Terragrunt Variables
These are variables that can be found in the global.yaml, environment.yaml, region.yaml or module.yaml
files (or their *.user.yaml counterparts) inside the environments directory.
Metadata
Used for consistency across labels and tags.
| Variable | Type | Description | Recommended File |
|---|---|---|---|
environment | string | The name of the environment | environment.yaml |
region | string | The name of the region | region.yaml |
extra_tags | map(string) | An object containing extra tags to add to all resources in the current scope | Any |
Module Source
Used to configure the terraform.source option when deploying a module.
| Variable | Type | Description | Recommended File |
|---|---|---|---|
version | string | Configures include.panfactum.locals.source. The version of the local modules from PF_IAC_DIR you are using. Must be a valid commit ref to the stack repo. | environment.yaml |
pf_stack_version | string | Configures include.panfactum.locals.pf_stack_source. The version of the Panfactum stack you are using. Must be a valid commit ref to the stack repo. | environment.yaml |
module | string | If using include.panfactum.locals.source, defines which module from PF_IAC_DIR to use. If using, include.panfactum.locals.pf_stack_source, defines which module from packages/infrastructure to use. Defaults to the name of the module directory. | module.yaml |
State Backend Setup
The Panfactum setup stores OpenTofu (Terraform) state files in an S3 bucket in each environment's AWS account. To configure this behavior, the following variables must be set:
| Variable | Type | Description | Recommended File |
|---|---|---|---|
tf_state_account_id | string | The AWS account ID for the account containing the S3 backend | environment.yaml |
tf_state_profile | string | The AWS profile to use for authenticating with the S3 backend | environment.yaml |
tf_state_region | string | The AWS region to use for the S3 bucket | environment.yaml |
tf_state_bucket | string | The name of the state bucket | environment.yaml |
tf_state_lock_table | string | The name of the DynamoDB table for the state locks | environment.yaml |
Providers
Providers must be enabled via a providers key which is an array of string values. Each value represents a provider
to enable for the module. As a result, this key is typically found in the module.yaml.
The following provider strings are available:
awshelmkuberneteslocalrandomtimetlsvaultauthentik
In addition, some providers have additional configuration values that must be set.
aws Provider
| Variable | Type | Description | Recommended File |
|---|---|---|---|
aws_account_id | string | The AWS account ID to use for the provider | environment.yaml |
aws_profile | string | The AWS profile that will be used for provider authentication | environment.yaml |
aws_region | string | The AWS region to use for the provider | region.yaml |
aws_secondary_account_id | string | The AWS account ID to use for the secondary provider | environment.yaml |
aws_secondary_profile | string | The AWS profile that will be used for secondary provider authentication | environment.yaml |
aws_secondary_region | string | The AWS region to use for the secondary provider | region.yaml |
Note: The aws provider is actually a set of two different aws provider configurations: a primary and secondary.
The secondary is used in some Panfactum modules to configure things like backups in a secondary region.
kubernetes Provider
| Variable | Type | Description | Recommended File |
|---|---|---|---|
kube_api_server | string | The https URL of the Kubernetes API server the provider should connect to | region.yaml |
kube_config_context | string | The name of the context the provider should use in your repo's kubeconfig file | region.yaml |
vault Provider
| Variable | Type | Description | Recommended File |
|---|---|---|---|
vault_addr | string | The https URL of the Vault server the provider should connect to | region.yaml |
authentik Provider
| Variable | Type | Description | Recommended File |
|---|---|---|---|
authentik_url | string | The https URL of the Authenik server the provider should connect to | global.yaml |