Fix file name deviations between modules

AGENTS.md

@@ -172,7 +172,7 @@ Every module MUST use the following file layout. Do NOT consolidate these files
 | `main.tf` | All modules | Configuration module call, metadata module call, and the module's primary resource (cluster or node-pool resource). |
 | `variables.tf` | All modules | All input variable definitions. |
 | `outputs.tf` | All modules | All output definitions. |
-| `moved.tf` | All modules | All `moved` blocks. No other content. |
+| `moved.tf` | When required | All `moved` blocks. No other content. Create this file only when the module has at least one `moved` block. Do not create an empty `moved.tf`. |
 | `versions.tf` | All modules | Provider requirements and minimum OpenTofu/Terraform version constraint. |
 | `network.tf` | Cluster modules | All network resources (VPC, subnets, route tables, gateways, and any other provider-required network constructs). |
 | `kubeconfig.tf` | Cluster modules | Kubeconfig local value. See Kubeconfig Generation section. |
@@ -189,7 +189,7 @@ Every module MUST use the following file layout. Do NOT consolidate these files
 
 **`moved` block rule:**
 
-When a resource is renamed or moved, add a `moved` block to `moved.tf`. MUST NOT run `tofu state mv` (or `terraform state mv`) — Kubestack releases modules, not managed infrastructure, so any state operation would only affect `tests/` and would not be portable to downstream module users who manage their own state.
+When a resource is renamed or moved, add a `moved` block to `moved.tf`. Create `moved.tf` only when the module has at least one `moved` block — do NOT create an empty `moved.tf` as a placeholder. MUST NOT run `tofu state mv` (or `terraform state mv`) — Kubestack releases modules, not managed infrastructure, so any state operation would only affect `tests/` and would not be portable to downstream module users who manage their own state.
 
 If a rename or move cannot be expressed as a declarative `moved` block, it is a breaking change. Past the v1 release, breaking changes MUST be avoided. When a pre-v1 breaking change is unavoidable, document the required manual `tofu state mv` command as an explicit migration step in the release notes.
 

DEVIATIONS.md

@@ -19,8 +19,6 @@ When a divergence is resolved, remove its entry from this file.
 
 > **Divergence — `azurerm/cluster`:** Cluster API Authentication — the kubeconfig output uses a client certificate issued via `kube_admin_config` rather than a short-lived Azure AD / Entra ID token, violating the rule that static long-lived credentials must be disabled. Planned resolution: switch to Azure AD / Entra ID token-based authentication in the v1 release.
 
-> **Divergence — `azurerm/cluster`:** Networking — network resources are placed in `vnet.tf` instead of the required `network.tf`. Planned resolution: rename `vnet.tf` to `network.tf` in the v1 release.
-
 > **Divergence — `azurerm/cluster`:** Networking — the VNet and subnet are only created when `network_plugin = "azure"`; when the default `"kubenet"` plugin is used no dedicated network resources are provisioned by the module, violating the rule that every cluster module MUST create its own dedicated network resources. Planned resolution: always provision a VNet and subnet in the v1 release.
 
 > **Divergence — `azurerm/cluster`:** Networking — CIDR Defaults — `service_cidr`, `dns_service_ip`, and `pod_cidr` are given hardcoded Kubestack defaults (`10.0.0.0/16`, `10.0.0.10`, `10.244.0.0/16`) even though AKS accepts but does not require these arguments; the rule requires passing `null` to let the provider apply its own defaults. Planned resolution: remove the hardcoded defaults and pass `null` in the v1 release.
@@ -41,10 +39,6 @@ When a divergence is resolved, remove its entry from this file.
 
 > **Divergence — `azurerm/cluster`:** Cluster Module Outputs — the cluster module exposes `aks_vnet` and `default_ingress_ip` outputs beyond the four required outputs, without compelling provider-specific justification. Planned resolution: evaluate for removal in the v1 release.
 
-> **Divergence — `aws/cluster`:** Networking — network resources are placed in `vpc.tf` instead of the required `network.tf`. Planned resolution: rename `vpc.tf` to `network.tf` in the v1 release.
-
-> **Divergence — `aws/cluster/node-pool`:** Networking — network resources are placed in `vpc.tf` instead of the required `network.tf`. Planned resolution: rename `vpc.tf` to `network.tf` in the v1 release.
-
 > **Divergence — `aws/cluster`:** Networking — nodes are assigned public IPs by default (`map_public_ip_on_launch = true` is the default when `cluster_vpc_subnet_map_public_ip` is unset), violating the rule that nodes MUST be configured with private IPs only by default and egress MUST route through NAT gateways. Planned resolution: flip the default to private nodes with NAT gateway egress in the v1 release.
 
 > **Divergence — `aws/cluster`:** Cross-Provider Developer Experience — there is no `region` configuration attribute; the AWS region is sourced entirely from the provider configuration rather than being exposed as a required configuration attribute with a `precondition`. Planned resolution: add a `region` configuration attribute and precondition in the v1 release.
@@ -79,8 +73,6 @@ When a divergence is resolved, remove its entry from this file.
 
 > **Divergence — `google/cluster`:** Required File Layout — `provider.tf` contains the data source `data.google_client_config.default`, which is used by both `kubeconfig.tf` and the kubernetes provider alias block in the same file; per the data source placement rule, a data source used by multiple resources belongs in `data_sources.tf`, not co-located with a provider block. Planned resolution: move the data source to `data_sources.tf` in the v1 release.
 
-> **Divergence — `scaleway/cluster` and `scaleway/cluster/node-pool`:** Required File Layout — neither module contains a `moved.tf` file, violating the rule that every module MUST have a `moved.tf`. Planned resolution: add empty `moved.tf` files in the v1 release.
-
 > **Divergence — `scaleway/cluster`:** Configuration Inheritance — `precondition` lifecycle blocks are absent from `scaleway_k8s_cluster` for required attributes (`region`, `cluster_version`), violating the rule that required attributes with no module default must be guarded by a precondition on the primary resource. Planned resolution: add preconditions in the v1 release.
 
 > **Divergence — `scaleway/cluster/node-pool`:** Configuration Inheritance — `precondition` lifecycle blocks are absent from `scaleway_k8s_pool` for required attributes (`zones`, `node_type`, `min_size`, `max_size`), violating the rule that required attributes with no module default must be guarded by a precondition on the primary resource. Planned resolution: add preconditions in the v1 release.

google/cluster/node-pool/main.tf

@@ -8,6 +8,17 @@ locals {
   cfg = module.configuration.merged[terraform.workspace]
 
   disable_per_node_pool_service_account = local.cfg.service_account_email == null ? false : true
+
+  base_oauth_scopes = [
+    "https://www.googleapis.com/auth/devstorage.read_only",
+    "https://www.googleapis.com/auth/logging.write",
+    "https://www.googleapis.com/auth/monitoring",
+    "https://www.googleapis.com/auth/servicecontrol",
+    "https://www.googleapis.com/auth/service.management.readonly",
+    "https://www.googleapis.com/auth/trace.append",
+  ]
+
+  oauth_scopes = compact(concat(local.base_oauth_scopes, try(coalesce(local.cfg.extra_oauth_scopes, null), [])))
 }
 
 resource "google_container_node_pool" "current" {