feat(init): init --with-opencost — deploy OpenCost for precise Tier-2 cost

[mayur-tolexo]

What

Make kubectl tidy init optionally deploy OpenCost into the cluster, so scans report precise Tier-2 cost (real node pricing — spot / reserved / committed-use discounts) out of the box, instead of blended derived pricing. Before this, Tier 2 only worked if you already ran OpenCost yourself.

How it works

kubectl tidy init --with-opencost                  # CRD + operator + OpenCost
kubectl tidy init --with-opencost \
  --prometheus-url http://prometheus-server.monitoring.svc:80   # default shown
kubectl tidy init --print --with-opencost          # emit manifests for GitOps
kubectl tidy uninstall --with-opencost             # remove it again

• Embedded manifest (internal/installer/assets/opencost.yaml): Namespace, ServiceAccount, read-only ClusterRole/ClusterRoleBinding, Deployment (ghcr.io/opencost/opencost), and a Service on :9003 at opencost.opencost.svc — exactly the endpoint kubetidy's DetectOpenCost already probes, so Tier 2 lights up automatically once it's ready.
• OpenCost needs Prometheus to read usage; the Prometheus endpoint is templated into the manifest via a placeholder and set with --prometheus-url (defaults to http://prometheus-server.monitoring.svc:80).
• Reversible: uninstall --with-opencost deletes OpenCost (before the operator), idempotently. It's off by default so a user's own OpenCost install is never touched.
• --print --with-opencost emits the manifests for inspection/GitOps instead of applying.

Changes

• internal/installer/installer.go: embed the manifest, add IncludeOpenCost/PrometheusURL to Options and IncludeOpenCost to UninstallOptions; wire installOpenCost into Install (both code paths) and OpenCost removal into Uninstall; export OpenCostManifest(prometheusURL) for --print.
• internal/cli/init.go: --with-opencost + --prometheus-url flags, --print support, friendly success note.
• internal/cli/uninstall.go: --with-opencost flag.
• Docs: README (setup + Tier 2 sections), ROADMAP (producer side of Tier 2), CHANGELOG [Unreleased].

Tests

• internal/installer/opencost_test.go: manifest substitution + defaulting, object decode (6 kinds), Uninstall --with-opencost removes it / leaves it alone by default.
• internal/cli/init_test.go / uninstall_test.go: new flags present; --print --with-opencost includes the substituted manifest, omitted otherwise.

Full gate green: go build, go vet, gofmt, go test ./..., golangci-lint (0 issues).

Note: the apply path itself (installOpenCost) isn't unit-tested because the fake dynamic client doesn't support server-side apply — same constraint as the existing Install path. Verified via --print output and decode tests.

🤖 Generated with Claude Code