refactor: extract K8s logic into ContainerK8s library target

Move all K8s sources from the container-k8s executable into a new
ContainerK8s library target. Sources/Plugins/K8s/ becomes a thin entry
point (K8sMain.swift) that calls K8sCommand.main().

Also make iptables MSS clamping non-fatal: if xt_TCPMSS is unavailable
in the VM kernel the node prep no longer aborts; a warning is logged
instead.

Author: jshi991

Package.swift

@@ -52,6 +52,7 @@ let package = Package(
         .library(name: "TerminalProgress", targets: ["TerminalProgress"]),
         .library(name: "MachineAPIClient", targets: ["MachineAPIClient"]),
         .library(name: "MachineAPIService", targets: ["MachineAPIService"]),
+        .library(name: "ContainerK8s", targets: ["ContainerK8s"]),
     ],
     dependencies: [
         .package(url: "https://github.com/apple/containerization.git", exact: Version(stringLiteral: scVersion)),
@@ -167,19 +168,21 @@ let package = Package(
         .testTarget(
             name: "K8sTests",
             dependencies: [
-                "k8s",
+                "ContainerK8s",
                 "ContainerResource",
                 "Yams",
             ],
             path: "Tests/K8sPluginTests"
         ),
-        .executableTarget(
-            name: "k8s",
+        .target(
+            name: "ContainerK8s",
             dependencies: [
                 .product(name: "ArgumentParser", package: "swift-argument-parser"),
                 .product(name: "Logging", package: "swift-log"),
                 .product(name: "Containerization", package: "containerization"),
                 .product(name: "ContainerizationOCI", package: "containerization"),
+                .product(name: "ContainerizationOS", package: "containerization"),
+                .product(name: "SystemPackage", package: "swift-system"),
                 "ContainerAPIClient",
                 "ContainerLog",
                 "ContainerPersistence",
@@ -188,10 +191,14 @@ let package = Package(
                 "TerminalProgress",
                 "Yams",
             ],
-            path: "Sources/Plugins/K8s",
-            exclude: ["config.toml"],
             resources: [.process("Resources/kindnet.yaml")]
         ),
+        .executableTarget(
+            name: "k8s",
+            dependencies: ["ContainerK8s"],
+            path: "Sources/Plugins/K8s",
+            exclude: ["config.toml"]
+        ),
         .executableTarget(
             name: "container-apiserver",
             dependencies: [

Sources/Plugins/K8s/K8sCommand.swift …s/ContainerK8s/Commands/K8sCommand.swiftSources/Plugins/K8s/K8sCommand.swift renamed to Sources/ContainerK8s/Commands/K8sCommand.swift Sources/Plugins/K8s/K8sCommand.swift renamed to Sources/ContainerK8s/Commands/K8sCommand.swift

@@ -17,9 +17,8 @@
 import ArgumentParser
 import ContainerVersion
 
-@main
-struct K8sCommand: AsyncParsableCommand {
-    static let configuration = CommandConfiguration(
+public struct K8sCommand: AsyncParsableCommand {
+    public static let configuration = CommandConfiguration(
         commandName: "k8s",
         abstract: "Manage local Kubernetes development clusters (EXPERIMENTAL)",
         discussion: """
@@ -56,4 +55,6 @@ struct K8sCommand: AsyncParsableCommand {
             K8sWriteConfig.self,
         ]
     )
+
+    public init() {}
 }

Sources/Plugins/K8s/K8sCreate.swift …es/ContainerK8s/Commands/K8sCreate.swiftSources/Plugins/K8s/K8sCreate.swift renamed to Sources/ContainerK8s/Commands/K8sCreate.swift Sources/Plugins/K8s/K8sCreate.swift renamed to Sources/ContainerK8s/Commands/K8sCreate.swift

@@ -216,6 +216,9 @@ struct K8sHelper {
         guard result.code == 0 else {
             throw ContainerizationError(.internalError, message: "node prep failed on \(nodeID): \(result.output)")
         }
+        if result.output.contains("mss-clamp-failed") {
+            log.warning("MSS clamping unavailable — large pod-to-pod transfers may be affected", metadata: ["node": "\(nodeID)"])
+        }
     }
 
     static func bootstrapControlPlane(
@@ -291,8 +294,8 @@ struct K8sHelper {
         sysctl -w net.bridge.bridge-nf-call-ip6tables=1 2>/dev/null || true
         systemctl restart containerd
         ctr -n k8s.io images tag registry.k8s.io/pause:3.10 registry.k8s.io/pause:3.10.1 2>/dev/null || true
-        iptables -t mangle -A OUTPUT  -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1220
-        iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1220
+        iptables -t mangle -A OUTPUT  -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1220 2>/dev/null || echo "warning: mss-clamp-failed"
+        iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1220 2>/dev/null || echo "warning: mss-clamp-failed"
         """
     }()