Skip to main content

​
Legend

​
Deploy

Deployment configuration for this module

​
ModuleDeployment

Deployment configuration — discriminated by deployment typeDiscriminated union. The type field selects which schema applies.

​
AwsStaticModuleDeployment

AWS static site deployment configuration
​
enum
required
Deployment type discriminatorAllowed values: aws:static
​
AwsStaticDeploymentInfrastructure
required
Infrastructure resources required by the deploymentSee: AwsStaticDeploymentInfrastructure
​
integer
Maximum total wall-clock budget (in seconds) for a single deploy, measured from the moment the workflow starts (including time spent waiting for the deployment-manager lock). Matches the semantics of pipeline step timeout. When omitted the deploy has no explicit wall-clock limit beyond the workflow-level activity timeouts on each phase. Default: unset (no wall-clock cap).(format:int32,min:60)
​
InputProperty[]
required
Deployment-specific inputs shown in the deploy modal. Same types as module inputs — reuses the InputProperty union.See: InputProperty
​
AwsStaticDeploymentDefinition
required
Per-deploy definition. Templateable — supports both module.input and deploy.input references inside string fields.See: AwsStaticDeploymentDefinition(templateable)

​
Ec2ModuleDeployment

AWS EC2 deployment configuration. In-place only: instances are never replaced; the module-provided SSM document performs the whole per-instance deploy and its exit status is the per-instance verdict. Traffic-shift strategies are deliberately out of scope — rolling is the only supported deployment strategy.
​
enum
required
Deployment type discriminatorAllowed values: aws:ec2
​
Pipeline.GitSource
See: Pipeline.GitSource(templateable)
​
Ec2DeploymentInfrastructure
required
Infrastructure resources required by the deployment.See: Ec2DeploymentInfrastructure
​
EcsDeployConcurrency
Concurrency policy — controls how simultaneous deploy requests are handled. Omit to use defaults: queue_size=1, queue_overflow=oldest.See: EcsDeployConcurrency
​
Ec2DeploymentStrategyConfig
Rolling in-place deployment strategy. Its rollout controls map to SSM SendCommand MaxConcurrency / MaxErrors. Omit for the safe default: one instance at a time, stop on first failure.See: Ec2DeploymentStrategyConfig(templateable)
​
integer
Maximum total wall-clock budget (in seconds) for a single deploy, measured from the moment the workflow starts (including time spent waiting for the deployment-manager lock). Matches the semantics of pipeline step timeout. Default: unset (no wall-clock cap).(format:int32,min:60)
​
InputProperty[]
required
Deployment-specific inputs shown in the deploy modal. Same types as module inputs — reuses the InputProperty union.See: InputProperty
​
Ec2DeploymentDefinition
required
Per-deploy definition. Templateable — supports both module.input and deploy.input references inside string fields.See: Ec2DeploymentDefinition(templateable)

​
EksModuleDeployment

AWS EKS deployment configuration. Helm executes on an ephemeral Ravion runner inside the cluster VPC — the deploy manager orchestrates but never touches the Kubernetes API itself. helm upgrade --atomic auto-reverts failed deploys.
​
enum
required
Deployment type discriminatorAllowed values: aws:eks
​
EksDeploymentInfrastructure
required
Infrastructure resources required by the deployment.See: EksDeploymentInfrastructure
​
EcsDeployConcurrency
Concurrency policy — controls how simultaneous deploy requests are handled. Omit to use defaults: queue_size=1, queue_overflow=oldest.See: EcsDeployConcurrency
​
integer
Maximum total wall-clock budget (in seconds) for a single deploy, measured from the moment the workflow starts (including time spent waiting for the deployment-manager lock). Matches the semantics of pipeline step timeout. Default: unset (no wall-clock cap).(format:int32,min:60)
​
InputProperty[]
required
Deployment-specific inputs shown in the deploy modal. Same types as module inputs — reuses the InputProperty union.See: InputProperty
​
EksDeploymentDefinition
required
Per-deploy definition. Templateable — supports both module.input and deploy.input references inside string fields.See: EksDeploymentDefinition(templateable)

​
LambdaModuleDeployment

AWS Lambda deployment configuration. v1 supports UpdateFunctionCode
  • PublishVersion + UpdateAlias. Pre/post deploy hooks and weighted- routing alias shifts are deliberately out of scope for v1.
​
enum
required
Deployment type discriminatorAllowed values: aws:lambda
​
LambdaDeploymentInfrastructure
required
Infrastructure resources required by the deployment.See: LambdaDeploymentInfrastructure
​
integer
Maximum total wall-clock budget (in seconds) for a single deploy, measured from the moment the workflow starts (including time spent waiting for the deployment-manager lock). Matches the semantics of pipeline step timeout. Default: unset (no wall-clock cap).(format:int32,min:60)
​
InputProperty[]
required
Deployment-specific inputs shown in the deploy modal. Same types as module inputs — reuses the InputProperty union.See: InputProperty
​
LambdaDeploymentDefinition
required
Per-deploy definition. Templateable — supports both module.input and deploy.input references inside string fields.See: LambdaDeploymentDefinition(templateable)
​
LambdaFunctionConfiguration
Per-deploy function-configuration overrides applied via UpdateFunctionConfiguration before the new code is published. Every field is optional — omitted fields are left untouched on AWS (partial update semantic). Omitting the entire block skips the UpdateFunctionConfiguration phase.Templateable — every string/scalar leaf supports module.input and deploy.input references.See: LambdaFunctionConfiguration(templateable)

​
AwsStaticDeploymentDefinition

Per-deploy definition for AWS static deployments. The deploy manager promotes the resolved s3_directory to the active KVS key and (optionally) issues a background CloudFront cache invalidation across all distributions.
​
string
required
S3 directory (version prefix) to promote to active. Templateable — typically references a deploy input that holds the version built by the upstream pipeline step.(minLen:1; templateable)
​
string[] | null
CloudFront cache invalidation paths to issue across every distribution after the KVS write succeeds. Runs in the background — the deploy is marked complete on KVS write, not on invalidation completion. Empty list disables invalidation entirely (preferred for KVS-versioned setups where each version flip is automatically a fresh cache key).(templateable)
​
integer | null
Number of latest successful deploys to keep in S3. Older S3 directories are pruned in the background after a successful deploy. Omit or set to 0 to disable pruning entirely.(format:int32,min:0; templateable)

​
AwsStaticDeploymentInfrastructure

Infrastructure resources required for AWS static site deployment. Not provisioned by the deploy manager — must already exist (typically created by the hosting/static_site Terraform module). The KeyValueStore is shared by all distributions of the module; the CloudFront viewer-request function reads it on every request to resolve the active S3 directory.
​
string
required
CloudFront KeyValueStore ARN that holds the active version pointer. The deploy step writes key="active", value=<s3_directory> to this store via PutKey with optimistic ETag concurrency.(minLen:1; templateable)
​
string[]
required
CloudFront distribution ARNs that share this origin/KVS. Used for optional cache invalidation after the version flip.(minItems:1; templateable)
​
string
required
AWS region of the S3 hosting bucket.(minLen:1; templateable)
​
string
required
S3 bucket name that hosts the versioned build directories. Build artifacts live at s3://<s3_bucket>/<s3_directory>/....(minLen:1; templateable)

​
Ec2DeploymentDefinition

Per-deploy EC2 definition — discriminated by runtime.Discriminated union. The runtime field selects which schema applies.

​
Ec2DeploymentInfrastructure

Infrastructure resources required for an AWS EC2 deployment. Not provisioned by the deploy manager — must already exist (created by the compute/ec2_service Terraform module). The deploy manager runs the module-provided SSM command document against the Auto Scaling Group’s in-service instances; all deploy mechanics (env rebuild, target-group drain/re-register, container/artifact swap, local health gate) live inside the document.
​
string
required
Name of the Auto Scaling Group whose in-service instances the deploy targets. For container deploys the module’s SSM deploy document is derived from this name by convention (<name>-deploy) — the Terraform module names both from the same input, so the document is not part of this contract.(minLen:1; templateable)
​
string
required
AWS region of the Auto Scaling Group and SSM document.(minLen:1; templateable)
​
string
required
Ravion AWS account ID (awsact_…, as selected from $values:ravion/aws_accounts) that owns the Auto Scaling Group — not the raw AWS account number. Unlike the ECS / Lambda / Static deploy types, no EC2 infrastructure field is an ARN the account could be parsed from, so it is declared explicitly.(minLen:1; templateable)
​
string | null
CloudWatch log group receiving application stdout and stderr from the EC2 instances. The deploy manager combines this with the deployment and instance IDs to query one exact stream per instance.(templateable)
​
string | null
ARN of the service target group when the service is attached to a load balancer. Informational for the deploy manager (the SSM document owns drain/re-register); omitted for worker-mode services.(templateable)

​
Ec2DeploymentStrategyConfig

Rolling in-place deployment strategy for EC2 instances. The rollout controls map 1:1 to SSM SendCommand’s MaxConcurrency / MaxErrors semantics — values are absolute counts (“1”, “5”) or percentages (“25%”).
​
enum
required
Deployment strategy. EC2 deployments currently support rolling in-place updates only.Allowed values: rolling(templateable)
​
string | null
How many instances run the deploy document at once. SSM SendCommand MaxConcurrency semantics. Default: “1” — one instance at a time, so a load-balanced service keeps serving from the untouched instances during the rollout.(templateable)
​
string | null
How many per-instance failures are tolerated before SSM stops sending the document to further instances. SSM SendCommand MaxErrors semantics. Default: “0” — the first failed instance halts the rollout.(templateable)

​
EksDeploymentDefinition

Helm-engine EKS deploy definition. The runner executes helm upgrade --install --atomic, so a deploy either lands or leaves the cluster untouched. Release name and namespace are explicit — Ravion derives nothing implicitly.
​
enum
required
Definition engine discriminator.Allowed values: helm(templateable)
​
string
required
Helm release name the deploy upgrades. Explicit and stable per module instance — rollback and history target this release.(minLen:1; templateable)
​
string
required
Kubernetes namespace the release is installed into.(minLen:1; templateable)
​
HelmChartSource
required
Where the chart comes from — a chart directory (bundled or checked out of Git), an OCI registry, or an HTTP repository.See: HelmChartSource(templateable)
​
map<string,any | null>
Values passed to Helm (equivalent to a --values file). Merged over the chart’s defaults. Templateable — supports module.input and deploy.input references, including object spread directives.(templateable)
​
EcsSecret[] | null
Secret references injected into the release’s containers. Reuses the ECS EcsSecret shape verbatim — {name, value_from: <ARN>}, Parameter Store or Secrets Manager, including ECS’s JSON-key extraction suffix (arn:…:secret:db-AbCdEf:password::) — so a service migrating from aws:ecs to aws:eks carries its secret configuration unchanged.Reference-only: Ravion never reads these values. The ARNs travel to the chart as ordinary Helm values under the reserved ravion.secrets key, the chart renders an External Secrets Operator ExternalSecret from them, and ESO materializes the Kubernetes Secret in-cluster. No secret value ever reaches Tower, the Helm values document, the release manifest, deploymentData, or Ravion logs.value_from must be a full ARN — unlike ECS, a bare Parameter Store name is rejected, because the chart has to know which provider a reference belongs to in order to pick the right ESO SecretStore.See: EcsSecret(templateable)
​
boolean | null
Whether Helm creates the target namespace when it does not exist (--create-namespace). Default: false.(templateable)

​
EksDeploymentInfrastructure

Infrastructure resources required for an AWS EKS deployment. Not provisioned by the deploy manager — must already exist (created by the compute/eks composite Terraform module). The deploy manager launches an ephemeral runner inside the cluster VPC, assembles a kubeconfig in-memory from these values plus aws eks get-token, and never persists credentials.
​
string
required
Full ARN of the EKS cluster the deploy targets, e.g. arn:aws:eks:us-east-1:123456789012:cluster/prod. Ravion parses the AWS account number and region out of it to resolve which connected AWS account owns the cluster — the same contract aws:ecs uses with ecs_cluster_arn.(minLen:1; templateable)
​
string
required
Name of the EKS cluster the deploy targets.(minLen:1; templateable)
​
string
required
HTTPS endpoint of the cluster’s Kubernetes API server. May be a private-only endpoint — the runner executes inside the cluster VPC, so reachability is guaranteed by construction.(minLen:1; templateable)
​
string
required
Base64-encoded certificate authority data of the cluster, used to verify the API server’s TLS certificate when assembling the kubeconfig.(minLen:1; templateable)
​
string
required
ARN of the stable <cluster>-ravion-runner IAM role provisioned by the EKS module alongside its cluster access entry. The runner assumes this role to obtain a cluster token via aws eks get-token --role-arn — per-step ephemeral roles are incompatible with authentication_mode = API access entries. The field name matches the shipped rvn-eks Terraform output, so the template reads straight through.(minLen:1; templateable)
​
string | null
ID or given ID of the execution environment the deploy’s ephemeral Helm runner is launched into. The environment supplies the runner’s VPC, subnet and security group.Its AWS account and region must match the cluster’s, both of which are read out of cluster_arn — an environment elsewhere cannot assume the cluster’s runner role or reach its network, and the deploy fails naming the environment rather than failing later at EC2 launch.A pipeline deploy step, or an API deploy request, that names its own environment overrides this one.(templateable)
​
Pipeline.ExecutionEnvironmentOverrides
Overrides for individual attributes of the resolved execution environment. Valid with or without execution_environment_id: without one they apply on top of the AWS account’s default environment.Merged per field with the step- or request-level overrides, which win wherever both name the same attribute.See: Pipeline.ExecutionEnvironmentOverrides(templateable)

​
LambdaDeploymentDefinition

Per-deploy Lambda definition — discriminated by package_type.Discriminated union. The package_type field selects which schema applies.

​
LambdaDeploymentInfrastructure

Infrastructure resources required for AWS Lambda deployment. Not provisioned by the deploy manager — must already exist (typically created by the compute/lambda Terraform module). The alias is expected to already exist on the function; the deploy step only flips it onto a freshly-published version.
​
string
required
Full ARN of the Lambda function the deploy targets.(minLen:1; templateable)
​
string
required
AWS region of the function. Mirrors aws_static_module_deployment’s s3_region — needed because Lambda’s regional endpoint is the only thing the workflow can reach the function through.(minLen:1; templateable)
​
string | null
Alias the deploy flips after publishing the new function version. Default: live. The alias must already exist on the function — the deploy step calls UpdateAlias, never CreateAlias.(templateable)
​
string | null
S3 bucket the build step uploaded the zip artifact into. Optional — captured into the deploy snapshot for audit even when the deploy itself targets an Image-packaged function.(templateable)

​
LambdaFunctionConfiguration

AWS Lambda function configuration — every field optional, applied as a partial update via UpdateFunctionConfiguration. Fields the user omits are left untouched on AWS; an empty block (or omitting the function_configuration key entirely) skips the UpdateFunctionConfiguration phase altogether.All scalar/string fields are templateable for << module.input.* >> and << deploy.input.* >> expressions.https://docs.aws.amazon.com/lambda/latest/api/API_UpdateFunctionConfiguration.html
​
string | null
IAM execution role ARN.(templateable)
​
string | null
Handler entrypoint (Zip only — ignored for Image).(templateable)
​
string | null
Lambda runtime (Zip only — ignored for Image).(templateable)
​
integer | null
Memory size in MiB. 128–10240.(format:int32,min:128,max:10240; templateable)
​
integer | null
Wall-clock timeout in seconds. 1–900.(format:int32,min:1,max:900; templateable)
​
string | null
Function description shown in the AWS console.(templateable)
​
enum[x86_64,arm64][] | null
CPU architectures — exactly one of x86_64 or arm64.(templateable)
​
LambdaEnvironment
Environment variables applied to the function.See: LambdaEnvironment(templateable)
​
LambdaVpcConfig
VPC configuration. Setting empty arrays disconnects the function from the VPC.See: LambdaVpcConfig(templateable)
​
string[] | null
Lambda layer ARNs (versioned, e.g. arn:aws:lambda:us-east-1:123456789012:layer:foo:3).(templateable)
​
LambdaEphemeralStorage
Ephemeral /tmp storage size.See: LambdaEphemeralStorage(templateable)
​
LambdaTracingConfig
X-Ray tracing mode.See: LambdaTracingConfig(templateable)
​
string | null
Customer-managed KMS key ARN for environment variable encryption.(templateable)
​
LambdaDeadLetterConfig
Dead-letter destination for async invocations.See: LambdaDeadLetterConfig(templateable)
​
LambdaFileSystemConfig[] | null
EFS file systems attached to the function.See: LambdaFileSystemConfig(templateable)
​
LambdaSnapStart
SnapStart configuration. Java-only on AWS today, but the field is forwarded as-is to Lambda.See: LambdaSnapStart(templateable)
​
LambdaLoggingConfig
CloudWatch logging configuration.See: LambdaLoggingConfig(templateable)
​
LambdaImageConfig
Image overrides — image-packaged functions only.See: LambdaImageConfig(templateable)

​
Ec2ContainerDeploymentDefinition

Container-runtime EC2 deploy definition. The image must already exist (pushed by the upstream build step’s ecr destination, or supplied by the user for prebuilt/disabled builds).
​
enum
required
Definition type discriminator.Allowed values: container(templateable)
​
string
required
Full image URI to deploy. Prefer a digest-qualified URI for reproducibility. Templateable — typically combines the repository URL with a deploy input or references a deploy input containing the full URI.(minLen:1; templateable)

​
Ec2ManualDeploymentDefinition

Manual-runtime EC2 deploy definition. The deploy manager sends these shell commands to every in-service instance through the module-provided deploy document, which refreshes and loads the app env file (plain values and secrets) before running them — no build artifact is involved.
​
enum
required
Definition type discriminator.Allowed values: manual(templateable)
​
string[]
required
Shell commands run in order on each instance, as root. A non-zero exit fails the deploy on that instance. Templateable — typically references a module input.(minItems:1; templateable)
​
string | null
Long-running foreground command started after the release commands succeed. The deploy manager forwards it to the module-provided deploy document so it is captured with the release instead of the stack.(templateable)

​
EksHelmDefinition

Helm-engine EKS deploy definition. The runner executes helm upgrade --install --atomic, so a deploy either lands or leaves the cluster untouched. Release name and namespace are explicit — Ravion derives nothing implicitly.
​
enum
required
Definition engine discriminator.Allowed values: helm(templateable)
​
string
required
Helm release name the deploy upgrades. Explicit and stable per module instance — rollback and history target this release.(minLen:1; templateable)
​
string
required
Kubernetes namespace the release is installed into.(minLen:1; templateable)
​
HelmChartSource
required
Where the chart comes from — a chart directory (bundled or checked out of Git), an OCI registry, or an HTTP repository.See: HelmChartSource(templateable)
​
map<string,any | null>
Values passed to Helm (equivalent to a --values file). Merged over the chart’s defaults. Templateable — supports module.input and deploy.input references, including object spread directives.(templateable)
​
EcsSecret[] | null
Secret references injected into the release’s containers. Reuses the ECS EcsSecret shape verbatim — {name, value_from: <ARN>}, Parameter Store or Secrets Manager, including ECS’s JSON-key extraction suffix (arn:…:secret:db-AbCdEf:password::) — so a service migrating from aws:ecs to aws:eks carries its secret configuration unchanged.Reference-only: Ravion never reads these values. The ARNs travel to the chart as ordinary Helm values under the reserved ravion.secrets key, the chart renders an External Secrets Operator ExternalSecret from them, and ESO materializes the Kubernetes Secret in-cluster. No secret value ever reaches Tower, the Helm values document, the release manifest, deploymentData, or Ravion logs.value_from must be a full ARN — unlike ECS, a bare Parameter Store name is rejected, because the chart has to know which provider a reference belongs to in order to pick the right ESO SecretStore.See: EcsSecret(templateable)
​
boolean | null
Whether Helm creates the target namespace when it does not exist (--create-namespace). Default: false.(templateable)

​
LambdaImageDefinition

Image-packaged Lambda deploy definition. The image must already exist in ECR (typically pushed by the upstream build step’s ecr destination).
​
enum
required
Definition type discriminator.Allowed values: image(templateable)
​
string
required
Full ECR image URI. Prefer <repo>@sha256:<digest> form for reproducibility — Lambda resolves a mutable tag at deploy time and silently pins it, but the deploy snapshot records the resolved digest only when one was provided.(minLen:1; templateable)

​
LambdaZipDefinition

Zip-packaged Lambda deploy definition. The code object must already exist in S3 (typically uploaded by the upstream build step’s s3-zip destination).
​
enum
required
Definition type discriminator.Allowed values: zip(templateable)
​
string
required
S3 key the build step uploaded into. Templateable — typically references a deploy input that holds the key written by the upstream build step.(minLen:1; templateable)

​
LambdaDeadLetterConfig

Dead-letter destination for async invocations.
​
string | null
SQS queue ARN or SNS topic ARN.(templateable)

​
LambdaEnvironment

Lambda function environment block. Mirrors AWS Lambda’s Environment shape — a single variables map of string → string.
​
map<string,string> | null
Environment variables applied to the function. Replaces the existing variable set on AWS — the API doesn’t merge.(templateable)

​
LambdaEphemeralStorage

Function-level ephemeral storage (/tmp) size in MiB.
​
integer
required
Size in MiB. 512–10240.(format:int32,min:512,max:10240; templateable)

​
LambdaFileSystemConfig

EFS file system attached to the function.
​
string
required
EFS access point ARN.(templateable)
​
string
required
Mount path inside the container — must start with /mnt/.(templateable)

​
LambdaImageConfig

Container image configuration overrides — image-packaged functions only.
​
string[] | null
Override the image’s CMD.(templateable)
​
string[] | null
Override the image’s ENTRYPOINT.(templateable)
​
string | null
Override the image’s WORKDIR.(templateable)

​
LambdaLoggingConfig

Function logging configuration (CloudWatch destination + log levels).
​
enum | null
Format the logs are emitted in.Allowed values: JSON | Text(templateable)
​
enum | null
Application log level — only valid when log_format is JSON.Allowed values: TRACE | DEBUG | INFO | WARN | ERROR | FATAL(templateable)
​
enum | null
System log level — only valid when log_format is JSON.Allowed values: DEBUG | INFO | WARN(templateable)
​
string | null
Destination CloudWatch log group.(templateable)

​
LambdaSnapStart

SnapStart configuration.
​
enum
required
When to take the snapshot. None disables SnapStart; PublishedVersions snapshots each PublishVersion call.Allowed values: None | PublishedVersions(templateable)

​
LambdaTracingConfig

AWS X-Ray tracing configuration.
​
enum
required
Active samples + traces requests; PassThrough only propagates an upstream sampling decision.Allowed values: Active | PassThrough(templateable)

​
LambdaVpcConfig

VPC configuration for a Lambda function.
​
string[] | null
Subnet IDs the function’s ENIs are placed into.(templateable)
​
string[] | null
Security group IDs attached to the function’s ENIs.(templateable)
​
boolean | null
Whether the function gets dual-stack IPv6 networking.(templateable)

​
HelmChartSource

Where the Helm chart comes from — discriminated by type.Discriminated union. The type field selects which schema applies.

​
HelmGitChartSource

Helm chart installed from a directory of chart files. Either the directory is already in the runner’s working directory — the Ravion charts shipped with a module definition (rvn-eks-web, rvn-eks-worker, rvn-eks-cron) — or Ravion checks a repository out onto the runner first and the directory lives inside that checkout.Private repositories authenticate through the organization’s connected code source, exactly as a build checkout does. There is no token field: the clone credential is resolved on the runner and never travels through the deploy’s history.
​
enum
required
Chart source discriminator.Allowed values: git(templateable)
​
string | null
Git repository URL containing the chart. Omit to install a chart already present in the runner’s working directory.(templateable)
​
string | null
Branch to check out. Required whenever repo_url is set — the runner’s clone needs a branch to start from.(templateable)
​
string | null
Exact commit SHA or tag to pin the checkout to, applied on top of branch. Strongly preferred for reproducible deploys.(templateable)
​
string
required
Path of the chart directory within the repository, or — when repo_url is omitted — relative to the runner’s working directory.(minLen:1; templateable)

​
HelmHttpChartSource

Helm chart pulled from a classic HTTP Helm repository.
​
enum
required
Chart source discriminator.Allowed values: http(templateable)
​
string
required
HTTP(S) URL of the Helm repository.(minLen:1; templateable)
​
string
required
Name of the chart within the repository.(minLen:1; templateable)
​
string | null
Chart version to install. Prefer pinning an exact version for reproducibility.(templateable)
​
HelmRegistryCredentials
Credentials for a private Helm repository.See: HelmRegistryCredentials(templateable)

​
HelmOciChartSource

Helm chart pulled from an OCI registry.
​
enum
required
Chart source discriminator.Allowed values: oci(templateable)
​
string
required
Full OCI chart reference.(minLen:1; templateable)
​
string | null
Chart version to install. Prefer pinning an exact version for reproducibility.(templateable)
​
HelmRegistryCredentials
Credentials for a private OCI registry.See: HelmRegistryCredentials(templateable)

​
HelmRegistryCredentials

Credentials for a private OCI registry or HTTP Helm repository, passed to helm pull as --username / --password. Supply both — a registry that wants one wants the other.
​
HelmCredentialRef
required
Registry / repository username reference.See: HelmCredentialRef(templateable)
​
HelmCredentialRef
required
Registry / repository password reference.See: HelmCredentialRef(templateable)

​
HelmCredentialRef

One credential a chart registry or repository authenticates with. The same reference shapes environment variables use: the value is read from Parameter Store or Secrets Manager on the runner and never enters the deploy’s history, the instruction, or Ravion logs.One of: Pipeline.ParameterStoreEnvVar, Pipeline.SecretsManagerEnvVar.