`) that must agree across clusters, and labels per-cluster resources. | `number` | n/a | yes |
| app\_image\_pull\_policy | imagePullPolicy for the orchestrator/policy-server/UI containers (sets the chart-wide imagePullPolicy). null keeps the chart default (IfNotPresent); set "Always" for a mutable tag like latest. | `string` | `null` | no |
| azure\_oauth\_client\_id | Entra ID (Azure AD) client ID for the vault UI. | `string` | `""` | no |
| azure\_tenant\_id | Entra ID tenant ID for the vault UI. | `string` | `""` | no |
| bootstrap\_approval\_threshold | Policy-server signature quorum. The deployment is hard-pinned to 1. | `number` | `1` | no |
| db\_allocated\_storage | Initial allocated storage (GB) for the PostgreSQL instance. | `number` | `20` | no |
| db\_app\_username | Non-superuser PostgreSQL role created by the in-cluster bootstrap job. The chart reads this as `postgresql.credentials.username`. | `string` | `"crypto_vault"` | no |
| db\_backup\_retention\_period | RDS automated-backup retention window in days (1-35). | `number` | `7` | no |
| db\_backup\_window | Daily UTC window for RDS automated backups ("hh:mm-hh:mm"). Must not overlap db\_maintenance\_window. | `string` | `"03:00-04:00"` | no |
| db\_cloudwatch\_logs\_enabled | Ship RDS PostgreSQL logs to CloudWatch. | `bool` | `true` | no |
| db\_cloudwatch\_logs\_exports | Log types to export when CloudWatch logging is enabled. | `list(string)` | \[
"postgresql",
"upgrade"
]
| no |
| db\_deletion\_protection | Enable RDS deletion protection. Should be true in production. | `bool` | `true` | no |
| db\_engine\_version | PostgreSQL major version for the RDS instance. | `string` | `"17"` | no |
| db\_force\_ssl | Enforce TLS on RDS (rds.force\_ssl=1) and connect the app with sslmode=require. REQUIRES the app binaries (orchestrator / policy-server / mpc-key-store) to be built with a SQLx TLS backend — historically they were not, so if those pods can't reach the DB (connection errors / CrashLoop), set this to false to allow plaintext while the app gains TLS support. The bootstrap Job uses libpq (psql) and negotiates TLS regardless, so it is unaffected. | `bool` | `true` | no |
| db\_instance\_type | RDS instance class for the per-cluster PostgreSQL database. | `string` | `"db.t3.small"` | no |
| db\_maintenance\_window | Weekly UTC window for RDS maintenance ("ddd:hh:mm-ddd:hh:mm"). | `string` | `"mon:04:00-mon:05:00"` | no |
| db\_max\_allocated\_storage | Storage autoscaling upper bound (GB). | `number` | `100` | no |
| db\_multi\_az | Enable Multi-AZ failover for the RDS instance. | `bool` | `true` | no |
| db\_performance\_insights\_enabled | Enable RDS Performance Insights. | `bool` | `true` | no |
| db\_performance\_insights\_retention\_period | Performance Insights retention in days. 7 is the free tier; 731 (2 years) and multiples of 31 thereafter are the paid tiers. | `number` | `7` | no |
| db\_skip\_final\_snapshot | Skip the RDS final snapshot on destroy. Defaults to false (production-safe: a final snapshot is taken before deletion). Set true for throwaway/CI stacks so repeated create/destroy cycles don't accumulate orphaned final-\* snapshots (storage cost). | `bool` | `false` | no |
| eks\_cloudwatch\_log\_retention\_in\_days | Retention (days) for EKS control-plane CloudWatch logs. 0 = indefinite. | `number` | `90` | no |
| eks\_cloudwatch\_log\_types | Control-plane log types to ship when CloudWatch logging is enabled. | `list(string)` | \[
"audit",
"api",
"authenticator"
]
| no |
| eks\_cloudwatch\_logs\_enabled | Send EKS control-plane logs to CloudWatch. | `bool` | `true` | no |
| eks\_cluster\_version | Kubernetes version for the EKS cluster. | `string` | `"1.35"` | no |
| eks\_endpoint\_public\_access | Expose the EKS API server endpoint publicly (still filtered by eks\_endpoint\_public\_access\_cidrs). Private (in-VPC) access is always enabled. Defaults to FALSE — production-safe private-only posture: the machine running Terraform (the kubernetes + helm providers target the API) must reach the private endpoint over the VPC / a peered network / VPN, or the apply will hang. Set true (and tighten eks\_endpoint\_public\_access\_cidrs) only when you need to reach the API from outside the VPC, e.g. the example's apply-from-anywhere flow. | `bool` | `false` | no |
| eks\_endpoint\_public\_access\_cidrs | CIDR blocks allowed to reach the EKS API server when eks\_endpoint\_public\_access = true. Defaults to unrestricted (0.0.0.0/0) for first-run convenience — TIGHTEN to your operator / CI egress CIDRs for anything beyond a throwaway test cluster. | `list(string)` | \[
"0.0.0.0/0"
]
| no |
| eks\_general\_node\_groups\_per\_az | When true (default), run one general-tier node group per AZ (each a single-subnet ASG) so every AZ always has a schedulable node for AZ-locked EBS volumes (NATS JetStream) — preventing the 'orphaned NATS PV' deadlock and matching the Cluster-Autoscaler topology for zonal volumes (eks\_general\_node\_min\_size then applies per group). When false, run a single multi-AZ general group — the cheap single-replica footprint, where NATS is single-pod and needs no zonal-volume HA. The examples/aws wrapper sets this to var.chart\_ha. | `bool` | `true` | no |
| eks\_general\_node\_instance\_types | EC2 instance types for the general (untainted, non-Nitro) node group that runs everything except the enclave pods — orchestrator, policy-server, NATS, relay, UI, cluster controllers. Need not support Nitro Enclaves. Defaults to m5.xlarge (4 vCPU): the orchestrator and relay-router are each CPU-heavy on the signing hot path and want up to ~2 cores apiece (a single orchestrator sustains ~1.2 cores under load, so a 2-vCPU node packs the hot-path pods too tight); 4 vCPU gives the hot-path pods room and reduces node sprawl. | `list(string)` | \[
"m5.xlarge"
]
| no |
| eks\_general\_node\_max\_size | Maximum nodes per general node group. | `number` | `6` | no |
| eks\_general\_node\_min\_size | Minimum nodes PER general node group. With eks\_general\_node\_groups\_per\_az=true (default) there is one group per AZ, so the cluster-wide general floor is this value times the AZ count (e.g. 1 -> 3 nodes across 3 AZs); with it false there is a single multi-AZ group and this is its floor. | `number` | `1` | no |
| eks\_node\_instance\_types | EC2 instance types for the Nitro node group (tainted `aws-nitro-enclaves=true:NoSchedule`, runs only the MPC keystore enclave pods). All must support Nitro Enclaves. The enclave vCPU carve-out is auto-derived from this instance's cores (see enclave\_cpu\_count / enclave\_parent\_reserved\_cores), so a bigger type here directly raises signing throughput. Defaults to c5.xlarge. | `list(string)` | \[
"c5.xlarge"
]
| no |
| eks\_node\_max\_size | Maximum nodes in the Nitro node group. | `number` | `10` | no |
| eks\_node\_min\_size | Minimum nodes in the Nitro node group. Each MPC keystore enclave pod (every replica) needs its own Nitro node via the host-vsock anti-affinity, so this must cover the keystore replica count. The signer & writer are unified into one keystore, so a single-shard cluster at the HA default (replicas: 2) needs 2 Nitro nodes per shard. desired\_size tracks it. The examples/aws wrapper overrides this per chart\_ha. | `number` | `2` | no |
| enclave\_allocated\_memory\_mib | Memory (MiB) reserved on each Nitro-capable node for the enclave allocator (drives the node's hugepage reservation). null (default) auto-sizes it to the enclave's memory (one enclave pod per node) so no hugepages sit idle. Set a number only to override. | `number` | `null` | no |
| enclave\_allocated\_vcpus | vCPUs reserved on each Nitro-capable node for the enclave allocator. null (default) auto-sizes it to the per-node enclave (one enclave pod per node) so no vCPUs sit idle — i.e. it tracks the derived enclave\_cpu\_count. Set a number only to override. | `number` | `null` | no |
| enclave\_parent\_reserved\_cores | Full physical cores to leave for the parent instance (kubelet + the socat/resource-server proxy that sits on the enclave signing hot path) when auto-deriving the enclave vCPU count from the node instance type. The enclave gets all remaining cores. AWS requires >=1 core for the parent on a multithreaded instance; 1 is right when the Nitro nodes are dedicated to the enclave pod, raise it if they co-host other workloads. | `number` | `1` | no |
| enclave\_parent\_reserved\_mib | Memory (MiB) to leave for the parent instance when auto-deriving the enclave memory from the node instance type (the enclave gets all remaining RAM, floored to whole 1Gi hugepages). Must cover the parent's real footprint, and note the enclave's HugePages-1Gi are carved OUT of node allocatable: parent regular RAM = this value minus EKS kube/system reservation (~1.5-1.8 GiB). It has to fit the enclave-runner (builds the EIF, up to its 2Gi limit) + the enclaver/resource-server/credential-fetcher sidecars + kubelet/OS. Default 6144 (→ ~4.3 GiB allocatable for the parent pods, safe for the 2Gi runner). NOTE the enclave gets (node RAM − this value): on the DEFAULT c5.xlarge (8192 MiB) that is ~2 GiB — the FLOOR of AWS's 2-4 GiB guidance, adequate but NOT generous; the headroom only grows on larger types (c5.2xlarge 16 GiB → ~10 GiB enclave). Under-reserving can OOM the runner during EIF build; raise this only if the parent co-hosts more, and move to a larger instance type for more enclave RAM. | `number` | `6144` | no |
| google\_admin\_emails | Initial Setup Admin Google emails. Becomes the chart's `googleAuth.adminEmails`, which the policy-server-writer renders into `[[initial_admins]]` entries (the live setup-admin enrollment path). | `list(string)` | `[]` | no |
| google\_oauth\_client\_id | Google OAuth client ID used by the vault UI and policy-server initial-admin matching. Hub-side; ignored on spoke clusters. | `string` | `""` | no |
| helm\_release\_name | Helm release name the operator will use for `helm install`. Terraform pre-wires the chart's resource names from it (the TargetGroupBinding service refs derive from the release fullname), so the operator MUST install with this exact release name. | `string` | `"crypto-vault"` | no |
| image\_tags | Image tags for each component. The chart pins all images via the chart version; setting these forces specific tags (typically left null in production). | object(\{
mpc\_key\_store = optional(string, null)
policy\_server = optional(string, null)
orchestrator = optional(string, null)
ui = optional(string, null)
}) | `{}` | no |
| internet\_facing | Master public/private switch for the hub's two front-door NLBs (vault UI + orchestrator API): true = internet-facing (public subnets); false (default) = internal (private subnets — VPC / VPN / PrivateLink only). Override per-LB with `ui_load_balancer.internet_facing` / `orchestrator_load_balancer.internet_facing` (each null = inherit this master). The cross-cluster NATS / relay / KS / POL NLBs are always internal regardless. | `bool` | `false` | no |
| is\_hub | Whether this cluster runs the hub-cluster services (orchestrator, NATS, vault UI) in addition to the per-cluster KS+POL. In the three-cluster deployment exactly one module invocation sets this to true. | `bool` | `false` | no |
| ks\_internal\_lb | Whether to expose THIS cluster's local (unified) KS via a Terraform-managed internal NLB (bound to the chart's KS ClusterIP Service via TargetGroupBinding) so a remote hub orchestrator can dial it over HTTP. Typically set on spokes. The former signer/writer roles are merged into one keystore, so a single NLB is created. The TF caller layers a PrivateLink Endpoint Service on top of the NLB and feeds the endpoint DNS back into the hub via `remote_mpc_key_stores`. | object(\{
enabled = bool
}) | \{
"enabled": false
} | no |
| kubernetes\_namespace | Kubernetes namespace into which the crypto-vault chart is installed. Used by the IRSA trust policy for the MPC keystore service account. | `string` | `"crypto-vault"` | no |
| load\_balancer\_enabled | Master on/off switch for the hub's two Terraform-managed front-door NLBs — the vault UI (`ui_load_balancer`) and the orchestrator REST API (`orchestrator_load_balancer`). true creates both; false (default) creates neither. Override per-LB with `ui_load_balancer.enabled` / `orchestrator_load_balancer.enabled` (each null = inherit this master). The cross-cluster NATS / relay / KS / POL NLBs are unaffected. | `bool` | `false` | no |
| mpc\_key\_store\_image\_repository | Container image repository for the unified MPC keystore enclave. The former signer/writer roles are merged into ONE enclave image serving both the signing and keygen/import paths; the chart is enclave-only, so this defaults to the AWS Nitro variant. | `string` | `"repo.sodot.dev/sodot-docker-oci/mpc-key-store-aws-nitro"` | no |
| mpc\_key\_store\_image\_tag | Tag for the MPC keystore enclave image. Defaults to the pinned `v0.1.15` release on the sodot-docker-oci production registry; override to a mutable `latest` build (from a development registry) or to another release tag as needed. | `string` | `"v0.1.15"` | no |
| nats\_box\_enabled | Deploy the nats-box debug/CLI utility pod (for running `nats` commands against the cluster). Off by default — it has no runtime role and is just extra surface in production; enable it for an ops/debug session. Wires the chart's `nats.natsBox.enabled`. | `bool` | `false` | no |
| nats\_hub\_url | NATS connection URL the spoke cluster's KS+POL use to reach the hub. Required when `is_hub = false` and the chart's default direct topology is in use. Resolved through the customer's private cross-cluster network (PrivateLink / VPC peering / VPN). | `string` | `""` | no |
| nats\_internal\_lb | Hub-only: create the Terraform-managed internal NLB in front of the hub's NATS (bound to the chart's `nats` Service via TargetGroupBinding once the operator installs the chart). The TF caller then layers PrivateLink (Endpoint Service backed by the NLB) or relies on direct VPC routing for the peering case. REQUIRED on the hub — the rendered chart values dial NATS by this NLB's DNS name (the in-enclave resolver is AWS VPC DNS and can't see in-cluster Service names); ignored on spokes. | object(\{
enabled = bool
}) | \{
"enabled": false
} | no |
| nitro\_enclave | AWS Nitro Enclave runtime configuration for the chart's `aws.nitroEnclave.*` block. | object(\{
enclave\_image = optional(string, "")
# null (default) auto-derives the enclave vCPUs from the node instance's
# physical cores: (cores - enclave\_parent\_reserved\_cores) \* threads\_per\_core.
# On the default c5.xlarge that is (2-1)\*2 = 2; on a c5.2xlarge it becomes
# (4-1)\*2 = 6, so the enclave scales with the instance with no manual tuning.
enclave\_cpu\_count = optional(number)
# null (default) auto-derives the enclave memory from the node instance's RAM
# minus enclave\_parent\_reserved\_mib, floored to whole 1Gi hugepages — so on a
# dedicated Nitro node the enclave gets (almost) the whole box and memory never
# caps throughput as the vCPU carve-out grows. e.g. c7i.2xlarge (16 GiB) - 6 GiB
# parent = 10 GiB enclave. Set a number to pin it (must be a multiple of 1024
# for 1Gi pages); the node allocator reserves exactly this (no idle hugepages).
enclave\_memory\_mib = optional(number)
enclave\_cid = optional(number, 16)
enclave\_debug = optional(bool, false)
# Single flag coupling the device plugin's ENCLAVE\_CPU\_ADVERTISEMENT
# (nitro-device-plugin.tf) to the keystore pod's scheduling request. When true
# (default) the plugin advertises `aws.ec2.nitro/nitro_enclaves_cpus` and the
# chart requests it (= enclave\_cpu\_count), so the scheduler accounts for the
# enclave vCPU carve-out. Both move together — never set one without the other.
enclave\_cpu\_advertisement = optional(bool, true)
enclave\_dns\_servers = optional(string, "")
enclave\_dns\_search = optional(string, "")
enclave\_dns\_options = optional(string, "")
# MUST match what the node's nitro-enclaves-allocator reserves: a whole-GiB
# enclave\_memory\_mib is handed out as 1Gi hugepages (and zero 2Mi pages), so
# request 1Gi here and keep enclave\_memory\_mib a multiple of 1024. Requesting
# "2Mi" against 1Gi-only nodes leaves the keystore pod unschedulable. (Enforced
# by the validation below.)
hugepages\_size = optional(string, "1Gi")
tun\_host\_addr = optional(string, "192.168.255.2")
tun\_mtu = optional(number, 1400)
runner\_image = optional(string, "repo.sodot.dev/sodot-docker-oci/enclave-runner")
runner\_image\_tag = optional(string, "v0.1.15")
enclaver\_image = optional(string, "repo.sodot.dev/sodot-docker-oci/enclaver")
enclaver\_image\_tag = optional(string, "v0.1.15")
enclaver\_image\_digest = optional(string, "") # optional "sha256:..." pin; overrides \_tag as repo@digest. The server-mode sidecar must match the enclaver baked into the EIF (ENCLAVER\_DIGEST) or the TUN desyncs — see the chart values.yaml note.
resource\_server\_image = optional(string, "repo.sodot.dev/sodot-docker-oci/enclave-resource-server")
resource\_server\_image\_tag = optional(string, "v0.1.15")
credential\_fetcher\_image = optional(string, "amazon/aws-cli")
credential\_fetcher\_image\_tag = optional(string, "2.34.57") # keep aligned with the chart's credential-fetcher image tag; the module forwards this unconditionally, so a stale value here overrides the chart default on every deploy.
credential\_refresh\_interval\_seconds = optional(number, 21600)
# Mode B (the production default): consume a CI-built, *measured* EIF instead
# of building it in-container, so PCR0 is reproducible and pinnable in the KMS
# key policy (kms:RecipientAttestation:PCR0). The measured EIF is published
# from a reviewed release tag (NOT :latest).
# When enabled the runner drops the host docker.sock and a fetch-eif
# initContainer oras-pulls the EIF into a shared volume. The default ref is the
# published v0.1.15 EIF on sodot-docker-oci; set prebuilt\_eif\_enabled=false to
# fall back to Mode A (in-container build, non-deterministic PCR0).
# Mode A is DEV-ONLY: it mounts the host docker.sock (root-on-host surface)
# and yields a non-pinnable PCR0, so keep this true (Mode B) in production.
prebuilt\_eif\_enabled = optional(bool, true)
prebuilt\_eif\_ref = optional(string, "repo.sodot.dev/sodot-docker-oci/mpc-key-store-eif:v0.1.15")
prebuilt\_eif\_directory = optional(string, "/eif")
prebuilt\_eif\_oras\_image = optional(string, "ghcr.io/oras-project/oras")
prebuilt\_eif\_oras\_image\_tag = optional(string, "v1.2.0")
# --- Enclave log-exporter sidecar (OTEL logs -> stdout -> `kubectl logs`) ---
# In production the enclave console is sealed (no --debug-mode), so the app
# exports its OTLP signals (logs/metrics/traces) to this sidecar, which prints
# each LOG record to its own stdout (recovering `kubectl logs`) and optionally
# tees logs/metrics/traces to a downstream OTLP collector. Enabled by default —
# it is the enclave's only log path in production. The enclave-side endpoint is
# baked into the measured EIF and is deliberately out of ENCLAVE\_ENV\_ALLOW, so
# this is purely a sidecar (no enclave-env plumbing). NOTE: the NON-enclave
# services (orchestrator, policy-server) export OTLP directly — see the top-level
# `observability` variable.
otlp\_exporter\_enabled = optional(bool, true)
otlp\_exporter\_image = optional(string, "repo.sodot.dev/sodot-docker-oci/enclave-otlp-exporter")
otlp\_exporter\_image\_tag = optional(string, "v0.1.15")
otlp\_exporter\_format = optional(string, "text") # "text" (line per record) or "json" (one JSON object per record)
otlp\_exporter\_threads = optional(number, 4)
otlp\_exporter\_bind\_timeout\_secs = optional(number, 120)
# OTLP/gRPC ingress on tunHostAddr:4317 (OTLP/HTTP on :4318 is always bound). The
# enclave exports over gRPC :4317 BY DEFAULT (baked into the measured EIF), so this
# is the live ingress — keep it true. Set false ONLY for an EIF rebuilt to export
# over HTTP; disabling it on the default gRPC EIF severs the enclave's telemetry.
otlp\_exporter\_grpc\_ingress = optional(bool, true)
# Optional downstream "tee": a BASE URL (http://host:port, NO path) of YOUR OTLP
# collector, plus the transport it speaks ("http" or "grpc"). http:// only — the
# exporter's outbound client has NO TLS, so point it at a plaintext in-cluster
# collector (which handles any TLS egress to a vendor). Empty (default) = stdout
# only. When set, the chart also opens keystore egress to the endpoint's port
# (parsed from the URL) so the NetworkPolicy admits it.
otlp\_exporter\_endpoint = optional(string, "")
otlp\_exporter\_protocol = optional(string, "http") # tee transport: "http" or "grpc"
otlp\_exporter\_timeout\_secs = optional(number, 5)
otlp\_exporter\_queue\_capacity = optional(number, 2048)
otlp\_exporter\_queue\_bytes = optional(number, 67108864) # 64 MiB
}) | `{}` | no |
| observability | OpenTelemetry/OTLP export for the NON-enclave services (orchestrator and
policy-server reader+writer). They run as ordinary pods and speak OTLP DIRECTLY
to your collector — no sidecar, no enclave boundary. (The in-enclave keystore is
separate: its telemetry goes through the nitro\_enclave OTLP-exporter sidecar,
whose endpoint is baked into the measured EIF.)
Export is OFF until you set otlp\_endpoint; until then these services log only to
their container stdout, exactly as before. The transport's standard endpoint
handling applies (grpc: verbatim; http/protobuf: /v1/logs appended), and the URL
scheme selects TLS (https:// negotiates TLS, http:// stays plaintext).
Auth headers (a bearer token, typically) come from a Secret YOU create in the
release namespace, never from a ConfigMap: set otlp\_headers\_secret\_name +
otlp\_headers\_secret\_key to the Secret and the key holding the header value,
taken verbatim as a comma-separated key=value list (e.g. "authorization=Bearer
abc123"). Leave the name empty to send no auth. Credentials require an https://
endpoint — the app refuses to send them over plaintext.
RUST\_LOG sets only the stdout filter; use otlp\_log\_filter (VAULT\_OTLP\_LOG\_FILTER)
to tune the verbosity of the logs exported over OTLP. | object(\{
otlp\_endpoint = optional(string, "")
otlp\_protocol = optional(string, "grpc") # "grpc" or "http/protobuf"
otlp\_console = optional(bool, true) # also keep logging to stdout
otlp\_timeout = optional(string, "") # OTEL\_EXPORTER\_OTLP\_TIMEOUT (ms), e.g. "10000"; empty = SDK default
otlp\_resource\_attributes = optional(string, "") # OTEL\_RESOURCE\_ATTRIBUTES, comma-separated key=value
otlp\_log\_filter = optional(string, "") # VAULT\_OTLP\_LOG\_FILTER, tracing EnvFilter syntax; empty = app default. RUST\_LOG sets only the stdout filter.
otlp\_headers\_secret\_name = optional(string, "") # existing Secret (empty = no auth headers)
otlp\_headers\_secret\_key = optional(string, "") # key within that Secret holding the header string
}) | `{}` | no |
| orchestrator\_image\_repository | Orchestrator image repository. Defaults to the sodot-docker-oci production registry; takes effect when image\_tags.orchestrator is set. | `string` | `"repo.sodot.dev/sodot-docker-oci/orchestrator"` | no |
| orchestrator\_ingress | Hub-only public ingress for the orchestrator REST API. When `enabled = true`, an Ingress resource is created on the hub cluster pointing at the customer's NGINX / ALB. Set host to a DNS name the customer owns. | object(\{
enabled = bool
host = string
class\_name = optional(string, "alb")
annotations = optional(map(string), \{})
tls\_enabled = optional(bool, true)
tls\_secret = optional(string, "")
acm\_cert\_arn = optional(string, "")
}) | \{
"enabled": false,
"host": ""
} | no |
| orchestrator\_load\_balancer | Hub-only: expose the orchestrator REST API behind a Terraform-managed AWS NLB with a TLS listener (bound to the orchestrator ClusterIP Service via TargetGroupBinding) — the SAME mechanism as the UI LB. `enabled` and `internet_facing` each override the matching master (`load_balancer_enabled` / `internet_facing`) for this LB; leave them null to inherit. Provide the API's own DNS `host` and ACM `certificate_arn` (distinct from the UI's). The caller wires the DNS record from the `orchestrator_lb_*` outputs. | object(\{
enabled = optional(bool)
internet\_facing = optional(bool)
host = optional(string, "")
certificate\_arn = optional(string, "")
}) | `{}` | no |
| pol\_internal\_lb | Whether to expose THIS cluster's local policy-server reader + writer via Terraform-managed internal NLBs (bound to the chart's ClusterIP Services via TargetGroupBinding) so a remote hub orchestrator can dial them over HTTP (required for the cross-cluster pubkey ceremony + approval verification). Typically set on spokes alongside `ks_internal_lb`. | object(\{
enabled = bool
}) | \{
"enabled": false
} | no |
| policy\_server\_image\_repository | Policy-server (reader + writer) image repository. Defaults to the sodot-docker-oci production registry; takes effect when image\_tags.policy\_server is set. | `string` | `"repo.sodot.dev/sodot-docker-oci/policy-server"` | no |
| relay\_address | Relay service address used by MPC keystores + orchestrator. Required on spokes (typically the hub's relay PrivateLink endpoint URL). Ignored on the hub: when `is_hub = true` the module derives the in-cluster URL `http://relay-router:80` because the relay subchart runs in-namespace there. Format: "http://\:\" or "https://\". | `string` | `""` | no |
| relay\_internal\_lb | Hub-only: create the Terraform-managed internal NLB in front of the relay subchart's relay-router (bound via TargetGroupBinding once the chart is installed); the TF caller then layers a PrivateLink Endpoint Service on it so spoke clusters reach the relay over the private network. REQUIRED on the hub for the same in-enclave DNS reason as `nats_internal_lb`. | object(\{
enabled = bool
}) | \{
"enabled": false
} | no |
| remote\_mpc\_key\_stores | Hub-only: list of remote KS shards the hub orchestrator should know about. Each entry contributes one `[[key_store_gw.mpc_key_store_servers]]` URL to the orchestrator config (the signer & writer are unified into one keystore service per shard). The chart renders these into `remoteMpcKeyStores` (URL-only, no Deployment/Service). URLs are typically PrivateLink endpoint DNS names provisioned by the TF caller. `mpc_shard_index` is the remote shard's 0-based index (its `shard_index` output): the chart names the gateway entry `mpc-ks-` to match that shard's own keystore self-name, which the orchestrator keys its cluster-identity set by. | list(object(\{
name = string
url = string
mpc\_shard\_index = number
})) | `[]` | no |
| remote\_policy\_servers | Hub-only: list of remote policy servers the hub orchestrator should know about. Each entry contributes one `[[policy_gw.readers]]` and one `[[policy_gw.writers]]` to the orchestrator config. The chart renders these into `remotePolicyServers` (URL-only, no Deployment/Service). `name` must equal the remote POL's MPC component name (`policy-server-reader-`) so the orchestrator can verify approval signatures (the verifying key itself is propagated via the cluster-identity set, not configured here). | list(object(\{
name = string
reader\_url = string
writer\_url = string
})) | `[]` | no |
| secrets\_recovery\_window\_days | Recovery window (in days) for the Secrets Manager secrets this module creates (artifactory, relay-api-key, db-app-user). Set 0 to force-delete immediately on destroy with no recovery window, so re-creating the same-named secrets after a destroy does not fail because they are still pending deletion — use for ephemeral/test deployments. Default 30 (the AWS default, production-safe). | `number` | `30` | no |
| storage\_class\_encrypted | Encrypt volumes provisioned by the default StorageClass at rest. Leave true; only set false if you have a specific reason. | `bool` | `true` | no |
| storage\_class\_fs\_type | Filesystem laid down on volumes from the default StorageClass (ext4 or xfs). | `string` | `"ext4"` | no |
| storage\_class\_reclaim\_policy | Reclaim policy for the default StorageClass (Delete or Retain). Delete reclaims the EBS volume with the PVC; Retain keeps it for manual recovery. | `string` | `"Delete"` | no |
| storage\_class\_type | EBS volume type for the cluster's default `gp3` StorageClass. | `string` | `"gp3"` | no |
| tags | Extra AWS resource tags merged into every resource that supports tagging. | `map(string)` | `{}` | no |
| ui\_client\_secret\_ref | BYO mode: name of an existing Kubernetes Secret in the chart namespace containing the UI's Google OAuth client secret under key `CLIENT_SECRET`. Use when the customer manages secrets externally (External Secrets Operator, sealed-secrets, etc.). Mutually exclusive with `ui_google_oauth_client_secret` — this takes precedence when both are set. | `string` | `""` | no |
| ui\_google\_oauth\_client\_secret | Convenience mode: literal Google OAuth client secret. When non-empty (and `ui_client_secret_ref` is empty), the module creates a Kubernetes Secret named `vault-ui-google-client-secret` with key `CLIENT_SECRET` and auto-wires `ui.clientSecretRef` to it. Hub-side only; pass via a gitignored tfvars file or `TF_VAR_ui_google_oauth_client_secret` env. | `string` | `""` | no |
| ui\_image\_repository | Vault-UI image repository. Defaults to the sodot-docker-oci production registry; takes effect when image\_tags.ui is set. | `string` | `"repo.sodot.dev/sodot-docker-oci/vault-ui"` | no |
| ui\_ingress | Hub-only public ingress for the vault UI. | object(\{
enabled = bool
host = string
class\_name = optional(string, "alb")
annotations = optional(map(string), \{})
tls\_enabled = optional(bool, true)
tls\_secret = optional(string, "")
acm\_cert\_arn = optional(string, "")
}) | \{
"enabled": false,
"host": ""
} | no |
| ui\_load\_balancer | Hub-only: expose the vault UI behind a Terraform-managed AWS NLB with a TLS listener (bound to the chart's UI ClusterIP Service via TargetGroupBinding) — consistent with the other Terraform-managed NLBs. `enabled` and `internet_facing` each override the matching master (`load_balancer_enabled` / `internet_facing`) for this LB; leave them null to inherit. `host` drives the UI's REDIRECT\_URI and must match `certificate_arn`'s domain; the caller wires the DNS record from the `ui_lb_*` outputs. | object(\{
enabled = optional(bool)
internet\_facing = optional(bool)
host = optional(string, "")
certificate\_arn = optional(string, "")
}) | `{}` | no |
| vpc\_cidr | CIDR block for this cluster's VPC. Must not overlap with peer VPCs if you intend to use the `peering-aws` helper module to mesh same-cloud clusters. | `string` | `"10.0.0.0/16"` | no |
| vpc\_private\_subnets | CIDR blocks for private subnets (EKS nodes + RDS). Length must equal `vpc_public_subnets`. | `list(string)` | \[
"10.0.1.0/24",
"10.0.2.0/24",
"10.0.3.0/24"
]
| no |
| vpc\_public\_subnets | CIDR blocks for public subnets (NAT gateways + optional public-facing LBs). Length must equal `vpc_private_subnets` — the module pairs one private + one public subnet per AZ. | `list(string)` | \[
"10.0.101.0/24",
"10.0.102.0/24",
"10.0.103.0/24"
]
| no |
| vpc\_single\_nat\_gateway | Route all private-subnet egress through a single shared NAT gateway (cheapest, but a single point of failure for outbound traffic). Defaults to false for highly-available egress — one NAT gateway per AZ, at ~Nx the NAT cost. Set true for a low-cost non-production footprint that can tolerate an egress SPOF. | `bool` | `false` | no |
### Outputs
| Name | Description |
| ---- | ----------- |
| artifactory\_secret\_arn | ARN of the Secrets Manager secret holding the Artifactory pull credentials. |
| aws\_account\_id | AWS account ID hosting this cluster (used by the peering helper for cross-account accepters). |
| aws\_region | AWS region echo. |
| database\_names | Logical PostgreSQL database names created on this cluster. |
| db\_app\_user\_secret\_arn | ARN of the Secrets Manager secret holding the chart's application PostgreSQL credentials. |
| db\_instance\_address | Hostname clients use to reach the RDS PostgreSQL instance. |
| db\_master\_user\_secret\_arn | ARN of the AWS-managed master-user secret for the RDS instance. |
| eks\_cluster\_certificate\_authority\_data | Base64-encoded cluster CA bundle. |
| eks\_cluster\_endpoint | EKS cluster API server endpoint. |
| eks\_cluster\_name | EKS cluster name. |
| eks\_node\_security\_group\_id | Security group attached to EKS worker nodes. |
| eks\_oidc\_provider\_arn | OIDC provider ARN — wire into IRSA trust policies. |
| helm\_release\_name | Helm release name the operator MUST install with (echoes var.helm\_release\_name). Terraform pre-wires the chart's resource names — the TargetGroupBinding service refs — from it, so a mismatched release name breaks the NLB bindings. |
| helm\_values\_yaml | The module-rendered crypto-vault chart values as a ready-to-use YAML document — everything the chart needs on this cluster (DB connection + credentials, KMS key ARN/region, IRSA role ARN, the local MPC shard + policy-server identities, googleAuth, relay address/apiKey, UI TLS host, and the services.\* role toggles). Write it to a file and `helm install -f` it with release name = helm\_release\_name (the examples/aws harness writes ./out/cluster-\.values.yaml). Contains secrets: treat the file like a credential. |
| ks\_internal\_lb\_arn | ARN of the Terraform-managed NLB fronting this cluster's unified keystore (the former signer/writer roles are merged into one). Feed into `privatelink-aws.provider_side.nlb_arn` from a hub-side TF caller. Only emitted when `ks_internal_lb.enabled = true`. |
| ks\_shard\_name | Name of this cluster's local MPC keystore shard (mirrors `mpc_key_store.name`). Useful when the hub caller assembles `remote_mpc_key_stores` entries from a spoke's module outputs. |
| namespace | Kubernetes namespace into which the chart is installed. |
| nats\_internal\_lb\_arn | ARN of the Terraform-managed NLB fronting the hub's NATS. Feed into `privatelink-aws.provider_side.nlb_arn`. Only emitted on the hub with `nats_internal_lb.enabled = true`. |
| nats\_internal\_lb\_hostname | DNS name of the AWS NLB. Useful for direct cross-VPC routing (peering case) where you'd build `nats_hub_url = nats://:4222`. |
| orchestrator\_lb\_dns\_name | DNS name of the orchestrator API NLB. Point a Route53 alias (or a CNAME at your own DNS provider) for orchestrator\_load\_balancer.host at this. Only emitted on the hub when the API LB is enabled (load\_balancer\_enabled or orchestrator\_load\_balancer.enabled). |
| orchestrator\_lb\_zone\_id | Canonical hosted-zone ID of the orchestrator API NLB, for a Route53 alias record's `alias.zone_id`. |
| pol\_component\_name | This cluster's local policy-server MPC component name (`policy-server-reader-`). The hub caller uses this as the `name` in a `remote_policy_servers` entry so the orchestrator can verify the POL's approval signatures. |
| pol\_reader\_internal\_lb\_arn | ARN of the Terraform-managed NLB for the policy-server reader. Feed into `privatelink-aws.provider_side.nlb_arn` from a hub-side TF caller. Only emitted when `pol_internal_lb.enabled = true`. |
| pol\_writer\_internal\_lb\_arn | ARN of the Terraform-managed NLB for the policy-server writer. Same usage as pol\_reader\_internal\_lb\_arn. |
| policy\_server\_port | Port the policy-server reader/writer Services listen on. Used by the hub caller to build the `reader_url` / `writer_url` for a `remote_policy_servers` entry. |
| relay\_api\_key\_secret\_arn | ARN of the Secrets Manager secret holding the relay API key. |
| relay\_internal\_lb\_arn | ARN of the Terraform-managed NLB fronting the hub's relay-router. Feed into `privatelink-aws.provider_side.nlb_arn` from the example so spoke clusters can reach the hub's relay. Only emitted on the hub with `relay_internal_lb.enabled = true`. |
| relay\_internal\_lb\_hostname | DNS name of the relay-router NLB — useful for the peering case (build `relay_address = http://:80`). |
| shard\_index | This cluster's 0-based MPC shard index (echoes `var.shard_index`). The hub caller passes it as a `remote_mpc_key_stores[].mpc_shard_index` so the orchestrator gateway entry is named `mpc-ks-`, matching this shard's keystore self-name. |
| storage\_encryptor\_kms\_key\_alias | Alias for the storage-encryptor KMS key. |
| storage\_encryptor\_kms\_key\_arn | ARN of the KMS key used by the MPC keystore's storage encryptor. |
| ui\_lb\_dns\_name | DNS name of the UI NLB. Point a Route53 alias (or a CNAME at your own DNS provider) for ui\_load\_balancer.host at this. Only emitted on the hub when the UI LB is enabled (load\_balancer\_enabled or ui\_load\_balancer.enabled). |
| ui\_lb\_zone\_id | Canonical hosted-zone ID of the UI NLB, for a Route53 alias record's `alias.zone_id`. |
| vpc\_cidr\_block | Primary CIDR block of the VPC. |
| vpc\_id | VPC ID for this cluster's network. |
| vpc\_private\_route\_table\_ids | Private route table IDs (used by `peering-aws` to install cross-account routes). |
| vpc\_private\_subnets | Private subnet IDs (EKS nodes + RDS). |
| vpc\_public\_subnets | Public subnet IDs (NAT gateways + LBs). |