From 6367771f12bf0c4d7335e9659df1b44be65dd1c2 Mon Sep 17 00:00:00 2001 From: Bharat Kathi Date: Thu, 25 Jun 2026 23:04:54 -0700 Subject: [PATCH 1/5] feat: add vault kubernetes application --- kubernetes/apps/vault.yaml | 23 ++++++ .../manifests/vault/configmap-kerbecs.yaml | 62 ++++++++++++++ kubernetes/manifests/vault/ingress.yaml | 30 +++++++ kubernetes/manifests/vault/kerbecs.yaml | 74 +++++++++++++++++ kubernetes/manifests/vault/kustomization.yaml | 19 +++++ kubernetes/manifests/vault/namespace.yaml | 4 + kubernetes/manifests/vault/postgres.yaml | 8 ++ kubernetes/manifests/vault/server.yaml | 81 +++++++++++++++++++ kubernetes/manifests/vault/web.yaml | 47 +++++++++++ 9 files changed, 348 insertions(+) create mode 100644 kubernetes/apps/vault.yaml create mode 100644 kubernetes/manifests/vault/configmap-kerbecs.yaml create mode 100644 kubernetes/manifests/vault/ingress.yaml create mode 100644 kubernetes/manifests/vault/kerbecs.yaml create mode 100644 kubernetes/manifests/vault/kustomization.yaml create mode 100644 kubernetes/manifests/vault/namespace.yaml create mode 100644 kubernetes/manifests/vault/postgres.yaml create mode 100644 kubernetes/manifests/vault/server.yaml create mode 100644 kubernetes/manifests/vault/web.yaml diff --git a/kubernetes/apps/vault.yaml b/kubernetes/apps/vault.yaml new file mode 100644 index 0000000..954d098 --- /dev/null +++ b/kubernetes/apps/vault.yaml @@ -0,0 +1,23 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: vault + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: default + source: + repoURL: https://github.com/Gaucho-Racing/infrastructure.git + targetRevision: main + path: kubernetes/manifests/vault + destination: + server: https://kubernetes.default.svc + namespace: vault + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - ServerSideApply=true diff --git a/kubernetes/manifests/vault/configmap-kerbecs.yaml b/kubernetes/manifests/vault/configmap-kerbecs.yaml new file mode 100644 index 0000000..a6f2d11 --- /dev/null +++ b/kubernetes/manifests/vault/configmap-kerbecs.yaml @@ -0,0 +1,62 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: kerbecs-config + namespace: vault +data: + kerbecs.yaml: | + gateway: + name: vault-gateway + version: 1.0.0 + env: ${ENV:PROD} + timeouts: + dial: 5s + headers: 30s + idle: 50s + overall: 0 + + listeners: + gateway: + port: "10310" + cors: + enabled: true + allowed_origins: ["*"] + allow_credentials: false + admin: + port: "10300" + auth: + type: basic + username: ${KERBECS_USER:admin} + password: ${KERBECS_PASSWORD:admin} + + providers: + static: + watch: true + + upstreams: + vault: + name: vault + version: 1.0.0 + instances: + - http://vault.vault.svc.cluster.local:9999 + + web: + name: vault-web + version: 1.0.0 + instances: + - http://web.vault.svc.cluster.local:80 + + routes: + - name: vault-api + match: + path: /api/* + upstream: vault + rewrite: + strip_prefix: /api + envelope: passthrough + + - name: vault-web + match: + path: /* + upstream: web + envelope: passthrough diff --git a/kubernetes/manifests/vault/ingress.yaml b/kubernetes/manifests/vault/ingress.yaml new file mode 100644 index 0000000..8723db8 --- /dev/null +++ b/kubernetes/manifests/vault/ingress.yaml @@ -0,0 +1,30 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: vault + namespace: vault + annotations: + alb.ingress.kubernetes.io/scheme: internet-facing + alb.ingress.kubernetes.io/target-type: ip + alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}]' + alb.ingress.kubernetes.io/ssl-redirect: '443' + alb.ingress.kubernetes.io/backend-protocol: HTTP + alb.ingress.kubernetes.io/group.name: gr-prod + external-dns.alpha.kubernetes.io/hostname: vault.gauchoracing.com + external-dns.alpha.kubernetes.io/cloudflare-proxied: "true" +spec: + ingressClassName: alb + tls: + - hosts: + - vault.gauchoracing.com + rules: + - host: vault.gauchoracing.com + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: kerbecs + port: + number: 10310 diff --git a/kubernetes/manifests/vault/kerbecs.yaml b/kubernetes/manifests/vault/kerbecs.yaml new file mode 100644 index 0000000..e968692 --- /dev/null +++ b/kubernetes/manifests/vault/kerbecs.yaml @@ -0,0 +1,74 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: kerbecs + namespace: vault +spec: + replicas: 1 + selector: + matchLabels: + app: kerbecs + template: + metadata: + labels: + app: kerbecs + spec: + topologySpreadConstraints: + - maxSkew: 1 + minDomains: 2 + topologyKey: kubernetes.io/hostname + whenUnsatisfiable: DoNotSchedule + labelSelector: + matchLabels: + app: kerbecs + containers: + - name: kerbecs + image: bk1031/kerbecs:latest + ports: + - containerPort: 10310 + name: gateway + - containerPort: 10300 + name: admin + resources: + requests: + cpu: 100m + memory: 128Mi + limits: + cpu: 500m + memory: 512Mi + env: + - name: KERBECS_CONFIG + value: /etc/kerbecs/kerbecs.yaml + - name: ENV + value: PROD + - name: KERBECS_USER + value: admin + - name: KERBECS_PASSWORD + valueFrom: + secretKeyRef: + name: vault-secrets + key: KERBECS_PASSWORD + volumeMounts: + - name: kerbecs-config + mountPath: /etc/kerbecs + readOnly: true + volumes: + - name: kerbecs-config + configMap: + name: kerbecs-config +--- +apiVersion: v1 +kind: Service +metadata: + name: kerbecs + namespace: vault +spec: + selector: + app: kerbecs + ports: + - name: gateway + port: 10310 + targetPort: 10310 + - name: admin + port: 10300 + targetPort: 10300 diff --git a/kubernetes/manifests/vault/kustomization.yaml b/kubernetes/manifests/vault/kustomization.yaml new file mode 100644 index 0000000..37524d3 --- /dev/null +++ b/kubernetes/manifests/vault/kustomization.yaml @@ -0,0 +1,19 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - namespace.yaml + - configmap-kerbecs.yaml + - postgres.yaml + - kerbecs.yaml + - server.yaml + - web.yaml + - ingress.yaml + +images: + - name: ghcr.io/gaucho-racing/vault-server + newTag: 1.0.0 + - name: ghcr.io/gaucho-racing/vault-web + newTag: 1.0.0 + - name: bk1031/kerbecs + newTag: 3.2.0 diff --git a/kubernetes/manifests/vault/namespace.yaml b/kubernetes/manifests/vault/namespace.yaml new file mode 100644 index 0000000..0158c8f --- /dev/null +++ b/kubernetes/manifests/vault/namespace.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: vault diff --git a/kubernetes/manifests/vault/postgres.yaml b/kubernetes/manifests/vault/postgres.yaml new file mode 100644 index 0000000..ecdef0b --- /dev/null +++ b/kubernetes/manifests/vault/postgres.yaml @@ -0,0 +1,8 @@ +apiVersion: v1 +kind: Service +metadata: + name: postgres + namespace: vault +spec: + type: ExternalName + externalName: ec2-52-32-150-44.us-west-2.compute.amazonaws.com diff --git a/kubernetes/manifests/vault/server.yaml b/kubernetes/manifests/vault/server.yaml new file mode 100644 index 0000000..f4e3a99 --- /dev/null +++ b/kubernetes/manifests/vault/server.yaml @@ -0,0 +1,81 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: vault + namespace: vault +spec: + replicas: 1 + selector: + matchLabels: + app: vault + template: + metadata: + labels: + app: vault + spec: + topologySpreadConstraints: + - maxSkew: 1 + minDomains: 2 + topologyKey: kubernetes.io/hostname + whenUnsatisfiable: DoNotSchedule + labelSelector: + matchLabels: + app: vault + containers: + - name: vault + image: ghcr.io/gaucho-racing/vault-server:latest + ports: + - containerPort: 9999 + resources: + requests: + cpu: 50m + memory: 128Mi + limits: + cpu: 500m + memory: 512Mi + env: + - name: ENV + value: PROD + - name: PORT + value: "9999" + - name: DATABASE_HOST + value: postgres.vault.svc.cluster.local + - name: DATABASE_PORT + value: "5432" + - name: DATABASE_USER + value: postgres + - name: DATABASE_NAME + value: vault + - name: DATABASE_PASSWORD + valueFrom: + secretKeyRef: + name: vault-secrets + key: POSTGRES_PASSWORD + - name: SENTINEL_URL + value: https://sentinel-v5.gauchoracing.com + - name: SENTINEL_CLIENT_ID + value: cfqmh6bfYFe8 + - name: SENTINEL_CLIENT_SECRET + valueFrom: + secretKeyRef: + name: vault-secrets + key: SENTINEL_CLIENT_SECRET + - name: SENTINEL_SA_TOKEN + valueFrom: + secretKeyRef: + name: vault-secrets + key: SENTINEL_SA_TOKEN + - name: SENTINEL_REDIRECT_URI + value: https://vault.gauchoracing.com/auth/login +--- +apiVersion: v1 +kind: Service +metadata: + name: vault + namespace: vault +spec: + selector: + app: vault + ports: + - port: 9999 + targetPort: 9999 diff --git a/kubernetes/manifests/vault/web.yaml b/kubernetes/manifests/vault/web.yaml new file mode 100644 index 0000000..4f2f1f0 --- /dev/null +++ b/kubernetes/manifests/vault/web.yaml @@ -0,0 +1,47 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: web + namespace: vault +spec: + replicas: 1 + selector: + matchLabels: + app: web + template: + metadata: + labels: + app: web + spec: + topologySpreadConstraints: + - maxSkew: 1 + minDomains: 2 + topologyKey: kubernetes.io/hostname + whenUnsatisfiable: DoNotSchedule + labelSelector: + matchLabels: + app: web + containers: + - name: web + image: ghcr.io/gaucho-racing/vault-web:latest + ports: + - containerPort: 80 + resources: + requests: + cpu: 10m + memory: 32Mi + limits: + cpu: 100m + memory: 128Mi +--- +apiVersion: v1 +kind: Service +metadata: + name: web + namespace: vault +spec: + selector: + app: web + ports: + - port: 80 + targetPort: 80 From 21ff826a49b70c4c4e8cb0004c1967b0db1ea4a9 Mon Sep 17 00:00:00 2001 From: Bharat Kathi Date: Thu, 25 Jun 2026 23:13:31 -0700 Subject: [PATCH 2/5] fix: use production vault sentinel client --- kubernetes/manifests/vault/server.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kubernetes/manifests/vault/server.yaml b/kubernetes/manifests/vault/server.yaml index f4e3a99..3f1ef10 100644 --- a/kubernetes/manifests/vault/server.yaml +++ b/kubernetes/manifests/vault/server.yaml @@ -54,7 +54,7 @@ spec: - name: SENTINEL_URL value: https://sentinel-v5.gauchoracing.com - name: SENTINEL_CLIENT_ID - value: cfqmh6bfYFe8 + value: Ehf9Nl8SVs9w - name: SENTINEL_CLIENT_SECRET valueFrom: secretKeyRef: From ea7e591af68c83eb0b08c112acdbf49866bb40e9 Mon Sep 17 00:00:00 2001 From: Bharat Kathi Date: Thu, 25 Jun 2026 23:16:51 -0700 Subject: [PATCH 3/5] fix: enable strict ssl for vault --- infra/environments/prod/main.tf | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/infra/environments/prod/main.tf b/infra/environments/prod/main.tf index 4f0a885..0634c84 100644 --- a/infra/environments/prod/main.tf +++ b/infra/environments/prod/main.tf @@ -240,6 +240,15 @@ resource "cloudflare_ruleset" "ssl_overrides" { ssl = "strict" } }, + { + description = "vault-strict-mode" + expression = "(http.host eq \"vault.gauchoracing.com\")" + action = "set_config" + enabled = true + action_parameters = { + ssl = "strict" + } + }, ] } From 6504c41b3929d9304bed23268ecbb30f4a5477a5 Mon Sep 17 00:00:00 2001 From: Bharat Kathi Date: Thu, 25 Jun 2026 23:39:31 -0700 Subject: [PATCH 4/5] chore(terraform): bump aws provider to 6.52 to satisfy eks module --- infra/environments/prod/.terraform.lock.hcl | 82 +++++++++++---------- 1 file changed, 42 insertions(+), 40 deletions(-) diff --git a/infra/environments/prod/.terraform.lock.hcl b/infra/environments/prod/.terraform.lock.hcl index ebcef8a..35966e3 100644 --- a/infra/environments/prod/.terraform.lock.hcl +++ b/infra/environments/prod/.terraform.lock.hcl @@ -2,42 +2,43 @@ # Manual edits may be lost in future updates. provider "registry.terraform.io/cloudflare/cloudflare" { - version = "5.19.1" + version = "5.21.1" constraints = "~> 5.0" hashes = [ - "h1:HkKPMZ/n+QiExkRUSLjGMTGnuIaph+k932LiTp7CKZM=", - "zh:0651618000db705564dab5a25322b9d76ea54b7dd78931ed3565497b559babeb", - "zh:1a7847e9479fb6d21a65ef933ffae1416b1e4b44ca940c0d6c50fc4248cc4a0d", - "zh:5597cee5854131045eb9f201ae3a70b59c51955d31a647d9616863c746d902cb", - "zh:580786830d93e35b957754fd4c62d4681a3b19abc28b757e41acba26455663b1", - "zh:83c4bdfb0e74fd50e56fff3c461d76c1c1ec61af3f679e4de1aa70b5ed05a09f", - "zh:abb4d1052cee61d80f9cb51e5421e3c118312403afb7104b98bd7e310ac736ee", - "zh:b0aeeb3d66ea4d719989875e778c477065ba941e3a76e9a8caacc3be08208dd9", - "zh:e43b4b2dfcec1ce2115f5a5c86042d432deb49bee8eae103eb56d97ea02e2e3b", + "h1:gNF1Sro3G9nXhtdkitXwDVKxI1jpBAf8KPv+Y4kAJwk=", + "zh:049719425b8be43d9d4f0c208217aca0baa22374f061d7ff92f02563490f649c", + "zh:0a8a3c1b26680b437fe9e7910ca81e532d36f8efacfb14f45690b6a779856993", + "zh:32b61f80892243f7ab8e453fa038c1f3e2aac733ccb98307c2cfe798b2793b32", + "zh:42c27f3cd62979e70716c51f682a3d131d51ad76d86dff83d8cdbfffcebac841", + "zh:4c8cd464f9b6ecde5cd4430bbba4be3b810826105e51ef6328b6a2b69f821443", + "zh:586ea42ef74d6c5bc4c9b89da6b1f8618a19f4e80272fe8d615e7d5b11c491af", + "zh:b09b86c7cac7085e01c9b7a828f09d13c44589d3e3cd42f0b694ca3e4cd3ed0a", + "zh:eac80665e60c701b37a6318f4e405d67f1720f8da5f93135c6256049282d3367", "zh:f809ab383cca0a5f83072981c64208cbd7fa67e986a86ee02dd2c82333221e32", ] } provider "registry.terraform.io/hashicorp/aws" { - version = "6.47.0" - constraints = "~> 6.0, >= 6.28.0" + version = "6.52.0" + constraints = ">= 6.0.0, ~> 6.0, >= 6.28.0, >= 6.52.0" hashes = [ - "h1:cn19NQndVIksT44BCnFHnNak7f8EURsZmT5BNeDC5YE=", - "zh:16379546c8b3ebcd6dfe6a5d6b69eb243202585fbd4786e1207bf97004b60799", - "zh:2ab74c8cd808d1206e4885cbe54433d33b63a257a2ff6b177f6e10b367fabb26", - "zh:2e5142d5b41ab2bf33e408c040c1540260508a5f2b3dedcda805749611d1c044", - "zh:5428f836b8184be2922652438784c275565e882cec732cc64ba6ed40cf1e4edb", - "zh:7927df3cf86cb67be4b0f397dc8d9ce4c7fc4d61d2bbcb091ea9420395f909c5", - "zh:915b94b53bbfc95ed7f1dcc353a8b20b54cabb362c2304d92bc45d04dc4d0802", + "h1:lpXqosKH8yAahK3SA1P5Pdy1ziXJcY+blUidY0q9yGk=", + "zh:1ab1d78f2336fed42b4e13fa0077a0be9d86a7899897cda5b9f1a60051ec2e93", + "zh:1df11f5f252030803939a1c778931dbdcee1b1070b38b98d9a8cbfc26c2aeb8e", + "zh:20ec9af03c0c1f2f8582a8805d43a4cd1a0a65082308e00f025d87605715a88f", + "zh:2d5562ed0e7cb0892fb537c7989d25fdde1d0ac1f3a768ba15fa087985f2a0f5", + "zh:40d64f668961a172355c3d11d258e19172ffafb421c40d89266b129ed8f92a5d", + "zh:497792bccc33001247473bc32a148c067982cb3d245b8f3610afb920635d2235", + "zh:8011f9167082af74ed9257582a83d54e889388656597721b2691797f1dd6fb58", + "zh:8b10d1bbca51b0da1e1be0967ce75b039f2d5d86f2ca7339994a92d35cdf47a8", + "zh:9549647dbf7c913512c26fed6badd7bf24a29a36c2bd308536849303a85427da", + "zh:97c4b726cdbe48166f4b9e6a1230312a7933dc19dd139d941ca6aca86706eb33", "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425", - "zh:9df44c98ce7939cdad234358b1c4778d42f7f485fb14ff5e340b061b2f86ce40", - "zh:acb2c2f6f8de5361f3ee2f7fbeab9ca23cef05fc5559abb6d99124a979239359", - "zh:c1c7b63502380987b6fb51d7ea0c03fe01ec105170acfe0146b28d4eb6173a91", - "zh:cc50e06c2a9759b3a93442887276e8c8a5b1722fe1714e628f28a57938845e3f", - "zh:ccac3cfc441914df16ed9f1029fe047446702cd576061a8acc6e07a06be669b3", - "zh:cdd918479cd9dda1ff67b9d13129862b48db3f58085b318208fb55b4886e4153", - "zh:da8a6b187750b4fb373697d4cbb58a29ac8a689bfb842129146e1451b6d8a4f1", - "zh:de0f3b71225f44002db8230c7504ae7b4250124b32bc3bc99e08eff48f60f59e", + "zh:a484bc8166278b546bfe53698fa9e0a919dffe3bfda3c8bf8a0fc6811b5b9e66", + "zh:aa96e76bd9f93e5395a553fccec485554a74acae46b3834b1296374eba4f010f", + "zh:cf290ee3d0dfe91b596445f860440d9f18826f7395ff785f83f70d36cedadd1c", + "zh:d56b6a79207663673f66d9ed378d705c1bd1b4d117eeb5e2be3938cf1b75b7be", + "zh:febef068317f8e49bd438ccdf2f54345fc3bc4b80a2699d9ab3c449d7e521d8e", ] } @@ -63,22 +64,23 @@ provider "registry.terraform.io/hashicorp/cloudinit" { } provider "registry.terraform.io/hashicorp/helm" { - version = "3.1.2" + version = "3.2.0" constraints = "~> 3.0" hashes = [ - "h1:om+/PuZW1dhW+8Sti5oAte6kE147KI5vA5ifxl7x9C8=", - "zh:1086b24b20d94afc331eb38c52b70848899fd0efaed46d9f4646180b96e9dffd", - "zh:28bebd04f8d0c44291dc961597c89de5be1e62153191b8b466dbbfb254c696aa", - "zh:49a7dd287c2c80621ba0c25834b1afac88c45d47ad3a24cd0aed634d78b1bbd4", - "zh:574e146b128be51cd4d9ee66cb8352eac82c7e3be2dbf53a51516ca701bb8b7c", - "zh:68285c8987affaa635c9590a0cefe238ba277e12532b64cb2d7ffec570ade064", - "zh:6ce12b5eb8f1d9aa61c4d336905e0186f9ea82c8767169533be5b206e4bd33f4", - "zh:83b7743951c989732f191cb429549296bca6faecffed492094bef92bec5c9dcb", - "zh:84fe2d11907b4e9d0c536d8b50bb63ad4056f60a73c4b734d5de7435784e53a7", - "zh:c8a25498bfbde4916f178d6880d9ee56ed9ceb88bef4842cd47360faadbb3dfb", - "zh:dfad553c09b36a7df68c3622c78b835669e69aaf954735802e85375a8df01dff", + "h1:3WcDkgmMy9vTO6hSMzqI7o4nNeSa5AXDENxk6WphT6w=", + "zh:2f1d55bf4e6a9c2629dfd3b162a05632f2e251bf6083d8613f38af3d51cea553", + "zh:33b378f15d39c2050a9272f6d5e8437f162972c93244af6df6de54ba2b0a416c", + "zh:501d7e7b3d42f5b40a6e5e979d5a6a4d67eba0fb37d786e2c3d7186e742dd557", + "zh:52e430da694bad4a06d049aa574d4a7a2b4e11c47d7bab637131068cc1160593", + "zh:77fb8ecaa27f4218177917bb3865551b058b92193408fa20366c45a529f0ac94", + "zh:b114d6ea5ab4486dc26b83cd595f0af820b3d66d0d1cf81975dfe7baa84419e2", + "zh:b6729f6f32fab90945e3cb4ba0268b73262dad0d14c1d71514ac767bac644595", + "zh:b9ff1756e698e1d3bdb0c2605ee31794f15d8275e2f8817a2bf66f3272ed9362", + "zh:be4791496afea715783f0efb65d21c99d3dc84ddb94ba4868f3afee2d50e71ef", + "zh:c8f66bd76991d7521a805cce3000a5226b1b18baf1d6b63a03d38e09208a564b", + "zh:e2bdd80b8956307f7307f90ffab0e91169bb83babeb540c712239dbc5c09916f", "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c", - "zh:fd6f36da732f442e421d2b90ed3925a1c9ad0992c380a61fe7681d90b34aa5f3", + "zh:fcda8394edc50d2a2132534edf8655cb25dc76f55937e859b9ffb5f787430f37", ] } From 839538d642bb3570dbdfd43c55251e732f268abc Mon Sep 17 00:00:00 2001 From: Bharat Kathi Date: Thu, 25 Jun 2026 23:41:32 -0700 Subject: [PATCH 5/5] chore(terraform): pin registry module versions to prevent drift --- infra/modules/eks/main.tf | 2 +- infra/modules/vpc/main.tf | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/infra/modules/eks/main.tf b/infra/modules/eks/main.tf index f273682..72f2f39 100644 --- a/infra/modules/eks/main.tf +++ b/infra/modules/eks/main.tf @@ -9,7 +9,7 @@ module "eks" { source = "terraform-aws-modules/eks/aws" - version = "~> 21.0" + version = "21.24.0" name = var.name kubernetes_version = var.kubernetes_version diff --git a/infra/modules/vpc/main.tf b/infra/modules/vpc/main.tf index 853c5a7..fe6f7cf 100644 --- a/infra/modules/vpc/main.tf +++ b/infra/modules/vpc/main.tf @@ -8,7 +8,7 @@ module "vpc" { source = "terraform-aws-modules/vpc/aws" - version = "~> 6.0" + version = "6.6.1" name = var.name cidr = var.cidr