v1.0 — Stage 1 close

Initial public release. Stage 1 closed.

Included

• 14 Ansible roles — host bootstrap → LXD substrate → transient k3s
  bootstrap cluster → CAPI/CAPN init → pivot to self-hosted mgmt →
  cleanup → harness plumbing.
• 1 Terraform module — terraform/modules/workload_cluster: CAPI
  objects, machine templates, guest networking, add-ons via
  hashicorp/helm.
• 5 Helm charts in charts/ — capi-cluster-class,
  capi-workload-cluster, cni-calico, metallb, metallb-config.
  Single carrier for every Kubernetes object the project creates.
• Molecule + Vagrant + libvirt local harness.
• Makefile for lint / test-local-e2e / deploy-workload /
  reset-all / clean-local.

Substrate contract

• Single bare-metal Debian 13 host; unprivileged-LXC only (no toggle).
• Default topology: workload 3 CP + 2 worker, mgmt 1 CP + 2 worker
  (self-hosted after pivot).
• Mandatory CAPI bootstrap-and-pivot; bootstrap k3s LXC destroyed by
  cleanup_bootstrap.
• Helm-first delivery — no raw manifests, no kubectl apply -f.
• Chart-side Gate A (external L2) + Gate B (CNI viability)
  helm.sh/hook: test Pods fail the deploy on data-plane defects.
• Reusable-repo / private consumer-repo boundary — no site-specific
  inventories, secrets, or tfvars in this repo.

Pinned stack

Kubernetes v1.35.0 · k3s v1.35.3+k3s1 · Cluster API v1.12.5 ·
CAPN v0.8.5 · LXD snap 6/stable · Calico v3.31.5 ·
MetalLB v0.15.3 · Terraform hashicorp/helm ~> 3.1.1. Full
version log in plans/PLAN-stage1-common.md §8a.

Closed by design

Privileged LXC, multi-CNI runtime toggles, raw manifests, custom
APT repos on the host, host-firewall management, external etcd.