Epic: OSS fleet control-point roadmap (H1 credibility → H2 production wrap → H3 isolation runtime)

[jleni]

Goal: make kobe a complete OSS fleet control-point — the layer where pools, leases, quotas, observability, UI, SSO/audit, sleep/cost, and DR live — while consuming vcluster/Kamaji/k3s/k0s/CAPI as interchangeable runtime backends.

Strategic frame:

• Runtime decision is vcluster-backend (density) + native pkobe (isolation); the in-house kobe-sync syncer is retired (docs: reconcile runtime strategy — kobe-sync retired in favor of vcluster-backend + native pkobe #17).
• The engine substrate already exists: warm pools, lease/TTL API, per-role quotas, multi-backend, connect-proxy (zero-inbound), golden-image + Velero/S3 DR.
• The remaining gaps are the visible veneer (UI, SSO/audit) + production wrap (conformance, HA, datastore, cert lifecycle, sleep/cost).

Horizons: H1 credibility (conformance, contract, docs) → H2 backend breadth + production wrap (datastore, cert lifecycle, sleep, fidelity, portability, UI, SSO/audit) → H3 isolation runtime + platform completeness (pkobe, isolation tiers, VM kind).

Related (not sub-issues)

• k0s HA control planes (servers>1) — mirror the shipped k3s HA pattern #7 — k0s HA control planes
• perf(ipam): consider reflector cache for compute_used LISTs (only if telemetry shows it's hot) #8 — IPAM reflector cache (scale, deferred)
• Self-provisioned ephemeral pools for CI (hash + bounded policy + TTL) #9 — self-provisioned ephemeral CI pools
• Teardown contract + exit gate — still tracked privately (kobe-old#178), to be ported.

Sub-issues

H1

• docs: reconcile runtime strategy — kobe-sync retired in favor of vcluster-backend + native pkobe #17 — docs: reconcile runtime strategy (kobe-sync retired)
• Readiness-gate-as-admission: backend-agnostic conformance matrix in CI (+ CoreDNS/x509 + in-cluster-token gates) #10 — readiness-gate-as-admission: backend-agnostic conformance matrix in CI
• Freeze ClusterBackend as a versioned RuntimeBackend contract + per-backend capability matrix #11 — versioned RuntimeBackend contract + per-backend capability matrix

H2

• CAPI real-node support via ClusterClass (Proxmox/CAPMOX + KubeVirt/CAPK) #12 — CAPI real-node support via ClusterClass (Proxmox + KubeVirt)
• Pluggable multi-driver DataStore (PostgreSQL/MySQL/NATS) over KobeStore #18 — pluggable multi-driver DataStore (PostgreSQL/MySQL/NATS)
• Act on cert expiry: recycle-before-expiry / re-issue (completes the shipped expiry gauge) #19 — act on cert expiry (recycle-before-expiry / re-issue)
• Per-lease sleep/resume + auto-sleep schedule #20 — per-lease sleep/resume + auto-sleep schedule
• vcluster-backend fidelity contract + SyncError taxonomy #15 — vcluster-backend fidelity contract + SyncError taxonomy
• Portability: placement-aware golden restore + cross-host instance migration #13 — placement-aware golden restore + cross-host instance migration
• Management UI / self-service portal #21 — management UI / self-service portal
• SSO portal + audit logging #22 — SSO portal + audit logging

H3

• pkobe: native dedicated-control-plane + real-node isolation backend #23 — pkobe: native dedicated-control-plane + real-node isolation backend
• Isolation tiers for the pod kind (RuntimeClass: runc → gVisor → Kata/Firecracker) #14 — isolation tiers for the pod kind (runc → gVisor → Kata/Firecracker)
• VM as a leasable kind (KubeVirt) — distinct from CAPK/pkobe cluster workers #16 — VM as a leasable kind (KubeVirt)