{"id":29943307,"url":"https://github.com/sourcefuse/terraform-aws-arc-eks","last_synced_at":"2026-03-10T13:10:13.068Z","repository":{"id":182580086,"uuid":"409595615","full_name":"sourcefuse/terraform-aws-arc-eks","owner":"sourcefuse","description":"Repo for managing the EKS Terraform Module.","archived":false,"fork":false,"pushed_at":"2025-09-13T14:15:32.000Z","size":4828,"stargazers_count":3,"open_issues_count":28,"forks_count":0,"subscribers_count":4,"default_branch":"main","last_synced_at":"2026-03-02T08:41:42.630Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/sourcefuse.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2021-09-23T13:06:09.000Z","updated_at":"2025-09-13T14:15:20.000Z","dependencies_parsed_at":"2024-04-13T00:33:25.676Z","dependency_job_id":"0eb514b3-2969-490a-8c0f-154d4909a17c","html_url":"https://github.com/sourcefuse/terraform-aws-arc-eks","commit_stats":null,"previous_names":["sourcefuse/terraform-aws-ref-arch-eks","sourcefuse/terraform-aws-arc-eks"],"tags_count":40,"template":false,"template_full_name":null,"purl":"pkg:github/sourcefuse/terraform-aws-arc-eks","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sourcefuse%2Fterraform-aws-arc-eks","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sourcefuse%2Fterraform-aws-arc-eks/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sourcefuse%2Fterraform-aws-arc-eks/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sourcefuse%2Fterraform-aws-arc-eks/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sourcefuse","download_url":"https://codeload.github.com/sourcefuse/terraform-aws-arc-eks/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sourcefuse%2Fterraform-aws-arc-eks/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":30334413,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-03-10T12:41:07.687Z","status":"ssl_error","status_checked_at":"2026-03-10T12:41:06.728Z","response_time":106,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-08-03T02:14:57.402Z","updated_at":"2026-03-10T13:10:13.062Z","avatar_url":"https://github.com/sourcefuse.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"![Module Structure](./static/banner.png)\n\n# [terraform-aws-arc-eks](https://github.com/sourcefuse/terraform-aws-arc-eks)\n\u003c!-- ALL-CONTRIBUTORS-BADGE:START - Do not remove or modify this section --\u003e\n[![All Contributors](https://img.shields.io/badge/all_contributors-4-orange.svg?style=flat-square)](#contributors-)\n\u003c!-- ALL-CONTRIBUTORS-BADGE:END --\u003e\n\n\u003ca href=\"https://github.com/sourcefuse/terraform-aws-arc-eks/releases/latest\"\u003e\u003cimg src=\"https://img.shields.io/github/release/sourcefuse/terraform-aws-arc-eks.svg?style=for-the-badge\" alt=\"Latest Release\"/\u003e\u003c/a\u003e \u003ca href=\"https://github.com/sourcefuse/terraform-aws-arc-eks/commits\"\u003e\u003cimg src=\"https://img.shields.io/github/last-commit/sourcefuse/terraform-aws-arc-eks.svg?style=for-the-badge\" alt=\"Last Updated\"/\u003e\u003c/a\u003e ![Terraform](https://img.shields.io/badge/terraform-%235835CC.svg?style=for-the-badge\u0026logo=terraform\u0026logoColor=white) ![GitHub Actions](https://img.shields.io/badge/github%20actions-%232671E5.svg?style=for-the-badge\u0026logo=githubactions\u0026logoColor=white)\n\n[![Quality gate](https://sonarcloud.io/api/project_badges/quality_gate?project=sourcefuse_terraform-aws-arc-eks)](https://sonarcloud.io/summary/new_code?id=sourcefuse_terraform-aws-arc-eks)\n\n[![Known Vulnerabilities](https://github.com/sourcefuse/terraform-aws-ref-arch-eks/actions/workflows/snyk.yaml/badge.svg)](https://github.com/sourcefuse/terraform-aws-ref-arch-eks/actions/workflows/snyk.yaml)\n\n## Overview\n\nSourceFuse AWS Reference Architecture (ARC) Terraform module provisions a EKS (Elastic Kubernetes Service) cluster with support for multiple operational modes and integrations:\n\n- **EKS Cluster Creation**: Automates the setup of the EKS control plane and associated IAM roles, VPC configurations, and security groups.\n\n- **EKS Auto Mode Support**: Enables simplified node management with AWS-managed node groups and automatic provisioning.\n\n- **Karpenter Installation**: Optionally installs and configures Karpenter, a flexible autoscaler that dynamically launches compute based on pod requirements.\n\n- **Fargate Support**: Allows deployment of serverless workloads on AWS Fargate by creating the required Fargate profiles and IAM roles.\n\n- **EKS Capabilities**: Supports the latest EKS capabilities including ArgoCD for GitOps, ACK (AWS Controllers for Kubernetes) for managing AWS services directly from Kubernetes, and KRO (Kubernetes Resource Operator) for simplified resource management.\n\nThis module helps streamline EKS provisioning while offering flexibility in compute optionsβ€”ideal for both production and cost-optimized environments.\n\nFor more information about this repository and its usage, please see [Terraform AWS ARC EKS Module Usage Guide](docs/module-usage-guide/README.md).\n\n![arc_eks_hla](./static/arc_eks_hla.png)\n\n## Usage\nSee `examples` directory for usage examples, including configurations for `auto-mode`, `fargate-profile`, `karpenter`, `nodegroup`, and `eks-capabilities`. Below is the example for a simple EKS cluster creation.\n```hcl\nmodule \"eks_cluster\" {\n source = \"sourcefuse/arc-eks/aws\"\n version = \"5.0.16\"\n namespace = var.namespace\n environment = var.environment\n kubernetes_version = var.kubernetes_version\n name = \"${var.namespace}-${var.environment}-cluster\"\n vpc_config = local.vpc_config\n access_config = local.access_config\n enable_oidc_provider = false\n envelope_encryption = local.envelope_encryption\n kubernetes_network_config = local.kubernetes_network_config\n}\n```\n\n\n\n\u003c!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK --\u003e\n## Requirements\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"requirement_terraform\"\u003e\u003c/a\u003e [terraform](#requirement\\_terraform) | \u003e= 1.6.0 |\n| \u003ca name=\"requirement_aws\"\u003e\u003c/a\u003e [aws](#requirement\\_aws) | \u003e= 6.0.0 |\n| \u003ca name=\"requirement_helm\"\u003e\u003c/a\u003e [helm](#requirement\\_helm) | 2.12.1 |\n| \u003ca name=\"requirement_kubernetes\"\u003e\u003c/a\u003e [kubernetes](#requirement\\_kubernetes) | = 2.24.0 |\n| \u003ca name=\"requirement_null\"\u003e\u003c/a\u003e [null](#requirement\\_null) | \u003e= 2.0 |\n| \u003ca name=\"requirement_tls\"\u003e\u003c/a\u003e [tls](#requirement\\_tls) | \u003e= 3.1.0, != 4.0.0 |\n\n## Providers\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"provider_aws\"\u003e\u003c/a\u003e [aws](#provider\\_aws) | 6.35.1 |\n| \u003ca name=\"provider_helm\"\u003e\u003c/a\u003e [helm](#provider\\_helm) | 2.12.1 |\n| \u003ca name=\"provider_kubernetes\"\u003e\u003c/a\u003e [kubernetes](#provider\\_kubernetes) | 2.24.0 |\n| \u003ca name=\"provider_tls\"\u003e\u003c/a\u003e [tls](#provider\\_tls) | 4.2.1 |\n\n## Modules\n\n| Name | Source | Version |\n|------|--------|---------|\n| \u003ca name=\"module_kms\"\u003e\u003c/a\u003e [kms](#module\\_kms) | sourcefuse/arc-kms/aws | 1.0.11 |\n\n## Resources\n\n| Name | Type |\n|------|------|\n| [aws_eks_access_entry.auto_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_access_entry) | resource |\n| [aws_eks_access_entry.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_access_entry) | resource |\n| [aws_eks_access_policy_association.auto_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_access_policy_association) | resource |\n| [aws_eks_access_policy_association.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_access_policy_association) | resource |\n| [aws_eks_addon.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_addon) | resource |\n| [aws_eks_capability.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_capability) | resource |\n| [aws_eks_cluster.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_cluster) | resource |\n| [aws_eks_fargate_profile.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_fargate_profile) | resource |\n| [aws_eks_node_group.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_node_group) | resource |\n| [aws_iam_instance_profile.karpenter_instance_profile](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_instance_profile) | resource |\n| [aws_iam_openid_connect_provider.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_openid_connect_provider) | resource |\n| [aws_iam_policy.iam](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |\n| [aws_iam_policy.kms](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |\n| [aws_iam_role.auto](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |\n| [aws_iam_role.eks_fargate_profile](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |\n| [aws_iam_role.eks_node_group](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |\n| [aws_iam_role.karpenter_controller_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |\n| [aws_iam_role.karpenter_node_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |\n| [aws_iam_role.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |\n| [aws_iam_role_policy.ec2_fleet](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |\n| [aws_iam_role_policy.karpenter_controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |\n| [aws_iam_role_policy_attachment.eks_cluster_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |\n| [aws_iam_role_policy_attachment.fargate](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |\n| [aws_iam_role_policy_attachment.iam](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |\n| [aws_iam_role_policy_attachment.karpenter_node_policy_attachment](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |\n| [aws_iam_role_policy_attachment.kms](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |\n| [aws_iam_role_policy_attachment.node_AmazonEC2ContainerRegistryPullOnly](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |\n| [aws_iam_role_policy_attachment.node_polcies](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |\n| [aws_iam_role_policy_attachment.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |\n| [aws_security_group_rule.cluster_ingress_rules](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource |\n| [helm_release.karpenter](https://registry.terraform.io/providers/hashicorp/helm/2.12.1/docs/resources/release) | resource |\n| [kubernetes_config_map.aws_auth](https://registry.terraform.io/providers/hashicorp/kubernetes/2.24.0/docs/resources/config_map) | resource |\n| [kubernetes_config_map_v1_data.aws_auth](https://registry.terraform.io/providers/hashicorp/kubernetes/2.24.0/docs/resources/config_map_v1_data) | resource |\n| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |\n| [aws_iam_policy_document.ec2_fleet](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |\n| [aws_iam_policy_document.iam](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |\n| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |\n| [tls_certificate.this](https://registry.terraform.io/providers/hashicorp/tls/latest/docs/data-sources/certificate) | data source |\n\n## Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| \u003ca name=\"input_access_config\"\u003e\u003c/a\u003e [access\\_config](#input\\_access\\_config) | Access configuration for the cluster.\u003cbr/\u003e- `authentication_mode`: One of \"API\" or \"API\\_AND\\_CONFIG\\_MAP\"\u003cbr/\u003e- `bootstrap_cluster_creator_admin_permissions`: Grant creator admin access\u003cbr/\u003e- `aws_auth_config_map`: (optional) Config for aws-auth ConfigMap\u003cbr/\u003e- `eks_access_entries`: (optional) List of principals and their policy associations | \u003cpre\u003eobject({\u003cbr/\u003e authentication_mode = optional(string, \"API\")\u003cbr/\u003e bootstrap_cluster_creator_admin_permissions = optional(bool, false)\u003cbr/\u003e\u003cbr/\u003e aws_auth_config_map = optional(object({\u003cbr/\u003e create = optional(bool, false)\u003cbr/\u003e manage = optional(bool, false)\u003cbr/\u003e roles = optional(list(any), [])\u003cbr/\u003e users = optional(list(any), [])\u003cbr/\u003e accounts = optional(list(string), [])\u003cbr/\u003e }), {})\u003cbr/\u003e\u003cbr/\u003e eks_access_entries = optional(list(object({\u003cbr/\u003e principal_arn = optional(string)\u003cbr/\u003e policy_arns = optional(list(string))\u003cbr/\u003e access_scope = optional(object({\u003cbr/\u003e type = string\u003cbr/\u003e namespaces = optional(list(string))\u003cbr/\u003e }))\u003cbr/\u003e })), [])\u003cbr/\u003e })\u003c/pre\u003e | \u003cpre\u003e{\u003cbr/\u003e \"authentication_mode\": \"API\",\u003cbr/\u003e \"bootstrap_cluster_creator_admin_permissions\": false\u003cbr/\u003e}\u003c/pre\u003e | no |\n| \u003ca name=\"input_additional_cluster_security_group_rules\"\u003e\u003c/a\u003e [additional\\_cluster\\_security\\_group\\_rules](#input\\_additional\\_cluster\\_security\\_group\\_rules) | List of ingress security group rules to apply to the EKS cluster security group | \u003cpre\u003elist(object({\u003cbr/\u003e from_port = number\u003cbr/\u003e to_port = number\u003cbr/\u003e protocol = string\u003cbr/\u003e cidr_blocks = optional(list(string), [])\u003cbr/\u003e ipv6_cidr_blocks = optional(list(string), [])\u003cbr/\u003e description = optional(string)\u003cbr/\u003e }))\u003c/pre\u003e | `[]` | no |\n| \u003ca name=\"input_additional_node_group_policy_arns\"\u003e\u003c/a\u003e [additional\\_node\\_group\\_policy\\_arns](#input\\_additional\\_node\\_group\\_policy\\_arns) | Optional additional policies to attach to node group role | `list(string)` | `[]` | no |\n| \u003ca name=\"input_auto_mode_config\"\u003e\u003c/a\u003e [auto\\_mode\\_config](#input\\_auto\\_mode\\_config) | (optional) EKS automates routine cluster tasks for compute, storage, and networking.\u003cbr/\u003eWhen a new pod can't fit onto existing nodes, EKS creates a new node.\u003cbr/\u003eEKS combines cluster infrastructure managed by AWS with integrated Kubernetes capabilities to meet application compute needs. | \u003cpre\u003eobject({\u003cbr/\u003e enable = optional(bool, false)\u003cbr/\u003e node_pools = optional(list(string), [\"general-purpose\", \"system\"])\u003cbr/\u003e node_role_arn = optional(string, null)\u003cbr/\u003e })\u003c/pre\u003e | \u003cpre\u003e{\u003cbr/\u003e \"enable\": false\u003cbr/\u003e}\u003c/pre\u003e | no |\n| \u003ca name=\"input_bootstrap_self_managed_addons_enabled\"\u003e\u003c/a\u003e [bootstrap\\_self\\_managed\\_addons\\_enabled](#input\\_bootstrap\\_self\\_managed\\_addons\\_enabled) | (optional) Install default unmanaged add-ons, such as aws-cni, kube-proxy, and CoreDNS during cluster creation. If false, you must manually install desired add-ons. Changing this value will force a new cluster to be created. | `bool` | `true` | no |\n| \u003ca name=\"input_eks_additional_policy_arns\"\u003e\u003c/a\u003e [eks\\_additional\\_policy\\_arns](#input\\_eks\\_additional\\_policy\\_arns) | Optional additional policy ARNs that user wants to attach | `list(string)` | `[]` | no |\n| \u003ca name=\"input_eks_addons\"\u003e\u003c/a\u003e [eks\\_addons](#input\\_eks\\_addons) | Map of EKS Add-ons to create | \u003cpre\u003emap(object({\u003cbr/\u003e addon_version = optional(string)\u003cbr/\u003e service_account_role_arn = optional(string)\u003cbr/\u003e resolve_conflicts_on_update = optional(string)\u003cbr/\u003e resolve_conflicts_on_create = optional(string)\u003cbr/\u003e }))\u003c/pre\u003e | `{}` | no |\n| \u003ca name=\"input_eks_capabilities_config\"\u003e\u003c/a\u003e [eks\\_capabilities\\_config](#input\\_eks\\_capabilities\\_config) | Configuration for EKS Capabilities (ArgoCD, ACK, KRO).\u003cbr/\u003eThis enables the latest EKS capabilities features for enhanced cluster functionality.\u003cbr/\u003e\u003cbr/\u003e- enable: Whether to enable EKS capabilities\u003cbr/\u003e- capabilities: List of capability configurations\u003cbr/\u003e\u003cbr/\u003eEach capability object may include:\u003cbr/\u003e - name: Unique identifier for the capability\u003cbr/\u003e - capability\\_name: The AWS EKS capability name (e.g., \"ArgoCD\", \"ACK-EC2\", \"KRO\")\u003cbr/\u003e - type: Capability type (ARGOCD, ACK, KRO)\u003cbr/\u003e - role\\_arn: (Required) IAM role ARN for the capability\u003cbr/\u003e - delete\\_propagation\\_policy: (Optional) Delete propagation policy (default: \"RETAIN\")\u003cbr/\u003e - argocd\\_config: (Optional) Configuration for ArgoCD capability\u003cbr/\u003e\u003cbr/\u003eNote: ACK and KRO capabilities don't require additional configuration beyond role\\_arn. | \u003cpre\u003eobject({\u003cbr/\u003e enable = bool\u003cbr/\u003e capabilities = list(object({\u003cbr/\u003e name = string\u003cbr/\u003e capability_name = string\u003cbr/\u003e type = string\u003cbr/\u003e role_arn = string\u003cbr/\u003e delete_propagation_policy = optional(string, \"RETAIN\")\u003cbr/\u003e\u003cbr/\u003e # ArgoCD specific configuration\u003cbr/\u003e argocd_config = optional(object({\u003cbr/\u003e namespace = optional(string, \"argocd\")\u003cbr/\u003e\u003cbr/\u003e # AWS IAM Identity Center configuration (required by provider)\u003cbr/\u003e aws_idc = object({\u003cbr/\u003e idc_instance_arn = string\u003cbr/\u003e idc_region = optional(string)\u003cbr/\u003e })\u003cbr/\u003e\u003cbr/\u003e # Network access configuration\u003cbr/\u003e network_access = optional(object({\u003cbr/\u003e vpce_ids = optional(list(string))\u003cbr/\u003e }), null)\u003cbr/\u003e\u003cbr/\u003e # RBAC role mappings\u003cbr/\u003e rbac_role_mapping = optional(list(object({\u003cbr/\u003e role = string # Valid values: ADMIN, EDITOR, VIEWER\u003cbr/\u003e identity = list(object({\u003cbr/\u003e id = string\u003cbr/\u003e type = string # Valid values: SSO_USER, SSO_GROUP\u003cbr/\u003e }))\u003cbr/\u003e })), [])\u003cbr/\u003e }), null)\u003cbr/\u003e }))\u003cbr/\u003e })\u003c/pre\u003e | \u003cpre\u003e{\u003cbr/\u003e \"capabilities\": [],\u003cbr/\u003e \"enable\": false\u003cbr/\u003e}\u003c/pre\u003e | no |\n| \u003ca name=\"input_eks_policy_arns\"\u003e\u003c/a\u003e [eks\\_policy\\_arns](#input\\_eks\\_policy\\_arns) | List of IAM policy ARNs to attach to the EKS role | `list(string)` | \u003cpre\u003e[\u003cbr/\u003e \"arn:aws:iam::aws:policy/AmazonEKSClusterPolicy\",\u003cbr/\u003e \"arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy\",\u003cbr/\u003e \"arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy\",\u003cbr/\u003e \"arn:aws:iam::aws:policy/AmazonEKSNetworkingPolicy\",\u003cbr/\u003e \"arn:aws:iam::aws:policy/AmazonEKSComputePolicy\",\u003cbr/\u003e \"arn:aws:iam::aws:policy/AmazonEKSBlockStoragePolicy\",\u003cbr/\u003e \"arn:aws:iam::aws:policy/AmazonEKSLoadBalancingPolicy\"\u003cbr/\u003e]\u003c/pre\u003e | no |\n| \u003ca name=\"input_enable_arc_zonal_shift\"\u003e\u003c/a\u003e [enable\\_arc\\_zonal\\_shift](#input\\_enable\\_arc\\_zonal\\_shift) | (optional) Whether to enable ARC Zonal shift , it shift application traffic away from an impaired Availability Zone (AZ) in your EKS cluster. | `bool` | `false` | no |\n| \u003ca name=\"input_enable_oidc_provider\"\u003e\u003c/a\u003e [enable\\_oidc\\_provider](#input\\_enable\\_oidc\\_provider) | Whether to enable OIDC provider | `bool` | `true` | no |\n| \u003ca name=\"input_enabled_cluster_log_types\"\u003e\u003c/a\u003e [enabled\\_cluster\\_log\\_types](#input\\_enabled\\_cluster\\_log\\_types) | A list of the desired control plane logging to enable. Valid values [`api`, `audit`, `authenticator`, `controllerManager`, `scheduler`] | `list(string)` | `[]` | no |\n| \u003ca name=\"input_envelope_encryption\"\u003e\u003c/a\u003e [envelope\\_encryption](#input\\_envelope\\_encryption) | Whether to enable Envelope encryption | \u003cpre\u003eobject({\u003cbr/\u003e enable = optional(bool, true)\u003cbr/\u003e kms_deletion_window_in_days = optional(number, 10)\u003cbr/\u003e resources = optional(list(string), [\"secrets\"])\u003cbr/\u003e key_arn = optional(string, null) // if null it created new KMS key\u003cbr/\u003e })\u003c/pre\u003e | \u003cpre\u003e{\u003cbr/\u003e \"enable\": true,\u003cbr/\u003e \"resources\": [\u003cbr/\u003e \"secrets\"\u003cbr/\u003e ]\u003cbr/\u003e}\u003c/pre\u003e | no |\n| \u003ca name=\"input_environment\"\u003e\u003c/a\u003e [environment](#input\\_environment) | ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT' | `string` | n/a | yes |\n| \u003ca name=\"input_fargate_profile_config\"\u003e\u003c/a\u003e [fargate\\_profile\\_config](#input\\_fargate\\_profile\\_config) | Combined configuration for the EKS Fargate profile, including IAM policies. | \u003cpre\u003eobject({\u003cbr/\u003e enable = bool\u003cbr/\u003e fargate_profile_name = optional(string)\u003cbr/\u003e pod_execution_role_arn = optional(string)\u003cbr/\u003e subnet_ids = optional(list(string))\u003cbr/\u003e selectors = optional(list(object({\u003cbr/\u003e namespace = string\u003cbr/\u003e labels = optional(map(string))\u003cbr/\u003e })))\u003cbr/\u003e tags = optional(map(string), {})\u003cbr/\u003e policy_arns = optional(list(string), [\"arn:aws:iam::aws:policy/AmazonEKSFargatePodExecutionRolePolicy\"])\u003cbr/\u003e additional_policy_arns = optional(list(string), [])\u003cbr/\u003e })\u003c/pre\u003e | \u003cpre\u003e{\u003cbr/\u003e \"enable\": false\u003cbr/\u003e}\u003c/pre\u003e | no |\n| \u003ca name=\"input_karpenter_config\"\u003e\u003c/a\u003e [karpenter\\_config](#input\\_karpenter\\_config) | Configuration for Karpenter | \u003cpre\u003eobject({\u003cbr/\u003e enable = bool\u003cbr/\u003e name = optional(string)\u003cbr/\u003e namespace = optional(string, \"karpenter\")\u003cbr/\u003e create_namespace = optional(bool)\u003cbr/\u003e version = optional(string, \"0.36.0\")\u003cbr/\u003e helm_repository = optional(string, \"oci://public.ecr.aws/karpenter\")\u003cbr/\u003e chart = optional(string)\u003cbr/\u003e additional_karpenter_node_role_policies = optional(list(string), [])\u003cbr/\u003e helm_release_values = optional(any)\u003cbr/\u003e helm_release_set_values = optional(list(object({\u003cbr/\u003e name = string\u003cbr/\u003e value = string\u003cbr/\u003e })), [])\u003cbr/\u003e })\u003c/pre\u003e | \u003cpre\u003e{\u003cbr/\u003e \"enable\": false\u003cbr/\u003e}\u003c/pre\u003e | no |\n| \u003ca name=\"input_kubernetes_network_config\"\u003e\u003c/a\u003e [kubernetes\\_network\\_config](#input\\_kubernetes\\_network\\_config) | Configuration block for Kubernetes network.\u003cbr/\u003e\u003cbr/\u003e- `service_ipv4_cidr`: Optional custom CIDR block for Kubernetes service IPs. Must be within 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16 and have a netmask between /12 and /24.\u003cbr/\u003e- `ip_family`: The IP family to assign (ipv4 or ipv6). Default is ipv4. | \u003cpre\u003eobject({\u003cbr/\u003e ipv4_cidr = optional(string, null)\u003cbr/\u003e ip_family = optional(string, \"ipv4\")\u003cbr/\u003e })\u003c/pre\u003e | \u003cpre\u003e{\u003cbr/\u003e \"ip_family\": \"ipv4\"\u003cbr/\u003e}\u003c/pre\u003e | no |\n| \u003ca name=\"input_kubernetes_version\"\u003e\u003c/a\u003e [kubernetes\\_version](#input\\_kubernetes\\_version) | Desired Kubernetes master version | `string` | n/a | yes |\n| \u003ca name=\"input_name\"\u003e\u003c/a\u003e [name](#input\\_name) | EKS Cluster name | `string` | n/a | yes |\n| \u003ca name=\"input_namespace\"\u003e\u003c/a\u003e [namespace](#input\\_namespace) | Namespace your resource belongs to.\u003cbr/\u003eUsually an abbreviation of your organization name, e.g. 'example' or 'arc', to help ensure generated IDs are globally unique\" | `string` | n/a | yes |\n| \u003ca name=\"input_node_group_config\"\u003e\u003c/a\u003e [node\\_group\\_config](#input\\_node\\_group\\_config) | Configuration for EKS managed node groups.\u003cbr/\u003e\u003cbr/\u003e- enable: Controls whether EKS node groups should be created.\u003cbr/\u003e- config: A map of node group configurations, where each key is an identifier for a node group.\u003cbr/\u003e Each node group object may include:\u003cbr/\u003e\u003cbr/\u003e - node\\_group\\_name: (Optional) Custom name for the node group. If not specified, a default will be used.\u003cbr/\u003e - node\\_role\\_arn: (Optional) ARN of the IAM role for the node group.\u003cbr/\u003e - release\\_version: (Optional) AMI version for the node group.\u003cbr/\u003e - scaling\\_config: Required settings for desired, minimum, and maximum node counts.\u003cbr/\u003e - taints: (Optional) List of taints applied to nodes, each with a key, value (optional), and effect.\u003cbr/\u003e - update\\_config: (Optional) Configuration for rolling updates, such as max unavailable nodes.\u003cbr/\u003e - remote\\_access: (Optional) SSH access configuration, including key name and allowed source security group IDs.\u003cbr/\u003e - launch\\_template: (Optional) Launch template settings, including ID, name, and version.\u003cbr/\u003e - node\\_repair\\_config: (Optional) Node auto-repair configuration (e.g., self-healing).\u003cbr/\u003e - instance\\_types: (Optional) List of EC2 instance types to use (default is [\"t3.medium\"]).\u003cbr/\u003e - ami\\_type: (Optional) AMI type (e.g., \"AL2\\_x86\\_64\", \"BOTTLEROCKET\\_x86\\_64\").\u003cbr/\u003e - disk\\_size: (Optional) Size in GiB of the root EBS volume.\u003cbr/\u003e - capacity\\_type: (Optional) Capacity type (\"ON\\_DEMAND\" or \"SPOT\"), defaults to \"ON\\_DEMAND\".\u003cbr/\u003e - labels: (Optional) Key-value map of Kubernetes labels to apply to the nodes.\u003cbr/\u003e - ignore\\_desired\\_size: (Optional) If true, the desired size will be ignored during updates (default: false).\u003cbr/\u003e - subnet\\_ids: Required list of subnet IDs where the node group will be deployed.\u003cbr/\u003e - kubernetes\\_version: (Optional) Kubernetes version to use for the node group. | \u003cpre\u003eobject({\u003cbr/\u003e enable = bool\u003cbr/\u003e config = map(object({\u003cbr/\u003e node_group_name = optional(string)\u003cbr/\u003e node_role_arn = optional(string)\u003cbr/\u003e release_version = optional(string)\u003cbr/\u003e scaling_config = object({\u003cbr/\u003e desired_size = number\u003cbr/\u003e max_size = number\u003cbr/\u003e min_size = number\u003cbr/\u003e })\u003cbr/\u003e taints = optional(list(object({\u003cbr/\u003e key = string\u003cbr/\u003e value = optional(string)\u003cbr/\u003e effect = string\u003cbr/\u003e })), [])\u003cbr/\u003e update_config = optional(object({\u003cbr/\u003e max_unavailable = optional(number)\u003cbr/\u003e max_unavailable_percentage = optional(number)\u003cbr/\u003e }))\u003cbr/\u003e remote_access = optional(object({\u003cbr/\u003e ec2_ssh_key = string\u003cbr/\u003e source_security_group_ids = list(string)\u003cbr/\u003e }))\u003cbr/\u003e launch_template = optional(object({\u003cbr/\u003e id = optional(string)\u003cbr/\u003e name = optional(string)\u003cbr/\u003e version = string\u003cbr/\u003e }))\u003cbr/\u003e node_repair_config = optional(object({\u003cbr/\u003e enabled = bool\u003cbr/\u003e }))\u003cbr/\u003e instance_types = optional(list(string), [\"t3.medium\"])\u003cbr/\u003e ami_type = optional(string)\u003cbr/\u003e disk_size = optional(number)\u003cbr/\u003e capacity_type = optional(string, \"ON_DEMAND\")\u003cbr/\u003e labels = optional(map(string), {})\u003cbr/\u003e ignore_desired_size = optional(bool, false)\u003cbr/\u003e subnet_ids = list(string)\u003cbr/\u003e kubernetes_version = optional(string)\u003cbr/\u003e }))\u003cbr/\u003e })\u003c/pre\u003e | \u003cpre\u003e{\u003cbr/\u003e \"config\": {},\u003cbr/\u003e \"enable\": false\u003cbr/\u003e}\u003c/pre\u003e | no |\n| \u003ca name=\"input_node_group_policy_arns\"\u003e\u003c/a\u003e [node\\_group\\_policy\\_arns](#input\\_node\\_group\\_policy\\_arns) | Default policies for EKS node group | `list(string)` | \u003cpre\u003e[\u003cbr/\u003e \"arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy\",\u003cbr/\u003e \"arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy\",\u003cbr/\u003e \"arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly\"\u003cbr/\u003e]\u003c/pre\u003e | no |\n| \u003ca name=\"input_tags\"\u003e\u003c/a\u003e [tags](#input\\_tags) | Tags for EKS resources | `map(string)` | `{}` | no |\n| \u003ca name=\"input_upgrade_policy\"\u003e\u003c/a\u003e [upgrade\\_policy](#input\\_upgrade\\_policy) | (optional) Support type to use for the cluster. If the cluster is set to EXTENDED, it will enter extended support at the end of standard support.\u003cbr/\u003e If the cluster is set to STANDARD, it will be automatically upgraded at the end of standard support.\u003cbr/\u003e Valid values are EXTENDED, STANDARD\"\u003cbr/\u003e\u003cbr/\u003e STANDARD - This option supports the Kubernetes version for 14 months after the release date. There is no additional cost. When standard support ends, your cluster will be auto upgraded to the next version.\u003cbr/\u003e EXTENDED - This option supports the Kubernetes version for 26 months after the release date. The extended support period has an additional hourly cost that begins after the standard support period ends. When extended support ends, your cluster will be auto upgraded to the next version. | `string` | `\"STANDARD\"` | no |\n| \u003ca name=\"input_vpc_config\"\u003e\u003c/a\u003e [vpc\\_config](#input\\_vpc\\_config) | Configuration block for VPC settings:\u003cbr/\u003e - security\\_group\\_ids: List of security group IDs associated with the VPC.\u003cbr/\u003e - subnet\\_ids: List of subnet IDs where resources will be deployed.\u003cbr/\u003e - endpoint\\_private\\_access: Enable or disable private access to the cluster endpoint.\u003cbr/\u003e - endpoint\\_public\\_access: Enable or disable public access to the cluster endpoint.\u003cbr/\u003e - public\\_access\\_cidrs: CIDR blocks that can access the public endpoint (if enabled). | \u003cpre\u003eobject({\u003cbr/\u003e security_group_ids = optional(list(string), [])\u003cbr/\u003e subnet_ids = list(string)\u003cbr/\u003e endpoint_private_access = optional(bool, false)\u003cbr/\u003e endpoint_public_access = optional(bool, true)\u003cbr/\u003e public_access_cidrs = optional(list(string), [\"0.0.0.0/0\"])\u003cbr/\u003e })\u003c/pre\u003e | n/a | yes |\n\n## Outputs\n\n| Name | Description |\n|------|-------------|\n| \u003ca name=\"output_arn\"\u003e\u003c/a\u003e [arn](#output\\_arn) | The Amazon Resource Name (ARN) of the EKS cluster |\n| \u003ca name=\"output_auto_mode_node_role_arn\"\u003e\u003c/a\u003e [auto\\_mode\\_node\\_role\\_arn](#output\\_auto\\_mode\\_node\\_role\\_arn) | ARN of Auto mode node role |\n| \u003ca name=\"output_certificate_authority_data\"\u003e\u003c/a\u003e [certificate\\_authority\\_data](#output\\_certificate\\_authority\\_data) | The base64-encoded certificate data required to communicate with the EKS cluster |\n| \u003ca name=\"output_eks_capabilities\"\u003e\u003c/a\u003e [eks\\_capabilities](#output\\_eks\\_capabilities) | EKS capabilities information |\n| \u003ca name=\"output_eks_cluster_id\"\u003e\u003c/a\u003e [eks\\_cluster\\_id](#output\\_eks\\_cluster\\_id) | The unique identifier of the EKS cluster |\n| \u003ca name=\"output_eks_cluster_security_group_id\"\u003e\u003c/a\u003e [eks\\_cluster\\_security\\_group\\_id](#output\\_eks\\_cluster\\_security\\_group\\_id) | The ID of the security group associated with the EKS cluster's control plane |\n| \u003ca name=\"output_endpoint\"\u003e\u003c/a\u003e [endpoint](#output\\_endpoint) | The endpoint for the EKS cluster API server |\n| \u003ca name=\"output_name\"\u003e\u003c/a\u003e [name](#output\\_name) | The name of the EKS cluster |\n| \u003ca name=\"output_oidc_provider_url\"\u003e\u003c/a\u003e [oidc\\_provider\\_url](#output\\_oidc\\_provider\\_url) | The OIDC identity provider URL for the EKS cluster (without the https:// prefix) |\n\u003c!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK --\u003e\n\n## Kubernetes dashboard\nTo view the dashboard, run the following commands:\n\n```shell\naws eks update-kubeconfig --name refarch-dev-primary-k8s-cluster --region us-east-1\nkubectl -n kube-system describe secret $(kubectl -n kube-system get secret | grep eks-dashboard-viewer | awk '{print $1}') #Copy the token from the output\nkubectl proxy\n```\n\nThen navigate to:\n\n```text\nhttp://localhost:8001/api/v1/namespaces/kubernetes-dashboard/services/https:kubernetes-dashboard:/proxy/#/login\n```\n\nand use the copied token to login\n## Development\n\n### Prerequisites\n\n- [terraform](https://learn.hashicorp.com/terraform/getting-started/install#installing-terraform)\n- [terraform-docs](https://github.com/segmentio/terraform-docs)\n- [pre-commit](https://pre-commit.com/#install)\n- [golang](https://golang.org/doc/install#install)\n- [golint](https://github.com/golang/lint#installation)\n\n### Configurations\n\n- Configure pre-commit hooks\n```sh\npre-commit install\n```\n\n- Configure golang deps for tests\n```sh\n\u003e go get github.com/gruntwork-io/terratest/modules/terraform\n\u003e go get github.com/stretchr/testify/assert\n```\n### Git commits\n\nwhile Contributing or doing git commit please specify the breaking change in your commit message whether its major,minor or patch\n\nFor Example\n\n```sh\ngit commit -m \"your commit message #major\"\n```\nBy specifying this , it will bump the version and if you dont specify this in your commit message then by default it will consider patch and will bump that accordingly\n\n### Tests\n\n- Tests are available in `test` directory\n\n- In the test directory, run the below command\n```sh\ngo test\n```\n\n## Authors\n\nThis project is authored by below people\n\n- SourceFuse ARC Team\n\n## Contributors ✨\n\nThanks goes to these wonderful people ([emoji key](https://allcontributors.org/docs/en/emoji-key)):\n\n\u003c!-- ALL-CONTRIBUTORS-LIST:START - Do not remove or modify this section --\u003e\n\u003c!-- prettier-ignore-start --\u003e\n\u003c!-- markdownlint-disable --\u003e\n\u003ctable\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd align=\"center\" valign=\"top\" width=\"14.28%\"\u003e\u003ca href=\"https://github.com/vijay-stephen\"\u003e\u003cimg src=\"https://avatars.githubusercontent.com/u/91307015?v=4?s=100\" width=\"100px;\" alt=\"vijay-stephen\"/\u003e\u003cbr /\u003e\u003csub\u003e\u003cb\u003evijay-stephen\u003c/b\u003e\u003c/sub\u003e\u003c/a\u003e\u003cbr /\u003e\u003ca href=\"https://github.com/sourcefuse/terraform-aws-arc-eks/commits?author=vijay-stephen\" title=\"Code\"\u003eπŸ’»\u003c/a\u003e \u003ca href=\"#infra-vijay-stephen\" title=\"Infrastructure (Hosting, Build-Tools, etc)\"\u003eπŸš‡\u003c/a\u003e \u003ca href=\"https://github.com/sourcefuse/terraform-aws-arc-eks/commits?author=vijay-stephen\" title=\"Documentation\"\u003eπŸ“–\u003c/a\u003e \u003ca href=\"#maintenance-vijay-stephen\" title=\"Maintenance\"\u003e🚧\u003c/a\u003e \u003ca href=\"#mentoring-vijay-stephen\" title=\"Mentoring\"\u003eπŸ§‘β€πŸ«\u003c/a\u003e\u003c/td\u003e\n \u003ctd align=\"center\" valign=\"top\" width=\"14.28%\"\u003e\u003ca href=\"https://www.sourcefuse.com/\"\u003e\u003cimg src=\"https://avatars.githubusercontent.com/u/73998079?v=4?s=100\" width=\"100px;\" alt=\"Shubham Sinha\"/\u003e\u003cbr /\u003e\u003csub\u003e\u003cb\u003eShubham Sinha\u003c/b\u003e\u003c/sub\u003e\u003c/a\u003e\u003cbr /\u003e\u003ca href=\"https://github.com/sourcefuse/terraform-aws-arc-eks/commits?author=shubhamsinha-sf\" title=\"Code\"\u003eπŸ’»\u003c/a\u003e \u003ca href=\"#infra-shubhamsinha-sf\" title=\"Infrastructure (Hosting, Build-Tools, etc)\"\u003eπŸš‡\u003c/a\u003e \u003ca href=\"https://github.com/sourcefuse/terraform-aws-arc-eks/commits?author=shubhamsinha-sf\" title=\"Documentation\"\u003eπŸ“–\u003c/a\u003e \u003ca href=\"#maintenance-shubhamsinha-sf\" title=\"Maintenance\"\u003e🚧\u003c/a\u003e \u003ca href=\"#mentoring-shubhamsinha-sf\" title=\"Mentoring\"\u003eπŸ§‘β€πŸ«\u003c/a\u003e\u003c/td\u003e\n \u003ctd align=\"center\" valign=\"top\" width=\"14.28%\"\u003e\u003ca href=\"https://sourcefuse.com\"\u003e\u003cimg src=\"https://avatars.githubusercontent.com/u/89415058?v=4?s=100\" width=\"100px;\" alt=\"Travis Saucier\"/\u003e\u003cbr /\u003e\u003csub\u003e\u003cb\u003eTravis Saucier\u003c/b\u003e\u003c/sub\u003e\u003c/a\u003e\u003cbr /\u003e\u003ca href=\"https://github.com/sourcefuse/terraform-aws-arc-eks/commits?author=tsaucier-sf\" title=\"Code\"\u003eπŸ’»\u003c/a\u003e \u003ca href=\"#infra-tsaucier-sf\" title=\"Infrastructure (Hosting, Build-Tools, etc)\"\u003eπŸš‡\u003c/a\u003e \u003ca href=\"https://github.com/sourcefuse/terraform-aws-arc-eks/commits?author=tsaucier-sf\" title=\"Documentation\"\u003eπŸ“–\u003c/a\u003e \u003ca href=\"#maintenance-tsaucier-sf\" title=\"Maintenance\"\u003e🚧\u003c/a\u003e \u003ca href=\"#mentoring-tsaucier-sf\" title=\"Mentoring\"\u003eπŸ§‘β€πŸ«\u003c/a\u003e\u003c/td\u003e\n \u003ctd align=\"center\" valign=\"top\" width=\"14.28%\"\u003e\u003ca href=\"https://github.com/mayank0202\"\u003e\u003cimg src=\"https://avatars.githubusercontent.com/u/83959396?v=4?s=100\" width=\"100px;\" alt=\"Mayank Sharma\"/\u003e\u003cbr /\u003e\u003csub\u003e\u003cb\u003eMayank Sharma\u003c/b\u003e\u003c/sub\u003e\u003c/a\u003e\u003cbr /\u003e\u003ca href=\"https://github.com/sourcefuse/terraform-aws-arc-eks/commits?author=mayank0202\" title=\"Code\"\u003eπŸ’»\u003c/a\u003e \u003ca href=\"#infra-mayank0202\" title=\"Infrastructure (Hosting, Build-Tools, etc)\"\u003eπŸš‡\u003c/a\u003e \u003ca href=\"https://github.com/sourcefuse/terraform-aws-arc-eks/commits?author=mayank0202\" title=\"Documentation\"\u003eπŸ“–\u003c/a\u003e \u003ca href=\"#maintenance-mayank0202\" title=\"Maintenance\"\u003e🚧\u003c/a\u003e \u003ca href=\"#mentoring-mayank0202\" title=\"Mentoring\"\u003eπŸ§‘β€πŸ«\u003c/a\u003e\u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n\u003c/table\u003e\n\n\u003c!-- markdownlint-restore --\u003e\n\u003c!-- prettier-ignore-end --\u003e\n\n\u003c!-- ALL-CONTRIBUTORS-LIST:END --\u003e\n\nThis project follows the [all-contributors](https://github.com/all-contributors/all-contributors) specification. Contributions of any kind welcome!\n\n\u003c!-- BEGIN_TF_DOCS --\u003e\n\n\u003c!-- END_TF_DOCS --\u003e","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsourcefuse%2Fterraform-aws-arc-eks","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsourcefuse%2Fterraform-aws-arc-eks","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsourcefuse%2Fterraform-aws-arc-eks/lists"}