chore(main): release 5.1.0

[github-actions]

🤖 I have created a release beep boop

5.1.0 (2026-06-25)

⚠ BREAKING CHANGES

• iam/agent: the IRSA token no longer has Route53/EKS/ELB/AVP permissions directly. The agent must assume the permissions role (exposed via the nullplatform_agent_permissions_role_arn output) to use them.
• iam: infrastructure/aws/iam/ecr no longer creates the build workflow user, access key or group, and no longer outputs build_workflow_access_key_id / build_workflow_access_key_secret. Consumers must instantiate the new build-user module, pass its group_name to ecr (new required input build_workflow_group_name) and to s3-assets, take the build credentials from build-user outputs, and run a tofu state mv to preserve the existing user and access key (see infrastructure/aws/iam/build-user/README.md). The IAM group is renamed from ecr-managers to asset-publishers (recreated; does not rotate the user's keys).
• dns,ingress,iam: support disabling public-side resources (#364)
• nullplatform/dimension: callers of nullplatform/dimensions must migrate to nullplatform/dimension and run a terraform state mv to preserve the existing dimension (resource labels changed from environment / environment_value to this). Migration steps are documented in the new module's README.
• security,eks: cluster_security_group_id and gateway_port variables removed from infrastructure/aws/security. Callers must replace those inputs with a separate module eks_gateway_rules call using infrastructure/aws/eks-gateway-rules.

Features

• 613: add support cert manager for oci (#152) (1282171)
• account: make repository_prefix and repository_provider optional (#326) (a0a079a)
• add additional_policies variable to agent IAM module (#233) (7762406)
• add ebs and storage class for eks (#298) (8c00ba3)
• add eks_cluster_primary_security_group_id output (#236) (46412f8)
• add extra_envs variable to agent module (#229) (996b24f)
• add istio security groups (#190) (5e06e8c)
• add pre-configured api_key modules for agent, scope and service notifications (d5d1d76)
• add scope_configuration module (#271) (a49e943)
• agent: add config external-dns to aws config (3d69436)
• agent: add config external-dns to aws config (#105) (1a828f9)
• agent: IAM assume-role support + multi-instance parametrization (#386) (b82df52)
• agent: move identical variables to global configuration (2b78254)
• aks acr integration (#120) (e2237b6)
• api-key: add custom_grants support for multi-NRN grants (#276) (ce70c59)
• aws-backend: make backend module compliant with OpenTofu S3 backend docs (#238) (d494c20)
• aws-eks: add private access to k8s API (7d971ad)
• aws-vpc: disable public ip to EC2 (973f1bc)
• azure/aks: enforce workload identity — hardcode oidc_issuer_enabled (#358) (e542032)
• azure/cloud: support passing authentication credentials as variables (#381) (2313640)
• azure: Add private DNS zone module (813cad3)
• azure: Add private DNS zone module (#90) (5d4399e)
• azure: AKS routing infra — aks_route_table module, vnet drift fix, security improvements (#360) (15c2372)
• azure: unify variable names and update module conventions (41d4f3b)
• azure: unify variable names and update module conventions (#162) (d8bccf1)
• backend: add optional KMS encryption and IAM bucket policy (#246) (1af61bd)
• base: add gateway_public_azure_load_balancer_subnet (#403) (b9b6f5e)
• base: add gateway_public_load_balancer_type and fix public gateway name (#392) (116fc70)
• base: security and nrn tags (#160) (2ad4b2f)
• cert-manager: add aws support (858e346)
• cert-manager: add Azure Workload Identity support (#272) (800249c)
• chart: new version of charts (#122) (83a8b39)
• ci: enable AI readme generator workflow (#203) (5ed8c84)
• ci: integrate AI readme generation into Release Please workflow (#209) (5ea8de5)
• cloud-dns: DNSSEC enabled by default for public zones (#393) (c2e606d)
• commons/azure: Workload Identity for cert-manager and external-dns, with Service Principal fallback (#361) (f11896e)
• container orchestration (#216) (1a87622)
• customers-aws-image: update readme (f367a8f)
• dns,ingress,iam: support disabling public-side resources (#364) (872efa1)
• do not require org nrn (#261) (25d5a5b)
• ecr: migrate IAM to infrastructure/aws/iam/ecr module (#372) (faa35b8)
• edit readme (#222) (4f94816)
• eks version (#270) (8bf801e)
• eks: expose ami_release_version and use_latest_ami_release_version (#334) (1d88c1e)
• eks: expose control plane logging configuration (#242) (322d3f6)
• esternal-dns: resolve conflicts (4f71b63)
• external_dns: add label_filter support for Route53 provider (#371) (0827191)
• external_dns: support azure-private-dns provider (#369) (3a0ebf5)
• externaldns: support multi external dns (#97) (3ddbd8e)
• gcp: unify variable names and rename modules for consistency (3a619f8)
• iam/agent: split agent role into agent + permissions roles (#397) (9df28f5)
• iam: separate build workflow user from asset repositories + add S3 asset support (#402) (9ae9e09)
• identity-access-control: add cloud-agnostic provider config module (#387) (ddcc212)
• infra: add v1 to namespace external dns (ae35596)
• infrastructure/aws/eks: expose encryption_config (backward-compatible) (#324) (f3294d6)
• introduce api_key module for unified API key management (#155) (aded8a6)
• istio: expose istiod_replicas to guarantee HA for node drains (#292) (05a081f)
• nullplatform-base: update version (a872b6f)
• nullplatform/asset/ecr: add configurable cross-account pull policy (#330) (6f4392f)
• nullplatform/asset/ecr: add ecr:SetRepositoryPolicy to manager policy (#307) (a0520b5)
• nullplatform/base: add per-provider log/metrics split and applicationLogs toggle (#362) (b6fb844)
• nullplatform/cloud/aws/vpc: implement aws-networking-configuration provider config (#255) (3c3439b)
• nullplatform/scope_definition: add extra_visible_to_nrns for org-wide sharing (#304) (b52d0f0)
• nullplatform/scope_definition: expose scope_configuration_name_override (backward-compatible) (#328) (8ef0b0e)
• OCI security list auto-management and namespace race condition fix (#197) (3d2a723)
• oci test (#213) (33594c7)
• oci: add support for oci (#146) (ffaa72d)
• oci: cloud provider (#175) (bcdc2b5)
• provider: add support for azure devops (#133) (e0125d9)
• rename route53 to dns and add diagnose actions to scope definition (#215) (a40c98b)
• scope_configuration: support icon (#348) (a4db9cf)
• scope-definition-agent-association: add extra_filters support (#353) (0b0191f)
• scope-definition: add description field to nullplatform_service_specification (#273) (f9ee6ea)
• scope-definition: add optional scope configuration support (#254) (b585706)
• scope: parameterize repository values (#110) (297c1a3)
• security,eks: extract gateway SG rules into dedicated eks-gateway-rules module (#314) (bb5a1dd)
• service definition and service association channel (#121) (44e6a8e)
• service-definition: add local filesystem provider for spec loading (#278) (f24d7c9)
• service: add support to gitlab (#249) (1d41de6)
• support to different cni of oke (#250) (9905b57)
• tofu: run fmt (371342b)
• update nullplatform provider to >= 0.0.86 across all modules (#322) (6b5e5ce)
• vpc: export security group IDs as output (#258) (7509399)

Bug Fixes

• acm: fix logic (cafffea)
• actions (#227) (1bff3ae)
• add disclaimer for registration_enabled usage (ac1fd0a)
• add missing description and type fields to module variables (#268) (36faf96)
• add push release-please (#225) (1803560)
• add terraform-docs step to release PR generation flow (#262) (5a35267)
• add validation for virtual_network_links (76438d0)
• agent: add permission to verifiedpermissions (7d2c50c)
• agent: add permission to verifiedpermissions (#145) (369012e)
• agent: move cross-variable validations to lifecycle preconditions (#341) (799f26c)
• aks: add network contributor (0305ade)
• aks: add network contributor (#114) (1542270)
• alb-controller: fix sa to v1 (ab6f557)
• alb-controller: fix sa to v1 (8a9d1d3)
• api key lifecycle (#163) (beaa60f)
• api key lifecycle (#165) (86fd93e)
• api_key: add create_before_destroy to prevent service disruption (7efc3ed)
• api_key: convert tuple to map in dynamic block for_each (#342) (1d38bba)
• api_key: rename backend.tf to providers.tf and add version constraint (543b174)
• api_key: replace concat with merge to produce map(string) for tags (#346) (9cf26ea)
• api_key: use tomap and map(string) to satisfy for_each type constraint (#344) (bf02402)
• aws-eks: fix name varible (2b178e1)
• aws-region: use .name instead of .region attribute in aws_region data source (0d0912e)
• aws-region: use .name instead of .region attribute in aws_region data source (#154) (7094878)
• aws-security: resolve confllicts (34a4c27)
• aws/cloud: allow to update attributes (#363) (f99f9a1)
• azure-aks: add role to vnet (b40d33d)
• azure-aks: principal_id variable (6e3d54c)
• azure-aks: principal_id variable (6232bf0)
• azure/vnet: relax azurerm provider constraint to ~> 4.0 (a4985ec)
• base-gateways: add annottaion to LB use subnet private (8e3b09e)
• base: adding gateway name parameter (#139) (a47a299)
• base: disabled webhook option (2496ba4)
• base: remove dangerous helm release options (#302) (66cdd18)
• base: update outputs to use input vars instead of removed modules (ac34128)
• base: update version chart (0bc1fbd)
• base: update version chart (#116) (26a1034)
• base: update version heml chart (b8bec08)
• cert manager: fix linter (#95) (260d4c2)
• cert_manager,external_dns: move cross-variable validations to terraform_data preconditions (#315) (a213e35)
• cert-manager-iam: fix allow hosted zone (e819f79)
• cert-manager-iam: fix sa name & add private zone managed (5142697)
• cert-manager: add helm options (7bd7b2c)
• cert-manager: remove deafult to mandatory variables (351a7f9)
• cert-manager: remove IRSA (6383227)
• cert-manager: resolve conflicts (c6a3cb7)
• chart-base: add istio gateway security groups (#143) (03fa7be)
• ci: correct workflow reference path in tofu-test pipeline (0c97f44)
• ci: pass secrets to readme-generator workflow (#207) (a99fa51)
• ci: remove push trigger from tofu-test workflow (#205) (aef2384)
• ci: restore git permissions after secondary checkout (#264) (a1d81a5)
• ci: skip branch validation and commitlint for release-please branches (#300) (ce771a5)
• ci: skip deleted modules in readme generation (#301) (5f74c38)
• ci: update readme versions to release target and exclude root README (#211) (2b70f1b)
• code_repository: remove access block and ignore_changes from all providers (#396) (4295a7f)
• code-repository: fix version (c7a371b)
• code-repository: fix version (eaa3117)
• commitlint: disable body-max-line-length rule (3ed3244)
• commons-external-dns: add switch to namespaces create (06852f7)
• commons-external-dns: add switch to namespaces create (19cd4a6)
• delete conflicting aws provider from backend module (#240) (aa6cb87)
• disable readme version update temporarily (#192) (58072e7)
• dns: ignore vpc changes on private_zone for cross-account assoc (#398) (772c201)
• ecr: add cross-account pull and repository policy support (#384) (cf6431f)
• ecr: remove read section, cross-account role, and fix setup.policy drift (#389) (8000c6b)
• eks: add aditional security gorup (2c44375)
• eks: auth mode validation and s3 secure transport policy (#266) (3a96b54)
• eks: disable node security group to avoid ALB controller conflict (#137) (8cbe80b)
• eks: resolve Auto Mode compatibility issues (#167) (c58baea)
• eks: segretate logic of node groups (0937b93)
• external_dns: change default sources and policy (#282) (50e8cde)
• external_dns: derive label_filter default from zone_type convention (#375) (09ec15b)
• external_dns: move cross-variable validations to terraform_data preconditions (#310) (c4f010e)
• external-dns-iam: add trust policy (4fc890f)
• external-dns: add action external dns policy (4752701)
• external-dns: add manage private zone (e0fbfff)
• external-dns: add rbac (#141) (ea5c5bb)
• external-dns: add rbac to manage dns endpoints (546876e)
• external-dns: add source httproute (ba3b6fc)
• external-dns: add source variable (aed8c25)
• external-dns: delete namespace manifest (17b7495)
• external-dns: fix external dns varaible type (d44879c)
• external-dns: fix external dns varaible type (#128) (af26c59)
• external-dns: fix name chart (b0c4d05)
• external-dns: fix name chart (01852d9)
• external-dns: fix rbac to dnsendpoint (1e26890)
• external-dns: fix sources (fe50c75)
• external-dns: move zone_type to variable (bd3ac1b)
• external-dns: remove regsitry (73cf983)
• external-dns: resolve conflicts (4c9a701)
• external-dns: rollback name dns provider (16ecdd9)
• external-dns: sa name (e0bdcb6)
• external-dns: set default value (#126) (c652f64)
• external-dns: single managed hosted zone (8dd9c20)
• gcp: remove duplicate output and version files (4004729)
• gke: add protection destroy as false (#102) (26f0788)
• helm: add options to applies (987403a)
• helm: add options to applies (b64a340)
• iam-cert-manager: arn role (f9e27bd)
• iam-cert-manager: arn role (e0e112c)
• iam-cert-manager: arn role (65c5fb0)
• iam-cert-manager: arn role (4ea5275)
• iam-cert-manager: arn role (63959ac)
• improve vpc variable descriptions for clarity (#194) (a165d43)
• infra: fix namespace name (5f22a63)
• infra: security hardening, DNS test fixes, WI docs and AVP revert (#295) (d5982fe)
• istio subnet annotation (#327) (57c2495)
• istio: add OCI LoadBalancer subnet annotation support (#317) (4427b61)
• istio: wait for condition (8cbe4e1)
• make virtual_network_links required without default (329f5a5)
• nullplatform-asset-ecr: fix deprecated attribute name for region (ed29e76)
• nullplatform-base: add security groups to gateways (2b72d60)
• nullplatform/asset/ecr: correct invalid provider version constraint operator (#332) (8467496)
• nullplatform/asset/ecr: remove unsupported dimensions variable (#308) (6caa947)
• nullplatform/scope_definition: ignore_changes on action_specification icon (#350) (b895608)
• nullplatform/scope_definition: ignore_changes on scope_type provider_type and status (#305) (895ced0)
• nullplatform: add dimensions variable and eks balancer improvements (#290) (e38d07e)
• nullplatform: rename api key to SCOPE_DEFINITION_AGENT_ASSOCIATION (d23557a)
• pipeline: fix reference (#176) (ac897ab)
• private_dns: make virtual_network_links required and update example (c75b08f)
• release: fix commit message (#131) (eb4e239)
• release: fix commit message (#88) (5926b7b)
• remove OCI configuration aliases and bump chart defaults (#184) (2e65a28)
• remove provider (#285) (65a31b1)
• remove provider (#287) (6cd6ef0)
• remove usedBy tag from api_key notification channels (#183) (dbe2c9a)
• rename agent API key to AGENT-ASSOCIATION with minimal permissions (#92) (1fb44b2)
• rename api key to SCOPE_DEFINITION_AGENT_ASSOCIATION (#117) (1ed79ba)
• replace agent helm release when API key rotates (b0ea1c9)
• replace deprecated data.aws_region.current.name with .region (5e90e4a)
• replace deprecated data.aws_region.current.name with .region (#201) (0ba762b)
• replace notification channels when API key rotates (07d3e17)
• route53: disable output acm (1dc1601)
• route53: disabled ACM (413144d)
• scope_configuration: remove icon attribute (not in nullplatform_provider_config schema) (#351) (35b3d93)
• scope_definition_agent_association: add devops role to channel API key (dc92016)
• scope_definition_agent_association: use ops role instead of devops (6012a4a)
• scope: Add support for icon and annotations in service action spec definition (#82) (5c7c1bb)
• scope: Fixing typo in annotation in scope definition module (#85) (75a0d48)
• security,base: add health check toggle, ALB-to-pod rules, and gateway fixes (#230) (f60a1a5)
• security: align provider version constraints with repo conventions (a47de86)
• security: change gateway_port default from 8443 to 443 (#281) (6c5fc5c)
• security: resolve cluster SG from data source instead of variable (#284) (a816f55)
• security: use static var.cluster_name in count to avoid unknown at plan time (#338) (a2675f4)
• service_definition_agent_association: remove telemetry from channel_sources default (#377) (876ad77)
• service_definition: handle empty service_path for GitLab and cmdline (#400) (826e016)
• service-definition: simplify link specifications to use only links/ directory (#149) (6db7d61)
• tofu-modules: update varibles & readme (8de37f1)
• tofu: fmt (a9da839)
• tofu: resolve conflicts (57ef623)
• tofu: resolve conflicts (013628f)
• trigger release (#150) (eaa6a66)
• update to v0.15.0 and replace resource_group_name for parent_id (#53) (fe32430)
• use configurable branch for notification channel template URL (#224) (825343d)

Reverts

• release 2.0.0 and feat eks-gateway-rules (#318, #314) (#319) (167304f)

Miscellaneous Chores

• release 5.1.0 (#410) (fc5ef69)

Code Refactoring

• nullplatform/dimension: replace dimensions with parameterized single-dimension module (#354) (319d962)

---

This PR was generated with Release Please. See documentation.

[github-actions]

🤖 Created releases:

• v5.1.0

🌻