README.md | 2 +- infrastructure/aws/iam/s3/README.md | 2 +- infrastructure/aws/ingress/README.md | 2 +- infrastructure/aws/security/README.md | 2 +- infrastructure/aws/vpc/README.md | 2 +- infrastructure/azure/acr/README.md | 2 +- infrastructure/azure/aks/README.md | 2 +- .../azure/aks_route_table/README.md | 2 +- infrastructure/azure/dns/README.md | 2 +- infrastructure/azure/iam/README.md | 2 +- infrastructure/azure/private_dns/README.md | 2 +- infrastructure/azure/resource_group/README.md | 2 +- infrastructure/azure/security/README.md | 2 +- infrastructure/azure/vnet/README.md | 2 +- infrastructure/commons/cert_manager/README.md | 12 +- infrastructure/commons/external_dns/README.md | 14 +-- infrastructure/commons/istio/README.md | 2 +- infrastructure/commons/prometheus/README.md | 2 +- .../gcp/artifact-registry/README.md | 2 +- infrastructure/gcp/backend/README.md | 2 +- infrastructure/gcp/cloud-dns/README.md | 2 +- infrastructure/gcp/cloud-nat/README.md | 2 +- infrastructure/gcp/gke/README.md | 6 +- infrastructure/gcp/iam/README.md | 2 +- infrastructure/gcp/security/README.md | 2 +- infrastructure/gcp/vpc/README.md | 2 +- infrastructure/oci/backend/README.md | 2 +- infrastructure/oci/dns/README.md | 2 +- infrastructure/oci/dynamic_groups/README.md | 2 +- infrastructure/oci/oke/README.md | 2 +- infrastructure/oci/vcn/README.md | 2 +- nullplatform/account/README.md | 2 +- nullplatform/agent/README.md | 10 +- nullplatform/api_key/README.md | 10 +- nullplatform/asset/docker_server/README.md | 2 +- nullplatform/asset/ecr/README.md | 2 +- nullplatform/asset/s3/README.md | 2 +- nullplatform/base/README.md | 104 +++++++----------- nullplatform/cloud/aws/cloud/README.md | 2 +- nullplatform/cloud/aws/vpc/README.md | 2 +- nullplatform/cloud/azure/cloud/README.md | 2 +- nullplatform/cloud/gcp/cloud/README.md | 2 +- nullplatform/cloud/oci/cloud/README.md | 2 +- nullplatform/code_repository/README.md | 10 +- .../container_orchestration/aks/README.md | 2 +- .../container_orchestration/eks/README.md | 2 +- .../container_orchestration/gke/README.md | 2 +- .../container_orchestration/oke/README.md | 2 +- nullplatform/dimension/README.md | 2 +- nullplatform/dimension_value/README.md | 2 +- .../identity-access-control/README.md | 2 +- nullplatform/metrics/README.md | 2 +- nullplatform/packaged_service/README.md | 2 +- .../parameter_storage_configuration/README.md | 2 +- .../parameter_storage_definition/README.md | 2 +- .../README.md | 2 +- nullplatform/scope_configuration/README.md | 2 +- nullplatform/scope_definition/README.md | 2 +- .../README.md | 2 +- nullplatform/service_definition/README.md | 2 +- .../README.md | 2 +- nullplatform/users/README.md | 2 +- 73 files changed, 138 insertions(+), 160 deletions(-) diff --git a/infrastructure/aws/acm/README.md b/infrastructure/aws/acm/README.md index 5570c7143..1c68008be 100644 --- a/infrastructure/aws/acm/README.md +++ b/infrastructure/aws/acm/README.md @@ -18,7 +18,7 @@ The module creates an aws_acm_certificate resource with DNS validation, which is ```hcl module "acm" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/acm?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/acm?ref=v6.19.1" domain_name = "your-domain-name" zone_id = "your-zone-id" diff --git a/infrastructure/aws/aws_load_balancer_controller/README.md b/infrastructure/aws/aws_load_balancer_controller/README.md index 164a29b44..ec2533e01 100644 --- a/infrastructure/aws/aws_load_balancer_controller/README.md +++ b/infrastructure/aws/aws_load_balancer_controller/README.md @@ -18,7 +18,7 @@ This module creates a helm_release resource to deploy the AWS Load Balancer Cont ```hcl module "aws_load_balancer_controller" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/aws_load_balancer_controller?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/aws_load_balancer_controller?ref=v6.19.1" cluster_name = "your-cluster-name" vpc_id = "your-vpc-id" diff --git a/infrastructure/aws/backend/README.md b/infrastructure/aws/backend/README.md index d89335540..44323c495 100644 --- a/infrastructure/aws/backend/README.md +++ b/infrastructure/aws/backend/README.md @@ -20,7 +20,7 @@ This module creates an S3 bucket with versioning and server-side encryption enab ```hcl module "backend" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/backend?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/backend?ref=v6.19.1" } ``` diff --git a/infrastructure/aws/dns/README.md b/infrastructure/aws/dns/README.md index 4f617d8c1..3a1df4999 100644 --- a/infrastructure/aws/dns/README.md +++ b/infrastructure/aws/dns/README.md @@ -21,7 +21,7 @@ The module conditionally creates an aws_route53_zone resource for a public hoste ```hcl module "dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/dns?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/dns?ref=v6.19.1" domain_name = "your-domain-name" vpc_id = "your-vpc-id" diff --git a/infrastructure/aws/eks/README.md b/infrastructure/aws/eks/README.md index e76dc7291..3341dc817 100644 --- a/infrastructure/aws/eks/README.md +++ b/infrastructure/aws/eks/README.md @@ -22,7 +22,7 @@ The module wraps terraform-aws-modules/eks to create the EKS cluster (aws_eks_cl ```hcl module "eks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/eks?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/eks?ref=v6.19.1" aws_subnets_private_ids = "your-aws-subnets-private-ids" aws_vpc_vpc_id = "your-aws-vpc-vpc-id" diff --git a/infrastructure/aws/iam/agent/README.md b/infrastructure/aws/iam/agent/README.md index b0e8abcd4..578bbecec 100644 --- a/infrastructure/aws/iam/agent/README.md +++ b/infrastructure/aws/iam/agent/README.md @@ -21,7 +21,7 @@ The module uses the terraform-aws-modules/iam//modules/iam-role-for-service-acco ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/agent?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/agent?ref=v6.19.1" agent_namespace = "your-agent-namespace" aws_iam_openid_connect_provider_arn = "your-aws-iam-openid-connect-provider-arn" diff --git a/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md b/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md index ad048420f..2e7448d26 100644 --- a/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md +++ b/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md @@ -19,7 +19,7 @@ This module creates an IAM role for the AWS Load Balancer Controller using the t ```hcl module "aws_load_balancer_controller_iam" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/aws_load_balancer_controller_iam?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/aws_load_balancer_controller_iam?ref=v6.19.1" aws_iam_openid_connect_provider_arn = "your-aws-iam-openid-connect-provider-arn" cluster_name = "your-cluster-name" diff --git a/infrastructure/aws/iam/cert_manager/README.md b/infrastructure/aws/iam/cert_manager/README.md index 86815c53b..d9fe4ef2f 100644 --- a/infrastructure/aws/iam/cert_manager/README.md +++ b/infrastructure/aws/iam/cert_manager/README.md @@ -20,7 +20,7 @@ An aws_iam_policy resource is always created granting route53:GetChange, route53 ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cert_manager?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cert_manager?ref=v6.19.1" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/ci-build-workflow-user/README.md b/infrastructure/aws/iam/ci-build-workflow-user/README.md index a45d3b299..2f9c08cc9 100644 --- a/infrastructure/aws/iam/ci-build-workflow-user/README.md +++ b/infrastructure/aws/iam/ci-build-workflow-user/README.md @@ -21,7 +21,7 @@ The module creates an aws_iam_user named with the cluster_name prefix and genera ```hcl module "ci-build-workflow-user" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ci-build-workflow-user?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ci-build-workflow-user?ref=v6.19.1" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/cloudwatch/README.md b/infrastructure/aws/iam/cloudwatch/README.md index 00823149f..cbdea3128 100644 --- a/infrastructure/aws/iam/cloudwatch/README.md +++ b/infrastructure/aws/iam/cloudwatch/README.md @@ -20,7 +20,7 @@ The module creates an aws_iam_policy granting CloudWatch Logs and Metrics write ```hcl module "cloudwatch" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cloudwatch?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cloudwatch?ref=v6.19.1" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/ecr/README.md b/infrastructure/aws/iam/ecr/README.md index f4faddc43..f5145d659 100644 --- a/infrastructure/aws/iam/ecr/README.md +++ b/infrastructure/aws/iam/ecr/README.md @@ -20,7 +20,7 @@ The module creates an aws_iam_role named nullplatform-{cluster_name}-application ```hcl module "ecr" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ecr?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ecr?ref=v6.19.1" build_workflow_group_name = "your-build-workflow-group-name" cluster_name = "your-cluster-name" diff --git a/infrastructure/aws/iam/external_dns/README.md b/infrastructure/aws/iam/external_dns/README.md index 6d12c6cf0..30755805d 100644 --- a/infrastructure/aws/iam/external_dns/README.md +++ b/infrastructure/aws/iam/external_dns/README.md @@ -20,7 +20,7 @@ An aws_iam_policy resource named nullplatform_external_dns_policy is always crea ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/external_dns?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/external_dns?ref=v6.19.1" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/s3/README.md b/infrastructure/aws/iam/s3/README.md index a36105e27..cab44f6ca 100644 --- a/infrastructure/aws/iam/s3/README.md +++ b/infrastructure/aws/iam/s3/README.md @@ -18,7 +18,7 @@ The module creates an aws_iam_policy resource that allows s3:PutObject and s3:Ge ```hcl module "s3" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/s3?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/s3?ref=v6.19.1" bucket = "your-bucket" build_workflow_group_name = "your-build-workflow-group-name" diff --git a/infrastructure/aws/ingress/README.md b/infrastructure/aws/ingress/README.md index 21148c4b5..b4b30cecf 100644 --- a/infrastructure/aws/ingress/README.md +++ b/infrastructure/aws/ingress/README.md @@ -22,7 +22,7 @@ The module creates up to two kubernetes_ingress_v1 resources — one for an inte ```hcl module "ingress" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/ingress?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/ingress?ref=v6.19.1" certificate_arn = "your-certificate-arn" } diff --git a/infrastructure/aws/security/README.md b/infrastructure/aws/security/README.md index 57fec425a..ff0cabd2c 100644 --- a/infrastructure/aws/security/README.md +++ b/infrastructure/aws/security/README.md @@ -22,7 +22,7 @@ The module uses data sources (aws_eks_cluster, aws_vpc) to automatically derive ```hcl module "security" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/security?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/security?ref=v6.19.1" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/vpc/README.md b/infrastructure/aws/vpc/README.md index d33d510f8..ed0c1d12e 100644 --- a/infrastructure/aws/vpc/README.md +++ b/infrastructure/aws/vpc/README.md @@ -22,7 +22,7 @@ This module creates a terraform-aws-modules/vpc/aws module resource with DNS hos ```hcl module "vpc" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/vpc?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/vpc?ref=v6.19.1" account = "your-account" organization = "your-organization" diff --git a/infrastructure/azure/acr/README.md b/infrastructure/azure/acr/README.md index e21c29aa8..b14985317 100644 --- a/infrastructure/azure/acr/README.md +++ b/infrastructure/azure/acr/README.md @@ -18,7 +18,7 @@ The module uses the azurerm_container_registry resource to create the container ```hcl module "acr" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/acr?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/acr?ref=v6.19.1" containerregistry_name = "your-containerregistry-name" location = "your-location" diff --git a/infrastructure/azure/aks/README.md b/infrastructure/azure/aks/README.md index 5e37da49e..4a13dce31 100644 --- a/infrastructure/azure/aks/README.md +++ b/infrastructure/azure/aks/README.md @@ -22,7 +22,7 @@ The module wraps the Azure/aks/azurerm community module (version 11.0.0) and use ```hcl module "aks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks?ref=v6.19.1" cluster_name = "your-cluster-name" location = "your-location" diff --git a/infrastructure/azure/aks_route_table/README.md b/infrastructure/azure/aks_route_table/README.md index ada12cb18..0d55e409a 100644 --- a/infrastructure/azure/aks_route_table/README.md +++ b/infrastructure/azure/aks_route_table/README.md @@ -19,7 +19,7 @@ The module uses an azurerm_resources data source to discover the AKS-managed rou ```hcl module "aks_route_table" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks_route_table?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks_route_table?ref=v6.19.1" node_resource_group = "your-node-resource-group" subnet_id = "your-subnet-id" diff --git a/infrastructure/azure/dns/README.md b/infrastructure/azure/dns/README.md index 93dc49bd9..2f13a06a5 100644 --- a/infrastructure/azure/dns/README.md +++ b/infrastructure/azure/dns/README.md @@ -18,7 +18,7 @@ This module creates an azurerm_dns_zone resource and configures it with the prov ```hcl module "dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/dns?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/dns?ref=v6.19.1" domain_name = "your-domain-name" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/iam/README.md b/infrastructure/azure/iam/README.md index 0c355f451..2189b04c9 100644 --- a/infrastructure/azure/iam/README.md +++ b/infrastructure/azure/iam/README.md @@ -21,7 +21,7 @@ The module creates an azurerm_user_assigned_identity resource in the specified r ```hcl module "iam" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/iam?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/iam?ref=v6.19.1" location = "your-location" name = "your-name" diff --git a/infrastructure/azure/private_dns/README.md b/infrastructure/azure/private_dns/README.md index 23d4feda4..6e0c787b2 100644 --- a/infrastructure/azure/private_dns/README.md +++ b/infrastructure/azure/private_dns/README.md @@ -18,7 +18,7 @@ This module creates an azurerm_private_dns_zone resource and optionally multiple ```hcl module "private_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/private_dns?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/private_dns?ref=v6.19.1" domain_name = "your-domain-name" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/resource_group/README.md b/infrastructure/azure/resource_group/README.md index 0183e7cc5..776db4ac1 100644 --- a/infrastructure/azure/resource_group/README.md +++ b/infrastructure/azure/resource_group/README.md @@ -18,7 +18,7 @@ This module creates an azurerm_resource_group resource and outputs its name and ```hcl module "resource_group" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/resource_group?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/resource_group?ref=v6.19.1" location = "your-location" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/security/README.md b/infrastructure/azure/security/README.md index 2b75e0a2c..cef18c22b 100644 --- a/infrastructure/azure/security/README.md +++ b/infrastructure/azure/security/README.md @@ -21,7 +21,7 @@ The module uses azurerm_kubernetes_cluster and azurerm_virtual_network data sour ```hcl module "security" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/security?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/security?ref=v6.19.1" cluster_name = "your-cluster-name" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/vnet/README.md b/infrastructure/azure/vnet/README.md index c8fa93963..829e1c2e0 100644 --- a/infrastructure/azure/vnet/README.md +++ b/infrastructure/azure/vnet/README.md @@ -18,7 +18,7 @@ This module creates an Azure virtual network using the azurerm provider and conf ```hcl module "vnet" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/vnet?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/vnet?ref=v6.19.1" address_space = "your-address-space" location = "your-location" diff --git a/infrastructure/commons/cert_manager/README.md b/infrastructure/commons/cert_manager/README.md index 0bcc9c68c..9334229fb 100644 --- a/infrastructure/commons/cert_manager/README.md +++ b/infrastructure/commons/cert_manager/README.md @@ -22,7 +22,7 @@ Two primary helm_release resources are created: cert-manager from the Jetstack c ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.19.1" account_slug = "your-account-slug" cloud_provider = "your-cloud-provider" @@ -35,7 +35,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.19.1" account_slug = "your-account-slug" cloud_provider = "gcp" @@ -50,7 +50,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.19.1" account_slug = "your-account-slug" azure_client_id = "your-azure-client-id" # Required when cloud_provider = "azure" @@ -68,7 +68,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.19.1" account_slug = "your-account-slug" cloud_provider = "cloudflare" @@ -83,7 +83,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.19.1" account_slug = "your-account-slug" aws_identity_mode = "your-aws-identity-mode" # Required when cloud_provider = "aws" @@ -99,7 +99,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.19.1" account_slug = "your-account-slug" cert_manager_webhook_oci_namespace = "your-cert-manager-webhook-oci-namespace" # Required when cloud_provider = "oci" diff --git a/infrastructure/commons/external_dns/README.md b/infrastructure/commons/external_dns/README.md index 608a2bbba..9e63bd0e7 100644 --- a/infrastructure/commons/external_dns/README.md +++ b/infrastructure/commons/external_dns/README.md @@ -22,7 +22,7 @@ The module creates an optional kubernetes_namespace_v1 resource and a helm_relea ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.19.1" dns_provider_name = "your-dns-provider-name" domain_filters = "your-domain-filters" @@ -33,7 +33,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.19.1" cloudflare_token = "your-cloudflare-token" # Required when dns_provider_name = "cloudflare" dns_provider_name = "cloudflare" @@ -45,7 +45,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.19.1" aws_iam_role_arn = "your-aws-iam-role-arn" # Required when dns_provider_name = "aws" aws_identity_mode = "your-aws-identity-mode" # Required when dns_provider_name = "aws" @@ -61,7 +61,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.19.1" dns_provider_name = "oci" domain_filters = "your-domain-filters" @@ -76,7 +76,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.19.1" azure_client_id = "your-azure-client-id" # Required when dns_provider_name = "azure" azure_resource_group = "your-azure-resource-group" # Required when dns_provider_name = "azure" @@ -92,7 +92,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.19.1" azure_client_id = "your-azure-client-id" # Required when dns_provider_name = "azure-private-dns" azure_resource_group = "your-azure-resource-group" # Required when dns_provider_name = "azure-private-dns" @@ -108,7 +108,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.19.1" dns_provider_name = "google" domain_filters = "your-domain-filters" diff --git a/infrastructure/commons/istio/README.md b/infrastructure/commons/istio/README.md index 862e677c9..6365be7dd 100644 --- a/infrastructure/commons/istio/README.md +++ b/infrastructure/commons/istio/README.md @@ -21,7 +21,7 @@ The module creates three helm_release resources in a strict dependency chain: is ```hcl module "istio" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/istio?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/istio?ref=v6.19.1" } ``` diff --git a/infrastructure/commons/prometheus/README.md b/infrastructure/commons/prometheus/README.md index e7bb66122..d3d53729d 100644 --- a/infrastructure/commons/prometheus/README.md +++ b/infrastructure/commons/prometheus/README.md @@ -18,7 +18,7 @@ This module creates a helm_release resource to deploy the Prometheus chart from ```hcl module "prometheus" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.19.1" } ``` diff --git a/infrastructure/gcp/artifact-registry/README.md b/infrastructure/gcp/artifact-registry/README.md index dce8a0209..e1df15f0d 100644 --- a/infrastructure/gcp/artifact-registry/README.md +++ b/infrastructure/gcp/artifact-registry/README.md @@ -21,7 +21,7 @@ The module creates a google_artifact_registry_repository resource configured wit ```hcl module "artifact-registry" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/artifact-registry?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/artifact-registry?ref=v6.19.1" location = "your-location" project_id = "your-project-id" diff --git a/infrastructure/gcp/backend/README.md b/infrastructure/gcp/backend/README.md index 515dc02ab..7c4fe15d9 100644 --- a/infrastructure/gcp/backend/README.md +++ b/infrastructure/gcp/backend/README.md @@ -22,7 +22,7 @@ The module creates a random_id resource to generate a unique 8-byte hex suffix, ```hcl module "backend" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/backend?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/backend?ref=v6.19.1" project_id = "your-project-id" } diff --git a/infrastructure/gcp/cloud-dns/README.md b/infrastructure/gcp/cloud-dns/README.md index 238bb8b67..e8cc4bdf4 100644 --- a/infrastructure/gcp/cloud-dns/README.md +++ b/infrastructure/gcp/cloud-dns/README.md @@ -21,7 +21,7 @@ The module creates a single google_dns_managed_zone resource in the specified GC ```hcl module "cloud-dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-dns?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-dns?ref=v6.19.1" domain_name = "your-domain-name" project_id = "your-project-id" diff --git a/infrastructure/gcp/cloud-nat/README.md b/infrastructure/gcp/cloud-nat/README.md index 26f67529f..dc2e20cb3 100644 --- a/infrastructure/gcp/cloud-nat/README.md +++ b/infrastructure/gcp/cloud-nat/README.md @@ -19,7 +19,7 @@ This module creates a google_compute_router resource in a specified region and n ```hcl module "cloud-nat" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-nat?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-nat?ref=v6.19.1" nat_name = "your-nat-name" network_id = "your-network-id" diff --git a/infrastructure/gcp/gke/README.md b/infrastructure/gcp/gke/README.md index 8979ae779..2ca8faac2 100644 --- a/infrastructure/gcp/gke/README.md +++ b/infrastructure/gcp/gke/README.md @@ -22,7 +22,7 @@ The module conditionally creates one of two mutually-exclusive submodules based ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.19.1" cluster_name = "your-cluster-name" ip_range_pods = "your-ip-range-pods" @@ -38,7 +38,7 @@ module "gke" { ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.19.1" cluster_name = "your-cluster-name" ip_range_pods = "your-ip-range-pods" @@ -73,7 +73,7 @@ module "gke" { ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.19.1" cluster_name = "your-cluster-name" ip_range_pods = "your-ip-range-pods" diff --git a/infrastructure/gcp/iam/README.md b/infrastructure/gcp/iam/README.md index 4530fb451..483b30da1 100644 --- a/infrastructure/gcp/iam/README.md +++ b/infrastructure/gcp/iam/README.md @@ -19,7 +19,7 @@ The module creates google_service_account resources for each service account spe ```hcl module "iam" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/iam?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/iam?ref=v6.19.1" project_id = "your-project-id" } diff --git a/infrastructure/gcp/security/README.md b/infrastructure/gcp/security/README.md index 79c17513a..97ee046a3 100644 --- a/infrastructure/gcp/security/README.md +++ b/infrastructure/gcp/security/README.md @@ -22,7 +22,7 @@ The module uses data.google_container_cluster and data.google_compute_subnetwork ```hcl module "security" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/security?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/security?ref=v6.19.1" cluster_name = "your-cluster-name" gcp_project_id = "your-gcp-project-id" diff --git a/infrastructure/gcp/vpc/README.md b/infrastructure/gcp/vpc/README.md index a33f4569f..dd823cb43 100644 --- a/infrastructure/gcp/vpc/README.md +++ b/infrastructure/gcp/vpc/README.md @@ -20,7 +20,7 @@ The module invokes the terraform-google-modules/network/google module to create ```hcl module "vpc" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/vpc?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/vpc?ref=v6.19.1" network_name = "your-network-name" project_id = "your-project-id" diff --git a/infrastructure/oci/backend/README.md b/infrastructure/oci/backend/README.md index 47ec373be..68661cc7e 100644 --- a/infrastructure/oci/backend/README.md +++ b/infrastructure/oci/backend/README.md @@ -18,7 +18,7 @@ The module creates an oci_objectstorage_bucket resource, which is configured wit ```hcl module "backend" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/backend?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/backend?ref=v6.19.1" compartment_id = "your-compartment-id" namespace = "your-namespace" diff --git a/infrastructure/oci/dns/README.md b/infrastructure/oci/dns/README.md index d84546d34..09f7ac1f9 100644 --- a/infrastructure/oci/dns/README.md +++ b/infrastructure/oci/dns/README.md @@ -18,7 +18,7 @@ This module creates oci_dns_zone resources for each DNS zone defined in the dns_ ```hcl module "dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dns?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dns?ref=v6.19.1" compartment_id = "your-compartment-id" } diff --git a/infrastructure/oci/dynamic_groups/README.md b/infrastructure/oci/dynamic_groups/README.md index 6a6fa6f9b..6dc095de4 100644 --- a/infrastructure/oci/dynamic_groups/README.md +++ b/infrastructure/oci/dynamic_groups/README.md @@ -19,7 +19,7 @@ This module creates an OCI dynamic group and an OCI identity policy, connecting ```hcl module "dynamic_groups" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dynamic_groups?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dynamic_groups?ref=v6.19.1" cluster_id = "your-cluster-id" compartment_id = "your-compartment-id" diff --git a/infrastructure/oci/oke/README.md b/infrastructure/oci/oke/README.md index bcac63e89..a257bcd2c 100644 --- a/infrastructure/oci/oke/README.md +++ b/infrastructure/oci/oke/README.md @@ -21,7 +21,7 @@ The module instantiates the oracle-terraform-modules/oke/oci module to create an ```hcl module "oke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/oke?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/oke?ref=v6.19.1" api_endpoint_subnet_id = "your-api-endpoint-subnet-id" cluster_name = "your-cluster-name" diff --git a/infrastructure/oci/vcn/README.md b/infrastructure/oci/vcn/README.md index 5f5a7be16..78207d5df 100644 --- a/infrastructure/oci/vcn/README.md +++ b/infrastructure/oci/vcn/README.md @@ -19,7 +19,7 @@ The module instantiates oci_core_subnet resources for public and private subnets ```hcl module "vcn" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/vcn?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/vcn?ref=v6.19.1" } ``` diff --git a/nullplatform/account/README.md b/nullplatform/account/README.md index d49b5d0ad..22072195f 100644 --- a/nullplatform/account/README.md +++ b/nullplatform/account/README.md @@ -19,7 +19,7 @@ The module iterates over the `nullplatform_accounts` input map using `for_each` ```hcl module "account" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/account?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/account?ref=v6.19.1" nullplatform_accounts = "your-nullplatform-accounts" } diff --git a/nullplatform/agent/README.md b/nullplatform/agent/README.md index 344666d54..c676c7462 100644 --- a/nullplatform/agent/README.md +++ b/nullplatform/agent/README.md @@ -22,7 +22,7 @@ The module creates a helm_release resource targeting the nullplatform-agent char ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.19.1" api_key = "your-api-key" cloud_provider = "your-cloud-provider" @@ -36,7 +36,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.19.1" api_key = "your-api-key" aws_iam_role_arn = "your-aws-iam-role-arn" # Required when cloud_provider = "aws" @@ -51,7 +51,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.19.1" api_key = "your-api-key" cloud_provider = "gcp" @@ -65,7 +65,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.19.1" api_key = "your-api-key" azure_client_id = "your-azure-client-id" # Required when cloud_provider = "azure" @@ -85,7 +85,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.19.1" api_key = "your-api-key" cloud_provider = "oci" diff --git a/nullplatform/api_key/README.md b/nullplatform/api_key/README.md index 21abb5589..13c3a6583 100644 --- a/nullplatform/api_key/README.md +++ b/nullplatform/api_key/README.md @@ -21,7 +21,7 @@ The module creates a single nullplatform_api_key resource whose name, grants, an ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.19.1" type = "your-type" } @@ -31,7 +31,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.19.1" nrn = "your-nrn" # Required when type = "agent" type = "agent" @@ -42,7 +42,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.19.1" nrn = "your-nrn" # Required when type = "scope_notification" specification_slug = "your-specification-slug" # Required when type = "scope_notification" @@ -54,7 +54,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.19.1" nrn = "your-nrn" # Required when type = "service_notification" specification_slug = "your-specification-slug" # Required when type = "service_notification" @@ -66,7 +66,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.19.1" custom_grants = "your-custom-grants" # Required when type = "custom" custom_name = "your-custom-name" # Required when type = "custom" diff --git a/nullplatform/asset/docker_server/README.md b/nullplatform/asset/docker_server/README.md index 4045aebdc..fa777e547 100644 --- a/nullplatform/asset/docker_server/README.md +++ b/nullplatform/asset/docker_server/README.md @@ -21,7 +21,7 @@ Creates a nullplatform_provider_config resource of type 'docker-server' with enc ```hcl module "docker_server" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/docker_server?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/docker_server?ref=v6.19.1" login_server = "your-login-server" nrn = "your-nrn" diff --git a/nullplatform/asset/ecr/README.md b/nullplatform/asset/ecr/README.md index ef894fcfc..db1053f81 100644 --- a/nullplatform/asset/ecr/README.md +++ b/nullplatform/asset/ecr/README.md @@ -21,7 +21,7 @@ The module reads the current AWS region via the aws_region data source and combi ```hcl module "ecr" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/ecr?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/ecr?ref=v6.19.1" application_role_arn = "your-application-role-arn" build_workflow_access_key_id = "your-build-workflow-access-key-id" diff --git a/nullplatform/asset/s3/README.md b/nullplatform/asset/s3/README.md index f9676b05b..a45d79983 100644 --- a/nullplatform/asset/s3/README.md +++ b/nullplatform/asset/s3/README.md @@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type s3-con ```hcl module "s3" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/s3?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/s3?ref=v6.19.1" bucket_name = "your-bucket-name" nrn = "your-nrn" diff --git a/nullplatform/base/README.md b/nullplatform/base/README.md index 793c864a8..fcb03c9fc 100644 --- a/nullplatform/base/README.md +++ b/nullplatform/base/README.md @@ -2,27 +2,27 @@ ## Description -Deploys the nullplatform base Helm chart onto a Kubernetes cluster across multiple cloud providers, configuring gateways, ingress controllers, logging integrations, and the control plane agent via a rendered values template +Deploys the nullplatform base Helm chart onto a Kubernetes cluster across multiple cloud providers with configurable networking, logging, and observability integrations ## Architecture -The module creates two kubernetes_namespace_v1 resources ('nullplatform-tools' and 'nullplatform') to avoid Helm lookup race conditions, then deploys a single helm_release resource ('nullplatform-base') from the nullplatform Helm repository with a templatefile-rendered values YAML. All input variables flow through the locals.tf templatefile into the helm_release values block, which configures sub-charts for gateways, ingress controllers, logging pipelines, metrics, and the control plane agent. Outputs expose cloud-specific security resource identifiers (AWS security group IDs, Azure NSG IDs, GCP firewall names) that were passed in from upstream security submodules. +The module creates two kubernetes_namespace_v1 resources (nullplatform-tools and nullplatform) to pre-seed namespaces before chart installation, then deploys a helm_release resource pointing to the nullplatform-base chart from the nullplatform GitHub Helm registry. A templatefile-rendered local (nullplatform_base_values) merges all input variables into a YAML values file that is passed directly to the helm_release, controlling everything from gateway topology and ingress controllers to logging backends and observability pipelines. Outputs surface provider-specific security resource identifiers (AWS security group IDs, Azure NSG IDs, GCP firewall names) that are expected to originate from companion security submodules. ## Features -- Creates kubernetes_namespace_v1 resources for nullplatform-tools and nullplatform to prevent Helm chart race conditions -- Deploys nullplatform-base helm_release with fully rendered YAML values supporting EKS, GKE, AKS, OKE, and ARO providers -- Configures public and private Gateway API resources with per-cloud security group, NSG, firewall, and OCI subnet annotations -- Enables pluggable observability backends including Prometheus, Loki, GELF, Dynatrace, Datadog, New Relic, and CloudWatch -- Supports internal and external public load balancer modes for Cloudflare Tunnel / VPN or direct internet exposure -- Configures control plane agent deployment with configurable image repository and tag -- Creates image pull secrets and ingress controller resources for both public and private traffic scopes +- Creates kubernetes_namespace_v1 resources for nullplatform-tools and nullplatform to prevent Helm lookup race conditions +- Deploys nullplatform-base helm_release with full values rendered from a templatefile covering gateways, ingress, logging, and observability +- Configures public and private gateway resources with per-cloud security group, NSG, firewall, and OCI subnet annotations +- Supports multi-provider observability integrations including Prometheus, Loki, GELF, Dynatrace, Datadog, New Relic, and CloudWatch +- Configures ingress controllers with independent public and private scopes, names, and domains +- Enables optional control plane agent deployment with configurable image repository and tag +- Supports image pull secrets for private container registries across all Kubernetes providers ## Basic Usage ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.19.1" k8s_provider = "your-k8s-provider" np_api_key = "your-np-api-key" @@ -33,18 +33,10 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.19.0" - - aws_region = "your-aws-region" # Required when k8s_provider = "eks" - cloudwatch_service_account_annotations = "your-cloudwatch-service-account-annotations" # Required when k8s_provider = "eks" - gateway_internal_aws_name = "your-gateway-internal-aws-name" # Required when k8s_provider = "eks" - gateway_private_aws_dns_name = "your-gateway-private-aws-dns-name" # Required when k8s_provider = "eks" - gateway_private_aws_security_group_id = "your-gateway-private-aws-security-group-id" # Required when k8s_provider = "eks" - gateway_public_aws_dns_name = "your-gateway-public-aws-dns-name" # Required when k8s_provider = "eks" - gateway_public_aws_name = "your-gateway-public-aws-name" # Required when k8s_provider = "eks" - gateway_public_aws_security_group_id = "your-gateway-public-aws-security-group-id" # Required when k8s_provider = "eks" - k8s_provider = "eks" - np_api_key = "your-np-api-key" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.19.1" + + k8s_provider = "eks" + np_api_key = "your-np-api-key" } ``` @@ -52,12 +44,10 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.19.1" - gateway_private_gcp_firewall_name = "your-gateway-private-gcp-firewall-name" # Required when k8s_provider = "gke" - gateway_public_gcp_firewall_name = "your-gateway-public-gcp-firewall-name" # Required when k8s_provider = "gke" - k8s_provider = "gke" - np_api_key = "your-np-api-key" + k8s_provider = "gke" + np_api_key = "your-np-api-key" } ``` @@ -65,14 +55,10 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.19.0" - - gateway_private_azure_nsg_id = "your-gateway-private-azure-nsg-id" # Required when k8s_provider = "aks" - gateway_public_azure_load_balancer_subnet = "your-gateway-public-azure-load-balancer-subnet" # Required when k8s_provider = "aks" - gateway_public_azure_nsg_id = "your-gateway-public-azure-nsg-id" # Required when k8s_provider = "aks" - internal_azure_load_balancer_subnet = "your-internal-azure-load-balancer-subnet" # Required when k8s_provider = "aks" - k8s_provider = "aks" - np_api_key = "your-np-api-key" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.19.1" + + k8s_provider = "aks" + np_api_key = "your-np-api-key" } ``` @@ -80,29 +66,21 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.19.0" - - gateway_private_oci_security_list_management_mode = "your-gateway-private-oci-security-list-management-mode" # Required when k8s_provider = "oke" - gateway_private_oci_subnet = "your-gateway-private-oci-subnet" # Required when k8s_provider = "oke" - gateway_public_oci_security_list_management_mode = "your-gateway-public-oci-security-list-management-mode" # Required when k8s_provider = "oke" - gateway_public_oci_subnet = "your-gateway-public-oci-subnet" # Required when k8s_provider = "oke" - k8s_provider = "oke" - np_api_key = "your-np-api-key" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.19.1" + + k8s_provider = "oke" + np_api_key = "your-np-api-key" } ``` -### Usage with Azure ARO +### Usage with Azure Red Hat OpenShift (ARO) ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.19.0" - - gateway_private_azure_nsg_id = "your-gateway-private-azure-nsg-id" # Required when k8s_provider = "aro" - gateway_public_azure_load_balancer_subnet = "your-gateway-public-azure-load-balancer-subnet" # Required when k8s_provider = "aro" - gateway_public_azure_nsg_id = "your-gateway-public-azure-nsg-id" # Required when k8s_provider = "aro" - internal_azure_load_balancer_subnet = "your-internal-azure-load-balancer-subnet" # Required when k8s_provider = "aro" - k8s_provider = "aro" - np_api_key = "your-np-api-key" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.19.1" + + k8s_provider = "aro" + np_api_key = "your-np-api-key" } ``` @@ -217,7 +195,7 @@ resource "example_resource" "this" { | [newrelic\_metrics\_enabled](#input\_newrelic\_metrics\_enabled) | Enable metrics forwarding to New Relic. Set to false to send only logs. | `bool` | `true` | no | | [newrelic\_region](#input\_newrelic\_region) | New Relic region (e.g., US, EU). | `string` | `""` | no | | [np\_api\_key](#input\_np\_api\_key) | Nullplatform API key for authentication (account level). | `string` | n/a | yes | -| [nullplatform\_base\_helm\_version](#input\_nullplatform\_base\_helm\_version) | Helm chart version for the nullplatform base. | `string` | `"2.40.0"` | no | +| [nullplatform\_base\_helm\_version](#input\_nullplatform\_base\_helm\_version) | Helm chart version for the nullplatform base. | `string` | `"2.44.0"` | no | | [prometheus\_enabled](#input\_prometheus\_enabled) | Enable the Prometheus exporter. | `bool` | `true` | no | | [tls\_required](#input\_tls\_required) | Whether TLS is required. | `bool` | `true` | no | @@ -237,16 +215,16 @@ resource "example_resource" "this" { diff --git a/nullplatform/cloud/aws/cloud/README.md b/nullplatform/cloud/aws/cloud/README.md index 90d8ac4ee..94dcd3697 100644 --- a/nullplatform/cloud/aws/cloud/README.md +++ b/nullplatform/cloud/aws/cloud/README.md @@ -21,7 +21,7 @@ The module uses data sources aws_caller_identity and aws_region to dynamically r ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/cloud?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/cloud?ref=v6.19.1" domain_name = "your-domain-name" hosted_private_zone_id = "your-hosted-private-zone-id" diff --git a/nullplatform/cloud/aws/vpc/README.md b/nullplatform/cloud/aws/vpc/README.md index c2449cd1b..89b288a5f 100644 --- a/nullplatform/cloud/aws/vpc/README.md +++ b/nullplatform/cloud/aws/vpc/README.md @@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource of type aws-ne ```hcl module "vpc" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/vpc?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/vpc?ref=v6.19.1" nrn = "your-nrn" vpc_id = "your-vpc-id" diff --git a/nullplatform/cloud/azure/cloud/README.md b/nullplatform/cloud/azure/cloud/README.md index 1e6acaf1f..606729c6f 100644 --- a/nullplatform/cloud/azure/cloud/README.md +++ b/nullplatform/cloud/azure/cloud/README.md @@ -22,7 +22,7 @@ The module creates a single nullplatform_provider_config resource of type 'azure ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/azure/cloud?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/azure/cloud?ref=v6.19.1" azure_resource_group_name = "your-azure-resource-group-name" nrn = "your-nrn" diff --git a/nullplatform/cloud/gcp/cloud/README.md b/nullplatform/cloud/gcp/cloud/README.md index 6700b52e3..3deedc72a 100644 --- a/nullplatform/cloud/gcp/cloud/README.md +++ b/nullplatform/cloud/gcp/cloud/README.md @@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type 'googl ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/gcp/cloud?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/gcp/cloud?ref=v6.19.1" domain_name = "your-domain-name" location = "your-location" diff --git a/nullplatform/cloud/oci/cloud/README.md b/nullplatform/cloud/oci/cloud/README.md index e958565aa..cd9513ff3 100644 --- a/nullplatform/cloud/oci/cloud/README.md +++ b/nullplatform/cloud/oci/cloud/README.md @@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type 'oci-c ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/oci/cloud?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/oci/cloud?ref=v6.19.1" account_id = "your-account-id" account_name = "your-account-name" diff --git a/nullplatform/code_repository/README.md b/nullplatform/code_repository/README.md index c000525e9..648ddd6b7 100644 --- a/nullplatform/code_repository/README.md +++ b/nullplatform/code_repository/README.md @@ -22,7 +22,7 @@ The module uses local boolean flags (is_gitlab, is_github, is_azure, is_bitbucke ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.19.1" git_provider = "your-git-provider" nrn = "your-nrn" @@ -33,7 +33,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.19.1" git_provider = "github" github_installation_id = "your-github-installation-id" # Required when git_provider = "github" @@ -46,7 +46,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.19.1" git_provider = "gitlab" gitlab_access_token = "your-gitlab-access-token" # Required when git_provider = "gitlab" @@ -62,7 +62,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.19.1" azure_access_token = "your-azure-access-token" # Required when git_provider = "azure" azure_agent_pool = "your-azure-agent-pool" # Required when git_provider = "azure" @@ -76,7 +76,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.19.1" bitbucket_collaborators = "your-bitbucket-collaborators" # Required when git_provider = "bitbucket" bitbucket_installation_url = "your-bitbucket-installation-url" # Required when git_provider = "bitbucket" diff --git a/nullplatform/container_orchestration/aks/README.md b/nullplatform/container_orchestration/aks/README.md index 63b6dbebe..4e88bb96c 100644 --- a/nullplatform/container_orchestration/aks/README.md +++ b/nullplatform/container_orchestration/aks/README.md @@ -21,7 +21,7 @@ The module builds a local.attributes map that aggregates cluster metadata, gatew ```hcl module "aks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.19.1" cluster_name = "your-cluster-name" nrn = "your-nrn" diff --git a/nullplatform/container_orchestration/eks/README.md b/nullplatform/container_orchestration/eks/README.md index f8450cc2d..6bb568e3b 100644 --- a/nullplatform/container_orchestration/eks/README.md +++ b/nullplatform/container_orchestration/eks/README.md @@ -22,7 +22,7 @@ The module assembles a set of structured locals by merging optional variables in ```hcl module "eks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.19.1" cluster_name = "your-cluster-name" nrn = "your-nrn" diff --git a/nullplatform/container_orchestration/gke/README.md b/nullplatform/container_orchestration/gke/README.md index 80e73b1d5..6cd1dc9f8 100644 --- a/nullplatform/container_orchestration/gke/README.md +++ b/nullplatform/container_orchestration/gke/README.md @@ -22,7 +22,7 @@ The module constructs a structured attributes object using locals that merge clu ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.19.1" cluster_name = "your-cluster-name" location = "your-location" diff --git a/nullplatform/container_orchestration/oke/README.md b/nullplatform/container_orchestration/oke/README.md index 0928c8907..67a1dd882 100644 --- a/nullplatform/container_orchestration/oke/README.md +++ b/nullplatform/container_orchestration/oke/README.md @@ -19,7 +19,7 @@ Creates a single nullplatform_provider_config resource of type 'oke' that stores ```hcl module "oke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/oke?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/oke?ref=v6.19.1" cluster_name = "your-cluster-name" nrn = "your-nrn" diff --git a/nullplatform/dimension/README.md b/nullplatform/dimension/README.md index 2107f493a..ebebba336 100644 --- a/nullplatform/dimension/README.md +++ b/nullplatform/dimension/README.md @@ -19,7 +19,7 @@ The module creates a nullplatform_dimension resource using the provided name, or ```hcl module "dimension" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension?ref=v6.19.1" name = "your-name" nrn = "your-nrn" diff --git a/nullplatform/dimension_value/README.md b/nullplatform/dimension_value/README.md index a00fff152..c52bd8196 100644 --- a/nullplatform/dimension_value/README.md +++ b/nullplatform/dimension_value/README.md @@ -19,7 +19,7 @@ The module uses a terraform_data resource to enforce mutual-exclusivity and pres ```hcl module "dimension_value" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension_value?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension_value?ref=v6.19.1" dimension_id = "your-dimension-id" name = "your-name" diff --git a/nullplatform/identity-access-control/README.md b/nullplatform/identity-access-control/README.md index c2fb76440..28428dee0 100644 --- a/nullplatform/identity-access-control/README.md +++ b/nullplatform/identity-access-control/README.md @@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource named identity ```hcl module "identity-access-control" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/identity-access-control?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/identity-access-control?ref=v6.19.1" attributes = "your-attributes" nrn = "your-nrn" diff --git a/nullplatform/metrics/README.md b/nullplatform/metrics/README.md index 3db879177..6f727769b 100644 --- a/nullplatform/metrics/README.md +++ b/nullplatform/metrics/README.md @@ -21,7 +21,7 @@ The module creates a single nullplatform_provider_config resource of type 'prome ```hcl module "metrics" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/metrics?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/metrics?ref=v6.19.1" nrn = "your-nrn" } diff --git a/nullplatform/packaged_service/README.md b/nullplatform/packaged_service/README.md index 234197d16..00ef56382 100644 --- a/nullplatform/packaged_service/README.md +++ b/nullplatform/packaged_service/README.md @@ -17,7 +17,7 @@ spec updates / republish correctly. ```hcl module "packaged_service" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/packaged_service?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/packaged_service?ref=v6.19.1" nrn = "organization=…:account=…:namespace=…" diff --git a/nullplatform/parameter_storage_configuration/README.md b/nullplatform/parameter_storage_configuration/README.md index f0f9dfb03..b09866f41 100644 --- a/nullplatform/parameter_storage_configuration/README.md +++ b/nullplatform/parameter_storage_configuration/README.md @@ -20,7 +20,7 @@ The module delegates entirely to a remote `scope_configuration` module sourced f ```hcl module "parameter_storage_configuration" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_configuration?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_configuration?ref=v6.19.1" attributes = "your-attributes" np_api_key = "your-np-api-key" diff --git a/nullplatform/parameter_storage_definition/README.md b/nullplatform/parameter_storage_definition/README.md index a88e2554c..c89fb334e 100644 --- a/nullplatform/parameter_storage_definition/README.md +++ b/nullplatform/parameter_storage_definition/README.md @@ -20,7 +20,7 @@ A data.http resource fetches the raw specification template from a configurable ```hcl module "parameter_storage_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition?ref=v6.19.1" np_api_key = "your-np-api-key" nrn = "your-nrn" diff --git a/nullplatform/parameter_storage_definition_agent_association/README.md b/nullplatform/parameter_storage_definition_agent_association/README.md index eb8dcafda..7b0275dd1 100644 --- a/nullplatform/parameter_storage_definition_agent_association/README.md +++ b/nullplatform/parameter_storage_definition_agent_association/README.md @@ -21,7 +21,7 @@ The module creates a terraform_data resource to track API key changes and a null ```hcl module "parameter_storage_definition_agent_association" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition_agent_association?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition_agent_association?ref=v6.19.1" api_key = "your-api-key" nrn = "your-nrn" diff --git a/nullplatform/scope_configuration/README.md b/nullplatform/scope_configuration/README.md index 85282afab..817aecc2a 100644 --- a/nullplatform/scope_configuration/README.md +++ b/nullplatform/scope_configuration/README.md @@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource that binds a N ```hcl module "scope_configuration" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_configuration?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_configuration?ref=v6.19.1" attributes = "your-attributes" np_api_key = "your-np-api-key" diff --git a/nullplatform/scope_definition/README.md b/nullplatform/scope_definition/README.md index ad93a743e..e500a80a0 100644 --- a/nullplatform/scope_definition/README.md +++ b/nullplatform/scope_definition/README.md @@ -22,7 +22,7 @@ The module fetches JSON templates via data.http resources from a configurable Gi ```hcl module "scope_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition?ref=v6.19.1" np_api_key = "your-np-api-key" nrn = "your-nrn" diff --git a/nullplatform/scope_definition_agent_association/README.md b/nullplatform/scope_definition_agent_association/README.md index 284be26c4..368beff8b 100644 --- a/nullplatform/scope_definition_agent_association/README.md +++ b/nullplatform/scope_definition_agent_association/README.md @@ -22,7 +22,7 @@ The module fetches a notification channel JSON template via the `data.http` prov ```hcl module "scope_definition_agent_association" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition_agent_association?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition_agent_association?ref=v6.19.1" api_key = "your-api-key" nrn = "your-nrn" diff --git a/nullplatform/service_definition/README.md b/nullplatform/service_definition/README.md index e9fc1469a..ff3842cb4 100644 --- a/nullplatform/service_definition/README.md +++ b/nullplatform/service_definition/README.md @@ -22,7 +22,7 @@ The module uses data.http resources to fetch service-spec, action, and link JSON ```hcl module "service_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.19.1" nrn = "your-nrn" service_name = "your-service-name" diff --git a/nullplatform/service_definition_agent_association/README.md b/nullplatform/service_definition_agent_association/README.md index c28c98299..c3b96eca0 100644 --- a/nullplatform/service_definition_agent_association/README.md +++ b/nullplatform/service_definition_agent_association/README.md @@ -22,7 +22,7 @@ The module creates a terraform_data resource to track API key changes as a lifec ```hcl module "service_definition_agent_association" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition_agent_association?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition_agent_association?ref=v6.19.1" api_key = "your-api-key" repository_service_spec_repo = "your-repository-service-spec-repo" diff --git a/nullplatform/users/README.md b/nullplatform/users/README.md index 73104336c..4d3db281a 100644 --- a/nullplatform/users/README.md +++ b/nullplatform/users/README.md @@ -21,7 +21,7 @@ The module iterates over a map of user definitions using `nullplatform_user` res ```hcl module "users" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/users?ref=v6.19.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/users?ref=v6.19.1" nullplatform_users = "your-nullplatform-users" } From 8598b8289758e5f0632d371cd0a161ab41615aea Mon Sep 17 00:00:00 2001 From: Gonzalo Rojas Date: Thu, 27 Aug 2026 18:07:45 -0300 Subject: [PATCH 40/81] ci: reject new moving version defaults, and document what to pin (#539) check-version-pinning.sh rejects a new moving default, a repository URL pinned to a branch, or a helm_release with no version. Without it the pinning erodes on its own: someone adds default = "latest" in six months and nothing notices. It runs in pre-commit and again as a step in the terraform-lint workflow -- folded into the existing job rather than given its own, because it needs the same changed-file list that job already computes and adding it there costs no new check. That mirrors what the workflow already does for tflint, whose comment calls itself the CI backstop for anyone committing with --no-verify. Findings are keyed by path plus variable name rather than line number so the baseline survives files moving, and the patterns use POSIX classes rather than \s, which neither POSIX awk nor GNU grep supports and which would have made the check silently useless on the runner. It found three violations a manual sweep had missed. Fifteen findings are baselined. Ten are the scopes and service-spec repositories, which can be pinned without a breaking change and are deferred for their own review. The other five are fixed by the separate "require an explicit version" PR, whose base does not contain this file and so cannot remove the entries itself. VERSIONS.md lists every version to pin with its current value, and records the one trap worth knowing before bumping an image by hand: k8s-traffic-manager publishes a v2.0.2 built five months before 1.8.0, so the higher version number is the older build from a line that was not continued. Nothing here bumps a version automatically. Doing that would put the drift back in documentation form and contradict the rule of pinning what you already run. The root README pointed its Usage example at v6.11.0, eight releases behind this line, because the generator rewrites every module README's source ref but never touches the root one. --- .github/workflows/tflint-unused.yml | 16 +++- .pre-commit-config.yaml | 7 ++ README.md | 7 +- VERSIONS.md | 134 +++++++++++++++++++++++++++ scripts/check-version-pinning.sh | 81 ++++++++++++++++ scripts/version-pinning-baseline.txt | 26 ++++++ 6 files changed, 268 insertions(+), 3 deletions(-) create mode 100644 VERSIONS.md create mode 100755 scripts/check-version-pinning.sh create mode 100644 scripts/version-pinning-baseline.txt diff --git a/.github/workflows/tflint-unused.yml b/.github/workflows/tflint-unused.yml index b2be4f8f5..11c7e1c4e 100644 --- a/.github/workflows/tflint-unused.yml +++ b/.github/workflows/tflint-unused.yml @@ -1,4 +1,4 @@ -name: tflint-unused-declarations +name: terraform-lint on: pull_request: @@ -7,7 +7,7 @@ on: jobs: check: - name: Check for unused declarations + name: Lint changed Terraform runs-on: ubuntu-24.04 steps: - name: Checkout repository @@ -52,3 +52,15 @@ jobs: echo "::error::tflint found unused declarations in one or more changed modules (see groups above)." exit 1 fi + + # CI backstop for the local pre-commit hook. + - name: Check version pinning + if: steps.changed.outputs.dirs != '' + env: + BASE_SHA: ${{ github.event.pull_request.base.sha }} + HEAD_SHA: ${{ github.event.pull_request.head.sha }} + run: | + files="$(git diff --name-only "$BASE_SHA" "$HEAD_SHA" -- '*.tf' || true)" + [ -z "$files" ] && exit 0 + # shellcheck disable=SC2086 + ./scripts/check-version-pinning.sh $files diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 3a7551db7..246c08c4d 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -23,6 +23,13 @@ repos: require_serial: true exclude: '\.terraform/|\.terragrunt-cache/' + - id: check-version-pinning + name: check version pinning + entry: scripts/check-version-pinning.sh + language: script + files: '\.tf$' + exclude: '\.terraform/|\.terragrunt-cache/' + - id: block-superpowers-files name: block superpowers files entry: >- diff --git a/README.md b/README.md index eea697ad0..6ed387a9b 100644 --- a/README.md +++ b/README.md @@ -30,7 +30,7 @@ Reference any module via its Git source, pinned to a release tag: ```hcl module "vpc" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/vpc?ref=v6.11.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/vpc?ref=v6.19.1" # module inputs ... } @@ -46,6 +46,11 @@ tofu apply See the [latest releases](https://github.com/nullplatform/tofu-modules/releases) for available versions. +Several modules require you to pin a chart version, an image tag or a git ref, with no +default. **[VERSIONS.md](VERSIONS.md) lists every one of them with its current value and a +ready-to-paste block** — read it before your first apply rather than hunting the numbers down +one variable at a time. + ## Versioning Releases follow [Semantic Versioning](https://semver.org/) and are automated via [release-please](https://github.com/googleapis/release-please). See [CHANGELOG.md](CHANGELOG.md) for the full release history. diff --git a/VERSIONS.md b/VERSIONS.md new file mode 100644 index 000000000..b2352a36a --- /dev/null +++ b/VERSIONS.md @@ -0,0 +1,134 @@ +# Pinned versions + +Every version these modules deploy — Helm charts, container images, and the git refs the agent +clones — is listed here with the value to pin. + +For the version of *these modules*, see the +[releases](https://github.com/nullplatform/tofu-modules/releases). + +## Why it matters + +`latest` and branch names resolve at deploy time, not at apply time. A pod restart can pull a +different build with no change on your side and no diff to review. Every default below names +a specific release, so an upgrade is something someone decides. + +## What to pin + +Verified 2026-08-27. + +| Component | Current | Variable | Module | +| --- | --- | --- | --- | +| `nullplatform-base` chart | `2.44.0` | `nullplatform_base_helm_version` | `nullplatform/base` | +| `nullplatform-agent` chart | `2.37.0` | `nullplatform_agent_helm_version` | `nullplatform/agent` | +| `cert-manager` chart | `v1.21.1` | `cert_manager_version` | `infrastructure/commons/cert_manager` | +| `prometheus` chart | `29.27.0` | `prometheus_version` | `infrastructure/commons/prometheus` | +| `k8s-logs-controller` | `1.6.0` | `logging_controller_image_tag` | `nullplatform/base` | +| `controlplane-agent` | `0.9.2` | `control_plane_agent_image_tag` | `nullplatform/base` | +| `k8s-traffic-manager` | `1.8.0` | `agent_traffic_manager_tag` | `nullplatform/agent` | +| traffic manager (provider config) | `1.8.0` | `traffic_manager_version` | `container_orchestration/eks` | +| `scopes` repository | `v1.15.1` | `agent_repos_scope` | `nullplatform/agent` | + +**Read your cluster before copying these.** The rule is to pin what you are already running, +so the change stays functionally inert. Four of these were previously unpinnable and resolved +at deploy time, so what you run may not match the table: `cert_manager_version`, +`prometheus_version`, `logging_controller_image_tag`, and `traffic_manager_version` on eks. + +## Ready to paste + +```hcl +module "base" { + nullplatform_base_helm_version = "2.44.0" + logging_controller_image_tag = "1.6.0" + control_plane_agent_image_tag = "0.9.2" +} + +module "agent" { + nullplatform_agent_helm_version = "2.37.0" + image_tag = "0.9.2" + agent_repos_scope_tag = "v1.15.1" + agent_traffic_manager_tag = "1.8.0" + + agent_repos_extra = [ + "https://github.com/nullplatform/scopes-lambda.git#v0.3.1", + "https://github.com/nullplatform/scopes-static-files.git#v0.4.0", + ] +} + +# eks, aks and gke all take this +module "container_orchestration" { + traffic_manager_version = "1.8.0" +} + +module "cert_manager" { + cert_manager_version = "v1.21.1" +} + +module "prometheus" { + prometheus_version = "29.27.0" +} + +module "service_definition" { + # No value listed: repository_org and repository_name are configurable, so which spec + # repository you read is your choice and so is its ref. + repository_branch = "..." +} +``` + +To find what an install is actually running before changing anything: + +```bash +helm -n nullplatform-tools get values nullplatform-base +helm -n list -o json | jq -r '.[] | "\(.name)\t\(.chart)"' +kubectl -n nullplatform-tools get deploy \ + -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.spec.template.spec.containers[*].image}{"\n"}{end}' +``` + +The traffic manager image is assembled from `agent_traffic_manager_tag` and published to the +agent as `TRAFFIC_CONTAINER_IMAGE`. `extra_envs` still takes precedence over it, so a digest +or a mirrored registry path can be passed the way it was before the tag was exposed. + +## Caveats + +**The scopes ref steps back.** `agent_repos_scope` used to point at `scopes.git#main`, and +`main` has moved past `v1.15.1`. Pinning the tag is deliberate — it is the ref named in the +migration request — but it is not the same tree the branch tip pointed at. + +**cert-manager and prometheus were not pinnable at all.** `cert_manager_version` existed but +was never wired to its `helm_release`, and `prometheus` had no version argument, so both +tracked whatever their chart repository served. + +**Not everything is covered yet.** The scopes and service-spec repositories are read through +eleven other paths, in `scope_definition`, `scope_definition_agent_association`, +`parameter_storage_definition` and `service_definition`, and those still default to a moving +branch. Pinning `agent_repos_scope` does not cover them: the agent clones the ref while the +definition modules read the branch. They are listed in +`scripts/version-pinning-baseline.txt` with the reason. + +**A name cannot prove immutability.** The checks below reject `latest`, `main`, `master` and +`HEAD`. A tag called `beta` or a branch called `develop` passes. Nothing distinguishes a +mutable ref from a fixed one by name alone. + +## Keeping this current + +There is no automation that bumps these numbers, on purpose. Bumping a documented version to +whatever is newest would put the drift back in documentation form, and it contradicts the rule +above about pinning what you already run. When a new version ships, someone decides and edits +this table. + +What is automated is the opposite direction: `scripts/check-version-pinning.sh` rejects a *new* +moving default, a repository URL pinned to a branch, or a `helm_release` with no `version`. It +runs in pre-commit and again as a step in the `terraform-lint` workflow, so skipping the local +hook does not skip the check. Deliberately deferred violations live in +`scripts/version-pinning-baseline.txt` with the reason; that file should only ever shrink. + +One trap worth knowing before bumping an image by hand: **`k8s-traffic-manager` publishes a +`v2.0.2` built 2026-02-09 while `1.8.0` was built 2026-07-29**, and `k8s-logs-controller` a +`v2.0.1` from that same February against a `1.6.0` from August. The higher version number is +the older build, from a line that was not continued. Compare build dates, not version numbers: + +```bash +tag=1.8.0; repo=nullplatform/k8s-traffic-manager +t=$(curl -s "https://public.ecr.aws/token/?scope=repository:$repo:pull" | jq -r .token) +curl -s -H "Authorization: Bearer $t" "https://public.ecr.aws/v2/$repo/tags/list" | jq -r '.tags[]' +``` + diff --git a/scripts/check-version-pinning.sh b/scripts/check-version-pinning.sh new file mode 100755 index 000000000..4c77edce9 --- /dev/null +++ b/scripts/check-version-pinning.sh @@ -0,0 +1,81 @@ +#!/usr/bin/env bash +set -euo pipefail + +# Rejects a new moving version reference. See VERSIONS.md. +# +# Usage: check-version-pinning.sh ... + +BASELINE="$(dirname "$0")/version-pinning-baseline.txt" +FAILED=0 + +baselined() { + [ -f "$BASELINE" ] || return 1 + grep -qxF "$1" <(grep -v '^[[:space:]]*#' "$BASELINE" | grep -v '^[[:space:]]*$') 2>/dev/null +} + +for file in "$@"; do + [ -f "$file" ] || continue + case "$file" in + */.terraform/*|*/.terragrunt-cache/*) continue ;; + *.tf) ;; + *) continue ;; + esac + + while IFS='|' read -r key message; do + [ -n "$key" ] || continue + if baselined "$key"; then + continue + fi + printf ' %s\n %s\n' "$key" "$message" >&2 + FAILED=1 + done < <( + awk -v F="$file" ' + function emit(key, msg) { print F ":" key "|" msg } + + /^variable[[:space:]]+"/ { + match($0, /"[^"]+"/) + vname = substr($0, RSTART + 1, RLENGTH - 2) + invar = 1; next + } + invar && /^}/ { invar = 0; vname = ""; next } + + invar && $0 ~ /^[[:space:]]*default[[:space:]]*=[[:space:]]*"(latest|main|master|HEAD)"[[:space:]]*$/ { + emit(vname, "defaults to a moving reference. Pin it, or drop the default so the caller has to pin it.") + next + } + invar && $0 ~ /^[[:space:]]*default[[:space:]]*=[[:space:]]*".*#(latest|main|master|HEAD)"[[:space:]]*$/ { + emit(vname, "default pins a git ref to a moving branch. Expose the ref as its own variable without a default.") + next + } + invar && $0 ~ /^[[:space:]]*default[[:space:]]*=[[:space:]]*".*\/refs\/heads"?[[:space:]]*$/ { + emit(vname, "default hardcodes refs/heads, so a caller cannot pin to a tag without also rewriting the URL. Expose the ref namespace as a variable.") + next + } + + /^resource[[:space:]]+"helm_release"[[:space:]]+"/ { + n = $0 + sub(/^resource[[:space:]]+"helm_release"[[:space:]]+"/, "", n) + sub(/".*$/, "", n) + rname = n; inres = 1; hasver = 0; next + } + inres && $0 ~ /^[[:space:]]+version[[:space:]]*=/ { hasver = 1; next } + inres && /^}/ { + if (!hasver) { + emit("helm_release." rname, "has no version argument, so Helm resolves whatever the chart repository serves at apply time with no diff to review. Add version = var..") + } + inres = 0; next + } + ' "$file" + ) +done + +if [ "$FAILED" -ne 0 ]; then + { + echo "" + echo "Version pinning check failed." + echo "Fix the finding, or -- if the fix is deliberately deferred -- add the key to" + echo "scripts/version-pinning-baseline.txt with a comment saying why and where it is tracked." + } >&2 +fi + +exit $FAILED diff --git a/scripts/version-pinning-baseline.txt b/scripts/version-pinning-baseline.txt new file mode 100644 index 000000000..92cb25f64 --- /dev/null +++ b/scripts/version-pinning-baseline.txt @@ -0,0 +1,26 @@ +# Deliberately deferred version-pinning violations. Each group says why. +# This file should only ever shrink. +# +# Format: : + +# The scopes and service-spec repositories, read through ten paths across three +# modules, all defaulting to a moving branch. Fixable without a breaking change; +# deferred for its own review. +nullplatform/parameter_storage_definition/variables.tf:repository_parameter_storage_spec +nullplatform/parameter_storage_definition/variables.tf:repository_parameter_storage_spec_branch +nullplatform/scope_definition/variables.tf:repository_action_templates +nullplatform/scope_definition/variables.tf:repository_action_templates_branch +nullplatform/scope_definition/variables.tf:repository_scope_template +nullplatform/scope_definition/variables.tf:repository_scope_template_branch +nullplatform/scope_definition/variables.tf:repository_service_spec +nullplatform/scope_definition/variables.tf:repository_service_spec_branch +nullplatform/scope_definition_agent_association/variables.tf:repository_notification_channel +nullplatform/scope_definition_agent_association/variables.tf:repository_notification_channel_branch + +# Fixed by the "require an explicit version" PR, whose base does not contain this +# file. Remove these when it merges. +infrastructure/commons/cert_manager/main.tf:helm_release.cert_manager +infrastructure/commons/prometheus/main.tf:helm_release.prometheus +nullplatform/agent/variables.tf:agent_repos_scope +nullplatform/container_orchestration/eks/variables.tf:traffic_manager_version +nullplatform/service_definition/variables.tf:repository_branch From 1489874f69c2504a5d718884d69e19ee17413ed3 Mon Sep 17 00:00:00 2001 From: Gonzalo Rojas Date: Fri, 28 Aug 2026 10:53:20 -0300 Subject: [PATCH 41/81] feat: require an explicit version for everything the modules deploy (#540) Every version these modules deploy loses its default and becomes a required input. A default is a version somebody else chose, and it is why a moving reference survived this long unnoticed: nobody had to look at it. Thirteen inputs now have no default: base nullplatform_base_helm_version, logging_controller_image_tag, control_plane_agent_image_tag agent nullplatform_agent_helm_version, agent_traffic_manager_tag, agent_repos_scope_tag, image_tag eks traffic_manager_version (was "latest") aks traffic_manager_version (was "") gke traffic_manager_version (was "") commons cert_manager_version, prometheus_version service_definition repository_branch (was "main") Each rejects an empty value and the well-known moving names. That guard cannot tell a mutable ref from a fixed one by name alone -- a tag called beta or a branch called develop still passes -- so it catches mistakes, not intent. cert_manager_version was declared and never referenced: grep found one occurrence, its own declaration, and the helm_release had no version argument at all. prometheus had neither. Both tracked whatever their chart repository served while the README showed a number. The traffic manager image splits into agent_traffic_manager_repository, which keeps a default, and the required tag -- the same shape nullplatform/base already uses for its own images, so the two are no longer inconsistent within one change. agent_repos_scope is now the repository alone plus a required tag, and it rejects an inline # so pasting the old value fails during plan instead of at clone time inside the pod. agent_repos_extra requires a pinned ref on every entry, which covers scopes-* and services-* without enumerating them. repository_ref_type moves to "tags" as a consequence rather than a decision: with a pinned ref required, "heads" would build refs/heads/v1.4.0, which does not exist. The agent module had no tests, so its rendered values were never asserted on. It has them now, reading helm_release.agent.values[0] directly: an output for the rendered values adds nothing the resource attribute does not already give, and would put a test-only value in the module's public interface. Each variable carries an "# example:" comment with the current value, so the generated README shows something that can be pasted instead of a placeholder. Migration required for every consumer. Thirteen inputs have no default and must be set; see VERSIONS.md for the current value of each. The rule is to pin what you are already running -- but four of these were previously unpinnable, so read your cluster rather than copying the table: cert_manager_version, prometheus_version, logging_controller_image_tag and traffic_manager_version on eks all resolved to whatever their source served at deploy time. Note on the commit type: this removes required-input defaults, so it is a breaking change by any normal reading. It is typed feat: rather than feat!: because the repository temporarily blocks breaking-change markers, which means release-please will cut a minor for it. Whoever writes the release notes has to add the warning by hand -- the changelog will not carry it. --- .github/workflows/tofu-test.yml | 4 +- infrastructure/commons/cert_manager/main.tf | 1 + .../tests/cert_manager_aws.tftest.hcl | 29 +++-- .../tests/cert_manager_azure.tftest.hcl | 1 + .../tests/cert_manager_cloudflare.tftest.hcl | 11 +- .../cert_manager_cross_provider.tftest.hcl | 4 + .../tests/cert_manager_oci.tftest.hcl | 1 + .../commons/cert_manager/variables.tf | 9 +- .../commons/prometheus/.terraform.lock.hcl | 25 +++++ infrastructure/commons/prometheus/main.tf | 1 + .../prometheus/tests/prometheus.tftest.hcl | 34 ++++++ .../commons/prometheus/variables.tf | 11 ++ nullplatform/agent/locals.tf | 9 +- nullplatform/agent/tests/agent.tftest.hcl | 13 ++- .../agent/tests/agent_values.tftest.hcl | 102 ++++++++++++++++++ nullplatform/agent/variables.tf | 69 ++++++++++-- nullplatform/api_key/tests/api_key.tftest.hcl | 4 +- .../base/tests/base_values.tftest.hcl | 13 ++- nullplatform/base/variables.tf | 27 +++-- .../container_orchestration/aks/main.tf | 2 +- .../aks/tests/aks.tftest.hcl | 17 ++- .../container_orchestration/aks/variables.tf | 9 +- .../eks/tests/eks.tftest.hcl | 32 +++++- .../container_orchestration/eks/variables.tf | 9 +- .../container_orchestration/gke/main.tf | 2 +- .../gke/tests/gke.tftest.hcl | 17 ++- .../container_orchestration/gke/variables.tf | 9 +- nullplatform/service_definition/variables.tf | 16 ++- 28 files changed, 405 insertions(+), 76 deletions(-) create mode 100644 infrastructure/commons/prometheus/.terraform.lock.hcl create mode 100644 infrastructure/commons/prometheus/tests/prometheus.tftest.hcl create mode 100644 nullplatform/agent/tests/agent_values.tftest.hcl diff --git a/.github/workflows/tofu-test.yml b/.github/workflows/tofu-test.yml index 3d83139e9..63afe3b5f 100644 --- a/.github/workflows/tofu-test.yml +++ b/.github/workflows/tofu-test.yml @@ -14,7 +14,7 @@ jobs: test-commons-modules: uses: nullplatform/actions-nullplatform/.github/workflows/tofu-test.yml@main with: - modules: '["infrastructure/commons/cert_manager", "infrastructure/commons/external_dns", "infrastructure/commons/istio"]' + modules: '["infrastructure/commons/cert_manager", "infrastructure/commons/external_dns", "infrastructure/commons/istio", "infrastructure/commons/prometheus"]' test-aws-modules: uses: nullplatform/actions-nullplatform/.github/workflows/tofu-test.yml@main @@ -30,7 +30,7 @@ jobs: test-nullplatform-modules: uses: nullplatform/actions-nullplatform/.github/workflows/tofu-test.yml@main with: - modules: '["nullplatform/account", "nullplatform/agent", "nullplatform/api_key", "nullplatform/dimension", "nullplatform/dimension_value", "nullplatform/users", "nullplatform/metrics", "nullplatform/asset/docker_server", "nullplatform/cloud/azure/cloud", "nullplatform/cloud/gcp/cloud", "nullplatform/cloud/aws/cloud", "nullplatform/code_repository"]' + modules: '["nullplatform/account", "nullplatform/agent", "nullplatform/api_key", "nullplatform/dimension", "nullplatform/dimension_value", "nullplatform/users", "nullplatform/metrics", "nullplatform/asset/docker_server", "nullplatform/cloud/azure/cloud", "nullplatform/cloud/gcp/cloud", "nullplatform/cloud/aws/cloud", "nullplatform/code_repository", "nullplatform/base", "nullplatform/agent"]' test-container-orchestration-modules: uses: nullplatform/actions-nullplatform/.github/workflows/tofu-test.yml@main diff --git a/infrastructure/commons/cert_manager/main.tf b/infrastructure/commons/cert_manager/main.tf index 284dbc7e9..5ec6eda99 100644 --- a/infrastructure/commons/cert_manager/main.tf +++ b/infrastructure/commons/cert_manager/main.tf @@ -3,6 +3,7 @@ resource "helm_release" "cert_manager" { repository = "https://charts.jetstack.io" chart = "cert-manager" namespace = var.cert_manager_namespace + version = var.cert_manager_version create_namespace = true disable_webhooks = false diff --git a/infrastructure/commons/cert_manager/tests/cert_manager_aws.tftest.hcl b/infrastructure/commons/cert_manager/tests/cert_manager_aws.tftest.hcl index d7b52522f..e085bb663 100644 --- a/infrastructure/commons/cert_manager/tests/cert_manager_aws.tftest.hcl +++ b/infrastructure/commons/cert_manager/tests/cert_manager_aws.tftest.hcl @@ -1,12 +1,13 @@ mock_provider "helm" {} variables { - cloud_provider = "aws" - hosted_zone_name = "myorg.example.com" - account_slug = "myorg" - private_domain_name = "myorg.example.com" - aws_sa_arn = "arn:aws:iam::123456789012:role/cert-manager" - aws_region = "us-east-1" + cloud_provider = "aws" + hosted_zone_name = "myorg.example.com" + account_slug = "myorg" + private_domain_name = "myorg.example.com" + aws_sa_arn = "arn:aws:iam::123456789012:role/cert-manager" + aws_region = "us-east-1" + cert_manager_version = "v1.21.1" } # Validates AWS provider config plans successfully @@ -100,3 +101,19 @@ run "rejects_invalid_aws_identity_mode" { expect_failures = [var.aws_identity_mode] } + +################################################################################ +# Version pinning +################################################################################ + +# cert_manager_version was declared with a default and never referenced: grep found one +# occurrence, its own declaration. The helm_release had no version argument, so installs +# tracked whatever charts.jetstack.io served while the README showed a number. +run "cert_manager_version_reaches_the_release" { + command = plan + + assert { + condition = helm_release.cert_manager.version == "v1.21.1" + error_message = "cert_manager_version must be wired to the helm_release, not merely declared" + } +} diff --git a/infrastructure/commons/cert_manager/tests/cert_manager_azure.tftest.hcl b/infrastructure/commons/cert_manager/tests/cert_manager_azure.tftest.hcl index 479a3c76f..f9a069769 100644 --- a/infrastructure/commons/cert_manager/tests/cert_manager_azure.tftest.hcl +++ b/infrastructure/commons/cert_manager/tests/cert_manager_azure.tftest.hcl @@ -11,6 +11,7 @@ variables { azure_resource_group_name = "rg-test" azure_tenant_id = "11111111-2222-3333-4444-555555555555" azure_hosted_zone_name = "myorg.nullimplementation.com" + cert_manager_version = "v1.21.1" } # Validates Azure provider config plans successfully diff --git a/infrastructure/commons/cert_manager/tests/cert_manager_cloudflare.tftest.hcl b/infrastructure/commons/cert_manager/tests/cert_manager_cloudflare.tftest.hcl index 47e95bb29..8932865c9 100644 --- a/infrastructure/commons/cert_manager/tests/cert_manager_cloudflare.tftest.hcl +++ b/infrastructure/commons/cert_manager/tests/cert_manager_cloudflare.tftest.hcl @@ -1,11 +1,12 @@ mock_provider "helm" {} variables { - cloud_provider = "cloudflare" - hosted_zone_name = "myorg.nullimplementation.com" - account_slug = "myorg" - private_domain_name = "myorg.nullimplementation.com" - cloudflare_token = "fake-cloudflare-token-for-testing" + cloud_provider = "cloudflare" + hosted_zone_name = "myorg.nullimplementation.com" + account_slug = "myorg" + private_domain_name = "myorg.nullimplementation.com" + cloudflare_token = "fake-cloudflare-token-for-testing" + cert_manager_version = "v1.21.1" } # Validates Cloudflare provider config plans successfully diff --git a/infrastructure/commons/cert_manager/tests/cert_manager_cross_provider.tftest.hcl b/infrastructure/commons/cert_manager/tests/cert_manager_cross_provider.tftest.hcl index 89b0334df..8c3d9cf43 100644 --- a/infrastructure/commons/cert_manager/tests/cert_manager_cross_provider.tftest.hcl +++ b/infrastructure/commons/cert_manager/tests/cert_manager_cross_provider.tftest.hcl @@ -1,5 +1,9 @@ mock_provider "helm" {} +variables { + cert_manager_version = "v1.21.1" +} + # Validates invalid cloud_provider is rejected run "rejects_invalid_provider" { command = plan diff --git a/infrastructure/commons/cert_manager/tests/cert_manager_oci.tftest.hcl b/infrastructure/commons/cert_manager/tests/cert_manager_oci.tftest.hcl index 306360989..3a87c59b3 100644 --- a/infrastructure/commons/cert_manager/tests/cert_manager_oci.tftest.hcl +++ b/infrastructure/commons/cert_manager/tests/cert_manager_oci.tftest.hcl @@ -8,6 +8,7 @@ variables { oci_compartment_ocid = "ocid1.compartment.oc1..aaaaaaaatest" oci_sa_ocid = "ocid1.principal.oc1..aaaaaaaatest" oci_region = "us-ashburn-1" + cert_manager_version = "v1.21.1" } # Validates OCI provider config plans successfully diff --git a/infrastructure/commons/cert_manager/variables.tf b/infrastructure/commons/cert_manager/variables.tf index 0ed891cab..85a75d454 100644 --- a/infrastructure/commons/cert_manager/variables.tf +++ b/infrastructure/commons/cert_manager/variables.tf @@ -62,9 +62,14 @@ variable "private_domain_name" { ############################################################################### variable "cert_manager_version" { - description = "The version of cert-manager Helm chart to deploy" + # example: v1.21.1 + description = "No default: every install pins this deliberately — see VERSIONS.md. The version of cert-manager Helm chart to deploy. Was declared but never wired to the helm_release, so installs tracked whatever the chart repository served; the default is the version that resolved to as of 2026-08-27, which keeps behaviour unchanged while removing the drift." type = string - default = "1.18.2" + + validation { + condition = var.cert_manager_version != "" && !contains(["latest", "main", "master"], lower(var.cert_manager_version)) + error_message = "cert_manager_version must be a non-empty fixed version, not empty and not a moving reference." + } } variable "cert_manager_namespace" { diff --git a/infrastructure/commons/prometheus/.terraform.lock.hcl b/infrastructure/commons/prometheus/.terraform.lock.hcl new file mode 100644 index 000000000..89971bbf5 --- /dev/null +++ b/infrastructure/commons/prometheus/.terraform.lock.hcl @@ -0,0 +1,25 @@ +# This file is maintained automatically by "tofu init". +# Manual edits may be lost in future updates. + +provider "registry.opentofu.org/hashicorp/helm" { + version = "3.2.0" + constraints = "~> 3.0" + hashes = [ + "h1:thNSoWm4pdgTEO1XBi1n5V2nwsdSA6EVEXP3qPZiFcA=", + "zh:1a214581dee54ec4e9afa4050e54f6c187aed4b51b2d2ac929c58706b65e1159", + "zh:2f8ba94af93011768ed1fffd4d25b980cd764f2d49c9f13475512ec48464da0b", + "zh:36373bca4f374e95f654def79e0b12df0c8f2e01c634db80ff2737ded29062e3", + "zh:3a26b5c3e47b2bbc01faa0fa9fe816ea4f74f1f8f4555dfad7f62ee38266aaff", + "zh:51bc637700f13cfc1f7c6a8c03a4b5b5755338419912d945dbfe5ccb0ddbf614", + "zh:53f32f91afcb682209de124d8a994e591687023ae7c0dfed6184c5511778b16b", + "zh:6f4434327ed466b2b5be0d5f4aa537bca71ebd7f7fe05468065aeda52dfc8896", + "zh:7394e8c6f5027fa21699e46c9a45bee1ce87fd8dd98f2e89e8d414ec70c8e4e1", + "zh:d90b855a0990e3aa6445afe66de730c2f4651f39699c6b6345ca02f9af2a1a08", + "zh:d9b7246e6af0f75155ed532855014f888e9e5613242c89e321b4e0f9b54f5726", + "zh:dabd399ca36172c15d176a24cf199ac886ef191f7131e806d76a8dc209e5beb8", + "zh:e57987397be46dc123365f16c3bec4dd0615453c8bfdcfc1b7c9f3202a09c516", + "zh:ec88430b833b943b38d02f70b33250c72bb6ffa3b3d22360990a41390161a2b2", + "zh:f8ea01b57982e9ed9ad3a750b1caba261a478f5b0ddcac78a4502d886fd2fc74", + "zh:fb63819037158205ebf42b649c3a8ec308234ffe987a5dbd4444e1e0683f1170", + ] +} diff --git a/infrastructure/commons/prometheus/main.tf b/infrastructure/commons/prometheus/main.tf index e5f5e247e..d6abb7440 100644 --- a/infrastructure/commons/prometheus/main.tf +++ b/infrastructure/commons/prometheus/main.tf @@ -3,6 +3,7 @@ resource "helm_release" "prometheus" { repository = "https://prometheus-community.github.io/helm-charts" chart = "prometheus" namespace = var.prometheus_namespace + version = var.prometheus_version create_namespace = true disable_webhooks = false diff --git a/infrastructure/commons/prometheus/tests/prometheus.tftest.hcl b/infrastructure/commons/prometheus/tests/prometheus.tftest.hcl new file mode 100644 index 000000000..d2594f358 --- /dev/null +++ b/infrastructure/commons/prometheus/tests/prometheus.tftest.hcl @@ -0,0 +1,34 @@ +mock_provider "helm" {} + +variables { + prometheus_version = "29.27.0" +} + +################################################################################ +# Version pinning +################################################################################ + +# The helm_release carried no version argument and the module exposed no variable for one, +# so every apply resolved to whatever prometheus-community served latest, with no diff to +# review and no way to pin without editing the module. +run "prometheus_version_reaches_the_release" { + command = plan + + assert { + condition = helm_release.prometheus.version == "29.27.0" + error_message = "prometheus_version must be wired to the helm_release so the deployed chart is a decision" + } +} + +run "prometheus_version_is_overridable" { + command = plan + + variables { + prometheus_version = "29.26.0" + } + + assert { + condition = helm_release.prometheus.version == "29.26.0" + error_message = "prometheus_version must be settable by the caller" + } +} diff --git a/infrastructure/commons/prometheus/variables.tf b/infrastructure/commons/prometheus/variables.tf index 502083c4c..4db279135 100644 --- a/infrastructure/commons/prometheus/variables.tf +++ b/infrastructure/commons/prometheus/variables.tf @@ -1,3 +1,14 @@ +variable "prometheus_version" { + # example: 29.27.0 + description = "No default: every install pins this deliberately — see VERSIONS.md. Helm chart version for the prometheus-community/prometheus chart. The helm_release carried no version at all, so every apply resolved to whatever the repository served latest; the default is the version that resolved to as of 2026-08-27, which keeps behaviour unchanged while removing the drift." + type = string + + validation { + condition = var.prometheus_version != "" && !contains(["latest", "main", "master"], lower(var.prometheus_version)) + error_message = "prometheus_version must be a non-empty fixed version, not empty and not a moving reference." + } +} + variable "nullplatform_port" { description = "Port number for nullplatform service communication" type = number diff --git a/nullplatform/agent/locals.tf b/nullplatform/agent/locals.tf index 1a039b8ba..9c6cd6a1c 100644 --- a/nullplatform/agent/locals.tf +++ b/nullplatform/agent/locals.tf @@ -4,7 +4,13 @@ locals { - scope_list = compact([trimspace(coalesce(var.agent_repos_scope, ""))]) + # The repository lives here and only the tag is exposed, so a version bump is a variable + + # change instead of a hand-assembled URL. + + scope_repo = trimspace(coalesce(var.agent_repos_scope, "")) + + scope_list = compact([local.scope_repo != "" ? "${local.scope_repo}#${trimspace(var.agent_repos_scope_tag)}" : ""]) # Parse comma-separated extra repositories and clean whitespace repos_extra = compact([for s in var.agent_repos_extra : trimspace(s)]) @@ -42,6 +48,7 @@ locals { CLUSTER_NAME = var.cluster_name NAMESPACE = var.namespace IMAGE_TAG = var.image_tag + TRAFFIC_CONTAINER_IMAGE = "${var.agent_traffic_manager_repository}:${var.agent_traffic_manager_tag}" DOMAIN = var.domain DNS_TYPE = var.dns_type USE_ACCOUNT_SLUG = var.use_account_slug diff --git a/nullplatform/agent/tests/agent.tftest.hcl b/nullplatform/agent/tests/agent.tftest.hcl index 8174cef1c..9bd044919 100644 --- a/nullplatform/agent/tests/agent.tftest.hcl +++ b/nullplatform/agent/tests/agent.tftest.hcl @@ -2,11 +2,14 @@ mock_provider "nullplatform" {} mock_provider "helm" {} variables { - api_key = "test-api-key" - cluster_name = "test-cluster" - tags_selectors = { environment = "test" } - image_tag = "latest" - cloud_provider = "gcp" + api_key = "test-api-key" + cluster_name = "test-cluster" + tags_selectors = { environment = "test" } + image_tag = "latest" + cloud_provider = "gcp" + nullplatform_agent_helm_version = "2.37.0" + agent_traffic_manager_tag = "1.8.0" + agent_repos_scope_tag = "v1.15.1" } run "no_extra_envs_does_not_require_ingress_templates" { diff --git a/nullplatform/agent/tests/agent_values.tftest.hcl b/nullplatform/agent/tests/agent_values.tftest.hcl new file mode 100644 index 000000000..cbb42c65b --- /dev/null +++ b/nullplatform/agent/tests/agent_values.tftest.hcl @@ -0,0 +1,102 @@ +mock_provider "helm" {} +mock_provider "nullplatform" {} + +variables { + api_key = "test-api-key" + cluster_name = "my-cluster" + tags_selectors = { dimension = "prod" } + cloud_provider = "aws" + aws_iam_role_arn = "arn:aws:iam::123456789012:role/agent" + image_tag = "0.9.2" + nullplatform_agent_helm_version = "2.37.0" + agent_traffic_manager_tag = "1.8.0" + agent_repos_scope_tag = "v1.15.1" +} + +################################################################################ +# Traffic manager image +################################################################################ + +# Pinning the traffic manager used to mean passing the whole image string through +# extra_envs. The registry now lives in the module and only the tag is exposed. +run "traffic_manager_image_is_assembled_from_the_tag" { + command = plan + + assert { + condition = strcontains(helm_release.agent.values[0], "TRAFFIC_CONTAINER_IMAGE: \"public.ecr.aws/nullplatform/k8s-traffic-manager:1.8.0\"") + error_message = "TRAFFIC_CONTAINER_IMAGE should be built from the repository default and the pinned tag" + } +} + +run "traffic_manager_repository_is_overridable" { + command = plan + + variables { + agent_traffic_manager_repository = "my-mirror.example.com/nullplatform/k8s-traffic-manager" + } + + assert { + condition = strcontains(helm_release.agent.values[0], "TRAFFIC_CONTAINER_IMAGE: \"my-mirror.example.com/nullplatform/k8s-traffic-manager:1.8.0\"") + error_message = "the registry must be overridable for a mirrored path" + } +} + +run "extra_envs_still_overrides_the_traffic_manager_image" { + command = plan + + variables { + extra_envs = { + TRAFFIC_CONTAINER_IMAGE = "public.ecr.aws/nullplatform/k8s-traffic-manager@sha256:abc123" + } + } + + # extra_envs is merged last, so the previous way of doing this keeps working. That is what + # makes exposing the tag an addition rather than a breaking change. + assert { + condition = strcontains(helm_release.agent.values[0], "TRAFFIC_CONTAINER_IMAGE: \"public.ecr.aws/nullplatform/k8s-traffic-manager@sha256:abc123\"") + error_message = "extra_envs must keep precedence over the assembled image" + } +} + +################################################################################ +# Scope repository +################################################################################ + +run "scope_repo_is_pinned_to_a_tag" { + command = plan + + assert { + condition = !strcontains(helm_release.agent.values[0], "#main") + error_message = "the scope repo default must not point at a moving branch" + } + + assert { + condition = strcontains(helm_release.agent.values[0], "scopes.git#v1.15.1") + error_message = "the scope repo default should be pinned to the released tag" + } +} + +run "scope_repo_is_overridable" { + command = plan + + variables { + agent_repos_scope_tag = "v1.14.0" + } + + assert { + condition = strcontains(helm_release.agent.values[0], "scopes.git#v1.14.0") + error_message = "callers must still be able to choose their own ref" + } +} + +run "agent_repos_scope_rejects_an_inline_fragment" { + command = plan + + variables { + agent_repos_scope = "https://github.com/nullplatform/scopes.git#v1.15.1" + } + + # Catches the most likely migration mistake: pasting the old value verbatim, which would + # otherwise render repo.git#v1.15.1#v1.15.1. + expect_failures = [var.agent_repos_scope] +} diff --git a/nullplatform/agent/variables.tf b/nullplatform/agent/variables.tf index 105d1d2e2..bc2a9aa43 100644 --- a/nullplatform/agent/variables.tf +++ b/nullplatform/agent/variables.tf @@ -17,6 +17,7 @@ variable "cluster_name" { # Image tag for the agent container image variable "image_tag" { + # example: 0.9.2 description = "Image tag for the agent container image" type = string } @@ -57,11 +58,15 @@ variable "service_account_name" { # Version of the nullplatform agent Helm chart to deploy variable "nullplatform_agent_helm_version" { - description = "Version of the nullplatform agent Helm chart to deploy" + # example: 2.37.0 + description = "No default: every install pins this deliberately — see VERSIONS.md. Version of the nullplatform agent Helm chart to deploy" type = string # 2.37.0+ ships the worker orchestrator (patches, per-install isolation, idle - # reaper, insecure default). - default = "2.37.0" + + validation { + condition = var.nullplatform_agent_helm_version != "" && !contains(["latest", "main", "master"], lower(var.nullplatform_agent_helm_version)) + error_message = "nullplatform_agent_helm_version must be a non-empty fixed version, not empty and not a moving reference." + } } variable "worker" { @@ -93,16 +98,68 @@ variable "namespace" { # Git repository URL containing agent scope configurations (format: repo#branch) variable "agent_repos_scope" { - description = "Git repository URL containing agent scope configurations (format: repo#branch)" + description = "Git repository URL containing agent scope configurations, WITHOUT the ref fragment. The ref goes in agent_repos_scope_tag." + type = string + default = "https://github.com/nullplatform/scopes.git" + + # Without this, migrating by pasting the old value (repo.git#v1.15.1) produces + # repo.git#v1.15.1#, which fails inside the pod at clone time instead of during plan. + validation { + condition = length(regexall("#", var.agent_repos_scope)) == 0 + error_message = "agent_repos_scope must not contain a '#' fragment — set the ref in agent_repos_scope_tag instead." + } +} + +variable "agent_repos_scope_tag" { + # example: v1.15.1 + description = "Git tag of the scopes repository to clone. No default: every install pins this deliberately so the agent cannot pick up scope changes it was never rolled out with — see VERSIONS.md." type = string - default = "https://github.com/nullplatform/scopes.git#main" + + validation { + condition = var.agent_repos_scope_tag != "" && !contains(["main", "master", "head", "latest"], lower(var.agent_repos_scope_tag)) + error_message = "agent_repos_scope_tag must be a non-empty fixed tag, not empty and not a moving branch." + } } # List of additional Git repositories used for extended agent configuration +variable "agent_traffic_manager_repository" { + description = "Container image repository for the traffic manager. Defaults to the official nullplatform image; override to pull from a mirror. Matches the pattern nullplatform/base uses for its own images." + type = string + default = "public.ecr.aws/nullplatform/k8s-traffic-manager" +} + +variable "agent_traffic_manager_tag" { + # example: 1.8.0 + description = "No default: every install pins this deliberately — see VERSIONS.md. Image tag for the traffic manager, published to the agent as TRAFFIC_CONTAINER_IMAGE. Pinning this used to mean passing the whole image string through extra_envs; the registry lives here so only the tag is exposed. extra_envs still takes precedence for anyone who needs a digest or a mirrored path." + type = string + + validation { + condition = var.agent_traffic_manager_tag != "" && !contains(["latest", "main", "master"], lower(var.agent_traffic_manager_tag)) + error_message = "agent_traffic_manager_tag must be a non-empty fixed version, not empty and not a moving reference." + } +} + variable "agent_repos_extra" { - description = "List of additional Git repositories used for extended agent configuration" + description = "List of additional Git repositories used for extended agent configuration. Each entry MUST carry a pinned ref fragment (repo.git#v1.2.3); moving refs are rejected. Covers scopes-* and services-* without enumerating them." type = list(string) default = [] + + # Two validations rather than one so the error names which rule was broken. + validation { + condition = alltrue([ + for r in var.agent_repos_extra : + can(regex("#[^#]+$", trimspace(r))) + ]) + error_message = "every agent_repos_extra entry must pin a ref with a '#' fragment, e.g. https://github.com/nullplatform/scopes-lambda.git#v0.3.1" + } + + validation { + condition = alltrue([ + for r in var.agent_repos_extra : + !can(regex("(?i)#(main|master|head|latest)$", trimspace(r))) + ]) + error_message = "agent_repos_extra entries must pin a fixed tag, not a moving ref (main/master/HEAD/latest)." + } } # List of initialization scripts to execute during agent startup diff --git a/nullplatform/api_key/tests/api_key.tftest.hcl b/nullplatform/api_key/tests/api_key.tftest.hcl index f422ab176..64916e104 100644 --- a/nullplatform/api_key/tests/api_key.tftest.hcl +++ b/nullplatform/api_key/tests/api_key.tftest.hcl @@ -100,8 +100,8 @@ run "tags_merge_custom_tags" { command = plan variables { - type = "custom" - custom_name = "MY-KEY" + type = "custom" + custom_name = "MY-KEY" custom_role_slugs = ["developer"] custom_tags = [ { key = "team", value = "platform" }, diff --git a/nullplatform/base/tests/base_values.tftest.hcl b/nullplatform/base/tests/base_values.tftest.hcl index 73419fd11..079de99dd 100644 --- a/nullplatform/base/tests/base_values.tftest.hcl +++ b/nullplatform/base/tests/base_values.tftest.hcl @@ -2,8 +2,11 @@ mock_provider "helm" {} mock_provider "kubernetes" {} variables { - np_api_key = "test-api-key" - k8s_provider = "eks" + np_api_key = "test-api-key" + k8s_provider = "eks" + nullplatform_base_helm_version = "2.44.0" + logging_controller_image_tag = "1.6.0" + control_plane_agent_image_tag = "0.9.2" } ############################################ @@ -144,10 +147,10 @@ run "dynatrace_logs_disabled" { command = plan variables { - dynatrace_enabled = true - dynatrace_api_key = "dt-test-key" + dynatrace_enabled = true + dynatrace_api_key = "dt-test-key" dynatrace_environment_id = "dt-env-123" - dynatrace_logs_enabled = false + dynatrace_logs_enabled = false } assert { diff --git a/nullplatform/base/variables.tf b/nullplatform/base/variables.tf index e964fb573..78d2ed833 100644 --- a/nullplatform/base/variables.tf +++ b/nullplatform/base/variables.tf @@ -1,7 +1,12 @@ variable "nullplatform_base_helm_version" { - description = "Helm chart version for the nullplatform base." + # example: 2.44.0 + description = "No default: every install pins this deliberately — see VERSIONS.md. Helm chart version for the nullplatform base." type = string - default = "2.44.0" + + validation { + condition = var.nullplatform_base_helm_version != "" && !contains(["latest", "main", "master"], lower(var.nullplatform_base_helm_version)) + error_message = "nullplatform_base_helm_version must be a non-empty fixed version, not empty and not a moving reference." + } } variable "namespace" { @@ -131,9 +136,14 @@ variable "control_plane_agent_image_repository" { } variable "control_plane_agent_image_tag" { + # example: 0.9.2 type = string - description = "Container image tag for the control plane agent." - default = "0.9.2" + description = "No default: every install pins this deliberately — see VERSIONS.md. Container image tag for the control plane agent." + + validation { + condition = var.control_plane_agent_image_tag != "" && !contains(["latest", "main", "master"], lower(var.control_plane_agent_image_tag)) + error_message = "control_plane_agent_image_tag must be a non-empty fixed version, not empty and not a moving reference." + } } ############################################ @@ -165,9 +175,14 @@ variable "logging_controller_image_repository" { } variable "logging_controller_image_tag" { + # example: 1.6.0 type = string - description = "Container image tag for the logs controller DaemonSet." - default = "1.6.0" + description = "No default: every install pins this deliberately — see VERSIONS.md. Container image tag for the logs controller DaemonSet." + + validation { + condition = var.logging_controller_image_tag != "" && !contains(["latest", "main", "master"], lower(var.logging_controller_image_tag)) + error_message = "logging_controller_image_tag must be a non-empty fixed version, not empty and not a moving reference." + } } ############################################ diff --git a/nullplatform/container_orchestration/aks/main.tf b/nullplatform/container_orchestration/aks/main.tf index fc12c7ac7..16c4d4240 100644 --- a/nullplatform/container_orchestration/aks/main.tf +++ b/nullplatform/container_orchestration/aks/main.tf @@ -35,7 +35,7 @@ locals { }, length(local.resource_management) > 0 ? { resource_management = local.resource_management } : {}, length(local.security) > 0 ? { security = local.security } : {}, - var.traffic_manager_version != "" ? { traffic_manager = { version = var.traffic_manager_version } } : {}, + { traffic_manager = { version = var.traffic_manager_version } }, length(var.object_modifiers) > 0 ? { object_modifiers = { modifiers = var.object_modifiers } } : {}, ) } diff --git a/nullplatform/container_orchestration/aks/tests/aks.tftest.hcl b/nullplatform/container_orchestration/aks/tests/aks.tftest.hcl index d8d4688ca..f27817908 100644 --- a/nullplatform/container_orchestration/aks/tests/aks.tftest.hcl +++ b/nullplatform/container_orchestration/aks/tests/aks.tftest.hcl @@ -1,10 +1,11 @@ mock_provider "nullplatform" {} variables { - nrn = "organization=myorg:account=myaccount" - cluster_name = "my-aks-cluster" - resource_group = "my-aks-resource-group" - public_gateway_name = "istio-ingress" + nrn = "organization=myorg:account=myaccount" + cluster_name = "my-aks-cluster" + resource_group = "my-aks-resource-group" + public_gateway_name = "istio-ingress" + traffic_manager_version = "1.8.0" } run "aks_provider_type" { @@ -77,10 +78,6 @@ run "optional_fields_excluded_when_empty" { error_message = "Attributes should not contain security when not set" } - assert { - condition = !strcontains(nullplatform_provider_config.aks_config.attributes, "traffic_manager") - error_message = "Attributes should not contain traffic_manager when not set" - } assert { condition = !strcontains(nullplatform_provider_config.aks_config.attributes, "object_modifiers") @@ -227,7 +224,7 @@ run "with_traffic_manager" { command = plan variables { - traffic_manager_version = "latest" + traffic_manager_version = "1.8.0" } assert { @@ -236,7 +233,7 @@ run "with_traffic_manager" { } assert { - condition = strcontains(nullplatform_provider_config.aks_config.attributes, "latest") + condition = strcontains(nullplatform_provider_config.aks_config.attributes, "1.8.0") error_message = "Attributes should contain traffic manager version" } } diff --git a/nullplatform/container_orchestration/aks/variables.tf b/nullplatform/container_orchestration/aks/variables.tf index 649910cc9..211e0d862 100644 --- a/nullplatform/container_orchestration/aks/variables.tf +++ b/nullplatform/container_orchestration/aks/variables.tf @@ -85,9 +85,14 @@ variable "service_account_name" { } variable "traffic_manager_version" { - description = "Tag for the traffic manager sidecar container" + # example: 1.8.0 + description = "No default: every install pins this deliberately — see VERSIONS.md. Tag for the traffic manager sidecar container" type = string - default = "" + + validation { + condition = var.traffic_manager_version != "" && !contains(["latest", "main", "master"], lower(var.traffic_manager_version)) + error_message = "traffic_manager_version must be a non-empty fixed version, not empty and not a moving reference." + } } variable "object_modifiers" { diff --git a/nullplatform/container_orchestration/eks/tests/eks.tftest.hcl b/nullplatform/container_orchestration/eks/tests/eks.tftest.hcl index fb53d0ae5..864610593 100644 --- a/nullplatform/container_orchestration/eks/tests/eks.tftest.hcl +++ b/nullplatform/container_orchestration/eks/tests/eks.tftest.hcl @@ -1,8 +1,9 @@ mock_provider "nullplatform" {} variables { - nrn = "organization=myorg:account=myaccount" - cluster_name = "my-eks-cluster" + nrn = "organization=myorg:account=myaccount" + cluster_name = "my-eks-cluster" + traffic_manager_version = "1.8.0" } run "eks_provider_type" { @@ -184,7 +185,7 @@ run "with_traffic_manager" { command = plan variables { - traffic_manager_version = "latest" + traffic_manager_version = "1.8.0" } assert { @@ -193,7 +194,7 @@ run "with_traffic_manager" { } assert { - condition = strcontains(nullplatform_provider_config.eks_config.attributes, "latest") + condition = strcontains(nullplatform_provider_config.eks_config.attributes, "1.8.0") error_message = "Attributes should contain traffic manager version" } @@ -216,7 +217,7 @@ run "with_traffic_manager_port" { } assert { - condition = strcontains(nullplatform_provider_config.eks_config.attributes, "\"version\":\"latest\"") + condition = strcontains(nullplatform_provider_config.eks_config.attributes, "\"version\":\"1.8.0\"") error_message = "Setting the port must not drop the traffic manager version" } } @@ -342,3 +343,24 @@ run "with_all_options" { error_message = "Dimensions should contain Environment=staging" } } + +################################################################################ +# Version pinning +################################################################################ + +# The default used to be "latest", so an apply with no code change could move the deployed +# version. There is no default now -- the caller has to name one -- and this is the guard +# that a moving reference cannot reach the provider config by any route. +run "no_moving_reference_reaches_the_provider_config" { + command = plan + + assert { + condition = !strcontains(nullplatform_provider_config.eks_config.attributes, "latest") + error_message = "no attribute may reference a moving tag" + } + + assert { + condition = strcontains(nullplatform_provider_config.eks_config.attributes, "\"version\":\"1.8.0\"") + error_message = "the version the caller supplied must reach the provider config" + } +} diff --git a/nullplatform/container_orchestration/eks/variables.tf b/nullplatform/container_orchestration/eks/variables.tf index 4ac57957b..a85f0b506 100644 --- a/nullplatform/container_orchestration/eks/variables.tf +++ b/nullplatform/container_orchestration/eks/variables.tf @@ -112,9 +112,14 @@ variable "service_account_name" { } variable "traffic_manager_version" { - description = "Tag for the traffic manager sidecar container" + # example: 1.8.0 + description = "No default: every install pins this deliberately — see VERSIONS.md. Pinned rather than tracking latest: a moving tag means a pod restart can pull a different build with no apply in between. Tag for the traffic manager sidecar container" type = string - default = "latest" + + validation { + condition = var.traffic_manager_version != "" && !contains(["latest", "main", "master"], lower(var.traffic_manager_version)) + error_message = "traffic_manager_version must be a non-empty fixed version, not empty and not a moving reference." + } } variable "traffic_manager_port" { diff --git a/nullplatform/container_orchestration/gke/main.tf b/nullplatform/container_orchestration/gke/main.tf index e7a5b1930..132de9f29 100644 --- a/nullplatform/container_orchestration/gke/main.tf +++ b/nullplatform/container_orchestration/gke/main.tf @@ -30,7 +30,7 @@ locals { }, length(local.resource_management) > 0 ? { resource_management = local.resource_management } : {}, length(local.security) > 0 ? { security = local.security } : {}, - var.traffic_manager_version != "" ? { traffic_manager = { version = var.traffic_manager_version } } : {}, + { traffic_manager = { version = var.traffic_manager_version } }, length(var.object_modifiers) > 0 ? { object_modifiers = { modifiers = var.object_modifiers } } : {}, ) } diff --git a/nullplatform/container_orchestration/gke/tests/gke.tftest.hcl b/nullplatform/container_orchestration/gke/tests/gke.tftest.hcl index f7b24a7d2..028080b9f 100644 --- a/nullplatform/container_orchestration/gke/tests/gke.tftest.hcl +++ b/nullplatform/container_orchestration/gke/tests/gke.tftest.hcl @@ -1,10 +1,11 @@ mock_provider "nullplatform" {} variables { - nrn = "organization=myorg:account=myaccount" - cluster_name = "my-gke-cluster" - location = "us-central1-a" - public_gateway_name = "public-gateway" + nrn = "organization=myorg:account=myaccount" + cluster_name = "my-gke-cluster" + location = "us-central1-a" + public_gateway_name = "public-gateway" + traffic_manager_version = "1.8.0" } run "gke_provider_type" { @@ -72,10 +73,6 @@ run "optional_fields_excluded_when_empty" { error_message = "Attributes should not contain security when not set" } - assert { - condition = !strcontains(nullplatform_provider_config.gke_config.attributes, "traffic_manager") - error_message = "Attributes should not contain traffic_manager when not set" - } assert { condition = !strcontains(nullplatform_provider_config.gke_config.attributes, "object_modifiers") @@ -150,7 +147,7 @@ run "with_traffic_manager" { command = plan variables { - traffic_manager_version = "latest" + traffic_manager_version = "1.8.0" } assert { @@ -159,7 +156,7 @@ run "with_traffic_manager" { } assert { - condition = strcontains(nullplatform_provider_config.gke_config.attributes, "latest") + condition = strcontains(nullplatform_provider_config.gke_config.attributes, "1.8.0") error_message = "Attributes should contain traffic manager version" } } diff --git a/nullplatform/container_orchestration/gke/variables.tf b/nullplatform/container_orchestration/gke/variables.tf index dbd0d72cd..4f51bfb28 100644 --- a/nullplatform/container_orchestration/gke/variables.tf +++ b/nullplatform/container_orchestration/gke/variables.tf @@ -79,9 +79,14 @@ variable "service_account_name" { } variable "traffic_manager_version" { - description = "Tag for the traffic manager sidecar container" + # example: 1.8.0 + description = "No default: every install pins this deliberately — see VERSIONS.md. Tag for the traffic manager sidecar container" type = string - default = "" + + validation { + condition = var.traffic_manager_version != "" && !contains(["latest", "main", "master"], lower(var.traffic_manager_version)) + error_message = "traffic_manager_version must be a non-empty fixed version, not empty and not a moving reference." + } } variable "object_modifiers" { diff --git a/nullplatform/service_definition/variables.tf b/nullplatform/service_definition/variables.tf index 4da756e6d..9b22a344a 100644 --- a/nullplatform/service_definition/variables.tf +++ b/nullplatform/service_definition/variables.tf @@ -33,8 +33,18 @@ variable "repository_name" { variable "repository_branch" { type = string - default = "main" - description = "Branch of the service spec repository to use. Must be a short branch name (e.g. \"main\"), not a full ref." + description = <<-EOT + Git ref of the service spec repository to read, as a short name and not a full ref + (e.g. "v1.4.0"). No default and no recommended value: which spec repository an install + points at is its own choice, so there is no version anyone could pick for it. + + Combine with repository_ref_type, which selects the namespace this name lives in. + EOT + + validation { + condition = var.repository_branch != "" && !contains(["main", "master", "head", "latest"], lower(var.repository_branch)) + error_message = "repository_branch must be a non-empty pinned ref, not empty and not a moving branch." + } } variable "service_path" { @@ -92,7 +102,7 @@ variable "dimensions" { variable "repository_ref_type" { type = string - default = "heads" + default = "tags" description = "Git ref namespace for `repository_branch` on GitHub: \"heads\" for a branch, \"tags\" for a tag, or \"\" to treat it as a raw commit SHA. Defaults to \"heads\", preserving previous behaviour." validation { condition = contains(["heads", "tags", ""], var.repository_ref_type) From 71f5b2bab188e60fdacd2039e90d843bea2cca9b Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Fri, 28 Aug 2026 13:54:18 +0000 Subject: [PATCH 42/81] chore(6.x): release 6.20.0 --- CHANGELOG.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index ebb128da9..9ca9f60eb 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,12 @@ # Changelog +## [6.20.0](https://github.com/nullplatform/tofu-modules/compare/v6.19.1...v6.20.0) (2026-08-28) + + +### Features + +* require an explicit version for everything the modules deploy ([#540](https://github.com/nullplatform/tofu-modules/issues/540)) ([868ad98](https://github.com/nullplatform/tofu-modules/commit/868ad989663aa15e4dbdea98fa940e668e4994c2)) + ## [6.19.1](https://github.com/nullplatform/tofu-modules/compare/v6.19.0...v6.19.1) (2026-08-21) From 78220fd40dece67e79fb29c906fad00d86ca0cca Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Fri, 28 Aug 2026 13:56:41 +0000 Subject: [PATCH 43/81] docs: regenerate READMEs for changed modules and update versions --- infrastructure/aws/acm/README.md | 2 +- .../aws_load_balancer_controller/README.md | 2 +- infrastructure/aws/backend/README.md | 2 +- infrastructure/aws/dns/README.md | 2 +- infrastructure/aws/eks/README.md | 2 +- infrastructure/aws/iam/agent/README.md | 2 +- .../README.md | 2 +- infrastructure/aws/iam/cert_manager/README.md | 2 +- .../aws/iam/ci-build-workflow-user/README.md | 2 +- infrastructure/aws/iam/cloudwatch/README.md | 2 +- infrastructure/aws/iam/ecr/README.md | 2 +- infrastructure/aws/iam/external_dns/README.md | 2 +- infrastructure/aws/iam/s3/README.md | 2 +- infrastructure/aws/ingress/README.md | 2 +- infrastructure/aws/security/README.md | 2 +- infrastructure/aws/vpc/README.md | 2 +- infrastructure/azure/acr/README.md | 2 +- infrastructure/azure/aks/README.md | 2 +- .../azure/aks_route_table/README.md | 2 +- infrastructure/azure/dns/README.md | 2 +- infrastructure/azure/iam/README.md | 2 +- infrastructure/azure/private_dns/README.md | 2 +- infrastructure/azure/resource_group/README.md | 2 +- infrastructure/azure/security/README.md | 2 +- infrastructure/azure/vnet/README.md | 2 +- infrastructure/commons/cert_manager/README.md | 126 +++++---- infrastructure/commons/external_dns/README.md | 14 +- infrastructure/commons/istio/README.md | 2 +- infrastructure/commons/prometheus/README.md | 70 ++++- .../gcp/artifact-registry/README.md | 2 +- infrastructure/gcp/backend/README.md | 2 +- infrastructure/gcp/cloud-dns/README.md | 2 +- infrastructure/gcp/cloud-nat/README.md | 2 +- infrastructure/gcp/gke/README.md | 6 +- infrastructure/gcp/iam/README.md | 2 +- infrastructure/gcp/security/README.md | 2 +- infrastructure/gcp/vpc/README.md | 2 +- infrastructure/oci/backend/README.md | 2 +- infrastructure/oci/dns/README.md | 2 +- infrastructure/oci/dynamic_groups/README.md | 2 +- infrastructure/oci/oke/README.md | 2 +- infrastructure/oci/vcn/README.md | 2 +- nullplatform/account/README.md | 2 +- nullplatform/agent/README.md | 239 ++++++++++++------ nullplatform/api_key/README.md | 10 +- nullplatform/asset/docker_server/README.md | 2 +- nullplatform/asset/ecr/README.md | 2 +- nullplatform/asset/s3/README.md | 2 +- nullplatform/base/README.md | 138 +++++----- nullplatform/cloud/aws/cloud/README.md | 2 +- nullplatform/cloud/aws/vpc/README.md | 2 +- nullplatform/cloud/azure/cloud/README.md | 2 +- nullplatform/cloud/gcp/cloud/README.md | 2 +- nullplatform/cloud/oci/cloud/README.md | 2 +- nullplatform/code_repository/README.md | 10 +- .../container_orchestration/aks/README.md | 101 ++++++-- .../container_orchestration/eks/README.md | 93 +++++-- .../container_orchestration/gke/README.md | 103 +++++--- .../container_orchestration/oke/README.md | 2 +- nullplatform/dimension/README.md | 2 +- nullplatform/dimension_value/README.md | 2 +- .../identity-access-control/README.md | 2 +- nullplatform/metrics/README.md | 2 +- nullplatform/packaged_service/README.md | 2 +- .../parameter_storage_configuration/README.md | 2 +- .../parameter_storage_definition/README.md | 2 +- .../README.md | 2 +- nullplatform/scope_configuration/README.md | 2 +- nullplatform/scope_definition/README.md | 2 +- .../README.md | 2 +- nullplatform/service_definition/README.md | 94 ++++--- .../README.md | 2 +- nullplatform/users/README.md | 2 +- 73 files changed, 726 insertions(+), 400 deletions(-) diff --git a/infrastructure/aws/acm/README.md b/infrastructure/aws/acm/README.md index 1c68008be..b046db276 100644 --- a/infrastructure/aws/acm/README.md +++ b/infrastructure/aws/acm/README.md @@ -18,7 +18,7 @@ The module creates an aws_acm_certificate resource with DNS validation, which is ```hcl module "acm" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/acm?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/acm?ref=v6.20.0" domain_name = "your-domain-name" zone_id = "your-zone-id" diff --git a/infrastructure/aws/aws_load_balancer_controller/README.md b/infrastructure/aws/aws_load_balancer_controller/README.md index ec2533e01..0f475e256 100644 --- a/infrastructure/aws/aws_load_balancer_controller/README.md +++ b/infrastructure/aws/aws_load_balancer_controller/README.md @@ -18,7 +18,7 @@ This module creates a helm_release resource to deploy the AWS Load Balancer Cont ```hcl module "aws_load_balancer_controller" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/aws_load_balancer_controller?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/aws_load_balancer_controller?ref=v6.20.0" cluster_name = "your-cluster-name" vpc_id = "your-vpc-id" diff --git a/infrastructure/aws/backend/README.md b/infrastructure/aws/backend/README.md index 44323c495..85c4d03cc 100644 --- a/infrastructure/aws/backend/README.md +++ b/infrastructure/aws/backend/README.md @@ -20,7 +20,7 @@ This module creates an S3 bucket with versioning and server-side encryption enab ```hcl module "backend" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/backend?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/backend?ref=v6.20.0" } ``` diff --git a/infrastructure/aws/dns/README.md b/infrastructure/aws/dns/README.md index 3a1df4999..da46c3d64 100644 --- a/infrastructure/aws/dns/README.md +++ b/infrastructure/aws/dns/README.md @@ -21,7 +21,7 @@ The module conditionally creates an aws_route53_zone resource for a public hoste ```hcl module "dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/dns?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/dns?ref=v6.20.0" domain_name = "your-domain-name" vpc_id = "your-vpc-id" diff --git a/infrastructure/aws/eks/README.md b/infrastructure/aws/eks/README.md index 3341dc817..f8d110869 100644 --- a/infrastructure/aws/eks/README.md +++ b/infrastructure/aws/eks/README.md @@ -22,7 +22,7 @@ The module wraps terraform-aws-modules/eks to create the EKS cluster (aws_eks_cl ```hcl module "eks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/eks?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/eks?ref=v6.20.0" aws_subnets_private_ids = "your-aws-subnets-private-ids" aws_vpc_vpc_id = "your-aws-vpc-vpc-id" diff --git a/infrastructure/aws/iam/agent/README.md b/infrastructure/aws/iam/agent/README.md index 578bbecec..a70bd1949 100644 --- a/infrastructure/aws/iam/agent/README.md +++ b/infrastructure/aws/iam/agent/README.md @@ -21,7 +21,7 @@ The module uses the terraform-aws-modules/iam//modules/iam-role-for-service-acco ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/agent?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/agent?ref=v6.20.0" agent_namespace = "your-agent-namespace" aws_iam_openid_connect_provider_arn = "your-aws-iam-openid-connect-provider-arn" diff --git a/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md b/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md index 2e7448d26..ef051cb6c 100644 --- a/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md +++ b/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md @@ -19,7 +19,7 @@ This module creates an IAM role for the AWS Load Balancer Controller using the t ```hcl module "aws_load_balancer_controller_iam" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/aws_load_balancer_controller_iam?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/aws_load_balancer_controller_iam?ref=v6.20.0" aws_iam_openid_connect_provider_arn = "your-aws-iam-openid-connect-provider-arn" cluster_name = "your-cluster-name" diff --git a/infrastructure/aws/iam/cert_manager/README.md b/infrastructure/aws/iam/cert_manager/README.md index d9fe4ef2f..556e3b1bf 100644 --- a/infrastructure/aws/iam/cert_manager/README.md +++ b/infrastructure/aws/iam/cert_manager/README.md @@ -20,7 +20,7 @@ An aws_iam_policy resource is always created granting route53:GetChange, route53 ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cert_manager?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cert_manager?ref=v6.20.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/ci-build-workflow-user/README.md b/infrastructure/aws/iam/ci-build-workflow-user/README.md index 2f9c08cc9..ba258c562 100644 --- a/infrastructure/aws/iam/ci-build-workflow-user/README.md +++ b/infrastructure/aws/iam/ci-build-workflow-user/README.md @@ -21,7 +21,7 @@ The module creates an aws_iam_user named with the cluster_name prefix and genera ```hcl module "ci-build-workflow-user" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ci-build-workflow-user?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ci-build-workflow-user?ref=v6.20.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/cloudwatch/README.md b/infrastructure/aws/iam/cloudwatch/README.md index cbdea3128..e89f473b2 100644 --- a/infrastructure/aws/iam/cloudwatch/README.md +++ b/infrastructure/aws/iam/cloudwatch/README.md @@ -20,7 +20,7 @@ The module creates an aws_iam_policy granting CloudWatch Logs and Metrics write ```hcl module "cloudwatch" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cloudwatch?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cloudwatch?ref=v6.20.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/ecr/README.md b/infrastructure/aws/iam/ecr/README.md index f5145d659..beb601fe0 100644 --- a/infrastructure/aws/iam/ecr/README.md +++ b/infrastructure/aws/iam/ecr/README.md @@ -20,7 +20,7 @@ The module creates an aws_iam_role named nullplatform-{cluster_name}-application ```hcl module "ecr" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ecr?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ecr?ref=v6.20.0" build_workflow_group_name = "your-build-workflow-group-name" cluster_name = "your-cluster-name" diff --git a/infrastructure/aws/iam/external_dns/README.md b/infrastructure/aws/iam/external_dns/README.md index 30755805d..e3ae43109 100644 --- a/infrastructure/aws/iam/external_dns/README.md +++ b/infrastructure/aws/iam/external_dns/README.md @@ -20,7 +20,7 @@ An aws_iam_policy resource named nullplatform_external_dns_policy is always crea ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/external_dns?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/external_dns?ref=v6.20.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/s3/README.md b/infrastructure/aws/iam/s3/README.md index cab44f6ca..20c13e88e 100644 --- a/infrastructure/aws/iam/s3/README.md +++ b/infrastructure/aws/iam/s3/README.md @@ -18,7 +18,7 @@ The module creates an aws_iam_policy resource that allows s3:PutObject and s3:Ge ```hcl module "s3" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/s3?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/s3?ref=v6.20.0" bucket = "your-bucket" build_workflow_group_name = "your-build-workflow-group-name" diff --git a/infrastructure/aws/ingress/README.md b/infrastructure/aws/ingress/README.md index b4b30cecf..a64b8adfc 100644 --- a/infrastructure/aws/ingress/README.md +++ b/infrastructure/aws/ingress/README.md @@ -22,7 +22,7 @@ The module creates up to two kubernetes_ingress_v1 resources — one for an inte ```hcl module "ingress" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/ingress?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/ingress?ref=v6.20.0" certificate_arn = "your-certificate-arn" } diff --git a/infrastructure/aws/security/README.md b/infrastructure/aws/security/README.md index ff0cabd2c..01a42ee07 100644 --- a/infrastructure/aws/security/README.md +++ b/infrastructure/aws/security/README.md @@ -22,7 +22,7 @@ The module uses data sources (aws_eks_cluster, aws_vpc) to automatically derive ```hcl module "security" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/security?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/security?ref=v6.20.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/vpc/README.md b/infrastructure/aws/vpc/README.md index ed0c1d12e..d9ae720ee 100644 --- a/infrastructure/aws/vpc/README.md +++ b/infrastructure/aws/vpc/README.md @@ -22,7 +22,7 @@ This module creates a terraform-aws-modules/vpc/aws module resource with DNS hos ```hcl module "vpc" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/vpc?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/vpc?ref=v6.20.0" account = "your-account" organization = "your-organization" diff --git a/infrastructure/azure/acr/README.md b/infrastructure/azure/acr/README.md index b14985317..0acf4d776 100644 --- a/infrastructure/azure/acr/README.md +++ b/infrastructure/azure/acr/README.md @@ -18,7 +18,7 @@ The module uses the azurerm_container_registry resource to create the container ```hcl module "acr" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/acr?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/acr?ref=v6.20.0" containerregistry_name = "your-containerregistry-name" location = "your-location" diff --git a/infrastructure/azure/aks/README.md b/infrastructure/azure/aks/README.md index 4a13dce31..da3ffb3a3 100644 --- a/infrastructure/azure/aks/README.md +++ b/infrastructure/azure/aks/README.md @@ -22,7 +22,7 @@ The module wraps the Azure/aks/azurerm community module (version 11.0.0) and use ```hcl module "aks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks?ref=v6.20.0" cluster_name = "your-cluster-name" location = "your-location" diff --git a/infrastructure/azure/aks_route_table/README.md b/infrastructure/azure/aks_route_table/README.md index 0d55e409a..a1dfd623b 100644 --- a/infrastructure/azure/aks_route_table/README.md +++ b/infrastructure/azure/aks_route_table/README.md @@ -19,7 +19,7 @@ The module uses an azurerm_resources data source to discover the AKS-managed rou ```hcl module "aks_route_table" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks_route_table?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks_route_table?ref=v6.20.0" node_resource_group = "your-node-resource-group" subnet_id = "your-subnet-id" diff --git a/infrastructure/azure/dns/README.md b/infrastructure/azure/dns/README.md index 2f13a06a5..3d6c11f6d 100644 --- a/infrastructure/azure/dns/README.md +++ b/infrastructure/azure/dns/README.md @@ -18,7 +18,7 @@ This module creates an azurerm_dns_zone resource and configures it with the prov ```hcl module "dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/dns?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/dns?ref=v6.20.0" domain_name = "your-domain-name" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/iam/README.md b/infrastructure/azure/iam/README.md index 2189b04c9..942e5c31e 100644 --- a/infrastructure/azure/iam/README.md +++ b/infrastructure/azure/iam/README.md @@ -21,7 +21,7 @@ The module creates an azurerm_user_assigned_identity resource in the specified r ```hcl module "iam" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/iam?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/iam?ref=v6.20.0" location = "your-location" name = "your-name" diff --git a/infrastructure/azure/private_dns/README.md b/infrastructure/azure/private_dns/README.md index 6e0c787b2..f71b1d982 100644 --- a/infrastructure/azure/private_dns/README.md +++ b/infrastructure/azure/private_dns/README.md @@ -18,7 +18,7 @@ This module creates an azurerm_private_dns_zone resource and optionally multiple ```hcl module "private_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/private_dns?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/private_dns?ref=v6.20.0" domain_name = "your-domain-name" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/resource_group/README.md b/infrastructure/azure/resource_group/README.md index 776db4ac1..f15ae092a 100644 --- a/infrastructure/azure/resource_group/README.md +++ b/infrastructure/azure/resource_group/README.md @@ -18,7 +18,7 @@ This module creates an azurerm_resource_group resource and outputs its name and ```hcl module "resource_group" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/resource_group?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/resource_group?ref=v6.20.0" location = "your-location" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/security/README.md b/infrastructure/azure/security/README.md index cef18c22b..87b2ffa58 100644 --- a/infrastructure/azure/security/README.md +++ b/infrastructure/azure/security/README.md @@ -21,7 +21,7 @@ The module uses azurerm_kubernetes_cluster and azurerm_virtual_network data sour ```hcl module "security" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/security?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/security?ref=v6.20.0" cluster_name = "your-cluster-name" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/vnet/README.md b/infrastructure/azure/vnet/README.md index 829e1c2e0..63fd48807 100644 --- a/infrastructure/azure/vnet/README.md +++ b/infrastructure/azure/vnet/README.md @@ -18,7 +18,7 @@ This module creates an Azure virtual network using the azurerm provider and conf ```hcl module "vnet" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/vnet?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/vnet?ref=v6.20.0" address_space = "your-address-space" location = "your-location" diff --git a/infrastructure/commons/cert_manager/README.md b/infrastructure/commons/cert_manager/README.md index 9334229fb..fe813212e 100644 --- a/infrastructure/commons/cert_manager/README.md +++ b/infrastructure/commons/cert_manager/README.md @@ -2,55 +2,57 @@ ## Description -Deploys cert-manager and its configuration Helm charts on Kubernetes with multi-cloud DNS01 solver support for GCP, Azure, AWS, Cloudflare, and OCI +Deploys cert-manager and its configuration via Helm onto a Kubernetes cluster with DNS01 challenge solvers for GCP, Azure, AWS, Cloudflare, or OCI cloud providers ## Architecture -Two primary helm_release resources are created: cert-manager from the Jetstack chart repository and nullplatform-cert-manager-config from the nullplatform chart repository, with the config chart depending on the base cert-manager release. A third conditional helm_release for cert-manager-webhook-oci is created only when cloud_provider is 'oci'. The cert_manager_values local constructs the Helm values dynamically, merging base service account annotations with provider-specific annotations (GCP Workload Identity, AWS IRSA role ARN, Azure Workload Identity client ID, or OCI workload identity principal) based on cloud_provider and aws_identity_mode. Template files cert_manager_default_values and cert_manager_provider_values are rendered via templatefile() using common_context and provider_context locals and passed as values to the config chart. +The module creates two core helm_release resources: cert-manager from charts.jetstack.io and nullplatform-cert-manager-config from nullplatform's Helm registry, with the config chart depending on the cert-manager chart via depends_on. A third conditional helm_release for cert-manager-webhook-oci is created only when cloud_provider is 'oci'. Service account annotations are assembled in locals by merging base annotations with provider-specific identity annotations (GKE Workload Identity email, IRSA role ARN, Azure Workload Identity client ID, or OCI workload identity OCID) and passed to the cert-manager helm_release via yamlencode. Provider-specific Helm values are rendered from templatefiles and passed to the config helm_release. ## Features - Deploys cert-manager Helm chart with CRDs enabled and DNS01 recursive nameserver configuration -- Deploys nullplatform-cert-manager-config Helm chart with provider-specific DNS01 solver templates rendered via templatefile() -- Configures cert-manager Kubernetes service account annotations for GCP Workload Identity, AWS IRSA, Azure Workload Identity, and OCI workload identity -- Deploys cert-manager-webhook-oci Helm chart conditionally when cloud_provider is set to oci -- Supports AWS Pod Identity mode that omits IRSA role annotation for EKS Pod Identity agent-based credential injection -- Supports Azure Service Principal authentication when workload identity is disabled via azure_workload_identity_enabled -- Merges provider-specific pod labels for Azure Workload Identity use annotation on cert-manager pods +- Renders provider-specific cert-manager configuration from templatefiles for GCP, Azure, AWS, Cloudflare, and OCI +- Configures Kubernetes service account annotations for cloud-native identity (GKE Workload Identity, IRSA, Azure Workload Identity, OCI workload identity principal) +- Deploys OCI webhook helm_release conditionally when cloud_provider is set to oci +- Supports Azure Workload Identity or Service Principal authentication modes with conditional annotation and pod label injection +- Supports AWS IRSA and Pod Identity identity modes for cert-manager service account credential delivery +- Pins all Helm chart versions explicitly to prevent drift from floating version references ## Basic Usage ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.20.0" - account_slug = "your-account-slug" - cloud_provider = "your-cloud-provider" - hosted_zone_name = "your-hosted-zone-name" - private_domain_name = "your-private-domain-name" + account_slug = "your-account-slug" + cert_manager_version = "your-cert-manager-version" + cloud_provider = "your-cloud-provider" + hosted_zone_name = "your-hosted-zone-name" + private_domain_name = "your-private-domain-name" } ``` -### Usage with GCP Provider +### Usage with GCP Cloud Provider ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.19.1" - - account_slug = "your-account-slug" - cloud_provider = "gcp" - gcp_sa_email = "your-gcp-sa-email" # Required when cloud_provider = "gcp" - hosted_zone_name = "your-hosted-zone-name" - private_domain_name = "your-private-domain-name" - project_id = "your-project-id" # Required when cloud_provider = "gcp" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.20.0" + + account_slug = "your-account-slug" + cert_manager_version = "your-cert-manager-version" + cloud_provider = "gcp" + gcp_sa_email = "your-gcp-sa-email" # Required when cloud_provider = "gcp" + hosted_zone_name = "your-hosted-zone-name" + private_domain_name = "your-private-domain-name" + project_id = "your-project-id" # Required when cloud_provider = "gcp" } ``` -### Usage with Azure Provider +### Usage with Azure Cloud Provider ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.20.0" account_slug = "your-account-slug" azure_client_id = "your-azure-client-id" # Required when cloud_provider = "azure" @@ -58,19 +60,21 @@ module "cert_manager" { azure_resource_group_name = "your-azure-resource-group-name" # Required when cloud_provider = "azure" azure_subscription_id = "your-azure-subscription-id" # Required when cloud_provider = "azure" azure_tenant_id = "your-azure-tenant-id" # Required when cloud_provider = "azure" + cert_manager_version = "your-cert-manager-version" cloud_provider = "azure" hosted_zone_name = "your-hosted-zone-name" private_domain_name = "your-private-domain-name" } ``` -### Usage with Cloudflare Provider +### Usage with Cloudflare Cloud Provider ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.20.0" account_slug = "your-account-slug" + cert_manager_version = "your-cert-manager-version" cloud_provider = "cloudflare" cloudflare_secret_name = "your-cloudflare-secret-name" # Required when cloud_provider = "cloudflare" cloudflare_token = "your-cloudflare-token" # Required when cloud_provider = "cloudflare" @@ -79,29 +83,31 @@ module "cert_manager" { } ``` -### Usage with AWS Provider +### Usage with AWS Cloud Provider ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.19.1" - - account_slug = "your-account-slug" - aws_identity_mode = "your-aws-identity-mode" # Required when cloud_provider = "aws" - aws_region = "your-aws-region" # Required when cloud_provider = "aws" - aws_sa_arn = "your-aws-sa-arn" # Required when cloud_provider = "aws" - cloud_provider = "aws" - hosted_zone_name = "your-hosted-zone-name" - private_domain_name = "your-private-domain-name" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.20.0" + + account_slug = "your-account-slug" + aws_identity_mode = "your-aws-identity-mode" # Required when cloud_provider = "aws" + aws_region = "your-aws-region" # Required when cloud_provider = "aws" + aws_sa_arn = "your-aws-sa-arn" # Required when cloud_provider = "aws" + cert_manager_version = "your-cert-manager-version" + cloud_provider = "aws" + hosted_zone_name = "your-hosted-zone-name" + private_domain_name = "your-private-domain-name" } ``` -### Usage with OCI Provider +### Usage with OCI Cloud Provider ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.20.0" account_slug = "your-account-slug" + cert_manager_version = "your-cert-manager-version" cert_manager_webhook_oci_namespace = "your-cert-manager-webhook-oci-namespace" # Required when cloud_provider = "oci" cert_manager_webhook_oci_version = "your-cert-manager-webhook-oci-version" # Required when cloud_provider = "oci" cloud_provider = "oci" @@ -113,6 +119,20 @@ module "cert_manager" { } ``` +### Usage with Cert-Manager Version (fixed semver) + +```hcl +module "cert_manager" { + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.20.0" + + account_slug = "your-account-slug" + cert_manager_version = "v1.21.1" + cloud_provider = "your-cloud-provider" + hosted_zone_name = "your-hosted-zone-name" + private_domain_name = "your-private-domain-name" +} +``` + ## Using Outputs ```hcl @@ -163,7 +183,7 @@ resource "example_resource" "this" { | [azure\_workload\_identity\_enabled](#input\_azure\_workload\_identity\_enabled) | Enable Workload Identity for Azure DNS solver. When false, Service Principal auth is used and azure\_client\_secret is required. | `bool` | `true` | no | | [cert\_manager\_config\_version](#input\_cert\_manager\_config\_version) | The version of the cert-manager configuration Helm chart | `string` | `"2.35.0"` | no | | [cert\_manager\_namespace](#input\_cert\_manager\_namespace) | The Kubernetes namespace where cert-manager will be deployed | `string` | `"cert-manager"` | no | -| [cert\_manager\_version](#input\_cert\_manager\_version) | The version of cert-manager Helm chart to deploy | `string` | `"1.18.2"` | no | +| [cert\_manager\_version](#input\_cert\_manager\_version) | No default: every install pins this deliberately — see VERSIONS.md. The version of cert-manager Helm chart to deploy. Was declared but never wired to the helm\_release, so installs tracked whatever the chart repository served; the default is the version that resolved to as of 2026-08-27, which keeps behaviour unchanged while removing the drift. | `string` | n/a | yes | | [cert\_manager\_webhook\_oci\_namespace](#input\_cert\_manager\_webhook\_oci\_namespace) | Kubernetes namespace where the cert-manager OCI webhook is deployed | `string` | `"cert-manager"` | no | | [cert\_manager\_webhook\_oci\_version](#input\_cert\_manager\_webhook\_oci\_version) | Helm chart version for the cert-manager OCI webhook | `string` | `"1.4.1"` | no | | [cloud\_provider](#input\_cloud\_provider) | The cloud provider to use: gcp, azure, aws, cloudflare, or oci | `string` | n/a | yes | @@ -181,16 +201,16 @@ resource "example_resource" "this" { diff --git a/infrastructure/commons/external_dns/README.md b/infrastructure/commons/external_dns/README.md index 9e63bd0e7..4be4c203a 100644 --- a/infrastructure/commons/external_dns/README.md +++ b/infrastructure/commons/external_dns/README.md @@ -22,7 +22,7 @@ The module creates an optional kubernetes_namespace_v1 resource and a helm_relea ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.20.0" dns_provider_name = "your-dns-provider-name" domain_filters = "your-domain-filters" @@ -33,7 +33,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.20.0" cloudflare_token = "your-cloudflare-token" # Required when dns_provider_name = "cloudflare" dns_provider_name = "cloudflare" @@ -45,7 +45,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.20.0" aws_iam_role_arn = "your-aws-iam-role-arn" # Required when dns_provider_name = "aws" aws_identity_mode = "your-aws-identity-mode" # Required when dns_provider_name = "aws" @@ -61,7 +61,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.20.0" dns_provider_name = "oci" domain_filters = "your-domain-filters" @@ -76,7 +76,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.20.0" azure_client_id = "your-azure-client-id" # Required when dns_provider_name = "azure" azure_resource_group = "your-azure-resource-group" # Required when dns_provider_name = "azure" @@ -92,7 +92,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.20.0" azure_client_id = "your-azure-client-id" # Required when dns_provider_name = "azure-private-dns" azure_resource_group = "your-azure-resource-group" # Required when dns_provider_name = "azure-private-dns" @@ -108,7 +108,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.20.0" dns_provider_name = "google" domain_filters = "your-domain-filters" diff --git a/infrastructure/commons/istio/README.md b/infrastructure/commons/istio/README.md index 6365be7dd..fd3cd179c 100644 --- a/infrastructure/commons/istio/README.md +++ b/infrastructure/commons/istio/README.md @@ -21,7 +21,7 @@ The module creates three helm_release resources in a strict dependency chain: is ```hcl module "istio" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/istio?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/istio?ref=v6.20.0" } ``` diff --git a/infrastructure/commons/prometheus/README.md b/infrastructure/commons/prometheus/README.md index d3d53729d..b187e134f 100644 --- a/infrastructure/commons/prometheus/README.md +++ b/infrastructure/commons/prometheus/README.md @@ -2,23 +2,58 @@ ## Description -Deploys Prometheus using Helm chart in a specified Kubernetes namespace +Deploys Prometheus monitoring stack into a Kubernetes cluster using the prometheus-community Helm chart with opinionated release settings ## Architecture -This module creates a helm_release resource to deploy the Prometheus chart from the prometheus-community repository, and uses a templatefile to populate the prometheus_values template with the nullplatform_port variable, the resulting values are then passed to the helm_release resource, which creates the necessary Kubernetes resources, including deployments, services, and pods, in the specified namespace +A single helm_release resource named 'prometheus' installs the prometheus-community/prometheus chart into the namespace defined by var.prometheus_namespace, with the chart version pinned via var.prometheus_version. A templatefile-rendered locals block produces the Helm values YAML by interpolating var.nullplatform_port into a template file, and that rendered string is passed as the sole values override to the helm_release. Release lifecycle flags such as atomic, cleanup_on_fail, and recreate_pods are hardcoded to enforce deterministic, self-healing deployments on every apply. ## Features -- Deploys Prometheus chart with customizable nullplatform port -- Configures Kubernetes namespace for Prometheus deployment -- Creates necessary Kubernetes resources for Prometheus +- Deploys prometheus-community/prometheus Helm chart with a pinned, explicit chart version to prevent drift +- Renders Helm values from a template file with configurable nullplatform service port injection +- Creates the target Kubernetes namespace automatically via create_namespace flag +- Enforces atomic, self-healing releases with cleanup_on_fail and recreate_pods enabled +- Caps Helm release history to 10 revisions to limit etcd storage growth +- Configures a 600-second timeout with wait_for_jobs to ensure all Prometheus workloads reach ready state before completing ## Basic Usage ```hcl module "prometheus" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.20.0" + + prometheus_version = "your-prometheus-version" +} +``` + +### Usage with Pinned Release Version + +```hcl +module "prometheus" { + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.20.0" + + prometheus_version = "latest" +} +``` + +### Usage with Pinned Release Version + +```hcl +module "prometheus" { + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.20.0" + + prometheus_version = "main" +} +``` + +### Usage with Pinned Release Version + +```hcl +module "prometheus" { + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.20.0" + + prometheus_version = "master" } ``` @@ -42,7 +77,7 @@ resource "example_resource" "this" { | Name | Version | |------|---------| -| [helm](#provider\_helm) | ~> 3.0 | +| [helm](#provider\_helm) | 3.2.0 | ## Resources @@ -56,19 +91,28 @@ resource "example_resource" "this" { |------|-------------|------|---------|:--------:| | [nullplatform\_port](#input\_nullplatform\_port) | Port number for nullplatform service communication | `number` | `2021` | no | | [prometheus\_namespace](#input\_prometheus\_namespace) | Kubernetes namespace where Prometheus will be deployed | `string` | `"prometheus"` | no | +| [prometheus\_version](#input\_prometheus\_version) | No default: every install pins this deliberately — see VERSIONS.md. Helm chart version for the prometheus-community/prometheus chart. The helm\_release carried no version at all, so every apply resolved to whatever the repository served latest; the default is the version that resolved to as of 2026-08-27, which keeps behaviour unchanged while removing the drift. | `string` | n/a | yes | diff --git a/infrastructure/gcp/artifact-registry/README.md b/infrastructure/gcp/artifact-registry/README.md index e1df15f0d..4a60af0f9 100644 --- a/infrastructure/gcp/artifact-registry/README.md +++ b/infrastructure/gcp/artifact-registry/README.md @@ -21,7 +21,7 @@ The module creates a google_artifact_registry_repository resource configured wit ```hcl module "artifact-registry" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/artifact-registry?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/artifact-registry?ref=v6.20.0" location = "your-location" project_id = "your-project-id" diff --git a/infrastructure/gcp/backend/README.md b/infrastructure/gcp/backend/README.md index 7c4fe15d9..179cbb740 100644 --- a/infrastructure/gcp/backend/README.md +++ b/infrastructure/gcp/backend/README.md @@ -22,7 +22,7 @@ The module creates a random_id resource to generate a unique 8-byte hex suffix, ```hcl module "backend" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/backend?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/backend?ref=v6.20.0" project_id = "your-project-id" } diff --git a/infrastructure/gcp/cloud-dns/README.md b/infrastructure/gcp/cloud-dns/README.md index e8cc4bdf4..7f81bfd5d 100644 --- a/infrastructure/gcp/cloud-dns/README.md +++ b/infrastructure/gcp/cloud-dns/README.md @@ -21,7 +21,7 @@ The module creates a single google_dns_managed_zone resource in the specified GC ```hcl module "cloud-dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-dns?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-dns?ref=v6.20.0" domain_name = "your-domain-name" project_id = "your-project-id" diff --git a/infrastructure/gcp/cloud-nat/README.md b/infrastructure/gcp/cloud-nat/README.md index dc2e20cb3..1fc12ae71 100644 --- a/infrastructure/gcp/cloud-nat/README.md +++ b/infrastructure/gcp/cloud-nat/README.md @@ -19,7 +19,7 @@ This module creates a google_compute_router resource in a specified region and n ```hcl module "cloud-nat" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-nat?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-nat?ref=v6.20.0" nat_name = "your-nat-name" network_id = "your-network-id" diff --git a/infrastructure/gcp/gke/README.md b/infrastructure/gcp/gke/README.md index 2ca8faac2..f409bcbdb 100644 --- a/infrastructure/gcp/gke/README.md +++ b/infrastructure/gcp/gke/README.md @@ -22,7 +22,7 @@ The module conditionally creates one of two mutually-exclusive submodules based ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.20.0" cluster_name = "your-cluster-name" ip_range_pods = "your-ip-range-pods" @@ -38,7 +38,7 @@ module "gke" { ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.20.0" cluster_name = "your-cluster-name" ip_range_pods = "your-ip-range-pods" @@ -73,7 +73,7 @@ module "gke" { ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.20.0" cluster_name = "your-cluster-name" ip_range_pods = "your-ip-range-pods" diff --git a/infrastructure/gcp/iam/README.md b/infrastructure/gcp/iam/README.md index 483b30da1..0d460c5dd 100644 --- a/infrastructure/gcp/iam/README.md +++ b/infrastructure/gcp/iam/README.md @@ -19,7 +19,7 @@ The module creates google_service_account resources for each service account spe ```hcl module "iam" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/iam?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/iam?ref=v6.20.0" project_id = "your-project-id" } diff --git a/infrastructure/gcp/security/README.md b/infrastructure/gcp/security/README.md index 97ee046a3..826c46cd0 100644 --- a/infrastructure/gcp/security/README.md +++ b/infrastructure/gcp/security/README.md @@ -22,7 +22,7 @@ The module uses data.google_container_cluster and data.google_compute_subnetwork ```hcl module "security" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/security?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/security?ref=v6.20.0" cluster_name = "your-cluster-name" gcp_project_id = "your-gcp-project-id" diff --git a/infrastructure/gcp/vpc/README.md b/infrastructure/gcp/vpc/README.md index dd823cb43..376ce0e13 100644 --- a/infrastructure/gcp/vpc/README.md +++ b/infrastructure/gcp/vpc/README.md @@ -20,7 +20,7 @@ The module invokes the terraform-google-modules/network/google module to create ```hcl module "vpc" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/vpc?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/vpc?ref=v6.20.0" network_name = "your-network-name" project_id = "your-project-id" diff --git a/infrastructure/oci/backend/README.md b/infrastructure/oci/backend/README.md index 68661cc7e..377a88d58 100644 --- a/infrastructure/oci/backend/README.md +++ b/infrastructure/oci/backend/README.md @@ -18,7 +18,7 @@ The module creates an oci_objectstorage_bucket resource, which is configured wit ```hcl module "backend" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/backend?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/backend?ref=v6.20.0" compartment_id = "your-compartment-id" namespace = "your-namespace" diff --git a/infrastructure/oci/dns/README.md b/infrastructure/oci/dns/README.md index 09f7ac1f9..b430abb9b 100644 --- a/infrastructure/oci/dns/README.md +++ b/infrastructure/oci/dns/README.md @@ -18,7 +18,7 @@ This module creates oci_dns_zone resources for each DNS zone defined in the dns_ ```hcl module "dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dns?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dns?ref=v6.20.0" compartment_id = "your-compartment-id" } diff --git a/infrastructure/oci/dynamic_groups/README.md b/infrastructure/oci/dynamic_groups/README.md index 6dc095de4..cb57afefd 100644 --- a/infrastructure/oci/dynamic_groups/README.md +++ b/infrastructure/oci/dynamic_groups/README.md @@ -19,7 +19,7 @@ This module creates an OCI dynamic group and an OCI identity policy, connecting ```hcl module "dynamic_groups" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dynamic_groups?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dynamic_groups?ref=v6.20.0" cluster_id = "your-cluster-id" compartment_id = "your-compartment-id" diff --git a/infrastructure/oci/oke/README.md b/infrastructure/oci/oke/README.md index a257bcd2c..d94f5e050 100644 --- a/infrastructure/oci/oke/README.md +++ b/infrastructure/oci/oke/README.md @@ -21,7 +21,7 @@ The module instantiates the oracle-terraform-modules/oke/oci module to create an ```hcl module "oke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/oke?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/oke?ref=v6.20.0" api_endpoint_subnet_id = "your-api-endpoint-subnet-id" cluster_name = "your-cluster-name" diff --git a/infrastructure/oci/vcn/README.md b/infrastructure/oci/vcn/README.md index 78207d5df..3d722546d 100644 --- a/infrastructure/oci/vcn/README.md +++ b/infrastructure/oci/vcn/README.md @@ -19,7 +19,7 @@ The module instantiates oci_core_subnet resources for public and private subnets ```hcl module "vcn" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/vcn?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/vcn?ref=v6.20.0" } ``` diff --git a/nullplatform/account/README.md b/nullplatform/account/README.md index 22072195f..0e2457d41 100644 --- a/nullplatform/account/README.md +++ b/nullplatform/account/README.md @@ -19,7 +19,7 @@ The module iterates over the `nullplatform_accounts` input map using `for_each` ```hcl module "account" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/account?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/account?ref=v6.20.0" nullplatform_accounts = "your-nullplatform-accounts" } diff --git a/nullplatform/agent/README.md b/nullplatform/agent/README.md index c676c7462..7f384d411 100644 --- a/nullplatform/agent/README.md +++ b/nullplatform/agent/README.md @@ -2,96 +2,163 @@ ## Description -Deploys the nullplatform agent to a Kubernetes cluster via a Helm chart, supporting AWS, GCP, Azure, and OCI cloud providers +Deploys the nullplatform agent to a Kubernetes cluster via a Helm chart, configuring it for a specific cloud provider with pinned versions for all components ## Architecture -The module creates a helm_release resource targeting the nullplatform-agent chart from the official nullplatform Helm repository, with chart values rendered from a templatefile into a YAML values document. A terraform_data resource tracks the api_key input and triggers helm_release replacement when the key changes, while a second terraform_data resource enforces cross-variable preconditions (e.g., aws_iam_role_arn for AWS, Azure credentials for Azure). Cloud-provider-specific configuration is merged into the agent's environment variables via locals, and an optional worker orchestration block is encoded as a second Helm values layer when the worker variable is non-null. +The module creates a `helm_release` resource named `agent` that deploys the `nullplatform-agent` chart from the nullplatform Helm repository, with values templated from `nullplatform_agent_values.tmpl.yaml` using `templatefile()`. A `terraform_data.api_key_trigger` resource monitors the API key and forces a `helm_release` replacement when it changes, while a second `terraform_data.cross_variable_validation` resource enforces cross-variable preconditions at plan time. Cloud-provider-specific configuration (AWS IAM role ARN, Azure credentials) is merged into the Helm values via `locals.all_config`, and an optional `worker` block is encoded with `yamlencode` and appended as a second Helm values layer. ## Features -- Deploys nullplatform-agent Helm chart with cloud-provider-specific environment variable injection for AWS, GCP, Azure, and OCI -- Enforces cross-variable preconditions at plan time using terraform_data lifecycle blocks for required provider credentials -- Triggers full Helm release replacement when the API key changes via a terraform_data input tracker -- Configures agent Git repository scope and extra repositories by merging and deduplicating entries into a comma-separated list -- Supports optional worker orchestration configuration including allowedRegistries, patches, idleTTL, and rules passed as a second Helm values layer -- Renders agent arguments and environment variables from a YAML template supporting tags, API key, cluster name, domain, DNS type, and ingress paths -- Supports Istio ingress with required service_template, initial_ingress_path, and blue_green_ingress_path via precondition validation +- Deploys nullplatform-agent Helm chart with strictly pinned chart version, agent image tag, and traffic manager image tag to prevent unintended drift +- Configures cloud-provider-specific environment variables for AWS (IAM role ARN), Azure (client credentials, subscription, resource group, tenant), GCP, and OCI +- Assembles agent repository list from a primary scope repo with pinned git tag and optional extra repos, each requiring a fixed ref fragment +- Enforces cross-variable preconditions at plan time ensuring required cloud credentials are present and Istio ingress paths are configured when needed +- Supports worker orchestration configuration via a structured `worker` block merged as a second Helm values layer for allowedRegistries, patches, and idleTTL +- Triggers full Helm release replacement when the API key changes via a `terraform_data` lifecycle dependency +- Accepts arbitrary extra environment variables via `extra_envs` to override or extend the default agent configuration ## Basic Usage ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.20.0" + + agent_repos_scope_tag = "your-agent-repos-scope-tag" + agent_traffic_manager_tag = "your-agent-traffic-manager-tag" + api_key = "your-api-key" + cloud_provider = "your-cloud-provider" + cluster_name = "your-cluster-name" + image_tag = "your-image-tag" + nullplatform_agent_helm_version = "your-nullplatform-agent-helm-version" + tags_selectors = "your-tags-selectors" +} +``` + +### Usage with AWS Cloud Provider - api_key = "your-api-key" - cloud_provider = "your-cloud-provider" - cluster_name = "your-cluster-name" - image_tag = "your-image-tag" - tags_selectors = "your-tags-selectors" +```hcl +module "agent" { + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.20.0" + + agent_repos_scope_tag = "your-agent-repos-scope-tag" + agent_traffic_manager_tag = "your-agent-traffic-manager-tag" + api_key = "your-api-key" + aws_iam_role_arn = "your-aws-iam-role-arn" # Required when cloud_provider = "aws" + cloud_provider = "aws" + cluster_name = "your-cluster-name" + image_tag = "your-image-tag" + nullplatform_agent_helm_version = "your-nullplatform-agent-helm-version" + tags_selectors = "your-tags-selectors" } ``` -### Usage with AWS +### Usage with GCP Cloud Provider ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.19.1" - - api_key = "your-api-key" - aws_iam_role_arn = "your-aws-iam-role-arn" # Required when cloud_provider = "aws" - cloud_provider = "aws" - cluster_name = "your-cluster-name" - image_tag = "your-image-tag" - tags_selectors = "your-tags-selectors" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.20.0" + + agent_repos_scope_tag = "your-agent-repos-scope-tag" + agent_traffic_manager_tag = "your-agent-traffic-manager-tag" + api_key = "your-api-key" + cloud_provider = "gcp" + cluster_name = "your-cluster-name" + image_tag = "your-image-tag" + nullplatform_agent_helm_version = "your-nullplatform-agent-helm-version" + tags_selectors = "your-tags-selectors" } ``` -### Usage with GCP +### Usage with Azure Cloud Provider ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.20.0" + + agent_repos_scope_tag = "your-agent-repos-scope-tag" + agent_traffic_manager_tag = "your-agent-traffic-manager-tag" + api_key = "your-api-key" + azure_client_id = "your-azure-client-id" # Required when cloud_provider = "azure" + azure_client_secret = "your-azure-client-secret" # Required when cloud_provider = "azure" + azure_resource_group = "your-azure-resource-group" # Required when cloud_provider = "azure" + azure_subscription_id = "your-azure-subscription-id" # Required when cloud_provider = "azure" + azure_tenant_id = "your-azure-tenant-id" # Required when cloud_provider = "azure" + cloud_provider = "azure" + cluster_name = "your-cluster-name" + image_tag = "your-image-tag" + nullplatform_agent_helm_version = "your-nullplatform-agent-helm-version" + private_hosted_zone_rg = "your-private-hosted-zone-rg" # Required when cloud_provider = "azure" + tags_selectors = "your-tags-selectors" +} +``` + +### Usage with OCI Cloud Provider - api_key = "your-api-key" - cloud_provider = "gcp" - cluster_name = "your-cluster-name" - image_tag = "your-image-tag" - tags_selectors = "your-tags-selectors" +```hcl +module "agent" { + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.20.0" + + agent_repos_scope_tag = "your-agent-repos-scope-tag" + agent_traffic_manager_tag = "your-agent-traffic-manager-tag" + api_key = "your-api-key" + cloud_provider = "oci" + cluster_name = "your-cluster-name" + image_tag = "your-image-tag" + nullplatform_agent_helm_version = "your-nullplatform-agent-helm-version" + tags_selectors = "your-tags-selectors" } ``` -### Usage with Azure +### Usage with Pinned Helm Chart Version ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.19.1" - - api_key = "your-api-key" - azure_client_id = "your-azure-client-id" # Required when cloud_provider = "azure" - azure_client_secret = "your-azure-client-secret" # Required when cloud_provider = "azure" - azure_resource_group = "your-azure-resource-group" # Required when cloud_provider = "azure" - azure_subscription_id = "your-azure-subscription-id" # Required when cloud_provider = "azure" - azure_tenant_id = "your-azure-tenant-id" # Required when cloud_provider = "azure" - cloud_provider = "azure" - cluster_name = "your-cluster-name" - image_tag = "your-image-tag" - private_hosted_zone_rg = "your-private-hosted-zone-rg" # Required when cloud_provider = "azure" - tags_selectors = "your-tags-selectors" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.20.0" + + agent_repos_scope_tag = "your-agent-repos-scope-tag" + agent_traffic_manager_tag = "your-agent-traffic-manager-tag" + api_key = "your-api-key" + cloud_provider = "your-cloud-provider" + cluster_name = "your-cluster-name" + image_tag = "your-image-tag" + nullplatform_agent_helm_version = "fixed semver (e.g. 2.37.0)" + tags_selectors = "your-tags-selectors" } ``` -### Usage with OCI +### Usage with Pinned Scope Repository Tag ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.20.0" + + agent_repos_scope = "your-agent-repos-scope" # Required when agent_repos_scope_tag = "fixed git tag (e.g. v1.15.1)" + agent_repos_scope_tag = "fixed git tag (e.g. v1.15.1)" + agent_traffic_manager_tag = "your-agent-traffic-manager-tag" + api_key = "your-api-key" + cloud_provider = "your-cloud-provider" + cluster_name = "your-cluster-name" + image_tag = "your-image-tag" + nullplatform_agent_helm_version = "your-nullplatform-agent-helm-version" + tags_selectors = "your-tags-selectors" +} +``` + +### Usage with Pinned Traffic Manager Tag - api_key = "your-api-key" - cloud_provider = "oci" - cluster_name = "your-cluster-name" - image_tag = "your-image-tag" - tags_selectors = "your-tags-selectors" +```hcl +module "agent" { + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.20.0" + + agent_repos_scope_tag = "your-agent-repos-scope-tag" + agent_traffic_manager_tag = "fixed semver (e.g. 1.8.0)" + api_key = "your-api-key" + cloud_provider = "your-cloud-provider" + cluster_name = "your-cluster-name" + image_tag = "your-image-tag" + nullplatform_agent_helm_version = "your-nullplatform-agent-helm-version" + tags_selectors = "your-tags-selectors" } ``` @@ -131,8 +198,11 @@ resource "example_resource" "this" { | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| -| [agent\_repos\_extra](#input\_agent\_repos\_extra) | List of additional Git repositories used for extended agent configuration | `list(string)` | `[]` | no | -| [agent\_repos\_scope](#input\_agent\_repos\_scope) | Git repository URL containing agent scope configurations (format: repo#branch) | `string` | `"https://github.com/nullplatform/scopes.git#main"` | no | +| [agent\_repos\_extra](#input\_agent\_repos\_extra) | List of additional Git repositories used for extended agent configuration. Each entry MUST carry a pinned ref fragment (repo.git#v1.2.3); moving refs are rejected. Covers scopes-* and services-* without enumerating them. | `list(string)` | `[]` | no | +| [agent\_repos\_scope](#input\_agent\_repos\_scope) | Git repository URL containing agent scope configurations, WITHOUT the ref fragment. The ref goes in agent\_repos\_scope\_tag. | `string` | `"https://github.com/nullplatform/scopes.git"` | no | +| [agent\_repos\_scope\_tag](#input\_agent\_repos\_scope\_tag) | Git tag of the scopes repository to clone. No default: every install pins this deliberately so the agent cannot pick up scope changes it was never rolled out with — see VERSIONS.md. | `string` | n/a | yes | +| [agent\_traffic\_manager\_repository](#input\_agent\_traffic\_manager\_repository) | Container image repository for the traffic manager. Defaults to the official nullplatform image; override to pull from a mirror. Matches the pattern nullplatform/base uses for its own images. | `string` | `"public.ecr.aws/nullplatform/k8s-traffic-manager"` | no | +| [agent\_traffic\_manager\_tag](#input\_agent\_traffic\_manager\_tag) | No default: every install pins this deliberately — see VERSIONS.md. Image tag for the traffic manager, published to the agent as TRAFFIC\_CONTAINER\_IMAGE. Pinning this used to mean passing the whole image string through extra\_envs; the registry lives here so only the tag is exposed. extra\_envs still takes precedence for anyone who needs a digest or a mirrored path. | `string` | n/a | yes | | [api\_key](#input\_api\_key) | API key for authenticating with the nullplatform API | `string` | n/a | yes | | [aws\_iam\_role\_arn](#input\_aws\_iam\_role\_arn) | ARN of the AWS IAM role assigned to the agent | `string` | `""` | no | | [azure\_client\_id](#input\_azure\_client\_id) | Azure client ID for authentication | `string` | `null` | no | @@ -152,7 +222,7 @@ resource "example_resource" "this" { | [init\_scripts](#input\_init\_scripts) | List of initialization scripts to execute during agent startup | `list(string)` | `[]` | no | | [initial\_ingress\_path](#input\_initial\_ingress\_path) | Defines the initial ingress path used when deploying the application for the first time. Required when extra\_envs.INGRESS\_TYPE is 'istio' — the k8s scope's default template is AWS ALB Ingress and won't route traffic correctly through Istio, so it must be pointed at an Istio HTTPRoute template instead. | `string` | `""` | no | | [namespace](#input\_namespace) | Kubernetes namespace where the nullplatform agent will run | `string` | `"nullplatform-tools"` | no | -| [nullplatform\_agent\_helm\_version](#input\_nullplatform\_agent\_helm\_version) | Version of the nullplatform agent Helm chart to deploy | `string` | `"2.37.0"` | no | +| [nullplatform\_agent\_helm\_version](#input\_nullplatform\_agent\_helm\_version) | No default: every install pins this deliberately — see VERSIONS.md. Version of the nullplatform agent Helm chart to deploy | `string` | n/a | yes | | [private\_gateway\_name](#input\_private\_gateway\_name) | Name of the private/internal gateway used for routing | `string` | `"gateway-private"` | no | | [private\_hosted\_zone\_rg](#input\_private\_hosted\_zone\_rg) | Resource group for private hosted zone | `string` | `null` | no | | [public\_gateway\_name](#input\_public\_gateway\_name) | Name of the public gateway used for routing | `string` | `"gateway-public"` | no | @@ -167,16 +237,16 @@ resource "example_resource" "this" { diff --git a/nullplatform/api_key/README.md b/nullplatform/api_key/README.md index 13c3a6583..cc7e1fde5 100644 --- a/nullplatform/api_key/README.md +++ b/nullplatform/api_key/README.md @@ -21,7 +21,7 @@ The module creates a single nullplatform_api_key resource whose name, grants, an ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.20.0" type = "your-type" } @@ -31,7 +31,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.20.0" nrn = "your-nrn" # Required when type = "agent" type = "agent" @@ -42,7 +42,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.20.0" nrn = "your-nrn" # Required when type = "scope_notification" specification_slug = "your-specification-slug" # Required when type = "scope_notification" @@ -54,7 +54,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.20.0" nrn = "your-nrn" # Required when type = "service_notification" specification_slug = "your-specification-slug" # Required when type = "service_notification" @@ -66,7 +66,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.20.0" custom_grants = "your-custom-grants" # Required when type = "custom" custom_name = "your-custom-name" # Required when type = "custom" diff --git a/nullplatform/asset/docker_server/README.md b/nullplatform/asset/docker_server/README.md index fa777e547..6cc3a4aa5 100644 --- a/nullplatform/asset/docker_server/README.md +++ b/nullplatform/asset/docker_server/README.md @@ -21,7 +21,7 @@ Creates a nullplatform_provider_config resource of type 'docker-server' with enc ```hcl module "docker_server" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/docker_server?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/docker_server?ref=v6.20.0" login_server = "your-login-server" nrn = "your-nrn" diff --git a/nullplatform/asset/ecr/README.md b/nullplatform/asset/ecr/README.md index db1053f81..7341450b3 100644 --- a/nullplatform/asset/ecr/README.md +++ b/nullplatform/asset/ecr/README.md @@ -21,7 +21,7 @@ The module reads the current AWS region via the aws_region data source and combi ```hcl module "ecr" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/ecr?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/ecr?ref=v6.20.0" application_role_arn = "your-application-role-arn" build_workflow_access_key_id = "your-build-workflow-access-key-id" diff --git a/nullplatform/asset/s3/README.md b/nullplatform/asset/s3/README.md index a45d79983..c84dd20fd 100644 --- a/nullplatform/asset/s3/README.md +++ b/nullplatform/asset/s3/README.md @@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type s3-con ```hcl module "s3" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/s3?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/s3?ref=v6.20.0" bucket_name = "your-bucket-name" nrn = "your-nrn" diff --git a/nullplatform/base/README.md b/nullplatform/base/README.md index fcb03c9fc..e33c9dcea 100644 --- a/nullplatform/base/README.md +++ b/nullplatform/base/README.md @@ -2,85 +2,103 @@ ## Description -Deploys the nullplatform base Helm chart onto a Kubernetes cluster across multiple cloud providers with configurable networking, logging, and observability integrations +Deploys the nullplatform base Helm chart to a Kubernetes cluster with pre-created namespaces and multi-cloud gateway, logging, and observability configuration across EKS, GKE, AKS, OKE, and ARO providers ## Architecture -The module creates two kubernetes_namespace_v1 resources (nullplatform-tools and nullplatform) to pre-seed namespaces before chart installation, then deploys a helm_release resource pointing to the nullplatform-base chart from the nullplatform GitHub Helm registry. A templatefile-rendered local (nullplatform_base_values) merges all input variables into a YAML values file that is passed directly to the helm_release, controlling everything from gateway topology and ingress controllers to logging backends and observability pipelines. Outputs surface provider-specific security resource identifiers (AWS security group IDs, Azure NSG IDs, GCP firewall names) that are expected to originate from companion security submodules. +The module creates two kubernetes_namespace_v1 resources ('nullplatform-tools' and 'nullplatform') before deploying a helm_release named 'nullplatform-base' from the nullplatform Helm repository, using a templatefile-rendered locals block to produce the chart values. All provider-specific gateway settings (AWS security groups, Azure NSGs, GCP firewall rules, OCI subnets), logging backends (Loki, GELF, Datadog, Dynatrace, New Relic, CloudWatch), ingress controllers, and control plane agent image coordinates are wired from input variables into the template and passed as the helm_release values argument. Outputs expose the rendered Helm values and cloud-specific gateway security resource identifiers (security group IDs, NSG IDs, firewall names) for consumption by upstream modules. ## Features -- Creates kubernetes_namespace_v1 resources for nullplatform-tools and nullplatform to prevent Helm lookup race conditions -- Deploys nullplatform-base helm_release with full values rendered from a templatefile covering gateways, ingress, logging, and observability -- Configures public and private gateway resources with per-cloud security group, NSG, firewall, and OCI subnet annotations -- Supports multi-provider observability integrations including Prometheus, Loki, GELF, Dynatrace, Datadog, New Relic, and CloudWatch -- Configures ingress controllers with independent public and private scopes, names, and domains -- Enables optional control plane agent deployment with configurable image repository and tag -- Supports image pull secrets for private container registries across all Kubernetes providers +- Creates kubernetes_namespace_v1 resources for 'nullplatform-tools' and 'nullplatform' with Helm-compatible labels and annotations before chart installation +- Deploys helm_release 'nullplatform-base' with pinned chart version, 600-second timeout, and job completion waiting to ensure deterministic installs +- Configures multi-cloud gateway resources (AWS, Azure, GCP, OCI) with provider-specific security groups, NSGs, firewall rules, and subnet annotations +- Supports multiple observability backends including Prometheus, GELF, Loki, Dynatrace, Datadog, New Relic, and CloudWatch with per-backend enable flags +- Renders all Helm values via a templatefile from a YAML template, converting Terraform booleans and variables into chart-compatible strings +- Enforces pinned non-moving version references for Helm chart version, control plane agent image tag, and logging controller image tag via validation rules +- Configures public and private ingress controllers and Gateway API resources with per-controller scope, domain, and enablement settings ## Basic Usage ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.20.0" - k8s_provider = "your-k8s-provider" - np_api_key = "your-np-api-key" + control_plane_agent_image_tag = "your-control-plane-agent-image-tag" + k8s_provider = "your-k8s-provider" + logging_controller_image_tag = "your-logging-controller-image-tag" + np_api_key = "your-np-api-key" + nullplatform_base_helm_version = "your-nullplatform-base-helm-version" } ``` -### Usage with Amazon EKS +### Usage with EKS (Amazon Elastic Kubernetes Service) ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.20.0" - k8s_provider = "eks" - np_api_key = "your-np-api-key" + control_plane_agent_image_tag = "your-control-plane-agent-image-tag" + k8s_provider = "eks" + logging_controller_image_tag = "your-logging-controller-image-tag" + np_api_key = "your-np-api-key" + nullplatform_base_helm_version = "your-nullplatform-base-helm-version" } ``` -### Usage with Google GKE +### Usage with GKE (Google Kubernetes Engine) ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.20.0" - k8s_provider = "gke" - np_api_key = "your-np-api-key" + control_plane_agent_image_tag = "your-control-plane-agent-image-tag" + k8s_provider = "gke" + logging_controller_image_tag = "your-logging-controller-image-tag" + np_api_key = "your-np-api-key" + nullplatform_base_helm_version = "your-nullplatform-base-helm-version" } ``` -### Usage with Azure AKS +### Usage with AKS (Azure Kubernetes Service) ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.20.0" - k8s_provider = "aks" - np_api_key = "your-np-api-key" + control_plane_agent_image_tag = "your-control-plane-agent-image-tag" + k8s_provider = "aks" + logging_controller_image_tag = "your-logging-controller-image-tag" + np_api_key = "your-np-api-key" + nullplatform_base_helm_version = "your-nullplatform-base-helm-version" } ``` -### Usage with Oracle OKE +### Usage with OKE (Oracle Container Engine for Kubernetes) ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.20.0" - k8s_provider = "oke" - np_api_key = "your-np-api-key" + control_plane_agent_image_tag = "your-control-plane-agent-image-tag" + k8s_provider = "oke" + logging_controller_image_tag = "your-logging-controller-image-tag" + np_api_key = "your-np-api-key" + nullplatform_base_helm_version = "your-nullplatform-base-helm-version" } ``` -### Usage with Azure Red Hat OpenShift (ARO) +### Usage with ARO (Azure Red Hat OpenShift) ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.20.0" - k8s_provider = "aro" - np_api_key = "your-np-api-key" + control_plane_agent_image_tag = "your-control-plane-agent-image-tag" + k8s_provider = "aro" + logging_controller_image_tag = "your-logging-controller-image-tag" + np_api_key = "your-np-api-key" + nullplatform_base_helm_version = "your-nullplatform-base-helm-version" } ``` @@ -128,7 +146,7 @@ resource "example_resource" "this" { | [cloudwatch\_performance\_metrics\_enabled](#input\_cloudwatch\_performance\_metrics\_enabled) | Enable performance metrics in CloudWatch. | `bool` | `false` | no | | [cloudwatch\_service\_account\_annotations](#input\_cloudwatch\_service\_account\_annotations) | Annotations for the logs controller ServiceAccount (nullplatform-pod-metadata-reader-sa). Rendered only when cloudwatch\_enabled is true. Set eks.amazonaws.com/role-arn here to use IRSA instead of the node instance role. | `map(string)` | `{}` | no | | [control\_plane\_agent\_image\_repository](#input\_control\_plane\_agent\_image\_repository) | Container image repository for the control plane agent. | `string` | `"public.ecr.aws/nullplatform/controlplane-agent"` | no | -| [control\_plane\_agent\_image\_tag](#input\_control\_plane\_agent\_image\_tag) | Container image tag for the control plane agent. | `string` | `"0.9.2"` | no | +| [control\_plane\_agent\_image\_tag](#input\_control\_plane\_agent\_image\_tag) | No default: every install pins this deliberately — see VERSIONS.md. Container image tag for the control plane agent. | `string` | n/a | yes | | [control\_plane\_enabled](#input\_control\_plane\_enabled) | Enable the control plane. | `bool` | `false` | no | | [datadog\_api\_key](#input\_datadog\_api\_key) | Datadog API key. | `string` | `""` | no | | [datadog\_enabled](#input\_datadog\_enabled) | Enable Datadog integration. | `bool` | `false` | no | @@ -178,7 +196,7 @@ resource "example_resource" "this" { | [k8s\_provider](#input\_k8s\_provider) | Cloud provider (eks, gke, aks, oke and aro). | `string` | n/a | yes | | [logging\_application\_logs\_enabled](#input\_logging\_application\_logs\_enabled) | Enable application log forwarding. Set to false to keep only http/sys metrics pipelines active across all providers. | `bool` | `true` | no | | [logging\_controller\_image\_repository](#input\_logging\_controller\_image\_repository) | Container image repository for the logs controller DaemonSet. | `string` | `"public.ecr.aws/nullplatform/k8s-logs-controller"` | no | -| [logging\_controller\_image\_tag](#input\_logging\_controller\_image\_tag) | Container image tag for the logs controller DaemonSet. | `string` | `"1.6.0"` | no | +| [logging\_controller\_image\_tag](#input\_logging\_controller\_image\_tag) | No default: every install pins this deliberately — see VERSIONS.md. Container image tag for the logs controller DaemonSet. | `string` | n/a | yes | | [logging\_enabled](#input\_logging\_enabled) | Enable the logging layer. | `bool` | `true` | no | | [logging\_mount\_docker\_containers](#input\_logging\_mount\_docker\_containers) | Mount Docker container log paths. Enable when using Docker container runtime (e.g. Minikube). | `bool` | `false` | no | | [loki\_bearer\_token](#input\_loki\_bearer\_token) | Loki bearer token (if applicable). | `string` | `""` | no | @@ -195,7 +213,7 @@ resource "example_resource" "this" { | [newrelic\_metrics\_enabled](#input\_newrelic\_metrics\_enabled) | Enable metrics forwarding to New Relic. Set to false to send only logs. | `bool` | `true` | no | | [newrelic\_region](#input\_newrelic\_region) | New Relic region (e.g., US, EU). | `string` | `""` | no | | [np\_api\_key](#input\_np\_api\_key) | Nullplatform API key for authentication (account level). | `string` | n/a | yes | -| [nullplatform\_base\_helm\_version](#input\_nullplatform\_base\_helm\_version) | Helm chart version for the nullplatform base. | `string` | `"2.44.0"` | no | +| [nullplatform\_base\_helm\_version](#input\_nullplatform\_base\_helm\_version) | No default: every install pins this deliberately — see VERSIONS.md. Helm chart version for the nullplatform base. | `string` | n/a | yes | | [prometheus\_enabled](#input\_prometheus\_enabled) | Enable the Prometheus exporter. | `bool` | `true` | no | | [tls\_required](#input\_tls\_required) | Whether TLS is required. | `bool` | `true` | no | @@ -215,16 +233,16 @@ resource "example_resource" "this" { diff --git a/nullplatform/cloud/aws/cloud/README.md b/nullplatform/cloud/aws/cloud/README.md index 94dcd3697..73305ffbb 100644 --- a/nullplatform/cloud/aws/cloud/README.md +++ b/nullplatform/cloud/aws/cloud/README.md @@ -21,7 +21,7 @@ The module uses data sources aws_caller_identity and aws_region to dynamically r ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/cloud?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/cloud?ref=v6.20.0" domain_name = "your-domain-name" hosted_private_zone_id = "your-hosted-private-zone-id" diff --git a/nullplatform/cloud/aws/vpc/README.md b/nullplatform/cloud/aws/vpc/README.md index 89b288a5f..08a96c139 100644 --- a/nullplatform/cloud/aws/vpc/README.md +++ b/nullplatform/cloud/aws/vpc/README.md @@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource of type aws-ne ```hcl module "vpc" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/vpc?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/vpc?ref=v6.20.0" nrn = "your-nrn" vpc_id = "your-vpc-id" diff --git a/nullplatform/cloud/azure/cloud/README.md b/nullplatform/cloud/azure/cloud/README.md index 606729c6f..d59bd2af8 100644 --- a/nullplatform/cloud/azure/cloud/README.md +++ b/nullplatform/cloud/azure/cloud/README.md @@ -22,7 +22,7 @@ The module creates a single nullplatform_provider_config resource of type 'azure ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/azure/cloud?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/azure/cloud?ref=v6.20.0" azure_resource_group_name = "your-azure-resource-group-name" nrn = "your-nrn" diff --git a/nullplatform/cloud/gcp/cloud/README.md b/nullplatform/cloud/gcp/cloud/README.md index 3deedc72a..f3a718725 100644 --- a/nullplatform/cloud/gcp/cloud/README.md +++ b/nullplatform/cloud/gcp/cloud/README.md @@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type 'googl ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/gcp/cloud?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/gcp/cloud?ref=v6.20.0" domain_name = "your-domain-name" location = "your-location" diff --git a/nullplatform/cloud/oci/cloud/README.md b/nullplatform/cloud/oci/cloud/README.md index cd9513ff3..a1d62963a 100644 --- a/nullplatform/cloud/oci/cloud/README.md +++ b/nullplatform/cloud/oci/cloud/README.md @@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type 'oci-c ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/oci/cloud?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/oci/cloud?ref=v6.20.0" account_id = "your-account-id" account_name = "your-account-name" diff --git a/nullplatform/code_repository/README.md b/nullplatform/code_repository/README.md index 648ddd6b7..a3bbee454 100644 --- a/nullplatform/code_repository/README.md +++ b/nullplatform/code_repository/README.md @@ -22,7 +22,7 @@ The module uses local boolean flags (is_gitlab, is_github, is_azure, is_bitbucke ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.20.0" git_provider = "your-git-provider" nrn = "your-nrn" @@ -33,7 +33,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.20.0" git_provider = "github" github_installation_id = "your-github-installation-id" # Required when git_provider = "github" @@ -46,7 +46,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.20.0" git_provider = "gitlab" gitlab_access_token = "your-gitlab-access-token" # Required when git_provider = "gitlab" @@ -62,7 +62,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.20.0" azure_access_token = "your-azure-access-token" # Required when git_provider = "azure" azure_agent_pool = "your-azure-agent-pool" # Required when git_provider = "azure" @@ -76,7 +76,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.20.0" bitbucket_collaborators = "your-bitbucket-collaborators" # Required when git_provider = "bitbucket" bitbucket_installation_url = "your-bitbucket-installation-url" # Required when git_provider = "bitbucket" diff --git a/nullplatform/container_orchestration/aks/README.md b/nullplatform/container_orchestration/aks/README.md index 4e88bb96c..d241f8f60 100644 --- a/nullplatform/container_orchestration/aks/README.md +++ b/nullplatform/container_orchestration/aks/README.md @@ -2,31 +2,75 @@ ## Description -Configures an AKS cluster in the Nullplatform by creating a provider configuration resource that encapsulates cluster settings, gateway configuration, resource management policies, and security parameters +Configures an AKS cluster provider configuration in Nullplatform by encoding cluster, gateway, resource management, security, and traffic manager settings into a nullplatform_provider_config resource ## Architecture -The module builds a local.attributes map that aggregates cluster metadata, gateway specs, resource limits, and security settings, then passes this JSON-encoded structure to the nullplatform_provider_config resource of type aks-configuration. Inputs like cluster_name, resource_group, and gateway names flow into the attributes map, while optional blocks for resource_management and security are conditionally included based on non-empty variables. The resulting provider configuration is registered against the given NRN in the Nullplatform. +The module constructs a set of locals that merge optional and required inputs into structured maps representing cluster identity, gateway configuration, resource management ratios, and security settings. These locals are JSON-encoded and passed as the attributes argument to a single nullplatform_provider_config resource of type aks-configuration, keyed by the provided NRN and optional dimensions. The traffic_manager_version is always included in the attributes payload, while fields like authentication_mode, private_gateway_name, image_pull_secrets, service_account_name, resource_management ratios, and object_modifiers are conditionally included only when non-empty values are provided. ## Features -- Creates Nullplatform provider configuration for AKS clusters -- Configures public and optional private Application Gateway references -- Supports resource quotas for CPU/memory ratios and core limits -- Manages image pull secrets and service account mappings -- Enables traffic manager sidecar version specification -- Applies dynamic object modifiers for Kubernetes resources +- Creates a nullplatform_provider_config resource of type aks-configuration scoped to a Nullplatform NRN +- Encodes AKS cluster identity including name, resource group, and default application namespace +- Configures public and optionally private Application Gateway references within the Istio ingress namespace +- Pins traffic manager sidecar container to a fixed, explicitly declared version tag +- Conditionally includes resource management tuning parameters such as memory-to-CPU ratio and max milicores +- Supports optional Kubernetes security settings including image pull secrets and service account name +- Applies dynamic Kubernetes object modifiers when object_modifiers list is provided ## Basic Usage ```hcl module "aks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.20.0" - cluster_name = "your-cluster-name" - nrn = "your-nrn" - public_gateway_name = "your-public-gateway-name" - resource_group = "your-resource-group" + cluster_name = "your-cluster-name" + nrn = "your-nrn" + public_gateway_name = "your-public-gateway-name" + resource_group = "your-resource-group" + traffic_manager_version = "your-traffic-manager-version" +} +``` + +### Usage with Fixed Version Tag + +```hcl +module "aks" { + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.20.0" + + cluster_name = "your-cluster-name" + nrn = "your-nrn" + public_gateway_name = "your-public-gateway-name" + resource_group = "your-resource-group" + traffic_manager_version = "latest" +} +``` + +### Usage with Fixed Version Tag + +```hcl +module "aks" { + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.20.0" + + cluster_name = "your-cluster-name" + nrn = "your-nrn" + public_gateway_name = "your-public-gateway-name" + resource_group = "your-resource-group" + traffic_manager_version = "main" +} +``` + +### Usage with Fixed Version Tag + +```hcl +module "aks" { + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.20.0" + + cluster_name = "your-cluster-name" + nrn = "your-nrn" + public_gateway_name = "your-public-gateway-name" + resource_group = "your-resource-group" + traffic_manager_version = "master" } ``` @@ -78,21 +122,22 @@ resource "example_resource" "this" { | [public\_gateway\_name](#input\_public\_gateway\_name) | Name of the public Application Gateway in AKS | `string` | n/a | yes | | [resource\_group](#input\_resource\_group) | Name of the resource group containing the AKS cluster | `string` | n/a | yes | | [service\_account\_name](#input\_service\_account\_name) | The name of the Kubernetes service account used for deployments | `string` | `""` | no | -| [traffic\_manager\_version](#input\_traffic\_manager\_version) | Tag for the traffic manager sidecar container | `string` | `""` | no | +| [traffic\_manager\_version](#input\_traffic\_manager\_version) | No default: every install pins this deliberately — see VERSIONS.md. Tag for the traffic manager sidecar container | `string` | n/a | yes | diff --git a/nullplatform/container_orchestration/eks/README.md b/nullplatform/container_orchestration/eks/README.md index 6bb568e3b..b86c9bafb 100644 --- a/nullplatform/container_orchestration/eks/README.md +++ b/nullplatform/container_orchestration/eks/README.md @@ -2,30 +2,67 @@ ## Description -Configures a Nullplatform EKS provider configuration resource with cluster, load balancer, networking, resource management, security, and traffic manager settings +Configures a Nullplatform EKS provider by creating a nullplatform_provider_config resource that encodes cluster, load balancer, network, resource management, security, and traffic manager settings as structured JSON attributes ## Architecture -The module assembles a set of structured locals by merging optional variables into nested maps for cluster, balancer, network, resource_management, security, and traffic_manager configurations. All assembled locals are merged into a single attributes map and JSON-encoded before being passed to a single nullplatform_provider_config resource of type eks-configuration. Input variables flow directly into the locals merge logic, where empty strings and null values are conditionally excluded to avoid sending unset fields to the provider API. The nrn and dimensions variables are passed directly to the nullplatform_provider_config resource to identify and scope the configuration. +The module assembles multiple local maps (cluster, balancer, network, resource_management, security, traffic_manager) from input variables and merges them into a single attributes object that is JSON-encoded. A single nullplatform_provider_config resource of type 'eks-configuration' is created using the nrn, dimensions, and the encoded attributes payload. Optional fields are conditionally included in the merged locals only when their values are non-empty or non-null, preventing unnecessary keys from appearing in the provider configuration. The resulting resource registers the EKS cluster configuration within the Nullplatform control plane. ## Features -- Creates a nullplatform_provider_config resource of type eks-configuration to register EKS cluster settings with the Nullplatform platform -- Configures public and private ALB load balancers with support for additional balancers to scale beyond the 100-rule ALB limit -- Enforces ALB naming validation ensuring names are 1-32 alphanumeric characters with hyphens and no leading or trailing hyphens -- Configures traffic manager sidecar container version and pod-binding port with range validation between 1 and 65535 -- Supports resource management tuning via memory-to-CPU ratio, memory request-to-limit ratio, max CPU cores multiplier, and max milicores -- Configures Kubernetes security settings including image pull secrets and a custom service account name -- Supports dynamic Kubernetes object modifiers for patching deployed k8s resources via selector, action, type, and value +- Creates a nullplatform_provider_config resource that registers EKS cluster configuration with the Nullplatform control plane +- Configures ALB load balancer settings including public, private, additional balancers, and capacity thresholds with 50–99% rule usage validation +- Pins the traffic manager sidecar container to a fixed version tag, preventing unintended upgrades from moving references like latest or main +- Configures traffic manager sidecar port binding with a valid 1–65535 range, supporting environments that restrict pod-to-pod traffic on port 80 +- Manages Kubernetes resource allocation ratios including memory-to-CPU ratio, request-to-limit ratio, and maximum milicores per pod +- Supports dynamic Kubernetes object modification via configurable object_modifiers with selector, action, type, and value fields +- Configures security context including image pull secrets and Kubernetes service account name for deployment workloads ## Basic Usage ```hcl module "eks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.20.0" - cluster_name = "your-cluster-name" - nrn = "your-nrn" + cluster_name = "your-cluster-name" + nrn = "your-nrn" + traffic_manager_version = "your-traffic-manager-version" +} +``` + +### Usage with Pinned Release Version + +```hcl +module "eks" { + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.20.0" + + cluster_name = "your-cluster-name" + nrn = "your-nrn" + traffic_manager_version = "latest" +} +``` + +### Usage with Pinned Release Version + +```hcl +module "eks" { + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.20.0" + + cluster_name = "your-cluster-name" + nrn = "your-nrn" + traffic_manager_version = "main" +} +``` + +### Usage with Pinned Release Version + +```hcl +module "eks" { + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.20.0" + + cluster_name = "your-cluster-name" + nrn = "your-nrn" + traffic_manager_version = "master" } ``` @@ -79,23 +116,23 @@ resource "example_resource" "this" { | [public\_balancer\_name](#input\_public\_balancer\_name) | The name of the public-facing load balancer for external traffic routing | `string` | `""` | no | | [service\_account\_name](#input\_service\_account\_name) | The name of the Kubernetes service account used for deployments | `string` | `""` | no | | [traffic\_manager\_port](#input\_traffic\_manager\_port) | Port the traffic manager sidecar binds inside the pod. Defaults to 80 when unset. Set a different port (10080 recommended) when the cluster does not allow pod-to-pod traffic on port 80, which surfaces as a healthy pod that receives no traffic because kubelet probes are node-local and bypass the filtering. Open the port for pod-to-pod traffic before setting this value | `number` | `null` | no | -| [traffic\_manager\_version](#input\_traffic\_manager\_version) | Tag for the traffic manager sidecar container | `string` | `"latest"` | no | +| [traffic\_manager\_version](#input\_traffic\_manager\_version) | No default: every install pins this deliberately — see VERSIONS.md. Pinned rather than tracking latest: a moving tag means a pod restart can pull a different build with no apply in between. Tag for the traffic manager sidecar container | `string` | n/a | yes | | [use\_nullplatform\_namespace](#input\_use\_nullplatform\_namespace) | When enabled, uses the nullplatform system namespace instead of a custom namespace | `bool` | `false` | no | diff --git a/nullplatform/container_orchestration/gke/README.md b/nullplatform/container_orchestration/gke/README.md index 6cd1dc9f8..b55dc39c7 100644 --- a/nullplatform/container_orchestration/gke/README.md +++ b/nullplatform/container_orchestration/gke/README.md @@ -2,32 +2,75 @@ ## Description -Configures a GKE provider configuration resource in Nullplatform by encoding cluster, gateway, resource management, and security settings as a typed provider config +Configures a GKE cluster provider in Nullplatform by creating a nullplatform_provider_config resource with cluster, gateway, resource management, security, and traffic manager settings ## Architecture -The module constructs a structured attributes object using locals that merge cluster identity, gateway configuration, optional resource management ratios, security settings, and object modifiers. A single nullplatform_provider_config resource of type 'gke-configuration' is created, binding the NRN and dimensions to the JSON-encoded attributes. Input variables flow into conditional merges within locals so that optional fields like private_gateway_name, service_account_name, and traffic_manager_version are only included when non-empty. The resulting resource acts as a configuration record in the Nullplatform platform for GKE cluster integration. +The module constructs a set of locals that merge optional inputs (gateway namespace, private gateway, resource management ratios, image pull secrets, service account, object modifiers) into a structured attributes map. A single nullplatform_provider_config resource of type 'gke-configuration' is created, binding the NRN and optional dimensions to the JSON-encoded attributes map. The cluster identity (name, location, namespace), gateway configuration, traffic manager version, and security settings all flow through locals into the jsonencode(local.attributes) argument of the provider config resource. ## Features -- Creates a nullplatform_provider_config resource of type gke-configuration with cluster identity and location -- Configures public and optional private gateway references with namespace support -- Encodes resource management settings including memory/CPU ratios and max milicores when provided -- Attaches image pull secrets and Kubernetes service account name for secure workload identity -- Includes optional traffic manager sidecar version tagging -- Supports dynamic Kubernetes object modifiers for patching deployed resources -- Conditionally omits optional fields from the encoded attributes when left as empty defaults +- Creates a nullplatform_provider_config resource of type 'gke-configuration' scoped to a specific NRN +- Configures GKE cluster identity including name, location, and default application namespace +- Configures public and optionally private Istio gateway references with a configurable namespace +- Sets resource management parameters including memory-to-CPU ratio, request-to-limit ratios, and max milicores +- Pins traffic manager sidecar container to an explicit fixed version tag, rejecting moving references like latest/main/master +- Supports image pull secrets and custom Kubernetes service account name for secure workload deployments +- Applies dynamic Kubernetes object modifiers via a structured list of selector, action, type, and value entries ## Basic Usage ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.20.0" - cluster_name = "your-cluster-name" - location = "your-location" - nrn = "your-nrn" - public_gateway_name = "your-public-gateway-name" + cluster_name = "your-cluster-name" + location = "your-location" + nrn = "your-nrn" + public_gateway_name = "your-public-gateway-name" + traffic_manager_version = "your-traffic-manager-version" +} +``` + +### Usage with Latest Version (Disallowed) + +```hcl +module "gke" { + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.20.0" + + cluster_name = "your-cluster-name" + location = "your-location" + nrn = "your-nrn" + public_gateway_name = "your-public-gateway-name" + traffic_manager_version = "latest" +} +``` + +### Usage with Main Branch (Disallowed) + +```hcl +module "gke" { + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.20.0" + + cluster_name = "your-cluster-name" + location = "your-location" + nrn = "your-nrn" + public_gateway_name = "your-public-gateway-name" + traffic_manager_version = "main" +} +``` + +### Usage with Master Branch (Disallowed) + +```hcl +module "gke" { + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.20.0" + + cluster_name = "your-cluster-name" + location = "your-location" + nrn = "your-nrn" + public_gateway_name = "your-public-gateway-name" + traffic_manager_version = "master" } ``` @@ -78,22 +121,22 @@ resource "example_resource" "this" { | [private\_gateway\_name](#input\_private\_gateway\_name) | Name of the private gateway | `string` | `""` | no | | [public\_gateway\_name](#input\_public\_gateway\_name) | Name of the public gateway | `string` | n/a | yes | | [service\_account\_name](#input\_service\_account\_name) | The name of the Kubernetes service account used for deployments | `string` | `""` | no | -| [traffic\_manager\_version](#input\_traffic\_manager\_version) | Tag for the traffic manager sidecar container | `string` | `""` | no | +| [traffic\_manager\_version](#input\_traffic\_manager\_version) | No default: every install pins this deliberately — see VERSIONS.md. Tag for the traffic manager sidecar container | `string` | n/a | yes | diff --git a/nullplatform/container_orchestration/oke/README.md b/nullplatform/container_orchestration/oke/README.md index 67a1dd882..7eb214897 100644 --- a/nullplatform/container_orchestration/oke/README.md +++ b/nullplatform/container_orchestration/oke/README.md @@ -19,7 +19,7 @@ Creates a single nullplatform_provider_config resource of type 'oke' that stores ```hcl module "oke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/oke?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/oke?ref=v6.20.0" cluster_name = "your-cluster-name" nrn = "your-nrn" diff --git a/nullplatform/dimension/README.md b/nullplatform/dimension/README.md index ebebba336..77bca040b 100644 --- a/nullplatform/dimension/README.md +++ b/nullplatform/dimension/README.md @@ -19,7 +19,7 @@ The module creates a nullplatform_dimension resource using the provided name, or ```hcl module "dimension" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension?ref=v6.20.0" name = "your-name" nrn = "your-nrn" diff --git a/nullplatform/dimension_value/README.md b/nullplatform/dimension_value/README.md index c52bd8196..3c81f60c8 100644 --- a/nullplatform/dimension_value/README.md +++ b/nullplatform/dimension_value/README.md @@ -19,7 +19,7 @@ The module uses a terraform_data resource to enforce mutual-exclusivity and pres ```hcl module "dimension_value" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension_value?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension_value?ref=v6.20.0" dimension_id = "your-dimension-id" name = "your-name" diff --git a/nullplatform/identity-access-control/README.md b/nullplatform/identity-access-control/README.md index 28428dee0..9833b9e9a 100644 --- a/nullplatform/identity-access-control/README.md +++ b/nullplatform/identity-access-control/README.md @@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource named identity ```hcl module "identity-access-control" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/identity-access-control?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/identity-access-control?ref=v6.20.0" attributes = "your-attributes" nrn = "your-nrn" diff --git a/nullplatform/metrics/README.md b/nullplatform/metrics/README.md index 6f727769b..5234161b4 100644 --- a/nullplatform/metrics/README.md +++ b/nullplatform/metrics/README.md @@ -21,7 +21,7 @@ The module creates a single nullplatform_provider_config resource of type 'prome ```hcl module "metrics" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/metrics?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/metrics?ref=v6.20.0" nrn = "your-nrn" } diff --git a/nullplatform/packaged_service/README.md b/nullplatform/packaged_service/README.md index 00ef56382..c3b13959e 100644 --- a/nullplatform/packaged_service/README.md +++ b/nullplatform/packaged_service/README.md @@ -17,7 +17,7 @@ spec updates / republish correctly. ```hcl module "packaged_service" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/packaged_service?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/packaged_service?ref=v6.20.0" nrn = "organization=…:account=…:namespace=…" diff --git a/nullplatform/parameter_storage_configuration/README.md b/nullplatform/parameter_storage_configuration/README.md index b09866f41..6fef70a59 100644 --- a/nullplatform/parameter_storage_configuration/README.md +++ b/nullplatform/parameter_storage_configuration/README.md @@ -20,7 +20,7 @@ The module delegates entirely to a remote `scope_configuration` module sourced f ```hcl module "parameter_storage_configuration" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_configuration?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_configuration?ref=v6.20.0" attributes = "your-attributes" np_api_key = "your-np-api-key" diff --git a/nullplatform/parameter_storage_definition/README.md b/nullplatform/parameter_storage_definition/README.md index c89fb334e..28ec37cea 100644 --- a/nullplatform/parameter_storage_definition/README.md +++ b/nullplatform/parameter_storage_definition/README.md @@ -20,7 +20,7 @@ A data.http resource fetches the raw specification template from a configurable ```hcl module "parameter_storage_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition?ref=v6.20.0" np_api_key = "your-np-api-key" nrn = "your-nrn" diff --git a/nullplatform/parameter_storage_definition_agent_association/README.md b/nullplatform/parameter_storage_definition_agent_association/README.md index 7b0275dd1..2863f4831 100644 --- a/nullplatform/parameter_storage_definition_agent_association/README.md +++ b/nullplatform/parameter_storage_definition_agent_association/README.md @@ -21,7 +21,7 @@ The module creates a terraform_data resource to track API key changes and a null ```hcl module "parameter_storage_definition_agent_association" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition_agent_association?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition_agent_association?ref=v6.20.0" api_key = "your-api-key" nrn = "your-nrn" diff --git a/nullplatform/scope_configuration/README.md b/nullplatform/scope_configuration/README.md index 817aecc2a..f6477861c 100644 --- a/nullplatform/scope_configuration/README.md +++ b/nullplatform/scope_configuration/README.md @@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource that binds a N ```hcl module "scope_configuration" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_configuration?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_configuration?ref=v6.20.0" attributes = "your-attributes" np_api_key = "your-np-api-key" diff --git a/nullplatform/scope_definition/README.md b/nullplatform/scope_definition/README.md index e500a80a0..ec9ee812b 100644 --- a/nullplatform/scope_definition/README.md +++ b/nullplatform/scope_definition/README.md @@ -22,7 +22,7 @@ The module fetches JSON templates via data.http resources from a configurable Gi ```hcl module "scope_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition?ref=v6.20.0" np_api_key = "your-np-api-key" nrn = "your-nrn" diff --git a/nullplatform/scope_definition_agent_association/README.md b/nullplatform/scope_definition_agent_association/README.md index 368beff8b..3a40f7f70 100644 --- a/nullplatform/scope_definition_agent_association/README.md +++ b/nullplatform/scope_definition_agent_association/README.md @@ -22,7 +22,7 @@ The module fetches a notification channel JSON template via the `data.http` prov ```hcl module "scope_definition_agent_association" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition_agent_association?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition_agent_association?ref=v6.20.0" api_key = "your-api-key" nrn = "your-nrn" diff --git a/nullplatform/service_definition/README.md b/nullplatform/service_definition/README.md index ff3842cb4..7df99d7ce 100644 --- a/nullplatform/service_definition/README.md +++ b/nullplatform/service_definition/README.md @@ -2,31 +2,60 @@ ## Description -Provisions a Nullplatform service specification with its associated action and link specifications by fetching JSON templates from GitHub, GitLab, Bitbucket, or a local filesystem +Provisions nullplatform service, action, and link specifications by fetching JSON template files from a Git repository (GitHub, GitLab, Bitbucket) or local filesystem ## Architecture -The module uses data.http resources to fetch service-spec, action, and link JSON templates from a remote git provider (GitHub, GitLab, or Bitbucket) or reads them from local files when git_provider is set to 'local'. Parsed template data flows into a nullplatform_service_specification resource, which is created first and provides its ID to nullplatform_action_specification and nullplatform_link_specification resources via depends_on. Authentication headers are constructed per-provider in locals (Bearer for GitHub, PRIVATE-TOKEN for GitLab, Basic or Bearer for Bitbucket) and passed to each data.http request. +The module uses `data.http` resources to fetch `service-spec.json.tpl`, `actions/*.json.tpl`, and `links/*.json.tpl` template files from the configured Git provider using provider-specific raw content URLs and authentication headers built in locals. Parsed JSON from these HTTP responses (or local files when `git_provider = local`) flows into a `nullplatform_service_specification` resource, with dependent `nullplatform_action_specification` and `nullplatform_link_specification` resources created via `for_each` over the available action and link name lists. The service specification ID output from the primary resource is wired as input to both action and link specification resources via an explicit `depends_on` and the `service_specification_id` local. ## Features -- Creates a nullplatform_service_specification resource from a JSON template with configurable name, type, attributes, selectors, and dimensions -- Fetches service, action, and link spec templates from GitHub, GitLab, Bitbucket, or local filesystem based on git_provider -- Creates nullplatform_action_specification resources for each entry in available_actions list using fetched templates -- Creates nullplatform_link_specification resources for each entry in available_links list using fetched templates -- Configures provider-specific authentication headers including Bearer tokens, GitLab PRIVATE-TOKEN, and Bitbucket HTTP Basic auth -- Supports visibility scoping via NRN list combining the required nrn with optional extra_visibile_to_nrns -- Outputs service specification ID and slug for use by downstream modules +- Creates nullplatform_service_specification from a remote or local JSON template with configurable visibility via NRN list +- Creates nullplatform_action_specification resources for each named action template fetched from the repository +- Creates nullplatform_link_specification resources for each named link template fetched from the repository +- Supports GitHub, GitLab, Bitbucket, and local filesystem as template sources with provider-specific URL construction and auth headers +- Constructs GitHub raw content URLs with configurable ref namespace (heads, tags, or raw commit SHA) via repository_ref_type +- Authenticates to Bitbucket using either HTTP Basic (Atlassian API token) or Bearer (workspace access token) depending on bitbucket_email presence +- Validates HTTP responses with lifecycle postconditions to surface 401/403/404 errors as meaningful Terraform errors ## Basic Usage ```hcl module "service_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.20.0" - nrn = "your-nrn" - service_name = "your-service-name" - service_path = "your-service-path" + nrn = "your-nrn" + repository_branch = "your-repository-branch" + service_name = "your-service-name" + service_path = "your-service-path" +} +``` + +### Usage with GitHub Provider + +```hcl +module "service_definition" { + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.20.0" + + nrn = "your-nrn" + repository_branch = "main" + service_name = "your-service-name" + service_path = "your-service-path" +} +``` + +### Usage with Pinned Branch or Tag + +```hcl +module "service_definition" { + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.20.0" + + git_provider = "your-git-provider" # Required when repository_branch = "v1.4.0" + nrn = "your-nrn" + repository_branch = "v1.4.0" + repository_ref_type = "your-repository-ref-type" # Required when repository_branch = "v1.4.0" + service_name = "your-service-name" + service_path = "your-service-path" } ``` @@ -75,10 +104,10 @@ resource "example_resource" "this" { | [gitlab\_host](#input\_gitlab\_host) | GitLab host. Only used when git\_provider = "gitlab". Override for self-hosted instances (e.g. "gitlab.mycompany.com"). | `string` | `"gitlab.com"` | no | | [local\_specs\_path](#input\_local\_specs\_path) | Absolute path to the local service directory containing specs/. Required when git\_provider = "local". The directory must contain specs/service-spec.json.tpl and optionally specs/links/*.json.tpl and specs/actions/*.json.tpl. | `string` | `null` | no | | [nrn](#input\_nrn) | Nullplatform Resource Name (organization:account format) | `string` | n/a | yes | -| [repository\_branch](#input\_repository\_branch) | Branch of the service spec repository to use. Must be a short branch name (e.g. "main"), not a full ref. | `string` | `"main"` | no | +| [repository\_branch](#input\_repository\_branch) | Git ref of the service spec repository to read, as a short name and not a full ref
(e.g. "v1.4.0"). No default and no recommended value: which spec repository an install
points at is its own choice, so there is no version anyone could pick for it.

Combine with repository\_ref\_type, which selects the namespace this name lives in. | `string` | n/a | yes | | [repository\_name](#input\_repository\_name) | Repository name containing the service spec templates. | `string` | `"service"` | no | | [repository\_org](#input\_repository\_org) | GitHub organization or GitLab group owning the service spec repository. | `string` | `"nullplatform"` | no | -| [repository\_ref\_type](#input\_repository\_ref\_type) | Git ref namespace for `repository_branch` on GitHub: "heads" for a branch, "tags" for a tag, or "" to treat it as a raw commit SHA. Defaults to "heads", preserving previous behaviour. | `string` | `"heads"` | no | +| [repository\_ref\_type](#input\_repository\_ref\_type) | Git ref namespace for `repository_branch` on GitHub: "heads" for a branch, "tags" for a tag, or "" to treat it as a raw commit SHA. Defaults to "heads", preserving previous behaviour. | `string` | `"tags"` | no | | [repository\_token](#input\_repository\_token) | Access token for private repositories. GitHub: personal access token or fine-grained token. GitLab: Personal Access Token (PAT) with read\_api scope. | `string` | `null` | no | | [service\_name](#input\_service\_name) | Name of the scope type to be created | `string` | n/a | yes | | [service\_path](#input\_service\_path) | Path within the repository for the specific service (e.g., databases/postgres/k8s) | `string` | n/a | yes | @@ -94,16 +123,16 @@ resource "example_resource" "this" { diff --git a/nullplatform/service_definition_agent_association/README.md b/nullplatform/service_definition_agent_association/README.md index c3b96eca0..3a62f0e84 100644 --- a/nullplatform/service_definition_agent_association/README.md +++ b/nullplatform/service_definition_agent_association/README.md @@ -22,7 +22,7 @@ The module creates a terraform_data resource to track API key changes as a lifec ```hcl module "service_definition_agent_association" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition_agent_association?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition_agent_association?ref=v6.20.0" api_key = "your-api-key" repository_service_spec_repo = "your-repository-service-spec-repo" diff --git a/nullplatform/users/README.md b/nullplatform/users/README.md index 4d3db281a..30b4b0e19 100644 --- a/nullplatform/users/README.md +++ b/nullplatform/users/README.md @@ -21,7 +21,7 @@ The module iterates over a map of user definitions using `nullplatform_user` res ```hcl module "users" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/users?ref=v6.19.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/users?ref=v6.20.0" nullplatform_users = "your-nullplatform-users" } From dcdeae46ce2205a815a918ee275d8f94d52bdd0e Mon Sep 17 00:00:00 2001 From: Gonzalo Rojas Date: Fri, 28 Aug 2026 11:16:01 -0300 Subject: [PATCH 44/81] feat(api_key): add base type (#538) Same roles as the agent key minus secrets-reader. nullplatform/base deploys the logs controller and the control plane agent; neither reads secrets, so it does not need that role, and until now it consumed the agent's credential. Additive: no existing type changes. --- nullplatform/api_key/locals.tf | 13 ++++++ nullplatform/api_key/main.tf | 2 +- nullplatform/api_key/tests/api_key.tftest.hcl | 42 +++++++++++++++++++ nullplatform/api_key/variables.tf | 8 ++-- 4 files changed, 60 insertions(+), 5 deletions(-) diff --git a/nullplatform/api_key/locals.tf b/nullplatform/api_key/locals.tf index 6301a721e..34fc9d96c 100644 --- a/nullplatform/api_key/locals.tf +++ b/nullplatform/api_key/locals.tf @@ -19,6 +19,19 @@ locals { "secrets-reader", ] } + # Same roles as the agent key minus secrets-reader: the base chart deploys + # the logs controller and the control plane agent, neither of which reads + # secrets. Keeping the rest aligned means an install can hand base its own + # credential without losing a capability the agent key had. + base = { + name = "BASE" + role_slugs = [ + "controlplane:agent", + "developer", + "ops", + "secops", + ] + } scope_notification = { name = "SCOPE-NOTIFICATION-CHANNEL-${local.slug}" role_slugs = [ diff --git a/nullplatform/api_key/main.tf b/nullplatform/api_key/main.tf index 79961f2d4..cdff31d5a 100644 --- a/nullplatform/api_key/main.tf +++ b/nullplatform/api_key/main.tf @@ -36,7 +36,7 @@ resource "nullplatform_api_key" "this" { precondition { condition = var.type == "custom" || var.nrn != null - error_message = "nrn is required for predefined types (agent, scope_notification, service_notification)" + error_message = "nrn is required for predefined types (agent, base, scope_notification, service_notification)" } precondition { diff --git a/nullplatform/api_key/tests/api_key.tftest.hcl b/nullplatform/api_key/tests/api_key.tftest.hcl index 64916e104..49d60bcbc 100644 --- a/nullplatform/api_key/tests/api_key.tftest.hcl +++ b/nullplatform/api_key/tests/api_key.tftest.hcl @@ -18,6 +18,19 @@ run "agent_api_key" { } } +run "base_api_key" { + command = plan + + variables { + type = "base" + } + + assert { + condition = nullplatform_api_key.this.name == "BASE" + error_message = "Base API key name should be 'BASE'" + } +} + run "scope_notification_api_key" { command = plan @@ -147,6 +160,35 @@ run "agent_grants_include_controlplane_agent" { } } +run "base_grants_exclude_secrets_reader" { + command = plan + + variables { + type = "base" + } + + # The base chart does not read secrets, so it must not carry secrets-reader. + # Everything else matches the agent key so a single install can swap one for + # the other without losing a capability. + assert { + condition = length(nullplatform_api_key.this.grants) == 4 + error_message = "Base API key should have 4 grants (controlplane:agent, developer, ops, secops)" + } + + assert { + condition = length([for g in nullplatform_api_key.this.grants : g if g.role_slug == "secrets-reader"]) == 0 + error_message = "Base API key must not grant secrets-reader" + } + + assert { + condition = length(setsubtract( + toset([for g in nullplatform_api_key.this.grants : g.role_slug]), + toset(["controlplane:agent", "developer", "ops", "secops"]), + )) == 0 + error_message = "Base API key grants should be exactly the agent roles minus secrets-reader" + } +} + run "custom_grants_explicit_nrn" { command = plan diff --git a/nullplatform/api_key/variables.tf b/nullplatform/api_key/variables.tf index 89de21a09..01ac8daa0 100644 --- a/nullplatform/api_key/variables.tf +++ b/nullplatform/api_key/variables.tf @@ -3,17 +3,17 @@ ################################################################################ variable "type" { - description = "Type of API key to create. Determines the pre-configured grants and tags. Use 'custom' to define your own roles and tags." + description = "Type of API key to create. Determines the pre-configured grants and tags. 'base' carries the agent roles minus secrets-reader, for the nullplatform base module. Use 'custom' to define your own roles and tags." type = string validation { - condition = contains(["agent", "scope_notification", "service_notification", "custom"], var.type) - error_message = "type must be one of: agent, scope_notification, service_notification, custom" + condition = contains(["agent", "base", "scope_notification", "service_notification", "custom"], var.type) + error_message = "type must be one of: agent, base, scope_notification, service_notification, custom" } } variable "nrn" { - description = "Nullplatform Resource Name (e.g., organization=123:account=456:namespace=789). Required for predefined types (agent, scope_notification, service_notification). Optional for custom type when using custom_grants." + description = "Nullplatform Resource Name (e.g., organization=123:account=456:namespace=789). Required for predefined types (agent, base, scope_notification, service_notification). Optional for custom type when using custom_grants." type = string default = null } From e446dd8a5ccdee6a13e4a3f57e599483cb5fea4a Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Fri, 28 Aug 2026 14:16:50 +0000 Subject: [PATCH 45/81] chore(6.x): release 6.21.0 --- CHANGELOG.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 9ca9f60eb..e2a2f453c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,12 @@ # Changelog +## [6.21.0](https://github.com/nullplatform/tofu-modules/compare/v6.20.0...v6.21.0) (2026-08-28) + + +### Features + +* **api_key:** add base type ([#538](https://github.com/nullplatform/tofu-modules/issues/538)) ([272cbd0](https://github.com/nullplatform/tofu-modules/commit/272cbd08410dd78183363e1642c8a79478266cbd)) + ## [6.20.0](https://github.com/nullplatform/tofu-modules/compare/v6.19.1...v6.20.0) (2026-08-28) From 8efeef9159bd84eecb67423e8f2232aa570b3436 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Fri, 28 Aug 2026 14:17:25 +0000 Subject: [PATCH 46/81] docs: regenerate READMEs for changed modules and update versions --- infrastructure/aws/acm/README.md | 2 +- .../aws_load_balancer_controller/README.md | 2 +- infrastructure/aws/backend/README.md | 2 +- infrastructure/aws/dns/README.md | 2 +- infrastructure/aws/eks/README.md | 2 +- infrastructure/aws/iam/agent/README.md | 2 +- .../README.md | 2 +- infrastructure/aws/iam/cert_manager/README.md | 2 +- .../aws/iam/ci-build-workflow-user/README.md | 2 +- infrastructure/aws/iam/cloudwatch/README.md | 2 +- infrastructure/aws/iam/ecr/README.md | 2 +- infrastructure/aws/iam/external_dns/README.md | 2 +- infrastructure/aws/iam/s3/README.md | 2 +- infrastructure/aws/ingress/README.md | 2 +- infrastructure/aws/security/README.md | 2 +- infrastructure/aws/vpc/README.md | 2 +- infrastructure/azure/acr/README.md | 2 +- infrastructure/azure/aks/README.md | 2 +- .../azure/aks_route_table/README.md | 2 +- infrastructure/azure/dns/README.md | 2 +- infrastructure/azure/iam/README.md | 2 +- infrastructure/azure/private_dns/README.md | 2 +- infrastructure/azure/resource_group/README.md | 2 +- infrastructure/azure/security/README.md | 2 +- infrastructure/azure/vnet/README.md | 2 +- infrastructure/commons/cert_manager/README.md | 14 ++-- infrastructure/commons/external_dns/README.md | 14 ++-- infrastructure/commons/istio/README.md | 2 +- infrastructure/commons/prometheus/README.md | 8 +-- .../gcp/artifact-registry/README.md | 2 +- infrastructure/gcp/backend/README.md | 2 +- infrastructure/gcp/cloud-dns/README.md | 2 +- infrastructure/gcp/cloud-nat/README.md | 2 +- infrastructure/gcp/gke/README.md | 6 +- infrastructure/gcp/iam/README.md | 2 +- infrastructure/gcp/security/README.md | 2 +- infrastructure/gcp/vpc/README.md | 2 +- infrastructure/oci/backend/README.md | 2 +- infrastructure/oci/dns/README.md | 2 +- infrastructure/oci/dynamic_groups/README.md | 2 +- infrastructure/oci/oke/README.md | 2 +- infrastructure/oci/vcn/README.md | 2 +- nullplatform/account/README.md | 2 +- nullplatform/agent/README.md | 16 ++--- nullplatform/api_key/README.md | 66 +++++++++++-------- nullplatform/asset/docker_server/README.md | 2 +- nullplatform/asset/ecr/README.md | 2 +- nullplatform/asset/s3/README.md | 2 +- nullplatform/base/README.md | 12 ++-- nullplatform/cloud/aws/cloud/README.md | 2 +- nullplatform/cloud/aws/vpc/README.md | 2 +- nullplatform/cloud/azure/cloud/README.md | 2 +- nullplatform/cloud/gcp/cloud/README.md | 2 +- nullplatform/cloud/oci/cloud/README.md | 2 +- nullplatform/code_repository/README.md | 10 +-- .../container_orchestration/aks/README.md | 8 +-- .../container_orchestration/eks/README.md | 8 +-- .../container_orchestration/gke/README.md | 8 +-- .../container_orchestration/oke/README.md | 2 +- nullplatform/dimension/README.md | 2 +- nullplatform/dimension_value/README.md | 2 +- .../identity-access-control/README.md | 2 +- nullplatform/metrics/README.md | 2 +- nullplatform/packaged_service/README.md | 2 +- .../parameter_storage_configuration/README.md | 2 +- .../parameter_storage_definition/README.md | 2 +- .../README.md | 2 +- nullplatform/scope_configuration/README.md | 2 +- nullplatform/scope_definition/README.md | 2 +- .../README.md | 2 +- nullplatform/service_definition/README.md | 6 +- .../README.md | 2 +- nullplatform/users/README.md | 2 +- 73 files changed, 155 insertions(+), 143 deletions(-) diff --git a/infrastructure/aws/acm/README.md b/infrastructure/aws/acm/README.md index b046db276..6f76e8ba9 100644 --- a/infrastructure/aws/acm/README.md +++ b/infrastructure/aws/acm/README.md @@ -18,7 +18,7 @@ The module creates an aws_acm_certificate resource with DNS validation, which is ```hcl module "acm" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/acm?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/acm?ref=v6.21.0" domain_name = "your-domain-name" zone_id = "your-zone-id" diff --git a/infrastructure/aws/aws_load_balancer_controller/README.md b/infrastructure/aws/aws_load_balancer_controller/README.md index 0f475e256..8ecd418a4 100644 --- a/infrastructure/aws/aws_load_balancer_controller/README.md +++ b/infrastructure/aws/aws_load_balancer_controller/README.md @@ -18,7 +18,7 @@ This module creates a helm_release resource to deploy the AWS Load Balancer Cont ```hcl module "aws_load_balancer_controller" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/aws_load_balancer_controller?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/aws_load_balancer_controller?ref=v6.21.0" cluster_name = "your-cluster-name" vpc_id = "your-vpc-id" diff --git a/infrastructure/aws/backend/README.md b/infrastructure/aws/backend/README.md index 85c4d03cc..ef9e3edda 100644 --- a/infrastructure/aws/backend/README.md +++ b/infrastructure/aws/backend/README.md @@ -20,7 +20,7 @@ This module creates an S3 bucket with versioning and server-side encryption enab ```hcl module "backend" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/backend?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/backend?ref=v6.21.0" } ``` diff --git a/infrastructure/aws/dns/README.md b/infrastructure/aws/dns/README.md index da46c3d64..dddd76f18 100644 --- a/infrastructure/aws/dns/README.md +++ b/infrastructure/aws/dns/README.md @@ -21,7 +21,7 @@ The module conditionally creates an aws_route53_zone resource for a public hoste ```hcl module "dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/dns?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/dns?ref=v6.21.0" domain_name = "your-domain-name" vpc_id = "your-vpc-id" diff --git a/infrastructure/aws/eks/README.md b/infrastructure/aws/eks/README.md index f8d110869..6f3dbef9b 100644 --- a/infrastructure/aws/eks/README.md +++ b/infrastructure/aws/eks/README.md @@ -22,7 +22,7 @@ The module wraps terraform-aws-modules/eks to create the EKS cluster (aws_eks_cl ```hcl module "eks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/eks?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/eks?ref=v6.21.0" aws_subnets_private_ids = "your-aws-subnets-private-ids" aws_vpc_vpc_id = "your-aws-vpc-vpc-id" diff --git a/infrastructure/aws/iam/agent/README.md b/infrastructure/aws/iam/agent/README.md index a70bd1949..40809fceb 100644 --- a/infrastructure/aws/iam/agent/README.md +++ b/infrastructure/aws/iam/agent/README.md @@ -21,7 +21,7 @@ The module uses the terraform-aws-modules/iam//modules/iam-role-for-service-acco ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/agent?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/agent?ref=v6.21.0" agent_namespace = "your-agent-namespace" aws_iam_openid_connect_provider_arn = "your-aws-iam-openid-connect-provider-arn" diff --git a/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md b/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md index ef051cb6c..f95218715 100644 --- a/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md +++ b/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md @@ -19,7 +19,7 @@ This module creates an IAM role for the AWS Load Balancer Controller using the t ```hcl module "aws_load_balancer_controller_iam" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/aws_load_balancer_controller_iam?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/aws_load_balancer_controller_iam?ref=v6.21.0" aws_iam_openid_connect_provider_arn = "your-aws-iam-openid-connect-provider-arn" cluster_name = "your-cluster-name" diff --git a/infrastructure/aws/iam/cert_manager/README.md b/infrastructure/aws/iam/cert_manager/README.md index 556e3b1bf..224cd2ec3 100644 --- a/infrastructure/aws/iam/cert_manager/README.md +++ b/infrastructure/aws/iam/cert_manager/README.md @@ -20,7 +20,7 @@ An aws_iam_policy resource is always created granting route53:GetChange, route53 ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cert_manager?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cert_manager?ref=v6.21.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/ci-build-workflow-user/README.md b/infrastructure/aws/iam/ci-build-workflow-user/README.md index ba258c562..696258e9c 100644 --- a/infrastructure/aws/iam/ci-build-workflow-user/README.md +++ b/infrastructure/aws/iam/ci-build-workflow-user/README.md @@ -21,7 +21,7 @@ The module creates an aws_iam_user named with the cluster_name prefix and genera ```hcl module "ci-build-workflow-user" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ci-build-workflow-user?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ci-build-workflow-user?ref=v6.21.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/cloudwatch/README.md b/infrastructure/aws/iam/cloudwatch/README.md index e89f473b2..c6168fa66 100644 --- a/infrastructure/aws/iam/cloudwatch/README.md +++ b/infrastructure/aws/iam/cloudwatch/README.md @@ -20,7 +20,7 @@ The module creates an aws_iam_policy granting CloudWatch Logs and Metrics write ```hcl module "cloudwatch" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cloudwatch?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cloudwatch?ref=v6.21.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/ecr/README.md b/infrastructure/aws/iam/ecr/README.md index beb601fe0..3937f5bb8 100644 --- a/infrastructure/aws/iam/ecr/README.md +++ b/infrastructure/aws/iam/ecr/README.md @@ -20,7 +20,7 @@ The module creates an aws_iam_role named nullplatform-{cluster_name}-application ```hcl module "ecr" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ecr?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ecr?ref=v6.21.0" build_workflow_group_name = "your-build-workflow-group-name" cluster_name = "your-cluster-name" diff --git a/infrastructure/aws/iam/external_dns/README.md b/infrastructure/aws/iam/external_dns/README.md index e3ae43109..f52ddde14 100644 --- a/infrastructure/aws/iam/external_dns/README.md +++ b/infrastructure/aws/iam/external_dns/README.md @@ -20,7 +20,7 @@ An aws_iam_policy resource named nullplatform_external_dns_policy is always crea ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/external_dns?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/external_dns?ref=v6.21.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/s3/README.md b/infrastructure/aws/iam/s3/README.md index 20c13e88e..29f2a644a 100644 --- a/infrastructure/aws/iam/s3/README.md +++ b/infrastructure/aws/iam/s3/README.md @@ -18,7 +18,7 @@ The module creates an aws_iam_policy resource that allows s3:PutObject and s3:Ge ```hcl module "s3" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/s3?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/s3?ref=v6.21.0" bucket = "your-bucket" build_workflow_group_name = "your-build-workflow-group-name" diff --git a/infrastructure/aws/ingress/README.md b/infrastructure/aws/ingress/README.md index a64b8adfc..91c2b0a5f 100644 --- a/infrastructure/aws/ingress/README.md +++ b/infrastructure/aws/ingress/README.md @@ -22,7 +22,7 @@ The module creates up to two kubernetes_ingress_v1 resources — one for an inte ```hcl module "ingress" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/ingress?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/ingress?ref=v6.21.0" certificate_arn = "your-certificate-arn" } diff --git a/infrastructure/aws/security/README.md b/infrastructure/aws/security/README.md index 01a42ee07..07a1dced3 100644 --- a/infrastructure/aws/security/README.md +++ b/infrastructure/aws/security/README.md @@ -22,7 +22,7 @@ The module uses data sources (aws_eks_cluster, aws_vpc) to automatically derive ```hcl module "security" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/security?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/security?ref=v6.21.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/vpc/README.md b/infrastructure/aws/vpc/README.md index d9ae720ee..ff2b9614c 100644 --- a/infrastructure/aws/vpc/README.md +++ b/infrastructure/aws/vpc/README.md @@ -22,7 +22,7 @@ This module creates a terraform-aws-modules/vpc/aws module resource with DNS hos ```hcl module "vpc" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/vpc?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/vpc?ref=v6.21.0" account = "your-account" organization = "your-organization" diff --git a/infrastructure/azure/acr/README.md b/infrastructure/azure/acr/README.md index 0acf4d776..0d0780789 100644 --- a/infrastructure/azure/acr/README.md +++ b/infrastructure/azure/acr/README.md @@ -18,7 +18,7 @@ The module uses the azurerm_container_registry resource to create the container ```hcl module "acr" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/acr?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/acr?ref=v6.21.0" containerregistry_name = "your-containerregistry-name" location = "your-location" diff --git a/infrastructure/azure/aks/README.md b/infrastructure/azure/aks/README.md index da3ffb3a3..b759c0f15 100644 --- a/infrastructure/azure/aks/README.md +++ b/infrastructure/azure/aks/README.md @@ -22,7 +22,7 @@ The module wraps the Azure/aks/azurerm community module (version 11.0.0) and use ```hcl module "aks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks?ref=v6.21.0" cluster_name = "your-cluster-name" location = "your-location" diff --git a/infrastructure/azure/aks_route_table/README.md b/infrastructure/azure/aks_route_table/README.md index a1dfd623b..513e5720e 100644 --- a/infrastructure/azure/aks_route_table/README.md +++ b/infrastructure/azure/aks_route_table/README.md @@ -19,7 +19,7 @@ The module uses an azurerm_resources data source to discover the AKS-managed rou ```hcl module "aks_route_table" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks_route_table?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks_route_table?ref=v6.21.0" node_resource_group = "your-node-resource-group" subnet_id = "your-subnet-id" diff --git a/infrastructure/azure/dns/README.md b/infrastructure/azure/dns/README.md index 3d6c11f6d..8ffba1b31 100644 --- a/infrastructure/azure/dns/README.md +++ b/infrastructure/azure/dns/README.md @@ -18,7 +18,7 @@ This module creates an azurerm_dns_zone resource and configures it with the prov ```hcl module "dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/dns?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/dns?ref=v6.21.0" domain_name = "your-domain-name" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/iam/README.md b/infrastructure/azure/iam/README.md index 942e5c31e..6688696cb 100644 --- a/infrastructure/azure/iam/README.md +++ b/infrastructure/azure/iam/README.md @@ -21,7 +21,7 @@ The module creates an azurerm_user_assigned_identity resource in the specified r ```hcl module "iam" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/iam?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/iam?ref=v6.21.0" location = "your-location" name = "your-name" diff --git a/infrastructure/azure/private_dns/README.md b/infrastructure/azure/private_dns/README.md index f71b1d982..af0df7a1c 100644 --- a/infrastructure/azure/private_dns/README.md +++ b/infrastructure/azure/private_dns/README.md @@ -18,7 +18,7 @@ This module creates an azurerm_private_dns_zone resource and optionally multiple ```hcl module "private_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/private_dns?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/private_dns?ref=v6.21.0" domain_name = "your-domain-name" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/resource_group/README.md b/infrastructure/azure/resource_group/README.md index f15ae092a..792e9fe81 100644 --- a/infrastructure/azure/resource_group/README.md +++ b/infrastructure/azure/resource_group/README.md @@ -18,7 +18,7 @@ This module creates an azurerm_resource_group resource and outputs its name and ```hcl module "resource_group" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/resource_group?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/resource_group?ref=v6.21.0" location = "your-location" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/security/README.md b/infrastructure/azure/security/README.md index 87b2ffa58..d9f8780b1 100644 --- a/infrastructure/azure/security/README.md +++ b/infrastructure/azure/security/README.md @@ -21,7 +21,7 @@ The module uses azurerm_kubernetes_cluster and azurerm_virtual_network data sour ```hcl module "security" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/security?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/security?ref=v6.21.0" cluster_name = "your-cluster-name" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/vnet/README.md b/infrastructure/azure/vnet/README.md index 63fd48807..e65df5967 100644 --- a/infrastructure/azure/vnet/README.md +++ b/infrastructure/azure/vnet/README.md @@ -18,7 +18,7 @@ This module creates an Azure virtual network using the azurerm provider and conf ```hcl module "vnet" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/vnet?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/vnet?ref=v6.21.0" address_space = "your-address-space" location = "your-location" diff --git a/infrastructure/commons/cert_manager/README.md b/infrastructure/commons/cert_manager/README.md index fe813212e..9f4a96924 100644 --- a/infrastructure/commons/cert_manager/README.md +++ b/infrastructure/commons/cert_manager/README.md @@ -22,7 +22,7 @@ The module creates two core helm_release resources: cert-manager from charts.jet ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.21.0" account_slug = "your-account-slug" cert_manager_version = "your-cert-manager-version" @@ -36,7 +36,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.21.0" account_slug = "your-account-slug" cert_manager_version = "your-cert-manager-version" @@ -52,7 +52,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.21.0" account_slug = "your-account-slug" azure_client_id = "your-azure-client-id" # Required when cloud_provider = "azure" @@ -71,7 +71,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.21.0" account_slug = "your-account-slug" cert_manager_version = "your-cert-manager-version" @@ -87,7 +87,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.21.0" account_slug = "your-account-slug" aws_identity_mode = "your-aws-identity-mode" # Required when cloud_provider = "aws" @@ -104,7 +104,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.21.0" account_slug = "your-account-slug" cert_manager_version = "your-cert-manager-version" @@ -123,7 +123,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.21.0" account_slug = "your-account-slug" cert_manager_version = "v1.21.1" diff --git a/infrastructure/commons/external_dns/README.md b/infrastructure/commons/external_dns/README.md index 4be4c203a..915273208 100644 --- a/infrastructure/commons/external_dns/README.md +++ b/infrastructure/commons/external_dns/README.md @@ -22,7 +22,7 @@ The module creates an optional kubernetes_namespace_v1 resource and a helm_relea ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.21.0" dns_provider_name = "your-dns-provider-name" domain_filters = "your-domain-filters" @@ -33,7 +33,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.21.0" cloudflare_token = "your-cloudflare-token" # Required when dns_provider_name = "cloudflare" dns_provider_name = "cloudflare" @@ -45,7 +45,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.21.0" aws_iam_role_arn = "your-aws-iam-role-arn" # Required when dns_provider_name = "aws" aws_identity_mode = "your-aws-identity-mode" # Required when dns_provider_name = "aws" @@ -61,7 +61,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.21.0" dns_provider_name = "oci" domain_filters = "your-domain-filters" @@ -76,7 +76,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.21.0" azure_client_id = "your-azure-client-id" # Required when dns_provider_name = "azure" azure_resource_group = "your-azure-resource-group" # Required when dns_provider_name = "azure" @@ -92,7 +92,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.21.0" azure_client_id = "your-azure-client-id" # Required when dns_provider_name = "azure-private-dns" azure_resource_group = "your-azure-resource-group" # Required when dns_provider_name = "azure-private-dns" @@ -108,7 +108,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.21.0" dns_provider_name = "google" domain_filters = "your-domain-filters" diff --git a/infrastructure/commons/istio/README.md b/infrastructure/commons/istio/README.md index fd3cd179c..0ea111c6d 100644 --- a/infrastructure/commons/istio/README.md +++ b/infrastructure/commons/istio/README.md @@ -21,7 +21,7 @@ The module creates three helm_release resources in a strict dependency chain: is ```hcl module "istio" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/istio?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/istio?ref=v6.21.0" } ``` diff --git a/infrastructure/commons/prometheus/README.md b/infrastructure/commons/prometheus/README.md index b187e134f..dc6efd037 100644 --- a/infrastructure/commons/prometheus/README.md +++ b/infrastructure/commons/prometheus/README.md @@ -21,7 +21,7 @@ A single helm_release resource named 'prometheus' installs the prometheus-commun ```hcl module "prometheus" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.21.0" prometheus_version = "your-prometheus-version" } @@ -31,7 +31,7 @@ module "prometheus" { ```hcl module "prometheus" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.21.0" prometheus_version = "latest" } @@ -41,7 +41,7 @@ module "prometheus" { ```hcl module "prometheus" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.21.0" prometheus_version = "main" } @@ -51,7 +51,7 @@ module "prometheus" { ```hcl module "prometheus" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.21.0" prometheus_version = "master" } diff --git a/infrastructure/gcp/artifact-registry/README.md b/infrastructure/gcp/artifact-registry/README.md index 4a60af0f9..b6bcf6ff8 100644 --- a/infrastructure/gcp/artifact-registry/README.md +++ b/infrastructure/gcp/artifact-registry/README.md @@ -21,7 +21,7 @@ The module creates a google_artifact_registry_repository resource configured wit ```hcl module "artifact-registry" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/artifact-registry?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/artifact-registry?ref=v6.21.0" location = "your-location" project_id = "your-project-id" diff --git a/infrastructure/gcp/backend/README.md b/infrastructure/gcp/backend/README.md index 179cbb740..bb46a69f9 100644 --- a/infrastructure/gcp/backend/README.md +++ b/infrastructure/gcp/backend/README.md @@ -22,7 +22,7 @@ The module creates a random_id resource to generate a unique 8-byte hex suffix, ```hcl module "backend" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/backend?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/backend?ref=v6.21.0" project_id = "your-project-id" } diff --git a/infrastructure/gcp/cloud-dns/README.md b/infrastructure/gcp/cloud-dns/README.md index 7f81bfd5d..6e7e00093 100644 --- a/infrastructure/gcp/cloud-dns/README.md +++ b/infrastructure/gcp/cloud-dns/README.md @@ -21,7 +21,7 @@ The module creates a single google_dns_managed_zone resource in the specified GC ```hcl module "cloud-dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-dns?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-dns?ref=v6.21.0" domain_name = "your-domain-name" project_id = "your-project-id" diff --git a/infrastructure/gcp/cloud-nat/README.md b/infrastructure/gcp/cloud-nat/README.md index 1fc12ae71..a0d6b0119 100644 --- a/infrastructure/gcp/cloud-nat/README.md +++ b/infrastructure/gcp/cloud-nat/README.md @@ -19,7 +19,7 @@ This module creates a google_compute_router resource in a specified region and n ```hcl module "cloud-nat" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-nat?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-nat?ref=v6.21.0" nat_name = "your-nat-name" network_id = "your-network-id" diff --git a/infrastructure/gcp/gke/README.md b/infrastructure/gcp/gke/README.md index f409bcbdb..2f27f9a02 100644 --- a/infrastructure/gcp/gke/README.md +++ b/infrastructure/gcp/gke/README.md @@ -22,7 +22,7 @@ The module conditionally creates one of two mutually-exclusive submodules based ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.21.0" cluster_name = "your-cluster-name" ip_range_pods = "your-ip-range-pods" @@ -38,7 +38,7 @@ module "gke" { ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.21.0" cluster_name = "your-cluster-name" ip_range_pods = "your-ip-range-pods" @@ -73,7 +73,7 @@ module "gke" { ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.21.0" cluster_name = "your-cluster-name" ip_range_pods = "your-ip-range-pods" diff --git a/infrastructure/gcp/iam/README.md b/infrastructure/gcp/iam/README.md index 0d460c5dd..e8d913d41 100644 --- a/infrastructure/gcp/iam/README.md +++ b/infrastructure/gcp/iam/README.md @@ -19,7 +19,7 @@ The module creates google_service_account resources for each service account spe ```hcl module "iam" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/iam?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/iam?ref=v6.21.0" project_id = "your-project-id" } diff --git a/infrastructure/gcp/security/README.md b/infrastructure/gcp/security/README.md index 826c46cd0..ab6a3c5c7 100644 --- a/infrastructure/gcp/security/README.md +++ b/infrastructure/gcp/security/README.md @@ -22,7 +22,7 @@ The module uses data.google_container_cluster and data.google_compute_subnetwork ```hcl module "security" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/security?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/security?ref=v6.21.0" cluster_name = "your-cluster-name" gcp_project_id = "your-gcp-project-id" diff --git a/infrastructure/gcp/vpc/README.md b/infrastructure/gcp/vpc/README.md index 376ce0e13..5493a6bc9 100644 --- a/infrastructure/gcp/vpc/README.md +++ b/infrastructure/gcp/vpc/README.md @@ -20,7 +20,7 @@ The module invokes the terraform-google-modules/network/google module to create ```hcl module "vpc" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/vpc?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/vpc?ref=v6.21.0" network_name = "your-network-name" project_id = "your-project-id" diff --git a/infrastructure/oci/backend/README.md b/infrastructure/oci/backend/README.md index 377a88d58..2e4607e60 100644 --- a/infrastructure/oci/backend/README.md +++ b/infrastructure/oci/backend/README.md @@ -18,7 +18,7 @@ The module creates an oci_objectstorage_bucket resource, which is configured wit ```hcl module "backend" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/backend?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/backend?ref=v6.21.0" compartment_id = "your-compartment-id" namespace = "your-namespace" diff --git a/infrastructure/oci/dns/README.md b/infrastructure/oci/dns/README.md index b430abb9b..c620203d0 100644 --- a/infrastructure/oci/dns/README.md +++ b/infrastructure/oci/dns/README.md @@ -18,7 +18,7 @@ This module creates oci_dns_zone resources for each DNS zone defined in the dns_ ```hcl module "dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dns?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dns?ref=v6.21.0" compartment_id = "your-compartment-id" } diff --git a/infrastructure/oci/dynamic_groups/README.md b/infrastructure/oci/dynamic_groups/README.md index cb57afefd..244742364 100644 --- a/infrastructure/oci/dynamic_groups/README.md +++ b/infrastructure/oci/dynamic_groups/README.md @@ -19,7 +19,7 @@ This module creates an OCI dynamic group and an OCI identity policy, connecting ```hcl module "dynamic_groups" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dynamic_groups?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dynamic_groups?ref=v6.21.0" cluster_id = "your-cluster-id" compartment_id = "your-compartment-id" diff --git a/infrastructure/oci/oke/README.md b/infrastructure/oci/oke/README.md index d94f5e050..29b297526 100644 --- a/infrastructure/oci/oke/README.md +++ b/infrastructure/oci/oke/README.md @@ -21,7 +21,7 @@ The module instantiates the oracle-terraform-modules/oke/oci module to create an ```hcl module "oke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/oke?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/oke?ref=v6.21.0" api_endpoint_subnet_id = "your-api-endpoint-subnet-id" cluster_name = "your-cluster-name" diff --git a/infrastructure/oci/vcn/README.md b/infrastructure/oci/vcn/README.md index 3d722546d..83960ce30 100644 --- a/infrastructure/oci/vcn/README.md +++ b/infrastructure/oci/vcn/README.md @@ -19,7 +19,7 @@ The module instantiates oci_core_subnet resources for public and private subnets ```hcl module "vcn" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/vcn?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/vcn?ref=v6.21.0" } ``` diff --git a/nullplatform/account/README.md b/nullplatform/account/README.md index 0e2457d41..7ce8035ce 100644 --- a/nullplatform/account/README.md +++ b/nullplatform/account/README.md @@ -19,7 +19,7 @@ The module iterates over the `nullplatform_accounts` input map using `for_each` ```hcl module "account" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/account?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/account?ref=v6.21.0" nullplatform_accounts = "your-nullplatform-accounts" } diff --git a/nullplatform/agent/README.md b/nullplatform/agent/README.md index 7f384d411..32ea0d82d 100644 --- a/nullplatform/agent/README.md +++ b/nullplatform/agent/README.md @@ -22,7 +22,7 @@ The module creates a `helm_release` resource named `agent` that deploys the `nul ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.21.0" agent_repos_scope_tag = "your-agent-repos-scope-tag" agent_traffic_manager_tag = "your-agent-traffic-manager-tag" @@ -39,7 +39,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.21.0" agent_repos_scope_tag = "your-agent-repos-scope-tag" agent_traffic_manager_tag = "your-agent-traffic-manager-tag" @@ -57,7 +57,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.21.0" agent_repos_scope_tag = "your-agent-repos-scope-tag" agent_traffic_manager_tag = "your-agent-traffic-manager-tag" @@ -74,7 +74,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.21.0" agent_repos_scope_tag = "your-agent-repos-scope-tag" agent_traffic_manager_tag = "your-agent-traffic-manager-tag" @@ -97,7 +97,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.21.0" agent_repos_scope_tag = "your-agent-repos-scope-tag" agent_traffic_manager_tag = "your-agent-traffic-manager-tag" @@ -114,7 +114,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.21.0" agent_repos_scope_tag = "your-agent-repos-scope-tag" agent_traffic_manager_tag = "your-agent-traffic-manager-tag" @@ -131,7 +131,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.21.0" agent_repos_scope = "your-agent-repos-scope" # Required when agent_repos_scope_tag = "fixed git tag (e.g. v1.15.1)" agent_repos_scope_tag = "fixed git tag (e.g. v1.15.1)" @@ -149,7 +149,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.21.0" agent_repos_scope_tag = "your-agent-repos-scope-tag" agent_traffic_manager_tag = "fixed semver (e.g. 1.8.0)" diff --git a/nullplatform/api_key/README.md b/nullplatform/api_key/README.md index cc7e1fde5..249c89395 100644 --- a/nullplatform/api_key/README.md +++ b/nullplatform/api_key/README.md @@ -2,26 +2,27 @@ ## Description -Creates a Nullplatform API key with pre-configured or custom role grants and tags based on a specified type +Creates a nullplatform API key resource with pre-configured or custom role grants and tags based on a specified key type ## Architecture -The module creates a single nullplatform_api_key resource whose name, grants, and tags are derived from a locals-computed config map keyed by var.type. For predefined types (agent, scope_notification, service_notification), role slugs are expanded into grant blocks using the provided NRN, while the custom type allows fully user-defined grants via custom_grants or custom_role_slugs. Tags are merged from a static managedBy marker, NRN-parsed key-value pairs, and any user-supplied custom_tags, then injected as dynamic tag blocks on the resource. +The module defines a single nullplatform_api_key resource whose name, grants, and tags are derived from a locals.tf configuration map keyed by the var.type input. For predefined types (agent, base, scope_notification, service_notification), role slugs are resolved against a module-level NRN to build grant blocks dynamically; for the custom type, caller-supplied custom_name, custom_role_slugs, or custom_grants are used instead. Tags are assembled by merging a static managedBy label, NRN-derived key/value pairs parsed from var.nrn, and any caller-provided custom_tags. Lifecycle preconditions enforce type-specific invariants before resource creation. ## Features -- Creates nullplatform_api_key with type-specific pre-configured role grants for agent, scope_notification, and service_notification workflows -- Supports fully custom API key configuration with user-defined name, role slugs, and per-grant NRN assignments -- Automatically parses NRN string into structured organization, account, and namespace tags applied to the API key -- Merges static managedBy IaC tag with NRN-derived tags and user-supplied custom tags into a unified tag set -- Enforces type-specific preconditions ensuring required variables like custom_name, specification_slug, and nrn are provided at plan time -- Generates scoped notification channel names using specification_slug for scope_notification and service_notification types +- Creates a nullplatform_api_key resource with dynamically generated role grants using predefined role-slug sets per type +- Supports agent type with full role set including controlplane:agent, developer, ops, secops, and secrets-reader +- Supports base type with agent roles minus secrets-reader for nullplatform base module deployments +- Supports scope_notification and service_notification types with specification-slug-based naming and scoped role sets +- Supports custom type allowing caller-defined name, role slugs, and per-grant NRN overrides +- Merges NRN-derived tags and custom tags onto every API key with a mandatory managedBy=IaC label +- Enforces type-specific preconditions at plan time to prevent misconfigured grants or missing required inputs ## Basic Usage ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.21.0" type = "your-type" } @@ -31,18 +32,29 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.21.0" nrn = "your-nrn" # Required when type = "agent" type = "agent" } ``` +### Usage with Base API Key + +```hcl +module "api_key" { + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.21.0" + + nrn = "your-nrn" # Required when type = "base" + type = "base" +} +``` + ### Usage with Scope Notification API Key ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.21.0" nrn = "your-nrn" # Required when type = "scope_notification" specification_slug = "your-specification-slug" # Required when type = "scope_notification" @@ -54,7 +66,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.21.0" nrn = "your-nrn" # Required when type = "service_notification" specification_slug = "your-specification-slug" # Required when type = "service_notification" @@ -66,9 +78,8 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.21.0" - custom_grants = "your-custom-grants" # Required when type = "custom" custom_name = "your-custom-name" # Required when type = "custom" custom_role_slugs = "your-custom-role-slugs" # Required when type = "custom" type = "custom" @@ -111,9 +122,9 @@ resource "example_resource" "this" { | [custom\_name](#input\_custom\_name) | Name for the API key (required when type is 'custom') | `string` | `null` | no | | [custom\_role\_slugs](#input\_custom\_role\_slugs) | List of role slugs to assign using the module-level NRN (used when type is 'custom' and custom\_grants is empty) | `list(string)` | `[]` | no | | [custom\_tags](#input\_custom\_tags) | Additional tags to apply to the API key (optional, only used when type is 'custom') | 
list(object({
    key   = string
    value = string
  }))
| `[]` | no | -| [nrn](#input\_nrn) | Nullplatform Resource Name (e.g., organization=123:account=456:namespace=789). Required for predefined types (agent, scope\_notification, service\_notification). Optional for custom type when using custom\_grants. | `string` | `null` | no | +| [nrn](#input\_nrn) | Nullplatform Resource Name (e.g., organization=123:account=456:namespace=789). Required for predefined types (agent, base, scope\_notification, service\_notification). Optional for custom type when using custom\_grants. | `string` | `null` | no | | [specification\_slug](#input\_specification\_slug) | Specification slug used for the usedBy tag (required for scope\_notification and service\_notification types) | `string` | `null` | no | -| [type](#input\_type) | Type of API key to create. Determines the pre-configured grants and tags. Use 'custom' to define your own roles and tags. | `string` | n/a | yes | +| [type](#input\_type) | Type of API key to create. Determines the pre-configured grants and tags. 'base' carries the agent roles minus secrets-reader, for the nullplatform base module. Use 'custom' to define your own roles and tags. | `string` | n/a | yes | ## Outputs @@ -127,25 +138,26 @@ resource "example_resource" "this" { diff --git a/nullplatform/asset/docker_server/README.md b/nullplatform/asset/docker_server/README.md index 6cc3a4aa5..58fe258d8 100644 --- a/nullplatform/asset/docker_server/README.md +++ b/nullplatform/asset/docker_server/README.md @@ -21,7 +21,7 @@ Creates a nullplatform_provider_config resource of type 'docker-server' with enc ```hcl module "docker_server" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/docker_server?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/docker_server?ref=v6.21.0" login_server = "your-login-server" nrn = "your-nrn" diff --git a/nullplatform/asset/ecr/README.md b/nullplatform/asset/ecr/README.md index 7341450b3..f9179394e 100644 --- a/nullplatform/asset/ecr/README.md +++ b/nullplatform/asset/ecr/README.md @@ -21,7 +21,7 @@ The module reads the current AWS region via the aws_region data source and combi ```hcl module "ecr" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/ecr?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/ecr?ref=v6.21.0" application_role_arn = "your-application-role-arn" build_workflow_access_key_id = "your-build-workflow-access-key-id" diff --git a/nullplatform/asset/s3/README.md b/nullplatform/asset/s3/README.md index c84dd20fd..aab35aa01 100644 --- a/nullplatform/asset/s3/README.md +++ b/nullplatform/asset/s3/README.md @@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type s3-con ```hcl module "s3" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/s3?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/s3?ref=v6.21.0" bucket_name = "your-bucket-name" nrn = "your-nrn" diff --git a/nullplatform/base/README.md b/nullplatform/base/README.md index e33c9dcea..b64810eb5 100644 --- a/nullplatform/base/README.md +++ b/nullplatform/base/README.md @@ -22,7 +22,7 @@ The module creates two kubernetes_namespace_v1 resources ('nullplatform-tools' a ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.21.0" control_plane_agent_image_tag = "your-control-plane-agent-image-tag" k8s_provider = "your-k8s-provider" @@ -36,7 +36,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.21.0" control_plane_agent_image_tag = "your-control-plane-agent-image-tag" k8s_provider = "eks" @@ -50,7 +50,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.21.0" control_plane_agent_image_tag = "your-control-plane-agent-image-tag" k8s_provider = "gke" @@ -64,7 +64,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.21.0" control_plane_agent_image_tag = "your-control-plane-agent-image-tag" k8s_provider = "aks" @@ -78,7 +78,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.21.0" control_plane_agent_image_tag = "your-control-plane-agent-image-tag" k8s_provider = "oke" @@ -92,7 +92,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.21.0" control_plane_agent_image_tag = "your-control-plane-agent-image-tag" k8s_provider = "aro" diff --git a/nullplatform/cloud/aws/cloud/README.md b/nullplatform/cloud/aws/cloud/README.md index 73305ffbb..e1457a9a9 100644 --- a/nullplatform/cloud/aws/cloud/README.md +++ b/nullplatform/cloud/aws/cloud/README.md @@ -21,7 +21,7 @@ The module uses data sources aws_caller_identity and aws_region to dynamically r ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/cloud?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/cloud?ref=v6.21.0" domain_name = "your-domain-name" hosted_private_zone_id = "your-hosted-private-zone-id" diff --git a/nullplatform/cloud/aws/vpc/README.md b/nullplatform/cloud/aws/vpc/README.md index 08a96c139..cbef2b7ee 100644 --- a/nullplatform/cloud/aws/vpc/README.md +++ b/nullplatform/cloud/aws/vpc/README.md @@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource of type aws-ne ```hcl module "vpc" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/vpc?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/vpc?ref=v6.21.0" nrn = "your-nrn" vpc_id = "your-vpc-id" diff --git a/nullplatform/cloud/azure/cloud/README.md b/nullplatform/cloud/azure/cloud/README.md index d59bd2af8..c972be422 100644 --- a/nullplatform/cloud/azure/cloud/README.md +++ b/nullplatform/cloud/azure/cloud/README.md @@ -22,7 +22,7 @@ The module creates a single nullplatform_provider_config resource of type 'azure ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/azure/cloud?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/azure/cloud?ref=v6.21.0" azure_resource_group_name = "your-azure-resource-group-name" nrn = "your-nrn" diff --git a/nullplatform/cloud/gcp/cloud/README.md b/nullplatform/cloud/gcp/cloud/README.md index f3a718725..808c70a0e 100644 --- a/nullplatform/cloud/gcp/cloud/README.md +++ b/nullplatform/cloud/gcp/cloud/README.md @@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type 'googl ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/gcp/cloud?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/gcp/cloud?ref=v6.21.0" domain_name = "your-domain-name" location = "your-location" diff --git a/nullplatform/cloud/oci/cloud/README.md b/nullplatform/cloud/oci/cloud/README.md index a1d62963a..f43a6f388 100644 --- a/nullplatform/cloud/oci/cloud/README.md +++ b/nullplatform/cloud/oci/cloud/README.md @@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type 'oci-c ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/oci/cloud?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/oci/cloud?ref=v6.21.0" account_id = "your-account-id" account_name = "your-account-name" diff --git a/nullplatform/code_repository/README.md b/nullplatform/code_repository/README.md index a3bbee454..8d86052ee 100644 --- a/nullplatform/code_repository/README.md +++ b/nullplatform/code_repository/README.md @@ -22,7 +22,7 @@ The module uses local boolean flags (is_gitlab, is_github, is_azure, is_bitbucke ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.21.0" git_provider = "your-git-provider" nrn = "your-nrn" @@ -33,7 +33,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.21.0" git_provider = "github" github_installation_id = "your-github-installation-id" # Required when git_provider = "github" @@ -46,7 +46,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.21.0" git_provider = "gitlab" gitlab_access_token = "your-gitlab-access-token" # Required when git_provider = "gitlab" @@ -62,7 +62,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.21.0" azure_access_token = "your-azure-access-token" # Required when git_provider = "azure" azure_agent_pool = "your-azure-agent-pool" # Required when git_provider = "azure" @@ -76,7 +76,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.21.0" bitbucket_collaborators = "your-bitbucket-collaborators" # Required when git_provider = "bitbucket" bitbucket_installation_url = "your-bitbucket-installation-url" # Required when git_provider = "bitbucket" diff --git a/nullplatform/container_orchestration/aks/README.md b/nullplatform/container_orchestration/aks/README.md index d241f8f60..d47d26821 100644 --- a/nullplatform/container_orchestration/aks/README.md +++ b/nullplatform/container_orchestration/aks/README.md @@ -22,7 +22,7 @@ The module constructs a set of locals that merge optional and required inputs in ```hcl module "aks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.21.0" cluster_name = "your-cluster-name" nrn = "your-nrn" @@ -36,7 +36,7 @@ module "aks" { ```hcl module "aks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.21.0" cluster_name = "your-cluster-name" nrn = "your-nrn" @@ -50,7 +50,7 @@ module "aks" { ```hcl module "aks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.21.0" cluster_name = "your-cluster-name" nrn = "your-nrn" @@ -64,7 +64,7 @@ module "aks" { ```hcl module "aks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.21.0" cluster_name = "your-cluster-name" nrn = "your-nrn" diff --git a/nullplatform/container_orchestration/eks/README.md b/nullplatform/container_orchestration/eks/README.md index b86c9bafb..d253e54e2 100644 --- a/nullplatform/container_orchestration/eks/README.md +++ b/nullplatform/container_orchestration/eks/README.md @@ -22,7 +22,7 @@ The module assembles multiple local maps (cluster, balancer, network, resource_m ```hcl module "eks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.21.0" cluster_name = "your-cluster-name" nrn = "your-nrn" @@ -34,7 +34,7 @@ module "eks" { ```hcl module "eks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.21.0" cluster_name = "your-cluster-name" nrn = "your-nrn" @@ -46,7 +46,7 @@ module "eks" { ```hcl module "eks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.21.0" cluster_name = "your-cluster-name" nrn = "your-nrn" @@ -58,7 +58,7 @@ module "eks" { ```hcl module "eks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.21.0" cluster_name = "your-cluster-name" nrn = "your-nrn" diff --git a/nullplatform/container_orchestration/gke/README.md b/nullplatform/container_orchestration/gke/README.md index b55dc39c7..7c5f40bb3 100644 --- a/nullplatform/container_orchestration/gke/README.md +++ b/nullplatform/container_orchestration/gke/README.md @@ -22,7 +22,7 @@ The module constructs a set of locals that merge optional inputs (gateway namesp ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.21.0" cluster_name = "your-cluster-name" location = "your-location" @@ -36,7 +36,7 @@ module "gke" { ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.21.0" cluster_name = "your-cluster-name" location = "your-location" @@ -50,7 +50,7 @@ module "gke" { ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.21.0" cluster_name = "your-cluster-name" location = "your-location" @@ -64,7 +64,7 @@ module "gke" { ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.21.0" cluster_name = "your-cluster-name" location = "your-location" diff --git a/nullplatform/container_orchestration/oke/README.md b/nullplatform/container_orchestration/oke/README.md index 7eb214897..b4c3f8727 100644 --- a/nullplatform/container_orchestration/oke/README.md +++ b/nullplatform/container_orchestration/oke/README.md @@ -19,7 +19,7 @@ Creates a single nullplatform_provider_config resource of type 'oke' that stores ```hcl module "oke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/oke?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/oke?ref=v6.21.0" cluster_name = "your-cluster-name" nrn = "your-nrn" diff --git a/nullplatform/dimension/README.md b/nullplatform/dimension/README.md index 77bca040b..fc940ede2 100644 --- a/nullplatform/dimension/README.md +++ b/nullplatform/dimension/README.md @@ -19,7 +19,7 @@ The module creates a nullplatform_dimension resource using the provided name, or ```hcl module "dimension" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension?ref=v6.21.0" name = "your-name" nrn = "your-nrn" diff --git a/nullplatform/dimension_value/README.md b/nullplatform/dimension_value/README.md index 3c81f60c8..ebc9ba39d 100644 --- a/nullplatform/dimension_value/README.md +++ b/nullplatform/dimension_value/README.md @@ -19,7 +19,7 @@ The module uses a terraform_data resource to enforce mutual-exclusivity and pres ```hcl module "dimension_value" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension_value?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension_value?ref=v6.21.0" dimension_id = "your-dimension-id" name = "your-name" diff --git a/nullplatform/identity-access-control/README.md b/nullplatform/identity-access-control/README.md index 9833b9e9a..20256fc9f 100644 --- a/nullplatform/identity-access-control/README.md +++ b/nullplatform/identity-access-control/README.md @@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource named identity ```hcl module "identity-access-control" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/identity-access-control?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/identity-access-control?ref=v6.21.0" attributes = "your-attributes" nrn = "your-nrn" diff --git a/nullplatform/metrics/README.md b/nullplatform/metrics/README.md index 5234161b4..1cffd0298 100644 --- a/nullplatform/metrics/README.md +++ b/nullplatform/metrics/README.md @@ -21,7 +21,7 @@ The module creates a single nullplatform_provider_config resource of type 'prome ```hcl module "metrics" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/metrics?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/metrics?ref=v6.21.0" nrn = "your-nrn" } diff --git a/nullplatform/packaged_service/README.md b/nullplatform/packaged_service/README.md index c3b13959e..8bd5a17ee 100644 --- a/nullplatform/packaged_service/README.md +++ b/nullplatform/packaged_service/README.md @@ -17,7 +17,7 @@ spec updates / republish correctly. ```hcl module "packaged_service" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/packaged_service?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/packaged_service?ref=v6.21.0" nrn = "organization=…:account=…:namespace=…" diff --git a/nullplatform/parameter_storage_configuration/README.md b/nullplatform/parameter_storage_configuration/README.md index 6fef70a59..b456eaed7 100644 --- a/nullplatform/parameter_storage_configuration/README.md +++ b/nullplatform/parameter_storage_configuration/README.md @@ -20,7 +20,7 @@ The module delegates entirely to a remote `scope_configuration` module sourced f ```hcl module "parameter_storage_configuration" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_configuration?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_configuration?ref=v6.21.0" attributes = "your-attributes" np_api_key = "your-np-api-key" diff --git a/nullplatform/parameter_storage_definition/README.md b/nullplatform/parameter_storage_definition/README.md index 28ec37cea..2ef8d8767 100644 --- a/nullplatform/parameter_storage_definition/README.md +++ b/nullplatform/parameter_storage_definition/README.md @@ -20,7 +20,7 @@ A data.http resource fetches the raw specification template from a configurable ```hcl module "parameter_storage_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition?ref=v6.21.0" np_api_key = "your-np-api-key" nrn = "your-nrn" diff --git a/nullplatform/parameter_storage_definition_agent_association/README.md b/nullplatform/parameter_storage_definition_agent_association/README.md index 2863f4831..fe55fe47f 100644 --- a/nullplatform/parameter_storage_definition_agent_association/README.md +++ b/nullplatform/parameter_storage_definition_agent_association/README.md @@ -21,7 +21,7 @@ The module creates a terraform_data resource to track API key changes and a null ```hcl module "parameter_storage_definition_agent_association" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition_agent_association?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition_agent_association?ref=v6.21.0" api_key = "your-api-key" nrn = "your-nrn" diff --git a/nullplatform/scope_configuration/README.md b/nullplatform/scope_configuration/README.md index f6477861c..db77c6854 100644 --- a/nullplatform/scope_configuration/README.md +++ b/nullplatform/scope_configuration/README.md @@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource that binds a N ```hcl module "scope_configuration" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_configuration?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_configuration?ref=v6.21.0" attributes = "your-attributes" np_api_key = "your-np-api-key" diff --git a/nullplatform/scope_definition/README.md b/nullplatform/scope_definition/README.md index ec9ee812b..20383662c 100644 --- a/nullplatform/scope_definition/README.md +++ b/nullplatform/scope_definition/README.md @@ -22,7 +22,7 @@ The module fetches JSON templates via data.http resources from a configurable Gi ```hcl module "scope_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition?ref=v6.21.0" np_api_key = "your-np-api-key" nrn = "your-nrn" diff --git a/nullplatform/scope_definition_agent_association/README.md b/nullplatform/scope_definition_agent_association/README.md index 3a40f7f70..26d70f28b 100644 --- a/nullplatform/scope_definition_agent_association/README.md +++ b/nullplatform/scope_definition_agent_association/README.md @@ -22,7 +22,7 @@ The module fetches a notification channel JSON template via the `data.http` prov ```hcl module "scope_definition_agent_association" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition_agent_association?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition_agent_association?ref=v6.21.0" api_key = "your-api-key" nrn = "your-nrn" diff --git a/nullplatform/service_definition/README.md b/nullplatform/service_definition/README.md index 7df99d7ce..71f5c9482 100644 --- a/nullplatform/service_definition/README.md +++ b/nullplatform/service_definition/README.md @@ -22,7 +22,7 @@ The module uses `data.http` resources to fetch `service-spec.json.tpl`, `actions ```hcl module "service_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.21.0" nrn = "your-nrn" repository_branch = "your-repository-branch" @@ -35,7 +35,7 @@ module "service_definition" { ```hcl module "service_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.21.0" nrn = "your-nrn" repository_branch = "main" @@ -48,7 +48,7 @@ module "service_definition" { ```hcl module "service_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.21.0" git_provider = "your-git-provider" # Required when repository_branch = "v1.4.0" nrn = "your-nrn" diff --git a/nullplatform/service_definition_agent_association/README.md b/nullplatform/service_definition_agent_association/README.md index 3a62f0e84..5498b35d5 100644 --- a/nullplatform/service_definition_agent_association/README.md +++ b/nullplatform/service_definition_agent_association/README.md @@ -22,7 +22,7 @@ The module creates a terraform_data resource to track API key changes as a lifec ```hcl module "service_definition_agent_association" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition_agent_association?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition_agent_association?ref=v6.21.0" api_key = "your-api-key" repository_service_spec_repo = "your-repository-service-spec-repo" diff --git a/nullplatform/users/README.md b/nullplatform/users/README.md index 30b4b0e19..d16cd95de 100644 --- a/nullplatform/users/README.md +++ b/nullplatform/users/README.md @@ -21,7 +21,7 @@ The module iterates over a map of user definitions using `nullplatform_user` res ```hcl module "users" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/users?ref=v6.20.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/users?ref=v6.21.0" nullplatform_users = "your-nullplatform-users" } From 944d6839be633c49ade413afd4ac0a603cfd4266 Mon Sep 17 00:00:00 2001 From: Agustin Celentano <12614595+agustincelentano@users.noreply.github.com> Date: Tue, 1 Sep 2026 09:53:53 -0300 Subject: [PATCH 47/81] feat(istio): remove legacy istio-ingressgateway helm release (#543) The classic istio-ingressgateway (Istio 'gateway' chart) is no longer part of the ingress path: nullplatform-base declares Gateway API resources (gatewayClassName: istio) and istiod auto-provisions the gateway data-plane pods from them. The standalone ingressgateway ran with zero routes configured (no Gateway/VirtualService selects it) and only cost an unused cloud load balancer per cluster. Removes the helm_release, its values template, the gateway-only variables (service_type, ports, http2, replicas, cloud_provider/OCI annotations) and their tests. istio-base and istiod are unchanged. Note: applying this version uninstalls the istio-ingressgateway release and deletes its cloud load balancer. Callers passing the removed variables must drop those arguments. --- infrastructure/commons/istio/README.md | 101 +++--------------- infrastructure/commons/istio/locals.tf | 13 --- infrastructure/commons/istio/main.tf | 38 ------- .../templates/istio_ingressgateway.tmpl.yaml | 20 ---- .../commons/istio/tests/istio.tftest.hcl | 32 +----- .../tests/istio_cross_provider.tftest.hcl | 64 ----------- .../commons/istio/tests/istio_oci.tftest.hcl | 61 ----------- infrastructure/commons/istio/validation.tf | 8 -- infrastructure/commons/istio/variables.tf | 94 +--------------- 9 files changed, 17 insertions(+), 414 deletions(-) delete mode 100644 infrastructure/commons/istio/locals.tf delete mode 100644 infrastructure/commons/istio/templates/istio_ingressgateway.tmpl.yaml delete mode 100644 infrastructure/commons/istio/tests/istio_cross_provider.tftest.hcl delete mode 100644 infrastructure/commons/istio/tests/istio_oci.tftest.hcl delete mode 100644 infrastructure/commons/istio/validation.tf diff --git a/infrastructure/commons/istio/README.md b/infrastructure/commons/istio/README.md index 0ea111c6d..5def7659f 100644 --- a/infrastructure/commons/istio/README.md +++ b/infrastructure/commons/istio/README.md @@ -2,20 +2,17 @@ ## Description -Deploys a production-ready Istio service mesh on Kubernetes using three sequentially ordered Helm releases: istio-base, istiod, and istio-ingressgateway +Deploys the Istio service mesh control plane (istio-base and istiod) on Kubernetes using sequenced Helm releases. Ingress traffic is expected to be handled by Kubernetes Gateway API resources (provisioned by istiod on demand), not by a standalone ingress gateway. ## Architecture -The module creates three helm_release resources in a strict dependency chain: istio-base (CRDs and cluster-wide resources), istiod (control plane, dependent on istio-base), and istio-ingressgateway (data plane gateway, dependent on istiod). The istiod helm_release sets both pilot.replicaCount and pilot.autoscaleMin via the set block to prevent HPA from overriding the replica floor. The istio-ingressgateway helm_release merges a templatefile-rendered YAML (istio_ingressgateway.tmpl.yaml) with set blocks for replicaCount and autoscaling.minReplicas, and the template conditionally injects cloud-provider-specific LoadBalancer annotations based on the cloud_provider variable. +Two helm_release resources are created in a strict dependency chain: istio-base is deployed first (CRDs, including Gateway API support), and istiod depends on istio-base and configures pilot.replicaCount and pilot.autoscaleMin via dynamic set blocks using var.istiod_replicas. Gateway data-plane pods are not installed by this module: istiod auto-provisions them from Gateway API resources (gatewayClassName: istio) declared elsewhere (e.g. the nullplatform-base Helm chart). ## Features -- Deploys istio-base, istiod, and istio-ingressgateway Helm charts in strict dependency order with atomic rollback on failure -- Configures istiod HA by setting both pilot.replicaCount and pilot.autoscaleMin to prevent PodDisruptionBudget from blocking node drains -- Configures istio-ingressgateway HA by locking both replicaCount and autoscaling.minReplicas to prevent single-replica PDB drain deadlocks -- Injects cloud-provider-specific LoadBalancer annotations for AWS, OCI, Azure, and GCP via a templated Helm values file -- Supports optional HTTP/2 port exposure on the ingress gateway alongside the default HTTPS port -- Allows OCI-specific subnet OCID injection for LoadBalancer Service configuration +- Deploys istio-base and istiod Helm charts in dependency order with atomic and cleanup-on-fail guarantees +- Configures istiod HA by setting both pilot.replicaCount and pilot.autoscaleMin to prevent the HPA from scaling below the desired replica floor +- Allows namespace, Helm repository URL, and individual chart versions to be overridden independently for each Istio component ## Basic Usage @@ -46,51 +43,34 @@ resource "example_resource" "this" { | Name | Version | |------|---------| | [helm](#provider\_helm) | 3.1.1 | -| [terraform](#provider\_terraform) | n/a | ## Resources | Name | Type | |------|------| | [helm_release.istio_base](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource | -| [helm_release.istio_ingressgateway](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource | | [helm_release.istiod](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource | -| [terraform_data.provider_validation](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource | ## Inputs | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| -| [cloud\_provider](#input\_cloud\_provider) | The cloud provider where the cluster is running. Used to inject provider-specific LoadBalancer annotations (e.g. oci). Leave empty for generic/on-prem clusters. | `string` | `""` | no | -| [enable\_http2](#input\_enable\_http2) | Whether to expose the HTTP2 (port 80) service | `bool` | `false` | no | -| [http2\_port](#input\_http2\_port) | The external service port for HTTP2 when enabled. | `number` | `80` | no | -| [http2\_target\_port](#input\_http2\_target\_port) | The container target port for HTTP2 when enabled | `number` | `80` | no | -| [https\_port](#input\_https\_port) | The external HTTPS service port | `number` | `443` | no | -| [https\_target\_port](#input\_https\_target\_port) | The container target port for HTTPS | `number` | `8443` | no | | [istio\_base\_version](#input\_istio\_base\_version) | Helm chart version for the istio-base component | `string` | `"1.27.1"` | no | -| [istio\_ingressgateway\_replicas](#input\_istio\_ingressgateway\_replicas) | Number of istio-ingressgateway replicas. Set to 2+ to avoid PDB blocking node drains. Applied to both replicaCount and autoscaling.minReplicas to prevent the HPA from scaling back to 1. The Istio gateway Helm chart installs the gateway with a default PodDisruptionBudget (minAvailable=1), so a single replica blocks node rolling updates with PodEvictionFailure — same class of bug as the istiod single-replica issue. | `number` | `2` | no | -| [istio\_ingressgateway\_version](#input\_istio\_ingressgateway\_version) | Helm chart version for the Istio ingress gateway | `string` | `"1.27.1"` | no | | [istiod\_replicas](#input\_istiod\_replicas) | Number of istiod replicas. Set to 2+ to avoid PDB blocking node drains. Applied to both pilot.replicaCount and pilot.autoscaleMin to prevent the HPA from scaling back to 1. | `number` | `2` | no | | [istiod\_version](#input\_istiod\_version) | Helm chart version for istiod (Istio control plane) | `string` | `"1.27.1"` | no | -| [namespace](#input\_namespace) | The Kubernetes namespace where gateway will be installed. | `string` | `"istio-system"` | no | -| [oci\_load\_balancer\_subnet\_ids](#input\_oci\_load\_balancer\_subnet\_ids) | List of OCI subnet OCIDs for the LoadBalancer Service (required when cloud\_provider is 'oci') | `list(string)` | `[]` | no | +| [namespace](#input\_namespace) | The Kubernetes namespace where Istio will be installed. | `string` | `"istio-system"` | no | | [repository](#input\_repository) | The Helm repository URL (e.g., https://istio-release.storage.googleapis.com/charts). | `string` | `"https://istio-release.storage.googleapis.com/charts"` | no | -| [service\_type](#input\_service\_type) | The Kubernetes service type for the Istio ingress gateway | `string` | `"LoadBalancer"` | no | -| [status\_port](#input\_status\_port) | The status port used (status-port) | `number` | `15021` | no | diff --git a/infrastructure/commons/istio/locals.tf b/infrastructure/commons/istio/locals.tf deleted file mode 100644 index 96cc47ae7..000000000 --- a/infrastructure/commons/istio/locals.tf +++ /dev/null @@ -1,13 +0,0 @@ -locals { - helm_values = templatefile("${path.module}/templates/istio_ingressgateway.tmpl.yaml", { - service_type = var.service_type - status_port = var.status_port - https_port = var.https_port - https_target_port = var.https_target_port - enable_http2 = var.enable_http2 - http2_port = var.http2_port - http2_target_port = var.http2_target_port - cloud_provider = var.cloud_provider - oci_load_balancer_subnet_ids = var.oci_load_balancer_subnet_ids - }) -} diff --git a/infrastructure/commons/istio/main.tf b/infrastructure/commons/istio/main.tf index f3858e12f..a9c6f6ade 100644 --- a/infrastructure/commons/istio/main.tf +++ b/infrastructure/commons/istio/main.tf @@ -61,41 +61,3 @@ resource "helm_release" "istiod" { }, ] } - -# Setup Istio Gateway using Helm -resource "helm_release" "istio_ingressgateway" { - name = "istio-ingressgateway" - depends_on = [helm_release.istiod] - repository = var.repository - chart = "gateway" - namespace = var.namespace - version = var.istio_ingressgateway_version - - create_namespace = true - disable_webhooks = false - force_update = true - wait = true - wait_for_jobs = true - timeout = 600 - atomic = true - cleanup_on_fail = true - replace = true - recreate_pods = true - reset_values = true - reuse_values = false - dependency_update = true - max_history = 10 - - values = [local.helm_values] - - set = [ - { - name = "replicaCount" - value = var.istio_ingressgateway_replicas - }, - { - name = "autoscaling.minReplicas" - value = var.istio_ingressgateway_replicas - }, - ] -} diff --git a/infrastructure/commons/istio/templates/istio_ingressgateway.tmpl.yaml b/infrastructure/commons/istio/templates/istio_ingressgateway.tmpl.yaml deleted file mode 100644 index f4dd4d38c..000000000 --- a/infrastructure/commons/istio/templates/istio_ingressgateway.tmpl.yaml +++ /dev/null @@ -1,20 +0,0 @@ -service: - type: ${service_type} -%{ if cloud_provider == "oci" && length(oci_load_balancer_subnet_ids) > 0 ~} - annotations: - service.beta.kubernetes.io/oci-load-balancer-subnet1: "${join(",", oci_load_balancer_subnet_ids)}" - service.beta.kubernetes.io/oci-load-balancer-internal: "true" -%{ endif ~} - ports: - - name: status-port - port: ${status_port} - targetPort: ${status_port} - %{ if enable_http2 } - - name: http2 - port: ${http2_port} - protocol: TCP - targetPort: ${http2_target_port} - %{ endif } - - name: https - port: ${https_port} - targetPort: ${https_target_port} diff --git a/infrastructure/commons/istio/tests/istio.tftest.hcl b/infrastructure/commons/istio/tests/istio.tftest.hcl index bcf7f95dd..6fa66e39b 100644 --- a/infrastructure/commons/istio/tests/istio.tftest.hcl +++ b/infrastructure/commons/istio/tests/istio.tftest.hcl @@ -13,14 +13,9 @@ run "default_config" { condition = helm_release.istiod.namespace == "istio-system" error_message = "Istiod should deploy to istio-system namespace" } - - assert { - condition = helm_release.istio_ingressgateway.namespace == "istio-system" - error_message = "Ingress gateway should deploy to istio-system namespace" - } } -# Validates all three components have correct chart names +# Validates both components have correct chart names run "correct_chart_names" { command = plan @@ -33,11 +28,6 @@ run "correct_chart_names" { condition = helm_release.istiod.chart == "istiod" error_message = "Istiod chart should be 'istiod'" } - - assert { - condition = helm_release.istio_ingressgateway.chart == "gateway" - error_message = "Ingress gateway chart should be 'gateway'" - } } # Validates consistent versions across all components @@ -45,9 +35,8 @@ run "consistent_versions" { command = plan variables { - istio_base_version = "1.27.1" - istiod_version = "1.27.1" - istio_ingressgateway_version = "1.27.1" + istio_base_version = "1.27.1" + istiod_version = "1.27.1" } assert { @@ -59,11 +48,6 @@ run "consistent_versions" { condition = helm_release.istiod.version == "1.27.1" error_message = "Istiod version should match" } - - assert { - condition = helm_release.istio_ingressgateway.version == "1.27.1" - error_message = "Ingress gateway version should match" - } } # Validates custom namespace is propagated to all components @@ -83,11 +67,6 @@ run "custom_namespace" { condition = helm_release.istiod.namespace == "custom-istio" error_message = "Istiod should use custom namespace" } - - assert { - condition = helm_release.istio_ingressgateway.namespace == "custom-istio" - error_message = "Ingress gateway should use custom namespace" - } } # Validates all releases use atomic deployments @@ -103,11 +82,6 @@ run "atomic_deployments" { condition = helm_release.istiod.atomic == true error_message = "Istiod should use atomic deployment" } - - assert { - condition = helm_release.istio_ingressgateway.atomic == true - error_message = "Ingress gateway should use atomic deployment" - } } # Validates custom repository URL is propagated diff --git a/infrastructure/commons/istio/tests/istio_cross_provider.tftest.hcl b/infrastructure/commons/istio/tests/istio_cross_provider.tftest.hcl deleted file mode 100644 index 4975a5839..000000000 --- a/infrastructure/commons/istio/tests/istio_cross_provider.tftest.hcl +++ /dev/null @@ -1,64 +0,0 @@ -mock_provider "helm" {} - -# Validates invalid cloud_provider is rejected -run "rejects_invalid_provider" { - command = plan - - variables { - cloud_provider = "digitalocean" - } - - expect_failures = [var.cloud_provider] -} - -# Validates default config (no cloud_provider) does not include OCI annotations -run "default_config_no_oci_annotations" { - command = plan - - assert { - condition = !can(regex("oci\\.oraclecloud\\.com/subnet-ids", local.helm_values)) - error_message = "OCI annotation should not be present when cloud_provider is not set" - } -} - -# Validates gcp provider plans successfully without OCI vars -run "gcp_provider_no_oci_vars_required" { - command = plan - - variables { - cloud_provider = "gcp" - } - - assert { - condition = !can(regex("oci\\.oraclecloud\\.com/subnet-ids", local.helm_values)) - error_message = "OCI annotation should not be present for gcp provider" - } -} - -# Validates aws provider plans successfully without OCI vars -run "aws_provider_no_oci_vars_required" { - command = plan - - variables { - cloud_provider = "aws" - } - - assert { - condition = !can(regex("oci\\.oraclecloud\\.com/subnet-ids", local.helm_values)) - error_message = "OCI annotation should not be present for aws provider" - } -} - -# Validates azure provider plans successfully without OCI vars -run "azure_provider_no_oci_vars_required" { - command = plan - - variables { - cloud_provider = "azure" - } - - assert { - condition = !can(regex("oci\\.oraclecloud\\.com/subnet-ids", local.helm_values)) - error_message = "OCI annotation should not be present for azure provider" - } -} diff --git a/infrastructure/commons/istio/tests/istio_oci.tftest.hcl b/infrastructure/commons/istio/tests/istio_oci.tftest.hcl deleted file mode 100644 index 05d603e54..000000000 --- a/infrastructure/commons/istio/tests/istio_oci.tftest.hcl +++ /dev/null @@ -1,61 +0,0 @@ -mock_provider "helm" {} - -variables { - cloud_provider = "oci" - oci_load_balancer_subnet_ids = ["ocid1.subnet.oc1..aaaaaaaatest"] -} - -# Validates OCI provider config plans successfully -run "oci_full_config" { - command = plan - - assert { - condition = helm_release.istio_ingressgateway.namespace == "istio-system" - error_message = "Ingress gateway should deploy to istio-system namespace" - } -} - -# Validates OCI subnet annotation is present in rendered helm values -run "oci_annotation_present" { - command = plan - - assert { - condition = can(regex("service\\.beta\\.kubernetes\\.io/oci-load-balancer-subnet1", local.helm_values)) - error_message = "OCI subnet annotation should be present in helm values" - } -} - -# Validates OCI annotation contains the provided subnet OCID -run "oci_annotation_contains_subnet_id" { - command = plan - - assert { - condition = can(regex("ocid1\\.subnet\\.oc1\\.\\.aaaaaaaatest", local.helm_values)) - error_message = "OCI annotation should include the provided subnet OCID" - } -} - -# Validates multiple subnet OCIDs are joined with comma -run "oci_multiple_subnets_joined" { - command = plan - - variables { - oci_load_balancer_subnet_ids = ["ocid1.subnet.oc1..aaaaaaaafirst", "ocid1.subnet.oc1..aaaaaaaasecond"] - } - - assert { - condition = can(regex("ocid1\\.subnet\\.oc1\\.\\.aaaaaaaafirst,ocid1\\.subnet\\.oc1\\.\\.aaaaaaaasecond", local.helm_values)) - error_message = "Multiple OCI subnets should be comma-joined in the annotation" - } -} - -# Validates OCI fails without subnet IDs -run "oci_requires_subnet_ids" { - command = plan - - variables { - oci_load_balancer_subnet_ids = [] - } - - expect_failures = [terraform_data.provider_validation] -} diff --git a/infrastructure/commons/istio/validation.tf b/infrastructure/commons/istio/validation.tf deleted file mode 100644 index 8f373a945..000000000 --- a/infrastructure/commons/istio/validation.tf +++ /dev/null @@ -1,8 +0,0 @@ -resource "terraform_data" "provider_validation" { - lifecycle { - precondition { - condition = var.cloud_provider != "oci" || length(var.oci_load_balancer_subnet_ids) > 0 - error_message = "oci_load_balancer_subnet_ids is required when cloud_provider is 'oci'." - } - } -} diff --git a/infrastructure/commons/istio/variables.tf b/infrastructure/commons/istio/variables.tf index 87b6b1fcc..8c034cd2e 100644 --- a/infrastructure/commons/istio/variables.tf +++ b/infrastructure/commons/istio/variables.tf @@ -8,12 +8,6 @@ variable "istio_base_version" { default = "1.27.1" } -variable "istio_ingressgateway_version" { - description = "Helm chart version for the Istio ingress gateway" - type = string - default = "1.27.1" -} - variable "istiod_version" { description = "Helm chart version for istiod (Istio control plane)" type = string @@ -31,46 +25,6 @@ variable "istiod_replicas" { } } -variable "istio_ingressgateway_replicas" { - description = "Number of istio-ingressgateway replicas. Set to 2+ to avoid PDB blocking node drains. Applied to both replicaCount and autoscaling.minReplicas to prevent the HPA from scaling back to 1. The Istio gateway Helm chart installs the gateway with a default PodDisruptionBudget (minAvailable=1), so a single replica blocks node rolling updates with PodEvictionFailure — same class of bug as the istiod single-replica issue." - type = number - default = 2 - - validation { - condition = var.istio_ingressgateway_replicas >= 1 - error_message = "istio_ingressgateway_replicas must be at least 1." - } -} - -############################################################################### -# SERVICE CONFIGURATION -############################################################################### - - -variable "service_type" { - type = string - description = "The Kubernetes service type for the Istio ingress gateway" - default = "LoadBalancer" -} - -variable "status_port" { - type = number - description = "The status port used (status-port)" - default = 15021 -} - -variable "https_port" { - type = number - description = "The external HTTPS service port" - default = 443 -} - -variable "https_target_port" { - type = number - description = "The container target port for HTTPS" - default = 8443 -} - ############################################################################### # REPOSITORY CONFIGURATION ############################################################################### @@ -87,53 +41,7 @@ variable "repository" { variable "namespace" { type = string - description = "The Kubernetes namespace where gateway will be installed." + description = "The Kubernetes namespace where Istio will be installed." default = "istio-system" } - -############################################################################### -# CLOUD PROVIDER CONFIGURATION -############################################################################### - -variable "cloud_provider" { - type = string - description = "The cloud provider where the cluster is running. Used to inject provider-specific LoadBalancer annotations (e.g. oci). Leave empty for generic/on-prem clusters." - default = "" - validation { - condition = contains(["", "aws", "oci", "azure", "gcp"], var.cloud_provider) - error_message = "Value must be one of: '', 'aws', 'oci', 'azure', 'gcp'" - } -} - -############################################################################### -# OCI CONFIGURATION -############################################################################### - -variable "oci_load_balancer_subnet_ids" { - type = list(string) - description = "List of OCI subnet OCIDs for the LoadBalancer Service (required when cloud_provider is 'oci')" - default = [] -} - -############################################################################### -# HTTP2 CONFIGURATION -############################################################################### - -variable "enable_http2" { - type = bool - description = "Whether to expose the HTTP2 (port 80) service" - default = false -} - -variable "http2_port" { - type = number - description = "The external service port for HTTP2 when enabled." - default = 80 -} - -variable "http2_target_port" { - type = number - description = "The container target port for HTTP2 when enabled" - default = 80 -} From bdcb48c4a2f506be8e98ec6badcd71471fbe4e71 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 1 Sep 2026 12:54:58 +0000 Subject: [PATCH 48/81] chore(6.x): release 6.22.0 --- CHANGELOG.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index e2a2f453c..2eddacf46 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,12 @@ # Changelog +## [6.22.0](https://github.com/nullplatform/tofu-modules/compare/v6.21.0...v6.22.0) (2026-09-01) + + +### Features + +* **istio:** remove legacy istio-ingressgateway helm release ([#543](https://github.com/nullplatform/tofu-modules/issues/543)) ([957dbc4](https://github.com/nullplatform/tofu-modules/commit/957dbc4b7f9ed1346511f49042fd939143d3831f)) + ## [6.21.0](https://github.com/nullplatform/tofu-modules/compare/v6.20.0...v6.21.0) (2026-08-28) From e6aded61dd1c95900b392663c70c63335871697d Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Tue, 1 Sep 2026 12:55:40 +0000 Subject: [PATCH 49/81] docs: regenerate READMEs for changed modules and update versions --- infrastructure/aws/acm/README.md | 2 +- .../aws_load_balancer_controller/README.md | 2 +- infrastructure/aws/backend/README.md | 2 +- infrastructure/aws/dns/README.md | 2 +- infrastructure/aws/eks/README.md | 2 +- infrastructure/aws/iam/agent/README.md | 2 +- .../README.md | 2 +- infrastructure/aws/iam/cert_manager/README.md | 2 +- .../aws/iam/ci-build-workflow-user/README.md | 2 +- infrastructure/aws/iam/cloudwatch/README.md | 2 +- infrastructure/aws/iam/ecr/README.md | 2 +- infrastructure/aws/iam/external_dns/README.md | 2 +- infrastructure/aws/iam/s3/README.md | 2 +- infrastructure/aws/ingress/README.md | 2 +- infrastructure/aws/security/README.md | 2 +- infrastructure/aws/vpc/README.md | 2 +- infrastructure/azure/acr/README.md | 2 +- infrastructure/azure/aks/README.md | 2 +- .../azure/aks_route_table/README.md | 2 +- infrastructure/azure/dns/README.md | 2 +- infrastructure/azure/iam/README.md | 2 +- infrastructure/azure/private_dns/README.md | 2 +- infrastructure/azure/resource_group/README.md | 2 +- infrastructure/azure/security/README.md | 2 +- infrastructure/azure/vnet/README.md | 2 +- infrastructure/commons/cert_manager/README.md | 14 +++++----- infrastructure/commons/external_dns/README.md | 14 +++++----- infrastructure/commons/istio/README.md | 28 +++++++++++-------- infrastructure/commons/prometheus/README.md | 8 +++--- .../gcp/artifact-registry/README.md | 2 +- infrastructure/gcp/backend/README.md | 2 +- infrastructure/gcp/cloud-dns/README.md | 2 +- infrastructure/gcp/cloud-nat/README.md | 2 +- infrastructure/gcp/gke/README.md | 6 ++-- infrastructure/gcp/iam/README.md | 2 +- infrastructure/gcp/security/README.md | 2 +- infrastructure/gcp/vpc/README.md | 2 +- infrastructure/oci/backend/README.md | 2 +- infrastructure/oci/dns/README.md | 2 +- infrastructure/oci/dynamic_groups/README.md | 2 +- infrastructure/oci/oke/README.md | 2 +- infrastructure/oci/vcn/README.md | 2 +- nullplatform/account/README.md | 2 +- nullplatform/agent/README.md | 16 +++++------ nullplatform/api_key/README.md | 12 ++++---- nullplatform/asset/docker_server/README.md | 2 +- nullplatform/asset/ecr/README.md | 2 +- nullplatform/asset/s3/README.md | 2 +- nullplatform/base/README.md | 12 ++++---- nullplatform/cloud/aws/cloud/README.md | 2 +- nullplatform/cloud/aws/vpc/README.md | 2 +- nullplatform/cloud/azure/cloud/README.md | 2 +- nullplatform/cloud/gcp/cloud/README.md | 2 +- nullplatform/cloud/oci/cloud/README.md | 2 +- nullplatform/code_repository/README.md | 10 +++---- .../container_orchestration/aks/README.md | 8 +++--- .../container_orchestration/eks/README.md | 8 +++--- .../container_orchestration/gke/README.md | 8 +++--- .../container_orchestration/oke/README.md | 2 +- nullplatform/dimension/README.md | 2 +- nullplatform/dimension_value/README.md | 2 +- .../identity-access-control/README.md | 2 +- nullplatform/metrics/README.md | 2 +- nullplatform/packaged_service/README.md | 2 +- .../parameter_storage_configuration/README.md | 2 +- .../parameter_storage_definition/README.md | 2 +- .../README.md | 2 +- nullplatform/scope_configuration/README.md | 2 +- nullplatform/scope_definition/README.md | 2 +- .../README.md | 2 +- nullplatform/service_definition/README.md | 6 ++-- .../README.md | 2 +- nullplatform/users/README.md | 2 +- 73 files changed, 137 insertions(+), 133 deletions(-) diff --git a/infrastructure/aws/acm/README.md b/infrastructure/aws/acm/README.md index 6f76e8ba9..832d908e1 100644 --- a/infrastructure/aws/acm/README.md +++ b/infrastructure/aws/acm/README.md @@ -18,7 +18,7 @@ The module creates an aws_acm_certificate resource with DNS validation, which is ```hcl module "acm" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/acm?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/acm?ref=v6.22.0" domain_name = "your-domain-name" zone_id = "your-zone-id" diff --git a/infrastructure/aws/aws_load_balancer_controller/README.md b/infrastructure/aws/aws_load_balancer_controller/README.md index 8ecd418a4..8a5e33563 100644 --- a/infrastructure/aws/aws_load_balancer_controller/README.md +++ b/infrastructure/aws/aws_load_balancer_controller/README.md @@ -18,7 +18,7 @@ This module creates a helm_release resource to deploy the AWS Load Balancer Cont ```hcl module "aws_load_balancer_controller" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/aws_load_balancer_controller?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/aws_load_balancer_controller?ref=v6.22.0" cluster_name = "your-cluster-name" vpc_id = "your-vpc-id" diff --git a/infrastructure/aws/backend/README.md b/infrastructure/aws/backend/README.md index ef9e3edda..1d0f4848f 100644 --- a/infrastructure/aws/backend/README.md +++ b/infrastructure/aws/backend/README.md @@ -20,7 +20,7 @@ This module creates an S3 bucket with versioning and server-side encryption enab ```hcl module "backend" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/backend?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/backend?ref=v6.22.0" } ``` diff --git a/infrastructure/aws/dns/README.md b/infrastructure/aws/dns/README.md index dddd76f18..d8ca4853b 100644 --- a/infrastructure/aws/dns/README.md +++ b/infrastructure/aws/dns/README.md @@ -21,7 +21,7 @@ The module conditionally creates an aws_route53_zone resource for a public hoste ```hcl module "dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/dns?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/dns?ref=v6.22.0" domain_name = "your-domain-name" vpc_id = "your-vpc-id" diff --git a/infrastructure/aws/eks/README.md b/infrastructure/aws/eks/README.md index 6f3dbef9b..c30307d7d 100644 --- a/infrastructure/aws/eks/README.md +++ b/infrastructure/aws/eks/README.md @@ -22,7 +22,7 @@ The module wraps terraform-aws-modules/eks to create the EKS cluster (aws_eks_cl ```hcl module "eks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/eks?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/eks?ref=v6.22.0" aws_subnets_private_ids = "your-aws-subnets-private-ids" aws_vpc_vpc_id = "your-aws-vpc-vpc-id" diff --git a/infrastructure/aws/iam/agent/README.md b/infrastructure/aws/iam/agent/README.md index 40809fceb..b59794727 100644 --- a/infrastructure/aws/iam/agent/README.md +++ b/infrastructure/aws/iam/agent/README.md @@ -21,7 +21,7 @@ The module uses the terraform-aws-modules/iam//modules/iam-role-for-service-acco ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/agent?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/agent?ref=v6.22.0" agent_namespace = "your-agent-namespace" aws_iam_openid_connect_provider_arn = "your-aws-iam-openid-connect-provider-arn" diff --git a/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md b/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md index f95218715..8359be7a1 100644 --- a/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md +++ b/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md @@ -19,7 +19,7 @@ This module creates an IAM role for the AWS Load Balancer Controller using the t ```hcl module "aws_load_balancer_controller_iam" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/aws_load_balancer_controller_iam?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/aws_load_balancer_controller_iam?ref=v6.22.0" aws_iam_openid_connect_provider_arn = "your-aws-iam-openid-connect-provider-arn" cluster_name = "your-cluster-name" diff --git a/infrastructure/aws/iam/cert_manager/README.md b/infrastructure/aws/iam/cert_manager/README.md index 224cd2ec3..451ec5347 100644 --- a/infrastructure/aws/iam/cert_manager/README.md +++ b/infrastructure/aws/iam/cert_manager/README.md @@ -20,7 +20,7 @@ An aws_iam_policy resource is always created granting route53:GetChange, route53 ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cert_manager?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cert_manager?ref=v6.22.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/ci-build-workflow-user/README.md b/infrastructure/aws/iam/ci-build-workflow-user/README.md index 696258e9c..339ea6a2e 100644 --- a/infrastructure/aws/iam/ci-build-workflow-user/README.md +++ b/infrastructure/aws/iam/ci-build-workflow-user/README.md @@ -21,7 +21,7 @@ The module creates an aws_iam_user named with the cluster_name prefix and genera ```hcl module "ci-build-workflow-user" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ci-build-workflow-user?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ci-build-workflow-user?ref=v6.22.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/cloudwatch/README.md b/infrastructure/aws/iam/cloudwatch/README.md index c6168fa66..b4fdf7397 100644 --- a/infrastructure/aws/iam/cloudwatch/README.md +++ b/infrastructure/aws/iam/cloudwatch/README.md @@ -20,7 +20,7 @@ The module creates an aws_iam_policy granting CloudWatch Logs and Metrics write ```hcl module "cloudwatch" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cloudwatch?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cloudwatch?ref=v6.22.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/ecr/README.md b/infrastructure/aws/iam/ecr/README.md index 3937f5bb8..56b6eb4ab 100644 --- a/infrastructure/aws/iam/ecr/README.md +++ b/infrastructure/aws/iam/ecr/README.md @@ -20,7 +20,7 @@ The module creates an aws_iam_role named nullplatform-{cluster_name}-application ```hcl module "ecr" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ecr?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ecr?ref=v6.22.0" build_workflow_group_name = "your-build-workflow-group-name" cluster_name = "your-cluster-name" diff --git a/infrastructure/aws/iam/external_dns/README.md b/infrastructure/aws/iam/external_dns/README.md index f52ddde14..8f54c08bc 100644 --- a/infrastructure/aws/iam/external_dns/README.md +++ b/infrastructure/aws/iam/external_dns/README.md @@ -20,7 +20,7 @@ An aws_iam_policy resource named nullplatform_external_dns_policy is always crea ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/external_dns?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/external_dns?ref=v6.22.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/s3/README.md b/infrastructure/aws/iam/s3/README.md index 29f2a644a..1a2683eb7 100644 --- a/infrastructure/aws/iam/s3/README.md +++ b/infrastructure/aws/iam/s3/README.md @@ -18,7 +18,7 @@ The module creates an aws_iam_policy resource that allows s3:PutObject and s3:Ge ```hcl module "s3" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/s3?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/s3?ref=v6.22.0" bucket = "your-bucket" build_workflow_group_name = "your-build-workflow-group-name" diff --git a/infrastructure/aws/ingress/README.md b/infrastructure/aws/ingress/README.md index 91c2b0a5f..0a17561ea 100644 --- a/infrastructure/aws/ingress/README.md +++ b/infrastructure/aws/ingress/README.md @@ -22,7 +22,7 @@ The module creates up to two kubernetes_ingress_v1 resources — one for an inte ```hcl module "ingress" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/ingress?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/ingress?ref=v6.22.0" certificate_arn = "your-certificate-arn" } diff --git a/infrastructure/aws/security/README.md b/infrastructure/aws/security/README.md index 07a1dced3..3797b30ac 100644 --- a/infrastructure/aws/security/README.md +++ b/infrastructure/aws/security/README.md @@ -22,7 +22,7 @@ The module uses data sources (aws_eks_cluster, aws_vpc) to automatically derive ```hcl module "security" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/security?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/security?ref=v6.22.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/vpc/README.md b/infrastructure/aws/vpc/README.md index ff2b9614c..33a4116f1 100644 --- a/infrastructure/aws/vpc/README.md +++ b/infrastructure/aws/vpc/README.md @@ -22,7 +22,7 @@ This module creates a terraform-aws-modules/vpc/aws module resource with DNS hos ```hcl module "vpc" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/vpc?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/vpc?ref=v6.22.0" account = "your-account" organization = "your-organization" diff --git a/infrastructure/azure/acr/README.md b/infrastructure/azure/acr/README.md index 0d0780789..e69025832 100644 --- a/infrastructure/azure/acr/README.md +++ b/infrastructure/azure/acr/README.md @@ -18,7 +18,7 @@ The module uses the azurerm_container_registry resource to create the container ```hcl module "acr" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/acr?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/acr?ref=v6.22.0" containerregistry_name = "your-containerregistry-name" location = "your-location" diff --git a/infrastructure/azure/aks/README.md b/infrastructure/azure/aks/README.md index b759c0f15..418a07470 100644 --- a/infrastructure/azure/aks/README.md +++ b/infrastructure/azure/aks/README.md @@ -22,7 +22,7 @@ The module wraps the Azure/aks/azurerm community module (version 11.0.0) and use ```hcl module "aks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks?ref=v6.22.0" cluster_name = "your-cluster-name" location = "your-location" diff --git a/infrastructure/azure/aks_route_table/README.md b/infrastructure/azure/aks_route_table/README.md index 513e5720e..2f2dba42a 100644 --- a/infrastructure/azure/aks_route_table/README.md +++ b/infrastructure/azure/aks_route_table/README.md @@ -19,7 +19,7 @@ The module uses an azurerm_resources data source to discover the AKS-managed rou ```hcl module "aks_route_table" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks_route_table?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks_route_table?ref=v6.22.0" node_resource_group = "your-node-resource-group" subnet_id = "your-subnet-id" diff --git a/infrastructure/azure/dns/README.md b/infrastructure/azure/dns/README.md index 8ffba1b31..6a8792088 100644 --- a/infrastructure/azure/dns/README.md +++ b/infrastructure/azure/dns/README.md @@ -18,7 +18,7 @@ This module creates an azurerm_dns_zone resource and configures it with the prov ```hcl module "dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/dns?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/dns?ref=v6.22.0" domain_name = "your-domain-name" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/iam/README.md b/infrastructure/azure/iam/README.md index 6688696cb..6303bd0b9 100644 --- a/infrastructure/azure/iam/README.md +++ b/infrastructure/azure/iam/README.md @@ -21,7 +21,7 @@ The module creates an azurerm_user_assigned_identity resource in the specified r ```hcl module "iam" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/iam?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/iam?ref=v6.22.0" location = "your-location" name = "your-name" diff --git a/infrastructure/azure/private_dns/README.md b/infrastructure/azure/private_dns/README.md index af0df7a1c..a6ed41a69 100644 --- a/infrastructure/azure/private_dns/README.md +++ b/infrastructure/azure/private_dns/README.md @@ -18,7 +18,7 @@ This module creates an azurerm_private_dns_zone resource and optionally multiple ```hcl module "private_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/private_dns?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/private_dns?ref=v6.22.0" domain_name = "your-domain-name" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/resource_group/README.md b/infrastructure/azure/resource_group/README.md index 792e9fe81..d198ca506 100644 --- a/infrastructure/azure/resource_group/README.md +++ b/infrastructure/azure/resource_group/README.md @@ -18,7 +18,7 @@ This module creates an azurerm_resource_group resource and outputs its name and ```hcl module "resource_group" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/resource_group?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/resource_group?ref=v6.22.0" location = "your-location" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/security/README.md b/infrastructure/azure/security/README.md index d9f8780b1..4cefab63e 100644 --- a/infrastructure/azure/security/README.md +++ b/infrastructure/azure/security/README.md @@ -21,7 +21,7 @@ The module uses azurerm_kubernetes_cluster and azurerm_virtual_network data sour ```hcl module "security" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/security?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/security?ref=v6.22.0" cluster_name = "your-cluster-name" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/vnet/README.md b/infrastructure/azure/vnet/README.md index e65df5967..2f0508a66 100644 --- a/infrastructure/azure/vnet/README.md +++ b/infrastructure/azure/vnet/README.md @@ -18,7 +18,7 @@ This module creates an Azure virtual network using the azurerm provider and conf ```hcl module "vnet" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/vnet?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/vnet?ref=v6.22.0" address_space = "your-address-space" location = "your-location" diff --git a/infrastructure/commons/cert_manager/README.md b/infrastructure/commons/cert_manager/README.md index 9f4a96924..96adb4a44 100644 --- a/infrastructure/commons/cert_manager/README.md +++ b/infrastructure/commons/cert_manager/README.md @@ -22,7 +22,7 @@ The module creates two core helm_release resources: cert-manager from charts.jet ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.22.0" account_slug = "your-account-slug" cert_manager_version = "your-cert-manager-version" @@ -36,7 +36,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.22.0" account_slug = "your-account-slug" cert_manager_version = "your-cert-manager-version" @@ -52,7 +52,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.22.0" account_slug = "your-account-slug" azure_client_id = "your-azure-client-id" # Required when cloud_provider = "azure" @@ -71,7 +71,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.22.0" account_slug = "your-account-slug" cert_manager_version = "your-cert-manager-version" @@ -87,7 +87,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.22.0" account_slug = "your-account-slug" aws_identity_mode = "your-aws-identity-mode" # Required when cloud_provider = "aws" @@ -104,7 +104,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.22.0" account_slug = "your-account-slug" cert_manager_version = "your-cert-manager-version" @@ -123,7 +123,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.22.0" account_slug = "your-account-slug" cert_manager_version = "v1.21.1" diff --git a/infrastructure/commons/external_dns/README.md b/infrastructure/commons/external_dns/README.md index 915273208..f2908a564 100644 --- a/infrastructure/commons/external_dns/README.md +++ b/infrastructure/commons/external_dns/README.md @@ -22,7 +22,7 @@ The module creates an optional kubernetes_namespace_v1 resource and a helm_relea ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.22.0" dns_provider_name = "your-dns-provider-name" domain_filters = "your-domain-filters" @@ -33,7 +33,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.22.0" cloudflare_token = "your-cloudflare-token" # Required when dns_provider_name = "cloudflare" dns_provider_name = "cloudflare" @@ -45,7 +45,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.22.0" aws_iam_role_arn = "your-aws-iam-role-arn" # Required when dns_provider_name = "aws" aws_identity_mode = "your-aws-identity-mode" # Required when dns_provider_name = "aws" @@ -61,7 +61,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.22.0" dns_provider_name = "oci" domain_filters = "your-domain-filters" @@ -76,7 +76,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.22.0" azure_client_id = "your-azure-client-id" # Required when dns_provider_name = "azure" azure_resource_group = "your-azure-resource-group" # Required when dns_provider_name = "azure" @@ -92,7 +92,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.22.0" azure_client_id = "your-azure-client-id" # Required when dns_provider_name = "azure-private-dns" azure_resource_group = "your-azure-resource-group" # Required when dns_provider_name = "azure-private-dns" @@ -108,7 +108,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.22.0" dns_provider_name = "google" domain_filters = "your-domain-filters" diff --git a/infrastructure/commons/istio/README.md b/infrastructure/commons/istio/README.md index 5def7659f..c9e8be8d5 100644 --- a/infrastructure/commons/istio/README.md +++ b/infrastructure/commons/istio/README.md @@ -2,23 +2,25 @@ ## Description -Deploys the Istio service mesh control plane (istio-base and istiod) on Kubernetes using sequenced Helm releases. Ingress traffic is expected to be handled by Kubernetes Gateway API resources (provisioned by istiod on demand), not by a standalone ingress gateway. +Deploys Istio service mesh components (istio-base and istiod) into a Kubernetes cluster using Helm with configurable high-availability settings ## Architecture -Two helm_release resources are created in a strict dependency chain: istio-base is deployed first (CRDs, including Gateway API support), and istiod depends on istio-base and configures pilot.replicaCount and pilot.autoscaleMin via dynamic set blocks using var.istiod_replicas. Gateway data-plane pods are not installed by this module: istiod auto-provisions them from Gateway API resources (gatewayClassName: istio) declared elsewhere (e.g. the nullplatform-base Helm chart). +The module creates two helm_release resources: istio-base (the CRD and cluster-wide resource foundation) and istiod (the Istio control plane), with istiod depending on istio-base to enforce installation order. Both helm_release resources are configured with atomic installs, cleanup on failure, and forced updates for reliability. The istiod helm_release passes istiod_replicas into both pilot.replicaCount and pilot.autoscaleMin set blocks to enforce an HA floor that prevents the HPA from scaling the deployment back to a single replica. ## Features -- Deploys istio-base and istiod Helm charts in dependency order with atomic and cleanup-on-fail guarantees -- Configures istiod HA by setting both pilot.replicaCount and pilot.autoscaleMin to prevent the HPA from scaling below the desired replica floor -- Allows namespace, Helm repository URL, and individual chart versions to be overridden independently for each Istio component +- Deploys istio-base Helm chart with CRDs and cluster-scoped resources required by the Istio control plane +- Deploys istiod Helm chart as the Istio control plane with enforced dependency ordering on istio-base +- Configures high-availability for istiod by setting both pilot.replicaCount and pilot.autoscaleMin to prevent HPA from reducing replicas below the configured floor +- Enables atomic Helm releases with automatic cleanup on failure and pod recreation for safe upgrades +- Supports configurable Kubernetes namespace, Helm repository URL, and independent chart versions for istio-base and istiod ## Basic Usage ```hcl module "istio" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/istio?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/istio?ref=v6.22.0" } ``` @@ -65,12 +67,14 @@ resource "example_resource" "this" { diff --git a/infrastructure/commons/prometheus/README.md b/infrastructure/commons/prometheus/README.md index dc6efd037..cd40a4ffa 100644 --- a/infrastructure/commons/prometheus/README.md +++ b/infrastructure/commons/prometheus/README.md @@ -21,7 +21,7 @@ A single helm_release resource named 'prometheus' installs the prometheus-commun ```hcl module "prometheus" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.22.0" prometheus_version = "your-prometheus-version" } @@ -31,7 +31,7 @@ module "prometheus" { ```hcl module "prometheus" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.22.0" prometheus_version = "latest" } @@ -41,7 +41,7 @@ module "prometheus" { ```hcl module "prometheus" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.22.0" prometheus_version = "main" } @@ -51,7 +51,7 @@ module "prometheus" { ```hcl module "prometheus" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.22.0" prometheus_version = "master" } diff --git a/infrastructure/gcp/artifact-registry/README.md b/infrastructure/gcp/artifact-registry/README.md index b6bcf6ff8..fdba401f8 100644 --- a/infrastructure/gcp/artifact-registry/README.md +++ b/infrastructure/gcp/artifact-registry/README.md @@ -21,7 +21,7 @@ The module creates a google_artifact_registry_repository resource configured wit ```hcl module "artifact-registry" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/artifact-registry?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/artifact-registry?ref=v6.22.0" location = "your-location" project_id = "your-project-id" diff --git a/infrastructure/gcp/backend/README.md b/infrastructure/gcp/backend/README.md index bb46a69f9..8e3e5080f 100644 --- a/infrastructure/gcp/backend/README.md +++ b/infrastructure/gcp/backend/README.md @@ -22,7 +22,7 @@ The module creates a random_id resource to generate a unique 8-byte hex suffix, ```hcl module "backend" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/backend?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/backend?ref=v6.22.0" project_id = "your-project-id" } diff --git a/infrastructure/gcp/cloud-dns/README.md b/infrastructure/gcp/cloud-dns/README.md index 6e7e00093..6fae5dea8 100644 --- a/infrastructure/gcp/cloud-dns/README.md +++ b/infrastructure/gcp/cloud-dns/README.md @@ -21,7 +21,7 @@ The module creates a single google_dns_managed_zone resource in the specified GC ```hcl module "cloud-dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-dns?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-dns?ref=v6.22.0" domain_name = "your-domain-name" project_id = "your-project-id" diff --git a/infrastructure/gcp/cloud-nat/README.md b/infrastructure/gcp/cloud-nat/README.md index a0d6b0119..b1fa903fe 100644 --- a/infrastructure/gcp/cloud-nat/README.md +++ b/infrastructure/gcp/cloud-nat/README.md @@ -19,7 +19,7 @@ This module creates a google_compute_router resource in a specified region and n ```hcl module "cloud-nat" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-nat?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-nat?ref=v6.22.0" nat_name = "your-nat-name" network_id = "your-network-id" diff --git a/infrastructure/gcp/gke/README.md b/infrastructure/gcp/gke/README.md index 2f27f9a02..e66b18269 100644 --- a/infrastructure/gcp/gke/README.md +++ b/infrastructure/gcp/gke/README.md @@ -22,7 +22,7 @@ The module conditionally creates one of two mutually-exclusive submodules based ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.22.0" cluster_name = "your-cluster-name" ip_range_pods = "your-ip-range-pods" @@ -38,7 +38,7 @@ module "gke" { ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.22.0" cluster_name = "your-cluster-name" ip_range_pods = "your-ip-range-pods" @@ -73,7 +73,7 @@ module "gke" { ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.22.0" cluster_name = "your-cluster-name" ip_range_pods = "your-ip-range-pods" diff --git a/infrastructure/gcp/iam/README.md b/infrastructure/gcp/iam/README.md index e8d913d41..30b39ea00 100644 --- a/infrastructure/gcp/iam/README.md +++ b/infrastructure/gcp/iam/README.md @@ -19,7 +19,7 @@ The module creates google_service_account resources for each service account spe ```hcl module "iam" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/iam?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/iam?ref=v6.22.0" project_id = "your-project-id" } diff --git a/infrastructure/gcp/security/README.md b/infrastructure/gcp/security/README.md index ab6a3c5c7..6e448f5bc 100644 --- a/infrastructure/gcp/security/README.md +++ b/infrastructure/gcp/security/README.md @@ -22,7 +22,7 @@ The module uses data.google_container_cluster and data.google_compute_subnetwork ```hcl module "security" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/security?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/security?ref=v6.22.0" cluster_name = "your-cluster-name" gcp_project_id = "your-gcp-project-id" diff --git a/infrastructure/gcp/vpc/README.md b/infrastructure/gcp/vpc/README.md index 5493a6bc9..f49bd1991 100644 --- a/infrastructure/gcp/vpc/README.md +++ b/infrastructure/gcp/vpc/README.md @@ -20,7 +20,7 @@ The module invokes the terraform-google-modules/network/google module to create ```hcl module "vpc" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/vpc?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/vpc?ref=v6.22.0" network_name = "your-network-name" project_id = "your-project-id" diff --git a/infrastructure/oci/backend/README.md b/infrastructure/oci/backend/README.md index 2e4607e60..e5d63a35c 100644 --- a/infrastructure/oci/backend/README.md +++ b/infrastructure/oci/backend/README.md @@ -18,7 +18,7 @@ The module creates an oci_objectstorage_bucket resource, which is configured wit ```hcl module "backend" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/backend?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/backend?ref=v6.22.0" compartment_id = "your-compartment-id" namespace = "your-namespace" diff --git a/infrastructure/oci/dns/README.md b/infrastructure/oci/dns/README.md index c620203d0..3ad0030f4 100644 --- a/infrastructure/oci/dns/README.md +++ b/infrastructure/oci/dns/README.md @@ -18,7 +18,7 @@ This module creates oci_dns_zone resources for each DNS zone defined in the dns_ ```hcl module "dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dns?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dns?ref=v6.22.0" compartment_id = "your-compartment-id" } diff --git a/infrastructure/oci/dynamic_groups/README.md b/infrastructure/oci/dynamic_groups/README.md index 244742364..2c815da44 100644 --- a/infrastructure/oci/dynamic_groups/README.md +++ b/infrastructure/oci/dynamic_groups/README.md @@ -19,7 +19,7 @@ This module creates an OCI dynamic group and an OCI identity policy, connecting ```hcl module "dynamic_groups" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dynamic_groups?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dynamic_groups?ref=v6.22.0" cluster_id = "your-cluster-id" compartment_id = "your-compartment-id" diff --git a/infrastructure/oci/oke/README.md b/infrastructure/oci/oke/README.md index 29b297526..c6d1d1e17 100644 --- a/infrastructure/oci/oke/README.md +++ b/infrastructure/oci/oke/README.md @@ -21,7 +21,7 @@ The module instantiates the oracle-terraform-modules/oke/oci module to create an ```hcl module "oke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/oke?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/oke?ref=v6.22.0" api_endpoint_subnet_id = "your-api-endpoint-subnet-id" cluster_name = "your-cluster-name" diff --git a/infrastructure/oci/vcn/README.md b/infrastructure/oci/vcn/README.md index 83960ce30..88f1d3070 100644 --- a/infrastructure/oci/vcn/README.md +++ b/infrastructure/oci/vcn/README.md @@ -19,7 +19,7 @@ The module instantiates oci_core_subnet resources for public and private subnets ```hcl module "vcn" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/vcn?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/vcn?ref=v6.22.0" } ``` diff --git a/nullplatform/account/README.md b/nullplatform/account/README.md index 7ce8035ce..26b2ba8c7 100644 --- a/nullplatform/account/README.md +++ b/nullplatform/account/README.md @@ -19,7 +19,7 @@ The module iterates over the `nullplatform_accounts` input map using `for_each` ```hcl module "account" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/account?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/account?ref=v6.22.0" nullplatform_accounts = "your-nullplatform-accounts" } diff --git a/nullplatform/agent/README.md b/nullplatform/agent/README.md index 32ea0d82d..00971b9a6 100644 --- a/nullplatform/agent/README.md +++ b/nullplatform/agent/README.md @@ -22,7 +22,7 @@ The module creates a `helm_release` resource named `agent` that deploys the `nul ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.22.0" agent_repos_scope_tag = "your-agent-repos-scope-tag" agent_traffic_manager_tag = "your-agent-traffic-manager-tag" @@ -39,7 +39,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.22.0" agent_repos_scope_tag = "your-agent-repos-scope-tag" agent_traffic_manager_tag = "your-agent-traffic-manager-tag" @@ -57,7 +57,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.22.0" agent_repos_scope_tag = "your-agent-repos-scope-tag" agent_traffic_manager_tag = "your-agent-traffic-manager-tag" @@ -74,7 +74,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.22.0" agent_repos_scope_tag = "your-agent-repos-scope-tag" agent_traffic_manager_tag = "your-agent-traffic-manager-tag" @@ -97,7 +97,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.22.0" agent_repos_scope_tag = "your-agent-repos-scope-tag" agent_traffic_manager_tag = "your-agent-traffic-manager-tag" @@ -114,7 +114,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.22.0" agent_repos_scope_tag = "your-agent-repos-scope-tag" agent_traffic_manager_tag = "your-agent-traffic-manager-tag" @@ -131,7 +131,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.22.0" agent_repos_scope = "your-agent-repos-scope" # Required when agent_repos_scope_tag = "fixed git tag (e.g. v1.15.1)" agent_repos_scope_tag = "fixed git tag (e.g. v1.15.1)" @@ -149,7 +149,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.22.0" agent_repos_scope_tag = "your-agent-repos-scope-tag" agent_traffic_manager_tag = "fixed semver (e.g. 1.8.0)" diff --git a/nullplatform/api_key/README.md b/nullplatform/api_key/README.md index 249c89395..084e85a12 100644 --- a/nullplatform/api_key/README.md +++ b/nullplatform/api_key/README.md @@ -22,7 +22,7 @@ The module defines a single nullplatform_api_key resource whose name, grants, an ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.22.0" type = "your-type" } @@ -32,7 +32,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.22.0" nrn = "your-nrn" # Required when type = "agent" type = "agent" @@ -43,7 +43,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.22.0" nrn = "your-nrn" # Required when type = "base" type = "base" @@ -54,7 +54,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.22.0" nrn = "your-nrn" # Required when type = "scope_notification" specification_slug = "your-specification-slug" # Required when type = "scope_notification" @@ -66,7 +66,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.22.0" nrn = "your-nrn" # Required when type = "service_notification" specification_slug = "your-specification-slug" # Required when type = "service_notification" @@ -78,7 +78,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.22.0" custom_name = "your-custom-name" # Required when type = "custom" custom_role_slugs = "your-custom-role-slugs" # Required when type = "custom" diff --git a/nullplatform/asset/docker_server/README.md b/nullplatform/asset/docker_server/README.md index 58fe258d8..5ffad6ff3 100644 --- a/nullplatform/asset/docker_server/README.md +++ b/nullplatform/asset/docker_server/README.md @@ -21,7 +21,7 @@ Creates a nullplatform_provider_config resource of type 'docker-server' with enc ```hcl module "docker_server" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/docker_server?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/docker_server?ref=v6.22.0" login_server = "your-login-server" nrn = "your-nrn" diff --git a/nullplatform/asset/ecr/README.md b/nullplatform/asset/ecr/README.md index f9179394e..758032ab4 100644 --- a/nullplatform/asset/ecr/README.md +++ b/nullplatform/asset/ecr/README.md @@ -21,7 +21,7 @@ The module reads the current AWS region via the aws_region data source and combi ```hcl module "ecr" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/ecr?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/ecr?ref=v6.22.0" application_role_arn = "your-application-role-arn" build_workflow_access_key_id = "your-build-workflow-access-key-id" diff --git a/nullplatform/asset/s3/README.md b/nullplatform/asset/s3/README.md index aab35aa01..32fbaf221 100644 --- a/nullplatform/asset/s3/README.md +++ b/nullplatform/asset/s3/README.md @@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type s3-con ```hcl module "s3" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/s3?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/s3?ref=v6.22.0" bucket_name = "your-bucket-name" nrn = "your-nrn" diff --git a/nullplatform/base/README.md b/nullplatform/base/README.md index b64810eb5..e50e5e7e9 100644 --- a/nullplatform/base/README.md +++ b/nullplatform/base/README.md @@ -22,7 +22,7 @@ The module creates two kubernetes_namespace_v1 resources ('nullplatform-tools' a ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.22.0" control_plane_agent_image_tag = "your-control-plane-agent-image-tag" k8s_provider = "your-k8s-provider" @@ -36,7 +36,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.22.0" control_plane_agent_image_tag = "your-control-plane-agent-image-tag" k8s_provider = "eks" @@ -50,7 +50,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.22.0" control_plane_agent_image_tag = "your-control-plane-agent-image-tag" k8s_provider = "gke" @@ -64,7 +64,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.22.0" control_plane_agent_image_tag = "your-control-plane-agent-image-tag" k8s_provider = "aks" @@ -78,7 +78,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.22.0" control_plane_agent_image_tag = "your-control-plane-agent-image-tag" k8s_provider = "oke" @@ -92,7 +92,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.22.0" control_plane_agent_image_tag = "your-control-plane-agent-image-tag" k8s_provider = "aro" diff --git a/nullplatform/cloud/aws/cloud/README.md b/nullplatform/cloud/aws/cloud/README.md index e1457a9a9..4e07f1423 100644 --- a/nullplatform/cloud/aws/cloud/README.md +++ b/nullplatform/cloud/aws/cloud/README.md @@ -21,7 +21,7 @@ The module uses data sources aws_caller_identity and aws_region to dynamically r ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/cloud?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/cloud?ref=v6.22.0" domain_name = "your-domain-name" hosted_private_zone_id = "your-hosted-private-zone-id" diff --git a/nullplatform/cloud/aws/vpc/README.md b/nullplatform/cloud/aws/vpc/README.md index cbef2b7ee..029c17e20 100644 --- a/nullplatform/cloud/aws/vpc/README.md +++ b/nullplatform/cloud/aws/vpc/README.md @@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource of type aws-ne ```hcl module "vpc" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/vpc?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/vpc?ref=v6.22.0" nrn = "your-nrn" vpc_id = "your-vpc-id" diff --git a/nullplatform/cloud/azure/cloud/README.md b/nullplatform/cloud/azure/cloud/README.md index c972be422..270a294a6 100644 --- a/nullplatform/cloud/azure/cloud/README.md +++ b/nullplatform/cloud/azure/cloud/README.md @@ -22,7 +22,7 @@ The module creates a single nullplatform_provider_config resource of type 'azure ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/azure/cloud?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/azure/cloud?ref=v6.22.0" azure_resource_group_name = "your-azure-resource-group-name" nrn = "your-nrn" diff --git a/nullplatform/cloud/gcp/cloud/README.md b/nullplatform/cloud/gcp/cloud/README.md index 808c70a0e..21472fdfb 100644 --- a/nullplatform/cloud/gcp/cloud/README.md +++ b/nullplatform/cloud/gcp/cloud/README.md @@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type 'googl ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/gcp/cloud?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/gcp/cloud?ref=v6.22.0" domain_name = "your-domain-name" location = "your-location" diff --git a/nullplatform/cloud/oci/cloud/README.md b/nullplatform/cloud/oci/cloud/README.md index f43a6f388..56770d9ba 100644 --- a/nullplatform/cloud/oci/cloud/README.md +++ b/nullplatform/cloud/oci/cloud/README.md @@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type 'oci-c ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/oci/cloud?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/oci/cloud?ref=v6.22.0" account_id = "your-account-id" account_name = "your-account-name" diff --git a/nullplatform/code_repository/README.md b/nullplatform/code_repository/README.md index 8d86052ee..f6c964246 100644 --- a/nullplatform/code_repository/README.md +++ b/nullplatform/code_repository/README.md @@ -22,7 +22,7 @@ The module uses local boolean flags (is_gitlab, is_github, is_azure, is_bitbucke ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.22.0" git_provider = "your-git-provider" nrn = "your-nrn" @@ -33,7 +33,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.22.0" git_provider = "github" github_installation_id = "your-github-installation-id" # Required when git_provider = "github" @@ -46,7 +46,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.22.0" git_provider = "gitlab" gitlab_access_token = "your-gitlab-access-token" # Required when git_provider = "gitlab" @@ -62,7 +62,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.22.0" azure_access_token = "your-azure-access-token" # Required when git_provider = "azure" azure_agent_pool = "your-azure-agent-pool" # Required when git_provider = "azure" @@ -76,7 +76,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.22.0" bitbucket_collaborators = "your-bitbucket-collaborators" # Required when git_provider = "bitbucket" bitbucket_installation_url = "your-bitbucket-installation-url" # Required when git_provider = "bitbucket" diff --git a/nullplatform/container_orchestration/aks/README.md b/nullplatform/container_orchestration/aks/README.md index d47d26821..2e669c8de 100644 --- a/nullplatform/container_orchestration/aks/README.md +++ b/nullplatform/container_orchestration/aks/README.md @@ -22,7 +22,7 @@ The module constructs a set of locals that merge optional and required inputs in ```hcl module "aks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.22.0" cluster_name = "your-cluster-name" nrn = "your-nrn" @@ -36,7 +36,7 @@ module "aks" { ```hcl module "aks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.22.0" cluster_name = "your-cluster-name" nrn = "your-nrn" @@ -50,7 +50,7 @@ module "aks" { ```hcl module "aks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.22.0" cluster_name = "your-cluster-name" nrn = "your-nrn" @@ -64,7 +64,7 @@ module "aks" { ```hcl module "aks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.22.0" cluster_name = "your-cluster-name" nrn = "your-nrn" diff --git a/nullplatform/container_orchestration/eks/README.md b/nullplatform/container_orchestration/eks/README.md index d253e54e2..426025717 100644 --- a/nullplatform/container_orchestration/eks/README.md +++ b/nullplatform/container_orchestration/eks/README.md @@ -22,7 +22,7 @@ The module assembles multiple local maps (cluster, balancer, network, resource_m ```hcl module "eks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.22.0" cluster_name = "your-cluster-name" nrn = "your-nrn" @@ -34,7 +34,7 @@ module "eks" { ```hcl module "eks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.22.0" cluster_name = "your-cluster-name" nrn = "your-nrn" @@ -46,7 +46,7 @@ module "eks" { ```hcl module "eks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.22.0" cluster_name = "your-cluster-name" nrn = "your-nrn" @@ -58,7 +58,7 @@ module "eks" { ```hcl module "eks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.22.0" cluster_name = "your-cluster-name" nrn = "your-nrn" diff --git a/nullplatform/container_orchestration/gke/README.md b/nullplatform/container_orchestration/gke/README.md index 7c5f40bb3..6ceb93ec4 100644 --- a/nullplatform/container_orchestration/gke/README.md +++ b/nullplatform/container_orchestration/gke/README.md @@ -22,7 +22,7 @@ The module constructs a set of locals that merge optional inputs (gateway namesp ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.22.0" cluster_name = "your-cluster-name" location = "your-location" @@ -36,7 +36,7 @@ module "gke" { ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.22.0" cluster_name = "your-cluster-name" location = "your-location" @@ -50,7 +50,7 @@ module "gke" { ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.22.0" cluster_name = "your-cluster-name" location = "your-location" @@ -64,7 +64,7 @@ module "gke" { ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.22.0" cluster_name = "your-cluster-name" location = "your-location" diff --git a/nullplatform/container_orchestration/oke/README.md b/nullplatform/container_orchestration/oke/README.md index b4c3f8727..8e434b727 100644 --- a/nullplatform/container_orchestration/oke/README.md +++ b/nullplatform/container_orchestration/oke/README.md @@ -19,7 +19,7 @@ Creates a single nullplatform_provider_config resource of type 'oke' that stores ```hcl module "oke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/oke?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/oke?ref=v6.22.0" cluster_name = "your-cluster-name" nrn = "your-nrn" diff --git a/nullplatform/dimension/README.md b/nullplatform/dimension/README.md index fc940ede2..a70f05b42 100644 --- a/nullplatform/dimension/README.md +++ b/nullplatform/dimension/README.md @@ -19,7 +19,7 @@ The module creates a nullplatform_dimension resource using the provided name, or ```hcl module "dimension" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension?ref=v6.22.0" name = "your-name" nrn = "your-nrn" diff --git a/nullplatform/dimension_value/README.md b/nullplatform/dimension_value/README.md index ebc9ba39d..b45f9444d 100644 --- a/nullplatform/dimension_value/README.md +++ b/nullplatform/dimension_value/README.md @@ -19,7 +19,7 @@ The module uses a terraform_data resource to enforce mutual-exclusivity and pres ```hcl module "dimension_value" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension_value?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension_value?ref=v6.22.0" dimension_id = "your-dimension-id" name = "your-name" diff --git a/nullplatform/identity-access-control/README.md b/nullplatform/identity-access-control/README.md index 20256fc9f..3d60e3789 100644 --- a/nullplatform/identity-access-control/README.md +++ b/nullplatform/identity-access-control/README.md @@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource named identity ```hcl module "identity-access-control" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/identity-access-control?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/identity-access-control?ref=v6.22.0" attributes = "your-attributes" nrn = "your-nrn" diff --git a/nullplatform/metrics/README.md b/nullplatform/metrics/README.md index 1cffd0298..a3b89ef44 100644 --- a/nullplatform/metrics/README.md +++ b/nullplatform/metrics/README.md @@ -21,7 +21,7 @@ The module creates a single nullplatform_provider_config resource of type 'prome ```hcl module "metrics" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/metrics?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/metrics?ref=v6.22.0" nrn = "your-nrn" } diff --git a/nullplatform/packaged_service/README.md b/nullplatform/packaged_service/README.md index 8bd5a17ee..d722e98fa 100644 --- a/nullplatform/packaged_service/README.md +++ b/nullplatform/packaged_service/README.md @@ -17,7 +17,7 @@ spec updates / republish correctly. ```hcl module "packaged_service" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/packaged_service?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/packaged_service?ref=v6.22.0" nrn = "organization=…:account=…:namespace=…" diff --git a/nullplatform/parameter_storage_configuration/README.md b/nullplatform/parameter_storage_configuration/README.md index b456eaed7..6964eae3b 100644 --- a/nullplatform/parameter_storage_configuration/README.md +++ b/nullplatform/parameter_storage_configuration/README.md @@ -20,7 +20,7 @@ The module delegates entirely to a remote `scope_configuration` module sourced f ```hcl module "parameter_storage_configuration" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_configuration?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_configuration?ref=v6.22.0" attributes = "your-attributes" np_api_key = "your-np-api-key" diff --git a/nullplatform/parameter_storage_definition/README.md b/nullplatform/parameter_storage_definition/README.md index 2ef8d8767..9c0b296e0 100644 --- a/nullplatform/parameter_storage_definition/README.md +++ b/nullplatform/parameter_storage_definition/README.md @@ -20,7 +20,7 @@ A data.http resource fetches the raw specification template from a configurable ```hcl module "parameter_storage_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition?ref=v6.22.0" np_api_key = "your-np-api-key" nrn = "your-nrn" diff --git a/nullplatform/parameter_storage_definition_agent_association/README.md b/nullplatform/parameter_storage_definition_agent_association/README.md index fe55fe47f..c15cd4508 100644 --- a/nullplatform/parameter_storage_definition_agent_association/README.md +++ b/nullplatform/parameter_storage_definition_agent_association/README.md @@ -21,7 +21,7 @@ The module creates a terraform_data resource to track API key changes and a null ```hcl module "parameter_storage_definition_agent_association" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition_agent_association?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition_agent_association?ref=v6.22.0" api_key = "your-api-key" nrn = "your-nrn" diff --git a/nullplatform/scope_configuration/README.md b/nullplatform/scope_configuration/README.md index db77c6854..414703323 100644 --- a/nullplatform/scope_configuration/README.md +++ b/nullplatform/scope_configuration/README.md @@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource that binds a N ```hcl module "scope_configuration" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_configuration?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_configuration?ref=v6.22.0" attributes = "your-attributes" np_api_key = "your-np-api-key" diff --git a/nullplatform/scope_definition/README.md b/nullplatform/scope_definition/README.md index 20383662c..5f5232f1b 100644 --- a/nullplatform/scope_definition/README.md +++ b/nullplatform/scope_definition/README.md @@ -22,7 +22,7 @@ The module fetches JSON templates via data.http resources from a configurable Gi ```hcl module "scope_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition?ref=v6.22.0" np_api_key = "your-np-api-key" nrn = "your-nrn" diff --git a/nullplatform/scope_definition_agent_association/README.md b/nullplatform/scope_definition_agent_association/README.md index 26d70f28b..8a1799320 100644 --- a/nullplatform/scope_definition_agent_association/README.md +++ b/nullplatform/scope_definition_agent_association/README.md @@ -22,7 +22,7 @@ The module fetches a notification channel JSON template via the `data.http` prov ```hcl module "scope_definition_agent_association" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition_agent_association?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition_agent_association?ref=v6.22.0" api_key = "your-api-key" nrn = "your-nrn" diff --git a/nullplatform/service_definition/README.md b/nullplatform/service_definition/README.md index 71f5c9482..28a133d87 100644 --- a/nullplatform/service_definition/README.md +++ b/nullplatform/service_definition/README.md @@ -22,7 +22,7 @@ The module uses `data.http` resources to fetch `service-spec.json.tpl`, `actions ```hcl module "service_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.22.0" nrn = "your-nrn" repository_branch = "your-repository-branch" @@ -35,7 +35,7 @@ module "service_definition" { ```hcl module "service_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.22.0" nrn = "your-nrn" repository_branch = "main" @@ -48,7 +48,7 @@ module "service_definition" { ```hcl module "service_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.22.0" git_provider = "your-git-provider" # Required when repository_branch = "v1.4.0" nrn = "your-nrn" diff --git a/nullplatform/service_definition_agent_association/README.md b/nullplatform/service_definition_agent_association/README.md index 5498b35d5..a8b82d511 100644 --- a/nullplatform/service_definition_agent_association/README.md +++ b/nullplatform/service_definition_agent_association/README.md @@ -22,7 +22,7 @@ The module creates a terraform_data resource to track API key changes as a lifec ```hcl module "service_definition_agent_association" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition_agent_association?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition_agent_association?ref=v6.22.0" api_key = "your-api-key" repository_service_spec_repo = "your-repository-service-spec-repo" diff --git a/nullplatform/users/README.md b/nullplatform/users/README.md index d16cd95de..91f47a8f9 100644 --- a/nullplatform/users/README.md +++ b/nullplatform/users/README.md @@ -21,7 +21,7 @@ The module iterates over a map of user definitions using `nullplatform_user` res ```hcl module "users" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/users?ref=v6.21.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/users?ref=v6.22.0" nullplatform_users = "your-nullplatform-users" } From 13396328995fd2236b7704ecb08878198d647d11 Mon Sep 17 00:00:00 2001 From: Sebastian Correa Date: Tue, 1 Sep 2026 11:03:06 -0300 Subject: [PATCH 50/81] fix(base): expose gateway_api_crd_ref, default to v1.3.0 for Istio 1.27 (#544) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * fix(base): expose gateway_api_crd_ref for the Gateway API CRD install ref Wires the new global.gatewayApiCrdRef chart value through so operators can pin/bump the kubernetes-sigs/gateway-api ref applied by the base chart's CRD installer Job (nullplatform/helm-charts, chart >= the version that added global.gatewayApiCrdRef), instead of it being hardcoded in the chart and frozen after the first install. Defaults to the chart's previously hardcoded commit ref, so behavior is unchanged until a caller overrides it. Co-Authored-By: Claude Sonnet 5 * fix(base): default gateway_api_crd_ref to v1.3.0, matching Istio 1.27 Istio 1.27's version-pinned docs (istio.io/v1.27) document installing Gateway API CRDs at v1.3.0, not the latest release. A CRD version Istio's controller doesn't understand yet unlocks nothing, so this should track what the pinned Istio version actually validates against rather than the newest Gateway API tag. Co-Authored-By: Claude Sonnet 5 * fix(base): default install_gateway_v2_crd to true With the false default, the base chart's CRD-installer Job never ran, so Gateway API CRDs were frozen at whatever was present on first install and gateway_api_crd_ref had nothing to reconcile — matches the underlying nullplatform-base chart's own default (true), which this module was overriding. Verified safe against a live cluster still pinned to chart 2.44.0 (pre-dating gatewayApiCrdRef): that version's Job only installs when the CRD is missing, so flipping this default is a no-op there and only starts mattering once callers move to a chart version carrying the reconcile-on-every-upgrade Job from helm-charts#183 (which needs --force-conflicts, see that PR). Co-Authored-By: Claude Sonnet 5 --------- Co-authored-by: sebas_correa Co-authored-by: Claude Sonnet 5 --- nullplatform/base/locals.tf | 1 + .../nullplatform_base_values.tmpl.yaml | 1 + .../base/tests/base_values.tftest.hcl | 48 +++++++++++++++++++ nullplatform/base/variables.tf | 10 +++- 4 files changed, 58 insertions(+), 2 deletions(-) diff --git a/nullplatform/base/locals.tf b/nullplatform/base/locals.tf index 2d14f26fd..2f09bef29 100644 --- a/nullplatform/base/locals.tf +++ b/nullplatform/base/locals.tf @@ -5,6 +5,7 @@ locals { # ---- global ---- k8s_provider = var.k8s_provider installGatewayV2Crd = var.install_gateway_v2_crd ? "true" : "false" + gatewayApiCrdRef = var.gateway_api_crd_ref awsRegion = var.aws_region # ---- tls ---- diff --git a/nullplatform/base/templates/nullplatform_base_values.tmpl.yaml b/nullplatform/base/templates/nullplatform_base_values.tmpl.yaml index fd048b768..0e798ffeb 100644 --- a/nullplatform/base/templates/nullplatform_base_values.tmpl.yaml +++ b/nullplatform/base/templates/nullplatform_base_values.tmpl.yaml @@ -1,6 +1,7 @@ # Global settings global: installGatewayV2Crd: ${installGatewayV2Crd} + gatewayApiCrdRef: "${gatewayApiCrdRef}" # Kubernetes provider (options: "oke", "gke", "eks", "aks", "aro") provider: "${k8s_provider}" # AWS region (applicable for EKS provider) diff --git a/nullplatform/base/tests/base_values.tftest.hcl b/nullplatform/base/tests/base_values.tftest.hcl index 079de99dd..ce537d6a5 100644 --- a/nullplatform/base/tests/base_values.tftest.hcl +++ b/nullplatform/base/tests/base_values.tftest.hcl @@ -9,6 +9,54 @@ variables { control_plane_agent_image_tag = "0.9.2" } +############################################ +# Gateway API CRD ref +############################################ + +run "gateway_api_crd_ref_defaults_to_istio_1_27_ref" { + command = plan + + assert { + condition = strcontains(output.rendered_values, "gatewayApiCrdRef: \"v1.3.0\"") + error_message = "gatewayApiCrdRef should default to v1.3.0, matching Istio 1.27" + } +} + +run "gateway_api_crd_ref_override" { + command = plan + + variables { + gateway_api_crd_ref = "v1.6.0" + } + + assert { + condition = strcontains(output.rendered_values, "gatewayApiCrdRef: \"v1.6.0\"") + error_message = "gatewayApiCrdRef should reflect the overridden ref" + } +} + +run "install_gateway_v2_crd_defaults_to_true" { + command = plan + + assert { + condition = strcontains(output.rendered_values, "installGatewayV2Crd: true") + error_message = "install_gateway_v2_crd should default to true so CRDs actually reconcile to gateway_api_crd_ref" + } +} + +run "install_gateway_v2_crd_override" { + command = plan + + variables { + install_gateway_v2_crd = false + } + + assert { + condition = strcontains(output.rendered_values, "installGatewayV2Crd: false") + error_message = "install_gateway_v2_crd should still be overridable to false" + } +} + ############################################ # applicationLogs toggle ############################################ diff --git a/nullplatform/base/variables.tf b/nullplatform/base/variables.tf index 78d2ed833..7ff11a292 100644 --- a/nullplatform/base/variables.tf +++ b/nullplatform/base/variables.tf @@ -38,8 +38,14 @@ variable "aws_region" { variable "install_gateway_v2_crd" { type = bool - description = "Install Gateway API v2 CRDs." - default = false + description = "Install/reconcile the Gateway API CRDs (see gateway_api_crd_ref) via the base chart's pre-install/pre-upgrade Job. Defaults to true so CRDs actually track gateway_api_crd_ref instead of staying frozen at whatever was present on first install — matches the base chart's own default. Safe on chart versions before global.gatewayApiCrdRef too: those only install when the CRD is missing, so pre-existing CRDs from another source are left untouched." + default = true +} + +variable "gateway_api_crd_ref" { + type = string + description = "Git ref (tag or commit) of kubernetes-sigs/gateway-api to install when install_gateway_v2_crd is true. Ignored on chart versions older than the one that introduced global.gatewayApiCrdRef. Default (v1.3.0) matches what Istio 1.27 documents installing; re-check istio.io's version-pinned docs when bumping Istio." + default = "v1.3.0" } ############################################ From ac69960a70dea0898a56fefa01ccdbe3fa410b6d Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 1 Sep 2026 14:13:23 +0000 Subject: [PATCH 51/81] chore(6.x): release 6.22.1 --- CHANGELOG.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 2eddacf46..09145bdad 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,12 @@ # Changelog +## [6.22.1](https://github.com/nullplatform/tofu-modules/compare/v6.22.0...v6.22.1) (2026-09-01) + + +### Bug Fixes + +* **base:** expose gateway_api_crd_ref, default to v1.3.0 for Istio 1.27 ([#544](https://github.com/nullplatform/tofu-modules/issues/544)) ([4bf8323](https://github.com/nullplatform/tofu-modules/commit/4bf8323b32716944411b745e2f15aae8da1a64d2)) + ## [6.22.0](https://github.com/nullplatform/tofu-modules/compare/v6.21.0...v6.22.0) (2026-09-01) From 7d269bda7396b1c157a613a438720b60203b1d6c Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Tue, 1 Sep 2026 14:14:05 +0000 Subject: [PATCH 52/81] docs: regenerate READMEs for changed modules and update versions --- infrastructure/aws/acm/README.md | 2 +- .../aws_load_balancer_controller/README.md | 2 +- infrastructure/aws/backend/README.md | 2 +- infrastructure/aws/dns/README.md | 2 +- infrastructure/aws/eks/README.md | 2 +- infrastructure/aws/iam/agent/README.md | 2 +- .../README.md | 2 +- infrastructure/aws/iam/cert_manager/README.md | 2 +- .../aws/iam/ci-build-workflow-user/README.md | 2 +- infrastructure/aws/iam/cloudwatch/README.md | 2 +- infrastructure/aws/iam/ecr/README.md | 2 +- infrastructure/aws/iam/external_dns/README.md | 2 +- infrastructure/aws/iam/s3/README.md | 2 +- infrastructure/aws/ingress/README.md | 2 +- infrastructure/aws/security/README.md | 2 +- infrastructure/aws/vpc/README.md | 2 +- infrastructure/azure/acr/README.md | 2 +- infrastructure/azure/aks/README.md | 2 +- .../azure/aks_route_table/README.md | 2 +- infrastructure/azure/dns/README.md | 2 +- infrastructure/azure/iam/README.md | 2 +- infrastructure/azure/private_dns/README.md | 2 +- infrastructure/azure/resource_group/README.md | 2 +- infrastructure/azure/security/README.md | 2 +- infrastructure/azure/vnet/README.md | 2 +- infrastructure/commons/cert_manager/README.md | 14 +-- infrastructure/commons/external_dns/README.md | 14 +-- infrastructure/commons/istio/README.md | 2 +- infrastructure/commons/prometheus/README.md | 8 +- .../gcp/artifact-registry/README.md | 2 +- infrastructure/gcp/backend/README.md | 2 +- infrastructure/gcp/cloud-dns/README.md | 2 +- infrastructure/gcp/cloud-nat/README.md | 2 +- infrastructure/gcp/gke/README.md | 6 +- infrastructure/gcp/iam/README.md | 2 +- infrastructure/gcp/security/README.md | 2 +- infrastructure/gcp/vpc/README.md | 2 +- infrastructure/oci/backend/README.md | 2 +- infrastructure/oci/dns/README.md | 2 +- infrastructure/oci/dynamic_groups/README.md | 2 +- infrastructure/oci/oke/README.md | 2 +- infrastructure/oci/vcn/README.md | 2 +- nullplatform/account/README.md | 2 +- nullplatform/agent/README.md | 16 +-- nullplatform/api_key/README.md | 12 +-- nullplatform/asset/docker_server/README.md | 2 +- nullplatform/asset/ecr/README.md | 2 +- nullplatform/asset/s3/README.md | 2 +- nullplatform/base/README.md | 102 +++++++++++++----- nullplatform/cloud/aws/cloud/README.md | 2 +- nullplatform/cloud/aws/vpc/README.md | 2 +- nullplatform/cloud/azure/cloud/README.md | 2 +- nullplatform/cloud/gcp/cloud/README.md | 2 +- nullplatform/cloud/oci/cloud/README.md | 2 +- nullplatform/code_repository/README.md | 10 +- .../container_orchestration/aks/README.md | 8 +- .../container_orchestration/eks/README.md | 8 +- .../container_orchestration/gke/README.md | 8 +- .../container_orchestration/oke/README.md | 2 +- nullplatform/dimension/README.md | 2 +- nullplatform/dimension_value/README.md | 2 +- .../identity-access-control/README.md | 2 +- nullplatform/metrics/README.md | 2 +- nullplatform/packaged_service/README.md | 2 +- .../parameter_storage_configuration/README.md | 2 +- .../parameter_storage_definition/README.md | 2 +- .../README.md | 2 +- nullplatform/scope_configuration/README.md | 2 +- nullplatform/scope_definition/README.md | 2 +- .../README.md | 2 +- nullplatform/service_definition/README.md | 6 +- .../README.md | 2 +- nullplatform/users/README.md | 2 +- 73 files changed, 191 insertions(+), 143 deletions(-) diff --git a/infrastructure/aws/acm/README.md b/infrastructure/aws/acm/README.md index 832d908e1..a5641d2cb 100644 --- a/infrastructure/aws/acm/README.md +++ b/infrastructure/aws/acm/README.md @@ -18,7 +18,7 @@ The module creates an aws_acm_certificate resource with DNS validation, which is ```hcl module "acm" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/acm?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/acm?ref=v6.22.1" domain_name = "your-domain-name" zone_id = "your-zone-id" diff --git a/infrastructure/aws/aws_load_balancer_controller/README.md b/infrastructure/aws/aws_load_balancer_controller/README.md index 8a5e33563..902733191 100644 --- a/infrastructure/aws/aws_load_balancer_controller/README.md +++ b/infrastructure/aws/aws_load_balancer_controller/README.md @@ -18,7 +18,7 @@ This module creates a helm_release resource to deploy the AWS Load Balancer Cont ```hcl module "aws_load_balancer_controller" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/aws_load_balancer_controller?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/aws_load_balancer_controller?ref=v6.22.1" cluster_name = "your-cluster-name" vpc_id = "your-vpc-id" diff --git a/infrastructure/aws/backend/README.md b/infrastructure/aws/backend/README.md index 1d0f4848f..c12d6b252 100644 --- a/infrastructure/aws/backend/README.md +++ b/infrastructure/aws/backend/README.md @@ -20,7 +20,7 @@ This module creates an S3 bucket with versioning and server-side encryption enab ```hcl module "backend" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/backend?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/backend?ref=v6.22.1" } ``` diff --git a/infrastructure/aws/dns/README.md b/infrastructure/aws/dns/README.md index d8ca4853b..eff94dce6 100644 --- a/infrastructure/aws/dns/README.md +++ b/infrastructure/aws/dns/README.md @@ -21,7 +21,7 @@ The module conditionally creates an aws_route53_zone resource for a public hoste ```hcl module "dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/dns?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/dns?ref=v6.22.1" domain_name = "your-domain-name" vpc_id = "your-vpc-id" diff --git a/infrastructure/aws/eks/README.md b/infrastructure/aws/eks/README.md index c30307d7d..da29c6586 100644 --- a/infrastructure/aws/eks/README.md +++ b/infrastructure/aws/eks/README.md @@ -22,7 +22,7 @@ The module wraps terraform-aws-modules/eks to create the EKS cluster (aws_eks_cl ```hcl module "eks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/eks?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/eks?ref=v6.22.1" aws_subnets_private_ids = "your-aws-subnets-private-ids" aws_vpc_vpc_id = "your-aws-vpc-vpc-id" diff --git a/infrastructure/aws/iam/agent/README.md b/infrastructure/aws/iam/agent/README.md index b59794727..657dbf6e4 100644 --- a/infrastructure/aws/iam/agent/README.md +++ b/infrastructure/aws/iam/agent/README.md @@ -21,7 +21,7 @@ The module uses the terraform-aws-modules/iam//modules/iam-role-for-service-acco ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/agent?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/agent?ref=v6.22.1" agent_namespace = "your-agent-namespace" aws_iam_openid_connect_provider_arn = "your-aws-iam-openid-connect-provider-arn" diff --git a/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md b/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md index 8359be7a1..e407f32ae 100644 --- a/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md +++ b/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md @@ -19,7 +19,7 @@ This module creates an IAM role for the AWS Load Balancer Controller using the t ```hcl module "aws_load_balancer_controller_iam" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/aws_load_balancer_controller_iam?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/aws_load_balancer_controller_iam?ref=v6.22.1" aws_iam_openid_connect_provider_arn = "your-aws-iam-openid-connect-provider-arn" cluster_name = "your-cluster-name" diff --git a/infrastructure/aws/iam/cert_manager/README.md b/infrastructure/aws/iam/cert_manager/README.md index 451ec5347..f157360fe 100644 --- a/infrastructure/aws/iam/cert_manager/README.md +++ b/infrastructure/aws/iam/cert_manager/README.md @@ -20,7 +20,7 @@ An aws_iam_policy resource is always created granting route53:GetChange, route53 ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cert_manager?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cert_manager?ref=v6.22.1" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/ci-build-workflow-user/README.md b/infrastructure/aws/iam/ci-build-workflow-user/README.md index 339ea6a2e..ab1774a95 100644 --- a/infrastructure/aws/iam/ci-build-workflow-user/README.md +++ b/infrastructure/aws/iam/ci-build-workflow-user/README.md @@ -21,7 +21,7 @@ The module creates an aws_iam_user named with the cluster_name prefix and genera ```hcl module "ci-build-workflow-user" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ci-build-workflow-user?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ci-build-workflow-user?ref=v6.22.1" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/cloudwatch/README.md b/infrastructure/aws/iam/cloudwatch/README.md index b4fdf7397..03e7fdeb8 100644 --- a/infrastructure/aws/iam/cloudwatch/README.md +++ b/infrastructure/aws/iam/cloudwatch/README.md @@ -20,7 +20,7 @@ The module creates an aws_iam_policy granting CloudWatch Logs and Metrics write ```hcl module "cloudwatch" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cloudwatch?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cloudwatch?ref=v6.22.1" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/ecr/README.md b/infrastructure/aws/iam/ecr/README.md index 56b6eb4ab..090c90729 100644 --- a/infrastructure/aws/iam/ecr/README.md +++ b/infrastructure/aws/iam/ecr/README.md @@ -20,7 +20,7 @@ The module creates an aws_iam_role named nullplatform-{cluster_name}-application ```hcl module "ecr" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ecr?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ecr?ref=v6.22.1" build_workflow_group_name = "your-build-workflow-group-name" cluster_name = "your-cluster-name" diff --git a/infrastructure/aws/iam/external_dns/README.md b/infrastructure/aws/iam/external_dns/README.md index 8f54c08bc..73335b4c4 100644 --- a/infrastructure/aws/iam/external_dns/README.md +++ b/infrastructure/aws/iam/external_dns/README.md @@ -20,7 +20,7 @@ An aws_iam_policy resource named nullplatform_external_dns_policy is always crea ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/external_dns?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/external_dns?ref=v6.22.1" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/s3/README.md b/infrastructure/aws/iam/s3/README.md index 1a2683eb7..5411d39e2 100644 --- a/infrastructure/aws/iam/s3/README.md +++ b/infrastructure/aws/iam/s3/README.md @@ -18,7 +18,7 @@ The module creates an aws_iam_policy resource that allows s3:PutObject and s3:Ge ```hcl module "s3" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/s3?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/s3?ref=v6.22.1" bucket = "your-bucket" build_workflow_group_name = "your-build-workflow-group-name" diff --git a/infrastructure/aws/ingress/README.md b/infrastructure/aws/ingress/README.md index 0a17561ea..a89603679 100644 --- a/infrastructure/aws/ingress/README.md +++ b/infrastructure/aws/ingress/README.md @@ -22,7 +22,7 @@ The module creates up to two kubernetes_ingress_v1 resources — one for an inte ```hcl module "ingress" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/ingress?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/ingress?ref=v6.22.1" certificate_arn = "your-certificate-arn" } diff --git a/infrastructure/aws/security/README.md b/infrastructure/aws/security/README.md index 3797b30ac..4d337f111 100644 --- a/infrastructure/aws/security/README.md +++ b/infrastructure/aws/security/README.md @@ -22,7 +22,7 @@ The module uses data sources (aws_eks_cluster, aws_vpc) to automatically derive ```hcl module "security" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/security?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/security?ref=v6.22.1" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/vpc/README.md b/infrastructure/aws/vpc/README.md index 33a4116f1..3e3918d75 100644 --- a/infrastructure/aws/vpc/README.md +++ b/infrastructure/aws/vpc/README.md @@ -22,7 +22,7 @@ This module creates a terraform-aws-modules/vpc/aws module resource with DNS hos ```hcl module "vpc" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/vpc?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/vpc?ref=v6.22.1" account = "your-account" organization = "your-organization" diff --git a/infrastructure/azure/acr/README.md b/infrastructure/azure/acr/README.md index e69025832..bf1f5f59a 100644 --- a/infrastructure/azure/acr/README.md +++ b/infrastructure/azure/acr/README.md @@ -18,7 +18,7 @@ The module uses the azurerm_container_registry resource to create the container ```hcl module "acr" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/acr?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/acr?ref=v6.22.1" containerregistry_name = "your-containerregistry-name" location = "your-location" diff --git a/infrastructure/azure/aks/README.md b/infrastructure/azure/aks/README.md index 418a07470..c3f9c233e 100644 --- a/infrastructure/azure/aks/README.md +++ b/infrastructure/azure/aks/README.md @@ -22,7 +22,7 @@ The module wraps the Azure/aks/azurerm community module (version 11.0.0) and use ```hcl module "aks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks?ref=v6.22.1" cluster_name = "your-cluster-name" location = "your-location" diff --git a/infrastructure/azure/aks_route_table/README.md b/infrastructure/azure/aks_route_table/README.md index 2f2dba42a..52f8bbceb 100644 --- a/infrastructure/azure/aks_route_table/README.md +++ b/infrastructure/azure/aks_route_table/README.md @@ -19,7 +19,7 @@ The module uses an azurerm_resources data source to discover the AKS-managed rou ```hcl module "aks_route_table" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks_route_table?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks_route_table?ref=v6.22.1" node_resource_group = "your-node-resource-group" subnet_id = "your-subnet-id" diff --git a/infrastructure/azure/dns/README.md b/infrastructure/azure/dns/README.md index 6a8792088..f68cc5bfe 100644 --- a/infrastructure/azure/dns/README.md +++ b/infrastructure/azure/dns/README.md @@ -18,7 +18,7 @@ This module creates an azurerm_dns_zone resource and configures it with the prov ```hcl module "dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/dns?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/dns?ref=v6.22.1" domain_name = "your-domain-name" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/iam/README.md b/infrastructure/azure/iam/README.md index 6303bd0b9..f0a3380a6 100644 --- a/infrastructure/azure/iam/README.md +++ b/infrastructure/azure/iam/README.md @@ -21,7 +21,7 @@ The module creates an azurerm_user_assigned_identity resource in the specified r ```hcl module "iam" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/iam?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/iam?ref=v6.22.1" location = "your-location" name = "your-name" diff --git a/infrastructure/azure/private_dns/README.md b/infrastructure/azure/private_dns/README.md index a6ed41a69..3c1f72b10 100644 --- a/infrastructure/azure/private_dns/README.md +++ b/infrastructure/azure/private_dns/README.md @@ -18,7 +18,7 @@ This module creates an azurerm_private_dns_zone resource and optionally multiple ```hcl module "private_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/private_dns?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/private_dns?ref=v6.22.1" domain_name = "your-domain-name" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/resource_group/README.md b/infrastructure/azure/resource_group/README.md index d198ca506..42ef38b44 100644 --- a/infrastructure/azure/resource_group/README.md +++ b/infrastructure/azure/resource_group/README.md @@ -18,7 +18,7 @@ This module creates an azurerm_resource_group resource and outputs its name and ```hcl module "resource_group" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/resource_group?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/resource_group?ref=v6.22.1" location = "your-location" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/security/README.md b/infrastructure/azure/security/README.md index 4cefab63e..2006a091b 100644 --- a/infrastructure/azure/security/README.md +++ b/infrastructure/azure/security/README.md @@ -21,7 +21,7 @@ The module uses azurerm_kubernetes_cluster and azurerm_virtual_network data sour ```hcl module "security" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/security?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/security?ref=v6.22.1" cluster_name = "your-cluster-name" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/vnet/README.md b/infrastructure/azure/vnet/README.md index 2f0508a66..0b498e06f 100644 --- a/infrastructure/azure/vnet/README.md +++ b/infrastructure/azure/vnet/README.md @@ -18,7 +18,7 @@ This module creates an Azure virtual network using the azurerm provider and conf ```hcl module "vnet" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/vnet?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/vnet?ref=v6.22.1" address_space = "your-address-space" location = "your-location" diff --git a/infrastructure/commons/cert_manager/README.md b/infrastructure/commons/cert_manager/README.md index 96adb4a44..cbcd06884 100644 --- a/infrastructure/commons/cert_manager/README.md +++ b/infrastructure/commons/cert_manager/README.md @@ -22,7 +22,7 @@ The module creates two core helm_release resources: cert-manager from charts.jet ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.22.1" account_slug = "your-account-slug" cert_manager_version = "your-cert-manager-version" @@ -36,7 +36,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.22.1" account_slug = "your-account-slug" cert_manager_version = "your-cert-manager-version" @@ -52,7 +52,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.22.1" account_slug = "your-account-slug" azure_client_id = "your-azure-client-id" # Required when cloud_provider = "azure" @@ -71,7 +71,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.22.1" account_slug = "your-account-slug" cert_manager_version = "your-cert-manager-version" @@ -87,7 +87,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.22.1" account_slug = "your-account-slug" aws_identity_mode = "your-aws-identity-mode" # Required when cloud_provider = "aws" @@ -104,7 +104,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.22.1" account_slug = "your-account-slug" cert_manager_version = "your-cert-manager-version" @@ -123,7 +123,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.22.1" account_slug = "your-account-slug" cert_manager_version = "v1.21.1" diff --git a/infrastructure/commons/external_dns/README.md b/infrastructure/commons/external_dns/README.md index f2908a564..7a7bf9a1a 100644 --- a/infrastructure/commons/external_dns/README.md +++ b/infrastructure/commons/external_dns/README.md @@ -22,7 +22,7 @@ The module creates an optional kubernetes_namespace_v1 resource and a helm_relea ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.22.1" dns_provider_name = "your-dns-provider-name" domain_filters = "your-domain-filters" @@ -33,7 +33,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.22.1" cloudflare_token = "your-cloudflare-token" # Required when dns_provider_name = "cloudflare" dns_provider_name = "cloudflare" @@ -45,7 +45,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.22.1" aws_iam_role_arn = "your-aws-iam-role-arn" # Required when dns_provider_name = "aws" aws_identity_mode = "your-aws-identity-mode" # Required when dns_provider_name = "aws" @@ -61,7 +61,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.22.1" dns_provider_name = "oci" domain_filters = "your-domain-filters" @@ -76,7 +76,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.22.1" azure_client_id = "your-azure-client-id" # Required when dns_provider_name = "azure" azure_resource_group = "your-azure-resource-group" # Required when dns_provider_name = "azure" @@ -92,7 +92,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.22.1" azure_client_id = "your-azure-client-id" # Required when dns_provider_name = "azure-private-dns" azure_resource_group = "your-azure-resource-group" # Required when dns_provider_name = "azure-private-dns" @@ -108,7 +108,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.22.1" dns_provider_name = "google" domain_filters = "your-domain-filters" diff --git a/infrastructure/commons/istio/README.md b/infrastructure/commons/istio/README.md index c9e8be8d5..580b9cc89 100644 --- a/infrastructure/commons/istio/README.md +++ b/infrastructure/commons/istio/README.md @@ -20,7 +20,7 @@ The module creates two helm_release resources: istio-base (the CRD and cluster-w ```hcl module "istio" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/istio?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/istio?ref=v6.22.1" } ``` diff --git a/infrastructure/commons/prometheus/README.md b/infrastructure/commons/prometheus/README.md index cd40a4ffa..4beaf2231 100644 --- a/infrastructure/commons/prometheus/README.md +++ b/infrastructure/commons/prometheus/README.md @@ -21,7 +21,7 @@ A single helm_release resource named 'prometheus' installs the prometheus-commun ```hcl module "prometheus" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.22.1" prometheus_version = "your-prometheus-version" } @@ -31,7 +31,7 @@ module "prometheus" { ```hcl module "prometheus" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.22.1" prometheus_version = "latest" } @@ -41,7 +41,7 @@ module "prometheus" { ```hcl module "prometheus" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.22.1" prometheus_version = "main" } @@ -51,7 +51,7 @@ module "prometheus" { ```hcl module "prometheus" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.22.1" prometheus_version = "master" } diff --git a/infrastructure/gcp/artifact-registry/README.md b/infrastructure/gcp/artifact-registry/README.md index fdba401f8..7b149b97f 100644 --- a/infrastructure/gcp/artifact-registry/README.md +++ b/infrastructure/gcp/artifact-registry/README.md @@ -21,7 +21,7 @@ The module creates a google_artifact_registry_repository resource configured wit ```hcl module "artifact-registry" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/artifact-registry?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/artifact-registry?ref=v6.22.1" location = "your-location" project_id = "your-project-id" diff --git a/infrastructure/gcp/backend/README.md b/infrastructure/gcp/backend/README.md index 8e3e5080f..7711ec7db 100644 --- a/infrastructure/gcp/backend/README.md +++ b/infrastructure/gcp/backend/README.md @@ -22,7 +22,7 @@ The module creates a random_id resource to generate a unique 8-byte hex suffix, ```hcl module "backend" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/backend?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/backend?ref=v6.22.1" project_id = "your-project-id" } diff --git a/infrastructure/gcp/cloud-dns/README.md b/infrastructure/gcp/cloud-dns/README.md index 6fae5dea8..3aaa1805c 100644 --- a/infrastructure/gcp/cloud-dns/README.md +++ b/infrastructure/gcp/cloud-dns/README.md @@ -21,7 +21,7 @@ The module creates a single google_dns_managed_zone resource in the specified GC ```hcl module "cloud-dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-dns?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-dns?ref=v6.22.1" domain_name = "your-domain-name" project_id = "your-project-id" diff --git a/infrastructure/gcp/cloud-nat/README.md b/infrastructure/gcp/cloud-nat/README.md index b1fa903fe..75311cd9b 100644 --- a/infrastructure/gcp/cloud-nat/README.md +++ b/infrastructure/gcp/cloud-nat/README.md @@ -19,7 +19,7 @@ This module creates a google_compute_router resource in a specified region and n ```hcl module "cloud-nat" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-nat?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-nat?ref=v6.22.1" nat_name = "your-nat-name" network_id = "your-network-id" diff --git a/infrastructure/gcp/gke/README.md b/infrastructure/gcp/gke/README.md index e66b18269..9fb3686d3 100644 --- a/infrastructure/gcp/gke/README.md +++ b/infrastructure/gcp/gke/README.md @@ -22,7 +22,7 @@ The module conditionally creates one of two mutually-exclusive submodules based ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.22.1" cluster_name = "your-cluster-name" ip_range_pods = "your-ip-range-pods" @@ -38,7 +38,7 @@ module "gke" { ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.22.1" cluster_name = "your-cluster-name" ip_range_pods = "your-ip-range-pods" @@ -73,7 +73,7 @@ module "gke" { ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.22.1" cluster_name = "your-cluster-name" ip_range_pods = "your-ip-range-pods" diff --git a/infrastructure/gcp/iam/README.md b/infrastructure/gcp/iam/README.md index 30b39ea00..40e513508 100644 --- a/infrastructure/gcp/iam/README.md +++ b/infrastructure/gcp/iam/README.md @@ -19,7 +19,7 @@ The module creates google_service_account resources for each service account spe ```hcl module "iam" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/iam?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/iam?ref=v6.22.1" project_id = "your-project-id" } diff --git a/infrastructure/gcp/security/README.md b/infrastructure/gcp/security/README.md index 6e448f5bc..64a22b3b0 100644 --- a/infrastructure/gcp/security/README.md +++ b/infrastructure/gcp/security/README.md @@ -22,7 +22,7 @@ The module uses data.google_container_cluster and data.google_compute_subnetwork ```hcl module "security" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/security?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/security?ref=v6.22.1" cluster_name = "your-cluster-name" gcp_project_id = "your-gcp-project-id" diff --git a/infrastructure/gcp/vpc/README.md b/infrastructure/gcp/vpc/README.md index f49bd1991..621e313be 100644 --- a/infrastructure/gcp/vpc/README.md +++ b/infrastructure/gcp/vpc/README.md @@ -20,7 +20,7 @@ The module invokes the terraform-google-modules/network/google module to create ```hcl module "vpc" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/vpc?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/vpc?ref=v6.22.1" network_name = "your-network-name" project_id = "your-project-id" diff --git a/infrastructure/oci/backend/README.md b/infrastructure/oci/backend/README.md index e5d63a35c..9fdad3de3 100644 --- a/infrastructure/oci/backend/README.md +++ b/infrastructure/oci/backend/README.md @@ -18,7 +18,7 @@ The module creates an oci_objectstorage_bucket resource, which is configured wit ```hcl module "backend" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/backend?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/backend?ref=v6.22.1" compartment_id = "your-compartment-id" namespace = "your-namespace" diff --git a/infrastructure/oci/dns/README.md b/infrastructure/oci/dns/README.md index 3ad0030f4..8eebac29e 100644 --- a/infrastructure/oci/dns/README.md +++ b/infrastructure/oci/dns/README.md @@ -18,7 +18,7 @@ This module creates oci_dns_zone resources for each DNS zone defined in the dns_ ```hcl module "dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dns?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dns?ref=v6.22.1" compartment_id = "your-compartment-id" } diff --git a/infrastructure/oci/dynamic_groups/README.md b/infrastructure/oci/dynamic_groups/README.md index 2c815da44..58841143b 100644 --- a/infrastructure/oci/dynamic_groups/README.md +++ b/infrastructure/oci/dynamic_groups/README.md @@ -19,7 +19,7 @@ This module creates an OCI dynamic group and an OCI identity policy, connecting ```hcl module "dynamic_groups" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dynamic_groups?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dynamic_groups?ref=v6.22.1" cluster_id = "your-cluster-id" compartment_id = "your-compartment-id" diff --git a/infrastructure/oci/oke/README.md b/infrastructure/oci/oke/README.md index c6d1d1e17..6db6c0da3 100644 --- a/infrastructure/oci/oke/README.md +++ b/infrastructure/oci/oke/README.md @@ -21,7 +21,7 @@ The module instantiates the oracle-terraform-modules/oke/oci module to create an ```hcl module "oke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/oke?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/oke?ref=v6.22.1" api_endpoint_subnet_id = "your-api-endpoint-subnet-id" cluster_name = "your-cluster-name" diff --git a/infrastructure/oci/vcn/README.md b/infrastructure/oci/vcn/README.md index 88f1d3070..aec740d1a 100644 --- a/infrastructure/oci/vcn/README.md +++ b/infrastructure/oci/vcn/README.md @@ -19,7 +19,7 @@ The module instantiates oci_core_subnet resources for public and private subnets ```hcl module "vcn" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/vcn?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/vcn?ref=v6.22.1" } ``` diff --git a/nullplatform/account/README.md b/nullplatform/account/README.md index 26b2ba8c7..07117eb33 100644 --- a/nullplatform/account/README.md +++ b/nullplatform/account/README.md @@ -19,7 +19,7 @@ The module iterates over the `nullplatform_accounts` input map using `for_each` ```hcl module "account" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/account?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/account?ref=v6.22.1" nullplatform_accounts = "your-nullplatform-accounts" } diff --git a/nullplatform/agent/README.md b/nullplatform/agent/README.md index 00971b9a6..eae8827bb 100644 --- a/nullplatform/agent/README.md +++ b/nullplatform/agent/README.md @@ -22,7 +22,7 @@ The module creates a `helm_release` resource named `agent` that deploys the `nul ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.22.1" agent_repos_scope_tag = "your-agent-repos-scope-tag" agent_traffic_manager_tag = "your-agent-traffic-manager-tag" @@ -39,7 +39,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.22.1" agent_repos_scope_tag = "your-agent-repos-scope-tag" agent_traffic_manager_tag = "your-agent-traffic-manager-tag" @@ -57,7 +57,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.22.1" agent_repos_scope_tag = "your-agent-repos-scope-tag" agent_traffic_manager_tag = "your-agent-traffic-manager-tag" @@ -74,7 +74,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.22.1" agent_repos_scope_tag = "your-agent-repos-scope-tag" agent_traffic_manager_tag = "your-agent-traffic-manager-tag" @@ -97,7 +97,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.22.1" agent_repos_scope_tag = "your-agent-repos-scope-tag" agent_traffic_manager_tag = "your-agent-traffic-manager-tag" @@ -114,7 +114,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.22.1" agent_repos_scope_tag = "your-agent-repos-scope-tag" agent_traffic_manager_tag = "your-agent-traffic-manager-tag" @@ -131,7 +131,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.22.1" agent_repos_scope = "your-agent-repos-scope" # Required when agent_repos_scope_tag = "fixed git tag (e.g. v1.15.1)" agent_repos_scope_tag = "fixed git tag (e.g. v1.15.1)" @@ -149,7 +149,7 @@ module "agent" { ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.22.1" agent_repos_scope_tag = "your-agent-repos-scope-tag" agent_traffic_manager_tag = "fixed semver (e.g. 1.8.0)" diff --git a/nullplatform/api_key/README.md b/nullplatform/api_key/README.md index 084e85a12..c8718e265 100644 --- a/nullplatform/api_key/README.md +++ b/nullplatform/api_key/README.md @@ -22,7 +22,7 @@ The module defines a single nullplatform_api_key resource whose name, grants, an ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.22.1" type = "your-type" } @@ -32,7 +32,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.22.1" nrn = "your-nrn" # Required when type = "agent" type = "agent" @@ -43,7 +43,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.22.1" nrn = "your-nrn" # Required when type = "base" type = "base" @@ -54,7 +54,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.22.1" nrn = "your-nrn" # Required when type = "scope_notification" specification_slug = "your-specification-slug" # Required when type = "scope_notification" @@ -66,7 +66,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.22.1" nrn = "your-nrn" # Required when type = "service_notification" specification_slug = "your-specification-slug" # Required when type = "service_notification" @@ -78,7 +78,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.22.1" custom_name = "your-custom-name" # Required when type = "custom" custom_role_slugs = "your-custom-role-slugs" # Required when type = "custom" diff --git a/nullplatform/asset/docker_server/README.md b/nullplatform/asset/docker_server/README.md index 5ffad6ff3..c7aafe497 100644 --- a/nullplatform/asset/docker_server/README.md +++ b/nullplatform/asset/docker_server/README.md @@ -21,7 +21,7 @@ Creates a nullplatform_provider_config resource of type 'docker-server' with enc ```hcl module "docker_server" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/docker_server?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/docker_server?ref=v6.22.1" login_server = "your-login-server" nrn = "your-nrn" diff --git a/nullplatform/asset/ecr/README.md b/nullplatform/asset/ecr/README.md index 758032ab4..e0f2c0ca9 100644 --- a/nullplatform/asset/ecr/README.md +++ b/nullplatform/asset/ecr/README.md @@ -21,7 +21,7 @@ The module reads the current AWS region via the aws_region data source and combi ```hcl module "ecr" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/ecr?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/ecr?ref=v6.22.1" application_role_arn = "your-application-role-arn" build_workflow_access_key_id = "your-build-workflow-access-key-id" diff --git a/nullplatform/asset/s3/README.md b/nullplatform/asset/s3/README.md index 32fbaf221..072897fcc 100644 --- a/nullplatform/asset/s3/README.md +++ b/nullplatform/asset/s3/README.md @@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type s3-con ```hcl module "s3" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/s3?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/s3?ref=v6.22.1" bucket_name = "your-bucket-name" nrn = "your-nrn" diff --git a/nullplatform/base/README.md b/nullplatform/base/README.md index e50e5e7e9..0aa162b5e 100644 --- a/nullplatform/base/README.md +++ b/nullplatform/base/README.md @@ -2,27 +2,27 @@ ## Description -Deploys the nullplatform base Helm chart to a Kubernetes cluster with pre-created namespaces and multi-cloud gateway, logging, and observability configuration across EKS, GKE, AKS, OKE, and ARO providers +Deploys the nullplatform base Helm chart onto a Kubernetes cluster across multiple cloud providers, wiring up gateways, ingress controllers, logging pipelines, and observability integrations via a single helm_release resource ## Architecture -The module creates two kubernetes_namespace_v1 resources ('nullplatform-tools' and 'nullplatform') before deploying a helm_release named 'nullplatform-base' from the nullplatform Helm repository, using a templatefile-rendered locals block to produce the chart values. All provider-specific gateway settings (AWS security groups, Azure NSGs, GCP firewall rules, OCI subnets), logging backends (Loki, GELF, Datadog, Dynatrace, New Relic, CloudWatch), ingress controllers, and control plane agent image coordinates are wired from input variables into the template and passed as the helm_release values argument. Outputs expose the rendered Helm values and cloud-specific gateway security resource identifiers (security group IDs, NSG IDs, firewall names) for consumption by upstream modules. +The module pre-creates two kubernetes_namespace_v1 resources (nullplatform-tools and nullplatform) to avoid Helm lookup race conditions, then renders a YAML values file from a templatefile() call in locals.tf that maps all input variables to chart values. A single helm_release resource named 'nullplatform-base' deploys the chart from the nullplatform GitHub Helm repository into the pre-created namespace, with the rendered values controlling every subsystem including gateways, ingress controllers, control plane agent, logging DaemonSet, and observability exporters. Outputs surface the rendered values and cloud-specific security resource IDs (AWS security groups, Azure NSGs, GCP firewall names) that were passed in from upstream security submodules. ## Features -- Creates kubernetes_namespace_v1 resources for 'nullplatform-tools' and 'nullplatform' with Helm-compatible labels and annotations before chart installation -- Deploys helm_release 'nullplatform-base' with pinned chart version, 600-second timeout, and job completion waiting to ensure deterministic installs -- Configures multi-cloud gateway resources (AWS, Azure, GCP, OCI) with provider-specific security groups, NSGs, firewall rules, and subnet annotations -- Supports multiple observability backends including Prometheus, GELF, Loki, Dynatrace, Datadog, New Relic, and CloudWatch with per-backend enable flags -- Renders all Helm values via a templatefile from a YAML template, converting Terraform booleans and variables into chart-compatible strings -- Enforces pinned non-moving version references for Helm chart version, control plane agent image tag, and logging controller image tag via validation rules -- Configures public and private ingress controllers and Gateway API resources with per-controller scope, domain, and enablement settings +- Creates two Kubernetes namespaces (nullplatform-tools and nullplatform) with Helm-managed labels and annotations before chart installation +- Deploys the nullplatform-base Helm chart with a pinned version via helm_release, enforcing non-moving version references through input validation +- Configures public and private gateways with per-cloud security integration for AWS security groups, Azure NSGs, GCP firewall rules, and OCI security lists +- Enables pluggable observability backends including Prometheus, Loki, GELF, Dynatrace, Datadog, New Relic, and CloudWatch via feature-flag variables +- Deploys a logging controller DaemonSet and control plane agent with pinned container image tags enforced by validation rules +- Supports multi-cloud Kubernetes providers (EKS, GKE, AKS, OKE, ARO) with provider-specific gateway and load balancer configuration +- Configures Gateway API CRD installation, ingress controllers, TLS requirements, metrics server, and image pull secrets through a single templatefile-rendered values block ## Basic Usage ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.22.1" control_plane_agent_image_tag = "your-control-plane-agent-image-tag" k8s_provider = "your-k8s-provider" @@ -36,7 +36,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.22.1" control_plane_agent_image_tag = "your-control-plane-agent-image-tag" k8s_provider = "eks" @@ -50,7 +50,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.22.1" control_plane_agent_image_tag = "your-control-plane-agent-image-tag" k8s_provider = "gke" @@ -64,7 +64,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.22.1" control_plane_agent_image_tag = "your-control-plane-agent-image-tag" k8s_provider = "aks" @@ -78,7 +78,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.22.1" control_plane_agent_image_tag = "your-control-plane-agent-image-tag" k8s_provider = "oke" @@ -92,7 +92,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.22.1" control_plane_agent_image_tag = "your-control-plane-agent-image-tag" k8s_provider = "aro" @@ -102,6 +102,48 @@ module "base" { } ``` +### Usage with Pinned Helm Chart Version + +```hcl +module "base" { + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.22.1" + + control_plane_agent_image_tag = "your-control-plane-agent-image-tag" + k8s_provider = "your-k8s-provider" + logging_controller_image_tag = "your-logging-controller-image-tag" + np_api_key = "your-np-api-key" + nullplatform_base_helm_version = "latest" +} +``` + +### Usage with Pinned Control Plane Agent Image + +```hcl +module "base" { + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.22.1" + + control_plane_agent_image_tag = "latest" + k8s_provider = "your-k8s-provider" + logging_controller_image_tag = "your-logging-controller-image-tag" + np_api_key = "your-np-api-key" + nullplatform_base_helm_version = "your-nullplatform-base-helm-version" +} +``` + +### Usage with Pinned Logging Controller Image + +```hcl +module "base" { + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.22.1" + + control_plane_agent_image_tag = "your-control-plane-agent-image-tag" + k8s_provider = "your-k8s-provider" + logging_controller_image_tag = "latest" + np_api_key = "your-np-api-key" + nullplatform_base_helm_version = "your-nullplatform-base-helm-version" +} +``` + ## Using Outputs ```hcl @@ -159,6 +201,7 @@ resource "example_resource" "this" { | [dynatrace\_logs\_enabled](#input\_dynatrace\_logs\_enabled) | Enable log forwarding to Dynatrace. Set to false to send only metrics. | `bool` | `true` | no | | [dynatrace\_metrics\_enabled](#input\_dynatrace\_metrics\_enabled) | Enable metrics forwarding to Dynatrace. Set to false to send only logs. | `bool` | `true` | no | | [exporter\_prometheus\_port](#input\_exporter\_prometheus\_port) | Port Number to Prometheus exporter. | `string` | `"2021"` | no | +| [gateway\_api\_crd\_ref](#input\_gateway\_api\_crd\_ref) | Git ref (tag or commit) of kubernetes-sigs/gateway-api to install when install\_gateway\_v2\_crd is true. Ignored on chart versions older than the one that introduced global.gatewayApiCrdRef. Default (v1.3.0) matches what Istio 1.27 documents installing; re-check istio.io's version-pinned docs when bumping Istio. | `string` | `"v1.3.0"` | no | | [gateway\_api\_crds\_install](#input\_gateway\_api\_crds\_install) | Install Gateway API CRDs. | `bool` | `false` | no | | [gateway\_api\_enabled](#input\_gateway\_api\_enabled) | Enable the Gateway API. | `bool` | `false` | no | | [gateway\_enabled](#input\_gateway\_enabled) | Enable the HTTP gateway. | `bool` | `false` | no | @@ -191,7 +234,7 @@ resource "example_resource" "this" { | [image\_pull\_secrets\_registry](#input\_image\_pull\_secrets\_registry) | Registry URL for the image pull secret. | `string` | `""` | no | | [image\_pull\_secrets\_username](#input\_image\_pull\_secrets\_username) | Registry username. | `string` | `""` | no | | [ingressControllers](#input\_ingressControllers) | Configuración de los IngressControllers públicos y privados | 
object({
    public = object({
      name    = string
      enabled = bool
      scope   = string
      domain  = string
    })
    private = object({
      name    = string
      enabled = bool
      scope   = string
      domain  = string
    })
  })
| 
{
  "private": {
    "domain": "",
    "enabled": false,
    "name": "internal",
    "scope": "Internal"
  },
  "public": {
    "domain": "",
    "enabled": false,
    "name": "internet-facing",
    "scope": "External"
  }
}
| no | -| [install\_gateway\_v2\_crd](#input\_install\_gateway\_v2\_crd) | Install Gateway API v2 CRDs. | `bool` | `false` | no | +| [install\_gateway\_v2\_crd](#input\_install\_gateway\_v2\_crd) | Install/reconcile the Gateway API CRDs (see gateway\_api\_crd\_ref) via the base chart's pre-install/pre-upgrade Job. Defaults to true so CRDs actually track gateway\_api\_crd\_ref instead of staying frozen at whatever was present on first install — matches the base chart's own default. Safe on chart versions before global.gatewayApiCrdRef too: those only install when the CRD is missing, so pre-existing CRDs from another source are left untouched. | `bool` | `true` | no | | [internal\_azure\_load\_balancer\_subnet](#input\_internal\_azure\_load\_balancer\_subnet) | Name of the subnet for the internal gateway's Azure load balancer. Empty by default, in which case Azure picks the subnet automatically. Must be the subnet's resource name (e.g. "subnet-4"), not the key it has in a subnets\_definition map. | `string` | `""` | no | | [k8s\_provider](#input\_k8s\_provider) | Cloud provider (eks, gke, aks, oke and aro). | `string` | n/a | yes | | [logging\_application\_logs\_enabled](#input\_logging\_application\_logs\_enabled) | Enable application log forwarding. Set to false to keep only http/sys metrics pipelines active across all providers. | `bool` | `true` | no | @@ -233,16 +276,16 @@ resource "example_resource" "this" { diff --git a/nullplatform/cloud/aws/cloud/README.md b/nullplatform/cloud/aws/cloud/README.md index 4e07f1423..ff864577a 100644 --- a/nullplatform/cloud/aws/cloud/README.md +++ b/nullplatform/cloud/aws/cloud/README.md @@ -21,7 +21,7 @@ The module uses data sources aws_caller_identity and aws_region to dynamically r ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/cloud?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/cloud?ref=v6.22.1" domain_name = "your-domain-name" hosted_private_zone_id = "your-hosted-private-zone-id" diff --git a/nullplatform/cloud/aws/vpc/README.md b/nullplatform/cloud/aws/vpc/README.md index 029c17e20..44b3a5de8 100644 --- a/nullplatform/cloud/aws/vpc/README.md +++ b/nullplatform/cloud/aws/vpc/README.md @@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource of type aws-ne ```hcl module "vpc" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/vpc?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/vpc?ref=v6.22.1" nrn = "your-nrn" vpc_id = "your-vpc-id" diff --git a/nullplatform/cloud/azure/cloud/README.md b/nullplatform/cloud/azure/cloud/README.md index 270a294a6..41dd123f7 100644 --- a/nullplatform/cloud/azure/cloud/README.md +++ b/nullplatform/cloud/azure/cloud/README.md @@ -22,7 +22,7 @@ The module creates a single nullplatform_provider_config resource of type 'azure ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/azure/cloud?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/azure/cloud?ref=v6.22.1" azure_resource_group_name = "your-azure-resource-group-name" nrn = "your-nrn" diff --git a/nullplatform/cloud/gcp/cloud/README.md b/nullplatform/cloud/gcp/cloud/README.md index 21472fdfb..f9c7ebcb5 100644 --- a/nullplatform/cloud/gcp/cloud/README.md +++ b/nullplatform/cloud/gcp/cloud/README.md @@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type 'googl ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/gcp/cloud?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/gcp/cloud?ref=v6.22.1" domain_name = "your-domain-name" location = "your-location" diff --git a/nullplatform/cloud/oci/cloud/README.md b/nullplatform/cloud/oci/cloud/README.md index 56770d9ba..e7cbc7b60 100644 --- a/nullplatform/cloud/oci/cloud/README.md +++ b/nullplatform/cloud/oci/cloud/README.md @@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type 'oci-c ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/oci/cloud?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/oci/cloud?ref=v6.22.1" account_id = "your-account-id" account_name = "your-account-name" diff --git a/nullplatform/code_repository/README.md b/nullplatform/code_repository/README.md index f6c964246..c0566a1c6 100644 --- a/nullplatform/code_repository/README.md +++ b/nullplatform/code_repository/README.md @@ -22,7 +22,7 @@ The module uses local boolean flags (is_gitlab, is_github, is_azure, is_bitbucke ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.22.1" git_provider = "your-git-provider" nrn = "your-nrn" @@ -33,7 +33,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.22.1" git_provider = "github" github_installation_id = "your-github-installation-id" # Required when git_provider = "github" @@ -46,7 +46,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.22.1" git_provider = "gitlab" gitlab_access_token = "your-gitlab-access-token" # Required when git_provider = "gitlab" @@ -62,7 +62,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.22.1" azure_access_token = "your-azure-access-token" # Required when git_provider = "azure" azure_agent_pool = "your-azure-agent-pool" # Required when git_provider = "azure" @@ -76,7 +76,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.22.1" bitbucket_collaborators = "your-bitbucket-collaborators" # Required when git_provider = "bitbucket" bitbucket_installation_url = "your-bitbucket-installation-url" # Required when git_provider = "bitbucket" diff --git a/nullplatform/container_orchestration/aks/README.md b/nullplatform/container_orchestration/aks/README.md index 2e669c8de..7ec1008f6 100644 --- a/nullplatform/container_orchestration/aks/README.md +++ b/nullplatform/container_orchestration/aks/README.md @@ -22,7 +22,7 @@ The module constructs a set of locals that merge optional and required inputs in ```hcl module "aks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.22.1" cluster_name = "your-cluster-name" nrn = "your-nrn" @@ -36,7 +36,7 @@ module "aks" { ```hcl module "aks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.22.1" cluster_name = "your-cluster-name" nrn = "your-nrn" @@ -50,7 +50,7 @@ module "aks" { ```hcl module "aks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.22.1" cluster_name = "your-cluster-name" nrn = "your-nrn" @@ -64,7 +64,7 @@ module "aks" { ```hcl module "aks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.22.1" cluster_name = "your-cluster-name" nrn = "your-nrn" diff --git a/nullplatform/container_orchestration/eks/README.md b/nullplatform/container_orchestration/eks/README.md index 426025717..68d74849d 100644 --- a/nullplatform/container_orchestration/eks/README.md +++ b/nullplatform/container_orchestration/eks/README.md @@ -22,7 +22,7 @@ The module assembles multiple local maps (cluster, balancer, network, resource_m ```hcl module "eks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.22.1" cluster_name = "your-cluster-name" nrn = "your-nrn" @@ -34,7 +34,7 @@ module "eks" { ```hcl module "eks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.22.1" cluster_name = "your-cluster-name" nrn = "your-nrn" @@ -46,7 +46,7 @@ module "eks" { ```hcl module "eks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.22.1" cluster_name = "your-cluster-name" nrn = "your-nrn" @@ -58,7 +58,7 @@ module "eks" { ```hcl module "eks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.22.1" cluster_name = "your-cluster-name" nrn = "your-nrn" diff --git a/nullplatform/container_orchestration/gke/README.md b/nullplatform/container_orchestration/gke/README.md index 6ceb93ec4..b1f6a9099 100644 --- a/nullplatform/container_orchestration/gke/README.md +++ b/nullplatform/container_orchestration/gke/README.md @@ -22,7 +22,7 @@ The module constructs a set of locals that merge optional inputs (gateway namesp ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.22.1" cluster_name = "your-cluster-name" location = "your-location" @@ -36,7 +36,7 @@ module "gke" { ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.22.1" cluster_name = "your-cluster-name" location = "your-location" @@ -50,7 +50,7 @@ module "gke" { ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.22.1" cluster_name = "your-cluster-name" location = "your-location" @@ -64,7 +64,7 @@ module "gke" { ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.22.1" cluster_name = "your-cluster-name" location = "your-location" diff --git a/nullplatform/container_orchestration/oke/README.md b/nullplatform/container_orchestration/oke/README.md index 8e434b727..3dab188fb 100644 --- a/nullplatform/container_orchestration/oke/README.md +++ b/nullplatform/container_orchestration/oke/README.md @@ -19,7 +19,7 @@ Creates a single nullplatform_provider_config resource of type 'oke' that stores ```hcl module "oke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/oke?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/oke?ref=v6.22.1" cluster_name = "your-cluster-name" nrn = "your-nrn" diff --git a/nullplatform/dimension/README.md b/nullplatform/dimension/README.md index a70f05b42..090f0f450 100644 --- a/nullplatform/dimension/README.md +++ b/nullplatform/dimension/README.md @@ -19,7 +19,7 @@ The module creates a nullplatform_dimension resource using the provided name, or ```hcl module "dimension" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension?ref=v6.22.1" name = "your-name" nrn = "your-nrn" diff --git a/nullplatform/dimension_value/README.md b/nullplatform/dimension_value/README.md index b45f9444d..9874bc068 100644 --- a/nullplatform/dimension_value/README.md +++ b/nullplatform/dimension_value/README.md @@ -19,7 +19,7 @@ The module uses a terraform_data resource to enforce mutual-exclusivity and pres ```hcl module "dimension_value" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension_value?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension_value?ref=v6.22.1" dimension_id = "your-dimension-id" name = "your-name" diff --git a/nullplatform/identity-access-control/README.md b/nullplatform/identity-access-control/README.md index 3d60e3789..153679979 100644 --- a/nullplatform/identity-access-control/README.md +++ b/nullplatform/identity-access-control/README.md @@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource named identity ```hcl module "identity-access-control" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/identity-access-control?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/identity-access-control?ref=v6.22.1" attributes = "your-attributes" nrn = "your-nrn" diff --git a/nullplatform/metrics/README.md b/nullplatform/metrics/README.md index a3b89ef44..0646f1801 100644 --- a/nullplatform/metrics/README.md +++ b/nullplatform/metrics/README.md @@ -21,7 +21,7 @@ The module creates a single nullplatform_provider_config resource of type 'prome ```hcl module "metrics" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/metrics?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/metrics?ref=v6.22.1" nrn = "your-nrn" } diff --git a/nullplatform/packaged_service/README.md b/nullplatform/packaged_service/README.md index d722e98fa..070edf111 100644 --- a/nullplatform/packaged_service/README.md +++ b/nullplatform/packaged_service/README.md @@ -17,7 +17,7 @@ spec updates / republish correctly. ```hcl module "packaged_service" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/packaged_service?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/packaged_service?ref=v6.22.1" nrn = "organization=…:account=…:namespace=…" diff --git a/nullplatform/parameter_storage_configuration/README.md b/nullplatform/parameter_storage_configuration/README.md index 6964eae3b..68954f0f7 100644 --- a/nullplatform/parameter_storage_configuration/README.md +++ b/nullplatform/parameter_storage_configuration/README.md @@ -20,7 +20,7 @@ The module delegates entirely to a remote `scope_configuration` module sourced f ```hcl module "parameter_storage_configuration" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_configuration?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_configuration?ref=v6.22.1" attributes = "your-attributes" np_api_key = "your-np-api-key" diff --git a/nullplatform/parameter_storage_definition/README.md b/nullplatform/parameter_storage_definition/README.md index 9c0b296e0..e95c4920e 100644 --- a/nullplatform/parameter_storage_definition/README.md +++ b/nullplatform/parameter_storage_definition/README.md @@ -20,7 +20,7 @@ A data.http resource fetches the raw specification template from a configurable ```hcl module "parameter_storage_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition?ref=v6.22.1" np_api_key = "your-np-api-key" nrn = "your-nrn" diff --git a/nullplatform/parameter_storage_definition_agent_association/README.md b/nullplatform/parameter_storage_definition_agent_association/README.md index c15cd4508..90f63115c 100644 --- a/nullplatform/parameter_storage_definition_agent_association/README.md +++ b/nullplatform/parameter_storage_definition_agent_association/README.md @@ -21,7 +21,7 @@ The module creates a terraform_data resource to track API key changes and a null ```hcl module "parameter_storage_definition_agent_association" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition_agent_association?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition_agent_association?ref=v6.22.1" api_key = "your-api-key" nrn = "your-nrn" diff --git a/nullplatform/scope_configuration/README.md b/nullplatform/scope_configuration/README.md index 414703323..386f86a00 100644 --- a/nullplatform/scope_configuration/README.md +++ b/nullplatform/scope_configuration/README.md @@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource that binds a N ```hcl module "scope_configuration" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_configuration?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_configuration?ref=v6.22.1" attributes = "your-attributes" np_api_key = "your-np-api-key" diff --git a/nullplatform/scope_definition/README.md b/nullplatform/scope_definition/README.md index 5f5232f1b..4f9e414ae 100644 --- a/nullplatform/scope_definition/README.md +++ b/nullplatform/scope_definition/README.md @@ -22,7 +22,7 @@ The module fetches JSON templates via data.http resources from a configurable Gi ```hcl module "scope_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition?ref=v6.22.1" np_api_key = "your-np-api-key" nrn = "your-nrn" diff --git a/nullplatform/scope_definition_agent_association/README.md b/nullplatform/scope_definition_agent_association/README.md index 8a1799320..d973e1b0f 100644 --- a/nullplatform/scope_definition_agent_association/README.md +++ b/nullplatform/scope_definition_agent_association/README.md @@ -22,7 +22,7 @@ The module fetches a notification channel JSON template via the `data.http` prov ```hcl module "scope_definition_agent_association" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition_agent_association?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition_agent_association?ref=v6.22.1" api_key = "your-api-key" nrn = "your-nrn" diff --git a/nullplatform/service_definition/README.md b/nullplatform/service_definition/README.md index 28a133d87..03ea40881 100644 --- a/nullplatform/service_definition/README.md +++ b/nullplatform/service_definition/README.md @@ -22,7 +22,7 @@ The module uses `data.http` resources to fetch `service-spec.json.tpl`, `actions ```hcl module "service_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.22.1" nrn = "your-nrn" repository_branch = "your-repository-branch" @@ -35,7 +35,7 @@ module "service_definition" { ```hcl module "service_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.22.1" nrn = "your-nrn" repository_branch = "main" @@ -48,7 +48,7 @@ module "service_definition" { ```hcl module "service_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.22.1" git_provider = "your-git-provider" # Required when repository_branch = "v1.4.0" nrn = "your-nrn" diff --git a/nullplatform/service_definition_agent_association/README.md b/nullplatform/service_definition_agent_association/README.md index a8b82d511..be8250cb4 100644 --- a/nullplatform/service_definition_agent_association/README.md +++ b/nullplatform/service_definition_agent_association/README.md @@ -22,7 +22,7 @@ The module creates a terraform_data resource to track API key changes as a lifec ```hcl module "service_definition_agent_association" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition_agent_association?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition_agent_association?ref=v6.22.1" api_key = "your-api-key" repository_service_spec_repo = "your-repository-service-spec-repo" diff --git a/nullplatform/users/README.md b/nullplatform/users/README.md index 91f47a8f9..5c3debc3e 100644 --- a/nullplatform/users/README.md +++ b/nullplatform/users/README.md @@ -21,7 +21,7 @@ The module iterates over a map of user definitions using `nullplatform_user` res ```hcl module "users" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/users?ref=v6.22.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/users?ref=v6.22.1" nullplatform_users = "your-nullplatform-users" } From f15ba3c53cfa7d5f2382b7bf6d740b928f98e669 Mon Sep 17 00:00:00 2001 From: sebas_correa Date: Tue, 1 Sep 2026 13:28:20 -0300 Subject: [PATCH 53/81] fix(asset): remove unused dimensions variable across ecr/s3/docker_server dimensions was declared and (in s3/docker_server) wired into the nullplatform_provider_config resource, but never used by any caller in this repo. Removes it consistently from all three sibling asset modules instead of leaving ecr as the odd one out. --- nullplatform/asset/docker_server/main.tf | 5 ++--- nullplatform/asset/docker_server/variables.tf | 6 ------ nullplatform/asset/s3/main.tf | 7 +++---- nullplatform/asset/s3/variables.tf | 6 ------ 4 files changed, 5 insertions(+), 19 deletions(-) diff --git a/nullplatform/asset/docker_server/main.tf b/nullplatform/asset/docker_server/main.tf index f19ac1cdb..9fb2a85b0 100644 --- a/nullplatform/asset/docker_server/main.tf +++ b/nullplatform/asset/docker_server/main.tf @@ -1,7 +1,6 @@ resource "nullplatform_provider_config" "docker_server" { - nrn = var.nrn - type = "docker-server" - dimensions = var.dimensions + nrn = var.nrn + type = "docker-server" attributes = jsonencode({ "setup" : { "server" : var.login_server, diff --git a/nullplatform/asset/docker_server/variables.tf b/nullplatform/asset/docker_server/variables.tf index ad6dfb398..87126a51e 100644 --- a/nullplatform/asset/docker_server/variables.tf +++ b/nullplatform/asset/docker_server/variables.tf @@ -24,9 +24,3 @@ variable "password" { type = string sensitive = false } - -variable "dimensions" { - description = "Dimensions to segment the nullplatform provider config (e.g. by region, environment)" - type = map(string) - default = {} -} diff --git a/nullplatform/asset/s3/main.tf b/nullplatform/asset/s3/main.tf index 9818d911e..b44d82a26 100644 --- a/nullplatform/asset/s3/main.tf +++ b/nullplatform/asset/s3/main.tf @@ -1,8 +1,7 @@ resource "nullplatform_provider_config" "s3" { - provider = nullplatform - nrn = var.nrn - type = "s3-configuration" - dimensions = var.dimensions + provider = nullplatform + nrn = var.nrn + type = "s3-configuration" attributes = jsonencode({ bucket = { name = var.bucket_name diff --git a/nullplatform/asset/s3/variables.tf b/nullplatform/asset/s3/variables.tf index 527285b5a..3186b8681 100644 --- a/nullplatform/asset/s3/variables.tf +++ b/nullplatform/asset/s3/variables.tf @@ -3,12 +3,6 @@ variable "nrn" { type = string } -variable "dimensions" { - description = "Dimensions to segment the nullplatform provider config (e.g. by region, environment)" - type = map(string) - default = {} -} - variable "bucket_name" { description = "Name of the existing S3 bucket used as the asset repository, where Lambda/bundle assets are published. Maps to the platform's aws.s3_assets_bucket configuration." type = string From 2b29c87a65e7218cfd38d0a94dd3a7d69bade743 Mon Sep 17 00:00:00 2001 From: sebas_correa Date: Tue, 1 Sep 2026 14:26:35 -0300 Subject: [PATCH 54/81] feat(agent)!: move deploy/DNS env vars from the agent pod to the worker MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit DNS_TYPE, DOMAIN, USE_ACCOUNT_SLUG, SERVICE_TEMPLATE, INITIAL_INGRESS_PATH, and BLUE_GREEN_INGRESS_PATH are consumed when the worker renders a scope's k8s deployment, not by the agent's own control loop. They move off the agent pod's env and onto the worker container's env only. CLUSTER_NAME and NAMESPACE stay on the agent (it still needs them to operate) and are also added to the worker's env. Adds four typed variables for worker fields that had no variable before: worker_backend (default "kubernetes"), worker_allowed_registries (default null — omitted, not [], since an empty list under a deny-by-default guardrail could otherwise block the base scope images), worker_memory_limit, and worker_service_account_name (falls back to service_account_name). The worker values layer is now always emitted (previously gated on var.worker != null, which is an unadopted, untested passthrough — gating on it would have made these vars vanish entirely for the many callers who don't set var.worker). var.worker remains available as an extra/override layer merged on top of the computed base: its own patches are concatenated with, not replaced by, the computed worker-container patch. BREAKING CHANGE: DNS_TYPE, DOMAIN, USE_ACCOUNT_SLUG, SERVICE_TEMPLATE, INITIAL_INGRESS_PATH, and BLUE_GREEN_INGRESS_PATH are no longer set on the agent pod's own env — only on the worker's. Callers relying on those keys being present in the agent pod's configuration.values must move that dependency to the worker. --- nullplatform/agent/locals.tf | 59 ++++++-- nullplatform/agent/main.tf | 8 +- .../agent/tests/agent_values.tftest.hcl | 132 ++++++++++++++++++ nullplatform/agent/variables.tf | 43 ++++-- 4 files changed, 220 insertions(+), 22 deletions(-) diff --git a/nullplatform/agent/locals.tf b/nullplatform/agent/locals.tf index 9c6cd6a1c..2f4b3f007 100644 --- a/nullplatform/agent/locals.tf +++ b/nullplatform/agent/locals.tf @@ -49,13 +49,7 @@ locals { NAMESPACE = var.namespace IMAGE_TAG = var.image_tag TRAFFIC_CONTAINER_IMAGE = "${var.agent_traffic_manager_repository}:${var.agent_traffic_manager_tag}" - DOMAIN = var.domain - DNS_TYPE = var.dns_type - USE_ACCOUNT_SLUG = var.use_account_slug IMAGE_PULL_SECRETS = var.image_pull_secrets - SERVICE_TEMPLATE = var.service_template - INITIAL_INGRESS_PATH = var.initial_ingress_path - BLUE_GREEN_INGRESS_PATH = var.blue_green_ingress_path PRIVATE_GATEWAY_NAME = var.private_gateway_name PUBLIC_GATEWAY_NAME = var.public_gateway_name } @@ -94,7 +88,54 @@ locals { service_account_name = var.service_account_name }) - # Worker-orchestration config as a second Helm values layer, so the nested - # shape (allowedRegistries/patches/rules/pins) passes through verbatim. - worker_values = var.worker != null ? yamlencode({ worker = var.worker }) : null + # Deploy-template/DNS values consumed by the worker when it renders a scope's + # k8s deployment, not by the agent's own control loop. + worker_env = { + DNS_TYPE = var.dns_type + DOMAIN = var.domain + USE_ACCOUNT_SLUG = var.use_account_slug + K8S_NAMESPACE = var.namespace + CLUSTER_NAME = var.cluster_name + SERVICE_TEMPLATE = var.service_template + INITIAL_INGRESS_PATH = var.initial_ingress_path + BLUE_GREEN_INGRESS_PATH = var.blue_green_ingress_path + } + + worker_service_account_name = var.worker_service_account_name != "" ? var.worker_service_account_name : var.service_account_name + + worker_container_patch = { + target = { package = "containers" } + merge = { + spec = merge( + local.worker_service_account_name != "" ? { serviceAccountName = local.worker_service_account_name } : {}, + { + containers = [ + merge( + { name = "worker" }, + var.worker_memory_limit != null ? { resources = { limits = { memory = var.worker_memory_limit } } } : {}, + { env = [for k, v in local.worker_env : { name = k, value = v }] } + ) + ] + } + ) + } + } + + # Computed base merged with var.worker as an extra/override layer, so the + # escape hatch keeps working without dropping the computed worker-container + # patch (patches are concatenated, not replaced). + worker_base = merge( + { backend = var.worker_backend }, + var.worker_allowed_registries != null ? { allowedRegistries = var.worker_allowed_registries } : {}, + { patches = concat([local.worker_container_patch], try(var.worker.patches, [])) } + ) + + worker_final = merge( + local.worker_base, + try({ for k, v in var.worker : k => v if k != "patches" }, {}) + ) + + # Always emitted (unlike the agent's own values) so these env vars never + # silently disappear for callers who don't otherwise set var.worker. + worker_values = yamlencode({ worker = local.worker_final }) } diff --git a/nullplatform/agent/main.tf b/nullplatform/agent/main.tf index 78b5004ee..fee3ae3ee 100644 --- a/nullplatform/agent/main.tf +++ b/nullplatform/agent/main.tf @@ -65,10 +65,10 @@ resource "helm_release" "agent" { dependency_update = true max_history = 10 - values = concat( - [local.nullplatform_agent_values], - var.worker != null ? [local.worker_values] : [], - ) + values = [ + local.nullplatform_agent_values, + local.worker_values, + ] lifecycle { replace_triggered_by = [terraform_data.api_key_trigger] diff --git a/nullplatform/agent/tests/agent_values.tftest.hcl b/nullplatform/agent/tests/agent_values.tftest.hcl index cbb42c65b..3c08614df 100644 --- a/nullplatform/agent/tests/agent_values.tftest.hcl +++ b/nullplatform/agent/tests/agent_values.tftest.hcl @@ -100,3 +100,135 @@ run "agent_repos_scope_rejects_an_inline_fragment" { # otherwise render repo.git#v1.15.1#v1.15.1. expect_failures = [var.agent_repos_scope] } + +################################################################################ +# Worker orchestration +################################################################################ + +# DNS_TYPE/DOMAIN/USE_ACCOUNT_SLUG/SERVICE_TEMPLATE/INITIAL_INGRESS_PATH/ +# BLUE_GREEN_INGRESS_PATH are consumed by the worker when it renders a scope's +# k8s deployment, not by the agent's own control loop — they live on the +# worker's env only. CLUSTER_NAME/NAMESPACE are needed by both. +run "moved_deploy_vars_are_worker_only_cluster_and_namespace_are_shared" { + command = plan + + variables { + domain = "playground.nullapps.io" + dns_type = "external_dns" + namespace = "nullplatform" + } + + assert { + condition = alltrue([ + for key in ["DNS_TYPE", "DOMAIN", "USE_ACCOUNT_SLUG", "SERVICE_TEMPLATE", + "INITIAL_INGRESS_PATH", "BLUE_GREEN_INGRESS_PATH"] : + !strcontains(helm_release.agent.values[0], key) + ]) + error_message = "deploy/DNS vars must not leak into the agent pod's own values" + } + + assert { + condition = strcontains(helm_release.agent.values[0], "CLUSTER_NAME") && strcontains(helm_release.agent.values[0], "NAMESPACE") + error_message = "CLUSTER_NAME and NAMESPACE must stay in the agent's own values" + } +} + +run "worker_layer_always_present_with_expected_env" { + command = plan + + variables { + domain = "playground.nullapps.io" + dns_type = "external_dns" + namespace = "nullplatform" + } + + assert { + condition = strcontains(helm_release.agent.values[1], "\"backend\": \"kubernetes\"") + error_message = "worker layer must always be emitted, even without var.worker or any worker_* override" + } + + assert { + condition = ( + strcontains(helm_release.agent.values[1], "\"name\": \"DNS_TYPE\"") && + strcontains(helm_release.agent.values[1], "\"value\": \"external_dns\"") && + strcontains(helm_release.agent.values[1], "\"name\": \"DOMAIN\"") && + strcontains(helm_release.agent.values[1], "\"value\": \"playground.nullapps.io\"") && + strcontains(helm_release.agent.values[1], "\"name\": \"K8S_NAMESPACE\"") && + strcontains(helm_release.agent.values[1], "\"value\": \"nullplatform\"") && + strcontains(helm_release.agent.values[1], "\"name\": \"CLUSTER_NAME\"") + ) + error_message = "worker env must carry the deploy/DNS vars plus cluster/namespace" + } +} + +run "worker_typed_overrides_are_applied" { + command = plan + + variables { + worker_backend = "kubernetes" + worker_allowed_registries = ["public.ecr.aws/nullplatform/scopes*"] + worker_memory_limit = "2Gi" + worker_service_account_name = "nullplatform-agent" + } + + assert { + condition = ( + strcontains(helm_release.agent.values[1], "public.ecr.aws/nullplatform/scopes*") && + strcontains(helm_release.agent.values[1], "\"memory\": \"2Gi\"") && + strcontains(helm_release.agent.values[1], "\"serviceAccountName\": \"nullplatform-agent\"") + ) + error_message = "worker_allowed_registries/worker_memory_limit/worker_service_account_name must reach the worker patch" + } +} + +run "worker_service_account_falls_back_to_service_account_name" { + command = plan + + variables { + service_account_name = "my-sa" + } + + assert { + condition = strcontains(helm_release.agent.values[1], "\"serviceAccountName\": \"my-sa\"") + error_message = "worker's serviceAccountName should fall back to service_account_name when worker_service_account_name is unset" + } +} + +run "worker_defaults_omit_unset_optional_fields" { + command = plan + + assert { + condition = !strcontains(helm_release.agent.values[1], "allowedRegistries") + error_message = "allowedRegistries must be omitted (not an empty list) when worker_allowed_registries is left at its null default" + } + + assert { + condition = !strcontains(helm_release.agent.values[1], "resources") + error_message = "resources.limits.memory must be omitted when worker_memory_limit is left at its null default" + } +} + +# var.worker stays available as an extra/override layer on top of the computed +# base: its own patches are concatenated (not dropped), and its other top-level +# keys (e.g. idleTTL) pass through. +run "worker_extra_patches_and_overrides_are_merged_not_replaced" { + command = plan + + variables { + worker = { + idleTTL = "30m" + patches = [ + { target = { package = "my-pkg" }, merge = { spec = { serviceAccountName = "np-agent-sa" } } } + ] + } + } + + assert { + condition = ( + strcontains(helm_release.agent.values[1], "\"idleTTL\": \"30m\"") && + strcontains(helm_release.agent.values[1], "\"package\": \"my-pkg\"") && + strcontains(helm_release.agent.values[1], "\"name\": \"worker\"") + ) + error_message = "var.worker's own patches/keys must be merged alongside the computed worker-container patch, not replace it" + } +} diff --git a/nullplatform/agent/variables.tf b/nullplatform/agent/variables.tf index bc2a9aa43..3dfb22da5 100644 --- a/nullplatform/agent/variables.tf +++ b/nullplatform/agent/variables.tf @@ -71,24 +71,49 @@ variable "nullplatform_agent_helm_version" { variable "worker" { description = <<-EOT - Worker-orchestration config, merged into the agent chart's `worker` block: - backend, security, allowedRegistries (deny-by-default registry guardrail), - patches (standard k8s patching of workers — the preferred way to shape them), - idleTTL (reap idle workers), and the legacy defaults/rules/pins. See the - nullplatform-agent chart values (>= 2.37.0) for the full shape. null = chart - defaults. + Extra worker-orchestration config, merged on top of the module's own computed + worker block (backend, allowedRegistries, and the worker container's patch — + see worker_backend/worker_allowed_registries/worker_memory_limit/ + worker_service_account_name). Use this for anything not covered by those: + security, idleTTL (reap idle workers), the legacy defaults/rules/pins, or + additional patches (concatenated with, not replacing, the computed one). See + the nullplatform-agent chart values (>= 2.37.0) for the full shape. null = + nothing extra. Example: worker = { - allowedRegistries = ["public.ecr.aws/your-org/*"] - patches = [{ target = { package = "my-pkg" }, merge = { spec = { serviceAccountName = "np-agent-sa" } } }] - idleTTL = "30m" + patches = [{ target = { package = "my-pkg" }, merge = { spec = { serviceAccountName = "np-agent-sa" } } }] + idleTTL = "30m" } EOT type = any default = null } +variable "worker_backend" { + description = "Backend the worker orchestrator uses to run scope workers." + type = string + default = "kubernetes" +} + +variable "worker_allowed_registries" { + description = "Deny-by-default guardrail: container image registries workers may pull from. null leaves the chart's own default." + type = list(string) + default = null +} + +variable "worker_memory_limit" { + description = "Memory limit for the worker container (e.g. \"2Gi\"). null leaves the chart default." + type = string + default = null +} + +variable "worker_service_account_name" { + description = "ServiceAccount name for worker pods. Empty falls back to service_account_name, then the chart default." + type = string + default = "" +} + # Kubernetes namespace where the nullplatform agent will run variable "namespace" { description = "Kubernetes namespace where the nullplatform agent will run" From 290e203a4bbcab98e1be2208280b7036deac2c76 Mon Sep 17 00:00:00 2001 From: sebas_correa Date: Tue, 1 Sep 2026 14:38:48 -0300 Subject: [PATCH 55/81] fix(agent): drop worker_service_account_name, require real defaults MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The worker container has no service-account identity of its own — it always mirrors service_account_name, so a separate worker_service_account_name variable was dead weight (declared, never read once locals.tf derived it directly from service_account_name). Also: service_account_name and worker_memory_limit now default to concrete values ("nullplatform-agent" and "2Gi") instead of ""/null — both must always resolve to something real rather than silently omitting the field. Updates the affected tests to match. --- nullplatform/agent/locals.tf | 2 +- .../agent/tests/agent_values.tftest.hcl | 29 +++++++++++-------- nullplatform/agent/variables.tf | 24 ++++++--------- 3 files changed, 27 insertions(+), 28 deletions(-) diff --git a/nullplatform/agent/locals.tf b/nullplatform/agent/locals.tf index 2f4b3f007..925d60dd5 100644 --- a/nullplatform/agent/locals.tf +++ b/nullplatform/agent/locals.tf @@ -101,7 +101,7 @@ locals { BLUE_GREEN_INGRESS_PATH = var.blue_green_ingress_path } - worker_service_account_name = var.worker_service_account_name != "" ? var.worker_service_account_name : var.service_account_name + worker_service_account_name = var.service_account_name worker_container_patch = { target = { package = "containers" } diff --git a/nullplatform/agent/tests/agent_values.tftest.hcl b/nullplatform/agent/tests/agent_values.tftest.hcl index 3c08614df..8a3424218 100644 --- a/nullplatform/agent/tests/agent_values.tftest.hcl +++ b/nullplatform/agent/tests/agent_values.tftest.hcl @@ -165,23 +165,23 @@ run "worker_typed_overrides_are_applied" { command = plan variables { - worker_backend = "kubernetes" - worker_allowed_registries = ["public.ecr.aws/nullplatform/scopes*"] - worker_memory_limit = "2Gi" - worker_service_account_name = "nullplatform-agent" + worker_backend = "kubernetes" + worker_allowed_registries = ["public.ecr.aws/nullplatform/scopes*"] + worker_memory_limit = "3Gi" } assert { condition = ( strcontains(helm_release.agent.values[1], "public.ecr.aws/nullplatform/scopes*") && - strcontains(helm_release.agent.values[1], "\"memory\": \"2Gi\"") && - strcontains(helm_release.agent.values[1], "\"serviceAccountName\": \"nullplatform-agent\"") + strcontains(helm_release.agent.values[1], "\"memory\": \"3Gi\"") ) - error_message = "worker_allowed_registries/worker_memory_limit/worker_service_account_name must reach the worker patch" + error_message = "worker_allowed_registries/worker_memory_limit must reach the worker patch" } } -run "worker_service_account_falls_back_to_service_account_name" { +# The worker container has no service-account concept of its own — it always +# mirrors the agent's own service_account_name. +run "worker_service_account_mirrors_service_account_name" { command = plan variables { @@ -190,11 +190,11 @@ run "worker_service_account_falls_back_to_service_account_name" { assert { condition = strcontains(helm_release.agent.values[1], "\"serviceAccountName\": \"my-sa\"") - error_message = "worker's serviceAccountName should fall back to service_account_name when worker_service_account_name is unset" + error_message = "worker's serviceAccountName should mirror service_account_name" } } -run "worker_defaults_omit_unset_optional_fields" { +run "worker_defaults" { command = plan assert { @@ -203,8 +203,13 @@ run "worker_defaults_omit_unset_optional_fields" { } assert { - condition = !strcontains(helm_release.agent.values[1], "resources") - error_message = "resources.limits.memory must be omitted when worker_memory_limit is left at its null default" + condition = strcontains(helm_release.agent.values[1], "\"memory\": \"2Gi\"") + error_message = "worker_memory_limit must default to 2Gi, not be omitted" + } + + assert { + condition = strcontains(helm_release.agent.values[1], "\"serviceAccountName\": \"nullplatform-agent\"") + error_message = "the worker's serviceAccountName must default to service_account_name's default (nullplatform-agent)" } } diff --git a/nullplatform/agent/variables.tf b/nullplatform/agent/variables.tf index 3dfb22da5..881952c6d 100644 --- a/nullplatform/agent/variables.tf +++ b/nullplatform/agent/variables.tf @@ -53,7 +53,7 @@ variable "release_name" { variable "service_account_name" { description = "Override for the Kubernetes ServiceAccount name created by the Helm chart" type = string - default = "" + default = "nullplatform-agent" } # Version of the nullplatform agent Helm chart to deploy @@ -73,12 +73,12 @@ variable "worker" { description = <<-EOT Extra worker-orchestration config, merged on top of the module's own computed worker block (backend, allowedRegistries, and the worker container's patch — - see worker_backend/worker_allowed_registries/worker_memory_limit/ - worker_service_account_name). Use this for anything not covered by those: - security, idleTTL (reap idle workers), the legacy defaults/rules/pins, or - additional patches (concatenated with, not replacing, the computed one). See - the nullplatform-agent chart values (>= 2.37.0) for the full shape. null = - nothing extra. + see worker_backend/worker_allowed_registries/worker_memory_limit; the worker + container's serviceAccountName always mirrors service_account_name). Use this + for anything not covered by those: security, idleTTL (reap idle workers), the + legacy defaults/rules/pins, or additional patches (concatenated with, not + replacing, the computed one). See the nullplatform-agent chart values + (>= 2.37.0) for the full shape. null = nothing extra. Example: worker = { @@ -103,15 +103,9 @@ variable "worker_allowed_registries" { } variable "worker_memory_limit" { - description = "Memory limit for the worker container (e.g. \"2Gi\"). null leaves the chart default." + description = "Memory limit for the worker container (e.g. \"2Gi\")." type = string - default = null -} - -variable "worker_service_account_name" { - description = "ServiceAccount name for worker pods. Empty falls back to service_account_name, then the chart default." - type = string - default = "" + default = "2Gi" } # Kubernetes namespace where the nullplatform agent will run From 1d759de84a63c6a10b8cf900570397f20331c62f Mon Sep 17 00:00:00 2001 From: sebas_correa Date: Tue, 1 Sep 2026 14:55:57 -0300 Subject: [PATCH 56/81] refactor(agent): fold worker into the single agent values document worker was a second, independently-constructed Helm values layer (local.worker_values, yamlencode'd and appended to the helm_release's values list), built from four separate variables (worker_backend, worker_allowed_registries, worker_memory_limit, plus the already-removed worker_service_account_name). That's more machinery than needed: worker is already an existing variable of this module. worker now renders as just another top-level key inside the same templatefile-produced values document (the .tmpl.yaml renders it via yamlencode(worker) line by line, so nested content like patches still serializes correctly without hand-templating it). values goes back to a single-element list. Drops worker_backend/worker_allowed_registries/worker_memory_limit: backend and allowedRegistries are now just keys the caller can set inside var.worker itself (same as idleTTL already worked), with "kubernetes" as the module's own default when unset. The worker container's memory limit (2Gi) and serviceAccountName (mirrors service_account_name) are module defaults on the computed patch; a caller wanting a different memory limit adds their own patch targeting the same container via var.worker.patches, which concatenates with (not replaces) the computed one. Updates tests accordingly (single values[0], var.worker for overrides instead of the removed variables). --- nullplatform/agent/locals.tf | 63 ++++++++-------- nullplatform/agent/main.tf | 5 +- .../nullplatform_agent_values.tmpl.yaml | 5 ++ .../agent/tests/agent_values.tftest.hcl | 74 ++++++++++--------- nullplatform/agent/variables.tf | 40 ++++------ 5 files changed, 91 insertions(+), 96 deletions(-) diff --git a/nullplatform/agent/locals.tf b/nullplatform/agent/locals.tf index 925d60dd5..bf1f818f1 100644 --- a/nullplatform/agent/locals.tf +++ b/nullplatform/agent/locals.tf @@ -77,17 +77,6 @@ locals { var.extra_envs, ) - # Template único y simple - nullplatform_agent_values = templatefile("${path.module}/templates/nullplatform_agent_values.tmpl.yaml", { - args = local.all_args - config_values = local.all_config - image_tag = var.image_tag - image_repository = var.image_repository - aws_iam_role_arn = var.cloud_provider == "aws" ? var.aws_iam_role_arn : "" - init_scripts = var.init_scripts - service_account_name = var.service_account_name - }) - # Deploy-template/DNS values consumed by the worker when it renders a scope's # k8s deployment, not by the agent's own control loop. worker_env = { @@ -101,41 +90,51 @@ locals { BLUE_GREEN_INGRESS_PATH = var.blue_green_ingress_path } - worker_service_account_name = var.service_account_name - + # The worker container has no identity of its own — it always runs as the + # agent's own service account. worker_container_patch = { target = { package = "containers" } merge = { spec = merge( - local.worker_service_account_name != "" ? { serviceAccountName = local.worker_service_account_name } : {}, + var.service_account_name != "" ? { serviceAccountName = var.service_account_name } : {}, { containers = [ - merge( - { name = "worker" }, - var.worker_memory_limit != null ? { resources = { limits = { memory = var.worker_memory_limit } } } : {}, - { env = [for k, v in local.worker_env : { name = k, value = v }] } - ) + { + name = "worker" + resources = { limits = { memory = "2Gi" } } + env = [for k, v in local.worker_env : { name = k, value = v }] + } ] } ) } } - # Computed base merged with var.worker as an extra/override layer, so the - # escape hatch keeps working without dropping the computed worker-container - # patch (patches are concatenated, not replaced). - worker_base = merge( - { backend = var.worker_backend }, - var.worker_allowed_registries != null ? { allowedRegistries = var.worker_allowed_registries } : {}, - { patches = concat([local.worker_container_patch], try(var.worker.patches, [])) } - ) + # Sane module defaults, merged with var.worker as an extra/override layer — + # var.worker's own patches are concatenated (not replaced), so a caller who + # wants a different memory limit adds their own patch targeting the same + # container rather than the module inventing a dedicated override key for it. + worker_defaults = { + backend = "kubernetes" + patches = [local.worker_container_patch] + } worker_final = merge( - local.worker_base, - try({ for k, v in var.worker : k => v if k != "patches" }, {}) + local.worker_defaults, + try({ for k, v in var.worker : k => v if k != "patches" }, {}), + { patches = concat(local.worker_defaults.patches, try(var.worker.patches, [])) } ) - # Always emitted (unlike the agent's own values) so these env vars never - # silently disappear for callers who don't otherwise set var.worker. - worker_values = yamlencode({ worker = local.worker_final }) + # Single combined values document — worker is just another top-level key + # of the same agent chart values, not a second Helm values layer. + nullplatform_agent_values = templatefile("${path.module}/templates/nullplatform_agent_values.tmpl.yaml", { + args = local.all_args + config_values = local.all_config + image_tag = var.image_tag + image_repository = var.image_repository + aws_iam_role_arn = var.cloud_provider == "aws" ? var.aws_iam_role_arn : "" + init_scripts = var.init_scripts + service_account_name = var.service_account_name + worker = local.worker_final + }) } diff --git a/nullplatform/agent/main.tf b/nullplatform/agent/main.tf index fee3ae3ee..5a4d5ed25 100644 --- a/nullplatform/agent/main.tf +++ b/nullplatform/agent/main.tf @@ -65,10 +65,7 @@ resource "helm_release" "agent" { dependency_update = true max_history = 10 - values = [ - local.nullplatform_agent_values, - local.worker_values, - ] + values = [local.nullplatform_agent_values] lifecycle { replace_triggered_by = [terraform_data.api_key_trigger] diff --git a/nullplatform/agent/templates/nullplatform_agent_values.tmpl.yaml b/nullplatform/agent/templates/nullplatform_agent_values.tmpl.yaml index ef3711ab3..4785a44d7 100644 --- a/nullplatform/agent/templates/nullplatform_agent_values.tmpl.yaml +++ b/nullplatform/agent/templates/nullplatform_agent_values.tmpl.yaml @@ -35,3 +35,8 @@ initScripts: %{ endfor } %{ endif } +worker: + %{ for line in split("\n", yamlencode(worker)) } + ${line} + %{ endfor } + diff --git a/nullplatform/agent/tests/agent_values.tftest.hcl b/nullplatform/agent/tests/agent_values.tftest.hcl index 8a3424218..1ce25343b 100644 --- a/nullplatform/agent/tests/agent_values.tftest.hcl +++ b/nullplatform/agent/tests/agent_values.tftest.hcl @@ -108,7 +108,11 @@ run "agent_repos_scope_rejects_an_inline_fragment" { # DNS_TYPE/DOMAIN/USE_ACCOUNT_SLUG/SERVICE_TEMPLATE/INITIAL_INGRESS_PATH/ # BLUE_GREEN_INGRESS_PATH are consumed by the worker when it renders a scope's # k8s deployment, not by the agent's own control loop — they live on the -# worker's env only. CLUSTER_NAME/NAMESPACE are needed by both. +# worker's env only. CLUSTER_NAME/NAMESPACE are needed by both. There is a +# single combined values document now (worker is just another top-level key +# of it, not a second Helm values layer), so "not in the agent's own config" +# is checked via the configuration.values rendering (`KEY: "value"`, no +# leading quote on the key) rather than absence from the whole document. run "moved_deploy_vars_are_worker_only_cluster_and_namespace_are_shared" { command = plan @@ -122,18 +126,18 @@ run "moved_deploy_vars_are_worker_only_cluster_and_namespace_are_shared" { condition = alltrue([ for key in ["DNS_TYPE", "DOMAIN", "USE_ACCOUNT_SLUG", "SERVICE_TEMPLATE", "INITIAL_INGRESS_PATH", "BLUE_GREEN_INGRESS_PATH"] : - !strcontains(helm_release.agent.values[0], key) + !strcontains(helm_release.agent.values[0], "\n ${key}:") ]) - error_message = "deploy/DNS vars must not leak into the agent pod's own values" + error_message = "deploy/DNS vars must not leak into the agent pod's own configuration.values" } assert { - condition = strcontains(helm_release.agent.values[0], "CLUSTER_NAME") && strcontains(helm_release.agent.values[0], "NAMESPACE") - error_message = "CLUSTER_NAME and NAMESPACE must stay in the agent's own values" + condition = strcontains(helm_release.agent.values[0], "\n CLUSTER_NAME:") && strcontains(helm_release.agent.values[0], "\n NAMESPACE:") + error_message = "CLUSTER_NAME and NAMESPACE must stay in the agent's own configuration.values" } } -run "worker_layer_always_present_with_expected_env" { +run "worker_block_always_present_with_expected_env" { command = plan variables { @@ -143,39 +147,42 @@ run "worker_layer_always_present_with_expected_env" { } assert { - condition = strcontains(helm_release.agent.values[1], "\"backend\": \"kubernetes\"") - error_message = "worker layer must always be emitted, even without var.worker or any worker_* override" + condition = strcontains(helm_release.agent.values[0], "\"backend\": \"kubernetes\"") + error_message = "worker block must always be emitted, even without var.worker set" } assert { condition = ( - strcontains(helm_release.agent.values[1], "\"name\": \"DNS_TYPE\"") && - strcontains(helm_release.agent.values[1], "\"value\": \"external_dns\"") && - strcontains(helm_release.agent.values[1], "\"name\": \"DOMAIN\"") && - strcontains(helm_release.agent.values[1], "\"value\": \"playground.nullapps.io\"") && - strcontains(helm_release.agent.values[1], "\"name\": \"K8S_NAMESPACE\"") && - strcontains(helm_release.agent.values[1], "\"value\": \"nullplatform\"") && - strcontains(helm_release.agent.values[1], "\"name\": \"CLUSTER_NAME\"") + strcontains(helm_release.agent.values[0], "\"name\": \"DNS_TYPE\"") && + strcontains(helm_release.agent.values[0], "\"value\": \"external_dns\"") && + strcontains(helm_release.agent.values[0], "\"name\": \"DOMAIN\"") && + strcontains(helm_release.agent.values[0], "\"value\": \"playground.nullapps.io\"") && + strcontains(helm_release.agent.values[0], "\"name\": \"K8S_NAMESPACE\"") && + strcontains(helm_release.agent.values[0], "\"value\": \"nullplatform\"") && + strcontains(helm_release.agent.values[0], "\"name\": \"CLUSTER_NAME\"") ) error_message = "worker env must carry the deploy/DNS vars plus cluster/namespace" } } -run "worker_typed_overrides_are_applied" { +# backend/allowedRegistries have no dedicated variables — they're just keys +# on var.worker, same as idleTTL or any other chart field. +run "worker_backend_and_allowed_registries_are_overridable_via_var_worker" { command = plan variables { - worker_backend = "kubernetes" - worker_allowed_registries = ["public.ecr.aws/nullplatform/scopes*"] - worker_memory_limit = "3Gi" + worker = { + backend = "nomad" + allowedRegistries = ["public.ecr.aws/nullplatform/scopes*"] + } } assert { condition = ( - strcontains(helm_release.agent.values[1], "public.ecr.aws/nullplatform/scopes*") && - strcontains(helm_release.agent.values[1], "\"memory\": \"3Gi\"") + strcontains(helm_release.agent.values[0], "\"backend\": \"nomad\"") && + strcontains(helm_release.agent.values[0], "public.ecr.aws/nullplatform/scopes*") ) - error_message = "worker_allowed_registries/worker_memory_limit must reach the worker patch" + error_message = "var.worker.backend/allowedRegistries must override the module defaults" } } @@ -189,7 +196,7 @@ run "worker_service_account_mirrors_service_account_name" { } assert { - condition = strcontains(helm_release.agent.values[1], "\"serviceAccountName\": \"my-sa\"") + condition = strcontains(helm_release.agent.values[0], "\"serviceAccountName\": \"my-sa\"") error_message = "worker's serviceAccountName should mirror service_account_name" } } @@ -198,24 +205,25 @@ run "worker_defaults" { command = plan assert { - condition = !strcontains(helm_release.agent.values[1], "allowedRegistries") - error_message = "allowedRegistries must be omitted (not an empty list) when worker_allowed_registries is left at its null default" + condition = !strcontains(helm_release.agent.values[0], "allowedRegistries") + error_message = "allowedRegistries must be omitted (not an empty list) when var.worker doesn't set it" } assert { - condition = strcontains(helm_release.agent.values[1], "\"memory\": \"2Gi\"") - error_message = "worker_memory_limit must default to 2Gi, not be omitted" + condition = strcontains(helm_release.agent.values[0], "\"memory\": \"2Gi\"") + error_message = "the worker container's memory limit must default to 2Gi" } assert { - condition = strcontains(helm_release.agent.values[1], "\"serviceAccountName\": \"nullplatform-agent\"") + condition = strcontains(helm_release.agent.values[0], "\"serviceAccountName\": \"nullplatform-agent\"") error_message = "the worker's serviceAccountName must default to service_account_name's default (nullplatform-agent)" } } # var.worker stays available as an extra/override layer on top of the computed -# base: its own patches are concatenated (not dropped), and its other top-level -# keys (e.g. idleTTL) pass through. +# defaults: its own patches are concatenated (not dropped, so a caller wanting +# a different memory limit adds their own patch rather than replacing ours), +# and its other top-level keys (e.g. idleTTL) pass through. run "worker_extra_patches_and_overrides_are_merged_not_replaced" { command = plan @@ -230,9 +238,9 @@ run "worker_extra_patches_and_overrides_are_merged_not_replaced" { assert { condition = ( - strcontains(helm_release.agent.values[1], "\"idleTTL\": \"30m\"") && - strcontains(helm_release.agent.values[1], "\"package\": \"my-pkg\"") && - strcontains(helm_release.agent.values[1], "\"name\": \"worker\"") + strcontains(helm_release.agent.values[0], "\"idleTTL\": \"30m\"") && + strcontains(helm_release.agent.values[0], "\"package\": \"my-pkg\"") && + strcontains(helm_release.agent.values[0], "\"name\": \"worker\"") ) error_message = "var.worker's own patches/keys must be merged alongside the computed worker-container patch, not replace it" } diff --git a/nullplatform/agent/variables.tf b/nullplatform/agent/variables.tf index 881952c6d..2a91f86ae 100644 --- a/nullplatform/agent/variables.tf +++ b/nullplatform/agent/variables.tf @@ -72,42 +72,28 @@ variable "nullplatform_agent_helm_version" { variable "worker" { description = <<-EOT Extra worker-orchestration config, merged on top of the module's own computed - worker block (backend, allowedRegistries, and the worker container's patch — - see worker_backend/worker_allowed_registries/worker_memory_limit; the worker - container's serviceAccountName always mirrors service_account_name). Use this - for anything not covered by those: security, idleTTL (reap idle workers), the - legacy defaults/rules/pins, or additional patches (concatenated with, not - replacing, the computed one). See the nullplatform-agent chart values - (>= 2.37.0) for the full shape. null = nothing extra. + worker block: backend ("kubernetes" by default) and a patch for the worker + container (2Gi memory limit, the deploy/DNS env vars below, and a + serviceAccountName that always mirrors service_account_name). Set backend or + allowedRegistries here to override the module default; add your own entries + to patches to layer more on top of the computed one (concatenated, not + replaced — e.g. a different memory limit via your own patch targeting the + same "worker" container). Anything else — security, idleTTL (reap idle + workers), the legacy defaults/rules/pins — passes through as-is. See the + nullplatform-agent chart values (>= 2.37.0) for the full shape. null = + nothing extra. Example: worker = { - patches = [{ target = { package = "my-pkg" }, merge = { spec = { serviceAccountName = "np-agent-sa" } } }] - idleTTL = "30m" + allowedRegistries = ["public.ecr.aws/your-org/*"] + patches = [{ target = { package = "my-pkg" }, merge = { spec = { serviceAccountName = "np-agent-sa" } } }] + idleTTL = "30m" } EOT type = any default = null } -variable "worker_backend" { - description = "Backend the worker orchestrator uses to run scope workers." - type = string - default = "kubernetes" -} - -variable "worker_allowed_registries" { - description = "Deny-by-default guardrail: container image registries workers may pull from. null leaves the chart's own default." - type = list(string) - default = null -} - -variable "worker_memory_limit" { - description = "Memory limit for the worker container (e.g. \"2Gi\")." - type = string - default = "2Gi" -} - # Kubernetes namespace where the nullplatform agent will run variable "namespace" { description = "Kubernetes namespace where the nullplatform agent will run" From a371be67c4094fe80e01edc8e1855d4090cd3fa5 Mon Sep 17 00:00:00 2001 From: sebas_correa Date: Tue, 1 Sep 2026 15:18:52 -0300 Subject: [PATCH 57/81] fix(agent): drop unused cluster_name variable MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit cluster_name had no real consumer left in the module — it was only read into the agent pod's own configuration.values (CLUSTER_NAME), which the running chart doesn't actually use (verified against a live deployment: the pod's declared env vars are NP_WORKER_*/AWS IRSA vars only, no CLUSTER_NAME/NAMESPACE). NAMESPACE is dropped from the agent's own configuration.values for the same reason; it stays on the worker's env as K8S_NAMESPACE, which the worker orchestrator does read. BREAKING CHANGE: cluster_name is no longer an accepted input. Callers passing it will get "An argument named cluster_name is not expected here" and must remove it. --- nullplatform/agent/locals.tf | 3 -- nullplatform/agent/tests/agent.tftest.hcl | 1 - .../agent/tests/agent_values.tftest.hcl | 31 +++++++------------ nullplatform/agent/variables.tf | 6 ---- 4 files changed, 12 insertions(+), 29 deletions(-) diff --git a/nullplatform/agent/locals.tf b/nullplatform/agent/locals.tf index bf1f818f1..9f0ec460d 100644 --- a/nullplatform/agent/locals.tf +++ b/nullplatform/agent/locals.tf @@ -45,8 +45,6 @@ locals { NP_API_KEY = local.api_key TAGS = local.tags AGENT_REPOS = local.agent_repos - CLUSTER_NAME = var.cluster_name - NAMESPACE = var.namespace IMAGE_TAG = var.image_tag TRAFFIC_CONTAINER_IMAGE = "${var.agent_traffic_manager_repository}:${var.agent_traffic_manager_tag}" IMAGE_PULL_SECRETS = var.image_pull_secrets @@ -84,7 +82,6 @@ locals { DOMAIN = var.domain USE_ACCOUNT_SLUG = var.use_account_slug K8S_NAMESPACE = var.namespace - CLUSTER_NAME = var.cluster_name SERVICE_TEMPLATE = var.service_template INITIAL_INGRESS_PATH = var.initial_ingress_path BLUE_GREEN_INGRESS_PATH = var.blue_green_ingress_path diff --git a/nullplatform/agent/tests/agent.tftest.hcl b/nullplatform/agent/tests/agent.tftest.hcl index 9bd044919..2f27d0832 100644 --- a/nullplatform/agent/tests/agent.tftest.hcl +++ b/nullplatform/agent/tests/agent.tftest.hcl @@ -3,7 +3,6 @@ mock_provider "helm" {} variables { api_key = "test-api-key" - cluster_name = "test-cluster" tags_selectors = { environment = "test" } image_tag = "latest" cloud_provider = "gcp" diff --git a/nullplatform/agent/tests/agent_values.tftest.hcl b/nullplatform/agent/tests/agent_values.tftest.hcl index 1ce25343b..46a515384 100644 --- a/nullplatform/agent/tests/agent_values.tftest.hcl +++ b/nullplatform/agent/tests/agent_values.tftest.hcl @@ -3,7 +3,6 @@ mock_provider "nullplatform" {} variables { api_key = "test-api-key" - cluster_name = "my-cluster" tags_selectors = { dimension = "prod" } cloud_provider = "aws" aws_iam_role_arn = "arn:aws:iam::123456789012:role/agent" @@ -106,14 +105,14 @@ run "agent_repos_scope_rejects_an_inline_fragment" { ################################################################################ # DNS_TYPE/DOMAIN/USE_ACCOUNT_SLUG/SERVICE_TEMPLATE/INITIAL_INGRESS_PATH/ -# BLUE_GREEN_INGRESS_PATH are consumed by the worker when it renders a scope's -# k8s deployment, not by the agent's own control loop — they live on the -# worker's env only. CLUSTER_NAME/NAMESPACE are needed by both. There is a -# single combined values document now (worker is just another top-level key -# of it, not a second Helm values layer), so "not in the agent's own config" -# is checked via the configuration.values rendering (`KEY: "value"`, no -# leading quote on the key) rather than absence from the whole document. -run "moved_deploy_vars_are_worker_only_cluster_and_namespace_are_shared" { +# BLUE_GREEN_INGRESS_PATH/NAMESPACE are consumed by the worker when it renders +# a scope's k8s deployment, not by the agent's own control loop — they live on +# the worker's env only (NAMESPACE as K8S_NAMESPACE). There is a single +# combined values document now (worker is just another top-level key of it, +# not a second Helm values layer), so "not in the agent's own config" is +# checked via the configuration.values rendering (`KEY: "value"`, no leading +# quote on the key) rather than absence from the whole document. +run "moved_deploy_vars_are_worker_only" { command = plan variables { @@ -125,15 +124,10 @@ run "moved_deploy_vars_are_worker_only_cluster_and_namespace_are_shared" { assert { condition = alltrue([ for key in ["DNS_TYPE", "DOMAIN", "USE_ACCOUNT_SLUG", "SERVICE_TEMPLATE", - "INITIAL_INGRESS_PATH", "BLUE_GREEN_INGRESS_PATH"] : + "INITIAL_INGRESS_PATH", "BLUE_GREEN_INGRESS_PATH", "NAMESPACE"] : !strcontains(helm_release.agent.values[0], "\n ${key}:") ]) - error_message = "deploy/DNS vars must not leak into the agent pod's own configuration.values" - } - - assert { - condition = strcontains(helm_release.agent.values[0], "\n CLUSTER_NAME:") && strcontains(helm_release.agent.values[0], "\n NAMESPACE:") - error_message = "CLUSTER_NAME and NAMESPACE must stay in the agent's own configuration.values" + error_message = "deploy/DNS vars and NAMESPACE must not leak into the agent pod's own configuration.values" } } @@ -158,10 +152,9 @@ run "worker_block_always_present_with_expected_env" { strcontains(helm_release.agent.values[0], "\"name\": \"DOMAIN\"") && strcontains(helm_release.agent.values[0], "\"value\": \"playground.nullapps.io\"") && strcontains(helm_release.agent.values[0], "\"name\": \"K8S_NAMESPACE\"") && - strcontains(helm_release.agent.values[0], "\"value\": \"nullplatform\"") && - strcontains(helm_release.agent.values[0], "\"name\": \"CLUSTER_NAME\"") + strcontains(helm_release.agent.values[0], "\"value\": \"nullplatform\"") ) - error_message = "worker env must carry the deploy/DNS vars plus cluster/namespace" + error_message = "worker env must carry the deploy/DNS vars plus namespace" } } diff --git a/nullplatform/agent/variables.tf b/nullplatform/agent/variables.tf index 2a91f86ae..fe88a3b57 100644 --- a/nullplatform/agent/variables.tf +++ b/nullplatform/agent/variables.tf @@ -9,12 +9,6 @@ variable "api_key" { sensitive = true } -# Name of the Kubernetes cluster where the nullplatform agent will be deployed -variable "cluster_name" { - description = "Name of the Kubernetes cluster where the nullplatform agent will be deployed" - type = string -} - # Image tag for the agent container image variable "image_tag" { # example: 0.9.2 From 511f364c57e8ebf26cccc0882f4b0458ef6fe89b Mon Sep 17 00:00:00 2001 From: sebas_correa Date: Tue, 1 Sep 2026 15:31:05 -0300 Subject: [PATCH 58/81] fix(agent): default worker allowedRegistries to the nullplatform ECR org MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Without any allowedRegistries, the worker orchestrator denies every dynamic package-exec (verified against a live deployment: "no worker registries allowed and no pins ... every dynamic package-exec will be refused"). Defaults allowedRegistries to ["public.ecr.aws/nullplatform/*"] so the platform's own scope images keep pulling out of the box. allowedRegistries set via var.worker is now concatenated with (not replacing) that default, same as patches already worked — an implementation adds its own registries instead of having to repeat the default to avoid breaking the platform images. --- nullplatform/agent/locals.tf | 22 +++++++++++------- .../agent/tests/agent_values.tftest.hcl | 23 ++++++++++++++----- nullplatform/agent/variables.tf | 23 ++++++++++--------- 3 files changed, 43 insertions(+), 25 deletions(-) diff --git a/nullplatform/agent/locals.tf b/nullplatform/agent/locals.tf index 9f0ec460d..0d10876b5 100644 --- a/nullplatform/agent/locals.tf +++ b/nullplatform/agent/locals.tf @@ -107,19 +107,25 @@ locals { } } - # Sane module defaults, merged with var.worker as an extra/override layer — - # var.worker's own patches are concatenated (not replaced), so a caller who - # wants a different memory limit adds their own patch targeting the same - # container rather than the module inventing a dedicated override key for it. + # Sane module defaults, merged with var.worker as an extra/override layer. + # patches and allowedRegistries are concatenated (not replaced) with + # var.worker's own entries: a caller wanting a different memory limit adds + # their own patch targeting the same container rather than the module + # inventing a dedicated override key for it, and a caller needing extra + # registries adds to the default instead of having to repeat it. worker_defaults = { - backend = "kubernetes" - patches = [local.worker_container_patch] + backend = "kubernetes" + allowedRegistries = ["public.ecr.aws/nullplatform/*"] + patches = [local.worker_container_patch] } worker_final = merge( local.worker_defaults, - try({ for k, v in var.worker : k => v if k != "patches" }, {}), - { patches = concat(local.worker_defaults.patches, try(var.worker.patches, [])) } + try({ for k, v in var.worker : k => v if !contains(["patches", "allowedRegistries"], k) }, {}), + { + patches = concat(local.worker_defaults.patches, try(var.worker.patches, [])) + allowedRegistries = distinct(concat(local.worker_defaults.allowedRegistries, try(var.worker.allowedRegistries, []))) + } ) # Single combined values document — worker is just another top-level key diff --git a/nullplatform/agent/tests/agent_values.tftest.hcl b/nullplatform/agent/tests/agent_values.tftest.hcl index 46a515384..e3f2d6877 100644 --- a/nullplatform/agent/tests/agent_values.tftest.hcl +++ b/nullplatform/agent/tests/agent_values.tftest.hcl @@ -160,22 +160,33 @@ run "worker_block_always_present_with_expected_env" { # backend/allowedRegistries have no dedicated variables — they're just keys # on var.worker, same as idleTTL or any other chart field. -run "worker_backend_and_allowed_registries_are_overridable_via_var_worker" { +# backend is a plain override (var.worker's value wins outright); allowedRegistries +# is additive like patches — var.worker's entries join the default rather than +# replacing it, so the platform's own scope images keep pulling. +run "worker_backend_overrides_allowed_registries_extends" { command = plan variables { worker = { backend = "nomad" - allowedRegistries = ["public.ecr.aws/nullplatform/scopes*"] + allowedRegistries = ["123456789012.dkr.ecr.us-east-1.amazonaws.com/my-org/*"] } } assert { condition = ( strcontains(helm_release.agent.values[0], "\"backend\": \"nomad\"") && - strcontains(helm_release.agent.values[0], "public.ecr.aws/nullplatform/scopes*") + !strcontains(helm_release.agent.values[0], "\"backend\": \"kubernetes\"") ) - error_message = "var.worker.backend/allowedRegistries must override the module defaults" + error_message = "var.worker.backend must override the module default outright" + } + + assert { + condition = ( + strcontains(helm_release.agent.values[0], "public.ecr.aws/nullplatform/*") && + strcontains(helm_release.agent.values[0], "123456789012.dkr.ecr.us-east-1.amazonaws.com/my-org/*") + ) + error_message = "var.worker.allowedRegistries must extend the default registry list, not replace it" } } @@ -198,8 +209,8 @@ run "worker_defaults" { command = plan assert { - condition = !strcontains(helm_release.agent.values[0], "allowedRegistries") - error_message = "allowedRegistries must be omitted (not an empty list) when var.worker doesn't set it" + condition = strcontains(helm_release.agent.values[0], "public.ecr.aws/nullplatform/*") + error_message = "allowedRegistries must default to public.ecr.aws/nullplatform/* so the platform's own scope images keep pulling" } assert { diff --git a/nullplatform/agent/variables.tf b/nullplatform/agent/variables.tf index fe88a3b57..72dadebf2 100644 --- a/nullplatform/agent/variables.tf +++ b/nullplatform/agent/variables.tf @@ -66,20 +66,21 @@ variable "nullplatform_agent_helm_version" { variable "worker" { description = <<-EOT Extra worker-orchestration config, merged on top of the module's own computed - worker block: backend ("kubernetes" by default) and a patch for the worker - container (2Gi memory limit, the deploy/DNS env vars below, and a - serviceAccountName that always mirrors service_account_name). Set backend or - allowedRegistries here to override the module default; add your own entries - to patches to layer more on top of the computed one (concatenated, not - replaced — e.g. a different memory limit via your own patch targeting the - same "worker" container). Anything else — security, idleTTL (reap idle - workers), the legacy defaults/rules/pins — passes through as-is. See the - nullplatform-agent chart values (>= 2.37.0) for the full shape. null = - nothing extra. + worker block: backend ("kubernetes" by default), allowedRegistries + (["public.ecr.aws/nullplatform/*"] by default, so the platform's own scope + images keep working), and a patch for the worker container (2Gi memory + limit, the deploy/DNS env vars below, and a serviceAccountName that always + mirrors service_account_name). allowedRegistries and patches set here are + concatenated with (not replacing) the module defaults — add your own + registries or an extra patch rather than having to repeat the defaults; + set backend here to override it outright. Anything else — security, idleTTL + (reap idle workers), the legacy defaults/rules/pins — passes through as-is. + See the nullplatform-agent chart values (>= 2.37.0) for the full shape. + null = nothing extra. Example: worker = { - allowedRegistries = ["public.ecr.aws/your-org/*"] + allowedRegistries = ["123456789012.dkr.ecr.us-east-1.amazonaws.com/your-org/*"] patches = [{ target = { package = "my-pkg" }, merge = { spec = { serviceAccountName = "np-agent-sa" } } }] idleTTL = "30m" } From 98d4c9c9962ddbd5fd44f8de101d894b619bb833 Mon Sep 17 00:00:00 2001 From: sebas_correa Date: Tue, 1 Sep 2026 16:08:51 -0300 Subject: [PATCH 59/81] feat(scope_definition): default the oci_image package artifact to the platform's worker image MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit package.artifacts[].name now defaults to "worker-image", and meta.registry/meta.repository default to "public.ecr.aws" and "nullplatform/scopes/containers" for oci_image artifacts (the default artifact type) when the caller's meta omits them. Only meta.digest needs setting on every release; explicit values still win, and the default never applies to non-oci_image artifacts (git_repository, blob, oras_artifact have an unrelated meta shape). slug intentionally keeps no type-level default — it already falls back to the derived service specification slug via coalesce(var.package.slug, local.service_slug) in package.tf, which a hardcoded default would have silently broken for every scope type other than "containers". Verified the merge/for-expression logic in isolation (the module has no test suite and its full resource graph needs live HTTP template fetches, so a real `tofu test` wasn't practical here): defaults apply correctly, explicit overrides win, and non-oci_image artifacts are untouched. --- nullplatform/scope_definition/package.tf | 16 ++++++++++++++-- nullplatform/scope_definition/variables.tf | 9 ++++++++- 2 files changed, 22 insertions(+), 3 deletions(-) diff --git a/nullplatform/scope_definition/package.tf b/nullplatform/scope_definition/package.tf index c8509255f..46623ebbe 100644 --- a/nullplatform/scope_definition/package.tf +++ b/nullplatform/scope_definition/package.tf @@ -14,16 +14,28 @@ locals { package_enabled = var.package != null + # oci_image is the only artifact type where "registry"/"repository" mean + # anything — other types (git_repository, blob, oras_artifact) have an + # unrelated meta shape, so this default never applies to them. + package_oci_meta_defaults = { + registry = "public.ecr.aws" + repository = "nullplatform/scopes/containers" + } + # Artifacts split by intent: # create — `meta` given, lookup=false: register a new revision here # lookup — `meta` given, lookup=true: resolve an existing artifact by identity # pinned — explicit resource ids, taken as-is package_artifacts_to_create = local.package_enabled ? { - for a in var.package.artifacts : a.name => a if a.meta != null && !a.lookup + for a in var.package.artifacts : a.name => merge(a, { + meta = a.type == "oci_image" ? merge(local.package_oci_meta_defaults, a.meta) : a.meta + }) if a.meta != null && !a.lookup } : {} package_artifacts_to_lookup = local.package_enabled ? { - for a in var.package.artifacts : a.name => a if a.meta != null && a.lookup + for a in var.package.artifacts : a.name => merge(a, { + meta = a.type == "oci_image" ? merge(local.package_oci_meta_defaults, a.meta) : a.meta + }) if a.meta != null && a.lookup } : {} package_artifacts_existing = local.package_enabled ? { diff --git a/nullplatform/scope_definition/variables.tf b/nullplatform/scope_definition/variables.tf index bf166c861..cbb9da354 100644 --- a/nullplatform/scope_definition/variables.tf +++ b/nullplatform/scope_definition/variables.tf @@ -193,6 +193,13 @@ variable "package" { the latest revision is used); • pin explicit ids — set `resource_id` + `resource_revision_id`. + For an "oci_image" artifact (the default type), `name` defaults to + "worker-image" and meta.registry/meta.repository default to + "public.ecr.aws"/"nullplatform/scopes/containers" — the platform's own + container-scope worker image — when omitted from `meta`. Only meta.digest + needs setting on every release; every other artifact type gets no meta + defaults (their meta shape is unrelated to a container registry). + Null (the default) keeps the classic module behavior — no package. EOT type = object({ @@ -203,7 +210,7 @@ variable "package" { tags = optional(map(string), {}) # release tags: name => version (requires an API with the package release-tag routes) visible_to = optional(list(string)) # default: [var.nrn] artifacts = optional(list(object({ - name = string + name = optional(string, "worker-image") type = optional(string, "oci_image") # oci_image | oras_artifact | git_repository | blob meta = optional(any) # register (lookup=false) or find (lookup=true) lookup = optional(bool, false) # true: resolve an EXISTING artifact by meta identity From 71eeff78f77c240bf50a246e4d339fb3b77bdbcd Mon Sep 17 00:00:00 2001 From: sebas_correa Date: Tue, 1 Sep 2026 17:20:18 -0300 Subject: [PATCH 60/81] feat(agent): add TRAFFIC_CONTAINER_IMAGE to the worker's env The worker executes traffic-management actions (blue-green switches, etc.) that need to know the traffic-manager image, same as the agent already does via its own configuration.values. Mirrors the existing assembly (repository:tag from agent_traffic_manager_repository/_tag). --- nullplatform/agent/locals.tf | 1 + nullplatform/agent/tests/agent_values.tftest.hcl | 6 ++++-- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/nullplatform/agent/locals.tf b/nullplatform/agent/locals.tf index 0d10876b5..993fdab20 100644 --- a/nullplatform/agent/locals.tf +++ b/nullplatform/agent/locals.tf @@ -85,6 +85,7 @@ locals { SERVICE_TEMPLATE = var.service_template INITIAL_INGRESS_PATH = var.initial_ingress_path BLUE_GREEN_INGRESS_PATH = var.blue_green_ingress_path + TRAFFIC_CONTAINER_IMAGE = "${var.agent_traffic_manager_repository}:${var.agent_traffic_manager_tag}" } # The worker container has no identity of its own — it always runs as the diff --git a/nullplatform/agent/tests/agent_values.tftest.hcl b/nullplatform/agent/tests/agent_values.tftest.hcl index e3f2d6877..8f0796aa4 100644 --- a/nullplatform/agent/tests/agent_values.tftest.hcl +++ b/nullplatform/agent/tests/agent_values.tftest.hcl @@ -152,9 +152,11 @@ run "worker_block_always_present_with_expected_env" { strcontains(helm_release.agent.values[0], "\"name\": \"DOMAIN\"") && strcontains(helm_release.agent.values[0], "\"value\": \"playground.nullapps.io\"") && strcontains(helm_release.agent.values[0], "\"name\": \"K8S_NAMESPACE\"") && - strcontains(helm_release.agent.values[0], "\"value\": \"nullplatform\"") + strcontains(helm_release.agent.values[0], "\"value\": \"nullplatform\"") && + strcontains(helm_release.agent.values[0], "\"name\": \"TRAFFIC_CONTAINER_IMAGE\"") && + strcontains(helm_release.agent.values[0], "\"value\": \"public.ecr.aws/nullplatform/k8s-traffic-manager:1.8.0\"") ) - error_message = "worker env must carry the deploy/DNS vars plus namespace" + error_message = "worker env must carry the deploy/DNS vars plus namespace and the traffic-manager image" } } From 89f4aad91e6a4f64358b4a33f19c2803929e9e1a Mon Sep 17 00:00:00 2001 From: sebas_correa Date: Tue, 1 Sep 2026 17:47:50 -0300 Subject: [PATCH 61/81] fix(agent): give worker_env the same cloud_config/extra_envs layering as all_config worker_env only carried its own hardcoded defaults, unlike the agent's own all_config (default_config -> cloud_config -> extra_envs). A caller overriding something via extra_envs (e.g. TRAFFIC_CONTAINER_IMAGE pinned to a digest) had that reach the agent but not the worker, where deployment actions actually execute. Renames the raw defaults to worker_default_config and rebuilds worker_env as the same three-layer merge all_config already does, extra_envs last so it still wins. --- nullplatform/agent/locals.tf | 11 ++++++++++- .../agent/tests/agent_values.tftest.hcl | 18 ++++++++++++++++++ 2 files changed, 28 insertions(+), 1 deletion(-) diff --git a/nullplatform/agent/locals.tf b/nullplatform/agent/locals.tf index 993fdab20..847fa8064 100644 --- a/nullplatform/agent/locals.tf +++ b/nullplatform/agent/locals.tf @@ -77,7 +77,7 @@ locals { # Deploy-template/DNS values consumed by the worker when it renders a scope's # k8s deployment, not by the agent's own control loop. - worker_env = { + worker_default_config = { DNS_TYPE = var.dns_type DOMAIN = var.domain USE_ACCOUNT_SLUG = var.use_account_slug @@ -88,6 +88,15 @@ locals { TRAFFIC_CONTAINER_IMAGE = "${var.agent_traffic_manager_repository}:${var.agent_traffic_manager_tag}" } + # Same layering as all_config: cloud-specific values, then extra_envs last + # so a caller can override or add to what the worker sees, same as they + # already can for the agent's own config. + worker_env = merge( + local.worker_default_config, + lookup(local.cloud_config, var.cloud_provider, {}), + var.extra_envs, + ) + # The worker container has no identity of its own — it always runs as the # agent's own service account. worker_container_patch = { diff --git a/nullplatform/agent/tests/agent_values.tftest.hcl b/nullplatform/agent/tests/agent_values.tftest.hcl index 8f0796aa4..71968f333 100644 --- a/nullplatform/agent/tests/agent_values.tftest.hcl +++ b/nullplatform/agent/tests/agent_values.tftest.hcl @@ -57,6 +57,24 @@ run "extra_envs_still_overrides_the_traffic_manager_image" { } } +# worker_env goes through the same default -> cloud_config -> extra_envs +# layering as the agent's own all_config, so an extra_envs override reaches +# the worker too, not just the agent. +run "extra_envs_also_reaches_the_worker" { + command = plan + + variables { + extra_envs = { + TRAFFIC_CONTAINER_IMAGE = "public.ecr.aws/nullplatform/k8s-traffic-manager@sha256:abc123" + } + } + + assert { + condition = strcontains(helm_release.agent.values[0], "\"name\": \"TRAFFIC_CONTAINER_IMAGE\"") && strcontains(helm_release.agent.values[0], "\"value\": \"public.ecr.aws/nullplatform/k8s-traffic-manager@sha256:abc123\"") + error_message = "extra_envs overrides must also reach the worker's env" + } +} + ################################################################################ # Scope repository ################################################################################ From 23cffc14052d53ce2ef45eabf68f1a6f4e76712f Mon Sep 17 00:00:00 2001 From: sebas_correa Date: Tue, 1 Sep 2026 17:51:09 -0300 Subject: [PATCH 62/81] refactor(agent): dedupe the traffic-manager image expression TRAFFIC_CONTAINER_IMAGE's assembly was duplicated verbatim in default_config and worker_default_config. Extracted to local.traffic_container_image, referenced by both. --- nullplatform/agent/locals.tf | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/nullplatform/agent/locals.tf b/nullplatform/agent/locals.tf index 847fa8064..0164d731c 100644 --- a/nullplatform/agent/locals.tf +++ b/nullplatform/agent/locals.tf @@ -41,12 +41,16 @@ locals { all_args = concat(local.default_args, lookup(local.cloud_args, var.cloud_provider, [])) + # Consumed by both the agent's own config and the worker's — the worker + # needs it for traffic-management actions (blue-green switches, etc.). + traffic_container_image = "${var.agent_traffic_manager_repository}:${var.agent_traffic_manager_tag}" + default_config = { NP_API_KEY = local.api_key TAGS = local.tags AGENT_REPOS = local.agent_repos IMAGE_TAG = var.image_tag - TRAFFIC_CONTAINER_IMAGE = "${var.agent_traffic_manager_repository}:${var.agent_traffic_manager_tag}" + TRAFFIC_CONTAINER_IMAGE = local.traffic_container_image IMAGE_PULL_SECRETS = var.image_pull_secrets PRIVATE_GATEWAY_NAME = var.private_gateway_name PUBLIC_GATEWAY_NAME = var.public_gateway_name @@ -85,7 +89,7 @@ locals { SERVICE_TEMPLATE = var.service_template INITIAL_INGRESS_PATH = var.initial_ingress_path BLUE_GREEN_INGRESS_PATH = var.blue_green_ingress_path - TRAFFIC_CONTAINER_IMAGE = "${var.agent_traffic_manager_repository}:${var.agent_traffic_manager_tag}" + TRAFFIC_CONTAINER_IMAGE = local.traffic_container_image } # Same layering as all_config: cloud-specific values, then extra_envs last From fc4bfc33a6ef43a2d47fcdcb416607f3fbef04b9 Mon Sep 17 00:00:00 2001 From: sebas_correa Date: Tue, 1 Sep 2026 17:58:57 -0300 Subject: [PATCH 63/81] fix(agent): give the agent the deploy/DNS vars too, share one config map MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fixes a regression from the previous commit: worker_env had been rebuilt as merge(default_config, cloud_config, extra_envs), but default_config never carried DNS_TYPE/DOMAIN/USE_ACCOUNT_SLUG/ K8S_NAMESPACE/SERVICE_TEMPLATE/INITIAL_INGRESS_PATH/BLUE_GREEN_INGRESS_PATH (they lived only in the now-removed worker_default_config) — so the worker silently lost the very env vars the Istio template-path fix depends on. Resolution: fold those 7 keys into default_config so the agent and the worker share one config map (all_config), instead of keeping two maps in sync. worker_container_patch now reads env from local.all_config directly; the separate worker_env/worker_default_config locals are gone. NAMESPACE is renamed to K8S_NAMESPACE (verified against a live worker pod's actual env) since there's now only one map — this is what the worker reads and nothing else in the agent's own args/config depended on the literal key "NAMESPACE". Updates the tests that encoded the old separation. --- nullplatform/agent/locals.tf | 38 ++++++++----------- .../agent/tests/agent_values.tftest.hcl | 24 +++++------- 2 files changed, 25 insertions(+), 37 deletions(-) diff --git a/nullplatform/agent/locals.tf b/nullplatform/agent/locals.tf index 0164d731c..1ed284fe4 100644 --- a/nullplatform/agent/locals.tf +++ b/nullplatform/agent/locals.tf @@ -54,6 +54,15 @@ locals { IMAGE_PULL_SECRETS = var.image_pull_secrets PRIVATE_GATEWAY_NAME = var.private_gateway_name PUBLIC_GATEWAY_NAME = var.public_gateway_name + # Deploy-template/DNS values — read by the worker when it renders a + # scope's k8s deployment, and also exposed to the agent's own config. + DNS_TYPE = var.dns_type + DOMAIN = var.domain + USE_ACCOUNT_SLUG = var.use_account_slug + K8S_NAMESPACE = var.namespace + SERVICE_TEMPLATE = var.service_template + INITIAL_INGRESS_PATH = var.initial_ingress_path + BLUE_GREEN_INGRESS_PATH = var.blue_green_ingress_path } cloud_config = { @@ -73,34 +82,17 @@ locals { oci = {} } + # Single shared env: the agent's own configuration.values AND the worker's + # env are now the same map — the worker needs DNS_TYPE/DOMAIN/USE_ACCOUNT_SLUG/ + # K8S_NAMESPACE/SERVICE_TEMPLATE/INITIAL_INGRESS_PATH/BLUE_GREEN_INGRESS_PATH + # (deploy-template rendering) and the agent needs the rest; simpler to give + # both everything than to keep two maps in sync. all_config = merge( local.default_config, lookup(local.cloud_config, var.cloud_provider, {}), var.extra_envs, ) - # Deploy-template/DNS values consumed by the worker when it renders a scope's - # k8s deployment, not by the agent's own control loop. - worker_default_config = { - DNS_TYPE = var.dns_type - DOMAIN = var.domain - USE_ACCOUNT_SLUG = var.use_account_slug - K8S_NAMESPACE = var.namespace - SERVICE_TEMPLATE = var.service_template - INITIAL_INGRESS_PATH = var.initial_ingress_path - BLUE_GREEN_INGRESS_PATH = var.blue_green_ingress_path - TRAFFIC_CONTAINER_IMAGE = local.traffic_container_image - } - - # Same layering as all_config: cloud-specific values, then extra_envs last - # so a caller can override or add to what the worker sees, same as they - # already can for the agent's own config. - worker_env = merge( - local.worker_default_config, - lookup(local.cloud_config, var.cloud_provider, {}), - var.extra_envs, - ) - # The worker container has no identity of its own — it always runs as the # agent's own service account. worker_container_patch = { @@ -113,7 +105,7 @@ locals { { name = "worker" resources = { limits = { memory = "2Gi" } } - env = [for k, v in local.worker_env : { name = k, value = v }] + env = [for k, v in local.all_config : { name = k, value = v }] } ] } diff --git a/nullplatform/agent/tests/agent_values.tftest.hcl b/nullplatform/agent/tests/agent_values.tftest.hcl index 71968f333..b4915a766 100644 --- a/nullplatform/agent/tests/agent_values.tftest.hcl +++ b/nullplatform/agent/tests/agent_values.tftest.hcl @@ -57,9 +57,8 @@ run "extra_envs_still_overrides_the_traffic_manager_image" { } } -# worker_env goes through the same default -> cloud_config -> extra_envs -# layering as the agent's own all_config, so an extra_envs override reaches -# the worker too, not just the agent. +# The worker's env is all_config (same shared map as the agent's own +# configuration.values), so an extra_envs override reaches the worker too. run "extra_envs_also_reaches_the_worker" { command = plan @@ -123,14 +122,11 @@ run "agent_repos_scope_rejects_an_inline_fragment" { ################################################################################ # DNS_TYPE/DOMAIN/USE_ACCOUNT_SLUG/SERVICE_TEMPLATE/INITIAL_INGRESS_PATH/ -# BLUE_GREEN_INGRESS_PATH/NAMESPACE are consumed by the worker when it renders -# a scope's k8s deployment, not by the agent's own control loop — they live on -# the worker's env only (NAMESPACE as K8S_NAMESPACE). There is a single -# combined values document now (worker is just another top-level key of it, -# not a second Helm values layer), so "not in the agent's own config" is -# checked via the configuration.values rendering (`KEY: "value"`, no leading -# quote on the key) rather than absence from the whole document. -run "moved_deploy_vars_are_worker_only" { +# BLUE_GREEN_INGRESS_PATH/K8S_NAMESPACE are consumed by the worker when it +# renders a scope's k8s deployment. The agent's own configuration.values and +# the worker's env are the same shared map now, so these also show up in the +# agent's own config — that's expected, not a leak. +run "deploy_dns_vars_reach_both_agent_and_worker" { command = plan variables { @@ -142,10 +138,10 @@ run "moved_deploy_vars_are_worker_only" { assert { condition = alltrue([ for key in ["DNS_TYPE", "DOMAIN", "USE_ACCOUNT_SLUG", "SERVICE_TEMPLATE", - "INITIAL_INGRESS_PATH", "BLUE_GREEN_INGRESS_PATH", "NAMESPACE"] : - !strcontains(helm_release.agent.values[0], "\n ${key}:") + "INITIAL_INGRESS_PATH", "BLUE_GREEN_INGRESS_PATH", "K8S_NAMESPACE"] : + strcontains(helm_release.agent.values[0], "\n ${key}:") ]) - error_message = "deploy/DNS vars and NAMESPACE must not leak into the agent pod's own configuration.values" + error_message = "deploy/DNS vars and K8S_NAMESPACE must be present in the agent's own configuration.values" } } From 5ff136e650cc72df789438b76cee091de24703b8 Mon Sep 17 00:00:00 2001 From: sebas_correa Date: Wed, 2 Sep 2026 11:09:57 -0300 Subject: [PATCH 64/81] Revert "fix(agent): give the agent the deploy/DNS vars too, share one config map" This reverts commit 62a27d1a7f1bd719d43eb39ed54318bc59c23327. --- nullplatform/agent/locals.tf | 38 +++++++++++-------- .../agent/tests/agent_values.tftest.hcl | 24 +++++++----- 2 files changed, 37 insertions(+), 25 deletions(-) diff --git a/nullplatform/agent/locals.tf b/nullplatform/agent/locals.tf index 1ed284fe4..0164d731c 100644 --- a/nullplatform/agent/locals.tf +++ b/nullplatform/agent/locals.tf @@ -54,15 +54,6 @@ locals { IMAGE_PULL_SECRETS = var.image_pull_secrets PRIVATE_GATEWAY_NAME = var.private_gateway_name PUBLIC_GATEWAY_NAME = var.public_gateway_name - # Deploy-template/DNS values — read by the worker when it renders a - # scope's k8s deployment, and also exposed to the agent's own config. - DNS_TYPE = var.dns_type - DOMAIN = var.domain - USE_ACCOUNT_SLUG = var.use_account_slug - K8S_NAMESPACE = var.namespace - SERVICE_TEMPLATE = var.service_template - INITIAL_INGRESS_PATH = var.initial_ingress_path - BLUE_GREEN_INGRESS_PATH = var.blue_green_ingress_path } cloud_config = { @@ -82,17 +73,34 @@ locals { oci = {} } - # Single shared env: the agent's own configuration.values AND the worker's - # env are now the same map — the worker needs DNS_TYPE/DOMAIN/USE_ACCOUNT_SLUG/ - # K8S_NAMESPACE/SERVICE_TEMPLATE/INITIAL_INGRESS_PATH/BLUE_GREEN_INGRESS_PATH - # (deploy-template rendering) and the agent needs the rest; simpler to give - # both everything than to keep two maps in sync. all_config = merge( local.default_config, lookup(local.cloud_config, var.cloud_provider, {}), var.extra_envs, ) + # Deploy-template/DNS values consumed by the worker when it renders a scope's + # k8s deployment, not by the agent's own control loop. + worker_default_config = { + DNS_TYPE = var.dns_type + DOMAIN = var.domain + USE_ACCOUNT_SLUG = var.use_account_slug + K8S_NAMESPACE = var.namespace + SERVICE_TEMPLATE = var.service_template + INITIAL_INGRESS_PATH = var.initial_ingress_path + BLUE_GREEN_INGRESS_PATH = var.blue_green_ingress_path + TRAFFIC_CONTAINER_IMAGE = local.traffic_container_image + } + + # Same layering as all_config: cloud-specific values, then extra_envs last + # so a caller can override or add to what the worker sees, same as they + # already can for the agent's own config. + worker_env = merge( + local.worker_default_config, + lookup(local.cloud_config, var.cloud_provider, {}), + var.extra_envs, + ) + # The worker container has no identity of its own — it always runs as the # agent's own service account. worker_container_patch = { @@ -105,7 +113,7 @@ locals { { name = "worker" resources = { limits = { memory = "2Gi" } } - env = [for k, v in local.all_config : { name = k, value = v }] + env = [for k, v in local.worker_env : { name = k, value = v }] } ] } diff --git a/nullplatform/agent/tests/agent_values.tftest.hcl b/nullplatform/agent/tests/agent_values.tftest.hcl index b4915a766..71968f333 100644 --- a/nullplatform/agent/tests/agent_values.tftest.hcl +++ b/nullplatform/agent/tests/agent_values.tftest.hcl @@ -57,8 +57,9 @@ run "extra_envs_still_overrides_the_traffic_manager_image" { } } -# The worker's env is all_config (same shared map as the agent's own -# configuration.values), so an extra_envs override reaches the worker too. +# worker_env goes through the same default -> cloud_config -> extra_envs +# layering as the agent's own all_config, so an extra_envs override reaches +# the worker too, not just the agent. run "extra_envs_also_reaches_the_worker" { command = plan @@ -122,11 +123,14 @@ run "agent_repos_scope_rejects_an_inline_fragment" { ################################################################################ # DNS_TYPE/DOMAIN/USE_ACCOUNT_SLUG/SERVICE_TEMPLATE/INITIAL_INGRESS_PATH/ -# BLUE_GREEN_INGRESS_PATH/K8S_NAMESPACE are consumed by the worker when it -# renders a scope's k8s deployment. The agent's own configuration.values and -# the worker's env are the same shared map now, so these also show up in the -# agent's own config — that's expected, not a leak. -run "deploy_dns_vars_reach_both_agent_and_worker" { +# BLUE_GREEN_INGRESS_PATH/NAMESPACE are consumed by the worker when it renders +# a scope's k8s deployment, not by the agent's own control loop — they live on +# the worker's env only (NAMESPACE as K8S_NAMESPACE). There is a single +# combined values document now (worker is just another top-level key of it, +# not a second Helm values layer), so "not in the agent's own config" is +# checked via the configuration.values rendering (`KEY: "value"`, no leading +# quote on the key) rather than absence from the whole document. +run "moved_deploy_vars_are_worker_only" { command = plan variables { @@ -138,10 +142,10 @@ run "deploy_dns_vars_reach_both_agent_and_worker" { assert { condition = alltrue([ for key in ["DNS_TYPE", "DOMAIN", "USE_ACCOUNT_SLUG", "SERVICE_TEMPLATE", - "INITIAL_INGRESS_PATH", "BLUE_GREEN_INGRESS_PATH", "K8S_NAMESPACE"] : - strcontains(helm_release.agent.values[0], "\n ${key}:") + "INITIAL_INGRESS_PATH", "BLUE_GREEN_INGRESS_PATH", "NAMESPACE"] : + !strcontains(helm_release.agent.values[0], "\n ${key}:") ]) - error_message = "deploy/DNS vars and K8S_NAMESPACE must be present in the agent's own configuration.values" + error_message = "deploy/DNS vars and NAMESPACE must not leak into the agent pod's own configuration.values" } } From eefb2130339b60dfc3d51c3367831f413277cbf4 Mon Sep 17 00:00:00 2001 From: sebas_correa Date: Wed, 2 Sep 2026 11:55:08 -0300 Subject: [PATCH 65/81] refactor(agent): split agent-pod env from worker env into two maps MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit default_config/all_config (the agent pod's own configuration.values) now carries only NP_API_KEY/TAGS/IMAGE_TAG plus cloud_config; everything the worker needs to render a scope's k8s deployment or run traffic-management actions (DNS_TYPE, DOMAIN, USE_ACCOUNT_SLUG, K8S_NAMESPACE, SERVICE_TEMPLATE, INITIAL_INGRESS_PATH, BLUE_GREEN_INGRESS_PATH, TRAFFIC_CONTAINER_IMAGE, IMAGE_PULL_SECRETS, PRIVATE_GATEWAY_NAME, PUBLIC_GATEWAY_NAME) moves to its own worker_default_env/worker_all_config, merged with a worker-specific cloud_config (currently just azure) and var.extra_envs the same way all_config is. Keeping two maps in sync (rather than sharing one, as this branch briefly had) is intentional: the agent and the worker have different consumers and don't need each other's variables. Also drops agent_repos_scope/agent_repos_scope_tag/agent_repos_extra and the AGENT_REPOS arg they fed — no longer needed — and restores local.worker_defaults (backend="kubernetes") as the base of worker_final, which had been dropped while reworking this, leaving the worker block without a backend default. Updates tests to match: two obsolete scope-repo tests removed, three rewritten for the new split (traffic-manager image now asserted in the worker's env, not the agent's flat config; deploy/DNS vars asserted absent from the agent's own config). Co-Authored-By: Claude Sonnet 5 --- nullplatform/agent/locals.tf | 79 +++++++------------ nullplatform/agent/tests/agent.tftest.hcl | 1 - .../agent/tests/agent_values.tftest.hcl | 68 +++------------- nullplatform/agent/variables.tf | 50 +----------- 4 files changed, 39 insertions(+), 159 deletions(-) diff --git a/nullplatform/agent/locals.tf b/nullplatform/agent/locals.tf index 0164d731c..04e5188e6 100644 --- a/nullplatform/agent/locals.tf +++ b/nullplatform/agent/locals.tf @@ -4,20 +4,6 @@ locals { - # The repository lives here and only the tag is exposed, so a version bump is a variable - - # change instead of a hand-assembled URL. - - scope_repo = trimspace(coalesce(var.agent_repos_scope, "")) - - scope_list = compact([local.scope_repo != "" ? "${local.scope_repo}#${trimspace(var.agent_repos_scope_tag)}" : ""]) - # Parse comma-separated extra repositories and clean whitespace - repos_extra = compact([for s in var.agent_repos_extra : trimspace(s)]) - - # Merge scope and extra repositories, removing duplicates - final_repo_list = distinct(concat(local.scope_list, local.repos_extra)) - - agent_repos = join(",", local.final_repo_list) tags = join(",", [for k in sort(keys(var.tags_selectors)) : "${k}:${var.tags_selectors[k]}"]) api_key = var.api_key @@ -29,7 +15,6 @@ locals { "--command-executor-env=NP_API_KEY=$(NP_API_KEY)", "--command-executor-debug", "--webserver-enabled", - "--command-executor-git-command-repos $(AGENT_REPOS)" ] cloud_args = { @@ -41,19 +26,11 @@ locals { all_args = concat(local.default_args, lookup(local.cloud_args, var.cloud_provider, [])) - # Consumed by both the agent's own config and the worker's — the worker - # needs it for traffic-management actions (blue-green switches, etc.). - traffic_container_image = "${var.agent_traffic_manager_repository}:${var.agent_traffic_manager_tag}" default_config = { NP_API_KEY = local.api_key TAGS = local.tags - AGENT_REPOS = local.agent_repos IMAGE_TAG = var.image_tag - TRAFFIC_CONTAINER_IMAGE = local.traffic_container_image - IMAGE_PULL_SECRETS = var.image_pull_secrets - PRIVATE_GATEWAY_NAME = var.private_gateway_name - PUBLIC_GATEWAY_NAME = var.public_gateway_name } cloud_config = { @@ -61,27 +38,20 @@ locals { AWS_IAM_ROLE_ARN = var.aws_iam_role_arn } - azure = { - PRIVATE_HOSTED_ZONE_RG = var.private_hosted_zone_rg - RESOURCE_GROUP = var.azure_resource_group - AZURE_SUBSCRIPTION_ID = var.azure_subscription_id - AZURE_CLIENT_SECRET = var.azure_client_secret - AZURE_CLIENT_ID = var.azure_client_id - AZURE_TENANT_ID = var.azure_tenant_id - } - + gcp = {} + azure = {} oci = {} } + all_config = merge( local.default_config, lookup(local.cloud_config, var.cloud_provider, {}), var.extra_envs, ) - # Deploy-template/DNS values consumed by the worker when it renders a scope's - # k8s deployment, not by the agent's own control loop. - worker_default_config = { + + worker_default_env = { DNS_TYPE = var.dns_type DOMAIN = var.domain USE_ACCOUNT_SLUG = var.use_account_slug @@ -89,20 +59,31 @@ locals { SERVICE_TEMPLATE = var.service_template INITIAL_INGRESS_PATH = var.initial_ingress_path BLUE_GREEN_INGRESS_PATH = var.blue_green_ingress_path - TRAFFIC_CONTAINER_IMAGE = local.traffic_container_image + TRAFFIC_CONTAINER_IMAGE = "${var.agent_traffic_manager_repository}:${var.agent_traffic_manager_tag}" + IMAGE_PULL_SECRETS = var.image_pull_secrets + PRIVATE_GATEWAY_NAME = var.private_gateway_name + PUBLIC_GATEWAY_NAME = var.public_gateway_name + } - # Same layering as all_config: cloud-specific values, then extra_envs last - # so a caller can override or add to what the worker sees, same as they - # already can for the agent's own config. - worker_env = merge( - local.worker_default_config, - lookup(local.cloud_config, var.cloud_provider, {}), + worker_cloud_config = { + azure = { + PRIVATE_HOSTED_ZONE_RG = var.private_hosted_zone_rg + RESOURCE_GROUP = var.azure_resource_group + AZURE_SUBSCRIPTION_ID = var.azure_subscription_id + AZURE_CLIENT_SECRET = var.azure_client_secret + AZURE_CLIENT_ID = var.azure_client_id + AZURE_TENANT_ID = var.azure_tenant_id + } + } + + + worker_all_config = merge( + local.worker_default_env, + lookup(local.worker_cloud_config, var.cloud_provider, {}), var.extra_envs, ) - # The worker container has no identity of its own — it always runs as the - # agent's own service account. worker_container_patch = { target = { package = "containers" } merge = { @@ -113,20 +94,14 @@ locals { { name = "worker" resources = { limits = { memory = "2Gi" } } - env = [for k, v in local.worker_env : { name = k, value = v }] + env = [for k, v in local.worker_all_config : { name = k, value = v }] } ] } ) } } - - # Sane module defaults, merged with var.worker as an extra/override layer. - # patches and allowedRegistries are concatenated (not replaced) with - # var.worker's own entries: a caller wanting a different memory limit adds - # their own patch targeting the same container rather than the module - # inventing a dedicated override key for it, and a caller needing extra - # registries adds to the default instead of having to repeat it. + worker_defaults = { backend = "kubernetes" allowedRegistries = ["public.ecr.aws/nullplatform/*"] diff --git a/nullplatform/agent/tests/agent.tftest.hcl b/nullplatform/agent/tests/agent.tftest.hcl index 2f27d0832..7e99fb2cc 100644 --- a/nullplatform/agent/tests/agent.tftest.hcl +++ b/nullplatform/agent/tests/agent.tftest.hcl @@ -8,7 +8,6 @@ variables { cloud_provider = "gcp" nullplatform_agent_helm_version = "2.37.0" agent_traffic_manager_tag = "1.8.0" - agent_repos_scope_tag = "v1.15.1" } run "no_extra_envs_does_not_require_ingress_templates" { diff --git a/nullplatform/agent/tests/agent_values.tftest.hcl b/nullplatform/agent/tests/agent_values.tftest.hcl index 71968f333..3b30acb64 100644 --- a/nullplatform/agent/tests/agent_values.tftest.hcl +++ b/nullplatform/agent/tests/agent_values.tftest.hcl @@ -9,7 +9,6 @@ variables { image_tag = "0.9.2" nullplatform_agent_helm_version = "2.37.0" agent_traffic_manager_tag = "1.8.0" - agent_repos_scope_tag = "v1.15.1" } ################################################################################ @@ -18,12 +17,14 @@ variables { # Pinning the traffic manager used to mean passing the whole image string through # extra_envs. The registry now lives in the module and only the tag is exposed. +# TRAFFIC_CONTAINER_IMAGE is a worker-only var (worker_default_env), so it +# renders as an env list entry, not a flat configuration.values key. run "traffic_manager_image_is_assembled_from_the_tag" { command = plan assert { - condition = strcontains(helm_release.agent.values[0], "TRAFFIC_CONTAINER_IMAGE: \"public.ecr.aws/nullplatform/k8s-traffic-manager:1.8.0\"") - error_message = "TRAFFIC_CONTAINER_IMAGE should be built from the repository default and the pinned tag" + condition = strcontains(helm_release.agent.values[0], "\"name\": \"TRAFFIC_CONTAINER_IMAGE\"") && strcontains(helm_release.agent.values[0], "\"value\": \"public.ecr.aws/nullplatform/k8s-traffic-manager:1.8.0\"") + error_message = "TRAFFIC_CONTAINER_IMAGE should be built from the repository default and the pinned tag, and reach the worker's env" } } @@ -35,7 +36,7 @@ run "traffic_manager_repository_is_overridable" { } assert { - condition = strcontains(helm_release.agent.values[0], "TRAFFIC_CONTAINER_IMAGE: \"my-mirror.example.com/nullplatform/k8s-traffic-manager:1.8.0\"") + condition = strcontains(helm_release.agent.values[0], "\"name\": \"TRAFFIC_CONTAINER_IMAGE\"") && strcontains(helm_release.agent.values[0], "\"value\": \"my-mirror.example.com/nullplatform/k8s-traffic-manager:1.8.0\"") error_message = "the registry must be overridable for a mirrored path" } } @@ -57,9 +58,8 @@ run "extra_envs_still_overrides_the_traffic_manager_image" { } } -# worker_env goes through the same default -> cloud_config -> extra_envs -# layering as the agent's own all_config, so an extra_envs override reaches -# the worker too, not just the agent. +# The worker has its own env map (worker_all_config), layered with extra_envs +# the same way all_config is for the agent, so an override reaches both. run "extra_envs_also_reaches_the_worker" { command = plan @@ -75,61 +75,15 @@ run "extra_envs_also_reaches_the_worker" { } } -################################################################################ -# Scope repository -################################################################################ - -run "scope_repo_is_pinned_to_a_tag" { - command = plan - - assert { - condition = !strcontains(helm_release.agent.values[0], "#main") - error_message = "the scope repo default must not point at a moving branch" - } - - assert { - condition = strcontains(helm_release.agent.values[0], "scopes.git#v1.15.1") - error_message = "the scope repo default should be pinned to the released tag" - } -} - -run "scope_repo_is_overridable" { - command = plan - - variables { - agent_repos_scope_tag = "v1.14.0" - } - - assert { - condition = strcontains(helm_release.agent.values[0], "scopes.git#v1.14.0") - error_message = "callers must still be able to choose their own ref" - } -} - -run "agent_repos_scope_rejects_an_inline_fragment" { - command = plan - - variables { - agent_repos_scope = "https://github.com/nullplatform/scopes.git#v1.15.1" - } - - # Catches the most likely migration mistake: pasting the old value verbatim, which would - # otherwise render repo.git#v1.15.1#v1.15.1. - expect_failures = [var.agent_repos_scope] -} - ################################################################################ # Worker orchestration ################################################################################ # DNS_TYPE/DOMAIN/USE_ACCOUNT_SLUG/SERVICE_TEMPLATE/INITIAL_INGRESS_PATH/ -# BLUE_GREEN_INGRESS_PATH/NAMESPACE are consumed by the worker when it renders -# a scope's k8s deployment, not by the agent's own control loop — they live on -# the worker's env only (NAMESPACE as K8S_NAMESPACE). There is a single -# combined values document now (worker is just another top-level key of it, -# not a second Helm values layer), so "not in the agent's own config" is -# checked via the configuration.values rendering (`KEY: "value"`, no leading -# quote on the key) rather than absence from the whole document. +# BLUE_GREEN_INGRESS_PATH are consumed by the worker when it renders a scope's +# k8s deployment, not by the agent's own control loop — they live on the +# worker's env only (worker_default_env), never in the agent's own +# configuration.values (default_config). run "moved_deploy_vars_are_worker_only" { command = plan diff --git a/nullplatform/agent/variables.tf b/nullplatform/agent/variables.tf index 72dadebf2..e957013a9 100644 --- a/nullplatform/agent/variables.tf +++ b/nullplatform/agent/variables.tf @@ -11,7 +11,7 @@ variable "api_key" { # Image tag for the agent container image variable "image_tag" { - # example: 0.9.2 + # example: aws-0.10.0-nonroot description = "Image tag for the agent container image" type = string } @@ -96,32 +96,6 @@ variable "namespace" { default = "nullplatform-tools" } -# Git repository URL containing agent scope configurations (format: repo#branch) -variable "agent_repos_scope" { - description = "Git repository URL containing agent scope configurations, WITHOUT the ref fragment. The ref goes in agent_repos_scope_tag." - type = string - default = "https://github.com/nullplatform/scopes.git" - - # Without this, migrating by pasting the old value (repo.git#v1.15.1) produces - # repo.git#v1.15.1#, which fails inside the pod at clone time instead of during plan. - validation { - condition = length(regexall("#", var.agent_repos_scope)) == 0 - error_message = "agent_repos_scope must not contain a '#' fragment — set the ref in agent_repos_scope_tag instead." - } -} - -variable "agent_repos_scope_tag" { - # example: v1.15.1 - description = "Git tag of the scopes repository to clone. No default: every install pins this deliberately so the agent cannot pick up scope changes it was never rolled out with — see VERSIONS.md." - type = string - - validation { - condition = var.agent_repos_scope_tag != "" && !contains(["main", "master", "head", "latest"], lower(var.agent_repos_scope_tag)) - error_message = "agent_repos_scope_tag must be a non-empty fixed tag, not empty and not a moving branch." - } -} - -# List of additional Git repositories used for extended agent configuration variable "agent_traffic_manager_repository" { description = "Container image repository for the traffic manager. Defaults to the official nullplatform image; override to pull from a mirror. Matches the pattern nullplatform/base uses for its own images." type = string @@ -139,28 +113,6 @@ variable "agent_traffic_manager_tag" { } } -variable "agent_repos_extra" { - description = "List of additional Git repositories used for extended agent configuration. Each entry MUST carry a pinned ref fragment (repo.git#v1.2.3); moving refs are rejected. Covers scopes-* and services-* without enumerating them." - type = list(string) - default = [] - - # Two validations rather than one so the error names which rule was broken. - validation { - condition = alltrue([ - for r in var.agent_repos_extra : - can(regex("#[^#]+$", trimspace(r))) - ]) - error_message = "every agent_repos_extra entry must pin a ref with a '#' fragment, e.g. https://github.com/nullplatform/scopes-lambda.git#v0.3.1" - } - - validation { - condition = alltrue([ - for r in var.agent_repos_extra : - !can(regex("(?i)#(main|master|head|latest)$", trimspace(r))) - ]) - error_message = "agent_repos_extra entries must pin a fixed tag, not a moving ref (main/master/HEAD/latest)." - } -} # List of initialization scripts to execute during agent startup variable "init_scripts" { From 336ef5e1995dbb6d736fd5fd213e7308f9ab728a Mon Sep 17 00:00:00 2001 From: sebas_correa Date: Wed, 2 Sep 2026 12:37:43 -0300 Subject: [PATCH 66/81] fix(agent): restore a minimal agent_repo escape hatch, tidy formatting MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit agent_repos_scope/agent_repos_scope_tag/agent_repos_extra (and the AGENT_REPOS arg) were dropped in the previous commit on the assumption that every consumer had moved to worker_orchestrator — not verified, and most of the known callers of scope_definition_agent_association still use the legacy exec flow. Re-adds a single agent_repo variable (with description/type) so the legacy --command-executor-git-command-repos flow still has an escape hatch, without restoring the old multi-repo/validation complexity that's no longer needed. Also cleans up stray double-blank-lines and misaligned spacing left over from the previous commit's edits. --- nullplatform/agent/locals.tf | 21 +++++++++------------ nullplatform/agent/variables.tf | 6 ++++++ 2 files changed, 15 insertions(+), 12 deletions(-) diff --git a/nullplatform/agent/locals.tf b/nullplatform/agent/locals.tf index 04e5188e6..38103aa45 100644 --- a/nullplatform/agent/locals.tf +++ b/nullplatform/agent/locals.tf @@ -4,7 +4,7 @@ locals { - tags = join(",", [for k in sort(keys(var.tags_selectors)) : "${k}:${var.tags_selectors[k]}"]) + tags = join(",", [for k in sort(keys(var.tags_selectors)) : "${k}:${var.tags_selectors[k]}"]) api_key = var.api_key @@ -15,6 +15,7 @@ locals { "--command-executor-env=NP_API_KEY=$(NP_API_KEY)", "--command-executor-debug", "--webserver-enabled", + "--command-executor-git-command-repos $(AGENT_REPO)" ] cloud_args = { @@ -26,11 +27,11 @@ locals { all_args = concat(local.default_args, lookup(local.cloud_args, var.cloud_provider, [])) - default_config = { - NP_API_KEY = local.api_key - TAGS = local.tags - IMAGE_TAG = var.image_tag + NP_API_KEY = local.api_key + TAGS = local.tags + IMAGE_TAG = var.image_tag + AGENT_REPO = var.agent_repo } cloud_config = { @@ -38,19 +39,17 @@ locals { AWS_IAM_ROLE_ARN = var.aws_iam_role_arn } - gcp = {} + gcp = {} azure = {} - oci = {} + oci = {} } - all_config = merge( local.default_config, lookup(local.cloud_config, var.cloud_provider, {}), var.extra_envs, ) - worker_default_env = { DNS_TYPE = var.dns_type DOMAIN = var.domain @@ -63,7 +62,6 @@ locals { IMAGE_PULL_SECRETS = var.image_pull_secrets PRIVATE_GATEWAY_NAME = var.private_gateway_name PUBLIC_GATEWAY_NAME = var.public_gateway_name - } worker_cloud_config = { @@ -77,7 +75,6 @@ locals { } } - worker_all_config = merge( local.worker_default_env, lookup(local.worker_cloud_config, var.cloud_provider, {}), @@ -101,7 +98,7 @@ locals { ) } } - + worker_defaults = { backend = "kubernetes" allowedRegistries = ["public.ecr.aws/nullplatform/*"] diff --git a/nullplatform/agent/variables.tf b/nullplatform/agent/variables.tf index e957013a9..0c8027519 100644 --- a/nullplatform/agent/variables.tf +++ b/nullplatform/agent/variables.tf @@ -32,6 +32,12 @@ variable "tags_selectors" { type = map(string) } +variable "agent_repo" { + description = "Git repository (with ref) the agent clones for its legacy command-executor exec flow, e.g. \"https://github.com/nullplatform/scopes.git#v1.15.1\". Empty when every scope uses worker_orchestrator instead." + type = string + default = "" +} + ################################################################################ # Agent configuration ################################################################################ From ae0f6a390cd0a4378c0348dcc15e1595dab22dcf Mon Sep 17 00:00:00 2001 From: sebas_correa Date: Wed, 2 Sep 2026 12:49:37 -0300 Subject: [PATCH 67/81] feat(agent): agent_repo accepts a list, joined into AGENT_REPO MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit agent_repo is now list(string) instead of a single string, so the legacy exec flow can point the agent at more than one repo (e.g. the scopes repo plus a service-specific one) — joined with a comma and no spaces, same format the old AGENT_REPOS used. --- nullplatform/agent/locals.tf | 5 ++-- .../agent/tests/agent_values.tftest.hcl | 29 +++++++++++++++++++ nullplatform/agent/variables.tf | 16 ++++++++-- 3 files changed, 45 insertions(+), 5 deletions(-) diff --git a/nullplatform/agent/locals.tf b/nullplatform/agent/locals.tf index 38103aa45..333feb4aa 100644 --- a/nullplatform/agent/locals.tf +++ b/nullplatform/agent/locals.tf @@ -6,7 +6,8 @@ locals { tags = join(",", [for k in sort(keys(var.tags_selectors)) : "${k}:${var.tags_selectors[k]}"]) - api_key = var.api_key + api_key = var.api_key + agent_repo = join(",", var.agent_repo) default_args = [ "--tags=$(TAGS)", @@ -31,7 +32,7 @@ locals { NP_API_KEY = local.api_key TAGS = local.tags IMAGE_TAG = var.image_tag - AGENT_REPO = var.agent_repo + AGENT_REPO = local.agent_repo } cloud_config = { diff --git a/nullplatform/agent/tests/agent_values.tftest.hcl b/nullplatform/agent/tests/agent_values.tftest.hcl index 3b30acb64..ddc51278a 100644 --- a/nullplatform/agent/tests/agent_values.tftest.hcl +++ b/nullplatform/agent/tests/agent_values.tftest.hcl @@ -223,3 +223,32 @@ run "worker_extra_patches_and_overrides_are_merged_not_replaced" { error_message = "var.worker's own patches/keys must be merged alongside the computed worker-container patch, not replace it" } } + +################################################################################ +# Legacy exec repos +################################################################################ + +run "agent_repo_joins_multiple_repos_with_no_spaces" { + command = plan + + variables { + agent_repo = [ + "https://github.com/nullplatform/scopes.git#v1.15.1", + "https://github.com/nullplatform/services-s-3.git#v0.3.0", + ] + } + + assert { + condition = strcontains(helm_release.agent.values[0], "AGENT_REPO: \"https://github.com/nullplatform/scopes.git#v1.15.1,https://github.com/nullplatform/services-s-3.git#v0.3.0\"") + error_message = "agent_repo entries must be joined with a comma and no spaces" + } +} + +run "agent_repo_defaults_to_empty" { + command = plan + + assert { + condition = strcontains(helm_release.agent.values[0], "AGENT_REPO: \"\"") + error_message = "agent_repo must default to an empty list, joining to an empty string" + } +} diff --git a/nullplatform/agent/variables.tf b/nullplatform/agent/variables.tf index 0c8027519..cff47514c 100644 --- a/nullplatform/agent/variables.tf +++ b/nullplatform/agent/variables.tf @@ -33,9 +33,19 @@ variable "tags_selectors" { } variable "agent_repo" { - description = "Git repository (with ref) the agent clones for its legacy command-executor exec flow, e.g. \"https://github.com/nullplatform/scopes.git#v1.15.1\". Empty when every scope uses worker_orchestrator instead." - type = string - default = "" + description = <<-EOT + Git repositories (each with a ref) the agent clones for its legacy + command-executor exec flow. Joined into a comma-separated AGENT_REPO + value, no spaces. Empty when every scope uses worker_orchestrator instead. + + Example: + agent_repo = [ + "https://github.com/nullplatform/scopes.git#v1.15.1", + "https://github.com/nullplatform/services-s-3.git#v0.3.0", + ] + EOT + type = list(string) + default = [] } ################################################################################ From 5e83faa9c34fac1f9664c54a92778d90c9ef68b4 Mon Sep 17 00:00:00 2001 From: sebas_correa Date: Wed, 2 Sep 2026 13:34:13 -0300 Subject: [PATCH 68/81] fix(gcp/backend): self-provision a log bucket when log_bucket is unset MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Resolves a Trivy finding on the PR (GCP-0077, MEDIUM): the state bucket had no access logging by default. log_bucket was already an opt-in variable, but requiring every caller to bring their own centralized log bucket meant most installs shipped with logging off. When log_bucket is left null/empty, the module now creates its own dedicated log bucket and grants the project's GCS service agent roles/storage.objectCreator on it (required for delivery — see https://cloud.google.com/storage/docs/access-logs#delivery), so state bucket access logging is on out of the box. Passing log_bucket still works exactly as before and skips the self-provisioned bucket. GCP-0066 (LOW, customer-managed encryption key) stays opt-in via kms_key_name — enabling it by default would require every caller to pre-create a KMS key and grant IAM on it, which is a heavier default than warranted for a LOW-severity finding on a generic module. Adds a log_bucket_name output and updates/extends the test suite for the new default (26 tests, was 24). --- infrastructure/gcp/backend/main.tf | 46 +++++++++++++++++-- infrastructure/gcp/backend/outputs.tf | 5 ++ .../gcp/backend/tests/backend.tftest.hcl | 32 ++++++++++--- infrastructure/gcp/backend/variables.tf | 2 +- 4 files changed, 73 insertions(+), 12 deletions(-) diff --git a/infrastructure/gcp/backend/main.tf b/infrastructure/gcp/backend/main.tf index 91cac07f0..45402f3ed 100644 --- a/infrastructure/gcp/backend/main.tf +++ b/infrastructure/gcp/backend/main.tf @@ -2,6 +2,45 @@ resource "random_id" "bucket_suffix" { byte_length = 8 } +locals { + log_bucket_provided = var.log_bucket != null && var.log_bucket != "" + + # Falls back to a bucket this module creates and grants write access to, + # so state-bucket access logging is on out of the box (GCP-0077) without + # forcing every caller to bring their own centralized log bucket first. + effective_log_bucket = local.log_bucket_provided ? var.log_bucket : try(google_storage_bucket.logs[0].name, null) +} + +# The GCS service agent needs write access on whatever bucket receives access +# logs — https://cloud.google.com/storage/docs/access-logs#delivery. +data "google_storage_project_service_account" "gcs_account" { + count = local.log_bucket_provided ? 0 : 1 + project = var.project_id +} + +resource "google_storage_bucket" "logs" { + count = local.log_bucket_provided ? 0 : 1 + + name = "${lower(var.bucket_prefix)}-logs-${random_id.bucket_suffix.hex}" + project = var.project_id + location = var.location + storage_class = var.storage_class + force_destroy = var.force_destroy + + uniform_bucket_level_access = var.uniform_bucket_level_access + public_access_prevention = var.public_access_prevention + + labels = var.tags +} + +resource "google_storage_bucket_iam_member" "logs_writer" { + count = local.log_bucket_provided ? 0 : 1 + + bucket = google_storage_bucket.logs[0].name + role = "roles/storage.objectCreator" + member = "serviceAccount:${data.google_storage_project_service_account.gcs_account[0].email_address}" +} + resource "google_storage_bucket" "tf_state" { # GCS rejects uppercase bucket names, so the caller-supplied prefix is lowercased. name = "${lower(var.bucket_prefix)}-${random_id.bucket_suffix.hex}" @@ -26,11 +65,8 @@ resource "google_storage_bucket" "tf_state" { } } - dynamic "logging" { - for_each = var.log_bucket != null && var.log_bucket != "" ? [var.log_bucket] : [] - content { - log_bucket = logging.value - } + logging { + log_bucket = local.effective_log_bucket } labels = var.tags diff --git a/infrastructure/gcp/backend/outputs.tf b/infrastructure/gcp/backend/outputs.tf index e7d839abf..23395feab 100644 --- a/infrastructure/gcp/backend/outputs.tf +++ b/infrastructure/gcp/backend/outputs.tf @@ -17,3 +17,8 @@ output "location" { description = "Location of the GCS bucket" value = google_storage_bucket.tf_state.location } + +output "log_bucket_name" { + description = "Name of the bucket receiving access logs — either var.log_bucket, or the module's own auto-created log bucket when that's left unset" + value = local.effective_log_bucket +} diff --git a/infrastructure/gcp/backend/tests/backend.tftest.hcl b/infrastructure/gcp/backend/tests/backend.tftest.hcl index bf81b894b..7d4d16ea4 100644 --- a/infrastructure/gcp/backend/tests/backend.tftest.hcl +++ b/infrastructure/gcp/backend/tests/backend.tftest.hcl @@ -235,16 +235,26 @@ run "encryption_block_when_kms_key_provided" { } } -run "no_logging_block_by_default" { +run "log_bucket_is_self_provisioned_by_default" { command = plan assert { - condition = length(google_storage_bucket.tf_state.logging) == 0 - error_message = "Access logging should not be configured when log_bucket is not set" + condition = length(google_storage_bucket.tf_state.logging) == 1 + error_message = "Access logging should be configured even when log_bucket is not set — the module provisions its own log bucket" + } + + assert { + condition = length(google_storage_bucket.logs) == 1 + error_message = "The module should create its own log bucket when log_bucket is not set" + } + + assert { + condition = length(google_storage_bucket_iam_member.logs_writer) == 1 + error_message = "The GCS service agent should be granted write access to the self-provisioned log bucket" } } -run "empty_log_bucket_emits_no_logging_block" { +run "empty_log_bucket_also_self_provisions" { command = plan variables { @@ -252,8 +262,13 @@ run "empty_log_bucket_emits_no_logging_block" { } assert { - condition = length(google_storage_bucket.tf_state.logging) == 0 - error_message = "An empty log_bucket must not emit a logging block with an empty target" + condition = length(google_storage_bucket.tf_state.logging) == 1 + error_message = "An empty log_bucket should be treated the same as unset: the module self-provisions a log bucket" + } + + assert { + condition = length(google_storage_bucket.logs) == 1 + error_message = "The module should create its own log bucket when log_bucket is an empty string" } } @@ -268,6 +283,11 @@ run "logging_block_when_log_bucket_provided" { condition = google_storage_bucket.tf_state.logging[0].log_bucket == "myorg-access-logs" error_message = "Logging block should target the provided log bucket" } + + assert { + condition = length(google_storage_bucket.logs) == 0 + error_message = "The module should not self-provision a log bucket when the caller already provided one" + } } run "no_iam_bindings_by_default" { diff --git a/infrastructure/gcp/backend/variables.tf b/infrastructure/gcp/backend/variables.tf index 73d49dcc0..de5e626af 100644 --- a/infrastructure/gcp/backend/variables.tf +++ b/infrastructure/gcp/backend/variables.tf @@ -91,7 +91,7 @@ variable "kms_key_name" { } variable "log_bucket" { - description = "Name of an existing GCS bucket to receive this bucket's access logs. Leave null or empty to disable access logging. Recommended for a state bucket, so reads of state objects leave an audit trail" + description = "Name of an existing GCS bucket to receive this bucket's access logs. Leave null or empty and the module creates its own dedicated log bucket (and grants the GCS service agent write access to it) — access logging is always on, so reads of state objects leave an audit trail." type = string default = null } From e16da9d6d0e0f548404c263a54848bd2034044fe Mon Sep 17 00:00:00 2001 From: sebas_correa Date: Wed, 2 Sep 2026 14:33:22 -0300 Subject: [PATCH 69/81] fix(gcp/backend): enable versioning on the self-provisioned log bucket Closes a Trivy finding (GCP-0078) the previous commit introduced: the auto-created log bucket had no versioning, unlike tf_state. Reuses var.versioning_enabled, same as the state bucket. --- infrastructure/gcp/backend/main.tf | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/infrastructure/gcp/backend/main.tf b/infrastructure/gcp/backend/main.tf index 45402f3ed..97db6cb17 100644 --- a/infrastructure/gcp/backend/main.tf +++ b/infrastructure/gcp/backend/main.tf @@ -30,6 +30,10 @@ resource "google_storage_bucket" "logs" { uniform_bucket_level_access = var.uniform_bucket_level_access public_access_prevention = var.public_access_prevention + versioning { + enabled = var.versioning_enabled + } + labels = var.tags } From 789a13e428b75b76736f3f38929c63de011a0865 Mon Sep 17 00:00:00 2001 From: sebas_correa Date: Wed, 2 Sep 2026 14:50:30 -0300 Subject: [PATCH 70/81] feat(service_definition): default package artifact name/type to impl/git_repository MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Mirrors the scope_definition package-artifact defaults. A service package is typically one artifact pointing at the service's own implementation repo, so name defaults to "impl" and type to "git_repository" (was "oci_image", copied from scope_definition's mirror). Every other field — slug, version, default, tags, visible_to, and the artifact's own meta/lookup/resource_id/resource_revision_id — stays exactly as caller-configurable as before; only meta.url/reference need setting per release. Verified the defaulting behavior in isolation (this module has no test suite, and its provider is pinned below nullplatform_package/artifact support, so a real `tofu validate`/`test` wasn't practical here). --- nullplatform/service_definition/variables.tf | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/nullplatform/service_definition/variables.tf b/nullplatform/service_definition/variables.tf index cceacd130..85a92562b 100644 --- a/nullplatform/service_definition/variables.tf +++ b/nullplatform/service_definition/variables.tf @@ -127,6 +127,12 @@ variable "package" { to pin a specific revision, otherwise the latest revision is used); • pin explicit ids — set `resource_id` + `resource_revision_id`. + An artifact's `name` defaults to "impl" and `type` to "git_repository" — + a service package is typically a single artifact pointing at the + service's own implementation repo, so only `meta` (url/reference) needs + setting on every release. Every other field, at every level, is + caller-configurable with no other defaults baked in. + Null (the default) keeps the classic module behavior — no package. EOT type = object({ @@ -137,11 +143,11 @@ variable "package" { tags = optional(map(string), {}) # release tags: name => version (requires an API with the package release-tag routes) visible_to = optional(list(string)) # default: [var.nrn] artifacts = optional(list(object({ - name = string - type = optional(string, "oci_image") # oci_image | oras_artifact | git_repository | blob - meta = optional(any) # register (lookup=false) or find (lookup=true) - lookup = optional(bool, false) # true: resolve an EXISTING artifact by meta identity - resource_id = optional(string) # …or pin explicit ids + name = optional(string, "impl") # default: a single service-implementation artifact + type = optional(string, "git_repository") # oci_image | oras_artifact | git_repository | blob + meta = optional(any) # register (lookup=false) or find (lookup=true) + lookup = optional(bool, false) # true: resolve an EXISTING artifact by meta identity + resource_id = optional(string) # …or pin explicit ids resource_revision_id = optional(string) })), []) }) From 8cef343c2de813c00b8d45d242e25386a7b603d0 Mon Sep 17 00:00:00 2001 From: sebas_correa Date: Wed, 2 Sep 2026 15:33:57 -0300 Subject: [PATCH 71/81] docs(scope_definition,service_definition): digest/reference are type-specific, not interchangeable MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The package variable's description and the lookup-artifact data source's comment implied digest and reference were two equivalent ways to pin any artifact revision. Verified against the live API against a real oci_image artifact: it's stricter than that — - digest must match "sha256:<64-hex>" and only oci_image accepts it - reference (e.g. a tag) is what git_repository uses instead - each type rejects the other type's field with a validation error ("meta has unexpected field(s): reference" / "meta.digest must match sha256:<64-hex>") Clarifies both spots in scope_definition and service_definition (mirrors of each other) to say which field belongs to which type. --- nullplatform/scope_definition/package.tf | 7 +++++-- nullplatform/scope_definition/variables.tf | 7 +++++-- nullplatform/service_definition/package.tf | 7 +++++-- nullplatform/service_definition/variables.tf | 8 ++++++-- 4 files changed, 21 insertions(+), 8 deletions(-) diff --git a/nullplatform/scope_definition/package.tf b/nullplatform/scope_definition/package.tf index 46623ebbe..50b78c810 100644 --- a/nullplatform/scope_definition/package.tf +++ b/nullplatform/scope_definition/package.tf @@ -56,8 +56,11 @@ resource "nullplatform_artifact" "package" { } # Existing artifacts resolved by identity — no ids in your configuration. -# Identity meta (e.g. registry+repository) selects the artifact; include -# per-revision fields (digest/reference) to pin a revision, else latest wins. +# Identity meta (e.g. registry+repository for oci_image, url for +# git_repository) selects the artifact; include the type's own per-revision +# field to pin a revision — digest ("sha256:<64-hex>") for oci_image, +# reference (e.g. a tag) for git_repository; the API rejects the other +# type's field name — else latest wins. data "nullplatform_artifact" "package" { for_each = local.package_artifacts_to_lookup diff --git a/nullplatform/scope_definition/variables.tf b/nullplatform/scope_definition/variables.tf index cbb9da354..24e180e1e 100644 --- a/nullplatform/scope_definition/variables.tf +++ b/nullplatform/scope_definition/variables.tf @@ -189,8 +189,11 @@ variable "package" { { registry = "ghcr.io", repository = "acme/img", digest = "sha256:…" }); • look up one registered elsewhere BY IDENTITY (no ids needed) — set `lookup = true` + `meta` with the identity fields (e.g. registry + - repository; add digest/reference to pin a specific revision, otherwise - the latest revision is used); + repository for oci_image, or url for git_repository); add the + type's own per-revision field to pin a specific revision (digest, + formatted "sha256:<64-hex>", for oci_image; reference, e.g. a tag, + for git_repository — the API rejects the other type's field name), + otherwise the latest revision is used; • pin explicit ids — set `resource_id` + `resource_revision_id`. For an "oci_image" artifact (the default type), `name` defaults to diff --git a/nullplatform/service_definition/package.tf b/nullplatform/service_definition/package.tf index 036e34fa5..3833b473a 100644 --- a/nullplatform/service_definition/package.tf +++ b/nullplatform/service_definition/package.tf @@ -88,8 +88,11 @@ resource "nullplatform_artifact" "package" { } # Existing artifacts resolved by identity — no ids in your configuration. -# Identity meta (e.g. registry+repository, or url) selects the artifact; include -# per-revision fields (digest/reference) to pin a revision, else latest wins. +# Identity meta (e.g. registry+repository for oci_image, or url for +# git_repository) selects the artifact; include the type's own per-revision +# field to pin a revision — digest ("sha256:<64-hex>") for oci_image, +# reference (e.g. a tag) for git_repository; the API rejects the other +# type's field name — else latest wins. data "nullplatform_artifact" "package" { for_each = local.package_artifacts_to_lookup diff --git a/nullplatform/service_definition/variables.tf b/nullplatform/service_definition/variables.tf index 85a92562b..2bd9b7d68 100644 --- a/nullplatform/service_definition/variables.tf +++ b/nullplatform/service_definition/variables.tf @@ -123,8 +123,12 @@ variable "package" { { url = "https://github.com/acme/svc.git", reference = "main" } for a git_repository, or { registry, repository, digest } for an oci_image); • look up one registered elsewhere BY IDENTITY (no ids needed) — set - `lookup = true` + `meta` with the identity fields (add digest/reference - to pin a specific revision, otherwise the latest revision is used); + `lookup = true` + `meta` with the identity fields (url for + git_repository, or registry+repository for oci_image); add the + type's own per-revision field to pin a specific revision (reference, + e.g. a tag, for git_repository; digest, formatted "sha256:<64-hex>", + for oci_image — the API rejects the other type's field name), + otherwise the latest revision is used; • pin explicit ids — set `resource_id` + `resource_revision_id`. An artifact's `name` defaults to "impl" and `type` to "git_repository" — From 1e03c43b74b24308daf0864b6694a3f01449940e Mon Sep 17 00:00:00 2001 From: sebas_correa Date: Wed, 2 Sep 2026 16:15:16 -0300 Subject: [PATCH 72/81] fix(service_definition_agent_association): correct base_clone_path default MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The nullplatform-agent image clones service repos under /home/agent/.np, not /root/.np — the previous default produced a cmdline pointing at a path that doesn't exist in the running agent container. BREAKING CHANGE: base_clone_path now defaults to /home/agent/.np. Callers relying on the old /root/.np default must now pass it explicitly. Co-Authored-By: Claude Sonnet 5 --- nullplatform/service_definition_agent_association/variables.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nullplatform/service_definition_agent_association/variables.tf b/nullplatform/service_definition_agent_association/variables.tf index ad6beeb94..ca83fece4 100644 --- a/nullplatform/service_definition_agent_association/variables.tf +++ b/nullplatform/service_definition_agent_association/variables.tf @@ -40,7 +40,7 @@ variable "repository_service_spec_repo" { variable "base_clone_path" { type = string - default = "/root/.np" + default = "/home/agent/.np" description = "Base path where the service repository is cloned inside the agent pod" } From 62a948593ce9f3250ba5439e74f6d0280613f9c2 Mon Sep 17 00:00:00 2001 From: sebas_correa Date: Wed, 2 Sep 2026 16:21:57 -0300 Subject: [PATCH 73/81] fix(agent): join --command-executor-git-command-repos with = like every other flag MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The flag was rendered as "flag value" (space) instead of "flag=value" like every sibling entry in default_args. Kubernetes passes each args[] entry as a single argv token, and the agent image's entrypoint shell re-splits it on that embedded space via unquoted expansion — the second word ($(AGENT_REPO)) then undergoes the shell's own command substitution (not k8s $(VAR) substitution), fails silently, and vanishes, leaving the flag with no value. Go's flag parser then aborts at startup: "flag needs an argument: -command-executor-git-command-repos", crash-looping the agent pod. Co-Authored-By: Claude Sonnet 5 --- nullplatform/agent/locals.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nullplatform/agent/locals.tf b/nullplatform/agent/locals.tf index 333feb4aa..4b4acfdcc 100644 --- a/nullplatform/agent/locals.tf +++ b/nullplatform/agent/locals.tf @@ -16,7 +16,7 @@ locals { "--command-executor-env=NP_API_KEY=$(NP_API_KEY)", "--command-executor-debug", "--webserver-enabled", - "--command-executor-git-command-repos $(AGENT_REPO)" + "--command-executor-git-command-repos=$(AGENT_REPO)" ] cloud_args = { From c9228ba27e956498895251ca92d7287647b3e0f7 Mon Sep 17 00:00:00 2001 From: sebas_correa Date: Wed, 2 Sep 2026 16:56:27 -0300 Subject: [PATCH 74/81] feat(scope_definition,service_definition): make package oci_image meta defaults overridable MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The registry/repository defaults for oci_image package artifacts were hardcoded locals in scope_definition. Turn them into var.package_oci_default_registry/var.package_oci_default_repository so an implementing module can override them per instantiation, and add the same merge to service_definition (which had no oci_image defaults at all). Per-artifact meta still wins over the default when explicitly set — only values omitted from meta fall back to the variable defaults. Co-Authored-By: Claude Sonnet 5 --- nullplatform/scope_definition/package.tf | 7 ++++--- nullplatform/scope_definition/variables.tf | 21 +++++++++++++++---- nullplatform/service_definition/package.tf | 17 +++++++++++++-- nullplatform/service_definition/variables.tf | 22 ++++++++++++++++++-- 4 files changed, 56 insertions(+), 11 deletions(-) diff --git a/nullplatform/scope_definition/package.tf b/nullplatform/scope_definition/package.tf index 50b78c810..5cd9ef9ff 100644 --- a/nullplatform/scope_definition/package.tf +++ b/nullplatform/scope_definition/package.tf @@ -16,10 +16,11 @@ locals { # oci_image is the only artifact type where "registry"/"repository" mean # anything — other types (git_repository, blob, oras_artifact) have an - # unrelated meta shape, so this default never applies to them. + # unrelated meta shape, so this default never applies to them. Overridable + # per implementing module via var.package_oci_default_registry/repository. package_oci_meta_defaults = { - registry = "public.ecr.aws" - repository = "nullplatform/scopes/containers" + registry = var.package_oci_default_registry + repository = var.package_oci_default_repository } # Artifacts split by intent: diff --git a/nullplatform/scope_definition/variables.tf b/nullplatform/scope_definition/variables.tf index 24e180e1e..7a4ba524a 100644 --- a/nullplatform/scope_definition/variables.tf +++ b/nullplatform/scope_definition/variables.tf @@ -198,10 +198,11 @@ variable "package" { For an "oci_image" artifact (the default type), `name` defaults to "worker-image" and meta.registry/meta.repository default to - "public.ecr.aws"/"nullplatform/scopes/containers" — the platform's own - container-scope worker image — when omitted from `meta`. Only meta.digest - needs setting on every release; every other artifact type gets no meta - defaults (their meta shape is unrelated to a container registry). + var.package_oci_default_registry/var.package_oci_default_repository — + the platform's own container-scope worker image — when omitted from + `meta`. Only meta.digest needs setting on every release; every other + artifact type gets no meta defaults (their meta shape is unrelated to a + container registry). Null (the default) keeps the classic module behavior — no package. EOT @@ -238,3 +239,15 @@ variable "package" { error_message = "`lookup = true` requires `meta` with the identity fields of the existing artifact." } } + +variable "package_oci_default_registry" { + description = "Default meta.registry for an oci_image package artifact whose own meta omits it. See var.package's artifacts docs." + type = string + default = "public.ecr.aws" +} + +variable "package_oci_default_repository" { + description = "Default meta.repository for an oci_image package artifact whose own meta omits it — the platform's own container-scope worker image. See var.package's artifacts docs." + type = string + default = "nullplatform/scopes/containers" +} diff --git a/nullplatform/service_definition/package.tf b/nullplatform/service_definition/package.tf index 3833b473a..af98998e7 100644 --- a/nullplatform/service_definition/package.tf +++ b/nullplatform/service_definition/package.tf @@ -19,16 +19,29 @@ locals { package_enabled = var.package != null + # oci_image is the only artifact type where "registry"/"repository" mean + # anything — other types (git_repository, blob, oras_artifact) have an + # unrelated meta shape, so this default never applies to them. Overridable + # per implementing module via var.package_oci_default_registry/repository. + package_oci_meta_defaults = { + registry = var.package_oci_default_registry + repository = var.package_oci_default_repository + } + # Artifacts split by intent: # create — `meta` given, lookup=false: register a new revision here # lookup — `meta` given, lookup=true: resolve an existing artifact by identity # pinned — explicit resource ids, taken as-is package_artifacts_to_create = local.package_enabled ? { - for a in var.package.artifacts : a.name => a if a.meta != null && !a.lookup + for a in var.package.artifacts : a.name => merge(a, { + meta = a.type == "oci_image" ? merge(local.package_oci_meta_defaults, a.meta) : a.meta + }) if a.meta != null && !a.lookup } : {} package_artifacts_to_lookup = local.package_enabled ? { - for a in var.package.artifacts : a.name => a if a.meta != null && a.lookup + for a in var.package.artifacts : a.name => merge(a, { + meta = a.type == "oci_image" ? merge(local.package_oci_meta_defaults, a.meta) : a.meta + }) if a.meta != null && a.lookup } : {} package_artifacts_existing = local.package_enabled ? { diff --git a/nullplatform/service_definition/variables.tf b/nullplatform/service_definition/variables.tf index 2bd9b7d68..a4cbaf844 100644 --- a/nullplatform/service_definition/variables.tf +++ b/nullplatform/service_definition/variables.tf @@ -134,8 +134,14 @@ variable "package" { An artifact's `name` defaults to "impl" and `type` to "git_repository" — a service package is typically a single artifact pointing at the service's own implementation repo, so only `meta` (url/reference) needs - setting on every release. Every other field, at every level, is - caller-configurable with no other defaults baked in. + setting on every release. + + For an artifact with `type = "oci_image"` (opt-in — not the default + here), meta.registry/meta.repository default to + var.package_oci_default_registry/var.package_oci_default_repository + when omitted from `meta`. Only meta.digest needs setting on every + release in that case; every other artifact type gets no meta defaults + (their meta shape is unrelated to a container registry). Null (the default) keeps the classic module behavior — no package. EOT @@ -172,3 +178,15 @@ variable "package" { error_message = "`lookup = true` requires `meta` with the identity fields of the existing artifact." } } + +variable "package_oci_default_registry" { + description = "Default meta.registry for an oci_image package artifact whose own meta omits it. See var.package's artifacts docs." + type = string + default = "public.ecr.aws" +} + +variable "package_oci_default_repository" { + description = "Default meta.repository for an oci_image package artifact whose own meta omits it. See var.package's artifacts docs." + type = string + default = "nullplatform/scopes/containers" +} From b518373344ddd891fa9c5497a8b1f2c00b972a37 Mon Sep 17 00:00:00 2001 From: sebas_correa Date: Wed, 2 Sep 2026 17:16:55 -0300 Subject: [PATCH 75/81] feat(service_definition_agent_association): add worker_orchestrator support Mirrors scope_definition_agent_association: when worker_orchestrator = true, the channel routes package-exec to an agent that spawns the package's worker image and runs its baked entrypoint (/app/packages//entrypoint by default), instead of the legacy git-clone exec flow. Required for a service whose package registers an oci_image artifact to actually spawn an np-worker pod. Co-Authored-By: Claude Sonnet 5 --- .../main.tf | 22 +++++++++++++++-- .../variables.tf | 24 +++++++++++++++++++ 2 files changed, 44 insertions(+), 2 deletions(-) diff --git a/nullplatform/service_definition_agent_association/main.tf b/nullplatform/service_definition_agent_association/main.tf index 09bcaeb0c..4de6039a7 100644 --- a/nullplatform/service_definition_agent_association/main.tf +++ b/nullplatform/service_definition_agent_association/main.tf @@ -1,4 +1,8 @@ +locals { + worker_entrypoint = var.entrypoint != "" ? var.entrypoint : "/app/packages/${var.package_slug}/entrypoint" +} + resource "terraform_data" "api_key_trigger" { input = var.api_key } @@ -14,8 +18,18 @@ resource "nullplatform_notification_channel" "channel_from_template" { agent { api_key = var.api_key command { - type = "exec" - data = { + # Worker-orchestrator: route package-exec to an agent that spawns the + # package's worker image and runs its baked entrypoint (matches + # `np package publish`). Otherwise legacy git-clone exec. + type = var.worker_orchestrator ? "package-exec" : "exec" + data = var.worker_orchestrator ? { + package = var.package_slug + cmdline = local.worker_entrypoint + environment = jsonencode({ + NP_ACTION_CONTEXT = "'$${NOTIFICATION_CONTEXT}'" + NP_PLUGIN = var.package_slug + }) + } : { cmdline = "${var.base_clone_path}/${var.repository_service_spec_repo}${var.service_path != "" ? "/${var.service_path}" : ""}/entrypoint/entrypoint" arguments = jsonencode(var.agent_arguments) environment = jsonencode({ NP_ACTION_CONTEXT = "'$${NOTIFICATION_CONTEXT}'" }) @@ -34,5 +48,9 @@ resource "nullplatform_notification_channel" "channel_from_template" { lifecycle { replace_triggered_by = [terraform_data.api_key_trigger] + precondition { + condition = !var.worker_orchestrator || var.package_slug != "" + error_message = "package_slug is required when worker_orchestrator = true." + } } } diff --git a/nullplatform/service_definition_agent_association/variables.tf b/nullplatform/service_definition_agent_association/variables.tf index ca83fece4..51bfdd12a 100644 --- a/nullplatform/service_definition_agent_association/variables.tf +++ b/nullplatform/service_definition_agent_association/variables.tf @@ -60,3 +60,27 @@ variable "description" { type = string default = "" } + +variable "worker_orchestrator" { + description = <<-EOT + Emit a worker-orchestrator (package-exec) channel instead of the legacy + git-clone exec channel. When true, the channel routes package-exec commands + to an agent that spawns the package's worker image and runs its baked + entrypoint — matching what `np package publish` registers. Requires + package_slug; set tags_selectors to select the agent (e.g. {package = slug}). + EOT + type = bool + default = false +} + +variable "package_slug" { + description = "Package/service slug — the package-exec NP_PLUGIN and default entrypoint path. Required when worker_orchestrator = true." + type = string + default = "" +} + +variable "entrypoint" { + description = "Override the worker's baked entrypoint path. Defaults to /app/packages//entrypoint." + type = string + default = "" +} From 67ec6e484a07b6f2dc7e883ea1470c1c84451d99 Mon Sep 17 00:00:00 2001 From: sebas_correa Date: Wed, 2 Sep 2026 17:24:50 -0300 Subject: [PATCH 76/81] fix(agent): worker serviceAccountName patch was hardcoded to the containers package MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit worker_container_patch (the only place serviceAccountName got set on a worker pod) targeted package = "containers" unconditionally, so any other worker-orchestrated package's pod fell back to the namespace's default ServiceAccount — no IRSA identity, so sts:AssumeRole failed with "Unable to locate credentials" (surfaced by the aws-s3-bucket service's worker trying to assume its permissions role). Add var.worker_orchestrated_packages (default ["containers"], preserving current behavior) and emit one serviceAccountName-only patch per listed package, separate from the containers-specific k8s-deployment env vars patch. Callers add a package's slug to the list to give its worker the agent's own ServiceAccount. Co-Authored-By: Claude Sonnet 5 --- nullplatform/agent/locals.tf | 35 ++++++++++++------- .../agent/tests/agent_values.tftest.hcl | 18 ++++++++++ nullplatform/agent/variables.tf | 17 +++++++++ 3 files changed, 57 insertions(+), 13 deletions(-) diff --git a/nullplatform/agent/locals.tf b/nullplatform/agent/locals.tf index 4b4acfdcc..bffc950aa 100644 --- a/nullplatform/agent/locals.tf +++ b/nullplatform/agent/locals.tf @@ -82,28 +82,37 @@ locals { var.extra_envs, ) + # Generic IRSA identity — one patch per package in var.worker_orchestrated_packages, + # so any worker-orchestrated package's pod (not just "containers") gets the + # agent's own ServiceAccount and can assume its role's trusted AWS roles. + worker_service_account_patches = var.service_account_name != "" ? [ + for pkg in var.worker_orchestrated_packages : { + target = { package = pkg } + merge = { spec = { serviceAccountName = var.service_account_name } } + } + ] : [] + + # k8s-deployment template env vars — specific to the "containers" scope's + # worker only, regardless of what's in var.worker_orchestrated_packages. worker_container_patch = { target = { package = "containers" } merge = { - spec = merge( - var.service_account_name != "" ? { serviceAccountName = var.service_account_name } : {}, - { - containers = [ - { - name = "worker" - resources = { limits = { memory = "2Gi" } } - env = [for k, v in local.worker_all_config : { name = k, value = v }] - } - ] - } - ) + spec = { + containers = [ + { + name = "worker" + resources = { limits = { memory = "2Gi" } } + env = [for k, v in local.worker_all_config : { name = k, value = v }] + } + ] + } } } worker_defaults = { backend = "kubernetes" allowedRegistries = ["public.ecr.aws/nullplatform/*"] - patches = [local.worker_container_patch] + patches = concat(local.worker_service_account_patches, [local.worker_container_patch]) } worker_final = merge( diff --git a/nullplatform/agent/tests/agent_values.tftest.hcl b/nullplatform/agent/tests/agent_values.tftest.hcl index ddc51278a..342ae8bd5 100644 --- a/nullplatform/agent/tests/agent_values.tftest.hcl +++ b/nullplatform/agent/tests/agent_values.tftest.hcl @@ -179,6 +179,24 @@ run "worker_service_account_mirrors_service_account_name" { } } +run "worker_orchestrated_packages_gets_its_own_service_account_patch" { + command = plan + + variables { + worker_orchestrated_packages = ["containers", "aws-s3-bucket"] + } + + assert { + condition = strcontains(helm_release.agent.values[0], "\"package\": \"aws-s3-bucket\"") + error_message = "a package listed in worker_orchestrated_packages must get its own patch target" + } + + assert { + condition = length(regexall("\"serviceAccountName\": \"nullplatform-agent\"", helm_release.agent.values[0])) == 2 + error_message = "each package in worker_orchestrated_packages must get its own serviceAccountName patch (one per package, here 2)" + } +} + run "worker_defaults" { command = plan diff --git a/nullplatform/agent/variables.tf b/nullplatform/agent/variables.tf index cff47514c..a1f8dd846 100644 --- a/nullplatform/agent/variables.tf +++ b/nullplatform/agent/variables.tf @@ -66,6 +66,23 @@ variable "service_account_name" { default = "nullplatform-agent" } +variable "worker_orchestrated_packages" { + description = <<-EOT + Package slugs whose worker-orchestrator (package-exec) pods should run + under var.service_account_name — the same IRSA identity as the agent + itself — via a per-package worker-container patch. Add a package's slug + here whenever its worker needs to assume an AWS role (or otherwise needs + the agent's ServiceAccount) to do its job; a worker for a package not + listed here falls back to the namespace's default ServiceAccount. + + This is separate from the "containers" scope's own k8s-deployment env + vars (DNS_TYPE, DOMAIN, etc.), which remain specific to that package + regardless of what's listed here. + EOT + type = list(string) + default = ["containers"] +} + # Version of the nullplatform agent Helm chart to deploy variable "nullplatform_agent_helm_version" { # example: 2.37.0 From 6c970bfe06247fdaacada7be8670a69ef76548b1 Mon Sep 17 00:00:00 2001 From: sebas_correa Date: Wed, 2 Sep 2026 17:40:53 -0300 Subject: [PATCH 77/81] fix(service_definition_agent_association): drop legacy-exec-only required variables MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit repository_service_spec_repo and service_path had no default, forcing every caller to set them even when worker_orchestrator = true — where they're never read (the worker's baked entrypoint is used instead). Give both a default of "" and add a precondition requiring repository_service_spec_repo (the one whose absence would produce a broken cmdline) only when worker_orchestrator = false, mirroring the existing package_slug-required- when-true precondition. Co-Authored-By: Claude Sonnet 5 --- .../service_definition_agent_association/main.tf | 4 ++++ .../service_definition_agent_association/variables.tf | 10 ++++++---- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/nullplatform/service_definition_agent_association/main.tf b/nullplatform/service_definition_agent_association/main.tf index 4de6039a7..291c0f4b0 100644 --- a/nullplatform/service_definition_agent_association/main.tf +++ b/nullplatform/service_definition_agent_association/main.tf @@ -52,5 +52,9 @@ resource "nullplatform_notification_channel" "channel_from_template" { condition = !var.worker_orchestrator || var.package_slug != "" error_message = "package_slug is required when worker_orchestrator = true." } + precondition { + condition = var.worker_orchestrator || var.repository_service_spec_repo != "" + error_message = "repository_service_spec_repo is required when worker_orchestrator = false." + } } } diff --git a/nullplatform/service_definition_agent_association/variables.tf b/nullplatform/service_definition_agent_association/variables.tf index 51bfdd12a..377d056a7 100644 --- a/nullplatform/service_definition_agent_association/variables.tf +++ b/nullplatform/service_definition_agent_association/variables.tf @@ -35,24 +35,26 @@ variable "service_specification_slug" { variable "repository_service_spec_repo" { type = string - description = "GitHub repository name containing the service specs (used to build the agent cmdline path)" + default = "" + description = "GitHub repository name containing the service specs (used to build the agent cmdline path). Required when worker_orchestrator = false; unused (the worker's baked entrypoint is used instead) when true." } variable "base_clone_path" { type = string default = "/home/agent/.np" - description = "Base path where the service repository is cloned inside the agent pod" + description = "Base path where the service repository is cloned inside the agent pod. Unused when worker_orchestrator = true." } variable "service_path" { type = string - description = "Path to the service directory within the repository (e.g., databases/postgres/k8s)" + default = "" + description = "Path to the service directory within the repository (e.g., databases/postgres/k8s). Only consulted when worker_orchestrator = false — empty omits the path segment." } variable "agent_arguments" { type = list(string) default = [] - description = "Arguments to pass to the agent entrypoint command" + description = "Arguments to pass to the agent entrypoint command. Unused when worker_orchestrator = true." } variable "description" { From 020e338b33379b1fd0af0da86726611312bdf6cb Mon Sep 17 00:00:00 2001 From: sebas_correa Date: Wed, 2 Sep 2026 18:19:40 -0300 Subject: [PATCH 78/81] fix(agent): worker memory limit was also hardcoded to the containers package MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Same bug class as the serviceAccountName fix: the 2Gi memory limit only applied via a patch targeting package = "containers", so any other worker-orchestrated package's pod fell back to the chart's own thin default (256Mi) — observed OOM-adjacent (255Mi/256Mi) on the aws-s3-bucket service's worker mid-tofu-apply, which manifested as the agent's package-exec command hanging forever with no output. Fold the memory-limit patch into the same var.worker_orchestrated_packages loop as serviceAccountName (new var.worker_memory_limit, default 2Gi preserves current behavior for "containers"), leaving the containers-only patch with just its k8s-deployment env vars. Co-Authored-By: Claude Sonnet 5 --- nullplatform/agent/locals.tf | 30 ++++++++++++------- .../agent/tests/agent_values.tftest.hcl | 19 ++++++++++++ nullplatform/agent/variables.tf | 17 +++++++---- 3 files changed, 51 insertions(+), 15 deletions(-) diff --git a/nullplatform/agent/locals.tf b/nullplatform/agent/locals.tf index bffc950aa..619d897ce 100644 --- a/nullplatform/agent/locals.tf +++ b/nullplatform/agent/locals.tf @@ -82,15 +82,26 @@ locals { var.extra_envs, ) - # Generic IRSA identity — one patch per package in var.worker_orchestrated_packages, - # so any worker-orchestrated package's pod (not just "containers") gets the - # agent's own ServiceAccount and can assume its role's trusted AWS roles. - worker_service_account_patches = var.service_account_name != "" ? [ + # Generic identity + resources — one patch per package in + # var.worker_orchestrated_packages, so any worker-orchestrated package's pod + # (not just "containers") gets the agent's own ServiceAccount (to assume its + # role's trusted AWS roles) and enough memory to run its own tooling (e.g. + # tofu init/apply), instead of the chart's own thin defaults. + worker_common_patches = [ for pkg in var.worker_orchestrated_packages : { target = { package = pkg } - merge = { spec = { serviceAccountName = var.service_account_name } } + merge = { + spec = merge( + var.service_account_name != "" ? { serviceAccountName = var.service_account_name } : {}, + { + containers = [ + { name = "worker", resources = { limits = { memory = var.worker_memory_limit } } } + ] + } + ) + } } - ] : [] + ] # k8s-deployment template env vars — specific to the "containers" scope's # worker only, regardless of what's in var.worker_orchestrated_packages. @@ -100,9 +111,8 @@ locals { spec = { containers = [ { - name = "worker" - resources = { limits = { memory = "2Gi" } } - env = [for k, v in local.worker_all_config : { name = k, value = v }] + name = "worker" + env = [for k, v in local.worker_all_config : { name = k, value = v }] } ] } @@ -112,7 +122,7 @@ locals { worker_defaults = { backend = "kubernetes" allowedRegistries = ["public.ecr.aws/nullplatform/*"] - patches = concat(local.worker_service_account_patches, [local.worker_container_patch]) + patches = concat(local.worker_common_patches, [local.worker_container_patch]) } worker_final = merge( diff --git a/nullplatform/agent/tests/agent_values.tftest.hcl b/nullplatform/agent/tests/agent_values.tftest.hcl index 342ae8bd5..e075e9e2b 100644 --- a/nullplatform/agent/tests/agent_values.tftest.hcl +++ b/nullplatform/agent/tests/agent_values.tftest.hcl @@ -195,6 +195,25 @@ run "worker_orchestrated_packages_gets_its_own_service_account_patch" { condition = length(regexall("\"serviceAccountName\": \"nullplatform-agent\"", helm_release.agent.values[0])) == 2 error_message = "each package in worker_orchestrated_packages must get its own serviceAccountName patch (one per package, here 2)" } + + assert { + condition = length(regexall("\"memory\": \"2Gi\"", helm_release.agent.values[0])) == 2 + error_message = "each package in worker_orchestrated_packages must get its own memory limit patch (one per package, here 2) — a package left out would silently OOM on the chart's thin default" + } +} + +run "worker_memory_limit_is_overridable" { + command = plan + + variables { + worker_orchestrated_packages = ["containers", "aws-s3-bucket"] + worker_memory_limit = "4Gi" + } + + assert { + condition = length(regexall("\"memory\": \"4Gi\"", helm_release.agent.values[0])) == 2 + error_message = "worker_memory_limit must apply to every package in worker_orchestrated_packages" + } } run "worker_defaults" { diff --git a/nullplatform/agent/variables.tf b/nullplatform/agent/variables.tf index a1f8dd846..715a25831 100644 --- a/nullplatform/agent/variables.tf +++ b/nullplatform/agent/variables.tf @@ -69,11 +69,12 @@ variable "service_account_name" { variable "worker_orchestrated_packages" { description = <<-EOT Package slugs whose worker-orchestrator (package-exec) pods should run - under var.service_account_name — the same IRSA identity as the agent - itself — via a per-package worker-container patch. Add a package's slug - here whenever its worker needs to assume an AWS role (or otherwise needs - the agent's ServiceAccount) to do its job; a worker for a package not - listed here falls back to the namespace's default ServiceAccount. + under var.service_account_name (the same IRSA identity as the agent + itself) and var.worker_memory_limit, via a per-package worker-container + patch. Add a package's slug here whenever its worker needs to assume an + AWS role, or needs more memory than the chart's own default (e.g. to run + tofu/terraform); a worker for a package not listed here falls back to the + namespace's default ServiceAccount and the chart's own memory default. This is separate from the "containers" scope's own k8s-deployment env vars (DNS_TYPE, DOMAIN, etc.), which remain specific to that package @@ -83,6 +84,12 @@ variable "worker_orchestrated_packages" { default = ["containers"] } +variable "worker_memory_limit" { + description = "Memory limit for a worker-orchestrated package's pod (packages in var.worker_orchestrated_packages). The chart's own default is small enough to OOM mid-tofu-apply for packages that run real IaC tooling." + type = string + default = "2Gi" +} + # Version of the nullplatform agent Helm chart to deploy variable "nullplatform_agent_helm_version" { # example: 2.37.0 From cfa59482948b7a5dbafbf8338b32971acb84a92e Mon Sep 17 00:00:00 2001 From: sebas_correa Date: Thu, 3 Sep 2026 09:56:15 -0300 Subject: [PATCH 79/81] fix(agent): port the safe parts of 6.x's #519 (helm reliability + deprecated inputs) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cherry-picks the isolated, non-conflicting pieces of 6.x commit 747cb461 ("restore the inputs and Helm flags dropped in v6.14.0"). The rest of that commit (agent_repos_scope/agent_repos_extra restoration, ingress_type) is skipped — this branch already replaced that system with agent_repo and handles service_template/ingress paths differently; porting it wholesale would revert today's worker_orchestrated_packages/worker_memory_limit work. - create_namespace/atomic/cleanup_on_fail on helm_release.agent: the provider defaults all three to false, so a fresh install can die on a missing namespace and a failed upgrade sticks in "failed" with orphaned resources instead of rolling back — the exact "Error upgrading chart: context deadline exceeded" stuck-release state hit earlier in this same session. - nrn/private_domain restored as deprecated no-op inputs, so a caller on an older module version passing them doesn't fail at init. - all_config drops null values before reaching templatefile(), which otherwise fails with an error naming no variable. Co-Authored-By: Claude Sonnet 5 --- nullplatform/agent/locals.tf | 19 +++++++--- nullplatform/agent/main.tf | 8 +++++ .../agent/tests/agent_values.tftest.hcl | 36 +++++++++++++++++++ nullplatform/agent/variables.tf | 29 +++++++++++++++ 4 files changed, 87 insertions(+), 5 deletions(-) diff --git a/nullplatform/agent/locals.tf b/nullplatform/agent/locals.tf index 619d897ce..21812da07 100644 --- a/nullplatform/agent/locals.tf +++ b/nullplatform/agent/locals.tf @@ -45,11 +45,20 @@ locals { oci = {} } - all_config = merge( - local.default_config, - lookup(local.cloud_config, var.cloud_provider, {}), - var.extra_envs, - ) + # Referenced so that deleting either variable fails `tofu validate` in CI. + # `tofu test` alone would not catch it: it tolerates a `var.x` that no longer exists. + # tflint-ignore: terraform_unused_declarations + deprecated_inputs_accepted = [var.nrn, var.private_domain] + + # Drop nulls: a null reaching templatefile fails with an error that names no + # variable, before any precondition gets to report the actual missing input. + all_config = { + for k, v in merge( + local.default_config, + lookup(local.cloud_config, var.cloud_provider, {}), + var.extra_envs, + ) : k => v if v != null + } worker_default_env = { DNS_TYPE = var.dns_type diff --git a/nullplatform/agent/main.tf b/nullplatform/agent/main.tf index 5a4d5ed25..6af1c9985 100644 --- a/nullplatform/agent/main.tf +++ b/nullplatform/agent/main.tf @@ -59,6 +59,14 @@ resource "helm_release" "agent" { namespace = var.namespace version = var.nullplatform_agent_helm_version + # The provider defaults these three to false. Without create_namespace a fresh + # install dies with `namespaces "" not found`; without + # atomic/cleanup_on_fail a failed upgrade sticks in `failed` with orphaned + # resources instead of rolling back. + create_namespace = var.create_namespace + atomic = true + cleanup_on_fail = true + wait_for_jobs = true timeout = 600 reset_values = true diff --git a/nullplatform/agent/tests/agent_values.tftest.hcl b/nullplatform/agent/tests/agent_values.tftest.hcl index e075e9e2b..038d0f35f 100644 --- a/nullplatform/agent/tests/agent_values.tftest.hcl +++ b/nullplatform/agent/tests/agent_values.tftest.hcl @@ -289,3 +289,39 @@ run "agent_repo_defaults_to_empty" { error_message = "agent_repo must default to an empty list, joining to an empty string" } } + +# atomic/cleanup_on_fail default to false in the provider — without them a +# failed upgrade sticks in "failed" with orphaned resources instead of rolling +# back (observed in production: an "Error upgrading chart" left the release +# stuck until a manual retry). +run "helm_release_rolls_back_failed_upgrades" { + command = plan + + assert { + condition = helm_release.agent.atomic == true + error_message = "atomic must be true so a failed upgrade rolls back instead of sticking in failed" + } + + assert { + condition = helm_release.agent.cleanup_on_fail == true + error_message = "cleanup_on_fail must be true so a failed upgrade cleans up orphaned resources" + } + + assert { + condition = helm_release.agent.create_namespace == true + error_message = "create_namespace must default to true (the pre-existing behavior) so a fresh install doesn't die on a missing namespace" + } +} + +run "create_namespace_is_overridable" { + command = plan + + variables { + create_namespace = false + } + + assert { + condition = helm_release.agent.create_namespace == false + error_message = "create_namespace must be overridable to false for stacks where another module already owns the namespace" + } +} diff --git a/nullplatform/agent/variables.tf b/nullplatform/agent/variables.tf index 715a25831..1754886ab 100644 --- a/nullplatform/agent/variables.tf +++ b/nullplatform/agent/variables.tf @@ -136,6 +136,12 @@ variable "namespace" { default = "nullplatform-tools" } +variable "create_namespace" { + description = "Create the namespace if it does not exist. Leave true unless another module already owns it: nullplatform/base declares the same namespace with Helm ownership metadata, so with no ordering edge between the two whichever applies second fails." + type = bool + default = true +} + variable "agent_traffic_manager_repository" { description = "Container image repository for the traffic manager. Defaults to the official nullplatform image; override to pull from a mirror. Matches the pattern nullplatform/base uses for its own images." type = string @@ -311,3 +317,26 @@ variable "extra_envs" { type = map(string) default = {} } + +################################################################################ +# Deprecated inputs +# +# Restored: OpenTofu rejects an argument for a variable that does not exist, so +# a caller still passing these on an older module version fails at init the +# moment it bumps up. Intentionally unused. Drop them on the next major, with a +# BREAKING CHANGE footer. +################################################################################ + +# tflint-ignore: terraform_unused_declarations +variable "nrn" { + description = "DEPRECATED, accepted for compatibility and ignored. Nullplatform Resource Name; the agent resolves its own scope from the API key, so this module never consumed the value" + type = string + default = "" +} + +# tflint-ignore: terraform_unused_declarations +variable "private_domain" { + description = "DEPRECATED, accepted for compatibility and ignored. Previously rendered as the PRIVATE_DOMAIN env var for gcp and oci, which nothing in nullplatform/scopes reads" + type = string + default = "" +} From 2302ecc837917c0a40111239557f6743a82f9553 Mon Sep 17 00:00:00 2001 From: sebas_correa Date: Thu, 3 Sep 2026 09:58:08 -0300 Subject: [PATCH 80/81] feat(api_key): add the internal option (port from 6.x #547) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Ports 6.x commit 1189c569 as-is — small, additive, opt-in (default null), no overlap with anything touched on this branch. The keys this module creates (agent, notification-channel) are platform plumbing and show up in the API key listing alongside user-managed keys; var.internal keeps a key out of that listing via the provider's internal mark (create-only, so changing it replaces the key and rotates its secret). Bumps the provider floor to ~> 0.0.101, which publishes the internal attribute (already the version resolved elsewhere on this branch). Co-Authored-By: Claude Sonnet 5 --- nullplatform/api_key/.terraform.lock.hcl | 34 +++++++++---------- nullplatform/api_key/main.tf | 3 +- nullplatform/api_key/providers.tf | 2 +- nullplatform/api_key/tests/api_key.tftest.hcl | 27 +++++++++++++++ nullplatform/api_key/variables.tf | 10 ++++++ 5 files changed, 56 insertions(+), 20 deletions(-) diff --git a/nullplatform/api_key/.terraform.lock.hcl b/nullplatform/api_key/.terraform.lock.hcl index af891c76f..ad7ad8161 100644 --- a/nullplatform/api_key/.terraform.lock.hcl +++ b/nullplatform/api_key/.terraform.lock.hcl @@ -2,25 +2,23 @@ # Manual edits may be lost in future updates. provider "registry.opentofu.org/nullplatform/nullplatform" { - version = "0.0.95" - constraints = "~> 0.0.86" + version = "0.0.101" + constraints = "~> 0.0.101" hashes = [ - "h1:CwWF67wR7+i4kIqtQ6t6wDwJTCnnfwbK60B5zH2xMCo=", - "h1:TOKlvQhgsNAlXDVB9jNfTUTMIOgxgMJgHsr7AqTVtdA=", - "h1:UYs+ehJD8m3YGSb1vZUfFbYBHBRBj/Kn15Lp6OK2M5Y=", - "zh:02ec1e02e738e5f138e919d17391966e4b92d6933b6cd318eaed85e908f5cc8c", - "zh:1b2015fa088a40c4dcaef803d71942909ec45036524c12ca18272bf37dbf9283", - "zh:213f5ab10cc4c95e4568fdd10fec55886615978617b5815c9a900f233b4dca6e", - "zh:2a0ae4273515079385926beedeaf034257c4ee08e78733e19676fac9db4fd8d1", - "zh:356c2f91085ac397c419650a55c2ec8551da811db503a3dc0e510e05ca8fba42", - "zh:40bbd8163228b1ae88d515c643922c0565b015559b01023bc2ababdb3ad13e5c", - "zh:42ab71a0675b06fe3f661704142be8ddb029f052e3a001115fbb3ad0ee5e97f4", - "zh:46c6130dd7688a372a244c388f8568ddd12512e6d70d16b924495a4088f5ed4a", - "zh:5d862aa4ffa4f452a03e9a8ad3922a25674aff0a9770b674e09a68a087db17bb", - "zh:94cfe1a3446c4ea48d16b10c0b50f99bee89218f0a054514a97215c3af43c427", - "zh:aef3d42714928ca4099768efdaaf0d6eedab717d2b133ccb5de67167dfc24332", - "zh:e28d2e0a9b297c84dd18f1ab0a4f986108d2e1571523b15389473be4c267e917", - "zh:f1dd95be9f23c5602fcfca965832984f6d4411258c4ea87f69177a4604a5f39a", + "h1:XPoJp1UoUkgc5wOHFT2QUAjXrKTlZmAktgjIOKAAzfU=", + "zh:1b7fcf7075a3d18afe92bdb9f62420672d7fea7a4cf74dad5cfdd6cdc71d9e6a", + "zh:1bbb2061fa2e5102c0175b3679c93bde5b0f191041e671c2d8b0cc625e169954", + "zh:275d02069d39671bf848d14c258cbae5da88c8ef6b80839721d1fe07392485e0", + "zh:2bbb4d28410843cd949ab879d608fb25698c17ad735eb2fc3197221a041d2f57", + "zh:63dee806c8369f5fa77ff69b20b8cc3c76ce6c073b0b18ef776c89e54cc3cc79", + "zh:66ec8c5f0160cf9ddb0a8fc39a02655dc01baf982d3146c05905b6a2b92d0c4d", + "zh:94a517139d2bcf5b9d33234a00ebc65313952ad1d79958dfdd6dd165fb7952c8", + "zh:97357339d3d6b0dd61d7f05a60fbcb3a2ed9e1775551e875672b20828bcf010c", + "zh:a3ccf69e8dc785e80f1ad4ef4a42980ce3a89afda6f0a547075fffc81d8baea2", + "zh:ccd32a4c72f185f374a95e16a07685cad70224328fc434495d2545481a604c8b", + "zh:d7b50bb2561dafa32e27b92f37efeb450372003425873c5b247c9b7e4c25e219", + "zh:e35f4f870bd060e15e0a3d19e18e50bac346c24ba8c1ec1e198d441febadc696", + "zh:f4fbbed70bacbf83a5748e9d0a229dc07dfc34f683790ea86fb62fcfc9bee508", "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c", ] } diff --git a/nullplatform/api_key/main.tf b/nullplatform/api_key/main.tf index cdff31d5a..37fe5becd 100644 --- a/nullplatform/api_key/main.tf +++ b/nullplatform/api_key/main.tf @@ -3,7 +3,8 @@ ################################################################################ resource "nullplatform_api_key" "this" { - name = local.config.name + name = local.config.name + internal = var.internal dynamic "grants" { for_each = tomap({ for idx, grant in local.grants : tostring(idx) => grant }) diff --git a/nullplatform/api_key/providers.tf b/nullplatform/api_key/providers.tf index 903a15d7b..0afb9d176 100644 --- a/nullplatform/api_key/providers.tf +++ b/nullplatform/api_key/providers.tf @@ -2,7 +2,7 @@ terraform { required_providers { nullplatform = { source = "nullplatform/nullplatform" - version = "~> 0.0.86" + version = "~> 0.0.101" } } } diff --git a/nullplatform/api_key/tests/api_key.tftest.hcl b/nullplatform/api_key/tests/api_key.tftest.hcl index 49d60bcbc..9148f1349 100644 --- a/nullplatform/api_key/tests/api_key.tftest.hcl +++ b/nullplatform/api_key/tests/api_key.tftest.hcl @@ -212,3 +212,30 @@ run "custom_grants_explicit_nrn" { error_message = "Should have grant for organization=myorg:account=myaccount with role developer" } } + +run "internal_reaches_the_api_key" { + command = plan + + variables { + internal = true + } + + assert { + condition = nullplatform_api_key.this.internal == true + error_message = "internal = true should reach the nullplatform_api_key resource" + } +} + +# An explicit false still travels; the module never decides the mark on the caller's behalf. +run "internal_off_is_explicit" { + command = plan + + variables { + internal = false + } + + assert { + condition = nullplatform_api_key.this.internal == false + error_message = "internal = false should reach the nullplatform_api_key resource" + } +} diff --git a/nullplatform/api_key/variables.tf b/nullplatform/api_key/variables.tf index 01ac8daa0..d6663a6ae 100644 --- a/nullplatform/api_key/variables.tf +++ b/nullplatform/api_key/variables.tf @@ -57,3 +57,13 @@ variable "custom_tags" { })) default = [] } + +################################################################################ +# Visibility +################################################################################ + +variable "internal" { + description = "Marks the API key as internal to nullplatform, keeping it out of the API key listing (`GET /api_key` and the UI) while it stays readable by ID — for the plumbing credentials this module creates (agents, notification channels) rather than keys a person manages. Create-only in the API, so changing it replaces the key and rotates its secret. Leave unset for the platform default (not internal)." + type = bool + default = null +} From 8bb4d7791c0df31f5fd70a552a2442f9b4db2db0 Mon Sep 17 00:00:00 2001 From: sebas_correa Date: Thu, 3 Sep 2026 10:01:18 -0300 Subject: [PATCH 81/81] fix(agent): drop the nrn/private_domain deprecated no-ops MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Their only purpose was 6.x backward compatibility (a caller on an older module version passing them shouldn't fail at init) — this branch targets main/7.x, a new major where breaking changes are allowed, and no caller visible from this repo or its consumers passes either. Keeping an unused compatibility shim for a constraint that doesn't apply to this line serves no purpose. Co-Authored-By: Claude Sonnet 5 --- nullplatform/agent/locals.tf | 5 ----- nullplatform/agent/variables.tf | 23 ----------------------- 2 files changed, 28 deletions(-) diff --git a/nullplatform/agent/locals.tf b/nullplatform/agent/locals.tf index 21812da07..e7bde3127 100644 --- a/nullplatform/agent/locals.tf +++ b/nullplatform/agent/locals.tf @@ -45,11 +45,6 @@ locals { oci = {} } - # Referenced so that deleting either variable fails `tofu validate` in CI. - # `tofu test` alone would not catch it: it tolerates a `var.x` that no longer exists. - # tflint-ignore: terraform_unused_declarations - deprecated_inputs_accepted = [var.nrn, var.private_domain] - # Drop nulls: a null reaching templatefile fails with an error that names no # variable, before any precondition gets to report the actual missing input. all_config = { diff --git a/nullplatform/agent/variables.tf b/nullplatform/agent/variables.tf index 1754886ab..b0ee81afc 100644 --- a/nullplatform/agent/variables.tf +++ b/nullplatform/agent/variables.tf @@ -317,26 +317,3 @@ variable "extra_envs" { type = map(string) default = {} } - -################################################################################ -# Deprecated inputs -# -# Restored: OpenTofu rejects an argument for a variable that does not exist, so -# a caller still passing these on an older module version fails at init the -# moment it bumps up. Intentionally unused. Drop them on the next major, with a -# BREAKING CHANGE footer. -################################################################################ - -# tflint-ignore: terraform_unused_declarations -variable "nrn" { - description = "DEPRECATED, accepted for compatibility and ignored. Nullplatform Resource Name; the agent resolves its own scope from the API key, so this module never consumed the value" - type = string - default = "" -} - -# tflint-ignore: terraform_unused_declarations -variable "private_domain" { - description = "DEPRECATED, accepted for compatibility and ignored. Previously rendered as the PRIVATE_DOMAIN env var for gcp and oci, which nothing in nullplatform/scopes reads" - type = string - default = "" -}