network server module - #39
Merged
Merged
Conversation
- Rewrite rvn-ecs-nlb embedded README with full docs (overview, use cases, cluster/networking, listener/target group, health checks, capacity, autoscaling, deployment, logging, config table, design decisions). - Align definition.description with README first sentence. - Publish local dev version rvn-ecs-nlb@0.1.0-3. - Replace deprecated data.aws_region.current.id with .region across all 25 modules' locals.tf to clear provider v6 deprecation warnings.
Ravion Module Publish PlanDry run only. No Ravion API mutations were made.
Diffsrvn-acm-certificate 0.3.0 -> 0.3.1--- remote
+++ compiled
- [AWS Certificate Manager DNS validation](https://docs.aws.amazon.com/acm/latest/userguide/dns-validation.html)
- [AWS Certificate Manager certificates for CloudFront](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cnames-and-https-requirements.html)
- - [Source module](https://github.com/flightcontrolhq/modules/tree/rvn-acm-certificate@0.3.0/security/acm_certificate)
+ - [Source module](https://github.com/flightcontrolhq/modules/tree/rvn-acm-certificate@0.3.1/security/acm_certificate)
stack:
pipelines:
change:
@@
base_path: security/acm_certificate
branch: main
execution_environment_id: << module.input.execution_environment_id >>
- ref: rvn-acm-certificate@0.3.0
+ ref: rvn-acm-certificate@0.3.1
repo: https://github.com/flightcontrolhq/modules
stack_id: <<stack.id>>
terraform_variables:rvn-aws-iam-role 0.2.0 -> 0.2.1--- remote
+++ compiled
- [IAM roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html)
- [IAM JSON policy elements](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements.html)
- [IAM permissions boundaries](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html)
- - [Source module](https://github.com/flightcontrolhq/modules/tree/rvn-aws-iam-role@0.2.0/security/iam)
+ - [Source module](https://github.com/flightcontrolhq/modules/tree/rvn-aws-iam-role@0.2.1/security/iam)
stack:
pipelines:
change:
@@
base_path: security/iam
branch: main
execution_environment_id: << module.input.execution_environment_id >>
- ref: rvn-aws-iam-role@0.2.0
+ ref: rvn-aws-iam-role@0.2.1
repo: https://github.com/flightcontrolhq/modules
stack_id: <<stack.id>>
terraform_variables:rvn-aws-network 0.2.1 -> 0.2.2--- remote
+++ compiled
- **VPC Flow Logs** for network traffic monitoring and SOC 2 compliance
- **VPC Peering** to connect with existing VPCs across accounts or regions
- Terraform source: [flightcontrolhq/modules/networking/vpc](https://github.com/flightcontrolhq/modules/tree/rvn-aws-network@0.2.1/networking/vpc)
+ Terraform source: [flightcontrolhq/modules/networking/vpc](https://github.com/flightcontrolhq/modules/tree/rvn-aws-network@0.2.2/networking/vpc)
## Use cases
@@
base_path: networking/vpc
branch: main
execution_environment_id: << module.input.execution_environment_id >>
- ref: rvn-aws-network@0.2.1
+ ref: rvn-aws-network@0.2.2
repo: https://github.com/flightcontrolhq/modules
stack_id: <<stack.id>>
terraform_variables:rvn-aws-static 0.1.2 -> 0.1.3--- remote
+++ compiled
Every deployment is versioned. The deploy step promotes an S3 directory by updating the CloudFront KeyValueStore active pointer. CloudFront rewrites viewer requests to the active version prefix before it reads from S3.
- Terraform source: [flightcontrolhq/modules/hosting/static_site](https://github.com/flightcontrolhq/modules/tree/rvn-aws-static@0.1.2/hosting/static_site)
+ Terraform source: [flightcontrolhq/modules/hosting/static_site](https://github.com/flightcontrolhq/modules/tree/rvn-aws-static@0.1.3/hosting/static_site)
## Use cases
@@
base_path: hosting/static_site
branch: main
execution_environment_id: << module.input.execution_environment_id >>
- ref: rvn-aws-static@0.1.2
+ ref: rvn-aws-static@0.1.3
repo: https://github.com/flightcontrolhq/modules
stack_id: <<stack.id>>
terraform_variables:rvn-ecs-cluster 0.2.0 -> 0.2.1--- remote
+++ compiled
- **Public and private Network Load Balancers** for TCP/UDP and static IP use cases
- **CloudWatch Container Insights** dashboard metrics for production visibility
- Terraform source: [flightcontrolhq/modules/compute/ecs_cluster](https://github.com/flightcontrolhq/modules/tree/rvn-ecs-cluster@0.2.0/compute/ecs_cluster)
+ Terraform source: [flightcontrolhq/modules/compute/ecs_cluster](https://github.com/flightcontrolhq/modules/tree/rvn-ecs-cluster@0.2.1/compute/ecs_cluster)
## Use cases
@@
base_path: compute/ecs_cluster
branch: main
execution_environment_id: << module.input.execution_environment_id >>
- ref: rvn-ecs-cluster@0.2.0
+ ref: rvn-ecs-cluster@0.2.1
repo: https://github.com/flightcontrolhq/modules
stack_id: <<stack.id>>
terraform_variables:rvn-ecs-nlb n/a -> 0.1.1--- remote
+++ compiled
-
+description: Network Load Balanced ECS service for running TCP, UDP, or TLS workloads behind an ECS cluster Network Load Balancer.
+name: ECS Network Service
+type: rvn-ecs-nlbrvn-ecs-nlb n/a -> 0.1.1--- remote
+++ compiled
+build:
+ builder: '<< module.input.build_type == "dockerfile" ? {type: "dockerfile", dockerfile: module.input.dockerfile || "Dockerfile", context: module.input.dockerfile_context || ".", inject_env_variables_in_dockerfile: module.input.dockerfile_inject_env_variables, cache_from: {tag: "dockerfile"}} : module.input.build_type == "nixpacks" ? {type: "nixpacks", install_cmd: module.input.nixpacks_install_cmd, build_cmd: module.input.nixpacks_build_cmd, start_cmd: module.input.nixpacks_start_cmd, config_file_path: module.input.nixpacks_config_file_path, build_path: module.input.nixpacks_build_path, nixpacks_version: module.input.nixpacks_version, nix_pkgs: module.input.nixpacks_nix_pkgs, apt_pkgs: module.input.nixpacks_apt_pkgs, nix_libs: module.input.nixpacks_nix_libs, cache_from: {tag: "nixpacks"}} : {type: "disabled"} >>'
+ destinations:
+ - id: ecr
+ repository_arn: << stack.output.ecr_repository_arn >>
+ tags:
+ - <<pipeline.run.id>>-<< module.input.build_type >>
+ - << module.input.build_type >>
+ type: ecr
+ environment_variables: << module.input.build_environment_variables >>
+ infrastructure:
+ ami: << module.input.build_ami || nil >>
+ aws_account_id: "<< module.input.build_execution_environment_id || module.input.execution_environment_id ? nil : module.input.aws_account_id >>"
+ execution_environment_id: << module.input.build_execution_environment_id || module.input.execution_environment_id >>
+ instance_size: << module.input.build_instance_size >>
+ region: "<< module.input.build_execution_environment_id || module.input.execution_environment_id ? nil : module.input.aws_region >>"
+ type: << module.input.build_infrastructure_type >>
+ inputs:
+ - description: Defaults to repo default branch
+ id: branch
+ label: Git branch
+ required: false
+ type: string
+ - description: Optional commit SHA, tag, or ref to build. Defaults to the configured branch head.
+ id: ref
+ label: Git ref (commit or tag)
+ required: false
+ type: string
+ source:
+ base_path: << module.input.source_base_path || "." >>
+ branch: << build.input.branch >>
+ ref: << build.input.ref >>
+ repo: << module.input.source_repo >>
+ type: git
+ type: '<< module.input.build_type == "prebuilt_image" ? "disabled" : "image" >>'
+deploy:
+ concurrency:
+ queue_overflow: oldest
+ queue_size: 1
+ infrastructure:
+ ecs_alternate_target_group_arn: <<stack.output.alternate_target_group_arn>>
+ ecs_cluster_arn: <<stack.output.service_cluster>>
+ ecs_infrastructure_role_arn: <<stack.output.ecs_infrastructure_role_arn>>
+ ecs_production_listener_rule_arn: <<stack.output.production_listener_rule_arn>>
+ ecs_service_arn: <<stack.output.service_arn>>
+ ecs_target_group_arn: <<stack.output.target_group_arn>>
+ ecs_test_listener_rule_arn: <<stack.output.test_listener_rule_arn>>
+ inputs:
+ - description: Pass the image tag or digest to deploy. For Nixpacks or Dockerfile builds, this is resolved in the Ravion-created ECR repository. For Prebuilt image from registry mode, this is resolved in the repository configured on the module. Do not pass a full image URI.
+ id: image_ref
+ label: Image tag or digest
+ placeholder: sha256:... or latest or <run-id>-nixpacks
+ required: true
+ type: string
+ post_deploy: '<< module.input.post_deploy_enabled && len(module.input.post_deploy_command) > 0 ? {"container_overrides": [{"name": stack.output.container_name, "command": module.input.post_deploy_command, "environment": module.input.post_deploy_environment_variables, "cpu": module.input.post_deploy_cpu || nil, "memory": module.input.post_deploy_memory || nil}], "cpu": string(module.input.post_deploy_cpu || (module.input.capacity_provider == "ec2" ? int(float(module.input.task_cpu) * 1024) : int(float(module.input.fargate_size.vcpu) * 1024))), "memory": string(module.input.post_deploy_memory || (module.input.capacity_provider == "ec2" ? int(float(module.input.task_memory) * 1024) : int(float(module.input.fargate_size.memory_gb) * 1024))), "ephemeral_storage": (module.input.post_deploy_ephemeral_storage_size_gib ? {size_in_gib: module.input.post_deploy_ephemeral_storage_size_gib} : nil), "task_role_arn": stack.output.task_role_arn, "execution_role_arn": stack.output.execution_role_arn, "capacity_provider_strategy": ((module.input.capacity_provider == "fargate" || module.input.additional_fargate_capacity_enabled ? [{capacity_provider: module.input.fargate_capacity_provider_name, weight: 1, base: 0}] : []) | concat(module.input.capacity_provider == "fargate_spot" || module.input.additional_fargate_spot_capacity_enabled ? [{capacity_provider: module.input.fargate_spot_capacity_provider_name, weight: 1, base: 0}] : []) | concat(module.input.capacity_provider == "ec2" || module.input.additional_ec2_capacity_enabled ? [{capacity_provider: module.input.ec2_capacity_provider_name, weight: 1, base: 0}] : [])), "network_configuration": {"awsvpc_configuration": {"subnets": (module.input.private_subnet_placement_enabled ? module.input.private_subnet_ids : module.input.public_subnet_ids), "security_groups": ([stack.output.security_group_id] | concat(module.input.security_group_ids != nil ? module.input.security_group_ids : [])), "assign_public_ip": (module.input.private_subnet_placement_enabled ? "DISABLED" : "ENABLED")}}, "enable_execute_command": module.input.execute_command_enabled, "timeout": module.input.post_deploy_timeout} : nil >>'
+ pre_deploy: '<< module.input.pre_deploy_enabled && len(module.input.pre_deploy_command) > 0 ? {"container_overrides": [{"name": stack.output.container_name, "command": module.input.pre_deploy_command, "environment": module.input.pre_deploy_environment_variables, "cpu": module.input.pre_deploy_cpu || nil, "memory": module.input.pre_deploy_memory || nil}], "cpu": string(module.input.pre_deploy_cpu || (module.input.capacity_provider == "ec2" ? int(float(module.input.task_cpu) * 1024) : int(float(module.input.fargate_size.vcpu) * 1024))), "memory": string(module.input.pre_deploy_memory || (module.input.capacity_provider == "ec2" ? int(float(module.input.task_memory) * 1024) : int(float(module.input.fargate_size.memory_gb) * 1024))), "ephemeral_storage": (module.input.pre_deploy_ephemeral_storage_size_gib ? {size_in_gib: module.input.pre_deploy_ephemeral_storage_size_gib} : nil), "task_role_arn": stack.output.task_role_arn, "execution_role_arn": stack.output.execution_role_arn, "capacity_provider_strategy": ((module.input.capacity_provider == "fargate" || module.input.additional_fargate_capacity_enabled ? [{capacity_provider: module.input.fargate_capacity_provider_name, weight: 1, base: 0}] : []) | concat(module.input.capacity_provider == "fargate_spot" || module.input.additional_fargate_spot_capacity_enabled ? [{capacity_provider: module.input.fargate_spot_capacity_provider_name, weight: 1, base: 0}] : []) | concat(module.input.capacity_provider == "ec2" || module.input.additional_ec2_capacity_enabled ? [{capacity_provider: module.input.ec2_capacity_provider_name, weight: 1, base: 0}] : [])), "network_configuration": {"awsvpc_configuration": {"subnets": (module.input.private_subnet_placement_enabled ? module.input.private_subnet_ids : module.input.public_subnet_ids), "security_groups": ([stack.output.security_group_id] | concat(module.input.security_group_ids != nil ? module.input.security_group_ids : [])), "assign_public_ip": (module.input.private_subnet_placement_enabled ? "DISABLED" : "ENABLED")}}, "enable_execute_command": module.input.execute_command_enabled, "timeout": module.input.pre_deploy_timeout} : nil >>'
+ strategy: |
+ <<
+ module.input.deployment_strategy == "rolling" ? nil :
+ module.input.deployment_strategy == "blue_green" ? {
+ "type": "blue_green",
+ "bake_time_in_minutes": module.input.deployment_bake_time_in_minutes,
+ "pause_stages": module.input.deployment_pause_stages
+ } :
+ module.input.deployment_strategy == "linear" ? {
+ "type": "linear",
+ "bake_time_in_minutes": module.input.deployment_bake_time_in_minutes,
+ "pause_stages": module.input.deployment_pause_stages,
+ "linear": {
+ "step_percentage": module.input.linear_step_percentage,
+ "step_bake_time_in_minutes": module.input.linear_step_bake_time_in_minutes
+ }
+ } : {
+ "type": "canary",
+ "bake_time_in_minutes": module.input.deployment_bake_time_in_minutes,
+ "pause_stages": module.input.deployment_pause_stages,
+ "canary": {
+ "canary_percent": module.input.canary_percent,
+ "canary_bake_time_in_minutes": module.input.canary_bake_time_in_minutes
+ }
+ }
+ >>
+ task_definition:
+ container_definitions: "<< (module.input.firelens_enabled ? [{\"command\": (len(module.input.prebuilt_image_start_command) > 0 ? module.input.prebuilt_image_start_command : nil), \"cpu\": (module.input.capacity_provider == \"ec2\" ? int(float(module.input.task_cpu) * 1024) : int(float(module.input.fargate_size.vcpu) * 1024)), \"depends_on\": [{\"container_name\": \"log_router\", \"condition\": \"START\"}], \"environment\": ([{name: \"PORT\", value: string(module.input.container_port)}] | concat(module.input.environment_variables != nil ? module.input.environment_variables : [])), \"essential\": true, \"image\": (module.input.build_type == \"prebuilt_image\" ? (deploy.input.image_ref contains \"sha256:\" ? module.input.image_repository + \"@\" + deploy.input.image_ref : module.input.image_repository + \":\" + deploy.input.image_ref) : (deploy.input.image_ref contains \"sha256:\" ? stack.output.ecr_repository_url + \"@\" + deploy.input.image_ref : stack.output.ecr_repository_url + \":\" + deploy.input.image_ref)), \"linux_parameters\": {\"init_process_enabled\": true}, \"log_configuration\": {\"log_driver\": \"awsfirelens\"}, \"memory\": (module.input.capacity_provider == \"ec2\" ? int(float(module.input.task_memory) * 1024) : int(float(module.input.fargate_size.memory_gb) * 1024)), \"name\": (stack.output.container_name), \"port_mappings\": [{\"container_port\": (module.input.container_port), \"protocol\": (module.input.listener_protocol == \"UDP\" ? \"udp\" : \"tcp\")}], \"readonly_root_filesystem\": false, \"repository_credentials\": (module.input.image_registry_credentials_secret_arn ? {credentials_parameter: module.input.image_registry_credentials_secret_arn} : nil), \"secrets\": (module.input.secrets), \"stop_timeout\": 30}, {\"name\": \"log_router\", \"image\": module.input.firelens_image, \"cpu\": 0, \"memory_reservation\": 51, \"essential\": true, \"environment\": ([{name: \"FIRELENS_CONFIG_CONTENT\", value: \"[SERVICE]\\n Flush 1\\n Grace 30\\n\\n\" + (module.input.firelens_config ? module.input.firelens_config + \"\\n\" : \"\") + (module.input.firelens_cloudwatch_output_enabled ? \"\\n[OUTPUT]\\n Name cloudwatch\\n Match *\\n region \" + stack.output.region + \"\\n log_group_name \" + stack.output.log_group_name + \"\\n auto_create_group true\\n log_stream_prefix \" + stack.output.log_stream_prefix + \"/\\n retry_limit 2\\n log_key log\\n log_format json/emf\\n\" : \"\")}] | concat(module.input.firelens_environment_variables != nil ? module.input.firelens_environment_variables : [])), \"secrets\": module.input.firelens_secrets != nil ? module.input.firelens_secrets : [], \"command\": [\"/bin/sh\", \"-c\", \"printf '%s' \\\"$FIRELENS_CONFIG_CONTENT\\\" > /flightcontrol-firelens.conf && exec /entrypoint.sh\"], \"user\": \"0\", \"log_configuration\": {\"log_driver\": \"awslogs\", \"options\": {\"awslogs-group\": stack.output.log_group_name, \"awslogs-region\": stack.output.region, \"awslogs-stream-prefix\": stack.output.log_stream_prefix + \"/firelens\"}}, \"firelens_configuration\": {\"type\": \"fluentbit\", \"options\": {\"config-file-type\": \"file\", \"config-file-value\": \"/flightcontrol
... diff truncated ...rvn-ecs-web n/a -> 0.7.1--- remote
+++ compiled
description: Web server ECS service for running an HTTP application behind an ECS cluster load balancer.
-name: ECS Web Server
+name: ECS Web Service
type: rvn-ecs-webrvn-ecs-web 0.7.0 -> 0.7.1--- remote
+++ compiled
The module is intentionally focused on web services behind an Application Load Balancer. It uses the selected ECS cluster to inherit AWS account, region, VPC, subnets, capacity providers, load balancer listeners, and load balancer security groups.
- Terraform source: [flightcontrolhq/modules/compute/ecs_service](https://github.com/flightcontrolhq/modules/tree/rvn-ecs-web@0.7.0/compute/ecs_service)
+ Terraform source: [flightcontrolhq/modules/compute/ecs_service](https://github.com/flightcontrolhq/modules/tree/rvn-ecs-web@0.7.1/compute/ecs_service)
## Use cases
@@
base_path: compute/ecs_service
branch: main
execution_environment_id: << module.input.execution_environment_id >>
- ref: rvn-ecs-web@0.7.0
+ ref: rvn-ecs-web@0.7.1
repo: https://github.com/flightcontrolhq/modules
stack_id: <<stack.id>>
terraform_variables:rvn-ecs-worker 0.2.0 -> 0.2.1--- remote
+++ compiled
The ECS Worker module creates an ECS service for background jobs, queue consumers, event processors, and other private workloads in an existing Ravion ECS cluster. It uses the same ECS service Terraform module as ECS Web Server, but does not create or attach a load balancer target group and does not expose a primary container port.
- Terraform source: [flightcontrolhq/modules/compute/ecs_service](https://github.com/flightcontrolhq/modules/tree/rvn-ecs-worker@0.2.0/compute/ecs_service)
+ Terraform source: [flightcontrolhq/modules/compute/ecs_service](https://github.com/flightcontrolhq/modules/tree/rvn-ecs-worker@0.2.1/compute/ecs_service)
## Use cases
@@
base_path: compute/ecs_service
branch: main
execution_environment_id: << module.input.execution_environment_id >>
- ref: rvn-ecs-worker@0.2.0
+ ref: rvn-ecs-worker@0.2.1
repo: https://github.com/flightcontrolhq/modules
stack_id: <<stack.id>>
terraform_variables:rvn-elasticache 0.1.2 -> 0.1.3--- remote
+++ compiled
- [ElastiCache for Redis OSS security](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/auth.html)
- [ElastiCache for Valkey](https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/engine-versions.html)
- [ElastiCache Serverless](https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/elasticache-serverless.html)
- - [Source module](https://github.com/flightcontrolhq/modules/tree/rvn-elasticache@0.1.2/cache/elasticache)
+ - [Source module](https://github.com/flightcontrolhq/modules/tree/rvn-elasticache@0.1.3/cache/elasticache)
stack:
pipelines:
change:
@@
base_path: cache/elasticache
branch: main
execution_environment_id: << module.input.execution_environment_id >>
- ref: rvn-elasticache@0.1.2
+ ref: rvn-elasticache@0.1.3
repo: https://github.com/flightcontrolhq/modules
stack_id: <<stack.id>>
terraform_variables:rvn-rds 0.4.0 -> 0.4.1--- remote
+++ compiled
- [RDS DB instance classes](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.DBInstanceClass.html)
- [RDS security](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.html)
- [RDS monitoring](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_Monitoring.html)
- - [Terraform source](https://github.com/flightcontrolhq/modules/tree/rvn-rds@0.4.0/database/rds)
+ - [Terraform source](https://github.com/flightcontrolhq/modules/tree/rvn-rds@0.4.1/database/rds)
stack:
pipelines:
change:
@@
base_path: database/rds
branch: main
execution_environment_id: << module.input.execution_environment_id >>
- ref: rvn-rds@0.4.0
+ ref: rvn-rds@0.4.1
repo: https://github.com/flightcontrolhq/modules
stack_id: <<stack.id>>
terraform_variables:rvn-s3 0.1.0 -> 0.1.1--- remote
+++ compiled
- [Blocking public access to your Amazon S3 storage](https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html)
- [Protecting data with server-side encryption](https://docs.aws.amazon.com/AmazonS3/latest/userguide/serv-side-encryption.html)
- [Managing your storage lifecycle](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lifecycle-mgmt.html)
- - [Source module](https://github.com/flightcontrolhq/modules/tree/rvn-s3@0.1.0/storage/s3)
+ - [Source module](https://github.com/flightcontrolhq/modules/tree/rvn-s3@0.1.1/storage/s3)
stack:
pipelines:
change:
@@
base_path: storage/s3
branch: main
execution_environment_id: << module.input.execution_environment_id >>
- ref: rvn-s3@0.1.0
+ ref: rvn-s3@0.1.1
repo: https://github.com/flightcontrolhq/modules
stack_id: <<stack.id>>
terraform_variables: |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Bump patch versions after aws_region deprecation fix across underlying Terraform modules. Updated definitions: - rvn-s3 0.1.0 -> 0.1.1 - rvn-rds 0.4.0 -> 0.4.1 - rvn-ecs-web 0.7.0 -> 0.7.1 - rvn-ecs-worker 0.2.0 -> 0.2.1 - rvn-ecs-nlb 0.1.0 -> 0.1.1 (also includes README expansion) - rvn-ecs-cluster 0.2.0 -> 0.2.1 - rvn-elasticache 0.1.2 -> 0.1.3 - rvn-aws-static 0.1.2 -> 0.1.3 - rvn-acm-certificate 0.3.0 -> 0.3.1 - rvn-aws-network 0.2.0 -> 0.2.1 - rvn-aws-iam-role 0.2.0 -> 0.2.1
Member
Author
mabadir
approved these changes
Jul 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Greptile Summary
This PR introduces the new ECS Network Service (
rvn-ecs-nlb) module definition for TCP/UDP/TLS workloads behind a cluster NLB, and applies a repo-wide fix replacing the deprecateddata.aws_region.current.idattribute withdata.aws_region.current.regionacross all modules.rvn-ecs-nlbdefinition (compute/ecs_service/rvn-ecs-nlb-definition.yml): full-featured NLB service with TCP/UDP/TLS listener support, blue-green/linear/canary deployments, health check configuration, and CloudWatch metrics; backed by new security group ingress rules and NLB-cluster mapped-input partial.compute/ecs_cluster/load_balancers.tf): public NLB renamed from${name}-pub→${name}-pub-nlband private NLB from${name}-priv→${name}-priv-nlb; per-LB name-length validation blocks updated accordingly; newpublic_nlb_security_group_idandprivate_nlb_security_group_idoutputs added.data.aws_region.current.id→.regionapplied uniformly across all 20+ modulelocals.tffiles with matching patch-version bumps on definition YAMLs.Confidence Score: 4/5
Safe to merge after confirming the NLB rename impact on existing clusters; the new ECS Network Service definition and cross-repo region lookup fix are clean.
The NLB
namechange from-pub/-privto-pub-nlb/-priv-nlbinload_balancers.tfforces AWS to destroy and recreate both NLBs for any cluster that already has them provisioned, dropping all attached listeners and services during the replacement window. This is a real, current infrastructure risk for any user who applies the cluster module update.compute/ecs_cluster/load_balancers.tf and compute/ecs_cluster/rvn-ecs-cluster-definition.yml — the NLB rename and its versioning implications need to be addressed before merging.
Important Files Changed
-pub/-privsuffixes to-pub-nlb/-priv-nlb— an immutable AWS attribute that forces destroy-and-recreate of existing NLBs and all attached services.public_nlb_security_group_idandprivate_nlb_security_group_idoutputs, correctly guarded with nulls when the respective NLBs are disabled.aws_vpc_security_group_ingress_rule; protocol correctly derived from the listener protocol.load_balancer_ingress_cidr_blocks(with CIDR validation) andload_balancer_ingress_ipv6_cidr_blocksvariables added for NLB ingress control.rvn-ecs-nlb→compute/ecs_servicein the module path lookup table; both NLB and web definitions intentionally share the same module path.Sequence Diagram
%%{init: {'theme': 'neutral'}}%% sequenceDiagram participant User as User/Ravion participant Cluster as rvn-ecs-cluster participant NLB as AWS NLB (pub/priv) participant SG as NLB Security Group participant Service as rvn-ecs-nlb (ECS Service) participant TG as NLB Target Group User->>Cluster: enable public_nlb / private_nlb Cluster->>NLB: create name-pub-nlb / name-priv-nlb Cluster->>SG: create NLB security group Cluster-->>User: output public_nlb_arn, public_nlb_security_group_id, ... User->>Service: reference cluster (mapped inputs) Service->>TG: create target group (TCP/UDP/TLS) Service->>NLB: create listener on configured port Service->>SG: add ingress rule (ipv4 / ipv6 CIDR blocks) NLB->>TG: route traffic TG->>Service: forward to ECS tasks on container_port%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%% sequenceDiagram participant User as User/Ravion participant Cluster as rvn-ecs-cluster participant NLB as AWS NLB (pub/priv) participant SG as NLB Security Group participant Service as rvn-ecs-nlb (ECS Service) participant TG as NLB Target Group User->>Cluster: enable public_nlb / private_nlb Cluster->>NLB: create name-pub-nlb / name-priv-nlb Cluster->>SG: create NLB security group Cluster-->>User: output public_nlb_arn, public_nlb_security_group_id, ... User->>Service: reference cluster (mapped inputs) Service->>TG: create target group (TCP/UDP/TLS) Service->>NLB: create listener on configured port Service->>SG: add ingress rule (ipv4 / ipv6 CIDR blocks) NLB->>TG: route traffic TG->>Service: forward to ECS tasks on container_portComments Outside Diff (1)
compute/ecs_service/rvn-ecs-web-definition.yml, line 5-7 (link)release.versionandrelease.descriptionnot updated after name changeThe
namefield was changed from "ECS Web Server" to "ECS Web Service", which is a user-visible change. Per the module definition versioning policy, any change to a*-definition.ymlfile requires arelease.versionbump and an updatedrelease.description(a patch bump from0.7.0→0.7.1is appropriate here).Context Used: AGENTS.md (source)
Prompt To Fix With AI
Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
Reviews (2): Last reviewed commit: "fix(ecs-service): validate IPv6 ingress ..." | Re-trigger Greptile
Context used: