[DIRTY] feat(skills): scaffold cluster-bootstrap for LAN/cloud k3s

[bussyjd]

Summary

Scaffold a new cluster-bootstrap skill that lets obol-agent stand up a k3s cluster across one or more hosts (LAN or cloud) over SSH using k3sup, then prepares it for obol stack up. Topology (nodes, roles, labels) is persisted under $OBOL_CONFIG_DIR/cluster-bootstrap/ so the chart-side wiring can consume it later.

This is a scaffold PR: the bootstrap flows are wired up and the multi-node design is decided, but the chart changes that consume the bootstrap output are intentionally deferred (see "Out of scope" below). Don't run against a production cluster yet.

What's in

• internal/embed/skills/cluster-bootstrap/SKILL.md — topology model (single-host / lan-multi / cloud-multi), subcommand reference, caveats.
• internal/embed/skills/cluster-bootstrap/scripts/bootstrap.py — k3sup wrapper: single, server, join, kubeconfig-path, status, label. Persists topology to topology.json, keeps server token mode 0600, writes kubeconfig to the standard $OBOL_CONFIG_DIR/kubeconfig.yaml.
• internal/embed/skills/cluster-bootstrap/references/multi-node-design.md — full design doc with rejected alternatives.

Locked decisions

Storage — Option A (single primary node). One node carries obol.org/storage=primary (server by default). Stateful Deployments will gain nodeAffinity to that label; --no-storage-primary opts out. State is single-node, recoverable from PVC backup. Rejected: Longhorn/OpenEBS (≥3 nodes, ~500MiB/node baseline) and NFS dual-StorageClass (SPOF + fsync semantics break SQLite/BoltDB workloads).

Cloudflared — Shape 2 (pools list). The chart will render one Deployment per cloudflared.pools entry; each pool has its own replicas, nodeSelector, and Cloudflare credentials, with hostname PodAntiAffinity capping at one replica per node within a pool. bootstrap.py server|join --cloudflared-pool <name> records obol.org/cloudflared-pool=<name> (default default). Rejected: DaemonSet (can't run >1 tunnel per beefy node), single-Deployment+replicas (no edge-vs-cloud credential separation).

Out of scope (next ticket)

• local-path.yaml chart honoring storage.primaryLabel
• Stateful Deployments adding nodeAffinity to the primary label
• cloudflared chart rewriting the single Deployment as a range over pools (with hostname-antiaffinity invariant + NOTES.txt warning when replicas > matching nodes)
• obol stack up consuming topology.json to feed those values
• End-to-end multi-node smoke test

Test plan

• go build ./... clean
• go test ./internal/embed/... passes (CRD/RBAC validation unchanged)
• bootstrap.py --help, bootstrap.py server --help, bootstrap.py join --help parse cleanly
• bootstrap.py status on a fresh state returns "no nodes recorded"
• Live single-host install on a Linux box (deferred, requires non-Mac target)
• LAN server + agent join (deferred, requires multi-node test bed)

Notes

• Branch name is feature/cluster-bootstrap-skill per request; project convention elsewhere is feat/. Happy to rename if preferred.
• Does not touch any production infra templates (local-path.yaml, cloudflared chart). All changes live under internal/embed/skills/cluster-bootstrap/.

---

Generated by Claude Code