feat(agent): expose initContainers, volumes and volumeMounts passthrough

[serialito74]

What

Adds three new inputs to the nullplatform/agent module — init_containers, volumes, volume_mounts (all list(any), default []) — and renders them into the agent chart's initContainers, volumes, and volumeMounts values via yamlencode(). Nothing renders when the lists are empty, so existing consumers are unaffected.

Why

The underlying Helm chart (nullplatform/helm-charts charts/agent) already supports initContainers, volumes, and volumeMounts — the same mechanism the chart's own githubTokenInit feature builds on — but this module renders a fixed values.yaml with no way to reach them.

This blocks any init-container/sidecar use case that has to run before the agent starts. Concretely: on AAD/OIDC-enabled AKS clusters, the agent needs a kubelogin exec-plugin wrapper installed and a shared volume mounted onto PATH, or every scope/deployment operation fails with spawn kubelogin ENOENT. Today the only way to get that wrapper in is a manual kubectl patch against the agent Deployment — which Helm silently reverts on the next helm upgrade of this module, so it has to be reapplied by hand after every apply.

No chart change is required — helm-charts already accepts these values; only this module's templatefile() needed to pass them through.

Changes

• variables.tf — new init_containers, volumes, volume_mounts inputs
• locals.tf — pass the three into templatefile()
• templates/nullplatform_agent_values.tmpl.yaml — conditional initContainers/volumes/volumeMounts blocks via yamlencode()
• outputs.tf (new) — rendered_values output, mirroring the base module's pattern, so the template can be asserted on in tests
• tests/agent_values.tftest.hcl (new) — plan-time coverage: blocks omitted by default, rendered correctly when set
• README.md — regenerated via terraform-docs

Usage

module "agent" {
  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=<tag>"

  # ...

  init_containers = [
    {
      name    = "kubelogin-install"
      image   = "your-registry/kubelogin-wrapper:latest"
      command = ["sh", "-c", "cp /kubelogin /shared/kubelogin"]
      volumeMounts = [
        { name = "kubelogin-bin", mountPath = "/shared" }
      ]
    }
  ]

  volumes = [
    { name = "kubelogin-bin", emptyDir = {} }
  ]

  volume_mounts = [
    { name = "kubelogin-bin", mountPath = "/usr/local/bin/kubelogin", subPath = "kubelogin" }
  ]

  extra_envs = {
    NP_AGENT_CLIENT_SECRET = var.azure_client_secret
  }
}

Testing

tofu test — 4 passed, 0 failed (init_containers/volumes/volumeMounts omitted by default; rendered correctly when set). Rendered template output also validated against a Python YAML parser to confirm chart-shape correctness (initContainers/volumes/volumeMounts at root, list-of-maps intact). tofu fmt clean.