Phase 2: kubeconfig discovery + parent release detection + SA token

[saadqbal]

Summary

Phase 2 of the v0.1 roadmap (tracebloc/client#147, closes #150). Adds the plumbing the future tracebloc dataset push flow needs:

1. Read the customer's kubeconfig
2. Discover the tracebloc/client release running in the configured namespace
3. Mint an ingestor SA token (via TokenRequest, or fall back to a static secret)

End-to-end validated against the dev EKS cluster — the new tracebloc cluster info command produces:

Kubeconfig:
  context:     arn:aws:eks:eu-central-1:.../tb-client-dev-templates
  server:      https://....amazonaws.com
  namespace:   tracebloc-templates

Parent release:
  name:          tracebloc
  chart version: 1.3.5
  app version:   1.3.5
  jobs-manager:  http://jobs-manager.tracebloc-templates.svc.cluster.local:8080
  ingestor SA:   tracebloc-templates/ingestor
  ingestor img:  sha256:463e236748708a5e3564569eec9173ea8cb3bcf515992d4939c5b610f3807a4a

Ingestor SA token:
  source:        TokenRequest
  sha256[:8]:    13ce860c576ae04c
  expires in:    ~10m0s (server may cap shorter)

Ready for `tracebloc dataset push` (coming in Phase 3).

The discovered values match what we've been validating manually with kubectl all week. CLI is "ready for tracebloc dataset push" in the sense that the auth + URL plumbing now works end-to-end.

What lands

File	What
internal/cluster/kubeconfig.go	Load() reads kubeconfig honoring kubectl conventions; NewClientset() for downstream use
internal/cluster/discover.go	DiscoverParentRelease() finds the parent client release by listing chart-managed Deployments + filtering by -jobs-manager name suffix
internal/cluster/token.go	MintIngestorToken() — TokenRequest primary, static-secret fallback, hard-stop on non-recoverable errors
internal/cli/cluster.go	tracebloc cluster info subcommand
internal/cluster/*_test.go	11 test cases across the three files; 83.8% coverage on internal/cluster

Two bugs the real-cluster smoke caught

Worth calling out — both are textbook examples of unit tests not enough on their own:

1. ClientConfigLoadingRules{ExplicitPath: ""} does NOT fall back to ~/.kube/config. The default-loading-rules chain only kicks in via NewDefaultClientConfigLoadingRules(). Unit test never exercised the "kubeconfig defaults" path because it used a stub. Fixed + commented.

2. Selector app.kubernetes.io/name=jobs-manager matches nothing. The chart shares app.kubernetes.io/name=client (the chart name) across all its resources — that's the helm convention. To pick jobs-manager from its mysql / requests-proxy siblings, filter the result set by Deployment name suffix. Added a regression test that seeds all three sibling deployments and asserts only jobs-manager comes back.

Test plan

• make ci green locally: vet, test -race, fmt-check, schema-check
• Real-cluster smoke: tracebloc cluster info --context arn:aws:eks:...:cluster/tb-client-dev-templates --namespace tracebloc-templates returns the expected values, exit 0
• Sibling-filter regression test seeds 3 chart deployments, asserts only jobs-manager is picked
• TokenRequest test (using k8s fake clientset + a reactor) returns the stamped token
• Static-secret fallback test seeds a service-account-token Secret + makes TokenRequest fail with Forbidden, asserts fallback path
• Non-recoverable error (simulated network failure) propagates verbatim instead of falling back
• Real-cluster smoke against the static-secret fallback path — not exercised today (the dev cluster grants TokenRequest); will be exercised when a customer hits an older cluster

Library footprint

Brings in k8s.io/client-go + apimachinery + api (@v0.31.0). Cross-compiled binaries grow from ~10MB to ~30MB. Cost is acceptable for the customer-experience upside of "your kubeconfig is all you need."

Closes

tracebloc/client#150

🤖 Generated with Claude Code

---

Note

Medium Risk
Adds Kubernetes client-go based cluster discovery and ServiceAccount token minting logic plus a new CLI surface area, which can affect auth/RBAC handling and increases dependency footprint. CI linting is also reworked (dropping golangci-lint), so coverage of checks changes and may miss prior lints.

Overview
Introduces a new tracebloc cluster info command that loads kubeconfig (kubectl-compatible defaults/overrides), discovers the running tracebloc/client parent release by inspecting Helm-managed *-jobs-manager Deployments, and mints an ingestor ServiceAccount token via TokenRequest with static-secret fallback (printing only a short SHA256 fingerprint).

Updates build tooling by replacing the golangci-lint GitHub Action with standalone errcheck/gofmt -s/ineffassign/misspell steps, bumps the repo’s minimum Go version to 1.26.0, and adds k8s.io/* dependencies plus focused unit tests for discovery, kubeconfig path expansion, and token minting behavior.

^{Reviewed by Cursor Bugbot for commit f43d116. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

👋 Heads-up — Code review queue is at 19 / 8

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• averaging-service#87 — chore(ci): add pytest suite and CI workflow · author: @aptracebloc · reviewer: @saadqbal
• client-runtime#36 — Bump requests from 2.32.3 to 2.33.0 in /Node-deploy · author: @dependabot · no reviewer assigned
• client-runtime#37 — Bump black from 25.1.0 to 26.3.1 in /Node-deploy · author: @dependabot · no reviewer assigned
• client-runtime#38 — Bump requests from 2.32.3 to 2.33.0 · author: @dependabot · no reviewer assigned
• client-runtime#39 — Bump black from 25.1.0 to 26.3.1 · author: @dependabot · no reviewer assigned
• data-ingestors#108 — Copy tokenizer.json to training pod for MLM datasets · author: @shujaatTracebloc · reviewer: @saadqbal
• design-system#19 — fix: un-track coverage/ and node_modules/ from git · author: @LukasWodka · no reviewer assigned
• docs#3 — Block bots from crawling Mintlify static assets · author: @LukasWodka · reviewer: @saadqbal
• model-zoo#74 — Add 9 MLM model variants and remove warmstart · author: @shujaatTracebloc · reviewer: @divyasinghds
• model-zoo#75 — feat: add Jan 2026 trending models across all 9 task families · author: @divyasinghds · no reviewer assigned

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 123b56a. Configure here.}