refactor: move k8s scripts to tools/k8s/ directory

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <[email protected]>

Author: vredchenko

README.md

@@ -124,7 +124,7 @@ ADRs document significant technical decisions:
 ## Links
 
 - [Documentation](https://diamondlightsource.github.io/smartem-decisions/)
-- [Project Board](https://github.com/orgs/DiamondLightSource/projects/33/views/1)
+- [Project Board](https://github.com/orgs/DiamondLightSource/projects/51/views/1)
 - [SmartEM Backend](https://github.com/DiamondLightSource/smartem-decisions)
 
 ## Licence

claude-code/shared/skills/devops/SKILL.md

@@ -25,10 +25,10 @@ Kubernetes deployment, container management, and CI/CD operations for the SmartE
 cd repos/DiamondLightSource/smartem-decisions
 
 # Start local k3s cluster with all services
-./tools/dev-k8s.sh up
+./tools/k8s/dev-k8s.sh up
 
 # Stop and cleanup
-./tools/dev-k8s.sh down
+./tools/k8s/dev-k8s.sh down
 
 # Check cluster status
 kubectl get pods -n smartem-decisions

claude-code/smartem-decisions/REPO-GUIDELINES.md

@@ -65,8 +65,8 @@ python -m alembic upgrade head
 python -m alembic revision --autogenerate -m "Description"
 
 # Local Kubernetes operations
-./tools/dev-k8s.sh up      # Start local k3s cluster with services
-./tools/dev-k8s.sh down    # Stop cluster and cleanup
+./tools/k8s/dev-k8s.sh up      # Start local k3s cluster with services
+./tools/k8s/dev-k8s.sh down    # Stop cluster and cleanup
 ```
 
 ## Project Architecture

claude-code/smartem-decisions/settings.json

@@ -34,7 +34,7 @@
       "Bash(psql:*)",
       "Bash(pg_dump:*)",
       "Bash(pg_restore:*)",
-      "Bash(./tools/dev-k8s.sh:*)",
+      "Bash(./tools/k8s/dev-k8s.sh:*)",
       "Bash(./tools/*)",
       "WebFetch(domain:github.com)",
       "WebFetch(domain:diamondlightsource.github.io)",

docs/explanations/decisions/0006-sealed-secrets-kubernetes-secrets-management.md

@@ -46,7 +46,7 @@ be safely committed to version control whilst maintaining security.
 
 Implementation will include:
 - Installation of sealed-secrets controller in each Kubernetes environment
-- Integration with existing deployment workflow via tools/generate-sealed-secrets.sh script
+- Integration with existing deployment workflow via tools/k8s/generate-sealed-secrets.sh script
 - Documentation in docs/how-to/manage-kubernetes-secrets.md for team procedures
 - Environment-specific encryption keys for development, staging, and production clusters
 

docs/how-to/configure-environment-variables.md

@@ -59,7 +59,7 @@ HTTP_API_PORT=8000
 **Use Case**: Deploying SmartEM to local K8s cluster (k3s) for development.
 
 **When to Use**:
-- Running `./tools/dev-k8s.sh up`
+- Running `./tools/k8s/dev-k8s.sh up`
 - Setting up local development cluster with all services
 
 **Setup**:
@@ -89,7 +89,7 @@ RABBITMQ_PASSWORD=password
 ```
 
 **Used By**:
-- `./tools/dev-k8s.sh` script to create K8s Secrets and ConfigMaps
+- `./tools/k8s/dev-k8s.sh` script to create K8s Secrets and ConfigMaps
 
 ### 3. Kubernetes Staging: `.env.k8s.staging`
 
@@ -109,7 +109,7 @@ cp .env.example.k8s.staging .env.k8s.staging
 
 **Used By**:
 - CI/CD pipelines for staging deployments
-- `DEPLOY_ENV=staging ./tools/dev-k8s.sh up` (if adapted for remote clusters)
+- `DEPLOY_ENV=staging ./tools/k8s/dev-k8s.sh up` (if adapted for remote clusters)
 
 ### 4. Kubernetes Production: `.env.k8s.production`
 
@@ -167,7 +167,7 @@ cp .env.example.k8s.development .env.k8s.development
 nano .env.k8s.development
 
 # 3. Start K8s cluster (creates infrastructure)
-./tools/dev-k8s.sh up
+./tools/k8s/dev-k8s.sh up
 
 # 4. .env is already configured to connect to K8s NodePorts
 # No changes needed unless you want custom ports
@@ -236,7 +236,7 @@ When running in Kubernetes:
 
 ```bash
 # 1. Start K8s cluster
-./tools/dev-k8s.sh up
+./tools/k8s/dev-k8s.sh up
 
 # 2. Use .env (already configured for NodePorts)
 cat .env
@@ -261,7 +261,7 @@ cp .env.example.k8s.development .env.k8s.development
 # Edit with your credentials
 
 # 2. Deploy
-./tools/dev-k8s.sh up
+./tools/k8s/dev-k8s.sh up
 
 # 3. All services run in pods
 kubectl get pods -n smartem-decisions
@@ -280,7 +280,7 @@ kubectl get pods -n smartem-decisions
 test -f .env || cp .env.example .env
 
 # 2. Start K8s cluster
-./tools/dev-k8s.sh up
+./tools/k8s/dev-k8s.sh up
 
 # 3. Run E2E test (script loads .env automatically)
 ./tools/run-e2e-test.sh

docs/how-to/deploy-kubernetes.md

@@ -8,22 +8,22 @@ For local development, use the convenient script that provides a docker-compose-
 
 ```bash
 # Start the development environment (equivalent to docker-compose up -d)
-./tools/dev-k8s.sh
+./tools/k8s/dev-k8s.sh
 
 # Check status (equivalent to docker ps)
-./tools/dev-k8s.sh status
+./tools/k8s/dev-k8s.sh status
 
 # View logs for a service
-./tools/dev-k8s.sh logs smartem-http-api
+./tools/k8s/dev-k8s.sh logs smartem-http-api
 
 # Stop the environment (equivalent to docker-compose down)
-./tools/dev-k8s.sh down
+./tools/k8s/dev-k8s.sh down
 
 # Restart everything
-./tools/dev-k8s.sh restart
+./tools/k8s/dev-k8s.sh restart
 
 # Get help
-./tools/dev-k8s.sh --help
+./tools/k8s/dev-k8s.sh --help
 ```
 
 ### Access URLs
@@ -55,14 +55,14 @@ deploying to any environment, you must generate the appropriate sealed secrets:
 
 ```bash
 # Auto-generate secure credentials for development
-./tools/generate-sealed-secrets.sh development
+./tools/k8s/generate-sealed-secrets.sh development
 ```
 
 ### Generate Secrets for Production
 
 ```bash
 # Interactive credential input for production security
-./tools/generate-sealed-secrets.sh production
+./tools/k8s/generate-sealed-secrets.sh production
 ```
 
 Sealed secrets are encrypted with the cluster's public key and safe to commit to version control. The sealed-secrets 

docs/how-to/manage-kubernetes-secrets.md

@@ -62,13 +62,13 @@ The project includes a convenient script that handles the entire sealed secret g
 
 ```bash
 # Generate secrets for development (auto-generated passwords)
-./tools/generate-sealed-secrets.sh development
+./tools/k8s/generate-sealed-secrets.sh development
 
 # Generate secrets for production (interactive prompts)
-./tools/generate-sealed-secrets.sh production
+./tools/k8s/generate-sealed-secrets.sh production
 
 # Generate secrets for all environments
-./tools/generate-sealed-secrets.sh all
+./tools/k8s/generate-sealed-secrets.sh all
 ```
 
 ## Environment-Specific Workflows
@@ -78,7 +78,7 @@ The project includes a convenient script that handles the entire sealed secret g
 Development environments use automatically generated secure passwords for convenience:
 
 ```bash
-./tools/generate-sealed-secrets.sh development
+./tools/k8s/generate-sealed-secrets.sh development
 ```
 
 This will:
@@ -92,7 +92,7 @@ This will:
 Production and staging environments require interactive credential input for security:
 
 ```bash
-./tools/generate-sealed-secrets.sh production
+./tools/k8s/generate-sealed-secrets.sh production
 ```
 
 You'll be prompted to provide:
@@ -147,7 +147,7 @@ Regular secret rotation is essential for security. Follow these steps to rotate
 
 ```bash
 # Use the generation script with new credentials
-./tools/generate-sealed-secrets.sh production
+./tools/k8s/generate-sealed-secrets.sh production
 ```
 
 ### 2. Apply Updated Secrets
@@ -274,7 +274,7 @@ For issues with the generation script:
 
 ```bash
 # Run with verbose output
-bash -x ./tools/generate-sealed-secrets.sh development
+bash -x ./tools/k8s/generate-sealed-secrets.sh development
 
 # Check prerequisites manually
 kubectl cluster-info
@@ -326,7 +326,7 @@ For complex applications requiring multiple secret sources:
 
 ```bash
 # Database secrets
-./tools/generate-sealed-secrets.sh production
+./tools/k8s/generate-sealed-secrets.sh production
 
 # Additional API secrets
 kubectl create secret generic api-secrets \
@@ -355,7 +355,7 @@ rm plain-secret.yaml
 ## Files and Structure
 
 ```
-├── tools/generate-sealed-secrets.sh         # Main secret generation script
+├── tools/k8s/generate-sealed-secrets.sh         # Main secret generation script
 ├── k8s/environments/
 │   ├── development/
 │   │   ├── secrets.yaml                     # Development sealed secrets

docs/how-to/run-backend.md

@@ -6,7 +6,7 @@ The core backend service providing HTTP API, database operations, and message qu
 
 ```bash
 # create env and launch service stack locally:
-./tools/dev-k8s.sh up
+./tools/k8s/dev-k8s.sh up
 
 # launch RabbitMQ worker (consumer)
 python -m smartem_backend.consumer              # ERROR level (default)

docs/how-to/run-e2e-dev-simulation.md

@@ -8,7 +8,7 @@ For the simplest test execution, use the automated test runner script:
 
 ```bash
 # Check k3s status first (DO NOT restart if already running)
-./tools/dev-k8s.sh status
+./tools/k8s/dev-k8s.sh status
 
 # Run automated test (Test Type 2: Pre-Acquisition Agent Setup)
 ./tools/run-e2e-test.sh
@@ -64,7 +64,7 @@ If you've already set up once and just need to run another test:
 
 ```bash
 # 1. Check k3s status (DO NOT restart if already running)
-./tools/dev-k8s.sh status
+./tools/k8s/dev-k8s.sh status
 
 # 2. Prepare clean environment
 unset POSTGRES_HOST POSTGRES_PORT POSTGRES_DB POSTGRES_USER POSTGRES_PASSWORD
@@ -115,7 +115,7 @@ For testing multiple concurrent microscopes and acquisition sessions simultaneou
 
 ```bash
 # Check k3s status first (DO NOT restart if already running)
-./tools/dev-k8s.sh status
+./tools/k8s/dev-k8s.sh status
 
 # Run multi-microscope test with 3 microscopes (default)
 ./tools/run-e2e-test-multi-microscope.sh
@@ -239,7 +239,7 @@ The test setup simulates a complete SmartEM workflow:
 ### Environment Setup
 - Python 3.12+ with venv activated: `source .venv/bin/activate`
 - Full development install: `pip install -e .[all]`
-- Local k3s cluster running: `./tools/dev-k8s.sh up`
+- Local k3s cluster running: `./tools/k8s/dev-k8s.sh up`
 - Environment file: `.env` (created from `.env.example` - see Environment File Setup below)
 
 ### Test Data
@@ -506,7 +506,7 @@ pkill -f uvicorn
 pkill -f fastapi
 
 # 5. Verify k3s services are running (DO NOT restart if already running)
-./tools/dev-k8s.sh status
+./tools/k8s/dev-k8s.sh status
 
 # 6. Clean RabbitMQ (restart to ensure empty queue)
 kubectl rollout restart deployment/rabbitmq -n smartem-decisions
@@ -773,7 +773,7 @@ pgrep -f "smartem_backend|smartem_agent|fsrecorder"
 rm -rf ../epu-test-dir
 
 # Stop k3s cluster (if needed)
-./tools/dev-k8s.sh down
+./tools/k8s/dev-k8s.sh down
 ```
 
 ## Troubleshooting