chore(main): release 8.0.0

CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## [8.0.0](https://github.com/nullplatform/tofu-modules/compare/v7.1.0...v8.0.0) (2026-09-03)
+
+
+### ⚠ BREAKING CHANGES
+
+* DNS_TYPE, DOMAIN, USE_ACCOUNT_SLUG, SERVICE_TEMPLATE, INITIAL_INGRESS_PATH, and BLUE_GREEN_INGRESS_PATH are no longer set on the agent pod's own env — only on the worker's. Callers relying on those keys being present in the agent pod's configuration.values must move that dependency to the worker.
+
+### Miscellaneous Chores
+
+* merge 6.x into main + worker-orchestrator support for services ([#554](https://github.com/nullplatform/tofu-modules/issues/554)) ([34238fd](https://github.com/nullplatform/tofu-modules/commit/34238fd257ee791fdc8e9f79842ed8d921505a1c))
+
 ## [6.22.1](https://github.com/nullplatform/tofu-modules/compare/v6.22.0...v6.22.1) (2026-09-01)
 
 

infrastructure/aws/acm/README.md

@@ -18,7 +18,7 @@ The module creates an aws_acm_certificate resource with DNS validation, which is
 
 ```hcl
 module "acm" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/acm?ref=v7.1.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/acm?ref=v8.0.0"
 
   domain_name = "your-domain-name"
   zone_id     = "your-zone-id"

infrastructure/aws/aws_load_balancer_controller/README.md

@@ -18,7 +18,7 @@ This module creates a helm_release resource to deploy the AWS Load Balancer Cont
 
 ```hcl
 module "aws_load_balancer_controller" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/aws_load_balancer_controller?ref=v7.1.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/aws_load_balancer_controller?ref=v8.0.0"
 
   cluster_name = "your-cluster-name"
   vpc_id       = "your-vpc-id"

infrastructure/aws/backend/README.md

@@ -20,7 +20,7 @@ This module creates an S3 bucket with versioning and server-side encryption enab
 
 ```hcl
 module "backend" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/backend?ref=v7.1.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/backend?ref=v8.0.0"
 }
 ```
 

infrastructure/aws/dns/README.md

@@ -21,7 +21,7 @@ The module conditionally creates an aws_route53_zone resource for a public hoste
 
 ```hcl
 module "dns" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/dns?ref=v7.1.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/dns?ref=v8.0.0"
 
   domain_name = "your-domain-name"
   vpc_id      = "your-vpc-id"

infrastructure/aws/eks/README.md

@@ -22,7 +22,7 @@ The module wraps terraform-aws-modules/eks to create the EKS cluster (aws_eks_cl
 
 ```hcl
 module "eks" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/eks?ref=v7.1.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/eks?ref=v8.0.0"
 
   aws_subnets_private_ids = "your-aws-subnets-private-ids"
   aws_vpc_vpc_id          = "your-aws-vpc-vpc-id"

infrastructure/aws/iam/agent/README.md

@@ -21,7 +21,7 @@ The module uses the terraform-aws-modules/iam//modules/iam-role-for-service-acco
 
 ```hcl
 module "agent" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/agent?ref=v7.1.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/agent?ref=v8.0.0"
 
   agent_namespace                     = "your-agent-namespace"
   aws_iam_openid_connect_provider_arn = "your-aws-iam-openid-connect-provider-arn"

infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md

@@ -19,7 +19,7 @@ This module creates an IAM role for the AWS Load Balancer Controller using the t
 
 ```hcl
 module "aws_load_balancer_controller_iam" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/aws_load_balancer_controller_iam?ref=v7.1.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/aws_load_balancer_controller_iam?ref=v8.0.0"
 
   aws_iam_openid_connect_provider_arn = "your-aws-iam-openid-connect-provider-arn"
   cluster_name                        = "your-cluster-name"

infrastructure/aws/iam/cert_manager/README.md

@@ -20,7 +20,7 @@ An aws_iam_policy resource is always created granting route53:GetChange, route53
 
 ```hcl
 module "cert_manager" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cert_manager?ref=v7.1.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cert_manager?ref=v8.0.0"
 
   cluster_name = "your-cluster-name"
 }

infrastructure/aws/iam/ci-build-workflow-user/README.md

@@ -21,7 +21,7 @@ The module creates an aws_iam_user named with the cluster_name prefix and genera
 
 ```hcl
 module "ci-build-workflow-user" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ci-build-workflow-user?ref=v7.1.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ci-build-workflow-user?ref=v8.0.0"
 
   cluster_name = "your-cluster-name"
 }

infrastructure/aws/iam/cloudwatch/README.md

@@ -20,7 +20,7 @@ The module creates an aws_iam_policy granting CloudWatch Logs and Metrics write
 
 ```hcl
 module "cloudwatch" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cloudwatch?ref=v7.1.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cloudwatch?ref=v8.0.0"
 
   cluster_name = "your-cluster-name"
 }

infrastructure/aws/iam/ecr/README.md

@@ -20,7 +20,7 @@ The module creates an aws_iam_role named nullplatform-{cluster_name}-application
 
 ```hcl
 module "ecr" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ecr?ref=v7.1.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ecr?ref=v8.0.0"
 
   build_workflow_group_name = "your-build-workflow-group-name"
   cluster_name              = "your-cluster-name"

infrastructure/aws/iam/external_dns/README.md

@@ -20,7 +20,7 @@ An aws_iam_policy resource named nullplatform_external_dns_policy is always crea
 
 ```hcl
 module "external_dns" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/external_dns?ref=v7.1.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/external_dns?ref=v8.0.0"
 
   cluster_name = "your-cluster-name"
 }

infrastructure/aws/iam/s3/README.md

@@ -18,7 +18,7 @@ The module creates an aws_iam_policy resource that allows s3:PutObject and s3:Ge
 
 ```hcl
 module "s3" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/s3?ref=v7.1.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/s3?ref=v8.0.0"
 
   bucket                    = "your-bucket"
   build_workflow_group_name = "your-build-workflow-group-name"

infrastructure/aws/ingress/README.md

@@ -22,7 +22,7 @@ The module creates up to two kubernetes_ingress_v1 resources — one for an inte
 
 ```hcl
 module "ingress" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/ingress?ref=v7.1.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/ingress?ref=v8.0.0"
 
   certificate_arn = "your-certificate-arn"
 }

infrastructure/aws/security/README.md

@@ -22,7 +22,7 @@ The module uses data sources (aws_eks_cluster, aws_vpc) to automatically derive
 
 ```hcl
 module "security" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/security?ref=v7.1.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/security?ref=v8.0.0"
 
   cluster_name = "your-cluster-name"
 }

infrastructure/aws/vpc/README.md

@@ -2,27 +2,26 @@
 
 ## Description
 
-Creates an AWS VPC with public and private subnets across multiple availability zones, configured for Kubernetes workloads with NAT gateway for private subnet internet access
+Creates an AWS VPC with public and private subnets across multiple availability zones, configured for Kubernetes workloads with NAT gateway support
 
 ## Architecture
 
-This module creates a terraform-aws-modules/vpc/aws module resource with DNS hostnames enabled. It provisions public subnets tagged for external load balancers and private subnets tagged for internal load balancers, both tagged for Kubernetes integration. A single NAT gateway is created in a public subnet to enable outbound internet access for resources in private subnets. The VPC name is derived from organization and account variables, and outputs include the VPC ID, subnet IDs, and default security group ID.
+The module wraps the terraform-aws-modules/vpc/aws community module to provision an aws_vpc resource along with public and private aws_subnet resources distributed across the specified availability zones. A single aws_nat_gateway is created to provide outbound internet access for private subnets, while an aws_internet_gateway handles public subnet routing. Subnet tags for Kubernetes ELB roles are applied automatically, and outputs expose the vpc_id, subnet IDs, and default security group ID for consumption by downstream modules.
 
 ## Features
 
-- Creates VPC with configurable CIDR block and availability zones
-- Provisions public subnets with Kubernetes external load balancer tags
-- Provisions private subnets with Kubernetes internal load balancer tags
-- Configures single NAT gateway for private subnet internet egress
-- Enables DNS hostnames for VPC resources
-- Tags subnets with nullplatform identifiers for infrastructure management
-- Outputs VPC ID, subnet IDs, and default security group for downstream resource integration
+- Creates a VPC with configurable CIDR block named after the organization and account
+- Provisions public and private subnets across multiple availability zones for high availability
+- Deploys a single NAT gateway to provide cost-effective outbound internet access for private subnets
+- Applies Kubernetes ELB and internal-ELB subnet tags to enable automatic load balancer subnet discovery
+- Applies nullplatform subnet-type tags to distinguish public and private subnets
+- Enables DNS hostnames within the VPC to support service discovery and EKS node registration
 
 ## Basic Usage
 
 ```hcl
 module "vpc" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/vpc?ref=v7.1.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/vpc?ref=v8.0.0"
 
   account      = "your-account"
   organization = "your-organization"
@@ -73,16 +72,15 @@ resource "example_resource" "this" {
 <!-- BEGIN_AI_METADATA
 {
   "name": "vpc",
-  "description": "Creates an AWS VPC with public and private subnets across multiple availability zones, configured for Kubernetes workloads with NAT gateway for private subnet internet access",
-  "architecture": "This module creates a terraform-aws-modules/vpc/aws module resource with DNS hostnames enabled. It provisions public subnets tagged for external load balancers and private subnets tagged for internal load balancers, both tagged for Kubernetes integration. A single NAT gateway is created in a public subnet to enable outbound internet access for resources in private subnets. The VPC name is derived from organization and account variables, and outputs include the VPC ID, subnet IDs, and default security group ID.",
+  "description": "Creates an AWS VPC with public and private subnets across multiple availability zones, configured for Kubernetes workloads with NAT gateway support",
+  "architecture": "The module wraps the terraform-aws-modules/vpc/aws community module to provision an aws_vpc resource along with public and private aws_subnet resources distributed across the specified availability zones. A single aws_nat_gateway is created to provide outbound internet access for private subnets, while an aws_internet_gateway handles public subnet routing. Subnet tags for Kubernetes ELB roles are applied automatically, and outputs expose the vpc_id, subnet IDs, and default security group ID for consumption by downstream modules.",
   "features": [
-    "Creates VPC with configurable CIDR block and availability zones",
-    "Provisions public subnets with Kubernetes external load balancer tags",
-    "Provisions private subnets with Kubernetes internal load balancer tags",
-    "Configures single NAT gateway for private subnet internet egress",
-    "Enables DNS hostnames for VPC resources",
-    "Tags subnets with nullplatform identifiers for infrastructure management",
-    "Outputs VPC ID, subnet IDs, and default security group for downstream resource integration"
+    "Creates a VPC with configurable CIDR block named after the organization and account",
+    "Provisions public and private subnets across multiple availability zones for high availability",
+    "Deploys a single NAT gateway to provide cost-effective outbound internet access for private subnets",
+    "Applies Kubernetes ELB and internal-ELB subnet tags to enable automatic load balancer subnet discovery",
+    "Applies nullplatform subnet-type tags to distinguish public and private subnets",
+    "Enables DNS hostnames within the VPC to support service discovery and EKS node registration"
   ],
   "inputs": [
     {
@@ -107,6 +105,6 @@ resource "example_resource" "this" {
     "public_subnets",
     "security_group_ids"
   ],
-  "hash": "c0c6e91682b6bb694696874d8f69aed6"
+  "hash": "fca46061782a682001b91d42d94497cd"
 }
 END_AI_METADATA -->

infrastructure/azure/acr/README.md

@@ -18,7 +18,7 @@ The module uses the azurerm_container_registry resource to create the container
 
 ```hcl
 module "acr" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/acr?ref=v7.1.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/acr?ref=v8.0.0"
 
   containerregistry_name = "your-containerregistry-name"
   location               = "your-location"