nullplatform · sebastiancorrea81 · Aug 7, 2026 · Aug 7, 2026 · Aug 7, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -14,6 +14,7 @@
 * **azure/vnet:** let a subnet declare its route table ([#475](https://github.com/nullplatform/tofu-modules/issues/475)) ([d2a5faf](https://github.com/nullplatform/tofu-modules/commit/d2a5faf83e8f3297503f961e30a0a3d5b60ae015))
 * **docs:** update usage example to a current release tag ([a167934](https://github.com/nullplatform/tofu-modules/commit/a167934eaa22e97d3a704c1cb1f00ffe731d8ca3))
 * **docs:** update usage example to a current release tag ([#484](https://github.com/nullplatform/tofu-modules/issues/484)) ([ed6f5b0](https://github.com/nullplatform/tofu-modules/commit/ed6f5b06a907ef538c3cb44cb1614e9474414de9))
+* **nullplatform:** fail template fetches that do not return 200 ([#482](https://github.com/nullplatform/tofu-modules/issues/482)) ([c47b78b](https://github.com/nullplatform/tofu-modules/commit/c47b78bcf1c46f40304208637d50b3eb81577844))
 
 ## [6.10.0](https://github.com/nullplatform/tofu-modules/compare/v6.9.0...v6.10.0) (2026-08-07)
 

diff --git a/infrastructure/aws/eks/README.md b/infrastructure/aws/eks/README.md
@@ -80,7 +80,6 @@ resource "example_resource" "this" {
 | <a name="input_attach_cluster_primary_security_group"></a> [attach\_cluster\_primary\_security\_group](#input\_attach\_cluster\_primary\_security\_group) | Attach cluster primary security group to node groups | `bool` | `true` | no |
 | <a name="input_authentication_mode"></a> [authentication\_mode](#input\_authentication\_mode) | Authentication mode for the EKS cluster. Valid values: CONFIG\_MAP, API, API\_AND\_CONFIG\_MAP. | `string` | `"API_AND_CONFIG_MAP"` | no |
 | <a name="input_auto_mode_node_pools"></a> [auto\_mode\_node\_pools](#input\_auto\_mode\_node\_pools) | Node pools for Auto Mode. Valid values are 'general-purpose' and 'system'. | `list(string)` | <pre>[<br/>  "general-purpose",<br/>  "system"<br/>]</pre> | no |
-| <a name="input_aws_profile"></a> [aws\_profile](#input\_aws\_profile) | Optional AWS CLI profile used by the kubernetes provider's exec plugin (`aws eks get-token`) to authenticate against the cluster. If empty, the default AWS credential chain (or the AWS\_PROFILE environment variable) is used. | `string` | `""` | no |
 | <a name="input_aws_subnets_private_ids"></a> [aws\_subnets\_private\_ids](#input\_aws\_subnets\_private\_ids) | List of private subnet IDs for the EKS cluster and node groups | `list(string)` | n/a | yes |
 | <a name="input_aws_vpc_vpc_id"></a> [aws\_vpc\_vpc\_id](#input\_aws\_vpc\_vpc\_id) | VPC ID where the EKS cluster will be deployed | `string` | n/a | yes |
 | <a name="input_cloudwatch_log_group_retention_in_days"></a> [cloudwatch\_log\_group\_retention\_in\_days](#input\_cloudwatch\_log\_group\_retention\_in\_days) | Number of days to retain log events in the CloudWatch log group | `number` | `90` | no |

diff --git a/infrastructure/azure/vnet/README.md b/infrastructure/azure/vnet/README.md
@@ -2,19 +2,17 @@
 
 ## Description
 
-Creates an Azure Virtual Network with configurable subnets using the Azure Verified Module for network virtual networks
+Creates an Azure virtual network with specified address space and subnets
 
 ## Architecture
 
-The module wraps the azure/avm-res-network-virtualnetwork/azurerm AVM module, passing address_space, name, location, and tags directly into it while constructing the parent_id from the subscription_id and resource_group_name inputs. The subnets_definition map is forwarded to the AVM module's subnets argument, which internally provisions azurerm_subnet resources with optional route table associations. Outputs derive from the AVM module's resource_id and name attributes, with subnet_ids computed by interpolating subnet names against the virtual network resource ID.
+This module creates an Azure virtual network using the azurerm provider and configures it with the specified address space and subnets. The virtual network is created in the specified resource group and location. The module uses the avm_res_network_virtualnetwork module from the azure registry to create the virtual network and its subnets. The module also outputs the resource ID of the virtual network, its name, and a map of subnet names to their resource IDs.
 
 ## Features
 
-- Creates an Azure Virtual Network with one or more CIDR address spaces
-- Provisions multiple subnets with configurable address prefixes via a flexible map input
-- Supports optional route table association per subnet to preserve existing routing configurations
-- Outputs a computed map of subnet names to their full Azure resource IDs
-- Applies resource tags to all virtual network resources
+- Creates Azure virtual network with specified address space
+- Configures subnets within the virtual network
+- Supports custom tagging of virtual network resources
 
 ## Basic Usage
 
@@ -61,7 +59,7 @@ resource "example_resource" "this" {
 | <a name="input_address_space"></a> [address\_space](#input\_address\_space) | The address space (CIDR blocks) for the virtual network (e.g., ["10.0.0.0/16"]) | `set(string)` | n/a | yes |
 | <a name="input_location"></a> [location](#input\_location) | The Azure region where the virtual network will be created (e.g., eastus, westus2) | `string` | n/a | yes |
 | <a name="input_resource_group_name"></a> [resource\_group\_name](#input\_resource\_group\_name) | The name of the resource group where the virtual network will be created | `string` | n/a | yes |
-| <a name="input_subnets_definition"></a> [subnets\_definition](#input\_subnets\_definition) | A map of subnets to create within the virtual network. Each subnet requires<br/>a name and address\_prefixes, and may set route\_table to associate an<br/>existing route table. | <pre>map(object({<br/>    name             = string<br/>    address_prefixes = list(string)<br/><br/>    # The AVM submodule accepts this and always renders the field, so leaving it<br/>    # out is an explicit `routeTable: null` -- i.e. a detach -- not an omission.<br/>    # On an AKS kubenet subnet that means every plan proposes to strip the route<br/>    # table AKS attached, which is why `aks_route_table` has to keep putting it<br/>    # back. Declaring it here lets the subnet own what it actually has.<br/>    route_table = optional(object({<br/>      id = string<br/>    }))<br/>  }))</pre> | n/a | yes |
+| <a name="input_subnets_definition"></a> [subnets\_definition](#input\_subnets\_definition) | A map of subnets to create within the virtual network. Each subnet requires a name and address\_prefixes. | <pre>map(object({<br/>    name             = string<br/>    address_prefixes = list(string)<br/>  }))</pre> | n/a | yes |
 | <a name="input_subscription_id"></a> [subscription\_id](#input\_subscription\_id) | The ID of the Azure subscription | `string` | n/a | yes |
 | <a name="input_tags"></a> [tags](#input\_tags) | A mapping of tags to assign to the virtual network resources | `map(string)` | `{}` | no |
 | <a name="input_vnet_name"></a> [vnet\_name](#input\_vnet\_name) | The name of the virtual network | `string` | n/a | yes |
@@ -78,14 +76,12 @@ resource "example_resource" "this" {
 <!-- BEGIN_AI_METADATA
 {
   "name": "vnet",
-  "description": "Creates an Azure Virtual Network with configurable subnets using the Azure Verified Module for network virtual networks",
-  "architecture": "The module wraps the azure/avm-res-network-virtualnetwork/azurerm AVM module, passing address_space, name, location, and tags directly into it while constructing the parent_id from the subscription_id and resource_group_name inputs. The subnets_definition map is forwarded to the AVM module's subnets argument, which internally provisions azurerm_subnet resources with optional route table associations. Outputs derive from the AVM module's resource_id and name attributes, with subnet_ids computed by interpolating subnet names against the virtual network resource ID.",
+  "description": "Creates an Azure virtual network with specified address space and subnets",
+  "architecture": "This module creates an Azure virtual network using the azurerm provider and configures it with the specified address space and subnets. The virtual network is created in the specified resource group and location. The module uses the avm_res_network_virtualnetwork module from the azure registry to create the virtual network and its subnets. The module also outputs the resource ID of the virtual network, its name, and a map of subnet names to their resource IDs.",
   "features": [
-    "Creates an Azure Virtual Network with one or more CIDR address spaces",
-    "Provisions multiple subnets with configurable address prefixes via a flexible map input",
-    "Supports optional route table association per subnet to preserve existing routing configurations",
-    "Outputs a computed map of subnet names to their full Azure resource IDs",
-    "Applies resource tags to all virtual network resources"
+    "Creates Azure virtual network with specified address space",
+    "Configures subnets within the virtual network",
+    "Supports custom tagging of virtual network resources"
   ],
   "inputs": [
     {
@@ -110,7 +106,7 @@ resource "example_resource" "this" {
     },
     {
       "name": "subnets_definition",
-      "description": "",
+      "description": "A map of subnets to create within the virtual network. Each subnet requires a name and address_prefixes.",
       "required": true
     },
     {
@@ -129,6 +125,6 @@ resource "example_resource" "this" {
     "vnet_name",
     "subnet_ids"
   ],
-  "hash": "6e0c66f2c0f455a2b357a8d2e0d56ae8"
+  "hash": "fd524b5a584382c1be860e9b6871644c"
 }
 END_AI_METADATA -->
diff --git a/nullplatform/agent/README.md b/nullplatform/agent/README.md
@@ -2,21 +2,21 @@
 
 ## Description
 
-Deploys the nullplatform agent to a Kubernetes cluster via a Helm chart with cloud-provider-specific configuration for AWS, GCP, Azure, and OCI
+Deploys the Nullplatform agent to a Kubernetes cluster via a Helm release with multi-cloud provider support
 
 ## Architecture
 
-The module uses a helm_release resource to deploy the nullplatform-agent chart from the official nullplatform Helm repository into a configurable Kubernetes namespace. A templatefile renders a YAML values file (nullplatform_agent_values.tmpl.yaml) that merges default agent configuration with cloud-provider-specific environment variables and CLI arguments resolved in locals.tf. A terraform_data resource tracks the api_key input to trigger Helm release replacement when the key rotates, while a second terraform_data resource enforces cross-variable preconditions ensuring cloud-specific variables are present. An optional worker block is encoded as a second Helm values layer and appended to the release when provided.
+The module renders a Helm values file using a templatefile() call that merges default configuration, cloud-specific environment variables, and extra envs into a single locals map. A helm_release resource named 'agent' deploys the 'nullplatform-agent' chart from the official Nullplatform Helm repository into the specified Kubernetes namespace, consuming the rendered values. A terraform_data resource tracks the api_key as a replace trigger, forcing pod recreation when the API key changes. Cross-provider variable validation is enforced via terraform_data preconditions that gate cloud-specific required inputs like aws_iam_role_arn and azure_* credentials before the Helm release proceeds.
 
 ## Features
 
-- Deploys nullplatform-agent Helm chart with atomic, self-healing release settings including cleanup_on_fail and recreate_pods
-- Configures cloud-provider-specific environment variables and CLI arguments for AWS, GCP, Azure, and OCI targets
-- Injects AWS IAM role ARN annotation into the Kubernetes ServiceAccount for IRSA-based workload identity on AWS
-- Passes Azure service principal credentials (client ID, secret, tenant, subscription) as agent environment variables for Azure deployments
-- Merges agent repository scope list and extra Git repositories into a deduplicated comma-separated AGENT_REPOS argument
-- Supports optional worker-orchestration configuration via a structured any-typed variable rendered as a second Helm values layer
-- Triggers full Helm release replacement via terraform_data lifecycle when the API key value changes
+- Deploys nullplatform-agent Helm chart with atomic install and automatic cleanup on failure
+- Configures multi-cloud provider support for AWS, GCP, Azure, and OCI with provider-specific environment variable injection
+- Creates Kubernetes namespace automatically if it does not already exist
+- Injects NRN-parsed organization, account, and namespace tags into the agent configuration
+- Merges scope repository, extra Git repositories, and deduplicates the final agent repo list
+- Forces pod recreation via terraform_data trigger when the API key is rotated
+- Supports custom init scripts, image pull secrets, and additional environment variables for agent customization
 
 ## Basic Usage
 
@@ -33,7 +33,7 @@ module "agent" {
 }
 ```
 
-### Usage with AWS Deployment
+### Usage with AWS Cloud Provider
 
 ```hcl
 module "agent" {
@@ -49,7 +49,7 @@ module "agent" {
 }
 ```
 
-### Usage with GCP Deployment
+### Usage with GCP Cloud Provider
 
 ```hcl
 module "agent" {
@@ -64,7 +64,7 @@ module "agent" {
 }
 ```
 
-### Usage with Azure Deployment
+### Usage with Azure Cloud Provider
 
 ```hcl
 module "agent" {
@@ -87,7 +87,7 @@ module "agent" {
 }
 ```
 
-### Usage with OCI Deployment
+### Usage with OCI Cloud Provider
 
 ```hcl
 module "agent" {
@@ -160,7 +160,7 @@ resource "example_resource" "this" {
 | <a name="input_initial_ingress_path"></a> [initial\_ingress\_path](#input\_initial\_ingress\_path) | Defines the initial ingress path used when deploying the application for the first time. | `string` | `""` | no |
 | <a name="input_namespace"></a> [namespace](#input\_namespace) | Kubernetes namespace where the nullplatform agent will run | `string` | `"nullplatform-tools"` | no |
 | <a name="input_nrn"></a> [nrn](#input\_nrn) | Nullplatform Resource Name - unique identifier for nullplatform resources | `string` | n/a | yes |
-| <a name="input_nullplatform_agent_helm_version"></a> [nullplatform\_agent\_helm\_version](#input\_nullplatform\_agent\_helm\_version) | Version of the nullplatform agent Helm chart to deploy | `string` | `"2.37.0"` | no |
+| <a name="input_nullplatform_agent_helm_version"></a> [nullplatform\_agent\_helm\_version](#input\_nullplatform\_agent\_helm\_version) | Version of the nullplatform agent Helm chart to deploy | `string` | `"2.29.2"` | no |
 | <a name="input_private_domain"></a> [private\_domain](#input\_private\_domain) | Private domain name used for internal agent routing | `string` | `""` | no |
 | <a name="input_private_gateway_name"></a> [private\_gateway\_name](#input\_private\_gateway\_name) | Private gateway name for Azure networking | `string` | `null` | no |
 | <a name="input_private_hosted_zone_rg"></a> [private\_hosted\_zone\_rg](#input\_private\_hosted\_zone\_rg) | Resource group for private hosted zone | `string` | `null` | no |
@@ -170,22 +170,21 @@ resource "example_resource" "this" {
 | <a name="input_service_template"></a> [service\_template](#input\_service\_template) | Specifies the name or reference of the scope service template to be used for deployment. | `string` | `""` | no |
 | <a name="input_tags_selectors"></a> [tags\_selectors](#input\_tags\_selectors) | Map of tags used to select and filter channels and agents | `map(string)` | n/a | yes |
 | <a name="input_use_account_slug"></a> [use\_account\_slug](#input\_use\_account\_slug) | Flag to determine whether to use account slug in resource naming | `string` | `""` | no |
-| <a name="input_worker"></a> [worker](#input\_worker) | Worker-orchestration config, merged into the agent chart's `worker` block:<br/>backend, security, allowedRegistries (deny-by-default registry guardrail),<br/>patches (standard k8s patching of workers — the preferred way to shape them),<br/>idleTTL (reap idle workers), and the legacy defaults/rules/pins. See the<br/>nullplatform-agent chart values (>= 2.37.0) for the full shape. null = chart<br/>defaults.<br/><br/>Example:<br/>  worker = {<br/>    allowedRegistries = ["public.ecr.aws/your-org/*"]<br/>    patches           = [{ target = { package = "my-pkg" }, merge = { spec = { serviceAccountName = "np-agent-sa" } } }]<br/>    idleTTL           = "30m"<br/>  } | `any` | `null` | no |
 <!-- END_TF_DOCS -->
 
 <!-- BEGIN_AI_METADATA
 {
   "name": "agent",
-  "description": "Deploys the nullplatform agent to a Kubernetes cluster via a Helm chart with cloud-provider-specific configuration for AWS, GCP, Azure, and OCI",
-  "architecture": "The module uses a helm_release resource to deploy the nullplatform-agent chart from the official nullplatform Helm repository into a configurable Kubernetes namespace. A templatefile renders a YAML values file (nullplatform_agent_values.tmpl.yaml) that merges default agent configuration with cloud-provider-specific environment variables and CLI arguments resolved in locals.tf. A terraform_data resource tracks the api_key input to trigger Helm release replacement when the key rotates, while a second terraform_data resource enforces cross-variable preconditions ensuring cloud-specific variables are present. An optional worker block is encoded as a second Helm values layer and appended to the release when provided.",
+  "description": "Deploys the Nullplatform agent to a Kubernetes cluster via a Helm release with multi-cloud provider support",
+  "architecture": "The module renders a Helm values file using a templatefile() call that merges default configuration, cloud-specific environment variables, and extra envs into a single locals map. A helm_release resource named 'agent' deploys the 'nullplatform-agent' chart from the official Nullplatform Helm repository into the specified Kubernetes namespace, consuming the rendered values. A terraform_data resource tracks the api_key as a replace trigger, forcing pod recreation when the API key changes. Cross-provider variable validation is enforced via terraform_data preconditions that gate cloud-specific required inputs like aws_iam_role_arn and azure_* credentials before the Helm release proceeds.",
   "features": [
-    "Deploys nullplatform-agent Helm chart with atomic, self-healing release settings including cleanup_on_fail and recreate_pods",
-    "Configures cloud-provider-specific environment variables and CLI arguments for AWS, GCP, Azure, and OCI targets",
-    "Injects AWS IAM role ARN annotation into the Kubernetes ServiceAccount for IRSA-based workload identity on AWS",
-    "Passes Azure service principal credentials (client ID, secret, tenant, subscription) as agent environment variables for Azure deployments",
-    "Merges agent repository scope list and extra Git repositories into a deduplicated comma-separated AGENT_REPOS argument",
-    "Supports optional worker-orchestration configuration via a structured any-typed variable rendered as a second Helm values layer",
-    "Triggers full Helm release replacement via terraform_data lifecycle when the API key value changes"
+    "Deploys nullplatform-agent Helm chart with atomic install and automatic cleanup on failure",
+    "Configures multi-cloud provider support for AWS, GCP, Azure, and OCI with provider-specific environment variable injection",
+    "Creates Kubernetes namespace automatically if it does not already exist",
+    "Injects NRN-parsed organization, account, and namespace tags into the agent configuration",
+    "Merges scope repository, extra Git repositories, and deduplicates the final agent repo list",
+    "Forces pod recreation via terraform_data trigger when the API key is rotated",
+    "Supports custom init scripts, image pull secrets, and additional environment variables for agent customization"
   ],
   "inputs": [
     {
@@ -233,11 +232,6 @@ resource "example_resource" "this" {
       "description": "Version of the nullplatform agent Helm chart to deploy",
       "required": false
     },
-    {
-      "name": "worker",
-      "description": "",
-      "required": false
-    },
     {
       "name": "namespace",
       "description": "Kubernetes namespace where the nullplatform agent will run",
@@ -355,6 +349,6 @@ resource "example_resource" "this" {
     }
   ],
   "outputs": [],
-  "hash": "719722f8938eb34fee9cc16fb93cc436"
+  "hash": "e0d42905b16b6cea2f88a15d3dda544a"
 }
 END_AI_METADATA -->