Configuration

Configurations affecting how your platform gets built.

Keeping with the theme of building an opinionated platform, most configurations are optional.

When field with the type Object are optional, you can omit them entirely, or use {}. For such fields, the defaults are be specified in their own spec table.

CLI Spec

Field
Type
Description
Required

environmentName

String

The name of the environment that will be created and managed by the CLI. This name is also used in naming a lot of resources, like the eks cluster, the vpc and so on. This name should follow these rules:

  1. All lower-case

  2. Alpha-numeric, with - and _ allowed

  3. Must start with a letter

  4. Not more than 16 characters in length

Yes

aws

Object - AWS Spec

Configurations for all components deployed on AWS, including vpc, eks and so on

Yes

kubernetes

Object - Kubernetes Spec

Configurations for all services and operators running on the kubernetes cluster

No

AWS Spec

Field
Type
Description
Required

region

String

The name of the AWS region where you want to deploy your infrastructure. The name is the canonical name of the region like us-east-2 or eu-west-3

Yes

vpc

Object - VPC Spec

Configurations related to the vpc, subnets and other networking components

No

eks

Object - EKS Spec

Configurations for the eks cluster, and related components like node-groups and logging

No

routing

Object - Routing Spec

Configurations related to enabling public access for your services. Including Route53 zone creation, ACM TLS certificate and so on

No

VPC Spec

Field
Type
Description
Required
Default

cidr

String

The IPv4 network range for the VPC, in CIDR notation.

No

10.8.0.0/16

privateSubnets

Array[Subnet Spec]

Configuration for the private subnets to be attached to the VPC. These subnets are where all the eks workloads (your service pods) will be deployed

No

- cidr: "10.8.8.0/21"
- cidr: "10.8.16.0/21"

publicSubnets

Array[Subnet Spec]

Configuration for the private subnets to be attached to the VPC. Used for allowing public ingress/egress out of your Kubernetes cluster.

No

- cidr: "10.8.1.0/26"
- cidr: "10.8.2.0/26"

EKS Spec

Field
Type
Description
Required
Default

version

String

The Kubernetes version with which this eks cluster should be created.

No

1.29

nodeGroups

Array[EKSNodeGroup Spec]

Configuring the node-groups for the EKS clusters. Most people won't need to override this value since none of your workloads would be deployed on this node-group. This node-group only exists to launch Karpenter and External Secrets Operator. Nodes for the rest of the workloads are provisioned by Karpenter.

No

- name: "notops-default"
  instanceType: "t3.medium"
  minNodes: 2
  maxNodes: 20
  capacityType: "SPOT"
  amiType: "BOTTLEROCKET_x86_64"

logging

Object - EKSLogging Spec

Configurations for Cloudwatch Logging for the EKS cluster

No

logTypes:
  - "API"
  - "AUDIT"
retentionDays: 7

Routing Spec

The SSL cert is created and managed using AWS Certificate Manager. These certificates are free, and can be renewed automatically. There's also an option for you to import certificates bought from third-party providers.

Field
Type
Description
Required
Default

createSSLCert

Boolean

Whether CLI should create TLS/SSL certificate in AWS Certificate Manager

No

true

sslCertARN

String

AWS Certificate Manager ARN for an existing certificate. This is imported from third-party certificate providers you may have already purchased from for your domain. This certificate is assumed to be pre-validated. Follow these steps for importing certificate to AWS Certificate Manager. This config should only be set if createSSLCert flag is set to false

Yes, If createSSLCert is set to false

domainName

String

The public DNS domain-name for to use with your services. This is usually the top-level domain for your organizations, like example.com

Yes

enableWildcardSubdomains

Boolean

If the SSL cert should allow wild-card for sub-domains. If the domain you are using is example.com, setting this to true will allow *.example.com

No

true

subjectAlternativeNames

Array[String]

Additional values, most commonly hostnames, to attach to the SSL certificate, using Subject Alternative Names

No

[]

createHostedZoneForDomain

Boolean

Whether to create a public Route53 hosted-zone for your domain. If your domain is managed by a third-party provider, e.g. namecheap or godaddy, set this to false. Additionally, you can set this to true and configure your domain-provider with the nameservers from AWS

No

true

Subnet Spec

Field
Type
Description
Required

cidr

String

The IPv4 network range for this subnet, in CIDR notation. This CIDR must be contained within the CIDR for the VPC to which this subnet is going to be attached.

Yes

EKSNodeGroup Spec

Field
Type
Description
Required

name

String

The name of this node-group. If you create multiple node-groups, all node-group names must be unique within an EKS cluster

This name should follow these rules:

  1. At most 63 characters in length.

  2. Must start with a letter or digit, but can also include hyphens and underscores for the remaining characters

Yes

instanceType

String

One of the available EC2 instance types to use for the nodes in this node group. For example, t3.large or m7g.12xlarge. See all available types here

Yes

minNodes

Integer

The minimum number of worker nodes. Must be a number greater than 0.

Yes

maxNodes

Integer

The maximum number of worker nodes. Must be larger than or equal to minNodes

Yes

capacityType

String

One of the following values

  1. SPOT

  2. ON_DEMAND

Yes

amiType

String

One of the following values

  1. AL2_x86_64

  2. AL2_x86_64_GPU

  3. AL2_ARM_64

  4. BOTTLEROCKET_ARM_64

  5. BOTTLEROCKET_x86_64

  6. BOTTLEROCKET_ARM_64_NVIDIA

  7. BOTTLEROCKET_x86_64_NVIDIA

Yes

EKSLogging Spec

Amazon EKS control plane logging provides audit and diagnostic logs directly from the Amazon EKS control plane to CloudWatch Logs in your account. In clusters created by NotOps, this logging is enabled by default for certain components.

Field
Type
Description
Required

logTypes

Array[String]

The EKS control-plane components for which to generate logs. Each log-type corresponds to a control-plane component. To learn more about these components, see Kubernetes Components in the Kubernetes documentation. Following log-types are available:

  1. API: Enables logs for the kube-apiserver component

  2. AUDIT: Kubernetes audit logs provide a record of the individual users, administrators, or system components that have affected your cluster. See auditing for more details

  3. AUTHENTICATOR: Authenticator logs are unique to Amazon EKS. These logs represent the control plane component that Amazon EKS uses for Kubernetes Role Based Access Control (RBAC) authentication using IAM credentials

  4. CONTROLLER_MANAGER: The controller manager manages the core control loops that are shipped with Kubernetes. For more information, see kube-controller-manager

  5. SCHEDULER: The scheduler component manages when and where to run Pods in your cluster. For more information, see kube-scheduler

Yes. You can specify an empty array to disable all control-plane logs

retentionDays

Integer

The number of days to retain the control-plane logs in Cloudwatch. Must be one of the values from 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1096, 1827, 2192, 2557, 2922, 3288, 3653

Yes

Kubernetes Spec

Field
Type
Description
Required
Default

global

Object - K8sGlobal Spec

The shared config that will be applied to all services installed by the CLI

No

{}

argocd

Object

Configuration for the Argo CD Helm Chart. All values from the chart's default values.yaml are supported and can be overridden

No

redis-ha:
  enabled: false

controller:
  replicas: 1

server:
  autoscaling:
    enabled: true
    minReplicas: 1

repoServer:
  autoscaling:
    enabled: true
    minReplicas: 1

applicationSet:
  enabled: false

awsLoadBalancerController

Object

Configuration for the AWS Load Balancer Controller Helm Chart. All values from the chart's default values.yaml are supported and can be overridden

No

replicaCount: 1

externalSecrets

Object

Configuration for the External Secrets Helm Chart. All values from the chart's default values.yaml are supported and can be overridden

No

# Without this, the generated names look like "release-name-external-secrets"
fullnameOverride: "external-secrets"

istio

Object

Configuration for the following Istio helm charts:

  1. istio-base

  2. istio-cni

  3. istiod

The three charts here have namespaced configs and a shared config under a key global. Because the configs are namespaced, we can provide a single config object that works with all three.

No

global:
  priorityClassName: system-cluster-critical


##############################################################################################################
# CNI chart section from https://artifacthub.io/packages/helm/istio-official/cni/1.20.2?modal=values
##############################################################################################################

cni:
  enabled: true
  chained: true # it's true by default, but we want to make it explicit

##############################################################################################################
# Istio Discovery Chart section from https://artifacthub.io/packages/helm/istio-official/istiod/1.20.2?modal=values
##############################################################################################################

meshConfig:
  accessLogFile: /dev/stdout

# This has to be configured separately from the "cni" section
# https://istio.io/latest/docs/setup/additional-setup/cni/#installing-with-helm
istio_cni:
  enabled: true
  chained: true # it's true by default, but we want to make it explicit

istioIngressGateway

Object

Creates an Istio Gateway for routing ingress traffic into the Kubernetes cluster, using Istio Gateway Helm Chart. All values from the chart's default values.yaml are supported and can be overridden

No

name: "istio-ingressgateway"

service:
  ports:
    - name: http
      port: 443
      protocol: TCP
      targetPort: 80
  annotations:
    "service.beta.kubernetes.io/aws-load-balancer-scheme": "internet-facing"
    "service.beta.kubernetes.io/aws-load-balancer-type": "external"
    "service.beta.kubernetes.io/aws-load-balancer-nlb-target-type": "ip"
    "service.beta.kubernetes.io/aws-load-balancer-healthcheck-port": "15021"
    "service.beta.kubernetes.io/aws-load-balancer-healthcheck-path": "/healthz/ready"

karpenter

Object

Configuration for the Karpenter Helm Chart. All values from the chart's default values.yaml are supported and can be overridden

No

fullnameOverride: "karpenter"
# Need karpenter to be very reliable
# It already has default settings for topology spread constraints and node affinity/anti-affinity to spread it across
# AZs (if multiple AZs are available)
replicas: 2

K8sGlobal Spec

Field
Type
Description
Required
Default

docker

Object - K8sDocker Spec

Global configuration related to Docker, like docker-registry

No

{}

secrets

Object - K8sSecrets Spec

Global secrets to use with all Kubernetes services deployed by the CLI. For example, secrets that allow pulling from a private docker registry

No

{}

K8sDocker Spec

Field
Type
Description
Required

registryUrl

String

The docker registry URL where you have mirrored the images for all the Kubernetes services deployed by the CLI If this is a private registry, you must specify the imagePullSecret config that provides the credentials for pulling from that registry

No

K8sSecrets Spec

Field
Type
Description
Required
Default

dockerImagePull

Array[K8sImagePullSecret Spec]

A list of secrets to be used for pulling container images from a private registry. At least one secret must be specified if a private registry is being used to host the images to be deployed by the CLI If more than one secret is specified, they will be tried in order until one succeeds.

No

{}

K8sImagePullSecret Spec

Field
Type
Description
Required

name

String

The name of the secret. If you provide multiple secrets, each must have a unique name. This name will also be used to create a Kubernetes Secret, and must be a valid name for such objects.

Yes

providerType

String

One of:

  1. AWS_SECRETS_MANAGER

(only one provider supported at the moment)

Yes

config

Object - K8sImagePullSecretConfig Spec

Provider specific configuration, with details about the secret

One of:

  1. AWS_SECRETS_MANAGER

Yes

K8sImagePullSecretConfig Spec

This config object will differ based on the type of the Secret Provider used. See K8sImagePullSecret Spec for a list of supported providers.

AWS_SECRETS_MANAGER

Field
Type
Description
Required

path

String

The name of the secret in AWS Secrets Manager. This usually looks like a file-system path. For example /my-team/service-x/database The name must contain between 1 and 512 characters

Yes

PreviousReferenceNextCLI Commands

Last updated