[FEAT cloudctl] - bootstrap procedure

[uwe-mayer]

Priority

None

User Story

As a Greenhouse operator I need to bootstrap cloudctl, aka. I need first time connectivity to Greenhouse to be able to access all onboarded Clusters

Description

Provide a cloudctl bootstrap command for first-time Greenhouse cluster access. The command merges a Greenhouse-scoped kubeconfig into the user's local kubeconfig interactively, then suggests the next step.

The command must support two input modes so the Web UI can show both:

Mode 1 — individual flags (readable, scriptable):
```bash
cloudctl bootstrap
--greenhouse-server=https://greenhouse.example.com
--greenhouse-org=my-org
--greenhouse-token=
--greenhouse-ca-data=
```

Mode 2 — single base64 blob (one-liner, easy to copy-paste from UI):
```bash
cloudctl bootstrap --data=
```

Both modes open an interactive prompt locally: ask for the context name to use, ask whether to set it as the new default context, then write the result to the local kubeconfig.

After a successful bootstrap the command prints a next-step suggestion:
```
Bootstrap complete. Run cloudctl sync -n my-org to pull in your cluster access.
```

Acceptance Criteria

• cloudctl bootstrap --data=<base64-blob> decodes and merges the Greenhouse kubeconfig
• cloudctl bootstrap --greenhouse-server / --greenhouse-org / --greenhouse-token / --greenhouse-ca-data works as an alternative input mode
• Interactive prompt asks for the context name (default: greenhouse-<org>) and whether to set it as the current context
• Merged entry is written to the local kubeconfig (~/.kube/config by default, overridable with --kubeconfig)
• Existing unmanaged kubeconfig entries are never overwritten
• Command is idempotent: running it twice with the same input is safe
• --dry-run shows what would be written without touching the file
• After success, a next-step hint is printed: cloudctl sync -n <org>
• It is possible to access the Greenhouse api-server for cloudctl if the user has the correct permissions and groups in the upstream IdP

Out of Scope (handled on the Greenhouse side)

• Showing the bootstrap command in the Web UI → tracked in [FEAT] - static ClusterKubeconfig for Greenhouse cluster greenhouse#2186
• Providing the org-scoped kubeconfig download with OIDC / org-specific connector in the UI → tracked in [FEAT] - static ClusterKubeconfig for Greenhouse cluster greenhouse#2186

Reference Issues

• [FEAT] - static ClusterKubeconfig for Greenhouse cluster greenhouse#2186 — static ClusterKubeconfig for Greenhouse cluster (UI download)
• [FEAT cloudctl] - Simplify sync command with persisted Greenhouse connection config #79 — persisted sync config (next step after bootstrap: making cloudctl sync flag-free)

[github-actions]

Thanks for opening this issue! 🎉

A maintainer will triage it within 5 business days. You can learn more about our issue workflow in the Issue Lifecycle documentation.

In the meantime, please make sure you have provided:

• A clear problem statement
• Steps to reproduce (for bugs)
• Expected vs actual behavior

This helps us route your issue faster.

[onuryilmaz]

Related: #79 (persisted sync config) is the natural next step after bootstrap — once the user has bootstrapped, #79 makes cloudctl sync flag-free by persisting the Greenhouse connection details.