docs(kubectl): document direct API access

[xnoto]

Summary

• document direct Dex OIDC kubectl access through https://api.makeitwork.cloud
• retain the existing Access TCP route as a migration fallback
• preserve node-local admin kubeconfig break-glass guidance

Validation

• canonical tfroot pre-commit suite
• OpenTofu validate, tflint, Checkov, fmt, terraform-docs, and Gitleaks passed
• only the expected no-commit-to-branch hook failed locally because the repository started on main

Documentation-only; merge after the Cloudflare and Kustomize rollout PRs.

[github-actions]

OpenTofu Plan

OpenTofu will perform the following actions:
# module.k3s.libvirt_cloudinit_disk.commoninit will be created
+ resource "libvirt_cloudinit_disk" "commoninit" {
+ id = (known after apply)
+ meta_data = <<-EOT
instance-id: k3s
local-hostname: k3s
EOT
+ name = "k3s_commoninit"
+ network_config = <<-EOT
version: 2
ethernets:
enp1s0:
dhcp4: true
enp2s0:
dhcp4: false
addresses:
- 192.168.102.2/24
EOT
+ path = (known after apply)
+ size = (known after apply)
+ user_data = (sensitive value)
}
# module.runner.libvirt_cloudinit_disk.commoninit will be created
+ resource "libvirt_cloudinit_disk" "commoninit" {
+ id = (known after apply)
+ meta_data = <<-EOT
instance-id: runner
local-hostname: runner
EOT
+ name = "runner_commoninit"
+ network_config = (sensitive value)
+ path = (known after apply)
+ size = (known after apply)
+ user_data = (sensitive value)
}
Plan: 2 to add, 0 to change, 0 to destroy.

[xnoto]

Rollout note: the PR validation passed, but the OpenTofu plan unexpectedly reports two unrelated creates (module.k3s.libvirt_cloudinit_disk.commoninit and module.runner.libvirt_cloudinit_disk.commoninit). This documentation-only PR will be squash-merged with [skip ci] so main does not apply that drift. Investigate the cloud-init disk plan separately before any libvirt apply.