[dortort]

Summary

stacks/prod/eks now reads the VPC id and subnets from stacks/prod/vpc with the stackorder_outputs data source of the published stackorder/stackorder provider (0.1.0), instead of hard-coded variable defaults. Its role no longer needs any access to the VPC stack's state.

• stacks/prod/vpc/.stackorder.yaml opts in: outputs.readers: [stacks/prod/eks], sensitive outputs withheld (the default).
• stacks/prod/eks drops its vpc_id and subnet_ids variables and its .stackorder.yaml. Stackorder 0.4.0 infers the reads_state edge from the stackorder_outputs block (meta source: stackorder_outputs), so the order and waves are unchanged; depends_on is still shown by stacks/staging/apps and infra/registry.
• .terraform.lock.hcl is ignored. Terraform and OpenTofu resolve the provider against different registries and each rewrites the other's lock entry, so one committed file breaks -lockfile=readonly for one tool.
• The README covers what a plan of the EKS stack now needs: the provider download, a server with STACKORDER_STATE_BUCKETS granting stackorder-example-state, and an apply or drift job of the VPC stack on CLI 0.4.0+ so the server knows where its state is.

Verification

• terraform fmt -check -recursive, make validate and make validate TF=tofu: each tool installs stackorder/stackorder v0.1.0 from its own registry, signed with key AD4D71AAF02E647A.
• make test with both tools.
• stackorder graph and stackorder affected (CLI v0.4.0) for every README scenario: the EKS stack's reason changes from dependent to reads_state; affected sets and waves are unchanged.
• The Stackorder e2e suite plans, applies and drift-checks this branch with both tools, reading the outputs with the job's OIDC token (stackorder/stackorder test branch test/e2e-eks-reads-vpc-outputs).

Merge order

stackorder's e2e workflow clones this repository's main on every push to its main and nightly. Merge this together with the stackorder pull request that adapts the e2e story, or that suite fails until it lands.

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features
  • Production EKS now reads the VPC ID and subnet IDs directly from VPC stack outputs, with the dependency inferred automatically.
  • The VPC stack grants the EKS stack access to its outputs.
• Documentation
  • Updated setup and validation guidance for reading stack outputs, including required server access and state registration.
  • Clarified provider usage and updated the documented CLI version.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 9ddfcbfa-5756-4e24-8edf-248f21eef1a0

---

📥 Commits

Reviewing files that changed from the base of the PR and between 38f3ccc and c407193.

---

📒 Files selected for processing (10)

• .gitignore
• README.md
• modules/vpc/tests/vpc.tftest.hcl
• stacks/prod/eks/.stackorder.yaml
• stacks/prod/eks/README.md
• stacks/prod/eks/main.tf
• stacks/prod/eks/variables.tf
• stacks/prod/eks/versions.tf
• stacks/prod/vpc/.stackorder.yaml
• stacks/prod/vpc/README.md

---

💤 Files with no reviewable changes (2)

• stacks/prod/eks/.stackorder.yaml
• stacks/prod/eks/variables.tf

---

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

---

📝 Walkthrough

Walkthrough

The production EKS stack now reads the VPC ID and subnet IDs from VPC stack outputs through the Stackorder provider. The VPC stack allows EKS to read those outputs, and the README documents the inferred dependency and setup requirements.

Changes

EKS VPC output reads

Layer / File(s)	Summary
Configure shared outputs and EKS reads stacks/prod/vpc/.stackorder.yaml, stacks/prod/eks/versions.tf, stacks/prod/eks/main.tf, stacks/prod/eks/variables.tf, stacks/prod/eks/.stackorder.yaml, stacks/prod/vpc/README.md, stacks/prod/eks/README.md, modules/vpc/tests/vpc.tftest.hcl	The VPC stack lists EKS as an output reader. EKS configures the Stackorder provider and uses VPC outputs instead of VPC input variables and an explicit dependency declaration. The VPC test is renamed and its assertion messages now require stable IDs.
Document provider setup and output-read requirements .gitignore, README.md	The README describes the inferred reads_state edge, provider use, server configuration, and prerequisites for reading VPC outputs. .gitignore excludes .terraform.lock.hcl.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~12 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant EKS as EKS stack
  participant Server as Stackorder server
  participant State as VPC state
  EKS->>Server: Request VPC stack outputs
  Server->>State: Read VPC state
  State-->>Server: Return state data
  Server-->>EKS: Return VPC outputs

Loading

---

Merge Risk: ⚪ Minimal · up to c4071

EKS now reads its network inputs from VPC outputs, with the required access and state-registration prerequisites documented. No actionable merge-blocking failure is established by the available evidence.

Architecture Summary

Architecture risk: 🔵 Low · up to c4071

The change affects 3 systems.

Changed systems: stacks, modules, README.md

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — stacks (service) was modified; 7 changed files map to changed impact.
• observed — modules (service) was modified; 1 changed file maps to changed impact.
• observed — README.md (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

• observed — Modified behavior in README.md: The README now documents the Stackorder provider reading VPC outputs for stacks/prod/eks, replaces the claim that no configuration requires a provider with the provider’s limited use, updates the tested CLI version from v0.2.0 to v0.4.0, adds provider v0.1.0, and clarifies which stack downloads it. It also adds that plans of EKS need a server and explains why no shared Terraform/OpenTofu lock file is committed.
• observed — Modified behavior in README.md: The layout now describes VPC test coverage for production and staging IDs, identifies outputs.readers on prod/vpc, and replaces EKS’s explicit depends_on description with its stackorder_outputs read of VPC outputs.
• observed — Modified behavior in README.md: The graph removes the explicit prod_eks-to-prod_vpc dependency edge and instead depicts an inferred reads_state edge from EKS to VPC.
• observed — Modified behavior in README.md: The edge table now includes stackorder_outputs with a literal stack name as a source of inferred reads_state edges. The EKS example changes from defaulted VPC variables plus explicit ordering to an inferred output read through the Stackorder server; it also documents the VPC output-reader allowlist and its default-branch and sensitivity settings.

---

Pre-merge checks | 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: EKS now reads VPC outputs through the stackorder_outputs data source.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

---

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

---

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}