From 5da4d1c11e61ad675158604b6ef27f4c04729eb1 Mon Sep 17 00:00:00 2001
From: Matias <matias.casoli@ingenia.la>
Date: Tue, 21 Jul 2026 14:03:09 -0300
Subject: [PATCH 1/2] feat(agent): expose initContainers, volumes and
 volumeMounts passthrough
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The underlying Helm chart already supports initContainers/volumes/volumeMounts
(e.g. the githubTokenInit pattern), but this module rendered a fixed values.yaml
with no way to reach them. This blocks any sidecar/init-container use case that
needs to run before the agent starts, such as installing a kubelogin exec
plugin wrapper for AAD/OIDC-enabled Kubernetes clusters — currently the only
way to do that is a manual kubectl patch that gets wiped on every helm upgrade.
---
 nullplatform/agent/README.md                  |  3 +++
 nullplatform/agent/locals.tf                  |  3 +++
 .../nullplatform_agent_values.tmpl.yaml       | 15 +++++++++++++
 nullplatform/agent/variables.tf               | 21 +++++++++++++++++++
 4 files changed, 42 insertions(+)

diff --git a/nullplatform/agent/README.md b/nullplatform/agent/README.md
index dfe1afb9..be6a3b2b 100644
--- a/nullplatform/agent/README.md
+++ b/nullplatform/agent/README.md
@@ -156,6 +156,7 @@ resource "example_resource" "this" {
 | <a name="input_image_pull_secrets"></a> [image\_pull\_secrets](#input\_image\_pull\_secrets) | Image pull secrets configuration | `string` | `""` | no |
 | <a name="input_image_repository"></a> [image\_repository](#input\_image\_repository) | Container image repository for the agent. Defaults to the official nullplatform image. | `string` | `""` | no |
 | <a name="input_image_tag"></a> [image\_tag](#input\_image\_tag) | Image tag for the agent container image | `string` | n/a | yes |
+| <a name="input_init_containers"></a> [init\_containers](#input\_init\_containers) | Additional init containers to run before the main agent container (raw Kubernetes container spec, passed through to the Helm chart's initContainers value) | `list(any)` | `[]` | no |
 | <a name="input_init_scripts"></a> [init\_scripts](#input\_init\_scripts) | List of initialization scripts to execute during agent startup | `list(string)` | `[]` | no |
 | <a name="input_initial_ingress_path"></a> [initial\_ingress\_path](#input\_initial\_ingress\_path) | Defines the initial ingress path used when deploying the application for the first time. | `string` | `""` | no |
 | <a name="input_namespace"></a> [namespace](#input\_namespace) | Kubernetes namespace where the nullplatform agent will run | `string` | `"nullplatform-tools"` | no |
@@ -170,6 +171,8 @@ resource "example_resource" "this" {
 | <a name="input_service_template"></a> [service\_template](#input\_service\_template) | Specifies the name or reference of the scope service template to be used for deployment. | `string` | `""` | no |
 | <a name="input_tags_selectors"></a> [tags\_selectors](#input\_tags\_selectors) | Map of tags used to select and filter channels and agents | `map(string)` | n/a | yes |
 | <a name="input_use_account_slug"></a> [use\_account\_slug](#input\_use\_account\_slug) | Flag to determine whether to use account slug in resource naming | `string` | `""` | no |
+| <a name="input_volume_mounts"></a> [volume\_mounts](#input\_volume\_mounts) | Additional volumeMounts to add to the main agent container (raw Kubernetes volumeMount spec, passed through to the Helm chart's volumeMounts value) | `list(any)` | `[]` | no |
+| <a name="input_volumes"></a> [volumes](#input\_volumes) | Additional volumes to add to the agent pod (raw Kubernetes volume spec, passed through to the Helm chart's volumes value) | `list(any)` | `[]` | no |
 <!-- END_TF_DOCS -->
 
 <!-- BEGIN_AI_METADATA
diff --git a/nullplatform/agent/locals.tf b/nullplatform/agent/locals.tf
index ed8354db..7065f746 100644
--- a/nullplatform/agent/locals.tf
+++ b/nullplatform/agent/locals.tf
@@ -104,5 +104,8 @@ locals {
     aws_iam_role_arn     = var.cloud_provider == "aws" ? var.aws_iam_role_arn : ""
     init_scripts         = var.init_scripts
     service_account_name = var.service_account_name
+    init_containers      = var.init_containers
+    volumes              = var.volumes
+    volume_mounts        = var.volume_mounts
   })
 }
diff --git a/nullplatform/agent/templates/nullplatform_agent_values.tmpl.yaml b/nullplatform/agent/templates/nullplatform_agent_values.tmpl.yaml
index ef3711ab..3a0b32a9 100644
--- a/nullplatform/agent/templates/nullplatform_agent_values.tmpl.yaml
+++ b/nullplatform/agent/templates/nullplatform_agent_values.tmpl.yaml
@@ -35,3 +35,18 @@ initScripts:
   %{ endfor }
   %{ endif }
 
+  %{ if length(init_containers) > 0 }
+initContainers:
+${yamlencode(init_containers)}
+  %{ endif }
+
+  %{ if length(volumes) > 0 }
+volumes:
+${yamlencode(volumes)}
+  %{ endif }
+
+  %{ if length(volume_mounts) > 0 }
+volumeMounts:
+${yamlencode(volume_mounts)}
+  %{ endif }
+
diff --git a/nullplatform/agent/variables.tf b/nullplatform/agent/variables.tf
index 20380c26..5a9221d1 100644
--- a/nullplatform/agent/variables.tf
+++ b/nullplatform/agent/variables.tf
@@ -234,3 +234,24 @@ variable "extra_envs" {
   type        = map(string)
   default     = {}
 }
+
+# Additional init containers to run before the main agent container (raw container spec, passed through to the chart's initContainers value)
+variable "init_containers" {
+  description = "Additional init containers to run before the main agent container (raw Kubernetes container spec, passed through to the Helm chart's initContainers value)"
+  type        = list(any)
+  default     = []
+}
+
+# Additional volumes to add to the agent pod (raw volume spec, passed through to the chart's volumes value)
+variable "volumes" {
+  description = "Additional volumes to add to the agent pod (raw Kubernetes volume spec, passed through to the Helm chart's volumes value)"
+  type        = list(any)
+  default     = []
+}
+
+# Additional volumeMounts to add to the main agent container (raw volumeMount spec, passed through to the chart's volumeMounts value)
+variable "volume_mounts" {
+  description = "Additional volumeMounts to add to the main agent container (raw Kubernetes volumeMount spec, passed through to the Helm chart's volumeMounts value)"
+  type        = list(any)
+  default     = []
+}

From ea0fffb5b494f685211038ce54a53adc4142764f Mon Sep 17 00:00:00 2001
From: Matias <matias.casoli@ingenia.la>
Date: Tue, 21 Jul 2026 14:27:55 -0300
Subject: [PATCH 2/2] test(agent): add rendered_values output and plan tests
 for new passthroughs

Mirrors the base module's rendered_values/tftest.hcl pattern so
init_containers/volumes/volume_mounts have plan-time coverage.
---
 nullplatform/agent/README.md                  |  6 ++
 nullplatform/agent/outputs.tf                 |  9 ++
 .../agent/tests/agent_values.tftest.hcl       | 97 +++++++++++++++++++
 3 files changed, 112 insertions(+)
 create mode 100644 nullplatform/agent/outputs.tf
 create mode 100644 nullplatform/agent/tests/agent_values.tftest.hcl

diff --git a/nullplatform/agent/README.md b/nullplatform/agent/README.md
index be6a3b2b..3a3a7ed1 100644
--- a/nullplatform/agent/README.md
+++ b/nullplatform/agent/README.md
@@ -173,6 +173,12 @@ resource "example_resource" "this" {
 | <a name="input_use_account_slug"></a> [use\_account\_slug](#input\_use\_account\_slug) | Flag to determine whether to use account slug in resource naming | `string` | `""` | no |
 | <a name="input_volume_mounts"></a> [volume\_mounts](#input\_volume\_mounts) | Additional volumeMounts to add to the main agent container (raw Kubernetes volumeMount spec, passed through to the Helm chart's volumeMounts value) | `list(any)` | `[]` | no |
 | <a name="input_volumes"></a> [volumes](#input\_volumes) | Additional volumes to add to the agent pod (raw Kubernetes volume spec, passed through to the Helm chart's volumes value) | `list(any)` | `[]` | no |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| <a name="output_rendered_values"></a> [rendered\_values](#output\_rendered\_values) | The rendered Helm values passed to the agent chart. |
 <!-- END_TF_DOCS -->
 
 <!-- BEGIN_AI_METADATA
diff --git a/nullplatform/agent/outputs.tf b/nullplatform/agent/outputs.tf
new file mode 100644
index 00000000..8f3ce193
--- /dev/null
+++ b/nullplatform/agent/outputs.tf
@@ -0,0 +1,9 @@
+############################################
+# Rendered Helm Values (used in tests)
+############################################
+
+output "rendered_values" {
+  description = "The rendered Helm values passed to the agent chart."
+  value       = local.nullplatform_agent_values
+  sensitive   = true
+}
diff --git a/nullplatform/agent/tests/agent_values.tftest.hcl b/nullplatform/agent/tests/agent_values.tftest.hcl
new file mode 100644
index 00000000..1645f965
--- /dev/null
+++ b/nullplatform/agent/tests/agent_values.tftest.hcl
@@ -0,0 +1,97 @@
+mock_provider "helm" {}
+
+variables {
+  api_key              = "test-api-key"
+  cluster_name         = "test-cluster"
+  nrn                  = "organization=1:account=2:namespace=3"
+  tags_selectors       = { environment = "test" }
+  image_tag            = "latest"
+  cloud_provider       = "gcp"
+  private_gateway_name = ""
+  private_domain       = ""
+}
+
+############################################
+# initContainers
+############################################
+
+run "init_containers_omitted_by_default" {
+  command = plan
+
+  assert {
+    condition     = !strcontains(output.rendered_values, "initContainers:")
+    error_message = "initContainers block should be omitted when init_containers is empty"
+  }
+}
+
+run "init_containers_rendered" {
+  command = plan
+
+  variables {
+    init_containers = [
+      {
+        name  = "kubelogin-install"
+        image = "busybox:1.36"
+        volumeMounts = [
+          { name = "kubelogin-bin", mountPath = "/shared" }
+        ]
+      }
+    ]
+  }
+
+  assert {
+    condition     = strcontains(output.rendered_values, "initContainers:")
+    error_message = "initContainers block should be present when init_containers is non-empty"
+  }
+
+  assert {
+    condition     = strcontains(output.rendered_values, "\"name\": \"kubelogin-install\"")
+    error_message = "init container name should be rendered"
+  }
+}
+
+############################################
+# volumes / volumeMounts
+############################################
+
+run "volumes_and_volume_mounts_omitted_by_default" {
+  command = plan
+
+  assert {
+    condition     = !strcontains(output.rendered_values, "\nvolumes:")
+    error_message = "volumes block should be omitted when volumes is empty"
+  }
+
+  assert {
+    condition     = !strcontains(output.rendered_values, "volumeMounts:")
+    error_message = "volumeMounts block should be omitted when volume_mounts is empty"
+  }
+}
+
+run "volumes_and_volume_mounts_rendered" {
+  command = plan
+
+  variables {
+    volumes = [
+      { name = "kubelogin-bin", emptyDir = {} }
+    ]
+    volume_mounts = [
+      { name = "kubelogin-bin", mountPath = "/usr/local/bin/kubelogin", subPath = "kubelogin" }
+    ]
+  }
+
+  assert {
+    condition     = strcontains(output.rendered_values, "\nvolumes:")
+    error_message = "volumes block should be present when volumes is non-empty"
+  }
+
+  assert {
+    condition     = strcontains(output.rendered_values, "volumeMounts:")
+    error_message = "volumeMounts block should be present when volume_mounts is non-empty"
+  }
+
+  assert {
+    condition     = strcontains(output.rendered_values, "\"mountPath\": \"/usr/local/bin/kubelogin\"")
+    error_message = "volume mount path should be rendered"
+  }
+}