chore(main): release 7.8.0

CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [7.8.0](https://github.com/nullplatform/tofu-modules/compare/v7.7.0...v7.8.0) (2026-09-11)
+
+
+### Features
+
+* **eks:** pin the cluster addon versions with addon_versions ([#581](https://github.com/nullplatform/tofu-modules/issues/581)) ([ee87a05](https://github.com/nullplatform/tofu-modules/commit/ee87a051edc39fa6201a5723f66d7e31e165662b))
+
 ## [7.7.0](https://github.com/nullplatform/tofu-modules/compare/v7.6.0...v7.7.0) (2026-09-09)
 
 

VERSIONS.md

@@ -14,20 +14,20 @@ a specific release, so an upgrade is something someone decides.
 
 ## What to pin
 
-Verified 2026-09-08.
+Verified 2026-09-11.
 
 | Component | Current | Variable | Module |
 | --- | --- | --- | --- |
 | `nullplatform-base` chart | `2.44.6` | `nullplatform_base_helm_version` | `nullplatform/base` |
 | `nullplatform-agent` chart | `3.0.0` | `nullplatform_agent_helm_version` | `nullplatform/agent` |
-| `cert-manager` chart | `v1.21.1` | `cert_manager_version` | `infrastructure/commons/cert_manager` |
-| `prometheus` chart | `29.27.2` | `prometheus_version` | `infrastructure/commons/prometheus` |
+| `cert-manager` chart | `v1.21.2` | `cert_manager_version` | `infrastructure/commons/cert_manager` |
+| `prometheus` chart | `29.28.1` | `prometheus_version` | `infrastructure/commons/prometheus` |
 | `istio-base` chart | `1.30.4` | `istio_base_version` | `infrastructure/commons/istio` |
 | `istiod` chart | `1.30.4` | `istiod_version` | `infrastructure/commons/istio` |
 | `gateway-api` CRDs | `v1.5.1` | `gateway_api_crd_ref` | `nullplatform/base` |
 | `k8s-logs-controller` | `1.6.1` | `logging_controller_image_tag` | `nullplatform/base` |
-| `k8s-traffic-manager` | `1.8.0` | `agent_traffic_manager_tag` | `nullplatform/agent` |
-| traffic manager (provider config) | `1.8.0` | `traffic_manager_version` | `container_orchestration/eks` |
+| `k8s-traffic-manager` | `1.8.1` | `agent_traffic_manager_tag` | `nullplatform/agent` |
+| traffic manager (provider config) | `1.8.1` | `traffic_manager_version` | `container_orchestration/eks` |
 | `scopes` repository | `v1.15.1` | `agent_repo` (as `"https://github.com/nullplatform/scopes.git#v1.15.1"`) | `nullplatform/agent` |
 
 **Read your cluster before copying these.** The rule is to pin what you are already running,
@@ -48,7 +48,7 @@ module "agent" {
   nullplatform_agent_helm_version = "3.0.0"
   image_tag                       = "0.9.2"
   agent_repos_scope_tag           = "v1.15.1"
-  agent_traffic_manager_tag       = "1.8.0"
+  agent_traffic_manager_tag       = "1.8.1"
 
   agent_repos_extra = [
     "https://github.com/nullplatform/scopes-lambda.git#v0.3.1",
@@ -58,15 +58,15 @@ module "agent" {
 
 # eks, aks and gke all take this
 module "container_orchestration" {
-  traffic_manager_version = "1.8.0"
+  traffic_manager_version = "1.8.1"
 }
 
 module "cert_manager" {
-  cert_manager_version = "v1.21.1"
+  cert_manager_version = "v1.21.2"
 }
 
 module "prometheus" {
-  prometheus_version = "29.27.2"
+  prometheus_version = "29.28.1"
 }
 
 module "istio" {

infrastructure/aws/acm/README.md

@@ -18,7 +18,7 @@ The module creates an aws_acm_certificate resource with DNS validation, which is
 
 ```hcl
 module "acm" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/acm?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/acm?ref=v7.8.0"
 
   domain_name = "your-domain-name"
   zone_id     = "your-zone-id"

infrastructure/aws/aws_load_balancer_controller/README.md

@@ -18,7 +18,7 @@ This module creates a helm_release resource to deploy the AWS Load Balancer Cont
 
 ```hcl
 module "aws_load_balancer_controller" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/aws_load_balancer_controller?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/aws_load_balancer_controller?ref=v7.8.0"
 
   cluster_name = "your-cluster-name"
   vpc_id       = "your-vpc-id"

infrastructure/aws/backend/README.md

@@ -20,7 +20,7 @@ This module creates an S3 bucket with versioning and server-side encryption enab
 
 ```hcl
 module "backend" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/backend?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/backend?ref=v7.8.0"
 }
 ```
 

infrastructure/aws/dns/README.md

@@ -21,7 +21,7 @@ The module conditionally creates an aws_route53_zone resource for a public hoste
 
 ```hcl
 module "dns" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/dns?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/dns?ref=v7.8.0"
 
   domain_name = "your-domain-name"
   vpc_id      = "your-vpc-id"

infrastructure/aws/eks/README.md

@@ -2,27 +2,27 @@
 
 ## Description
 
-Provisions an Amazon EKS cluster with managed node groups or Auto Mode, core add-ons, IRSA, and an EBS CSI driver IAM role using the terraform-aws-modules/eks module
+Provisions an Amazon EKS cluster with managed node groups or Auto Mode, core addons, IRSA, and optional KMS encryption using the terraform-aws-modules/eks/aws upstream module
 
 ## Architecture
 
-The module wraps terraform-aws-modules/eks to create the EKS cluster (aws_eks_cluster), optionally provisioning either an EKS managed node group or Auto Mode compute config based on the use_auto_mode flag. An aws_iam_role (ebs_csi_driver) is created and wired into the aws-ebs-csi-driver add-on via service_account_role_arn, while IRSA is enabled to expose an OIDC provider ARN as output. Security group additional rules for NLB health checks and HTTPS ingress are conditionally injected via security_group_additional_rules, using the VPC CIDR fetched from the aws_vpc data source combined with any additional_network_cidrs.
+The module wraps `terraform-aws-modules/eks/aws` (which internally creates `aws_eks_cluster`, `aws_eks_node_group`, `aws_iam_role`, `aws_iam_role_policy_attachment`, and `aws_eks_addon` resources) and wires a locally created `aws_iam_role` for the EBS CSI driver into the addon's `service_account_role_arn`. An `aws_vpc` data source resolves the VPC CIDR for security group rules, which are conditionally added to the cluster security group for NLB health checks and HTTPS ingress. KMS key creation is derived from `encryption_config.provider_key_arn`: when a CMK ARN is supplied the module sets `create_kms_key = false` and passes the ARN through; otherwise the upstream module auto-generates an `aws_kms_key`. When `use_auto_mode = true`, `eks_managed_node_groups` is set to empty and `compute_config` enables EKS Auto Mode with the specified node pools.
 
 ## Features
 
-- Creates EKS cluster with configurable Kubernetes version and dual endpoint access control
-- Provisions EKS managed node group with configurable AMI type, instance type, and scaling parameters
-- Enables EKS Auto Mode with configurable node pools (general-purpose and/or system) as an alternative to managed node groups
-- Installs core EKS add-ons: aws-ebs-csi-driver, coredns, eks-pod-identity-agent, kube-proxy, and vpc-cni
-- Creates IAM role for the EBS CSI driver and wires it to the add-on via IRSA with OIDC provider
-- Configures optional CloudWatch log group for EKS control plane logs with configurable retention
-- Adds conditional security group rules for NLB health checks (port 15021) and HTTPS (port 443) ingress from VPC and peered CIDRs
+- Creates EKS cluster with configurable Kubernetes version and private subnet placement
+- Installs five core addons (aws-ebs-csi-driver, coredns, eks-pod-identity-agent, kube-proxy, vpc-cni) with optional version pinning to prevent plan drift
+- Supports EKS Auto Mode with configurable node pools (general-purpose, system) as an alternative to managed node groups
+- Configures IRSA via OIDC provider and creates a dedicated IAM role for the EBS CSI driver
+- Manages KMS encryption for etcd secrets, supporting both auto-generated keys and bring-your-own CMK
+- Adds optional security group rules for NLB health checks and HTTPS traffic using VPC and additional CIDRs
+- Supports configurable API server endpoint access with public CIDR allowlisting and multiple authentication modes
 
 ## Basic Usage
 
 ```hcl
 module "eks" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/eks?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/eks?ref=v7.8.0"
 
   aws_subnets_private_ids = "your-aws-subnets-private-ids"
   aws_vpc_vpc_id          = "your-aws-vpc-vpc-id"
@@ -75,6 +75,7 @@ resource "example_resource" "this" {
 |------|-------------|------|---------|:--------:|
 | <a name="input_access_entries"></a> [access\_entries](#input\_access\_entries) | Map of access entries for the EKS cluster | <pre>map(object({<br/>    principal_arn     = string<br/>    user_name         = optional(string)<br/>    kubernetes_groups = optional(list(string))<br/>    type              = optional(string)<br/><br/>    policy_associations = optional(map(object({<br/>      policy_arn = string<br/>      access_scope = optional(object({<br/>        type       = optional(string)<br/>        namespaces = optional(list(string))<br/>      }))<br/>    })))<br/>  }))</pre> | `{}` | no |
 | <a name="input_additional_network_cidrs"></a> [additional\_network\_cidrs](#input\_additional\_network\_cidrs) | Additional CIDR blocks to allow in security group rules (e.g., peered VPC, on-premises network). | `list(string)` | `[]` | no |
+| <a name="input_addon_versions"></a> [addon\_versions](#input\_addon\_versions) | Pinned EKS addon versions, keyed by addon name (aws-ebs-csi-driver, coredns, eks-pod-identity-agent, kube-proxy, vpc-cni). An addon left out keeps resolving to the most recent version, which surfaces as plan drift whenever AWS publishes a new build. | `map(string)` | `{}` | no |
 | <a name="input_ami_release_version"></a> [ami\_release\_version](#input\_ami\_release\_version) | Pin a specific AMI release version for the managed node group (e.g. "1.34.6-20260415").<br/>When null, the upstream module resolves the AMI based on use\_latest\_ami\_release\_version.<br/>Set this to a fixed value when reproducible AMIs are required (e.g. to avoid plan drift<br/>every time AWS publishes a new optimized AMI). | `string` | `null` | no |
 | <a name="input_ami_type"></a> [ami\_type](#input\_ami\_type) | AMI type to use with the node | `string` | `"AL2023_x86_64_STANDARD"` | no |
 | <a name="input_attach_cluster_primary_security_group"></a> [attach\_cluster\_primary\_security\_group](#input\_attach\_cluster\_primary\_security\_group) | Attach cluster primary security group to node groups | `bool` | `true` | no |
@@ -117,16 +118,16 @@ resource "example_resource" "this" {
 <!-- BEGIN_AI_METADATA
 {
   "name": "eks",
-  "description": "Provisions an Amazon EKS cluster with managed node groups or Auto Mode, core add-ons, IRSA, and an EBS CSI driver IAM role using the terraform-aws-modules/eks module",
-  "architecture": "The module wraps terraform-aws-modules/eks to create the EKS cluster (aws_eks_cluster), optionally provisioning either an EKS managed node group or Auto Mode compute config based on the use_auto_mode flag. An aws_iam_role (ebs_csi_driver) is created and wired into the aws-ebs-csi-driver add-on via service_account_role_arn, while IRSA is enabled to expose an OIDC provider ARN as output. Security group additional rules for NLB health checks and HTTPS ingress are conditionally injected via security_group_additional_rules, using the VPC CIDR fetched from the aws_vpc data source combined with any additional_network_cidrs.",
+  "description": "Provisions an Amazon EKS cluster with managed node groups or Auto Mode, core addons, IRSA, and optional KMS encryption using the terraform-aws-modules/eks/aws upstream module",
+  "architecture": "The module wraps `terraform-aws-modules/eks/aws` (which internally creates `aws_eks_cluster`, `aws_eks_node_group`, `aws_iam_role`, `aws_iam_role_policy_attachment`, and `aws_eks_addon` resources) and wires a locally created `aws_iam_role` for the EBS CSI driver into the addon's `service_account_role_arn`. An `aws_vpc` data source resolves the VPC CIDR for security group rules, which are conditionally added to the cluster security group for NLB health checks and HTTPS ingress. KMS key creation is derived from `encryption_config.provider_key_arn`: when a CMK ARN is supplied the module sets `create_kms_key = false` and passes the ARN through; otherwise the upstream module auto-generates an `aws_kms_key`. When `use_auto_mode = true`, `eks_managed_node_groups` is set to empty and `compute_config` enables EKS Auto Mode with the specified node pools.",
   "features": [
-    "Creates EKS cluster with configurable Kubernetes version and dual endpoint access control",
-    "Provisions EKS managed node group with configurable AMI type, instance type, and scaling parameters",
-    "Enables EKS Auto Mode with configurable node pools (general-purpose and/or system) as an alternative to managed node groups",
-    "Installs core EKS add-ons: aws-ebs-csi-driver, coredns, eks-pod-identity-agent, kube-proxy, and vpc-cni",
-    "Creates IAM role for the EBS CSI driver and wires it to the add-on via IRSA with OIDC provider",
-    "Configures optional CloudWatch log group for EKS control plane logs with configurable retention",
-    "Adds conditional security group rules for NLB health checks (port 15021) and HTTPS (port 443) ingress from VPC and peered CIDRs"
+    "Creates EKS cluster with configurable Kubernetes version and private subnet placement",
+    "Installs five core addons (aws-ebs-csi-driver, coredns, eks-pod-identity-agent, kube-proxy, vpc-cni) with optional version pinning to prevent plan drift",
+    "Supports EKS Auto Mode with configurable node pools (general-purpose, system) as an alternative to managed node groups",
+    "Configures IRSA via OIDC provider and creates a dedicated IAM role for the EBS CSI driver",
+    "Manages KMS encryption for etcd secrets, supporting both auto-generated keys and bring-your-own CMK",
+    "Adds optional security group rules for NLB health checks and HTTPS traffic using VPC and additional CIDRs",
+    "Supports configurable API server endpoint access with public CIDR allowlisting and multiple authentication modes"
   ],
   "inputs": [
     {
@@ -159,6 +160,11 @@ resource "example_resource" "this" {
       "description": "Authentication mode for the EKS cluster. Valid values: CONFIG_MAP, API, API_AND_CONFIG_MAP.",
       "required": false
     },
+    {
+      "name": "addon_versions",
+      "description": "Pinned EKS addon versions, keyed by addon name (aws-ebs-csi-driver, coredns, eks-pod-identity-agent, kube-proxy, vpc-cni). An addon left out keeps resolving to the most recent version, which surfaces as plan drift whenever AWS publishes a new build.",
+      "required": false
+    },
     {
       "name": "ami_type",
       "description": "AMI type to use with the node",
@@ -251,7 +257,12 @@ resource "example_resource" "this" {
     },
     {
       "name": "encryption_config",
-      "description": "Encryption config for the EKS control plane (KMS encryption of etcd secrets). Default {} preserves the wrapper's pre-existing behavior: the upstream module auto-creates a KMS key. Set provider_key_arn to bring your own CMK — the wrapper then auto-disables upstream's create_kms_key so the supplied ARN is honored.",
+      "description": "",
+      "required": false
+    },
+    {
+      "name": "aws_profile",
+      "description": "Optional AWS CLI profile used by the kubernetes provider's exec plugin (`aws eks get-token`) to authenticate against the cluster. If empty, the default AWS credential chain (or the AWS_PROFILE environment variable) is used.",
       "required": false
     }
   ],
@@ -265,6 +276,6 @@ resource "example_resource" "this" {
     "eks_cluster_security_group_id",
     "eks_cluster_primary_security_group_id"
   ],
-  "hash": "a20671d0031dc3797531a0a3d823521e"
+  "hash": "3f5872e359ef0f6e03b46a812bac03db"
 }
 END_AI_METADATA -->

infrastructure/aws/iam/agent/README.md

@@ -21,7 +21,7 @@ The module uses the terraform-aws-modules/iam//modules/iam-role-for-service-acco
 
 ```hcl
 module "agent" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/agent?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/agent?ref=v7.8.0"
 
   agent_namespace                     = "your-agent-namespace"
   aws_iam_openid_connect_provider_arn = "your-aws-iam-openid-connect-provider-arn"

infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md

@@ -19,7 +19,7 @@ This module creates an IAM role for the AWS Load Balancer Controller using the t
 
 ```hcl
 module "aws_load_balancer_controller_iam" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/aws_load_balancer_controller_iam?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/aws_load_balancer_controller_iam?ref=v7.8.0"
 
   aws_iam_openid_connect_provider_arn = "your-aws-iam-openid-connect-provider-arn"
   cluster_name                        = "your-cluster-name"

infrastructure/aws/iam/cert_manager/README.md

@@ -20,7 +20,7 @@ An aws_iam_policy resource is always created granting route53:GetChange, route53
 
 ```hcl
 module "cert_manager" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cert_manager?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cert_manager?ref=v7.8.0"
 
   cluster_name = "your-cluster-name"
 }

infrastructure/aws/iam/ci-build-workflow-user/README.md

@@ -21,7 +21,7 @@ The module creates an aws_iam_user named with the cluster_name prefix and genera
 
 ```hcl
 module "ci-build-workflow-user" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ci-build-workflow-user?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ci-build-workflow-user?ref=v7.8.0"
 
   cluster_name = "your-cluster-name"
 }

infrastructure/aws/iam/cloudwatch/README.md

@@ -20,7 +20,7 @@ The module creates an aws_iam_policy granting CloudWatch Logs and Metrics write
 
 ```hcl
 module "cloudwatch" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cloudwatch?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cloudwatch?ref=v7.8.0"
 
   cluster_name = "your-cluster-name"
 }

infrastructure/aws/iam/ecr/README.md

@@ -20,7 +20,7 @@ The module creates an aws_iam_role named nullplatform-{cluster_name}-application
 
 ```hcl
 module "ecr" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ecr?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ecr?ref=v7.8.0"
 
   build_workflow_group_name = "your-build-workflow-group-name"
   cluster_name              = "your-cluster-name"

infrastructure/aws/iam/external_dns/README.md

@@ -20,7 +20,7 @@ An aws_iam_policy resource named nullplatform_external_dns_policy is always crea
 
 ```hcl
 module "external_dns" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/external_dns?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/external_dns?ref=v7.8.0"
 
   cluster_name = "your-cluster-name"
 }

infrastructure/aws/iam/s3/README.md

@@ -18,7 +18,7 @@ The module creates an aws_iam_policy resource that allows s3:PutObject and s3:Ge
 
 ```hcl
 module "s3" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/s3?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/s3?ref=v7.8.0"
 
   bucket                    = "your-bucket"
   build_workflow_group_name = "your-build-workflow-group-name"

infrastructure/aws/ingress/README.md

@@ -22,7 +22,7 @@ The module creates up to two kubernetes_ingress_v1 resources — one for an inte
 
 ```hcl
 module "ingress" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/ingress?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/ingress?ref=v7.8.0"
 
   certificate_arn = "your-certificate-arn"
 }

infrastructure/aws/security/README.md

@@ -22,7 +22,7 @@ The module uses data sources (aws_eks_cluster, aws_vpc) to automatically derive
 
 ```hcl
 module "security" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/security?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/security?ref=v7.8.0"
 
   cluster_name = "your-cluster-name"
 }