From bc6098458129f7b2dd12a0a021c5a2d69e3da5fa Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Tue, 16 Jun 2026 13:49:59 -0400 Subject: [PATCH 1/5] update ami and add vars,output for ami-type --- README.md | 4 +++- main.tf | 4 ++-- outputs.tf | 5 +++++ variables.tf | 6 ++++++ 4 files changed, 16 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 9200152..839632b 100644 --- a/README.md +++ b/README.md @@ -113,7 +113,7 @@ efs-csi-controller 0 5m | Name | Source | Version | |------|--------|---------| | [cloudwatch\_observability\_irsa\_role](#module\_cloudwatch\_observability\_irsa\_role) | git::https://github.e.it.census.gov/SCT-Engineering/terraform-aws-iam//modules/iam-role-for-service-accounts-eks | n/a | -| [cluster](#module\_cluster) | git::https://github.e.it.census.gov/SCT-Engineering/terraform-aws-eks/ | v21.15.1 | +| [cluster](#module\_cluster) | git::https://github.e.it.census.gov/SCT-Engineering/terraform-aws-eks/ | v21.23.0 | | [ebs\_csi\_irsa\_role](#module\_ebs\_csi\_irsa\_role) | git::https://github.e.it.census.gov/SCT-Engineering/terraform-aws-iam//modules/iam-role-for-service-accounts-eks | n/a | | [efs\_csi\_irsa\_role](#module\_efs\_csi\_irsa\_role) | git::https://github.e.it.census.gov/SCT-Engineering/terraform-aws-iam//modules/iam-role-for-service-accounts-eks | n/a | | [tags](#module\_tags) | git@github.e.it.census.gov:terraform-modules/boc-nts//tags | n/a | @@ -151,6 +151,7 @@ efs-csi-controller 0 5m | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| | [access\_entries](#input\_access\_entries) | Map of access entries to add to the cluster | `any` | `{}` | no | +| [ami\_type](#input\_ami\_type) | AMI type to use for the EKS node group | `string` | `"AL2023_x86_64"` | no | | [census\_private\_cidr](#input\_census\_private\_cidr) | Census Private CIR Blocks | `list(string)` | 
[
  "148.129.0.0/16",
  "172.16.0.0/12",
  "192.168.0.0/16",
  "10.0.0.0/16"
]
| no | | [cloudwatch\_retention\_days](#input\_cloudwatch\_retention\_days) | number of days to retain logs in cloudwatch | `string` | `"14"` | no | | [cluster\_name](#input\_cluster\_name) | EKS cluster name name component used through out the EKS cluster describing its purpose (ex: dice-dev) | `string` | n/a | yes | @@ -170,6 +171,7 @@ efs-csi-controller 0 5m | Name | Description | |------|-------------| | [access\_entries](#output\_access\_entries) | The access\_entries object added to cluster | +| [ami\_type](#output\_ami\_type) | AMI type used for the EKS node group | | [cloudwatch\_log\_group\_arn](#output\_cloudwatch\_log\_group\_arn) | Arn of cloudwatch log group created | | [cloudwatch\_log\_group\_name](#output\_cloudwatch\_log\_group\_name) | Name of cloudwatch log group created | | [cluster\_addons](#output\_cluster\_addons) | Map of attribute maps for all EKS cluster addons enabled | diff --git a/main.tf b/main.tf index 7a35ed9..7e9a991 100644 --- a/main.tf +++ b/main.tf @@ -25,7 +25,7 @@ resource "terraform_data" "subnet_validation" { } module "cluster" { - source = "git::https://github.e.it.census.gov/SCT-Engineering/terraform-aws-eks/?ref=v21.15.1" + source = "git::https://github.e.it.census.gov/SCT-Engineering/terraform-aws-eks/?ref=v21.23.0" access_entries = local.access_entries cloudwatch_log_group_retention_in_days = var.cloudwatch_retention_days @@ -59,7 +59,7 @@ module "cluster" { eks_managed_node_groups = { karpenter = { name = local.ng_name - ami_type = "BOTTLEROCKET_x86_64" + ami_type = var.ami_type capacity_type = "ON_DEMAND" instance_types = var.eks_instance_types diff --git a/outputs.tf b/outputs.tf index 3c868cb..3dec90b 100644 --- a/outputs.tf +++ b/outputs.tf @@ -281,3 +281,8 @@ output "node_group_name" { description = "name of the node group created for use by karpenter" value = local.ng_name } + +output "ami_type" { + description = "AMI type used for the EKS node group" + value = var.ami_type +} diff --git a/variables.tf b/variables.tf index f4463ec..acd43d4 100644 --- a/variables.tf +++ b/variables.tf @@ -1,3 +1,9 @@ +variable "ami_type" { + description = "AMI type to use for the EKS node group" + type = string + default = "AL2023_x86_64" +} + variable "cluster_name" { description = "EKS cluster name name component used through out the EKS cluster describing its purpose (ex: dice-dev)" type = string From 0d104838dcd19e7e943d4a3911e1b63c99eb719f Mon Sep 17 00:00:00 2001 From: Dave Arnold Date: Wed, 24 Jun 2026 12:35:26 -0400 Subject: [PATCH 2/5] ci: rewrite SSH module URLs to HTTPS in terraform-validate workflow In the GitHub Actions CI environment, the runner has no SSH key configured for github.e.it.census.gov, so 'terraform init' fails when pulling modules whose source URLs use the SSH git@ scheme (e.g. tags.tf, examples/simple/eks.tf). Changes made to .github/workflows/terraform-validate.yaml: 1. Added 'Setup GITHUB Credentials' step (CSVD/gh-auth@main) - Obtains a short-lived GitHub App token using the repository's GH_APP_PEM_FILE secret and GH_APP_ID / GH_APP_INSTALLATION_ID vars. - This mirrors the credential setup already present in the release workflow. 2. Added 'Configure Git HTTPS for Terraform module pulls' step - Runs: git config --global url."https://oauth2:@github.e.it.census.gov/".insteadOf "git@github.e.it.census.gov:" - This tells git to transparently rewrite any SSH git@ URL for this host to an authenticated HTTPS URL at the transport layer. - Terraform shells out to the system git binary for module fetches, so it honours this rewrite without any changes to .tf source URLs. No .tf files are modified: SSH source URLs in tags.tf and examples/simple/eks.tf remain intact so that developers using SSH keys locally are unaffected. --- .github/workflows/terraform-validate.yaml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/.github/workflows/terraform-validate.yaml b/.github/workflows/terraform-validate.yaml index ac349eb..fbf70f3 100644 --- a/.github/workflows/terraform-validate.yaml +++ b/.github/workflows/terraform-validate.yaml @@ -13,6 +13,18 @@ jobs: - name: Checkout code uses: CSVD/gh-actions-checkout@v4 + - name: Setup GITHUB Credentials + id: github_credentials + uses: CSVD/gh-auth@main + with: + github_app_pem_file: ${{ secrets.GH_APP_PEM_FILE }} + github_app_installation_id: ${{ vars.GH_APP_INSTALLATION_ID }} + github_app_id: ${{ vars.GH_APP_ID }} + + - name: Configure Git HTTPS for Terraform module pulls + run: | + git config --global url."https://oauth2:${{ steps.github_credentials.outputs.github_token }}@github.e.it.census.gov/".insteadOf "git@github.e.it.census.gov:" + - name: Setup Terraform uses: CSVD/gh-actions-setup-terraform@v2 with: From f76ef2e9c883f0d0ed351307d67053c096c31a7c Mon Sep 17 00:00:00 2001 From: Dave Arnold Date: Wed, 24 Jun 2026 12:38:29 -0400 Subject: [PATCH 3/5] ci: add ssh:// insteadOf rule to cover Terraform URL normalization Terraform normalizes SCP-style SSH sources (git@host:path) to ssh:// URLs before invoking git, so the previous insteadOf rule for 'git@github.e.it.census.gov:' did not match. Added a second rule for 'ssh://git@github.e.it.census.gov/' so both URL forms are rewritten to authenticated HTTPS. --- .github/workflows/terraform-validate.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/terraform-validate.yaml b/.github/workflows/terraform-validate.yaml index fbf70f3..326f217 100644 --- a/.github/workflows/terraform-validate.yaml +++ b/.github/workflows/terraform-validate.yaml @@ -24,6 +24,7 @@ jobs: - name: Configure Git HTTPS for Terraform module pulls run: | git config --global url."https://oauth2:${{ steps.github_credentials.outputs.github_token }}@github.e.it.census.gov/".insteadOf "git@github.e.it.census.gov:" + git config --global url."https://oauth2:${{ steps.github_credentials.outputs.github_token }}@github.e.it.census.gov/".insteadOf "ssh://git@github.e.it.census.gov/" - name: Setup Terraform uses: CSVD/gh-actions-setup-terraform@v2 From 0cf9077079701ef6ebab3482a5aa77815b219bdb Mon Sep 17 00:00:00 2001 From: Dave Arnold Date: Thu, 23 Jul 2026 16:42:41 -0400 Subject: [PATCH 4/5] refactor: remove duplicate gh-auth/insteadOf steps, delegate to terraform-validate action - Action (CSVD/terraform-validate) now accepts github_app_pem_file and handles gh-auth + git config insteadOf internally - Remove inline Setup GITHUB Credentials + Configure Git HTTPS steps from workflow - Pass credentials directly to the action via 'with' inputs - Resolves CSVDIES-10490 --- .github/workflows/terraform-validate.yaml | 17 ++++------------- 1 file changed, 4 insertions(+), 13 deletions(-) diff --git a/.github/workflows/terraform-validate.yaml b/.github/workflows/terraform-validate.yaml index 326f217..fd397c8 100644 --- a/.github/workflows/terraform-validate.yaml +++ b/.github/workflows/terraform-validate.yaml @@ -13,19 +13,6 @@ jobs: - name: Checkout code uses: CSVD/gh-actions-checkout@v4 - - name: Setup GITHUB Credentials - id: github_credentials - uses: CSVD/gh-auth@main - with: - github_app_pem_file: ${{ secrets.GH_APP_PEM_FILE }} - github_app_installation_id: ${{ vars.GH_APP_INSTALLATION_ID }} - github_app_id: ${{ vars.GH_APP_ID }} - - - name: Configure Git HTTPS for Terraform module pulls - run: | - git config --global url."https://oauth2:${{ steps.github_credentials.outputs.github_token }}@github.e.it.census.gov/".insteadOf "git@github.e.it.census.gov:" - git config --global url."https://oauth2:${{ steps.github_credentials.outputs.github_token }}@github.e.it.census.gov/".insteadOf "ssh://git@github.e.it.census.gov/" - - name: Setup Terraform uses: CSVD/gh-actions-setup-terraform@v2 with: @@ -34,6 +21,10 @@ jobs: - name: Validate Terraform Configuration id: validate uses: CSVD/terraform-validate@main + with: + github_app_pem_file: ${{ secrets.GH_APP_PEM_FILE }} + github_app_installation_id: ${{ vars.GH_APP_INSTALLATION_ID }} + github_app_id: ${{ vars.GH_APP_ID }} - name: Check Validation/Test Results if: always() From 6a0b139d97b6a654705e934fbfc9a6d84f1d2866 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Fri, 24 Jul 2026 14:14:49 -0400 Subject: [PATCH 5/5] fix var --- README.md | 2 +- variables.tf | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 839632b..e714cd8 100644 --- a/README.md +++ b/README.md @@ -151,7 +151,7 @@ efs-csi-controller 0 5m | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| | [access\_entries](#input\_access\_entries) | Map of access entries to add to the cluster | `any` | `{}` | no | -| [ami\_type](#input\_ami\_type) | AMI type to use for the EKS node group | `string` | `"AL2023_x86_64"` | no | +| [ami\_type](#input\_ami\_type) | AMI type to use for the EKS node group | `string` | `""` | no | | [census\_private\_cidr](#input\_census\_private\_cidr) | Census Private CIR Blocks | `list(string)` | 
[
  "148.129.0.0/16",
  "172.16.0.0/12",
  "192.168.0.0/16",
  "10.0.0.0/16"
]
| no | | [cloudwatch\_retention\_days](#input\_cloudwatch\_retention\_days) | number of days to retain logs in cloudwatch | `string` | `"14"` | no | | [cluster\_name](#input\_cluster\_name) | EKS cluster name name component used through out the EKS cluster describing its purpose (ex: dice-dev) | `string` | n/a | yes | diff --git a/variables.tf b/variables.tf index acd43d4..bb30de3 100644 --- a/variables.tf +++ b/variables.tf @@ -1,7 +1,7 @@ variable "ami_type" { description = "AMI type to use for the EKS node group" type = string - default = "AL2023_x86_64" + default = "" } variable "cluster_name" {