From 0733cab8c47db065fb26614792d8468c7950053b Mon Sep 17 00:00:00 2001
From: Agustin Celentano <12614595+agustincelentano@users.noreply.github.com>
Date: Wed, 1 Jul 2026 17:55:15 -0300
Subject: [PATCH] refactor: move k8s IAM requirements to k8s/requirements/aws
 and rename role

Move the k8s permissions-role module from k8s/specs/tofu to k8s/requirements/aws,
aligning with the lambda/static-files requirements layout. Rename the default
permissions role to nullplatform_<cluster>_k8s_role (was
nullplatform-<cluster>-agent-permissions-role) to follow the
nullplatform_<cluster>_<scope>_role convention.

BREAKING: consumers referencing //k8s/specs/tofu must update the source to
//k8s/requirements/aws.
---
 k8s/{specs/tofu => requirements/aws}/data.tf      | 0
 k8s/{specs/tofu => requirements/aws}/locals.tf    | 2 +-
 k8s/{specs/tofu => requirements/aws}/main.tf      | 0
 k8s/{specs/tofu => requirements/aws}/outputs.tf   | 0
 k8s/{specs/tofu => requirements/aws}/variables.tf | 2 +-
 k8s/{specs/tofu => requirements/aws}/versions.tf  | 0
 6 files changed, 2 insertions(+), 2 deletions(-)
 rename k8s/{specs/tofu => requirements/aws}/data.tf (100%)
 rename k8s/{specs/tofu => requirements/aws}/locals.tf (91%)
 rename k8s/{specs/tofu => requirements/aws}/main.tf (100%)
 rename k8s/{specs/tofu => requirements/aws}/outputs.tf (100%)
 rename k8s/{specs/tofu => requirements/aws}/variables.tf (96%)
 rename k8s/{specs/tofu => requirements/aws}/versions.tf (100%)

diff --git a/k8s/specs/tofu/data.tf b/k8s/requirements/aws/data.tf
similarity index 100%
rename from k8s/specs/tofu/data.tf
rename to k8s/requirements/aws/data.tf
diff --git a/k8s/specs/tofu/locals.tf b/k8s/requirements/aws/locals.tf
similarity index 91%
rename from k8s/specs/tofu/locals.tf
rename to k8s/requirements/aws/locals.tf
index 42a8cf3d..b47445c9 100644
--- a/k8s/specs/tofu/locals.tf
+++ b/k8s/requirements/aws/locals.tf
@@ -6,7 +6,7 @@ locals {
   iam_create = var.iam_create_role
 
   # Derived names (overridable via variables)
-  permissions_role_name = var.permissions_role_name != "" ? var.permissions_role_name : "nullplatform-${var.cluster_name}-agent-permissions-role"
+  permissions_role_name = var.permissions_role_name != "" ? var.permissions_role_name : "nullplatform_${var.cluster_name}_k8s_role"
   policies_name_prefix  = var.policies_name_prefix != "" ? var.policies_name_prefix : "nullplatform_${var.cluster_name}"
 
   # Primary agent role trusted by the permissions role. Defaults to the
diff --git a/k8s/specs/tofu/main.tf b/k8s/requirements/aws/main.tf
similarity index 100%
rename from k8s/specs/tofu/main.tf
rename to k8s/requirements/aws/main.tf
diff --git a/k8s/specs/tofu/outputs.tf b/k8s/requirements/aws/outputs.tf
similarity index 100%
rename from k8s/specs/tofu/outputs.tf
rename to k8s/requirements/aws/outputs.tf
diff --git a/k8s/specs/tofu/variables.tf b/k8s/requirements/aws/variables.tf
similarity index 96%
rename from k8s/specs/tofu/variables.tf
rename to k8s/requirements/aws/variables.tf
index 84838ca4..ec1b7df1 100644
--- a/k8s/specs/tofu/variables.tf
+++ b/k8s/requirements/aws/variables.tf
@@ -26,7 +26,7 @@ variable "cluster_name" {
 }
 
 variable "permissions_role_name" {
-  description = "Override for the permissions IAM role name. Defaults to nullplatform-{cluster_name}-agent-permissions-role."
+  description = "Override for the permissions IAM role name. Defaults to nullplatform_{cluster_name}_k8s_role."
   type        = string
   default     = ""
 }
diff --git a/k8s/specs/tofu/versions.tf b/k8s/requirements/aws/versions.tf
similarity index 100%
rename from k8s/specs/tofu/versions.tf
rename to k8s/requirements/aws/versions.tf