From aa7f1b21688fa05f85551e70da442ce676ae0f29 Mon Sep 17 00:00:00 2001 From: Philipp Strube Date: Fri, 27 Feb 2026 17:27:49 +0100 Subject: [PATCH] Fix file name deviations between modules --- AGENTS.md | 4 ++-- DEVIATIONS.md | 8 -------- aws/cluster/{vpc.tf => network.tf} | 0 aws/cluster/node-pool/{vpc.tf => network.tf} | 0 azurerm/cluster/{vnet.tf => network.tf} | 0 google/cluster/node-pool/locals.tf | 12 ------------ google/cluster/node-pool/main.tf | 11 +++++++++++ 7 files changed, 13 insertions(+), 22 deletions(-) rename aws/cluster/{vpc.tf => network.tf} (100%) rename aws/cluster/node-pool/{vpc.tf => network.tf} (100%) rename azurerm/cluster/{vnet.tf => network.tf} (100%) delete mode 100644 google/cluster/node-pool/locals.tf diff --git a/AGENTS.md b/AGENTS.md index 07322d58..b6fb491c 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -172,7 +172,7 @@ Every module MUST use the following file layout. Do NOT consolidate these files | `main.tf` | All modules | Configuration module call, metadata module call, and the module's primary resource (cluster or node-pool resource). | | `variables.tf` | All modules | All input variable definitions. | | `outputs.tf` | All modules | All output definitions. | -| `moved.tf` | All modules | All `moved` blocks. No other content. | +| `moved.tf` | When required | All `moved` blocks. No other content. Create this file only when the module has at least one `moved` block. Do not create an empty `moved.tf`. | | `versions.tf` | All modules | Provider requirements and minimum OpenTofu/Terraform version constraint. | | `network.tf` | Cluster modules | All network resources (VPC, subnets, route tables, gateways, and any other provider-required network constructs). | | `kubeconfig.tf` | Cluster modules | Kubeconfig local value. See Kubeconfig Generation section. | @@ -189,7 +189,7 @@ Every module MUST use the following file layout. Do NOT consolidate these files **`moved` block rule:** -When a resource is renamed or moved, add a `moved` block to `moved.tf`. MUST NOT run `tofu state mv` (or `terraform state mv`) — Kubestack releases modules, not managed infrastructure, so any state operation would only affect `tests/` and would not be portable to downstream module users who manage their own state. +When a resource is renamed or moved, add a `moved` block to `moved.tf`. Create `moved.tf` only when the module has at least one `moved` block — do NOT create an empty `moved.tf` as a placeholder. MUST NOT run `tofu state mv` (or `terraform state mv`) — Kubestack releases modules, not managed infrastructure, so any state operation would only affect `tests/` and would not be portable to downstream module users who manage their own state. If a rename or move cannot be expressed as a declarative `moved` block, it is a breaking change. Past the v1 release, breaking changes MUST be avoided. When a pre-v1 breaking change is unavoidable, document the required manual `tofu state mv` command as an explicit migration step in the release notes. diff --git a/DEVIATIONS.md b/DEVIATIONS.md index 88d4fba3..055e09e4 100644 --- a/DEVIATIONS.md +++ b/DEVIATIONS.md @@ -19,8 +19,6 @@ When a divergence is resolved, remove its entry from this file. > **Divergence — `azurerm/cluster`:** Cluster API Authentication — the kubeconfig output uses a client certificate issued via `kube_admin_config` rather than a short-lived Azure AD / Entra ID token, violating the rule that static long-lived credentials must be disabled. Planned resolution: switch to Azure AD / Entra ID token-based authentication in the v1 release. -> **Divergence — `azurerm/cluster`:** Networking — network resources are placed in `vnet.tf` instead of the required `network.tf`. Planned resolution: rename `vnet.tf` to `network.tf` in the v1 release. - > **Divergence — `azurerm/cluster`:** Networking — the VNet and subnet are only created when `network_plugin = "azure"`; when the default `"kubenet"` plugin is used no dedicated network resources are provisioned by the module, violating the rule that every cluster module MUST create its own dedicated network resources. Planned resolution: always provision a VNet and subnet in the v1 release. > **Divergence — `azurerm/cluster`:** Networking — CIDR Defaults — `service_cidr`, `dns_service_ip`, and `pod_cidr` are given hardcoded Kubestack defaults (`10.0.0.0/16`, `10.0.0.10`, `10.244.0.0/16`) even though AKS accepts but does not require these arguments; the rule requires passing `null` to let the provider apply its own defaults. Planned resolution: remove the hardcoded defaults and pass `null` in the v1 release. @@ -41,10 +39,6 @@ When a divergence is resolved, remove its entry from this file. > **Divergence — `azurerm/cluster`:** Cluster Module Outputs — the cluster module exposes `aks_vnet` and `default_ingress_ip` outputs beyond the four required outputs, without compelling provider-specific justification. Planned resolution: evaluate for removal in the v1 release. -> **Divergence — `aws/cluster`:** Networking — network resources are placed in `vpc.tf` instead of the required `network.tf`. Planned resolution: rename `vpc.tf` to `network.tf` in the v1 release. - -> **Divergence — `aws/cluster/node-pool`:** Networking — network resources are placed in `vpc.tf` instead of the required `network.tf`. Planned resolution: rename `vpc.tf` to `network.tf` in the v1 release. - > **Divergence — `aws/cluster`:** Networking — nodes are assigned public IPs by default (`map_public_ip_on_launch = true` is the default when `cluster_vpc_subnet_map_public_ip` is unset), violating the rule that nodes MUST be configured with private IPs only by default and egress MUST route through NAT gateways. Planned resolution: flip the default to private nodes with NAT gateway egress in the v1 release. > **Divergence — `aws/cluster`:** Cross-Provider Developer Experience — there is no `region` configuration attribute; the AWS region is sourced entirely from the provider configuration rather than being exposed as a required configuration attribute with a `precondition`. Planned resolution: add a `region` configuration attribute and precondition in the v1 release. @@ -79,8 +73,6 @@ When a divergence is resolved, remove its entry from this file. > **Divergence — `google/cluster`:** Required File Layout — `provider.tf` contains the data source `data.google_client_config.default`, which is used by both `kubeconfig.tf` and the kubernetes provider alias block in the same file; per the data source placement rule, a data source used by multiple resources belongs in `data_sources.tf`, not co-located with a provider block. Planned resolution: move the data source to `data_sources.tf` in the v1 release. -> **Divergence — `scaleway/cluster` and `scaleway/cluster/node-pool`:** Required File Layout — neither module contains a `moved.tf` file, violating the rule that every module MUST have a `moved.tf`. Planned resolution: add empty `moved.tf` files in the v1 release. - > **Divergence — `scaleway/cluster`:** Configuration Inheritance — `precondition` lifecycle blocks are absent from `scaleway_k8s_cluster` for required attributes (`region`, `cluster_version`), violating the rule that required attributes with no module default must be guarded by a precondition on the primary resource. Planned resolution: add preconditions in the v1 release. > **Divergence — `scaleway/cluster/node-pool`:** Configuration Inheritance — `precondition` lifecycle blocks are absent from `scaleway_k8s_pool` for required attributes (`zones`, `node_type`, `min_size`, `max_size`), violating the rule that required attributes with no module default must be guarded by a precondition on the primary resource. Planned resolution: add preconditions in the v1 release. diff --git a/aws/cluster/vpc.tf b/aws/cluster/network.tf similarity index 100% rename from aws/cluster/vpc.tf rename to aws/cluster/network.tf diff --git a/aws/cluster/node-pool/vpc.tf b/aws/cluster/node-pool/network.tf similarity index 100% rename from aws/cluster/node-pool/vpc.tf rename to aws/cluster/node-pool/network.tf diff --git a/azurerm/cluster/vnet.tf b/azurerm/cluster/network.tf similarity index 100% rename from azurerm/cluster/vnet.tf rename to azurerm/cluster/network.tf diff --git a/google/cluster/node-pool/locals.tf b/google/cluster/node-pool/locals.tf deleted file mode 100644 index b3872f6a..00000000 --- a/google/cluster/node-pool/locals.tf +++ /dev/null @@ -1,12 +0,0 @@ -locals { - base_oauth_scopes = [ - "https://www.googleapis.com/auth/devstorage.read_only", - "https://www.googleapis.com/auth/logging.write", - "https://www.googleapis.com/auth/monitoring", - "https://www.googleapis.com/auth/servicecontrol", - "https://www.googleapis.com/auth/service.management.readonly", - "https://www.googleapis.com/auth/trace.append", - ] - - oauth_scopes = compact(concat(local.base_oauth_scopes, try(coalesce(local.cfg.extra_oauth_scopes, null), []))) -} diff --git a/google/cluster/node-pool/main.tf b/google/cluster/node-pool/main.tf index 8e18cc53..435ea7dc 100644 --- a/google/cluster/node-pool/main.tf +++ b/google/cluster/node-pool/main.tf @@ -8,6 +8,17 @@ locals { cfg = module.configuration.merged[terraform.workspace] disable_per_node_pool_service_account = local.cfg.service_account_email == null ? false : true + + base_oauth_scopes = [ + "https://www.googleapis.com/auth/devstorage.read_only", + "https://www.googleapis.com/auth/logging.write", + "https://www.googleapis.com/auth/monitoring", + "https://www.googleapis.com/auth/servicecontrol", + "https://www.googleapis.com/auth/service.management.readonly", + "https://www.googleapis.com/auth/trace.append", + ] + + oauth_scopes = compact(concat(local.base_oauth_scopes, try(coalesce(local.cfg.extra_oauth_scopes, null), []))) } resource "google_container_node_pool" "current" {