fixes

.tofu/scripts/get-kubeconfig.sh

@@ -5,9 +5,56 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 TOFU_ROOT="$(dirname "$SCRIPT_DIR")"
 PROJECT_ROOT="$(dirname "$TOFU_ROOT")"
 
-CLUSTER="${1:?Usage: $0 <cluster> (e.g., aks-dev, eks-prod)}"
+usage() {
+  cat <<EOF
+Usage: $0 <cluster> --envtype <dev|prod|workload>
+
+  Fetch (or reuse) a kubeconfig for the given cluster.
+  Platform is read from the cluster prefix (<platform>-...).
+  Env type must be supplied explicitly — it is no longer inferred
+  from the cluster name, so names like 'upc-forte-group' work.
+
+  Examples:
+    $0 aks-dev          --envtype dev
+    $0 upc-forte-group  --envtype prod
+    $0 eks-workload     --envtype workload
+EOF
+  exit "${1:-0}"
+}
+
+CLUSTER=""
+ENVTYPE=""
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --envtype)    ENVTYPE="${2:-}"; shift 2 ;;
+    --envtype=*)  ENVTYPE="${1#*=}"; shift ;;
+    -h|--help)    usage 0 ;;
+    -*)           echo "Unknown option: $1"; usage 1 ;;
+    *)
+      if [[ -z "$CLUSTER" ]]; then
+        CLUSTER="$1"; shift
+      else
+        echo "Error: unexpected argument '$1'"; usage 1
+      fi
+      ;;
+  esac
+done
+
+[[ -z "$CLUSTER" ]] && { echo "Error: <cluster> argument required"; usage 1; }
+[[ -z "$ENVTYPE" ]] && { echo "Error: --envtype <dev|prod|workload> required"; usage 1; }
+
+case "$ENVTYPE" in
+  dev|prod|workload) ;;
+  *) echo "Error: invalid --envtype '$ENVTYPE'. Expected: dev, prod, workload"; exit 1 ;;
+esac
+
 PLATFORM="${CLUSTER%%-*}"
-ENV="${CLUSTER#*-}"
+ENV="$ENVTYPE"
+
+case "$PLATFORM" in
+  aks|eks|gke|upc) ;;
+  *) echo "Error: unknown platform '$PLATFORM'. Expected: aks, eks, gke, upc"; exit 1 ;;
+esac
 
 KUBECONFIG_FILE="$PROJECT_ROOT/private/$CLUSTER/kubeconfig"
 
@@ -53,10 +100,6 @@ else
       CLUSTER_ID=$(tofu output -raw cluster_id 2>/dev/null || echo "${UPCLOUD_CLUSTER_ID:-}")
       upctl kubernetes config "$CLUSTER_ID" > "$KUBECONFIG_FILE"
       ;;
-    *)
-      echo "Error: unknown platform '$PLATFORM'"
-      exit 1
-      ;;
   esac
 
   chmod 600 "$KUBECONFIG_FILE"

.tofu/scripts/setup-cluster.sh

@@ -8,26 +8,33 @@ PROJECT_ROOT="$(dirname "$TOFU_ROOT")"
 # ─── Usage ────────────────────────────────────────────────────────────
 usage() {
   cat <<EOF
-Usage: $0 <cluster> [options]
+Usage: $0 <cluster> --envtype <dev|prod|workload> [options]
 
   Provision a Kubernetes cluster using OpenTofu.
-  Mirrors bootstrap.sh convention: cluster = <platform>-<env>
+  Cluster name is opaque — platform is read from its prefix
+  (<platform>-...), env is taken from --envtype.
 
-  Clusters:   aks-dev | aks-prod | eks-dev | eks-prod
-              gke-dev | gke-prod | upc-dev | upc-prod
-              upc-forte-group
-              <platform>-workload (for workload clusters)
+  Platforms (inferred from cluster prefix):
+    aks | eks | gke | upc
+
+  Env types (required via --envtype):
+    dev       Platform cluster, development
+    prod      Platform cluster, production
+    workload  Lean cluster for application workloads (no managed data
+              services — those run on the platform cluster)
 
   Options:
-    --plan        Plan only, don't apply
-    --destroy     Destroy the cluster (use teardown-cluster.sh instead)
-    --auto        Skip confirmation prompts
-    -h, --help    Show this help
+    --envtype <type>   dev | prod | workload  (required)
+    --plan             Plan only, don't apply
+    --destroy          Destroy the cluster (use teardown-cluster.sh instead)
+    --auto             Skip confirmation prompts
+    -h, --help         Show this help
 
   Examples:
-    $0 aks-dev
-    $0 eks-prod --plan
-    $0 upc-dev --auto
+    $0 aks-dev          --envtype dev
+    $0 eks-prod         --envtype prod --plan
+    $0 upc-forte-group  --envtype prod --auto
+    $0 upc-workload     --envtype workload
 
   Prerequisites:
     - tofu, kubectl, helm installed
@@ -42,17 +49,20 @@ EOF
 
 # ─── Parse arguments ──────────────────────────────────────────────────
 CLUSTER=""
+ENVTYPE=""
 PLAN_ONLY=false
 DESTROY=false
 AUTO_APPROVE=false
 
 while [[ $# -gt 0 ]]; do
   case "$1" in
-    --plan)       PLAN_ONLY=true; shift ;;
-    --destroy)    DESTROY=true; shift ;;
-    --auto)       AUTO_APPROVE=true; shift ;;
-    -h|--help)    usage 0 ;;
-    -*)           echo "Unknown option: $1"; usage 1 ;;
+    --plan)        PLAN_ONLY=true; shift ;;
+    --destroy)     DESTROY=true; shift ;;
+    --auto)        AUTO_APPROVE=true; shift ;;
+    --envtype)     ENVTYPE="${2:-}"; shift 2 ;;
+    --envtype=*)   ENVTYPE="${1#*=}"; shift ;;
+    -h|--help)     usage 0 ;;
+    -*)            echo "Unknown option: $1"; usage 1 ;;
     *)
       if [[ -z "$CLUSTER" ]]; then
         CLUSTER="$1"
@@ -66,10 +76,16 @@ while [[ $# -gt 0 ]]; do
 done
 
 [[ -z "$CLUSTER" ]] && { echo "Error: <cluster> argument required"; usage 1; }
+[[ -z "$ENVTYPE" ]] && { echo "Error: --envtype <dev|prod|workload> required"; usage 1; }
 
-# ─── Map cluster → platform + env ────────────────────────────────────
-PLATFORM="${CLUSTER%%-*}"   # aks-dev → aks
-ENV="${CLUSTER#*-}"         # aks-dev → dev
+case "$ENVTYPE" in
+  dev|prod|workload) ;;
+  *) echo "Error: invalid --envtype '$ENVTYPE'. Expected: dev, prod, workload"; exit 1 ;;
+esac
+
+# ─── Resolve platform + env ───────────────────────────────────────────
+PLATFORM="${CLUSTER%%-*}"   # cluster prefix → platform (e.g. upc-forte-group → upc)
+ENV="$ENVTYPE"              # env comes from --envtype, not the cluster name
 
 case "$PLATFORM" in
   aks|eks|gke|upc) ;;