karpenter: add the plugin module and its view of the capacity API

.github/workflows/ci.yaml

@@ -114,6 +114,9 @@ jobs:
       - name: Lint
         run: make lint
 
+      - name: Lint Karpenter plugin
+        run: make karpenter-lint
+
       - name: Save Go caches
         if: success() && github.event_name == 'push'
         uses: ./.github/actions/setup-go-cached
@@ -159,6 +162,9 @@ jobs:
       - name: Test
         run: make test
 
+      - name: Test Karpenter plugin
+        run: make karpenter-test
+
       - name: Upload coverage
         if: always()
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2

AGENTS.md

@@ -42,6 +42,10 @@ unbounded-kube is organized into several directories:
 - `internal/` - where shared but internal to this project packages are located.
   - `gantry/` - gantry shared packages (21 sub-packages: config, mirror, transfer, discovery, coord, hrw, coldstart, members, metrics, etc.). Includes `internal/gantry/proto/coord/v1/` for the libp2p coordination RPC messages (pull intent, please-pull); kept under internal/ so the wire schema isn't an exported API surface.
   - `net/` - unbounded-net shared packages (APIs, controllers, networking, metrics, webhooks, etc.).
+- `plugins/` - integrations that are their own Go modules because their upstream pins different library versions.
+  - `karpenter/` - the Unbounded Karpenter plugin: upstream Karpenter compiled with a cloud provider that uses only
+    MachineClass and MachineAllocation. It must not import the root module; it projects the API fields it uses and
+    checks them against the generated CRDs.
 - `tmp/` - project local temporary directory for intermediate stuff that will be cleaned up quickly.
 
 ## Building and Testing

Makefile

@@ -88,6 +88,11 @@ TOKEN_REFRESHER_IMAGE ?= $(CONTAINER_REGISTRY)/token-refresher:$(VERSION_TAG)
 MACHINE_OPS_CONTROLLER_BIN=bin/machine-ops-controller
 MACHINE_OPS_CONTROLLER_CMD=./cmd/machine-ops-controller
 MACHINE_OPS_CONTROLLER_IMAGE ?= $(CONTAINER_REGISTRY)/machine-ops-controller:$(VERSION_TAG)
+
+# The Unbounded Karpenter plugin is a nested Go module (plugins/karpenter),
+# because upstream Karpenter pins older Kubernetes libraries than this module.
+# Its targets delegate to plugins/karpenter/Makefile.
+KARPENTER_MAKE = $(MAKE) -C plugins/karpenter
 MACHINE_OPS_CONTROLLER_NAME ?= machine-ops-controller
 MACHINE_OPS_PROVIDER ?=
 MACHINE_OPS_SITE ?=
@@ -236,6 +241,7 @@ REACT_DEV ?= false
 
 .PHONY: all help fmt lint lint-actions test build vulncheck check-deps kubectl-unbounded kubectl-unbounded-build install-tools install-protoc install-helm install-kind generate kubectl-unbounded forge relctl relctl-build agent-artifacts-builder agent-artifacts-builder-build orcadev unbounded-agent machina machina-build machina-oci machina-oci-push machina-manifests machine-ops-controller machine-ops-controller-build machine-ops-controller-oci machine-ops-controller-oci-push machine-ops-manifests metalman metalman-build metalman-oci metalman-oci-push unbounded-operator unbounded-operator-build unbounded-operator-manifests playpen-manifests e2e-gantry e2e-playpen e2e-racer gomod docs-serve unbounded-net-controller unbounded-net-controller-build unbounded-net-node unbounded-net-node-build unbounded-net-routeplan-debug unping unping-build unroute unroute-build license-check notice notice-check gantry gantry-build gantry-manifests inventory-manifests
 .PHONY: net-frontend net-frontend-clean net-ebpf-build net-ebpf-generate net-ebpf-verify net-manifests gantry-chart-lint gantry-chart-package release-bom release-manifests unbounded-operator-release-manifest
+.PHONY: karpenter karpenter-fmt karpenter-lint karpenter-test
 .PHONY: image-machina-local image-token-refresher-local image-machine-ops-controller-local image-metalman-local image-unbounded-operator-local image-unbounded-operator-push image-playpen-local image-net-controller-local image-net-node-local image-gantry-local image-gantry-push images-local
 .PHONY: image-net-controller-push image-net-node-push images-net-all images-net-all-push
 
@@ -260,6 +266,8 @@ help: ## Show this help
 	@echo "  lint                             Run golangci-lint and actionlint"
 	@echo "  lint-actions                     Run actionlint over .github/workflows"
 	@echo "  test                             Run all tests"
+	@echo "  karpenter                        Lint and test the Karpenter plugin (nested module)"
+	@echo "  karpenter-fmt|lint|test          Individual Karpenter plugin steps"
 	@echo "  build                            Compile all Go packages"
 	@echo "  generate                         Run go generate (deepcopy, CRDs, protobuf)"
 	@echo "  vulncheck                        Run govulncheck; fails only on vulnerabilities with final fixes"
@@ -972,6 +980,19 @@ unroute-build: ## Build the unroute utility binary (no lint/test)
 
 unroute: test unroute-build ## Build the unroute utility (implies test)
 
+##@ Karpenter plugin (nested Go module in plugins/karpenter)
+
+karpenter-fmt: ## Format the Karpenter plugin module
+	$(KARPENTER_MAKE) fmt
+
+karpenter-lint: ## Lint the Karpenter plugin module
+	$(KARPENTER_MAKE) lint
+
+karpenter-test: ## Test the Karpenter plugin module
+	$(KARPENTER_MAKE) test
+
+karpenter: karpenter-lint karpenter-test ## Lint and test the Karpenter plugin
+
 ##@ Gantry (peer-to-peer OCI distribution)
 
 gantry-build: ## Build the gantry binary (no lint/test)

plugins/karpenter/Makefile

@@ -0,0 +1,28 @@
+# The Unbounded Karpenter plugin is its own Go module, because upstream
+# Karpenter pins Kubernetes libraries older than the root module's. Run these
+# targets from the repository root as `make karpenter-<target>`.
+
+ROOT := $(abspath ../..)
+GOLANGCI_LINT ?= golangci-lint
+
+export CGO_ENABLED := 0
+
+.PHONY: all tidy fmt lint test
+
+all: lint test
+
+tidy:
+	go mod tidy
+
+# golangci-lint resolves paths from the directory of its config file, so
+# `golangci-lint fmt` with the root config would format the whole repository.
+# Format only this module, the way the root `make fmt` does.
+fmt:
+	gofumpt -w ./internal
+	$(GOLANGCI_LINT) run --fix -c "$(ROOT)/.golangci.yaml" ./...
+
+lint:
+	$(GOLANGCI_LINT) run -c "$(ROOT)/.golangci.yaml" ./...
+
+test:
+	go test -count=1 ./...

plugins/karpenter/go.mod

@@ -0,0 +1,75 @@
+module github.com/Azure/unbounded/plugins/karpenter
+
+go 1.26.10
+
+require (
+	github.com/awslabs/operatorpkg v0.0.0-20261002163259-5e8ed3699dea
+	k8s.io/api v0.36.1
+	k8s.io/apiextensions-apiserver v0.36.0
+	k8s.io/apimachinery v0.36.1
+	sigs.k8s.io/yaml v1.6.0
+)
+
+require (
+	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/emicklei/go-restful/v3 v3.13.0 // indirect
+	github.com/evanphx/json-patch/v5 v5.9.11 // indirect
+	github.com/fsnotify/fsnotify v1.9.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.2 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-openapi/jsonpointer v0.23.1 // indirect
+	github.com/go-openapi/jsonreference v0.21.5 // indirect
+	github.com/go-openapi/swag v0.26.0 // indirect
+	github.com/go-openapi/swag/cmdutils v0.26.0 // indirect
+	github.com/go-openapi/swag/conv v0.26.0 // indirect
+	github.com/go-openapi/swag/fileutils v0.26.0 // indirect
+	github.com/go-openapi/swag/jsonname v0.26.0 // indirect
+	github.com/go-openapi/swag/jsonutils v0.26.0 // indirect
+	github.com/go-openapi/swag/loading v0.26.0 // indirect
+	github.com/go-openapi/swag/mangling v0.26.0 // indirect
+	github.com/go-openapi/swag/netutils v0.26.0 // indirect
+	github.com/go-openapi/swag/stringutils v0.26.0 // indirect
+	github.com/go-openapi/swag/typeutils v0.26.0 // indirect
+	github.com/go-openapi/swag/yamlutils v0.26.0 // indirect
+	github.com/google/gnostic-models v0.7.1 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/onsi/ginkgo/v2 v2.28.3 // indirect
+	github.com/onsi/gomega v1.40.0 // indirect
+	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+	github.com/prometheus/client_golang v1.23.2 // indirect
+	github.com/prometheus/client_model v0.6.2 // indirect
+	github.com/prometheus/common v0.67.5 // indirect
+	github.com/prometheus/procfs v0.20.1 // indirect
+	github.com/samber/lo v1.53.0 // indirect
+	github.com/spf13/pflag v1.0.10 // indirect
+	github.com/stretchr/objx v0.5.3 // indirect
+	github.com/x448/float16 v0.8.4 // indirect
+	go.uber.org/zap v1.28.0 // indirect
+	go.yaml.in/yaml/v2 v2.4.4 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/net v0.60.0 // indirect
+	golang.org/x/oauth2 v0.36.0 // indirect
+	golang.org/x/sync v0.23.0 // indirect
+	golang.org/x/sys v0.48.0 // indirect
+	golang.org/x/term v0.46.0 // indirect
+	golang.org/x/text v0.42.0 // indirect
+	golang.org/x/time v0.15.0 // indirect
+	gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect
+	google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
+	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
+	gopkg.in/inf.v0 v0.9.1 // indirect
+	k8s.io/client-go v0.36.1 // indirect
+	k8s.io/klog/v2 v2.140.0 // indirect
+	k8s.io/kube-openapi v0.0.0-20260414162039-ec9c827d403f // indirect
+	k8s.io/utils v0.0.0-20260319190234-28399d86e0b5 // indirect
+	sigs.k8s.io/controller-runtime v0.24.1 // indirect
+	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
+	sigs.k8s.io/randfill v1.0.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.4.0 // indirect
+)