diff --git a/‎main.tf‎
Lines changed: 29 additions & 12 deletions b/‎main.tf‎
Lines changed: 29 additions & 12 deletions
diff --git a/‎modules/comet_eks/main.tf‎
Lines changed: 49 additions & 15 deletions b/‎modules/comet_eks/main.tf‎
Lines changed: 49 additions & 15 deletions
diff --git a/‎modules/comet_eks/variables.tf‎
Lines changed: 3 additions & 24 deletions b/‎modules/comet_eks/variables.tf‎
Lines changed: 3 additions & 24 deletions
diff --git a/‎modules/comet_elasticache/main.tf‎
Lines changed: 15 additions & 5 deletions b/‎modules/comet_elasticache/main.tf‎
Lines changed: 15 additions & 5 deletions
diff --git a/‎modules/comet_elasticache/outputs.tf‎
Lines changed: 5 additions & 0 deletions b/‎modules/comet_elasticache/outputs.tf‎
Lines changed: 5 additions & 0 deletions
diff --git a/‎modules/comet_elasticache/variables.tf‎
Lines changed: 1 addition & 8 deletions b/‎modules/comet_elasticache/variables.tf‎
Lines changed: 1 addition & 8 deletions
diff --git a/‎modules/comet_rds/main.tf‎
Lines changed: 15 additions & 0 deletions b/‎modules/comet_rds/main.tf‎
Lines changed: 15 additions & 0 deletions
diff --git a/‎modules/comet_rds/variables.tf‎
Lines changed: 5 additions & 0 deletions b/‎modules/comet_rds/variables.tf‎
Lines changed: 5 additions & 0 deletions
diff --git a/‎modules/comet_rds_proxy/variables.tf‎
Lines changed: 1 addition & 2 deletions b/‎modules/comet_rds_proxy/variables.tf‎
Lines changed: 1 addition & 2 deletions
diff --git a/‎outputs.tf‎
Lines changed: 10 additions & 0 deletions b/‎outputs.tf‎
Lines changed: 10 additions & 0 deletions
@@ -21,6 +21,23 @@ locals {
     var.enable_rds ? random_password.rds_master[0].result : null
   )
 
+  # Resolve rds_proxy_allowed_cidrs' tri-state once (DND-1522). The proxy is a second
+  # path to the same Aurora cluster the mysql_vpn rule opens directly, so its CIDR
+  # ingress follows vpn_client_cidr instead of carrying its own copy of the pool: a
+  # duplicated default drifts on the first renumber, moving the direct path while the
+  # proxy keeps trusting the retired range. null means follow; [] still means SG-only
+  # ingress; an explicit list still wins.
+  #
+  # This has to be a local, not an inline conditional at each use. The
+  # rds_proxy_validation precondition counts ingress sources with
+  # length(rds_proxy_allowed_cidrs), and null is not a list — so resolving inline at the
+  # module argument only would leave length(null) to raise "Invalid function argument"
+  # in precisely the case the precondition exists to explain (enable_ec2 and enable_eks
+  # both false, no rds_proxy_allowed_sg_ids). Deriving the effective list also keeps the count
+  # honest: under null the proxy does get one CIDR source, so null must satisfy that
+  # check rather than fail it — which coalesce(..., []) would get backwards.
+  rds_proxy_effective_cidrs = var.rds_proxy_allowed_cidrs == null ? [var.vpn_client_cidr] : var.rds_proxy_allowed_cidrs
+
   # Mirrors the comet_rds_proxy count exactly, so mysql_host can never dereference
   # module.comet_rds_proxy[0] when the module isn't instantiated.
   rds_proxy_provisioned     = var.enable_rds_proxy && var.enable_rds
@@ -128,7 +145,7 @@ resource "terraform_data" "rds_proxy_validation" {
     # being able to connect. enable_ec2 / enable_eks auto-wire the app's SG; without
     # either, an explicit SG or CIDR has to be supplied.
     precondition {
-      condition     = var.enable_ec2 || var.enable_eks || length(var.rds_proxy_allowed_sg_ids) > 0 || length(var.rds_proxy_allowed_cidrs) > 0
+      condition     = var.enable_ec2 || var.enable_eks || length(var.rds_proxy_allowed_sg_ids) > 0 || length(local.rds_proxy_effective_cidrs) > 0
       error_message = "enable_rds_proxy requires at least one ingress source: enable_ec2=true or enable_eks=true (auto-wires the application SG), or non-empty rds_proxy_allowed_sg_ids, or non-empty rds_proxy_allowed_cidrs. Otherwise the proxy has no ingress rules and is unreachable."
     }
     precondition {
@@ -393,13 +410,10 @@ module "comet_eks" {
   # Karpenter Helm chart
   karpenter_extra_tags = var.eks_karpenter_extra_tags
 
-  # EKS API ingress — standardized fleet-wide access
-  enable_argocd_management_eks_access = var.enable_argocd_management_eks_access
-  argocd_management_cidrs             = var.argocd_management_cidrs
-  enable_vpn_eks_api_access           = var.enable_vpn_eks_api_access
-  vpn_client_cidr                     = var.vpn_client_cidr
-  enable_ci_runners_eks_api_access    = var.enable_ci_runners_eks_api_access
-  ci_runners_cidr                     = var.ci_runners_cidr
+  # EKS API ingress — standardized fleet-wide access (opened unconditionally, DND-1522)
+  argocd_management_cidrs = var.argocd_management_cidrs
+  vpn_client_cidr         = var.vpn_client_cidr
+  ci_runners_cidr         = var.ci_runners_cidr
 
 }
 
@@ -429,8 +443,7 @@ module "comet_elasticache" {
   elasticache_multi_az_enabled            = var.elasticache_multi_az_enabled
   elasticache_preferred_cache_cluster_azs = var.elasticache_preferred_cache_cluster_azs
 
-  enable_vpn_redis_access = var.enable_vpn_redis_access
-  vpn_client_cidr         = var.vpn_client_cidr
+  vpn_client_cidr = var.vpn_client_cidr
 }
 
 module "comet_rds" {
@@ -447,6 +460,8 @@ module "comet_rds" {
   rds_allow_from_sg = var.enable_ec2 ? module.comet_ec2[0].comet_ec2_sg_id : (
     var.enable_eks ? module.comet_eks[0].nodegroup_sg_id : (
   var.rds_allow_from_sg))
+  vpn_client_cidr = var.vpn_client_cidr
+
   # EKS Auto Mode nodes attach the cluster primary SG (distinct from the managed node SG
   # above), so grant them MySQL access too when Auto Mode is enabled.
   rds_auto_mode_allow_from_sg    = var.enable_eks && var.eks_enable_auto_mode ? module.comet_eks[0].cluster_primary_security_group_id : null
@@ -515,7 +530,7 @@ module "comet_rds_proxy" {
 
   # Same precedence as comet_rds's rds_allow_from_sg — EC2 first, then EKS, then the
   # explicit list. The EC2 branch was missing, so an enable_ec2 env got a proxy the
-  # application could not reach: rds_proxy_allowed_cidrs defaults to the VPN pool, so
+  # application could not reach: rds_proxy_allowed_cidrs follows the VPN pool, so
   # the "at least one ingress source" check passed on VPN access alone.
   # EKS: managed node SG + (with Auto Mode) the cluster primary SG that Auto Mode nodes
   # attach, so pods on either node type can reach the proxy.
@@ -525,7 +540,9 @@ module "comet_rds_proxy" {
       var.eks_enable_auto_mode ? [module.comet_eks[0].cluster_primary_security_group_id] : [],
     ) : var.rds_proxy_allowed_sg_ids
   )
-  allowed_cidrs = var.rds_proxy_allowed_cidrs
+
+  # Resolved once in locals, and shared with the rds_proxy_validation precondition.
+  allowed_cidrs = local.rds_proxy_effective_cidrs
 
   mysql_cluster_id      = module.comet_rds[0].mysql_cluster_id
   mysql_sg_id           = module.comet_rds[0].mysql_sg_id
 
@@ -1484,36 +1484,70 @@ module "karpenter_irsa" {
 #########################################
 #### EKS API ingress — fleet-wide CIDRs ####
 #########################################
-# These open the EKS cluster_security_group_id (the cluster's primary SG) on
-# port 443 to fleet-wide management surfaces. Each ingress source is gated by
-# its own toggle; the local map merges all enabled rules into a single
-# for_each so the common attributes live in one place.
+# These open the EKS cluster_primary_security_group_id on port 443 to fleet-wide
+# management surfaces (ArgoCD management, VPN clients, CI runners). Connectivity
+# is never a per-environment decision, so every source is opened unconditionally
+# (DND-1522); the CIDRs remain inputs. The local map merges all rules into a
+# single for_each so the common attributes live in one place.
 
 locals {
-  eks_api_ingress_rules = merge(
-    var.enable_argocd_management_eks_access ? {
-      for cidr in distinct(var.argocd_management_cidrs) :
-      "argocd-management-${replace(cidr, "/", "_")}" => {
+  # Ordered candidates — on a CIDR collision the earlier entry wins.
+  eks_api_rule_candidates = concat(
+    [
+      for cidr in distinct(var.argocd_management_cidrs) : {
+        key         = "argocd-management-${replace(cidr, "/", "_")}"
         cidr        = cidr
         description = "Allow ArgoCD management to reach EKS API from ${cidr}"
         name        = "argocd-management-access-${replace(cidr, "/", "_")}"
       }
-    } : {},
-    var.enable_vpn_eks_api_access ? {
-      "vpn" = {
+    ],
+    [
+      {
+        key         = "vpn"
         cidr        = var.vpn_client_cidr
         description = "Allow VPN clients to reach EKS API"
         name        = "vpn-eks-api-access"
       }
-    } : {},
-    var.enable_ci_runners_eks_api_access ? {
-      "ci-runners" = {
+    ],
+    [
+      {
+        key         = "ci-runners"
         cidr        = var.ci_runners_cidr
         description = "Allow CI cluster runners to reach EKS API"
         name        = "ci-runners-eks-api-access"
       }
-    } : {},
+    ],
   )
+
+  # AWS dedupes ingress on (protocol, port range, source), so two candidates
+  # sharing a CIDR would collide as InvalidPermission.Duplicate on apply. Keep
+  # only the first candidate for each CIDR. distinct() alone can't do this — it
+  # covered argocd_management_cidrs but not a cross-source collision (e.g.
+  # vpn_client_cidr equal to an argocd CIDR), and the enable_* toggles that used
+  # to make such a collision avoidable are gone (DND-1522). The default CIDRs
+  # don't collide, so every for_each key is unchanged and this is a no-op
+  # against existing state.
+  #
+  # WARNING — the winner keeps its own key, so introducing a collision moves the
+  # rule's Terraform address. Set vpn_client_cidr equal to an argocd CIDR and the
+  # "vpn" key disappears in favour of "argocd-management-<cidr>"; for an env
+  # already holding that rule under "vpn" the plan is a destroy plus a create at
+  # the new address, i.e. a window with no VPN reach to the EKS API. (Equal to
+  # ci_runners_cidr drops "ci-runners" instead — the order above decides which.)
+  # Same failure mode the redis_vpn moved block exists to prevent, reached
+  # through a config change rather than a refactor. If such a collision is ever
+  # deliberate, add a moved block for the retired key in the same change.
+  eks_api_ingress_rules = {
+    for candidate in local.eks_api_rule_candidates :
+    candidate.key => {
+      cidr        = candidate.cidr
+      description = candidate.description
+      name        = candidate.name
+    }
+    if candidate.key == [
+      for other in local.eks_api_rule_candidates : other.key if other.cidr == candidate.cidr
+    ][0]
+  }
 }
 
 resource "aws_vpc_security_group_ingress_rule" "eks_api" {
 
@@ -846,40 +846,19 @@ variable "eks_clickhouse_subnet_ids" {
 #### EKS API ingress — standardized fleet-wide access patterns
 #####################
 
-variable "enable_argocd_management_eks_access" {
-  description = "Open EKS API (port 443) to the ArgoCD management cluster CIDRs in argocd_management_cidrs. Required for ArgoCD to deploy into this cluster from the central mgmt cluster."
-  type        = bool
-  default     = false
-}
-
 variable "argocd_management_cidrs" {
-  description = "CIDRs allowed to reach the EKS API for ArgoCD management. Defaults cover the ArgoCD mgmt VPC + cluster CIDRs."
+  description = "CIDRs allowed to reach the EKS API for ArgoCD management. Opened unconditionally (DND-1522). Required — the root module always supplies it; the default lives only there so the value can't drift between submodules."
   type        = list(string)
-  default     = ["10.162.0.0/16", "10.100.0.0/16"]
-}
-
-variable "enable_vpn_eks_api_access" {
-  description = "Open EKS API (port 443) to the VPN client pool CIDR. Required after flipping endpoint_public_access=false (DND-915)."
-  type        = bool
-  default     = false
 }
 
 variable "vpn_client_cidr" {
-  description = "CIDR of the VPN client pool. Used by enable_vpn_eks_api_access and enable_vpn_redis_access."
+  description = "CIDR of the VPN client pool. Opened on the EKS API (DND-915) and passed through to Redis/MySQL SG rules (DND-1522). Required — the root module always supplies it; the default lives only there so the value can't drift between submodules."
   type        = string
-  default     = "10.126.0.0/15"
-}
-
-variable "enable_ci_runners_eks_api_access" {
-  description = "Open EKS API (port 443) to the CI runners cluster CIDR. Required for CI workflows that exec against the cluster (DND-1153)."
-  type        = bool
-  default     = false
 }
 
 variable "ci_runners_cidr" {
-  description = "CIDR of the CI runners cluster."
+  description = "CIDR of the CI runners cluster. Opened unconditionally on the EKS API (DND-1522). Required — the root module always supplies it; the default lives only there so the value can't drift between submodules."
   type        = string
-  default     = "10.4.0.0/16"
 }
 
 #####################
 
@@ -79,12 +79,11 @@ resource "aws_vpc_security_group_ingress_rule" "redis_port_inbound_auto_mode" {
   referenced_security_group_id = var.elasticache_auto_mode_allow_from_sg
   description                  = "Redis from EKS Auto Mode nodes (cluster primary SG)"
 }
-# VPN ingress to Redis (DND-752) — gated by enable_vpn_redis_access. Allows
-# operators on the VPN to connect to Redis via kubectl port-forward through
-# the cluster's Redis SG.
-resource "aws_vpc_security_group_ingress_rule" "redis_vpn" {
-  count = var.enable_vpn_redis_access ? 1 : 0
 
+# VPN ingress to Redis (DND-752). Allows operators on the VPN to connect to
+# Redis via kubectl port-forward through the cluster's Redis SG. Opened
+# unconditionally — connectivity is never per-environment (DND-1522).
+resource "aws_vpc_security_group_ingress_rule" "redis_vpn" {
   security_group_id = aws_security_group.redis_inbound_sg.id
   description       = "VPN client access (DND-752)"
   from_port         = local.redis_port
@@ -94,3 +93,14 @@ resource "aws_vpc_security_group_ingress_rule" "redis_vpn" {
 
   tags = merge(var.common_tags, { Name = "redis-vpn-access" })
 }
+
+# The rule was previously gated on enable_vpn_redis_access, so envs that had it
+# on hold it in state as redis_vpn[0]. Dropping count changes the address to
+# redis_vpn; without this, Terraform plans an unordered destroy + create of two
+# unrelated addresses, which can race into InvalidPermission.Duplicate and, on
+# the happy path, still leaves a window with no VPN ingress to Redis. No-op for
+# any consumer that had the toggle off (DND-1522).
+moved {
+  from = aws_vpc_security_group_ingress_rule.redis_vpn[0]
+  to   = aws_vpc_security_group_ingress_rule.redis_vpn
+}
@@ -8,6 +8,11 @@ output "redis_port" {
   value       = local.redis_port
 }
 
+output "redis_sg_id" {
+  description = "Security group ID of the Redis replication group"
+  value       = aws_security_group.redis_inbound_sg.id
+}
+
 output "transit_encryption_enabled" {
   description = "Whether transit encryption is enabled"
   value       = aws_elasticache_replication_group.comet-ml-ec-redis.transit_encryption_enabled
 
@@ -95,14 +95,7 @@ variable "common_tags" {
   default     = {}
 }
 
-variable "enable_vpn_redis_access" {
-  description = "Add a VPN client CIDR ingress rule on the Redis SG (port 6379). Required for operator port-forward access via the VPN (DND-752)."
-  type        = bool
-  default     = false
-}
-
 variable "vpn_client_cidr" {
-  description = "CIDR of the VPN client pool. Used when enable_vpn_redis_access = true."
+  description = "CIDR of the VPN client pool. Opened unconditionally on the Redis SG (port 6379) for operator port-forward access via the VPN (DND-752, DND-1522). Required — the root module always supplies it; the default lives only there so the value can't drift between submodules."
   type        = string
-  default     = "10.126.0.0/15"
 }
@@ -352,3 +352,18 @@ resource "aws_vpc_security_group_ingress_rule" "mysql_port_inbound_auto_mode" {
   referenced_security_group_id = var.rds_auto_mode_allow_from_sg
   description                  = "MySQL from EKS Auto Mode nodes (cluster primary SG)"
 }
+
+# VPN ingress to MySQL. Allows operators on the VPN to connect to Aurora via
+# kubectl port-forward through the cluster's MySQL SG. Opened unconditionally,
+# mirroring redis_vpn in modules/comet_elasticache — connectivity is never
+# per-environment (DND-1522).
+resource "aws_vpc_security_group_ingress_rule" "mysql_vpn" {
+  security_group_id = aws_security_group.mysql_sg.id
+  description       = "VPN client access (DND-1522)"
+  from_port         = local.mysql_port
+  to_port           = local.mysql_port
+  ip_protocol       = "tcp"
+  cidr_ipv4         = var.vpn_client_cidr
+
+  tags = merge(var.common_tags, { Name = "mysql-vpn-access" })
+}
@@ -185,6 +185,11 @@ variable "common_tags" {
   default     = {}
 }
 
+variable "vpn_client_cidr" {
+  description = "CIDR of the VPN client pool. Opened unconditionally on the MySQL SG (port 3306) for operator port-forward access via the VPN (DND-1522). Required — the root module always supplies it; the default lives only there so the value can't drift between submodules."
+  type        = string
+}
+
 variable "rds_snapshot_identifier" {
   description = "Snapshot identifier to restore the RDS cluster from. If provided, the cluster will be restored from this snapshot instead of being created fresh."
   type        = string
 
@@ -26,9 +26,8 @@ variable "allowed_sg_ids" {
 }
 
 variable "allowed_cidrs" {
-  description = "CIDR blocks allowed to connect to the proxy on the MySQL port (in addition to allowed_sg_ids). Defaults to the agentro VPN client pool so ops queries via VPN reach the proxy directly. Set to [] to allow only SG-based ingress."
+  description = "CIDR blocks allowed to connect to the proxy on the MySQL port (in addition to allowed_sg_ids). [] allows only SG-based ingress. Required — the root module resolves this from rds_proxy_allowed_cidrs, falling back to vpn_client_cidr; the default lives only there so the two MySQL paths can't diverge."
   type        = list(string)
-  default     = ["10.126.0.0/15"]
 }
 
 variable "mysql_cluster_id" {
 
@@ -72,6 +72,11 @@ output "mysql_database_name" {
   value       = var.enable_rds ? module.comet_rds[0].mysql_database_name : null
 }
 
+output "mysql_sg_id" {
+  description = "Security group ID of the MySQL (Aurora) cluster — wrappers add ingress rules to this instead of looking it up by name (DND-1522)"
+  value       = var.enable_rds ? module.comet_rds[0].mysql_sg_id : null
+}
+
 output "mysql_log_group_names" {
   description = "CloudWatch log group names for the RDS log groups this module MANAGES, keyed by log type. Superset of what is actively exported — cross-reference mysql_exported_log_types. Needed to build the terraform import address when adopting a cluster whose export was enabled out-of-band (DND-1537)."
   value       = var.enable_rds ? module.comet_rds[0].mysql_log_group_names : null
@@ -92,6 +97,11 @@ output "rds_password_auto_generated" {
   value       = var.enable_rds ? nonsensitive(var.rds_master_password == null) : null
 }
 
+output "redis_sg_id" {
+  description = "Security group ID of the Redis (ElastiCache) replication group — wrappers add ingress rules to this instead of looking it up by name (DND-1522)"
+  value       = var.enable_elasticache ? module.comet_elasticache[0].redis_sg_id : null
+}
+
 output "configure_kubectl" {
   description = "Configure kubectl: run the following command to update your kubeconfig with the newly provisioned cluster."
   value       = var.enable_eks ? "aws eks update-kubeconfig --region ${var.region} --name ${module.comet_eks[0].cluster_name}" : null
Original file line number	Diff line number	Diff line change
`@@ -26,9 +26,8 @@ variable "allowed_sg_ids" {`
`26`	`26`	`}`
`27`	`27`
`28`	`28`	`variable "allowed_cidrs" {`
`29`		`- description = "CIDR blocks allowed to connect to the proxy on the MySQL port (in addition to allowed_sg_ids). Defaults to the agentro VPN client pool so ops queries via VPN reach the proxy directly. Set to [] to allow only SG-based ingress."`
	`29`	`+ description = "CIDR blocks allowed to connect to the proxy on the MySQL port (in addition to allowed_sg_ids). [] allows only SG-based ingress. Required — the root module resolves this from rds_proxy_allowed_cidrs, falling back to vpn_client_cidr; the default lives only there so the two MySQL paths can't diverge."`
`30`	`30`	`type = list(string)`
`31`		`- default = ["10.126.0.0/15"]`
`32`	`31`	`}`
`33`	`32`
`34`	`33`	`variable "mysql_cluster_id" {`