From 642a526b56d2f3f079172ff0b9eb19a76b26b840 Mon Sep 17 00:00:00 2001
From: juvdiaz <juvenal.diaz@oracle.com>
Date: Fri, 5 Jun 2026 01:15:09 -0600
Subject: [PATCH] Guard cluster worker var loading

---
 bootstrap/cluster/main.tf      | 18 +++++++++++++++++-
 bootstrap/cluster/variables.tf |  5 +++++
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/bootstrap/cluster/main.tf b/bootstrap/cluster/main.tf
index 7da4685..4295062 100644
--- a/bootstrap/cluster/main.tf
+++ b/bootstrap/cluster/main.tf
@@ -380,10 +380,26 @@ EOT
   ]
 }
 
+resource "null_resource" "worker_nodes_required" {
+  triggers = {
+    worker_count = tostring(length(var.worker_nodes))
+  }
+
+  lifecycle {
+    precondition {
+      condition     = var.allow_empty_worker_nodes || length(var.worker_nodes) > 0
+      error_message = "worker_nodes is empty. Pass -var-file=/path/to/.lab/cluster-workers.auto.tfvars.json or set allow_empty_worker_nodes=true for an intentional control-plane-only cluster."
+    }
+  }
+}
+
 resource "null_resource" "kubeadm_worker" {
   for_each = var.worker_nodes
 
-  depends_on = [data.external.kubeadm_join_command]
+  depends_on = [
+    data.external.kubeadm_join_command,
+    null_resource.worker_nodes_required,
+  ]
 
   triggers = {
     node_name                            = each.value.node_name
diff --git a/bootstrap/cluster/variables.tf b/bootstrap/cluster/variables.tf
index c80d303..8b7b3f5 100644
--- a/bootstrap/cluster/variables.tf
+++ b/bootstrap/cluster/variables.tf
@@ -63,6 +63,11 @@ variable "worker_nodes" {
   default = {}
 }
 
+variable "allow_empty_worker_nodes" {
+  type    = bool
+  default = false
+}
+
 variable "worker_node_labels" {
   type = map(map(string))