From b0ea72e0359ec48f9ae091e0e91162fad3ffa6b9 Mon Sep 17 00:00:00 2001
From: edersonbrilhante <contato@edersonbrilhante.com.br>
Date: Mon, 31 Aug 2026 20:58:05 +0200
Subject: [PATCH] fix(karpenter): add EBS CSI startup taints

---
 modules/infra/eks/templates/node_pool.yaml.tpl    | 6 ++++++
 modules/platform/arc/templates/node_pool.yaml.tpl | 6 ++++++
 modules/platform/arc/tests/behavior.tftest.hcl    | 9 +++++++++
 3 files changed, 21 insertions(+)

diff --git a/modules/infra/eks/templates/node_pool.yaml.tpl b/modules/infra/eks/templates/node_pool.yaml.tpl
index d40abd27d..9cdd7fcc3 100644
--- a/modules/infra/eks/templates/node_pool.yaml.tpl
+++ b/modules/infra/eks/templates/node_pool.yaml.tpl
@@ -5,6 +5,12 @@ metadata:
 spec:
   template:
     spec:
+      # The EBS CSI node plugin removes this taint after it is ready. Marking
+      # it as a startup taint prevents Karpenter from provisioning duplicate
+      # nodes while the plugin is still initializing.
+      startupTaints:
+        - key: ebs.csi.aws.com/agent-not-ready
+          effect: NoExecute
       requirements:
         - key: karpenter.k8s.aws/instance-family
           operator: In
diff --git a/modules/platform/arc/templates/node_pool.yaml.tpl b/modules/platform/arc/templates/node_pool.yaml.tpl
index 7ea40ec24..ec632a91e 100644
--- a/modules/platform/arc/templates/node_pool.yaml.tpl
+++ b/modules/platform/arc/templates/node_pool.yaml.tpl
@@ -9,6 +9,12 @@
           forge.local/scale_set_type: dind
           forge.local/tenant: ${tenant}
       spec:
+        # The EBS CSI node plugin removes this taint after it is ready. Marking
+        # it as a startup taint prevents Karpenter from provisioning duplicate
+        # nodes while the plugin is still initializing.
+        startupTaints:
+          - key: ebs.csi.aws.com/agent-not-ready
+            effect: NoExecute
         requirements:
         ${replace(trimspace(yamlencode(requirements)), "\n", "\n        ")}
         nodeClassRef:
diff --git a/modules/platform/arc/tests/behavior.tftest.hcl b/modules/platform/arc/tests/behavior.tftest.hcl
index 42ea16d93..41f344fd0 100644
--- a/modules/platform/arc/tests/behavior.tftest.hcl
+++ b/modules/platform/arc/tests/behavior.tftest.hcl
@@ -171,6 +171,15 @@ run "arc_single_runner_contract" {
     )
     error_message = "ARC root module must record non-migration Karpenter trigger values."
   }
+
+  assert {
+    condition = (
+      strcontains(file("${path.module}/templates/node_pool.yaml.tpl"), "startupTaints:")
+      && strcontains(file("${path.module}/templates/node_pool.yaml.tpl"), "ebs.csi.aws.com/agent-not-ready")
+      && strcontains(file("${path.module}/templates/node_pool.yaml.tpl"), "effect: NoExecute")
+    )
+    error_message = "Each tenant Karpenter NodePool must declare the EBS CSI bootstrap taint as a startup taint."
+  }
 }
 
 run "arc_migration_contract" {