You are implementing Task C4 of an implementation plan: update the existing `README.md` of the `eks-cluster-applications` Terraform module to document the new `vector_*` variables and the data-flow change introduced by Phase B/C.

## Context

- Working directory: `/Users/steve.briggs/projects/IAC/terraform/iac-library/aws/compute/eks-cluster-applications`
- Existing `README.md` is 326 lines — established structure already in place. Read it first to understand the existing organization (e.g., how it documents the `otel_collector_*`, `fluxcd_*`, `application_deployment_*`, etc. surfaces). Match that style.
- New `vector.tf` file (created in C1) introduces 12 new variables:
  - `vector_chart_version` (required when enabled)
  - `vector_image_tag` (required when enabled)
  - `vector_datadog_site` (required when enabled)
  - `vector_datadog_api_key_vault_path` (required when enabled)
  - `vector_external_secrets_cluster_store_name` (required when enabled — name of the ClusterSecretStore created by external-secrets module)
  - `vector_enabled_cluster_types` (map; defaults: mgmt/cps/saas=true, infra/dev=false)
  - `vector_enabled` (bool, nullable; default null)
  - `vector_image` (default `registry.ic-ops.net/cache-docker-hub/timberio/vector`)
  - `vector_replicas` (number, default 3)
  - `vector_audit_drop_patterns` (list of strings, defaults to the two Immuta audit patterns)
  - `vector_email_redaction_enabled` (bool, default true)
  - `vector_email_redaction_replacement` (string, default `[REDACTED-EMAIL]`)
  - `vector_additional_config` (any, default null — escape hatch)
- The data flow when `vector_enabled = true`:
  - `apps → otel-lb → otel-collector → vector → Datadog`
  - Vector applies VRL transforms: drops audit log lines and redacts email addresses across logs/traces/metrics.
- When `vector_enabled = false` (or unset): `apps → otel-lb → otel-collector → Datadog` (unchanged).

## Task Description

### Task C4: README updates in eks-cluster-applications

**Files:**
- Modify: `terraform/iac-library/aws/compute/eks-cluster-applications/README.md`

- [ ] **Step 1: Read the existing `README.md`** thoroughly. Note where other modules' variables are documented and what the section structure looks like.

- [ ] **Step 2: Add a `vector_*` section** in the appropriate place — likely alongside other in-cluster components like `otel_collector_*`, `external_secrets_*`, etc. The section should:

   - Briefly describe what Vector does (in-cluster aggregator that receives OTLP from the otel-collector and applies VRL transforms before shipping to Datadog).
   - Note the data-flow change: when `vector_enabled = true`, the otel-collector's terminal exporter routes through Vector instead of direct-to-Datadog. The Datadog API key moves from the otel-collector's secret reference to the Vector module's ExternalSecret.
   - Tabulate the 12 new variables (or document them in the same style as the existing variables in the README — list, table, or paragraph).
   - Cross-link to `docs/superpowers/specs/2026-05-05-vector-redaction-design.md` (the design spec, located at `/Users/steve.briggs/projects/IAC/docs/superpowers/specs/2026-05-05-vector-redaction-design.md`).

- [ ] **Step 3: Add a brief note** somewhere that explains how to enable Vector for a particular cluster:

   ```hcl
   vector_enabled                            = true
   vector_chart_version                      = "0.36.0"
   vector_image_tag                          = "0.40.0-distroless-libc"
   vector_datadog_site                       = "datadoghq.com"
   vector_datadog_api_key_vault_path         = "secret/data/datadog/api-key"
   vector_external_secrets_cluster_store_name = "vault-cluster-store"
   ```

- [ ] **Step 4: If the existing README mentions otel_collector behavior in a way that's now changed** (e.g., "otel-collector exports directly to Datadog"), update that text to reflect the new dual-mode behavior (direct vs. via-Vector).

- [ ] **Step 5: Self-review.** Don't break existing structure or formatting; keep additions concise and aligned with the README's existing voice.

## Constraints

- **DO NOT run any git commands.**
- **DO NOT** push, tag, open MRs.
- **DO NOT** modify any other files in this task — only `README.md` in this directory.

## Spec / plan references

- Spec: `/Users/steve.briggs/projects/IAC/docs/superpowers/specs/2026-05-05-vector-redaction-design.md`
- Plan: `/Users/steve.briggs/projects/IAC/docs/superpowers/plans/2026-05-05-vector-redaction-pipeline.md` Task C4

## Report Format

- **Status:** DONE | DONE_WITH_CONCERNS | BLOCKED | NEEDS_CONTEXT
- Lines added (and any modified) to README
- Variables documented (count)
- Whether existing otel-collector copy needed updating (and how)
- Self-review findings


I'll start by reading the existing README and the spec file to understand the structure and context.


Error: File content (30571 tokens) exceeds maximum allowed tokens (25000). Use offset and limit parameters to read specific portions of the file, or search for specific content instead of reading the whole file.


1	# Vector + OpenTelemetry Redaction Pipeline — Design Spec
2
3	**Date:** 2026-05-05
4	**Author:** steve.briggs@immuta.com (with Claudebob)
5	**Status:** Draft, pending review
6
7	---
8
9	## 1. Overview
10
11	### Problem
12
13	Today the telemetry path on EKS clusters in this org is:
14
15	```
16	apps → otel-lb → otel-collector → Datadog (logs, APM, metrics)
17	```
18
19	Sensitive-data exclusion lives in **Datadog Agent processing rules** under
20	`kubernetes/applications/datadog-processing-rules`. Both `prod` and `staging` ship
21	the same `rules.json` containing two `exclude_at_match` entries that drop Immuta
22	audit log lines before they reach Datadog. `apm.json` is empty.
23
24	These rules are tied to the Datadog Agent's processing pipeline and only operate
25	on logs. They cannot redact span attributes or metric labels, and there is no
26	straightforward way to add modify-style transforms (e.g., replace email
27	addresses with a placeholder) within that surface.
28
29	### Goal
30
31	Insert **Vector** as a new in-cluster aggregator between the OTel collector and
32	Datadog. Vector replaces today's Datadog-side exclusion rules with VRL-based
33	filter and remap transforms, applied uniformly across logs, traces, and metrics.
34
35	The day-1 rule set replicates today's two audit exclusions and adds email
36	redaction across all three signals. The architecture leaves room to grow
37	additional patterns (SSN, credit cards, tokens, attribute drops, service-level
38	allow/deny) without further structural change.
39
40	### Non-goals (v1)
41
42	- Replacing the OTel collector.
43	- Removing the Datadog Agent (it remains for host metrics / kubelet stats).
44	- Decommissioning `kubernetes/applications/datadog-processing-rules` (separate effort).
45	- Per-cluster rule overlays beyond the Terraform variable surface.
46	- Dynamic / runtime-loaded rules.
47	- mTLS between OTel and Vector.
48	- Vector Agent-mode / DaemonSet collection.
49
50	---
51
52	## 2. Architecture
53
54	```
55	                                     [ in-cluster ]
56	  ┌──────────┐  OTLP  ┌─────────┐  OTLP  ┌────────────────┐  OTLP  ┌──────────────────┐ Datadog
57	  │   apps   │ ─────▶ │ otel-lb │ ─────▶ │ otel-collector │ ─────▶ │ vector aggregator│ ──────▶  Datadog SaaS
58	  └──────────┘        └─────────┘        └────────────────┘        │ - OTLP source    │  (logs, APM,
59	                                                                   │ - VRL transforms │   metrics)
60	                                                                   │ - Datadog sinks  │
61	                                                                   └──────────────────┘
62	```
63
64	**Components:**
65
66	- **OTel collector** keeps its current shape (`otel-lb` front tier + `otel-collector` back tier). Its terminal exporter switches from `datadog` to `otlp` (gRPC), pointed at the Vector Service.
67	- **Vector** runs as a Deployment with N replicas (default 3, matching OTel's tier), fronted by a ClusterIP Service. Receives OTLP, applies VRL transforms, ships to Datadog via Vector's native `datadog_logs` / `datadog_traces` / `datadog_metrics` sinks.
68	- **Datadog API key** moves from the OTel exporter config to Vector. Sourced from Vault via the existing `external-secrets` operator.
69
70	**Cluster scope.** Vector is enabled on the same cluster types as the OTel
71	collector by default: `mgmt`, `cps`, `saas` true; `infra`, `dev` false. A single
72	`vector_enabled` bool variable overrides the per-cluster-type default, matching
73	the established pattern in this module.
74
75	---
76
77	## 3. Terraform layout
78
79	Three changes across two repos.
80
81	### 3.1 `internal-modules/kubernetes/monitoring/otel-collector` v1.0.7 → v1.1.0
82
83	Backwards-compatible bump. New variables:
84
85	| Variable | Type | Default | Purpose |
86	|---|---|---|---|
87	| `downstream_endpoint` | string | `""` | When non-empty, swaps terminal exporter to OTLP |
88	| `downstream_protocol` | string | `"otlp/grpc"` | Wire protocol |
89
90	When `downstream_endpoint` is non-empty, the rendered helm values gain an
91	`exporters.otlp` block and `service.pipelines.{logs,traces,metrics}.exporters`
92	swap from `[datadog]` to `[otlp]`. The Datadog exporter block and its API-key
93	mount fall away under the same conditional. Empty preserves today's
94	direct-to-Datadog behavior — clusters that don't enable Vector see no behavioral
95	change.
96
97	### 3.2 `internal-modules/kubernetes/monitoring/vector` v1.0.0 (new module)
98
99	Mirrors the shape of the `otel-collector` internal-module: same provider wiring
100	(`kubernetes`, `helm`), same variable patterns, same approach to image / chart /
101	replica overrides.
102
103	What it creates:
104
105	- `kubernetes_namespace.vector` — the `vector` namespace.
106	- `kubernetes_manifest` for an `ExternalSecret` pulling the Datadog API key from Vault, using the same external-secrets cluster store the rest of the platform uses. Terraform waits for the underlying Secret object before proceeding.
107	- `helm_release.vector` — wraps the upstream `timberio/vector` chart with values templated from the variables below. Deployment annotated with `reloader.stakater.com/auto: "true"` so the existing reloader operator restarts pods on Datadog-key rotation.
108
109	Module variables (initial set):
110
111	| Variable | Type | Default | Purpose |
112	|---|---|---|---|
113	| `chart_version` | string | required | Vector helm chart version pin |
114	| `image` | string | `registry.ic-ops.net/cache-docker-hub/timberio/vector` | Image source |
115	| `image_tag_version` | string | required | Image tag |
116	| `replicas` | number | `3` | HA matches OTel collector tier |
117	| `datadog_site` | string | required | e.g. `datadoghq.com` / `us3.datadoghq.com` |
118	| `datadog_api_key_vault_path` | string | required | Vault path for ExternalSecret |
119	| `audit_drop_patterns` | list(string) | `["Audit\\s-\\s.+", "\"level\":\"audit\""]` | Day-1 exclude rules |
120	| `email_redaction_enabled` | bool | `true` | Toggle email redaction |
121	| `email_redaction_replacement` | string | `"[REDACTED-EMAIL]"` | Replacement marker |
122	| `additional_config` | any | `null` | Escape-hatch — overwrites `customConfig` wholesale, mirroring `otel_collector_additional_config` semantics |
123	| `resources_requests` / `resources_limits` | map | see Section 6 | Resource tuning |
124
125	### 3.3 `eks-cluster-applications` (this repo)
126
127	**New file `vector.tf`** — pure mirror of `otel_collector.tf`'s shape:
128
129	```hcl
130	locals {
131	  vector_enabled = (
132	    var.vector_enabled != null
133	    ? var.vector_enabled
134	    : lookup(var.vector_enabled_cluster_types, local.cluster_type, true)
135	  )
136	  vector_endpoint = "http://vector.vector.svc.cluster.local:4317"
137	}
138
139	module "vector" {
140	  source = "git@gitlab.infrastructure.immuta.io:infrastructure/terraform/internal-modules/kubernetes/monitoring/vector.git?ref=v1.0.0"
141	  count  = local.vector_enabled ? 1 : 0
142
143	  providers = {
144	    kubernetes = kubernetes.local-cluster
145	    helm       = helm.local-cluster
146	  }
147
148	  chart_version               = var.vector_chart_version
149	  image                       = var.vector_image
150	  image_tag_version           = var.vector_image_tag
151	  replicas                    = var.vector_replicas
152	  datadog_site                = var.vector_datadog_site
153	  datadog_api_key_vault_path  = var.vector_datadog_api_key_vault_path
154	  audit_drop_patterns         = var.vector_audit_drop_patterns
155	  email_redaction_enabled     = var.vector_email_redaction_enabled
156	  email_redaction_replacement = var.vector_email_redaction_replacement
157	  additional_config           = var.vector_additional_config
158
159	  depends_on = [
160	    module.cilium,
161	    module.external_secrets,
162	  ]
163	}
164	```
165
166	Plus variable declarations matching the otel-collector module's style.
167	`vector_enabled_cluster_types` defaults match OTel: `mgmt/cps/saas = true`,
168	`infra/dev = false`. A `data "external"` validation block enforces
169	`vector_enabled ⇒ external_secrets_enabled` (the Vault-backed key requires it).
170
171	**Edits to `otel_collector.tf`:**
172
173	- Bump `?ref=v1.0.7` → `?ref=v1.1.0`.
174	- Pass `downstream_endpoint = local.vector_enabled ? local.vector_endpoint : ""`.
175	- Add `depends_on = [module.vector]` so Vector's Service exists before OTel reconciles. (Belt-and-suspenders — OTLP exporter retries handle the runtime race.)
176
177	---
178
179	## 4. Vector configuration
180
181	Vector runs in **aggregator role** (it receives OTLP from another in-cluster
182	service rather than tailing files).
183
184	### 4.1 Pipeline topology
185
186	```
187	                ┌─ logs    ──▶ drop_audit ──▶ redact_emails_logs    ──▶ datadog_logs
188	otlp_in (4317   │
189	gRPC + 4318    ─┼─ traces  ──────────────────▶ redact_emails_traces  ──▶ datadog_traces
190	HTTP)          │
191	                └─ metrics ──────────────────▶ redact_emails_metrics ──▶ datadog_metrics
192	```
193
194	Three pipelines, one per signal. The `drop_audit` filter runs on logs only (the
195	day-1 rules are message-text patterns). Email redaction runs on all three.
196
197	### 4.2 VRL — audit-drop filter (logs only)
198
199	Vector's `filter` transform passes events for which the condition returns
200	`true`, so the condition is the inverse of what gets dropped:
201
202	```toml
203	[transforms.drop_audit]
204	type = "filter"
205	inputs = ["otlp_in.logs"]
206	condition = '''
207	  msg = string!(.message ?? "")
208	  !match(msg, r'Audit\s-\s.+') && !match(msg, r'"level":"audit"')
209	'''
210	```
211
212	`audit_drop_patterns` is templated into the helm values from the Terraform
213	variable. The default ships the two patterns from
214	`datadog-processing-rules/{prod,staging}/rules.json`.
215
216	### 4.3 VRL — email-redact transform (all three signals)
217
218	Per-signal `remap` transforms apply the same shared pattern. Log shape (the
219	simple case):
220
221	```toml
222	[transforms.redact_emails_logs]
223	type = "remap"
224	inputs = ["drop_audit"]
225	source = '''
226	  email_re = r'[\w._%+\-]+@[\w.-]+\.[A-Za-z]{2,}'
227
228	  if exists(.message) {
229	    .message = replace(string!(.message), email_re, "[REDACTED-EMAIL]")
230	  }
231
232	  # walk top-level attributes for string values containing emails
233	  if is_object(.attributes) {
234	    .attributes = map_values(object!(.attributes)) -> |v| {
235	      if is_string(v) { replace(v, email_re, "[REDACTED-EMAIL]") } else { v }
236	    }
237	  }
238	'''
239	```
240
241	Trace and metric variants apply the same `map_values` walk over `attributes`
242	and `resource.attributes`, plus span-event attributes for traces. The email
243	regex and the replacement string are both templated from Terraform variables.
244
245	**Limitation called out:** if an email is buried inside a stringified JSON
246	attribute value (e.g. `http.request.body` holding raw JSON text), the regex
247	catches it because it operates on string content. If it's deeply nested in a
248	structured object map, only values reachable by `map_values` are scanned. v1
249	does **not** recurse into nested object trees — kept simple to avoid runaway
250	transform CPU on payload-heavy spans. Recursion can be added when justified.
251
252	### 4.4 Helm values surface
253
254	The internal-module renders to the upstream `timberio/vector` chart:
255
256	```yaml
257	role: Aggregator
258	replicas: {{ .Values.replicas }}            # 3 by default
259
260	customConfig:
261	  data_dir: /vector-data-dir
262	  api: { enabled: true, address: 127.0.0.1:8686 }
263	  sources:
264	    otlp_in:
265	      type: opentelemetry
266	      grpc: { address: 0.0.0.0:4317 }
267	      http: { address: 0.0.0.0:4318 }
268	  transforms:
269	    drop_audit:           { ... }            # see 4.2
270	    redact_emails_logs:    { ... }
271	    redact_emails_traces:  { ... }
272	    redact_emails_metrics: { ... }
273	  sinks:
274	    datadog_logs:
275	      type: datadog_logs
276	      inputs: [redact_emails_logs]
277	      default_api_key: "${DATADOG_API_KEY}"
278	      site: {{ .Values.datadogSite }}
279	    datadog_traces:    { type: datadog_traces,  inputs: [redact_emails_traces],  default_api_key: "${DATADOG_API_KEY}", site: ... }
280	    datadog_metrics:   { type: datadog_metrics, inputs: [redact_emails_metrics], default_api_key: "${DATADOG_API_KEY}", site: ... }
281
282	service:
283	  enabled: true
284	  type: ClusterIP
285	  ports:
286	    - { name: otlp-grpc, port: 4317, protocol: TCP }
287	    - { name: otlp-http, port: 4318, protocol: TCP }
288
289	env:
290	  - name: DATADOG_API_KEY
291	    valueFrom:
292	      secretKeyRef:
293	        name: vector-datadog
294	        key: api_key
295
296	podAnnotations:
297	  reloader.stakater.com/auto: "true"
298
299	resources:
300	  requests: { cpu: 200m, memory: 256Mi }
301	  limits:   { cpu: 2,    memory: 1Gi }
302	```
303
304	`additional_config` (escape-hatch variable) when set overwrites `customConfig`
305	wholesale, matching `otel_collector_additional_config` semantics.
306
307	---
308
309	## 5. OTel collector exporter swap
310
311	### 5.1 Helm values diff
312
313	**Before (`v1.0.7`, today):**
314
315	```yaml
316	exporters:
317	  datadog:
318	    api:
319	      key:  ${DATADOG_API_KEY}
320	      site: datadoghq.com
321	service:
322	  pipelines:
323	    logs:    { receivers: [otlp], processors: [...], exporters: [datadog] }
324	    traces:  { receivers: [otlp], processors: [...], exporters: [datadog] }
325	    metrics: { receivers: [otlp], processors: [...], exporters: [datadog] }
326	```
327
328	**After (`v1.1.0` when `downstream_endpoint != ""`):**
329
330	```yaml
331	exporters:
332	  otlp:
333	    endpoint: http://vector.vector.svc.cluster.local:4317
334	    tls:
335	      insecure: true                  # in-cluster only; Cilium handles transit
336	    sending_queue:
337	      enabled: true
338	      queue_size: 5000
339	    retry_on_failure:
340	      enabled: true
341	      initial_interval: 5s
342	      max_interval: 30s
343	      max_elapsed_time: 300s
344	service:
345	  pipelines:
346	    logs:    { receivers: [otlp], processors: [...], exporters: [otlp] }
347	    traces:  { receivers: [otlp], processors: [...], exporters: [otlp] }
348	    metrics: { receivers: [otlp], processors: [...], exporters: [otlp] }
349	```
350
351	The `exporters.datadog` block disappears. Pipeline `processors` lists are
352	untouched — anything OTel does today (batching, `k8sattributes`, tail-sampling)
353	stays put.
354
355	### 5.2 Datadog API key ownership
356
357	- **Before:** OTel collector pods consume the Datadog API key (mount mechanism per the OTel internal-module's existing pattern).
358	- **After:** Vector module owns the secret. Its ExternalSecret creates `vector-datadog` in the `vector` namespace; Vector pods consume it via `env.DATADOG_API_KEY`. The OTel module's secret mount falls away under the same `downstream_endpoint != ""` conditional that gates the exporter swap.
359	- **Sequencing:** `module.otel_collector` has `depends_on = [module.vector]`. Single `terraform apply` brings up Vector first, then re-renders OTel.
360
361	### 5.3 Failure-mode behavior
362
363	If Vector is down or unhealthy:
364
365	- OTel's `sending_queue` buffers up to `queue_size: 5000` batches in-memory per pipeline.
366	- `retry_on_failure` retries with exponential backoff up to 5 minutes total.
367	- Past that, OTel drops batches and increments `otelcol_exporter_send_failed_*`.
368	- **No persistent queue in v1.** A Vector outage longer than ~5 minutes loses the buffer tail. Mitigation: Vector replica HA (3 replicas, PDB minAvailable 2). `file_storage` extension is a future hardening item.
369
370	### 5.4 TLS posture
371
372	OTLP between OTel and Vector runs as plain gRPC, both endpoints in-cluster.
373	Cilium provides transport encryption. App-layer mTLS is a future hardening
374	item.
375
376	### 5.5 Rollout shape (single cluster)
377
378	Single `terraform apply`:
379
380	1. `module.vector` provisions — namespace, ExternalSecret, helm release reconcile to ready.
381	2. Same apply re-renders OTel collector helm release with `v1.1.0` and `downstream_endpoint` set — OTel pods rolling-restart with new exporter config.
382	3. Vector now receives all traffic; Datadog continues to receive (via Vector's sinks).
383
384	**Rollback:** set `vector_enabled = false`. The `local.vector_endpoint` ternary
385	in `otel_collector.tf` falls back to `""`; OTel re-renders with the original
386	`datadog` exporter, OTel pods rolling-restart back to direct-to-Datadog. Vector
387	module destroys cleanly. The Datadog API key path on the OTel side must remain
388	available across the rollback — this is a pre-condition; the OTel-side secret
389	reference is not deleted in the same release that introduces Vector.
390
391	---
392
393	## 6. Operational concerns
394
395	### 6.1 HA topology
396
397	- **Replicas:** 3 default (`vector_replicas`).
398	- **PodDisruptionBudget:** `minAvailable: 2`.
399	- **Topology spread:** `topologySpreadConstraints` on `topology.kubernetes.io/zone`, `maxSkew: 1`. Module gives operators a passthrough variable to override on small clusters where AZ spread is impossible.
400	- **Anti-affinity:** preferred (not required) on `kubernetes.io/hostname`.
401
402	### 6.2 Vector's own telemetry
403
404	Vector emits Prometheus-format internal metrics on `:8686/metrics`. If a
405	Prometheus operator (kube-prometheus-stack CRDs) is present in the cluster, the
406	module ships a `ServiceMonitor` for scraping. Otherwise, the metrics are
407	consumable via the Datadog Agent's OpenMetrics check or the OTel collector
408	itself (annotation-based scraping). The shipping mechanism is a v1
409	implementation question — see §8.3. Key metrics:
410
411	| Metric | What it tells you |
412	|---|---|
413	| `vector_component_received_events_total` | Inbound rate per source/transform/sink |
414	| `vector_component_sent_events_total` | Outbound rate at each Datadog sink |
415	| `vector_component_errors_total` | Failed sends per sink |
416	| `vector_component_discarded_events_total` | Events dropped by `drop_audit` |
417	| `vector_buffer_events` | In-memory queue depth toward each Datadog sink |
418	| `vector_utilization` | Per-component utilization, 0–1 |
419
420	Vector's own logs go to stdout and are captured by the existing OTel pipeline.
421	A Vector outage means we cannot see Vector's logs through Vector. First-line
422	debug: `kubectl logs -n vector`.
423
424	### 6.3 Alerting (sketch — actual monitor wiring out of scope)
425
426	| Condition | Severity | Why |
427	|---|---|---|
428	| `vector_component_errors_total{sink=~"datadog_.*"}` rate > 0 for 5m | warn | Datadog sink failing |
429	| `vector_buffer_events / vector_buffer_max_events > 0.8` for 5m | warn | Outbound queue filling |
430	| `vector_buffer_events / vector_buffer_max_events > 0.95` for 2m | page | About to drop |
431	| Vector ready replicas < 2 for 5m | page | Below PDB floor |
432	| `otelcol_exporter_send_failed_*{exporter="otlp"}` rate > 0 for 5m | warn | OTel→Vector path broken |
433
434	Datadog monitor wiring lives in this org's Datadog-as-Code surface, not the
435	Terraform module. **Required follow-up before declaring v1 production-ready.**
436
437	### 6.4 Sizing & resource defaults
438
439	```yaml
440	resources:
441	  requests: { cpu: 200m, memory: 256Mi }
442	  limits:   { cpu: 2,    memory: 1Gi }
443	```
444
445	Conservative starting points. Vector CPU usage scales with VRL transform
446	complexity (regex on every event isn't free). Real sizing comes from
447	observed metrics after a soak in `mgmt`/`cps` before rolling to `saas`.
448
449	### 6.5 Vault / ExternalSecret dependency chain
450
451	```
452	Vault ──▶ external-secrets operator ──▶ ExternalSecret (vector ns)
453	                                              │
454	                                              ▼
455	                                         Secret: vector-datadog
456	                                              │
457	                                              ▼
458	                                  Vector pods (env DATADOG_API_KEY)
459	```
460
461	The Vector module uses `kubernetes_manifest.wait` on the ExternalSecret's
462	materialized Secret to block the helm release until secret hydration completes.
463	Without that wait, the helm release races ahead and Vector pods CrashLoop on
464	startup. Reconcile order within the module:
465
466	1. Namespace
467	2. ExternalSecret (and wait until the underlying Secret resource is observed)
468	3. Helm release for Vector
469
470	### 6.6 Datadog API key rotation
471
472	Rotate the secret in Vault. ExternalSecret refreshes the in-cluster Secret. The
473	existing **`reloader` operator** picks up the change and restarts Vector pods —
474	the Vector Deployment is annotated with `reloader.stakater.com/auto: "true"`.
475	No manual intervention required.
476
477	### 6.7 Bootstrap-order edge case (first-time cluster provisioning)
478
479	A net-new cluster runs `terraform apply` once for layer-3
480	(`eks-cluster-applications`). Within that apply:
481
482	1. `external_secrets` reconciles first (existing dependency).
483	2. `vector` reconciles next (new — `depends_on = [module.cilium, module.external_secrets]`).
484	3. `otel_collector` reconciles last (`depends_on = [module.vector]`).
485
486	There is never an OTel collector running with `downstream_endpoint` set before
487	Vector is ready to receive.
488
489	### 6.8 Data-loss budget for v1
490
491	| Scenario | Loss |
492	|---|---|
493	| Vector single-pod restart | None — other replicas serve via Service load-balancing |
494	| Vector full-outage < 5 min | None — OTel `sending_queue` + `retry_on_failure` covers |
495	| Vector full-outage > 5 min | Tail of OTel queue dropped; Datadog gap proportional to outage minus 5 min |
496	| OTel collector full-outage | Same shape as today — apps' OTLP exporters retry/buffer per their config |
497	| Datadog API key rotation | None — reloader-driven pod restart |
498
499	---
500
501	## 7. Testing & verification plan
502
503	### 7.1 Pre-deploy (local / CI)
504
505	1. **Terraform plan** in a sandbox state to confirm module shape, count toggles cleanly.
506	2. **Helm template render** of both modules, diff against current rendered manifests in CI.
507	3. **`vector validate`** on the rendered config — catches VRL syntax errors. CI step in the new `internal-modules/kubernetes/monitoring/vector` repo.
508	4. **VRL unit tests** via `vector vrl --input ... --program ...`:
509	   - Audit-drop: `{"message":"Audit - login by user"}` → filtered. `{"message":"INFO request handled"}` → passed.
510	   - Email redact: `{"message":"contact alice@example.com"}` → `.message == "contact [REDACTED-EMAIL]"`.
511	   - Edge: dotted addresses, plus-tag, email inside JSON-stringified attribute. Test corpus committed alongside the module.
512
513	### 7.2 Integration (sandbox EKS cluster)
514
515	Use a `dev`-type cluster with `vector_enabled = true` explicit override.
516
517	1. **Smoke:** apply, confirm Vector pods Ready, OTel rolled with new `otlp` exporter, no `otelcol_exporter_send_failed`.
518	2. **Audit-drop:** emit log with body `Audit - test-event-<uuid>`. Search Datadog for the UUID. **Pass = no result.** Repeat for `"level":"audit"`.
519	3. **Email-redact (logs):** emit log `Reach me at e2e-<uuid>@example.com`. **Pass = log appears, body contains `[REDACTED-EMAIL]`, original local-part not present.**
520	4. **Email-redact (traces):** emit trace with span attribute `user.email = e2e-<uuid>@example.com`. **Pass = attribute is `[REDACTED-EMAIL]` in Datadog APM.**
521	5. **Negative test:** emit logs containing email-shaped strings inside code blocks. Confirm regex matches and redacts. Documented as known limitation, not a failure.
522
523	### 7.3 Failure-mode tests (sandbox)
524
525	1. **Vector pod restart:** `kubectl delete pod -n vector -l app=vector`. Brief dip, no Datadog gap > 1m.
526	2. **Vector full-stop ≤ 1m:** scale to zero, wait, scale back. Queue grows then drains; no permanent drop.
527	3. **Vector full-stop > 5m:** expect Datadog gap of (outage − 5m). Confirms documented data-loss budget.
528	4. **Rollback drill:** `vector_enabled = false`, `terraform apply`. OTel reverts to `datadog` exporter, telemetry resumes.
529	5. **Key rotation:** rotate in Vault. Confirm reloader-driven pod restart, telemetry resumes.
530
531	### 7.4 Production rollout sequence
532
533	1. **Sandbox / `dev`-type cluster** — explicit opt-in, full integration suite.
534	2. **One `mgmt` cluster** — soak 3-7 days. Tune resource limits if needed.
535	3. **Remaining `mgmt` + all `cps` clusters** — incremental.
536	4. **`saas` clusters last**, region-by-region, lowest-risk regions first.
537
538	Each promotion gate: green dashboards (no error-rate spikes, healthy queue
539	depths) for 48h on the previous tier.
540
541	### 7.5 Acceptance criteria for v1
542
543	- All `*_enabled` clusters running Vector with no `otelcol_exporter_send_failed` over a 7-day window.
544	- Datadog ingestion volume post-rollout matches pre-rollout within ±5% (modulo the audit-drop and redaction reductions, expected and quantifiable).
545	- Sample query in Datadog (`@message:*@*.* AND -@message:"\[REDACTED-EMAIL\]"`) shows zero unredacted email addresses.
546	- Day-1 audit patterns produce zero hits in Datadog log search post-rollout.
547	- Datadog monitors from §6.3 deployed and silent for the first 7 days outside of planned rollout-induced restarts.
548	- Runbook entry added covering: Vector pod debug, queue-full triage, key rotation, rollback to direct-Datadog. (Runbook home TBD — placeholder.)
549
550	---
551
552	## 8. Out of scope, phased work, open questions
553
554	### 8.1 Out of scope for v1 (restated for cross-reference)
555
556	- Decommissioning `kubernetes/applications/datadog-processing-rules` — separate effort.
557	- Per-cluster rule overlay machinery beyond the Terraform variable surface.
558	- Dynamic / runtime-loaded rules.
559	- Persistent (`file_storage`) queue on the OTel collector.
560	- mTLS between OTel and Vector.
561	- Recursive descent in the email-redact VRL transform.
562	- Vector Agent-mode (DaemonSet) for node-level collection.
563	- Datadog monitor wiring (required follow-up, lives in Datadog-as-Code surface).
564	- Operations runbook (required follow-up, home TBD).
565
566	### 8.2 Phased work — post-v1, in rough priority order
567
568	1. **Expand redaction patterns:** SSN, credit cards, tokens, JWT, phone numbers. Each ships as opt-in `vector_<category>_redaction_enabled` flag in the module.
569	2. **Field/attribute name allow-deny lists.** `db.statement`, `http.request.body`, `aws.s3.key` — wholesale strip by attribute name via `vector_drop_attributes`.
570	3. **Service-level allow/deny.** Drop telemetry from services where redaction can't be exhaustive. `route` transform on `service.name`.
571	4. **Decommission `datadog-processing-rules`.** After Vector has been clean in prod for one quarter.
572	5. **Persistent OTel queue.** If the data-loss budget proves insufficient.
573	6. **Runtime-driven rule sources.** If redaction surface keeps growing such that Terraform applies become friction, move rules behind a `kubernetes` or `http` source.
574
575	### 8.3 Open questions to resolve in implementation
576
577	1. **Datadog site value origin.** Likely re-use whatever variable feeds the OTel module today; confirm during implementation by reading the OTel internal-module repo.
578	2. **Vault path for Datadog API key.** Same — find where OTel reads it today, point Vector at the same path. Likely the existing `external_secrets_*` variable cluster.
579	3. **OTel internal-module's existing secret-mount mechanism.** Affects how cleanly `v1.1.0` removes the mount when `downstream_endpoint` is set.
580	4. **`datadog_agent.tf` overlap.** Datadog Agent module remains for non-OTel reasons (host metrics, kubelet stats). Vector + OTel does not replace it; the Agent side is untouched.
581	5. **Vector self-metrics scrape mechanism.** Confirm whether a Prometheus operator with kube-prometheus-stack CRDs is present in the target cluster types. If yes, ship a `ServiceMonitor`. If no, fall back to Datadog Agent's OpenMetrics check (annotation-driven) or OTel-collector-side scraping. Decide before tagging v1.0.0 of the Vector module.
582
583	---
584
585	## Appendix A — File touch list
586
587	| Repo | File | Action |
588	|---|---|---|
589	| `internal-modules/kubernetes/monitoring/otel-collector` | `main.tf`, `variables.tf`, helm values template | Add `downstream_endpoint`, `downstream_protocol` vars; conditionally render `exporters.otlp` block and gate Datadog secret mount. Tag `v1.1.0`. |
590	| `internal-modules/kubernetes/monitoring/vector` | (new repo) | New module v1.0.0. Namespace, ExternalSecret, helm release, ServiceMonitor, PDB. |
591	| `terraform/iac-library/aws/compute/eks-cluster-applications` | `vector.tf` | New file — locals, vars, `module "vector"` call, validation. |
592	| `terraform/iac-library/aws/compute/eks-cluster-applications` | `otel_collector.tf` | Bump module ref to v1.1.0; pass `downstream_endpoint`; add `depends_on = [module.vector]`. |
593
594	## Appendix B — Day-1 rule equivalence
595
596	Source rules in `kubernetes/applications/datadog-processing-rules/{prod,staging}/rules.json`:
597
598	```json
599	[
600	  { "type": "exclude_at_match", "name": "exclude_immuta_audit",   "pattern": "Audit\\s-\\s.+" },
601	  { "type": "exclude_at_match", "name": "exclude_immuta_audit_2", "pattern": "\"level\":\"audit\"" }
602	]
603	```
604
605	Becomes (in Vector VRL):
606
607	```vrl
608	condition = !match(msg, r'Audit\s-\s.+') && !match(msg, r'"level":"audit"')
609	```
610
611	Plus new email redaction across all signals (no equivalent in source rules):
612
613	```vrl
614	.message = replace(string!(.message), r'[\w._%+\-]+@[\w.-]+\.[A-Za-z]{2,}', "[REDACTED-EMAIL]")
615	```
616


Now let me read the README in sections since it's large:


0	## Requirements
1
2	| Name | Version |
3	|------|---------|
4	|  [terraform](#requirement\_terraform) | >= 1.9.0 |
5	|  [aws](#requirement\_aws) | ~> 6.0 |
6
7	## Providers
8
9	| Name | Version |
10	|------|---------|
11	|  [aws](#provider\_aws) | ~> 6.0 |
12	|  [aws.super\_certificate\_zone](#provider\_aws.super\_certificate\_zone) | ~> 6.0 |
13	|  [external](#provider\_external) | n/a |
14	|  [kubernetes.local-cluster](#provider\_kubernetes.local-cluster) | n/a |
15	|  [random](#provider\_random) | n/a |
16	|  [vault](#provider\_vault) | n/a |
17
18	## Modules
19
20	| Name | Source | Version |
21	|------|--------|---------|
22	|  [addon-netpol](#module\_addon-netpol) | git@gitlab.infrastructure.immuta.io:infrastructure/terraform/internal-modules/kubernetes/security/network-policy.git | v1.1.0 |
23	|  [application\_deployment](#module\_application\_deployment) | git@gitlab.infrastructure.immuta.io:infrastructure/terraform/internal-modules/kubernetes/compute/application-deployment.git | v2.1.0 |
24	|  [argocd](#module\_argocd) | git@gitlab.infrastructure.immuta.io:infrastructure/terraform/internal-modules/kubernetes/compute/argocd.git | v1.4.1 |
25	|  [aws\_load\_balancer\_controller](#module\_aws\_load\_balancer\_controller) | git@gitlab.infrastructure.immuta.io:infrastructure/terraform/internal-modules/kubernetes/networking/aws-load-balancer-controller.git | v1.0.1 |
26	|  [aws\_load\_balancer\_controller\_sa](#module\_aws\_load\_balancer\_controller\_sa) | git@gitlab.infrastructure.immuta.io:infrastructure/terraform/internal-modules/aws/security/kubernetes-iam-serviceaccount.git | v7.0.0 |
27	|  [cert\_manager](#module\_cert\_manager) | git@gitlab.infrastructure.immuta.io:infrastructure/terraform/internal-modules/kubernetes/security/cert-manager.git | v1.4.0 |
28	|  [cert\_manager\_sa](#module\_cert\_manager\_sa) | git@gitlab.infrastructure.immuta.io:infrastructure/terraform/internal-modules/aws/security/kubernetes-iam-serviceaccount.git | v7.0.0 |
29	|  [cert\_manager\_super\_account](#module\_cert\_manager\_super\_account) | git@gitlab.infrastructure.immuta.io:infrastructure/terraform/internal-modules/aws/security/cross-account-iam-role.git | v3.0.0 |
30	|  [cilium](#module\_cilium) | git@gitlab.infrastructure.immuta.io:infrastructure/terraform/internal-modules/kubernetes/networking/cilium.git | v5.3.0 |
31	|  [cluster\_autoscaler](#module\_cluster\_autoscaler) | git@gitlab.infrastructure.immuta.io:infrastructure/terraform/internal-modules/kubernetes/compute/cluster-autoscaler.git | v3.0.0 |
32	|  [cluster\_autoscaler\_sa](#module\_cluster\_autoscaler\_sa) | git@gitlab.infrastructure.immuta.io:infrastructure/terraform/internal-modules/aws/security/kubernetes-iam-serviceaccount.git | v7.0.0 |
33	|  [cluster\_issuers](#module\_cluster\_issuers) | git@gitlab.infrastructure.immuta.io:infrastructure/terraform/internal-modules/kubernetes/security/cluster-issuers.git | v4.0.0 |
34	|  [cnpg\_operator\_deployment](#module\_cnpg\_operator\_deployment) | git@gitlab.infrastructure.immuta.io:infrastructure/terraform/internal-modules/kubernetes/compute/cnpg-operator.git | v1.0.1 |
35	|  [coredns](#module\_coredns) | git@gitlab.infrastructure.immuta.io:infrastructure/terraform/internal-modules/kubernetes/networking/coredns.git | v1.2.2 |
36	|  [datadog\_agent](#module\_datadog\_agent) | git@gitlab.infrastructure.immuta.io:infrastructure/terraform/internal-modules/kubernetes/monitoring/datadog-agent | v1.1.0 |
37	|  [ebs\_csi\_sa](#module\_ebs\_csi\_sa) | git@gitlab.infrastructure.immuta.io:infrastructure/terraform/internal-modules/aws/security/kubernetes-iam-serviceaccount.git | v7.0.0 |
38	|  [external\_dns\_private](#module\_external\_dns\_private) | git@gitlab.infrastructure.immuta.io:infrastructure/terraform/internal-modules/kubernetes/networking/external-dns.git | v1.3.2 |
39	|  [external\_dns\_private\_sa](#module\_external\_dns\_private\_sa) | git@gitlab.infrastructure.immuta.io:infrastructure/terraform/internal-modules/aws/security/kubernetes-iam-serviceaccount.git | v7.0.0 |
40	|  [external\_dns\_public](#module\_external\_dns\_public) | git@gitlab.infrastructure.immuta.io:infrastructure/terraform/internal-modules/kubernetes/networking/external-dns.git | v1.3.2 |
41	|  [external\_dns\_public\_sa](#module\_external\_dns\_public\_sa) | git@gitlab.infrastructure.immuta.io:infrastructure/terraform/internal-modules/aws/security/kubernetes-iam-serviceaccount.git | v7.0.0 |
42	|  [external\_networking](#module\_external\_networking) | git@gitlab.infrastructure.immuta.io:infrastructure/terraform/internal-modules/kubernetes/networking/external-networking.git | v5.1.0 |
43	|  [external\_secrets](#module\_external\_secrets) | git@gitlab.infrastructure.immuta.io:infrastructure/terraform/internal-modules/kubernetes/security/external-secrets.git | v1.2.0 |
44	|  [fluxcd](#module\_fluxcd) | git@gitlab.infrastructure.immuta.io:infrastructure/terraform/internal-modules/kubernetes/compute/fluxcd.git | v1.2.0 |
45	|  [ingress\_controller\_private](#module\_ingress\_controller\_private) | git@gitlab.infrastructure.immuta.io:infrastructure/terraform/internal-modules/kubernetes/networking/ingress-controller.git | v1.5.0 |
46	|  [ingress\_controller\_public](#module\_ingress\_controller\_public) | git@gitlab.infrastructure.immuta.io:infrastructure/terraform/internal-modules/kubernetes/networking/ingress-controller.git | v1.5.0 |
47	|  [kyverno](#module\_kyverno) | git@gitlab.infrastructure.immuta.io:infrastructure/terraform/internal-modules/kubernetes/security/kyverno.git | v3.0.0 |
48	|  [metrics\_server](#module\_metrics\_server) | git@gitlab.infrastructure.immuta.io:infrastructure/terraform/internal-modules/kubernetes/monitoring/metrics-server.git | v1.2.0 |
49	|  [otel\_collector](#module\_otel\_collector) | git@gitlab.infrastructure.immuta.io:infrastructure/terraform/internal-modules/kubernetes/monitoring/otel-collector.git | v1.0.7 |
50	|  [reloader](#module\_reloader) | git@gitlab.infrastructure.immuta.io:infrastructure/terraform/internal-modules/kubernetes/compute/reloader.git | v1.0.1 |
51	|  [s3\_csi\_driver](#module\_s3\_csi\_driver) | git@gitlab.infrastructure.immuta.io:infrastructure/terraform/internal-modules/kubernetes/storage/s3-csi-driver.git | v1.1.1 |
52	|  [s3\_csi\_driver\_sa](#module\_s3\_csi\_driver\_sa) | git@gitlab.infrastructure.immuta.io:infrastructure/terraform/internal-modules/aws/security/kubernetes-iam-serviceaccount.git | v7.0.0 |
53	|  [sysdig\_agent](#module\_sysdig\_agent) | git@gitlab.infrastructure.immuta.io:infrastructure/terraform/internal-modules/kubernetes/security/sysdig-agent.git | v4.0.0 |
54	|  [teleport](#module\_teleport) | git@gitlab.infrastructure.immuta.io:infrastructure/terraform/internal-modules/kubernetes/security/teleport-agent.git | v3.0.0 |
55	|  [teleport\_agent\_sa](#module\_teleport\_agent\_sa) | git@gitlab.infrastructure.immuta.io:infrastructure/terraform/internal-modules/aws/security/kubernetes-iam-serviceaccount.git | v7.0.0 |
56	|  [vault\_sidecar\_injector](#module\_vault\_sidecar\_injector) | git@gitlab.infrastructure.immuta.io:infrastructure/terraform/internal-modules/kubernetes/security/vault-sidecar-injector.git | v4.1.0 |
57
58	## Resources
59
60	| Name | Type |
61	|------|------|
62	| [aws_eks_addon.aws_ebs_csi_driver](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_addon) | resource |
63	| [aws_eks_addon.kube_proxy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_addon) | resource |
64	| [aws_iam_role_policy_attachment.ebs_csi_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
65	| [aws_vpc_security_group_ingress_rule.cluster_mesh_cidrs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_security_group_ingress_rule) | resource |
66	| [kubernetes_namespace.sysdig_agent](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/namespace) | resource |
67	| [kubernetes_namespace.teleport_agent_namespace](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/namespace) | resource |
68	| [kubernetes_secret.sysdig_secret](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/secret) | resource |
69	| [random_bytes.maglev](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/bytes) | resource |
70	| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
71	| [aws_eks_cluster.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster) | data source |
72	| [aws_eks_cluster_auth.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster_auth) | data source |
73	| [aws_iam_session_context.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_session_context) | data source |
74	| [aws_route53_zone.external_dns_private](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/route53_zone) | data source |
75	| [aws_route53_zone.external_dns_public](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/route53_zone) | data source |
76	| [aws_route53_zone.instances](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/route53_zone) | data source |
77	| [aws_route53_zone.super](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/route53_zone) | data source |
78	| [external_external.application_deployment_validate](https://registry.terraform.io/providers/hashicorp/external/latest/docs/data-sources/external) | data source |
79	| [vault_kv_secret_v2.sysdig_agent](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/data-sources/kv_secret_v2) | data source |
80
81	## Inputs
82
83	| Name | Description | Type | Default | Required |
84	|------|-------------|------|---------|:--------:|
85	|  [account\_name](#input\_account\_name) | Account name where the cluster is | `string` | n/a | yes |
86	|  [application\_deployment\_branch](#input\_application\_deployment\_branch) | branch on application-deployment repo to reference | `string` | `"master"` | no |
87	|  [application\_deployment\_enabled](#input\_application\_deployment\_enabled) | Override for explicitly enabling or disabling application-deployment | `bool` | `null` | no |
88	|  [application\_deployment\_enabled\_cluster\_types](#input\_application\_deployment\_enabled\_cluster\_types) | Types of clusters that application-deployment should be enabled on by default | `map(bool)` |
{
  "cps": true,
  "dev": true,
  "infra": true,
  "mgmt": true,
  "saas": true
}
 | no |
89	|  [application\_deployment\_github\_repo\_url](#input\_application\_deployment\_github\_repo\_url) | Repo URL for application-deployment in GitHub | `string` | `""` | no |
90	|  [application\_deployment\_prune](#input\_application\_deployment\_prune) | Determines if resources removed from the application-deployment Git Repo will also be deleted by flux | `bool` | `true` | no |
91	|  [application\_deployment\_refresh\_interval](#input\_application\_deployment\_refresh\_interval) | Golang timestring for how often the target branch should be synced | `string` | `"1m0s"` | no |
92	|  [application\_deployment\_repo\_url](#input\_application\_deployment\_repo\_url) | Repo URL for application-deployment | `string` | `""` | no |
93	|  [argocd\_aws\_iam\_role\_arn](#input\_argocd\_aws\_iam\_role\_arn) | Role arn that argocd should use | `string` | `""` | no |
94	|  [argocd\_enabled](#input\_argocd\_enabled) | Override for explicitly enabling or disabling argocd | `bool` | `null` | no |
95	|  [argocd\_enabled\_cluster\_types](#input\_argocd\_enabled\_cluster\_types) | Types of clusters the argocd helm chart should be installed on by default | `map(string)` |
{
  "cps": false,
  "dev": false,
  "infra": false,
  "mgmt": true,
  "saas": false
}
 | no |
96	|  [argocd\_env\_arch](#input\_argocd\_env\_arch) | The value for the ARCH environment variable in the install-customtools init container. | `string` | `""` | no |
97	|  [argocd\_env\_helm\_secrets\_version](#input\_argocd\_env\_helm\_secrets\_version) | The value for the HELM\_SECRETS\_VERSION environment variable in the install-customtools init container. | `string` | `""` | no |
98	|  [argocd\_env\_kubectl\_version](#input\_argocd\_env\_kubectl\_version) | The value for the KUBECTL\_VERSION environment variable in the install-customtools init container. | `string` | `""` | no |
99	|  [argocd\_env\_sops\_version](#input\_argocd\_env\_sops\_version) | The value for the SOPS\_VERSION environment variable in the install-customtools init container. | `string` | `""` | no |


100	|  [argocd\_env\_sops\_version](#input\_argocd\_env\_sops\_version) | The value for the SOPS\_VERSION environment variable in the install-customtools init container. | `string` | `""` | no |
101	|  [argocd\_env\_vals\_version](#input\_argocd\_env\_vals\_version) | The value for the VALS\_VERSION environment variable in the install-customtools init container. | `string` | `""` | no |
102	|  [argocd\_env\_version](#input\_argocd\_env\_version) | The value for the VERSION environment variable in the install-customtools init container. | `string` | `""` | no |
103	|  [argocd\_hostname](#input\_argocd\_hostname) | FQDN for ArgoCD | `string` | `""` | no |
104	|  [argocd\_image\_tag](#input\_argocd\_image\_tag) | ArgoCD application version | `string` | `""` | no |
105	|  [argocd\_rbac\_policy](#input\_argocd\_rbac\_policy) | ArgoCD RBAC policy in CSV format. Create a csv file and use the file() function to provide the input. | `string` | `""` | no |
106	|  [argocd\_repo](#input\_argocd\_repo) | Application Deployment Repo name | `string` | `"application-deployment"` | no |
107	|  [argocd\_version](#input\_argocd\_version) | ArgoCD Helm Chart version | `string` | `""` | no |
108	|  [aws\_load\_balancer\_controller\_enabled](#input\_aws\_load\_balancer\_controller\_enabled) | Override for explicitly enabling or disabling the aws load balancer | `bool` | `null` | no |
109	|  [aws\_load\_balancer\_controller\_version](#input\_aws\_load\_balancer\_controller\_version) | Version of aws-load-balancer-controller helm chart | `string` | `""` | no |
110	|  [aws\_load\_balancer\_enabled\_cluster\_types](#input\_aws\_load\_balancer\_enabled\_cluster\_types) | Types of clusters the aws load balancer should be enabled on by default | `map(string)` |
{
  "cps": true,
  "dev": false,
  "infra": false,
  "mgmt": true,
  "saas": true
}
 | no |
111	|  [cert\_manager\_enabled](#input\_cert\_manager\_enabled) | Override for explicitly enabling or disabling cert-manager | `bool` | `null` | no |
112	|  [cert\_manager\_enabled\_cluster\_types](#input\_cert\_manager\_enabled\_cluster\_types) | Types of clusters that cert-manager should be enabled on by default | `map(string)` |
{
  "cps": true,
  "dev": true,
  "infra": true,
  "mgmt": true,
  "saas": true
}
 | no |
113	|  [cert\_manager\_version](#input\_cert\_manager\_version) | Version of cert-manager helm chart | `string` | `""` | no |
114	|  [cilium\_audit\_mode](#input\_cilium\_audit\_mode) | Enable audit mode for policy enforcement | `bool` | `false` | no |
115	|  [cilium\_debug\_enabled](#input\_cilium\_debug\_enabled) | Enable cilium-agent debug logs | `bool` | `false` | no |
116	|  [cilium\_dnsproxy\_debug\_enabled](#input\_cilium\_dnsproxy\_debug\_enabled) | Enable cilium-dnsproxy debug logs | `bool` | `false` | no |
117	|  [cilium\_dnsproxy\_enabled](#input\_cilium\_dnsproxy\_enabled) | Enable Cilium HA DNSProxy if Cilium Enteprise is also enabled | `bool` | `true` | no |
118	|  [cilium\_dnsproxy\_version](#input\_cilium\_dnsproxy\_version) | Version of Cilium helm chart | `string` | `""` | no |
119	|  [cilium\_enabled](#input\_cilium\_enabled) | Override for explicitly enabling or disabling cilium | `bool` | `null` | no |
120	|  [cilium\_enabled\_cluster\_types](#input\_cilium\_enabled\_cluster\_types) | Types of clusters that cilium should be enabled on by default | `map(string)` |
{
  "cps": true,
  "dev": true,
  "infra": true,
  "mgmt": true,
  "saas": true
}
 | no |
121	|  [cilium\_enterprise](#input\_cilium\_enterprise) | Should cilium be deployed as enterprise (isovalent) or open source? | `bool` | `false` | no |
122	|  [cilium\_lb\_cert\_arn](#input\_cilium\_lb\_cert\_arn) | ARN of the ACM cert that will be associated with the LoadBalancer service | `string` | `""` | no |
123	|  [cilium\_lb\_eip\_ids](#input\_cilium\_lb\_eip\_ids) | CSV of Elastic IP IDs to configure on cilium LoadBalancer service | `string` | `""` | no |
124	|  [cilium\_lb\_subnets](#input\_cilium\_lb\_subnets) | CSV of Subnet IDs to associate with the LoadBalancer service | `string` | `""` | no |
125	|  [cilium\_max\_ips\_per\_hostname](#input\_cilium\_max\_ips\_per\_hostname) | Maximum number of IPs that can be cached for a single hostname (chart default 50) | `number` | `100` | no |
126	|  [cilium\_policy\_map\_max](#input\_cilium\_policy\_map\_max) | Maximum size of policyMap (chart default 16384) | `number` | `32768` | no |
127	|  [cilium\_proxy\_idle\_connection\_grace\_period](#input\_cilium\_proxy\_idle\_connection\_grace\_period) | Time during which idle but previously active connections with expired DNS lookups are still considered alive (chart default 0s) | `string` | `"60s"` | no |
128	|  [cilium\_registry\_override](#input\_cilium\_registry\_override) | Registry override for quay.io for cilium resources | `string` | `"quay.io"` | no |
129	|  [cilium\_version](#input\_cilium\_version) | Version of Cilium helm chart | `string` | `""` | no |
130	|  [cluster\_autoscaler\_enabled](#input\_cluster\_autoscaler\_enabled) | Override for explicitly enabling or disabling the cluster autoscaler | `bool` | `null` | no |
131	|  [cluster\_autoscaler\_enabled\_cluster\_types](#input\_cluster\_autoscaler\_enabled\_cluster\_types) | Types of clusters the cluster autoscaler should be enabled on by default | `map(string)` |
{
  "cps": true,
  "dev": true,
  "infra": true,
  "mgmt": true,
  "saas": true
}
 | no |
132	|  [cluster\_autoscaler\_image\_tag](#input\_cluster\_autoscaler\_image\_tag) | Tagged Image tag of the cluster autoscaler | `string` | `""` | no |
133	|  [cluster\_autoscaler\_version](#input\_cluster\_autoscaler\_version) | Version of cluster autoscaler helm chart | `string` | `""` | no |
134	|  [cluster\_ca](#input\_cluster\_ca) | Certificate Authority for the cluster | `string` | n/a | yes |
135	|  [cluster\_clustermesh\_id](#input\_cluster\_clustermesh\_id) | Cluster ID for clustermesh (must be set for ClusterMesh) | `number` | `0` | no |
136	|  [cluster\_endpoint](#input\_cluster\_endpoint) | Endpoint for the cluster from the EKS CLUSTER module | `string` | n/a | yes |
137	|  [cluster\_id](#input\_cluster\_id) | ID of the working cluster (should be the same as the cluster name) | `string` | n/a | yes |
138	|  [cluster\_issuers\_acme\_server](#input\_cluster\_issuers\_acme\_server) | Letsencrypt or Google server for cert generation | `string` | `"https://acme-v02.api.letsencrypt.org/directory"` | no |
139	|  [cluster\_issuers\_vault\_extra\_paths](#input\_cluster\_issuers\_vault\_extra\_paths) | List of extra Vault paths for clusterissuers | `list(string)` | `[]` | no |
140	|  [cluster\_issuers\_vault\_primary\_path](#input\_cluster\_issuers\_vault\_primary\_path) | Vault path for the primary cluster issuer (if using vault, otherwise can be left blank for default) | `string` | `""` | no |
141	|  [cluster\_mesh\_cidrs](#input\_cluster\_mesh\_cidrs) | List of CIDRs to allow for incoming cluster mesh connections (should be the CIDRs of the VPCs of the clusters in the mesh) | `list(string)` | `[]` | no |
142	|  [cluster\_mesh\_connections](#input\_cluster\_mesh\_connections) | List of connections that ClusterMesh should connect |
list(object({
    name    = string
    address = string
    port    = number
  }))
 | `[]` | no |
143	|  [cluster\_mesh\_domain](#input\_cluster\_mesh\_domain) | Domain of clustermesh if domains are not used | `string` | `""` | no |
144	|  [cluster\_mesh\_enable\_kvstoremesh](#input\_cluster\_mesh\_enable\_kvstoremesh) | Enable kvstoremesh for cluster mesh | `bool` | `true` | no |
145	|  [cluster\_mesh\_enabled](#input\_cluster\_mesh\_enabled) | Toggle to enable Cilium Cluster Mesh TLS config | `bool` | `false` | no |
146	|  [cluster\_mesh\_lb\_annotations](#input\_cluster\_mesh\_lb\_annotations) | Annotations for the LoadBalancer service for the ClusterMesh API Server | `map(string)` | `{}` | no |
147	|  [cluster\_mesh\_replicas](#input\_cluster\_mesh\_replicas) | Number of replicas for ClusterMesh API Servers | `number` | `3` | no |
148	|  [cluster\_mesh\_tls\_names](#input\_cluster\_mesh\_tls\_names) | List of names to include as SANs in the certificate for the etcd server | `list(string)` | `[]` | no |
149	|  [cluster\_name](#input\_cluster\_name) | Cluster name for the EKS cluster | `string` | n/a | yes |
150	|  [cluster\_oidc\_provider\_arn](#input\_cluster\_oidc\_provider\_arn) | OIDC Provider ARN for the current working cluster | `string` | n/a | yes |
151	|  [cluster\_oidc\_provider\_issuer](#input\_cluster\_oidc\_provider\_issuer) | ODIC Provider Issuer for the current working cluster | `string` | n/a | yes |
152	|  [cluster\_type](#input\_cluster\_type) | The type of cluster, i.e. saas, mgmt, cps, will default to extracting the type from the cluster name | `string` | `""` | no |
153	|  [cluster\_version](#input\_cluster\_version) | Cluster version for the EKS cluster | `string` | n/a | yes |
154	|  [cluster\_worker\_sg](#input\_cluster\_worker\_sg) | Security Group for worker nodes | `string` | `""` | no |
155	|  [cm\_domains](#input\_cm\_domains) | List of domain names for cert-manager to manage (must be in route53) | `list(string)` | `[]` | no |
156	|  [cm\_super\_domains](#input\_cm\_super\_domains) | List of domain names for cert-manager to manage (must be in route53) | `list(string)` | `[]` | no |
157	|  [cnpg\_operator\_enabled](#input\_cnpg\_operator\_enabled) | Override for explicitly enabling or disabling the CNPG operator | `bool` | `null` | no |
158	|  [cnpg\_operator\_enabled\_cluster\_types](#input\_cnpg\_operator\_enabled\_cluster\_types) | Types of clusters the CNPG operator should be enabled on by default | `map(string)` |
{
  "cps": false,
  "dev": false,
  "infra": false,
  "mgmt": false,
  "saas": true
}
 | no |
159	|  [cnpg\_operator\_image\_tag](#input\_cnpg\_operator\_image\_tag) | Image tag for the CNPG operator | `string` | `""` | no |
160	|  [cnpg\_operator\_version](#input\_cnpg\_operator\_version) | Version of the CNPG operator helm chart | `string` | `""` | no |
161	|  [coredns\_enabled](#input\_coredns\_enabled) | Override for explicitly enabling or disabling CoreDNS | `bool` | `null` | no |
162	|  [coredns\_enabled\_cluster\_types](#input\_coredns\_enabled\_cluster\_types) | Types of clusters coredns should be enabled on by default | `map(string)` |
{
  "cps": true,
  "dev": true,
  "infra": true,
  "mgmt": true,
  "saas": true
}
 | no |
163	|  [coredns\_image\_tag](#input\_coredns\_image\_tag) | Helm Value: Image override for coredns | `string` | `""` | no |
164	|  [coredns\_version](#input\_coredns\_version) | Version of coredns helm chart | `string` | `""` | no |
165	|  [datadog\_agent\_enabled](#input\_datadog\_agent\_enabled) | Override for explicitly enabling or disabling otel-collector | `bool` | `null` | no |
166	|  [datadog\_agent\_enabled\_cluster\_types](#input\_datadog\_agent\_enabled\_cluster\_types) | Types of clusters datadog\_agent should be enabled on by default | `map(string)` |
{
  "cps": true,
  "dev": false,
  "infra": false,
  "mgmt": true,
  "saas": true
}
 | no |
167	|  [datadog\_agent\_image\_tag](#input\_datadog\_agent\_image\_tag) | Version of otel-collector image tag | `string` | `""` | no |
168	|  [datadog\_agent\_version](#input\_datadog\_agent\_version) | Version of otel-collector helm chart | `string` | `""` | no |
169	|  [datadog\_create\_namespace](#input\_datadog\_create\_namespace) | n/a | `bool` | `false` | no |
170	|  [datadog\_enable\_mrds\_monitoring](#input\_datadog\_enable\_mrds\_monitoring) | Enable multitenant RDS monitoring | `bool` | `false` | no |
171	|  [datadog\_enable\_now\_obfusicator\_options](#input\_datadog\_enable\_now\_obfusicator\_options) | Whether to enable the NOWRDS obfuscator options in the Datadog agent configuration. | `bool` | `false` | no |
172	|  [datadog\_enable\_nowrds\_monitoring](#input\_datadog\_enable\_nowrds\_monitoring) | Enable monitoring for NOWRDS. | `bool` | `false` | no |
173	|  [datadog\_now\_obfusicator\_options](#input\_datadog\_now\_obfusicator\_options) | A map of options to configure the NOWRDS obfuscator in the Datadog agent configuration. | `map(string)` |
{
  "replace_digits": "true"
}
 | no |
174	|  [datadog\_tags](#input\_datadog\_tags) | Map of tags to apply to datadog metrics | `list(string)` | `[]` | no |
175	|  [ebs\_csi\_addon\_version](#input\_ebs\_csi\_addon\_version) | Version of the AWS EBS CSI driver eks addon to use | `string` | n/a | yes |
176	|  [enable\_kube\_proxy\_replacement](#input\_enable\_kube\_proxy\_replacement) | Enables deployment of the Cilium kube-proxy replacement. Kube-proxy daemonset should be deleted and nodes rolled before this is enabled. | `bool` | `true` | no |
177	|  [env](#input\_env) | Environment where the cluster is | `string` | n/a | yes |
178	|  [envoy\_debug\_enabled](#input\_envoy\_debug\_enabled) | Toggle to enable debug logs for envoy | `bool` | `false` | no |
179	|  [envoy\_enabled](#input\_envoy\_enabled) | Toggle to enable external envoy proxy daemonset | `bool` | `false` | no |
180	|  [external\_dns\_enabled\_cluster\_types](#input\_external\_dns\_enabled\_cluster\_types) | Types of clusters that external dns should be enabled on by default | `map(string)` |
{
  "cps": true,
  "dev": true,
  "infra": true,
  "mgmt": true,
  "saas": true
}
 | no |
181	|  [external\_dns\_private\_domain\_names](#input\_external\_dns\_private\_domain\_names) | List of domains that private external-dns can manage | `list(string)` | `[]` | no |
182	|  [external\_dns\_private\_enabled](#input\_external\_dns\_private\_enabled) | Override for explicitly enabling or disabling external-dns for private zones | `bool` | `null` | no |
183	|  [external\_dns\_public\_domain\_names](#input\_external\_dns\_public\_domain\_names) | List of domains that public external-dns can manage | `list(string)` | `[]` | no |
184	|  [external\_dns\_public\_enabled](#input\_external\_dns\_public\_enabled) | Override for explicitly enabling or disabling external-dns for public zones | `bool` | `null` | no |
185	|  [external\_dns\_version](#input\_external\_dns\_version) | Version of external-dns helm chart | `string` | `""` | no |
186	|  [external\_networking\_api\_listener\_hostname](#input\_external\_networking\_api\_listener\_hostname) | Hostname for the api.* HTTPS listener/cert (Required if external\_networking\_enable is true) | `string` | `""` | no |
187	|  [external\_networking\_app\_listener\_hostname](#input\_external\_networking\_app\_listener\_hostname) | Hostname for the app.* HTTPS listener/cert (Required if external\_networking\_enable is true) | `string` | `""` | no |
188	|  [external\_networking\_enabled](#input\_external\_networking\_enabled) | Override for explicitly enabling or disabling external\_networking | `bool` | `null` | no |
189	|  [external\_networking\_enabled\_cluster\_types](#input\_external\_networking\_enabled\_cluster\_types) | Types of clusters external\_networking should be enabled on by default | `map(string)` |
{
  "cps": true,
  "dev": false,
  "infra": false,
  "mgmt": true,
  "saas": true
}
 | no |
190	|  [external\_networking\_hosted\_listener\_hostname](#input\_external\_networking\_hosted\_listener\_hostname) | Hostname for the hosted HTTPS listener/cert (Required if external\_networking\_enable is true) | `string` | `""` | no |
191	|  [external\_networking\_http\_listener\_hostname](#input\_external\_networking\_http\_listener\_hostname) | Listener for the HTTP host | `string` | `"*.immutacloud.com"` | no |
192	|  [external\_networking\_ibpl\_acceptance\_required](#input\_external\_networking\_ibpl\_acceptance\_required) | Determine if endpoints connecting to the inbound PrivateLink service require acceptance via the console | `bool` | `true` | no |
193	|  [external\_networking\_nlb\_deletion\_protection](#input\_external\_networking\_nlb\_deletion\_protection) | Enable deletion protection on inbound PrivateLink NLB (only set to false if you need to destroy it!) | `bool` | `true` | no |
194	|  [external\_networking\_nlb\_enable\_cross\_zone\_load\_balancing](#input\_external\_networking\_nlb\_enable\_cross\_zone\_load\_balancing) | Enable cross-zone load balancing on inbound PrivateLink NLB | `bool` | `true` | no |
195	|  [external\_networking\_privatelink\_listener\_hostname](#input\_external\_networking\_privatelink\_listener\_hostname) | Hostname for the PrivateLink HTTPS listener/cert (Required if external\_networking\_enable is true) | `string` | `""` | no |
196	|  [external\_networking\_privatelink\_regions](#input\_external\_networking\_privatelink\_regions) | List of regions to allow connections to the inbound PrivateLink service | `list(string)` | `[]` | no |
197	|  [external\_networking\_wildcard\_listener\_hostname](#input\_external\_networking\_wildcard\_listener\_hostname) | Hostname for the wildcard HTTPS listener/cert (Required if external\_networking\_enable is true) | `string` | `""` | no |
198	|  [external\_secrets\_cluster\_store\_vault\_path](#input\_external\_secrets\_cluster\_store\_vault\_path) | Vault path that the External Secrets ClusterSecretStore will be configured to access | `string` | `"secret"` | no |
199	|  [external\_secrets\_enabled](#input\_external\_secrets\_enabled) | Override for explicitly enabling or disabling external-secrets | `bool` | `null` | no |


199	|  [external\_secrets\_enabled](#input\_external\_secrets\_enabled) | Override for explicitly enabling or disabling external-secrets | `bool` | `null` | no |
200	|  [external\_secrets\_enabled\_cluster\_types](#input\_external\_secrets\_enabled\_cluster\_types) | Types of clusters that external-secrets should be enabled on by default | `map(string)` |
{
  "cps": true,
  "dev": true,
  "infra": true,
  "mgmt": true,
  "saas": true
}
 | no |
201	|  [external\_secrets\_image\_tag](#input\_external\_secrets\_image\_tag) | tag override for external-secrets images, usually tracks helm chart version | `string` | `null` | no |
202	|  [external\_secrets\_log\_level](#input\_external\_secrets\_log\_level) | Logging level for external-secrets deployments | `string` | `"info"` | no |
203	|  [external\_secrets\_repo\_url](#input\_external\_secrets\_repo\_url) | OCI repo URL for external-secrets images | `string` | `"registry.ic-ops.net/cache-ghcr/external-secrets/external-secrets"` | no |
204	|  [external\_secrets\_vault\_secret\_name](#input\_external\_secrets\_vault\_secret\_name) | Vault path that the approle creds are located at, minus engine mount path | `string` | `"team/sre/infrastructure/external-secrets-approle"` | no |
205	|  [external\_secrets\_version](#input\_external\_secrets\_version) | Version of the external-secrets helm chart | `string` | `""` | no |
206	|  [flow\_export\_allow\_filter\_rules](#input\_flow\_export\_allow\_filter\_rules) | Extra set of export allow filter rules for filtering Cilium flows, separated by \n | `string` | `""` | no |
207	|  [flow\_export\_deny\_filter\_rules](#input\_flow\_export\_deny\_filter\_rules) | Extra set of export deny filter rules for filtering Cilium flows, separated by \n | `string` | `""` | no |
208	|  [fluxcd\_cli\_repo\_url](#input\_fluxcd\_cli\_repo\_url) | OCI repo URL for CLI images | `string` | `"registry.ic-ops.net/cache-ghcr/fluxcd/flux-cli"` | no |
209	|  [fluxcd\_enabled](#input\_fluxcd\_enabled) | Override for explicitly enabling or disabling fluxcd | `bool` | `null` | no |
210	|  [fluxcd\_enabled\_cluster\_types](#input\_fluxcd\_enabled\_cluster\_types) | Types of clusters that fluxcd should be enabled on by default | `map(string)` |
{
  "cps": true,
  "dev": true,
  "infra": true,
  "mgmt": true,
  "saas": true
}
 | no |
211	|  [fluxcd\_helm\_controller\_repo\_url](#input\_fluxcd\_helm\_controller\_repo\_url) | OCI repo URL for helm-controller images | `string` | `"registry.ic-ops.net/cache-ghcr/fluxcd/helm-controller"` | no |
212	|  [fluxcd\_kustomize\_controller\_repo\_url](#input\_fluxcd\_kustomize\_controller\_repo\_url) | OCI repo URL for kustomize-controller images | `string` | `"registry.ic-ops.net/cache-ghcr/fluxcd/kustomize-controller"` | no |
213	|  [fluxcd\_notification\_controller\_repo\_url](#input\_fluxcd\_notification\_controller\_repo\_url) | OCI repo URL for notification-controller images | `string` | `"registry.ic-ops.net/cache-ghcr/fluxcd/notification-controller"` | no |
214	|  [fluxcd\_source\_controller\_repo\_url](#input\_fluxcd\_source\_controller\_repo\_url) | OCI repo URL for source-controller images | `string` | `"registry.ic-ops.net/cache-ghcr/fluxcd/source-controller"` | no |
215	|  [fluxcd\_version](#input\_fluxcd\_version) | Version of the fluxcd helm chart | `string` | `""` | no |
216	|  [gatewayapi\_enabled](#input\_gatewayapi\_enabled) | Enable the Cilium GatewayAPI controller | `bool` | `false` | no |
217	|  [gatewayapi\_proxyprotocol](#input\_gatewayapi\_proxyprotocol) | Enable ProxyProtocolv2 on the GatewayAPI services | `bool` | `false` | no |
218	|  [global\_segment](#input\_global\_segment) | Global segment for the cluster, i.e. na, eu, ap | `string` | `""` | no |
219	|  [hubble\_enterprise\_version](#input\_hubble\_enterprise\_version) | Version of the Hubble Enterprise helm chart | `string` | `""` | no |
220	|  [hubbleui\_version](#input\_hubbleui\_version) | Version of Cilium helm chart | `string` | `""` | no |
221	|  [ingress\_controller\_cert](#input\_ingress\_controller\_cert) | ARN of the ACM cert that the Ingress Controller will set in it's LBC annotations | `string` | `""` | no |
222	|  [ingress\_controller\_cpu\_request](#input\_ingress\_controller\_cpu\_request) | CPU request for ingress-controller pod | `string` | `"250m"` | no |
223	|  [ingress\_controller\_digest](#input\_ingress\_controller\_digest) | Image digest of the ingress-nginx controller | `string` | `""` | no |
224	|  [ingress\_controller\_elb\_ssl\_policy](#input\_ingress\_controller\_elb\_ssl\_policy) | The SSL policy to attach to the ELB with the ingress-controller LoadBalancer service | `string` | `"ELBSecurityPolicy-TLS13-1-2-Res-2021-06"` | no |
225	|  [ingress\_controller\_enabled](#input\_ingress\_controller\_enabled) | Toggle to enable Cilium ingress controller | `bool` | `false` | no |
226	|  [ingress\_controller\_image\_repo](#input\_ingress\_controller\_image\_repo) | Image Repo (registy/image) of the ingress-nginx controller | `string` | `"registry.ic-ops.net/sre/ingress-nginx/controller"` | no |
227	|  [ingress\_controller\_image\_tag](#input\_ingress\_controller\_image\_tag) | Image tag of the Ingress Controller application | `string` | `""` | no |
228	|  [ingress\_controller\_max\_replicas](#input\_ingress\_controller\_max\_replicas) | Maximum number of replicas for ingress-controller HPA | `number` | `10` | no |
229	|  [ingress\_controller\_memory\_limit](#input\_ingress\_controller\_memory\_limit) | Memory limit for ingress-controller pod | `string` | `"1Gi"` | no |
230	|  [ingress\_controller\_memory\_request](#input\_ingress\_controller\_memory\_request) | Memory request for ingress-controller pod | `string` | `"500Mi"` | no |
231	|  [ingress\_controller\_min\_replicas](#input\_ingress\_controller\_min\_replicas) | Minimum number of replicas for ingress-controller HPA | `number` | `3` | no |
232	|  [ingress\_controller\_private\_enabled](#input\_ingress\_controller\_private\_enabled) | Override for explicitly enabling or disabling the installation of the private ingress controller | `bool` | `null` | no |
233	|  [ingress\_controller\_public\_enabled](#input\_ingress\_controller\_public\_enabled) | Override for explicitly enabling or disabling the installation of the public ingress controller | `bool` | `null` | no |
234	|  [ingress\_controller\_version](#input\_ingress\_controller\_version) | Version of the Ingress Controller helm chart | `string` | `""` | no |
235	|  [ingress\_enabled\_cluster\_types](#input\_ingress\_enabled\_cluster\_types) | Types of clusters the ingress controller should be enabled on by default | `map(string)` |
{
  "cps": true,
  "dev": false,
  "infra": false,
  "mgmt": true,
  "saas": false
}
 | no |
236	|  [kube\_proxy\_addon\_version](#input\_kube\_proxy\_addon\_version) | Version of kube-proxy eks addon to use | `string` | `""` | no |
237	|  [kube\_proxy\_enabled](#input\_kube\_proxy\_enabled) | Override for explicitly enabling or disabling kube-proxy | `bool` | `null` | no |
238	|  [kyverno\_admission\_replicas](#input\_kyverno\_admission\_replicas) | Numbers of replicas to deploy for the Kyverno admission controller. | `number` | `2` | no |
239	|  [kyverno\_background\_replicas](#input\_kyverno\_background\_replicas) | Numbers of replicas to deploy for the Kyverno background controller. | `number` | `2` | no |
240	|  [kyverno\_cleanup\_enabled](#input\_kyverno\_cleanup\_enabled) | Enables Kyverno cleanup controller deployment | `bool` | `false` | no |
241	|  [kyverno\_cleanup\_replicas](#input\_kyverno\_cleanup\_replicas) | Numbers of replicas to deploy for the Kyverno cleanup controller. | `number` | `2` | no |
242	|  [kyverno\_cluster\_role\_rules](#input\_kyverno\_cluster\_role\_rules) | List of rule objects that specify API Groups, resources, and verbs that allows Kyverno to access CRDs for policy enforcement. |
list(object({
    api_groups = list(string)
    resources  = list(string)
    verbs      = list(string)
  }))
 |
[
  {
    "api_groups": [
      "gateway.networking.k8s.io"
    ],
    "resources": [
      "*"
    ],
    "verbs": [
      "get",
      "list",
      "watch"
    ]
  },
  {
    "api_groups": [
      "cilium.io"
    ],
    "resources": [
      "*"
    ],
    "verbs": [
      "get",
      "list",
      "watch"
    ]
  },
  {
    "api_groups": [
      "acme.cert-manager.io"
    ],
    "resources": [
      "*"
    ],
    "verbs": [
      "get",
      "list",
      "watch"
    ]
  },
  {
    "api_groups": [
      "cert-manager.io"
    ],
    "resources": [
      "*"
    ],
    "verbs": [
      "get",
      "list",
      "watch"
    ]
  },
  {
    "api_groups": [
      "external-secrets.io"
    ],
    "resources": [
      "*"
    ],
    "verbs": [
      "get",
      "list",
      "watch"
    ]
  },
  {
    "api_groups": [
      "generators.external-secrets.io"
    ],
    "resources": [
      "*"
    ],
    "verbs": [
      "get",
      "list",
      "watch"
    ]
  },
  {
    "api_groups": [
      "source.toolkit.fluxcd.io"
    ],
    "resources": [
      "*"
    ],
    "verbs": [
      "get",
      "list",
      "watch"
    ]
  },
  {
    "api_groups": [
      "helm.toolkit.fluxcd.io"
    ],
    "resources": [
      "*"
    ],
    "verbs": [
      "get",
      "list",
      "watch"
    ]
  },
  {
    "api_groups": [
      "kustomize.toolkit.fluxcd.io"
    ],
    "resources": [
      "*"
    ],
    "verbs": [
      "get",
      "list",
      "watch"
    ]
  },
  {
    "api_groups": [
      "platform.immuta.io"
    ],
    "resources": [
      "*"
    ],
    "verbs": [
      "get",
      "list",
      "watch"
    ]
  },
  {
    "api_groups": [
      "postgresql.cnpg.io"
    ],
    "resources": [
      "*"
    ],
    "verbs": [
      "get",
      "list",
      "watch"
    ]
  }
]
 | no |
243	|  [kyverno\_enabled](#input\_kyverno\_enabled) | Override for explicitly enabling or disabling the kyverno | `bool` | `null` | no |
244	|  [kyverno\_enabled\_cluster\_types](#input\_kyverno\_enabled\_cluster\_types) | Types of clusters that kyverno should be enabled on by default | `map(string)` |
{
  "cps": true,
  "dev": false,
  "infra": false,
  "mgmt": true,
  "saas": true
}
 | no |
245	|  [kyverno\_install\_crds](#input\_kyverno\_install\_crds) | Enables installation of Kyverno CRDs | `bool` | `true` | no |
246	|  [kyverno\_log\_format](#input\_kyverno\_log\_format) | Format of outputted logs from Kyverno controllers | `string` | `"json"` | no |
247	|  [kyverno\_log\_verbosity](#input\_kyverno\_log\_verbosity) | What log level Kyverno should operate at. | `number` | `2` | no |
248	|  [kyverno\_reports\_replicas](#input\_kyverno\_reports\_replicas) | Numbers of replicas to deploy for the Kyverno reports controller. | `number` | `2` | no |
249	|  [kyverno\_version](#input\_kyverno\_version) | Version of the kyverno helm chart | `string` | `""` | no |
250	|  [maglev\_config](#input\_maglev\_config) | Optional configuration for Maglev load balancing algorithm. |
object({
    enabled    = bool
    table_size = number
    hash_seed  = string
  })
 |
{
  "enabled": true,
  "hash_seed": "",
  "table_size": 16381
}
 | no |
251	|  [metrics\_server\_enabled](#input\_metrics\_server\_enabled) | Override for explicitly enabling or disabling the metrics server | `bool` | `null` | no |
252	|  [metrics\_server\_enabled\_cluster\_types](#input\_metrics\_server\_enabled\_cluster\_types) | Types of clusters the metrics server should be enabled on by default | `map(string)` |
{
  "cps": true,
  "dev": true,
  "infra": true,
  "mgmt": true,
  "saas": true
}
 | no |
253	|  [metrics\_server\_image\_tag](#input\_metrics\_server\_image\_tag) | metrics-server version tag | `string` | `""` | no |
254	|  [metrics\_server\_version](#input\_metrics\_server\_version) | Version of metrics-server helm chart | `string` | `""` | no |
255	|  [node\_encryption\_enabled](#input\_node\_encryption\_enabled) | Enables Node Encryption on clusters | `bool` | `true` | no |
256	|  [otel\_collector\_additional\_config](#input\_otel\_collector\_additional\_config) | Alternate helm chart config to be used (overwrites entire helm config, does not merge) | `any` | `null` | no |
257	|  [otel\_collector\_enabled](#input\_otel\_collector\_enabled) | Override for explicitly enabling or disabling otel-collector | `bool` | `null` | no |
258	|  [otel\_collector\_enabled\_cluster\_types](#input\_otel\_collector\_enabled\_cluster\_types) | Types of clusters otel\_collector should be enabled on by default | `map(string)` |
{
  "cps": true,
  "dev": false,
  "infra": false,
  "mgmt": true,
  "saas": true
}
 | no |
259	|  [otel\_collector\_image\_tag](#input\_otel\_collector\_image\_tag) | Version of otel-collector image tag | `string` | `""` | no |
260	|  [otel\_collector\_replicas](#input\_otel\_collector\_replicas) | number of replicas for the otel collector/processor to have | `number` | `3` | no |
261	|  [otel\_collector\_version](#input\_otel\_collector\_version) | Version of otel-collector helm chart | `string` | `""` | no |
262	|  [otel\_image](#input\_otel\_image) | image for the otel collector/processor | `string` | `"registry.ic-ops.net/cache-docker-hub/otel/opentelemetry-collector-contrib"` | no |
263	|  [otel\_lb\_image](#input\_otel\_lb\_image) | image for the otel collector loadbalancer | `string` | `"registry.ic-ops.net/cache-docker-hub/otel/opentelemetry-collector-contrib"` | no |
264	|  [otel\_lb\_replicas](#input\_otel\_lb\_replicas) | number of replicas for the otel loadbalancer to have | `number` | `3` | no |
265	|  [private\_ingress\_proxy\_read\_timeout](#input\_private\_ingress\_proxy\_read\_timeout) | Maximum time (between reads) to read proxied server response | `number` | `300` | no |
266	|  [private\_ingress\_proxy\_send\_timeout](#input\_private\_ingress\_proxy\_send\_timeout) | Maximum time (between writes) to send proxied server request | `number` | `300` | no |
267	|  [private\_ingress\_proxy\_stream\_timeout](#input\_private\_ingress\_proxy\_stream\_timeout) | Maximum time between two successive read or write operations on client or proxied server connections | `number` | `600` | no |
268	|  [proxy\_enable\_transparent\_mode](#input\_proxy\_enable\_transparent\_mode) | Toggle to enable DNS Transparency Mode (fix for ITSM-3425) | `bool` | `true` | no |
269	|  [public\_ingress\_proxy\_read\_timeout](#input\_public\_ingress\_proxy\_read\_timeout) | Maximum time (between reads) to read proxied server response | `number` | `300` | no |
270	|  [public\_ingress\_proxy\_send\_timeout](#input\_public\_ingress\_proxy\_send\_timeout) | Maximum time (between writes) to send proxied server request | `number` | `300` | no |
271	|  [public\_ingress\_proxy\_stream\_timeout](#input\_public\_ingress\_proxy\_stream\_timeout) | Maximum time between two successive read or write operations on client or proxied server connections | `number` | `600` | no |
272	|  [region](#input\_region) | Region where the cluster is | `string` | n/a | yes |
273	|  [reloader\_enabled](#input\_reloader\_enabled) | Override for explicitly enabling or disabling reloader | `bool` | `null` | no |
274	|  [reloader\_enabled\_cluster\_types](#input\_reloader\_enabled\_cluster\_types) | Types of clusters that reloader should be enabled on by default | `map(string)` |
{
  "cps": true,
  "dev": true,
  "infra": true,
  "mgmt": true,
  "saas": true
}
 | no |
275	|  [reloader\_image\_tag](#input\_reloader\_image\_tag) | Image version for the reloader controller | `string` | `""` | no |
276	|  [reloader\_repo\_url](#input\_reloader\_repo\_url) | OCI repo URL for reloader images | `string` | `"registry.ic-ops.net/cache-ghcr/stakater/reloader"` | no |
277	|  [reloader\_version](#input\_reloader\_version) | Version of the reloader helm chart | `string` | `""` | no |
278	|  [s3\_csi\_driver\_enabled](#input\_s3\_csi\_driver\_enabled) | Override to explicitly enable or disable the s3 csi driver | `bool` | `null` | no |
279	|  [s3\_csi\_driver\_enabled\_cluster\_types](#input\_s3\_csi\_driver\_enabled\_cluster\_types) | Types of clusters the s3 csi driver should be enabled on by default | `map(string)` |
{
  "cps": false,
  "dev": false,
  "infra": true,
  "mgmt": false,
  "saas": true
}
 | no |
280	|  [s3\_csi\_driver\_image\_tag](#input\_s3\_csi\_driver\_image\_tag) | Image version/tag for the s3 csi driver | `string` | `""` | no |
281	|  [s3\_csi\_driver\_version](#input\_s3\_csi\_driver\_version) | Helm chart version for the s3 csi driver | `string` | `""` | no |
282	|  [s3\_csi\_liveness\_probe\_repo](#input\_s3\_csi\_liveness\_probe\_repo) | S3 CSI driver livenessProbe repo | `string` | `"registry.ic-ops.net/cache-k8s-registry/sig-storage/livenessprobe"` | no |
283	|  [s3\_csi\_liveness\_probe\_tag](#input\_s3\_csi\_liveness\_probe\_tag) | S3 CSI driver livenessProbe tag | `string` | `""` | no |
284	|  [s3\_csi\_node\_driver\_registrar\_repo](#input\_s3\_csi\_node\_driver\_registrar\_repo) | S3 CSI driver nodeDriverRegistrar repo | `string` | `"registry.ic-ops.net/cache-k8s-registry/sig-storage/csi-node-driver-registrar"` | no |
285	|  [s3\_csi\_node\_driver\_registrar\_tag](#input\_s3\_csi\_node\_driver\_registrar\_tag) | S3 CSI driver nodeDriverRegistrar tag | `string` | `""` | no |
286	|  [subnet\_ids](#input\_subnet\_ids) | List of subnets to deploy the cluster into | `list(string)` | n/a | yes |
287	|  [sysdig\_agent\_enabled](#input\_sysdig\_agent\_enabled) | Override for explicitly enabling or disabling the sysdig agent | `bool` | `null` | no |
288	|  [sysdig\_agent\_enabled\_cluster\_types](#input\_sysdig\_agent\_enabled\_cluster\_types) | Types of clusters that the sysdig agent should be enabled on by default | `map(string)` |
{
  "cps": true,
  "dev": false,
  "infra": false,
  "mgmt": true,
  "saas": true
}
 | no |
289	|  [sysdig\_agent\_version](#input\_sysdig\_agent\_version) | Version of the sysdig helm chart that will be deployed | `string` | `""` | no |
290	|  [sysdig\_cluster\_log\_level](#input\_sysdig\_cluster\_log\_level) | Log level for the sysdig cluster, valid values are: trace, debug, info, warn, err | `string` | `"warn"` | no |
291	|  [sysdig\_cluster\_replica\_count](#input\_sysdig\_cluster\_replica\_count) | Number of replicas for the sysdig cluster | `number` | `2` | no |
292	|  [sysdig\_host\_log\_level](#input\_sysdig\_host\_log\_level) | Log level for the sysdig host, valid values are: or none, debug, info, warning, error | `string` | `"warning"` | no |
293	|  [sysdig\_vault\_mount](#input\_sysdig\_vault\_mount) | mount for the sysdig vault secret | `string` | `"secret"` | no |
294	|  [sysdig\_vault\_name](#input\_sysdig\_vault\_name) | secret name | `string` | `"team/sre/infrastructure/sysdig"` | no |
295	|  [tags](#input\_tags) | Map of key-value pairs to tag created resources with. | `map(any)` | `{}` | no |
296	|  [teleport\_agent\_enabled](#input\_teleport\_agent\_enabled) | Override for explicitly enabling or disabling the teleport agent | `bool` | `null` | no |
297	|  [teleport\_agent\_enabled\_cluster\_types](#input\_teleport\_agent\_enabled\_cluster\_types) | Types of clusters that the teleport agent should be enabled on by default | `map(string)` |
{
  "cps": true,
  "dev": true,
  "infra": true,
  "mgmt": true,
  "saas": true
}
 | no |
298	|  [teleport\_agent\_proxy\_apps](#input\_teleport\_agent\_proxy\_apps) | A map of applications for the teleport agent to proxy |
list(object({
    name                 = string
    uri                  = string
    insecure_skip_verify = optional(bool, false)
    rewrite = optional(object({
      jwt_claims = optional(string)
      redirect   = optional(list(string), [])
      headers    = optional(list(string), [])
    }))
    labels = map(string)
  }))
 | `[]` | no |
299	|  [teleport\_agent\_proxy\_apps\_resources](#input\_teleport\_agent\_proxy\_apps\_resources) | A list of map of application resource targets that should be proxied by teleport application service |
list(object({
    labels = map(string)
  }))
 | `[]` | no |
300	|  [teleport\_agent\_version](#input\_teleport\_agent\_version) | Version of Teleport Agent and helm chart | `string` | `""` | no |
301	|  [teleport\_cluster](#input\_teleport\_cluster) | Teleport Cluster location | `string` | `"transporter.ic-ops.com:443"` | no |
302	|  [teleport\_os\_databases](#input\_teleport\_os\_databases) | List of OpenSearch Databases for Teleport Agent Connections |
list(object({
    name       = string
    uri        = string
    protocol   = optional(string, "opensearch")
    region     = string
    account_id = string
    labels     = optional(map(string))
    users      = optional(list(string), ["immuta_view", "immuta_admin"])
  }))
 | `[]` | no |
303	|  [teleport\_rds\_databases](#input\_teleport\_rds\_databases) | List of RDS Databases for Teleport Agent Connections |
list(object({
    name        = string
    uri         = string
    protocol    = optional(string, "postgres")
    region      = string
    instance_id = optional(string)
    labels      = optional(map(string), {})
    account_id  = string
    resource_id = optional(string)
    users       = optional(list(string), ["immuta_view", "immuta_admin"])
  }))
 | `[]` | no |
304	|  [teleport\_roles](#input\_teleport\_roles) | List of roles, comma separated, for the teleport-agent to assume in Teleport cluster | `string` | `"kube"` | no |
305	|  [trust\_manager\_authorized\_secrets](#input\_trust\_manager\_authorized\_secrets) | List of secret names that trust-manager is authorize to write to | `list(string)` | `[]` | no |
306	|  [trust\_manager\_authorized\_secrets\_all\_enabled](#input\_trust\_manager\_authorized\_secrets\_all\_enabled) | Enables trust-manager to write to all secrets in the cluster | `bool` | `false` | no |
307	|  [trust\_manager\_enabled](#input\_trust\_manager\_enabled) | Override for explicitly enabling or disabling trust-manager | `bool` | `null` | no |
308	|  [trust\_manager\_enabled\_cluster\_types](#input\_trust\_manager\_enabled\_cluster\_types) | Types of clusters that trust-manager should be enabled on by default | `map(string)` |
{
  "cps": true,
  "dev": false,
  "infra": false,
  "mgmt": true,
  "saas": true
}
 | no |
309	|  [trust\_manager\_secret\_targets\_enabled](#input\_trust\_manager\_secret\_targets\_enabled) | Enables trust-manager to write target secrets in bundles | `bool` | `true` | no |
310	|  [trust\_manager\_version](#input\_trust\_manager\_version) | Version of trust-manager helm chart | `string` | `""` | no |
311	|  [update\_strategy\_max\_unavailable](#input\_update\_strategy\_max\_unavailable) | Max unavailable for the sysdig agent update strategy | `string` | `"25%"` | no |
312	|  [vault\_endpoint](#input\_vault\_endpoint) | Endpoint for vault, used in helm values for vault sidecar injector | `string` | `"https://vault.infrastructure.immuta.io:8200"` | no |
313	|  [vault\_sidecar\_injector\_enabled](#input\_vault\_sidecar\_injector\_enabled) | Override for enabling or disabling the vault sidecar injector | `bool` | `null` | no |
314	|  [vault\_sidecar\_injector\_enabled\_cluster\_types](#input\_vault\_sidecar\_injector\_enabled\_cluster\_types) | Types of clusters that vault sidecar injector should be enabled on by default | `map(string)` |
{
  "cps": false,
  "dev": false,
  "infra": false,
  "mgmt": false,
  "saas": true
}
 | no |
315	|  [vault\_sidecar\_injector\_image\_tag](#input\_vault\_sidecar\_injector\_image\_tag) | Image tag for the vault sidecar injector | `string` | `""` | no |
316	|  [vault\_sidecar\_injector\_logformat](#input\_vault\_sidecar\_injector\_logformat) | Logging format for vault sidecar | `string` | `"json"` | no |
317	|  [vault\_sidecar\_injector\_loglevel](#input\_vault\_sidecar\_injector\_loglevel) | Logging level for vault sidecar | `string` | `"warn"` | no |
318	|  [vault\_sidecar\_injector\_version](#input\_vault\_sidecar\_injector\_version) | Version of the Vault helm chart, used to deploy the sidecar injector | `string` | `""` | no |
319	|  [vpc\_id](#input\_vpc\_id) | VPC in which to deploy the cluster | `string` | n/a | yes |
320	|  [wireguard\_enabled](#input\_wireguard\_enabled) | Enables Wireguard Encryption on clusters | `bool` | `true` | no |
321
322	## Outputs
323
324	| Name | Description |
325	|------|-------------|
326	|  [s3\_csi\_access\_role\_arn](#output\_s3\_csi\_access\_role\_arn) | S3 CSI Driver Role Arn |
327


Now I have a complete picture of the README structure. It's a Terraform-docs-generated file with:
- Requirements, Providers, Modules, Resources sections (auto-generated table format)
- Inputs table (alphabetically sorted, all variables in one big table)
- Outputs table

The README does NOT have hand-written narrative sections — it's purely the auto-generated terraform-docs format. The `otel_collector_*` variables are just rows in the big Inputs table, not a separate narrative section.

Given this is a terraform-docs style README, I need to add the `vector_*` variables as rows in the Inputs table (alphabetically sorted), add `module_vector` to the Modules table, and add a narrative section. Let me check if there's any custom content at the top that I might have missed by starting at line 0:


Bash

Count lines in README


List files in directory


326 /Users/steve.briggs/projects/IAC/terraform/iac-library/aws/compute/eks-cluster-applications/README.md


drwxr-xr-x steve.briggs staff 352 B  Fri Mar  6 12:13:52 2026 ..
.rw-r--r-- steve.briggs staff 3.0 KB Fri Mar  6 12:13:53 2026 .gitignore
.rw-r--r-- steve.briggs staff 4.0 KB Fri Mar  6 12:13:53 2026 application_deployment.tf
.rw-r--r-- steve.briggs staff 6.1 KB Fri Mar  6 12:13:53 2026 argocd_mgmt.tf
.rw-r--r-- steve.briggs staff 4.0 KB Fri Mar  6 12:13:53 2026 cluster_autoscaler.tf
.rw-r--r-- steve.briggs staff 2.7 KB Fri Mar  6 12:13:53 2026 cnpg_operator.tf
.rw-r--r-- steve.briggs staff 7.1 KB Fri Mar  6 12:13:53 2026 common.tf
.rw-r--r-- steve.briggs staff 2.2 KB Fri Mar  6 12:13:53 2026 coredns.tf
.rw-r--r-- steve.briggs staff 2.3 KB Fri Mar  6 12:13:53 2026 ebs_csi.tf
.rw-r--r-- steve.briggs staff 3.4 KB Fri Mar  6 12:13:53 2026 external_secrets.tf
.rw-r--r-- steve.briggs staff 1.9 KB Fri Mar  6 12:13:53 2026 kube_proxy.tf
.rw-r--r-- steve.briggs staff 5.4 KB Fri Mar  6 12:13:53 2026 kyverno.tf
.rw-r--r-- steve.briggs staff 2.5 KB Fri Mar  6 12:13:53 2026 metrics_server.tf
.rw-r--r-- steve.briggs staff 2.8 KB Fri Mar  6 12:13:53 2026 netpol.tf
.rw-r--r-- steve.briggs staff 2.7 KB Fri Mar  6 12:13:53 2026 reloader.tf
.rw-r--r-- steve.briggs staff 5.2 KB Fri Mar  6 12:13:53 2026 s3_csi.tf
.rw-r--r-- steve.briggs staff 3.3 KB Fri Mar  6 12:13:53 2026 vault_sidecar_injector.tf
drwxr-xr-x steve.briggs staff 256 B  Fri Mar  6 16:17:40 2026 .idea
.rw-r--r-- steve.briggs staff 9.1 KB Wed Apr  8 11:01:45 2026 cert_manager.tf
.rw-r--r-- steve.briggs staff  14 KB Wed Apr  8 11:01:45 2026 cilium.tf
.rw-r--r-- steve.briggs staff 6.6 KB Wed Apr  8 11:01:45 2026 external_dns.tf
.rw-r--r-- steve.briggs staff 6.7 KB Wed Apr  8 11:01:45 2026 teleport.tf
drwxr-xr-x steve.briggs staff 128 B  Tue May  5 12:28:44 2026 .claude
.rw-r--r-- steve.briggs staff  66 KB Tue May  5 12:42:37 2026 README.md
.rw-r--r-- steve.briggs staff  10 KB Tue May  5 12:42:37 2026 aws_loadbalancer.tf
.rw-r--r-- steve.briggs staff 4.1 KB Tue May  5 12:42:37 2026 datadog_agent.tf
.rw-r--r-- steve.briggs staff 6.7 KB Tue May  5 12:42:37 2026 external_networking.tf
.rw-r--r-- steve.briggs staff 3.6 KB Tue May  5 12:42:37 2026 fluxcd.tf
.rw-r--r-- steve.briggs staff 8.0 KB Tue May  5 12:42:37 2026 ingress_controller.tf
drwxr-xr-x steve.briggs staff 128 B  Tue May  5 14:52:45 2026 .terraform
.rw-r--r-- steve.briggs staff 7.6 KB Tue May  5 14:53:12 2026 .terraform.lock.hcl
.rw-r--r-- steve.briggs staff 4.8 KB Tue May  5 14:54:27 2026 sysdig_agent.tf
drwxr-xr-x steve.briggs staff 512 B  Tue May  5 14:54:27 2026 .git
.rw-r--r-- steve.briggs staff 5.9 KB Tue May  5 14:54:41 2026 vector.tf
.rw-r--r-- steve.briggs staff 3.8 KB Tue May  5 15:02:00 2026 otel_collector.tf
drwxr-xr-x steve.briggs staff 1.1 KB Tue May  5 15:02:00 2026 .


The README is 66KB and 326 lines — it's much larger than the token limit suggested. The 326-line count matches what I read. Wait, the file shows 66KB but only 326 lines? That's because the table rows are very wide. Let me check the README more carefully — it appears terraform-docs generated, so the file starts at line 0 (which is actually `## Requirements` — there's no preamble/header block).

Now let me read `vector.tf` and `otel_collector.tf` to understand what's there: