Variables and external prerequisites¶
This reference separates pipeline inputs, HCL inputs and prerequisites not created by the code. The inventory comes from commit ae1502b0: 110 declarations in variables.tf and 37 in remote-state.tf, across eight roots. Private values configured in GitLab are not visible in this analysis.
Operator-supplied variables¶
| CI variable | Provider / use | Code contract | Handling |
|---|---|---|---|
CLOUD_PROVIDER |
Both | aws or gcp; default aws |
Select explicitly |
PIPELINE_ACTION |
Both | create or destroy; default destroy |
Select explicitly |
ENVIRONMENT |
Both | State prefix; default pro |
Check correspondence with existing resources |
TF_STATE_TOKEN |
Both | Credential for reading other states; HTTP username oauth2 |
Secret with access to the required states |
REST_DB_PASSWORD |
Both, database and platform | Exported as TF_VAR_rest_db_password |
Required for those roots; keep the same value in both |
REST_DB_USER |
Both, database and platform | Overrides rest_db_user; HCL default restuser |
Keep database and Secret consistent |
AGENT_TOKEN |
AWS platform | Exported as TF_VAR_agent_token |
Secret EKS Agent token |
GKE_AGENT_TOKEN |
GCP platform | Exported as TF_VAR_gke_agent_token |
Secret GKE Agent token |
KAS_ADDRESS |
Both platforms | Exported as TF_VAR_kas_address |
Agent Server address supplied by the GitLab installation |
AWS_REGION |
AWS | If present, overrides TF_VAR_region |
HCL default eu-west-1 |
GCP_PROJECT_ID |
GCP | If present, exports TF_VAR_project_id |
Required unless supplied through equivalent TF_VAR_project_id |
GCP_REGION |
GCP | If present, overrides TF_VAR_region |
HCL default europe-west1 |
GCP_SERVICE_ACCOUNT_KEY |
GCP | JSON contents, written to a file by the job | Sensitive credential; not a File-variable contract |
A GitLab File variable containing the GCP key exposes a path to the shell. The current script would write that path as though it were JSON. Adopting a File variable requires adapting the GOOGLE_APPLICATION_CREDENTIALS assignment; changing only the variable type in the UI is insufficient.
AWS authentication comes from the provider/CLI credential chain. A runner may receive environment credentials (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and, where applicable, AWS_SESSION_TOKEN) or another configured identity. The repository does not declare GitLab OIDC, a provisioning role or its complete policy. CI federation absent from the source is not documented as implemented.
Configure sensitive variables in GitLab with appropriate access and exposure controls. For protected variables, check that the branch and execution context are authorized to receive them. Do not attach values to issues, published plans or documentation.
Pipeline-derived variables¶
STACK is set per job. TF_ROOT, TF_STATE_NAME, the four <LAYER>_STATE_NAME values, TF_HTTP_ADDRESS, TF_HTTP_LOCK_ADDRESS, TF_HTTP_UNLOCK_ADDRESS, TF_HTTP_USERNAME, TF_HTTP_PASSWORD, HTTP methods and retry wait are calculated in .tofu_base. GitLab supplies CI_API_V4_URL, CI_PROJECT_ID, CI_PROJECT_DIR and CI_JOB_TOKEN. Do not copy values from a previous run into permanent configuration.
State references use the following families. All corresponding HCL parameters are required; the job injects them, so there is no need to enter them individually in the UI.
| HCL family | Declared fields | Consumers |
|---|---|---|
network_state_* |
address, username, password; also lock_address and unlock_address in Kubernetes |
AWS and GCP: kubernetes, database and platform |
eks_state_* |
address, username, password |
AWS: database and platform |
rds_state_* |
address, username, password |
AWS: platform |
gke_state_* |
address, username, password |
GCP: platform |
database_state_* |
address, username, password |
GCP: platform |
HCL marks username and password as sensitive. The pipeline also exports lock and platform aliases that some roots do not declare. This does not add dependencies or resources. The read map is described in state.
HCL inputs by root¶
Supply TF_VAR_<name> to override an input. Maps and lists need an OpenTofu-compatible representation, such as JSON. The CI aliases above are exported in before_script; when present, they overwrite their corresponding TF_VAR_* value.
In the tables, required means HCL defines no default. null is preserved where the code delegates the choice. Listed values are not production sizing recommendations.
aws/network¶
Source: variables.tf.
| Variable | Type | Default | Sensitive |
|---|---|---|---|
region |
string |
"eu-west-1" |
— |
name |
string |
"gitlab-terraform-eks" |
— |
vpc_cidr |
string |
"10.0.0.0/16" |
— |
private_subnets |
list(string) |
[ "10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24" ] |
— |
public_subnets |
list(string) |
[ "10.0.4.0/24", "10.0.5.0/24", "10.0.6.0/24" ] |
— |
enable_nat_gateway |
bool |
true |
— |
single_nat_gateway |
bool |
true |
— |
tags |
map(string) |
{Project="tfm", Environment="dev", ManagedBy="opentofu"} |
— |
aws/kubernetes¶
Source: variables.tf.
| Variable | Type | Default | Sensitive |
|---|---|---|---|
region |
string |
"eu-west-1" |
— |
cluster_name |
string |
"gitlab-terraform-eks" |
— |
cluster_version |
string |
"1.31" |
— |
cluster_endpoint_public_access |
bool |
true |
— |
cluster_endpoint_public_access_cidrs |
list(string) |
["0.0.0.0/0"] |
— |
instance_type |
string |
"t3.small" |
— |
min_instance_count |
number |
1 |
— |
max_instance_count |
number |
3 |
— |
desired_instance_count |
number |
1 |
— |
tags |
map(string) |
{Project="tfm", Environment="dev", ManagedBy="opentofu"} |
— |
aws/database¶
Source: variables.tf.
| Variable | Type | Default | Sensitive |
|---|---|---|---|
region |
string |
"eu-west-1" |
— |
name |
string |
"gitlab-terraform-eks" |
— |
rest_db_database |
string |
"restdb" |
— |
rest_db_user |
string |
"restuser" |
— |
rest_db_password |
string |
Required | Yes |
rest_db_port |
number |
3306 |
— |
rest_db_engine_version |
string |
"8.0" |
— |
rest_db_instance_class |
string |
"db.t4g.micro" |
— |
rest_db_allocated_storage |
number |
20 |
— |
rest_db_max_allocated_storage |
number |
100 |
— |
backup_retention_period |
number |
1 |
— |
deletion_protection |
bool |
false |
— |
skip_final_snapshot |
bool |
true |
— |
tags |
map(string) |
{Project="tfm", Environment="dev", ManagedBy="opentofu"} |
— |
aws/platform¶
Source: variables.tf.
| Variable | Type | Default | Sensitive |
|---|---|---|---|
region |
string |
"eu-west-1" |
— |
name |
string |
"gitlab-terraform-eks" |
— |
aws_load_balancer_controller_namespace |
string |
"kube-system" |
— |
aws_load_balancer_controller_service_account |
string |
"aws-load-balancer-controller" |
— |
agent_namespace |
string |
"gitlab-agent" |
— |
agent_token |
string |
Required | Yes |
kas_address |
string |
Required | — |
app_namespace |
string |
"app" |
— |
rest_db_user |
string |
"restuser" |
— |
rest_db_password |
string |
Required | Yes |
tags |
map(string) |
{Project="tfm", Environment="dev", ManagedBy="opentofu"} |
— |
gcp/network¶
Source: variables.tf.
| Variable | Type | Default | Sensitive |
|---|---|---|---|
project_id |
string |
Required | — |
region |
string |
"europe-west1" |
— |
name |
string |
"gitlab-terraform-gke" |
— |
vpc_cidr |
string |
"10.0.0.0/16" |
— |
private_subnets |
list(string) |
[ "10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24" ] |
— |
public_subnets |
list(string) |
[ "10.0.4.0/24", "10.0.5.0/24", "10.0.6.0/24" ] |
— |
enable_cloud_nat |
bool |
true |
— |
single_nat_gateway |
bool |
true |
— |
private_google_access |
bool |
true |
— |
gke_pods_secondary_range_name |
string |
"gke-pods" |
— |
gke_services_secondary_range_name |
string |
"gke-services" |
— |
gke_pods_secondary_cidr |
string |
"10.10.0.0/16" |
— |
gke_services_secondary_cidr |
string |
"10.20.0.0/20" |
— |
labels |
map(string) |
{project="tfm", environment="dev", managed_by="opentofu"} |
— |
gcp/kubernetes¶
Source: variables.tf.
| Variable | Type | Default | Sensitive |
|---|---|---|---|
project_id |
string |
Required | — |
region |
string |
"europe-west1" |
— |
cluster_name |
string |
"gitlab-terraform-gke" |
— |
cluster_version |
string |
null |
— |
regional |
bool |
true |
— |
zones |
list(string) |
[ "europe-west1-b", "europe-west1-c" ] |
— |
cluster_endpoint_public_access |
bool |
true |
— |
cluster_endpoint_public_access_cidrs |
list(string) |
["0.0.0.0/0"] |
— |
master_ipv4_cidr_block |
string |
"172.16.0.0/28" |
— |
machine_type |
string |
"e2-small" |
— |
disk_size_gb |
number |
50 |
— |
disk_type |
string |
"pd-balanced" |
— |
min_instance_count |
number |
1 |
— |
max_instance_count |
number |
3 |
— |
desired_instance_count |
number |
1 |
— |
node_service_account_id |
string |
"gke-node-sa" |
— |
node_service_account_roles |
list(string) |
[ "roles/logging.logWriter", "roles/monitoring.metricWriter", "roles/monitoring.viewer" ] |
— |
enable_workload_identity |
bool |
true |
— |
enable_gce_pd_csi_driver |
bool |
true |
— |
deletion_protection |
bool |
false |
— |
labels |
map(string) |
{project="tfm", environment="dev", managed_by="opentofu"} |
— |
gcp/database¶
Source: variables.tf.
| Variable | Type | Default | Sensitive |
|---|---|---|---|
project_id |
string |
Required | — |
region |
string |
"europe-west1" |
— |
name |
string |
"gitlab-terraform-gke" |
— |
rest_db_database |
string |
"restdb" |
— |
rest_db_user |
string |
"restuser" |
— |
rest_db_password |
string |
Required | Yes |
rest_db_port |
number |
3306 |
— |
rest_db_engine_version |
string |
"MYSQL_8_0" |
— |
rest_db_instance_tier |
string |
"db-f1-micro" |
— |
rest_db_disk_size |
number |
20 |
— |
rest_db_disk_autoresize |
bool |
true |
— |
rest_db_disk_autoresize_limit |
number |
100 |
— |
rest_db_availability_type |
string |
"ZONAL" |
— |
backup_enabled |
bool |
true |
— |
backup_start_time |
string |
"02:00" |
— |
deletion_protection |
bool |
false |
— |
private_service_access_prefix_length |
number |
16 |
— |
labels |
map(string) |
{project="tfm", environment="dev", managed_by="opentofu"} |
— |
gcp/platform¶
Source: variables.tf.
| Variable | Type | Default | Sensitive |
|---|---|---|---|
project_id |
string |
Required | — |
region |
string |
"europe-west1" |
— |
name |
string |
"gitlab-terraform-gke" |
— |
agent_namespace |
string |
"gitlab-agent" |
— |
gke_agent_token |
string |
Required | Yes |
kas_address |
string |
Required | — |
app_namespace |
string |
"app" |
— |
app_service_account_name |
string |
"app" |
— |
create_app_service_account |
bool |
true |
— |
enable_app_workload_identity |
bool |
false |
— |
app_google_service_account_email |
string |
null |
— |
rest_db_user |
string |
"restuser" |
— |
rest_db_password |
string |
Required | Yes |
labels |
map(string) |
{project="tfm", environment="dev", managed_by="opentofu"} |
— |
Settings that must be coordinated¶
- Environments:
ENVIRONMENTdoes not change cloud names. Name-based isolation requires coordinating at leastname,cluster_name, the GCP node identity and tags, alongside chosen accounts/projects and networks. Changing an existing resource's state name is not a substitute for a migration. - GCP regions: changing
GCP_REGIONleaveszonesat itseurope-west1defaults; update both coherently. - DB credentials: keep
REST_DB_USERandREST_DB_PASSWORDconsistent betweendatabaseandplatform. Updating a Secret does not guarantee that an already-running pod reloads environment variables. - GCP networking: only the first entry of each subnet list is used.
single_nat_gatewayis unused andvpc_cidris logical. The platform roots'nameinput is not used to rename namespaces or releases. - Availability and retention: AWS hardcodes
multi_az=falseon the resource; no variable enables it. GCP exposes SQLZONAL/REGIONAL. Review backups, deletion protection and snapshots before storing data that must be preserved. - Workload Identity: enabling the pool and annotating
appdoes not create its IAM binding or change therest/webaccounts used by the applications.
Dependencies outside these roots¶
| Prerequisite | What must exist before the relevant phase |
|---|---|
| GitLab | Project, working runner, container-image access, reachable state backend, permissions and variables |
| AWS identity | Authentication and permissions for the declared EC2/VPC, IAM, EKS, RDS and related resources; verify cluster-access capability |
| GCP project | Billing, required Compute/GKE/Cloud SQL/Service Networking/IAM APIs and quotas |
| GCP identity | Account authorized to provision resources and access Kubernetes during bootstrap; the repository supplies no complete IAM policy |
| GitLab Agents | Registration of eks-agent and gke-agent, tokens and KAS_ADDRESS; see access |
| AWS exposure | ACM certificate and application DNS adapted to the Ingress manifest |
| Application | Container Registry read credential and registry Secret in each cluster; neither Terraform nor the inspected deployment creates it |
| GitLab environments | Cluster connections and permissions matching the deployment workflow; private configuration cannot be verified from the repository |
These permission categories are not a validated least-privilege IAM policy. Define them for the account and organization before execution. No cloud credential is needed to build or publish this documentation site.
Sources¶
- Pipeline: input mapping and backend.
- Per-root tables link to each
variables.tfat the reviewed commit. The 37 state parameters are declared in the six consumer-layerremote-state.tffiles. - AWS provider authentication.
- Thesis §7.2.7, printed pages 43–49 (PDF 49–55). The complete inventory and missing prerequisites come from source inspection.