Move the cluster bootstrap into the keys flake.

Bootstrapping the cluster needs access to secrets, so I am moving it into the keys flake.

nix/kubernetes/keys/package/bootstrap-script/package.nix

@@ -0,0 +1,49 @@
+# unpackPhase
+# patchPhase
+# configurePhase
+# buildPhase
+# checkPhase
+# installPhase
+# fixupPhase
+# installCheckPhase
+# distPhase
+{
+  config,
+  lib,
+  stdenv,
+  writeShellScript,
+  k8s,
+  openssh,
+  ...
+}:
+let
+  bootstrap_script = (writeShellScript "bootstrap-script" bootstrap_script_body);
+  bootstrap_script_body = (''
+    set -euo pipefail
+    IFS=$'\n\t'
+    DIR="$( cd "$( dirname "''${BASH_SOURCE[0]}" )" && pwd )"
+
+    ${apply_manifests}
+    echo "Bootstrap finished"
+  '');
+  manifests = (
+    lib.concatMapStringsSep "," lib.escapeShellArg [
+      ./files/manifests/initial_clusterrole.yaml
+      ./files/manifests/cilium.yaml
+      ./files/manifests/flux_namespace.yaml
+      ./files/manifests/flux.yaml
+    ]
+  );
+  apply_manifests = "kubectl --kubeconfig=${k8s.client-configs.admin}/admin.kubeconfig apply --server-side --force-conflicts -f ${manifests}";
+in
+stdenv.mkDerivation (finalAttrs: {
+  name = "bootstrap-script";
+  nativeBuildInputs = [ ];
+  buildInputs = [ ];
+
+  unpackPhase = "true";
+
+  installPhase = ''
+    cp ${bootstrap_script} "$out"
+  '';
+})