feat: linuxaid-agent operator + masterless puppet apply on Kubernetes nodes

.dockerignore

@@ -0,0 +1,4 @@
+.git
+.claude
+dist
+*.md

Dockerfile

@@ -0,0 +1,25 @@
+# syntax=docker/dockerfile:1
+#
+# Host agent image: stages the static linuxaid-cli onto the node and runs the
+# OpenVox agent in the host's namespaces via nsenter (see deploy/entrypoint.sh).
+# Runs as the per-node Job that the fan-out launcher spawns. The node's cert is
+# provided pre-signed (obmondo-clientcert), so there is nothing to enroll.
+
+FROM golang:1.24-alpine AS build
+WORKDIR /src
+RUN apk add --no-cache git
+COPY go.mod go.sum ./
+RUN --mount=type=cache,target=/go/pkg/mod go mod download
+COPY . .
+ARG VERSION=spike
+RUN --mount=type=cache,target=/go/pkg/mod --mount=type=cache,target=/root/.cache/go-build \
+    CGO_ENABLED=0 go build -trimpath -ldflags="-X main.Version=${VERSION} -s -w" -o /out/linuxaid-cli ./cmd/linuxaid-cli
+
+FROM alpine:3.20
+# git + openssh-client: apply mode clones the puppet code in-container into the
+# /opt/obmondo hostPath (the host itself is not required to have git).
+RUN apk add --no-cache bash util-linux ca-certificates git openssh-client
+COPY --from=build /out/linuxaid-cli /usr/local/bin/linuxaid-cli
+COPY deploy/entrypoint.sh /usr/local/bin/entrypoint.sh
+RUN chmod +x /usr/local/bin/entrypoint.sh
+ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]

Dockerfile.launcher

@@ -0,0 +1,21 @@
+# syntax=docker/dockerfile:1
+#
+# Fan-out launcher image: the in-cluster controller (linuxaid-agent) that lists
+# nodes and creates one per-node agent Job each run. It is only a Kubernetes API
+# client — no host access — so it runs non-root with no extra tooling.
+
+FROM golang:1.24-alpine AS build
+WORKDIR /src
+RUN apk add --no-cache git
+COPY go.mod go.sum ./
+RUN --mount=type=cache,target=/go/pkg/mod go mod download
+COPY . .
+ARG VERSION=spike
+RUN --mount=type=cache,target=/go/pkg/mod --mount=type=cache,target=/root/.cache/go-build \
+    CGO_ENABLED=0 go build -trimpath -ldflags="-X main.Version=${VERSION} -s -w" -o /out/linuxaid-agent ./cmd/linuxaid-agent
+
+FROM alpine:3.20
+RUN apk add --no-cache ca-certificates
+COPY --from=build /out/linuxaid-agent /usr/local/bin/linuxaid-agent
+USER 65534:65534
+ENTRYPOINT ["/usr/local/bin/linuxaid-agent"]

cmd/linuxaid-agent/main.go

@@ -0,0 +1,26 @@
+package main
+
+import (
+	"log/slog"
+	"os"
+
+	"github.com/spf13/cobra"
+)
+
+var Version string
+
+var rootCmd = &cobra.Command{
+	Use:     "linuxaid-agent",
+	Short:   "In-cluster controller for running LinuxAid OpenVox agents on Kubernetes nodes",
+	Version: Version,
+	CompletionOptions: cobra.CompletionOptions{
+		HiddenDefaultCmd: true,
+	},
+}
+
+func main() {
+	if err := rootCmd.Execute(); err != nil {
+		slog.Error(err.Error())
+		os.Exit(1)
+	}
+}