From f358277cb242b7079abfd94f21cc2b75821f47ee Mon Sep 17 00:00:00 2001
From: Agustin Celentano <12614595+agustincelentano@users.noreply.github.com>
Date: Mon, 14 Sep 2026 13:03:11 -0300
Subject: [PATCH] fix: deploy workloads into their own namespace, not the
 agent's

worker_default_env derived K8S_NAMESPACE from var.namespace, which is
documented as "Kubernetes namespace where the nullplatform agent will run" and
defaults to nullplatform-tools. Every k8s-scope worker therefore deployed its
application pods next to the agent instead of into nullplatform.

The block's own example a few lines below already shows the intended value:

    - { name: K8S_NAMESPACE, value: nullplatform }

and nullplatform/scopes ships K8S_NAMESPACE: nullplatform as the k8s scope
default, which is where every pre-worker agent deployed. The code and the
documentation disagreed; the code was wrong.

Splits the two concepts: var.namespace keeps meaning where the agent runs, and
the new var.workload_namespace is what the workers receive, defaulting to
nullplatform.

Callers that want workloads next to the agent can set workload_namespace to the
same value as namespace.
---
 nullplatform/agent/locals.tf    | 2 +-
 nullplatform/agent/variables.tf | 8 +++++++-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/nullplatform/agent/locals.tf b/nullplatform/agent/locals.tf
index cc89297e..2c34be9c 100644
--- a/nullplatform/agent/locals.tf
+++ b/nullplatform/agent/locals.tf
@@ -78,7 +78,7 @@ locals {
     DNS_TYPE                = var.dns_type
     DOMAIN                  = var.domain
     USE_ACCOUNT_SLUG        = var.use_account_slug
-    K8S_NAMESPACE           = var.namespace
+    K8S_NAMESPACE           = var.workload_namespace
     SERVICE_TEMPLATE        = var.service_template != "" ? var.service_template : local.worker_templates.SERVICE_TEMPLATE
     INITIAL_INGRESS_PATH    = var.initial_ingress_path != "" ? var.initial_ingress_path : local.worker_templates.INITIAL_INGRESS_PATH
     BLUE_GREEN_INGRESS_PATH = var.blue_green_ingress_path != "" ? var.blue_green_ingress_path : local.worker_templates.BLUE_GREEN_INGRESS_PATH
diff --git a/nullplatform/agent/variables.tf b/nullplatform/agent/variables.tf
index cbbf7a04..166922bb 100644
--- a/nullplatform/agent/variables.tf
+++ b/nullplatform/agent/variables.tf
@@ -166,11 +166,17 @@ variable "worker" {
 
 # Kubernetes namespace where the nullplatform agent will run
 variable "namespace" {
-  description = "Kubernetes namespace where the nullplatform agent will run"
+  description = "Kubernetes namespace where the nullplatform agent itself runs. This is NOT where scopes deploy their workloads — see var.workload_namespace."
   type        = string
   default     = "nullplatform-tools"
 }
 
+variable "workload_namespace" {
+  description = "Kubernetes namespace scopes deploy their application pods into, handed to the k8s-scope workers as K8S_NAMESPACE. Defaults to the k8s scope's own default, which is what every pre-worker agent used."
+  type        = string
+  default     = "nullplatform"
+}
+
 variable "create_namespace" {
   description = "Create the namespace if it does not exist. Leave true unless another module already owns it: nullplatform/base declares the same namespace with Helm ownership metadata, so with no ordering edge between the two whichever applies second fails."
   type        = bool