| additional_access_entry |
A single access entry. Useful when providing access to an additional role. |
map(any) |
{} |
no |
| additional_irsas |
List of additional IRSA accounts to create. |
list(object({
role_name = string,
namespace = string,
service_account = string,
})) |
[] |
no |
| additional_namespaces |
A list of namespaces that should be created on the cluster. The {{.nuon.install.id}} namespace is created by default. |
list(string) |
[] |
no |
| additional_tags |
Extra tags to append to the default tags that will be added to install resources. |
map(any) |
{} |
no |
| break_glass_iam_role_arn |
The break glass IAM Role ARN. If provided, an EKS access entry will be created for this role. |
string |
"" |
no |
| break_glass_role_eks_access_entry_policy_associations |
EKS Cluster Access Entry Policy Associations for break glass role. |
map(any) |
{
"cluster_admin": {
"access_scope": {
"type": "cluster"
},
"policy_arn": "arn:aws:eks::aws:cluster-access-policy/AmazonEKSClusterAdminPolicy"
},
"eks_admin": {
"access_scope": {
"type": "cluster"
},
"policy_arn": "arn:aws:eks::aws:cluster-access-policy/AmazonEKSAdminPolicy"
}
} |
no |
| break_glass_role_eks_kubernetes_groups |
List of Kubernetes Groups to add the break glass role to. The break glass role is assigned to a break_glass group automatically. These are additional groups. |
list(any) |
[] |
no |
| cluster_endpoint_public_access |
Whether the EKS cluster API server endpoint is publicly accessible. |
bool |
false |
no |
| cluster_name |
The name of the EKS cluster. If not provided, the install ID will be used by default. |
string |
"" |
no |
| cluster_version |
The Kubernetes version to use for the EKS cluster. |
string |
"1.32" |
no |
| default_instance_type |
The EC2 instance type to use for the EKS cluster's default node group. |
string |
"t3a.medium" |
no |
| deprovision_iam_role_arn |
The deprovision IAM Role ARN |
string |
n/a |
yes |
| deprovision_role_eks_access_entry_policy_associations |
EKS Cluster Access Entry Policy Associations for deprovision role. |
map(any) |
{
"cluster_admin": {
"access_scope": {
"type": "cluster"
},
"policy_arn": "arn:aws:eks::aws:cluster-access-policy/AmazonEKSClusterAdminPolicy"
},
"eks_admin": {
"access_scope": {
"type": "cluster"
},
"policy_arn": "arn:aws:eks::aws:cluster-access-policy/AmazonEKSAdminPolicy"
}
} |
no |
| deprovision_role_eks_kubernetes_groups |
List of Kubernetes Groups to add this role to. The deprovision role is assigned to a deprovision group automatically. These are additional groups. |
list(any) |
[] |
no |
| desired_size |
The desired number of nodes in the managed node group. |
number |
3 |
no |
| enable_nuon_dns |
Whether or not the cluster should use a nuon-provided nuon.run domain. Controls the cert-manager-issuer and the route_53_zone. |
string |
"false" |
no |
| helm_driver |
One of 'configmap' or 'secret' |
string |
"secret" |
no |
| internal_root_domain |
The internal root domain. |
string |
n/a |
yes |
| kyverno_policy_dir |
Path to a directory with kyverno policy manifests. |
string |
"./kyverno-policies" |
no |
| maintenance_cluster_role_rules_override |
A list of rules for the ClusterRole definition for the maintenance group. If this value is provided, these rules will be used instead. |
list(object({
apiGroups = list(string),
resources = list(string),
verbs = list(string),
resourceNames = optional(list(string)),
})) |
[] |
no |
| maintenance_iam_role_arn |
The provision IAM Role ARN |
string |
n/a |
yes |
| maintenance_role_eks_access_entry_policy_associations |
EKS Cluster Access Entry Policy Associations for maintenance role. Defaults to none meaning permissions are governed by eponymous RBAC group. |
map(any) |
{} |
no |
| maintenance_role_eks_kubernetes_groups |
List of Kubernetes Groups to add this role to. The maintenance role is assigned to a maintenance group automatically. These are additional groups. |
list(any) |
[] |
no |
| max_size |
The maximum number of nodes in the managed node group. |
number |
5 |
no |
| min_size |
The minimum number of nodes in the managed node group. |
number |
2 |
no |
| nuon_id |
The nuon id for this install. Used for naming purposes. |
string |
n/a |
yes |
| provision_iam_role_arn |
The maintenance IAM Role ARN |
string |
n/a |
yes |
| provision_role_eks_access_entry_policy_associations |
EKS Cluster Access Entry Policy Associations for provision role. |
map(any) |
{
"cluster_admin": {
"access_scope": {
"type": "cluster"
},
"policy_arn": "arn:aws:eks::aws:cluster-access-policy/AmazonEKSClusterAdminPolicy"
},
"eks_admin": {
"access_scope": {
"type": "cluster"
},
"policy_arn": "arn:aws:eks::aws:cluster-access-policy/AmazonEKSAdminPolicy"
}
} |
no |
| provision_role_eks_kubernetes_groups |
List of Kubernetes Groups to add this role to. The provision role is assigned to a provision group automatically. These are additional groups. |
list(any) |
[] |
no |
| public_root_domain |
The public root domain. |
string |
n/a |
yes |
| region |
The region to launch the cluster in. |
string |
n/a |
yes |
| tags |
List of custom tags to add to the install resources. Used for taxonomic purposes. |
map(any) |
n/a |
yes |
| vpc_id |
The ID of the AWS VPC to provision the sandbox in. |
string |
n/a |
yes |