fix(karpenter): add EBS CSI startup taints

modules/infra/eks/templates/node_pool.yaml.tpl

@@ -5,6 +5,12 @@ metadata:
 spec:
   template:
     spec:
+      # The EBS CSI node plugin removes this taint after it is ready. Marking
+      # it as a startup taint prevents Karpenter from provisioning duplicate
+      # nodes while the plugin is still initializing.
+      startupTaints:
+        - key: ebs.csi.aws.com/agent-not-ready
+          effect: NoExecute
       requirements:
         - key: karpenter.k8s.aws/instance-family
           operator: In

modules/platform/arc/templates/node_pool.yaml.tpl

@@ -9,6 +9,12 @@
           forge.local/scale_set_type: dind
           forge.local/tenant: ${tenant}
       spec:
+        # The EBS CSI node plugin removes this taint after it is ready. Marking
+        # it as a startup taint prevents Karpenter from provisioning duplicate
+        # nodes while the plugin is still initializing.
+        startupTaints:
+          - key: ebs.csi.aws.com/agent-not-ready
+            effect: NoExecute
         requirements:
         ${replace(trimspace(yamlencode(requirements)), "\n", "\n        ")}
         nodeClassRef:

modules/platform/arc/tests/behavior.tftest.hcl

@@ -171,6 +171,15 @@ run "arc_single_runner_contract" {
     )
     error_message = "ARC root module must record non-migration Karpenter trigger values."
   }
+
+  assert {
+    condition = (
+      strcontains(file("${path.module}/templates/node_pool.yaml.tpl"), "startupTaints:")
+      && strcontains(file("${path.module}/templates/node_pool.yaml.tpl"), "ebs.csi.aws.com/agent-not-ready")
+      && strcontains(file("${path.module}/templates/node_pool.yaml.tpl"), "effect: NoExecute")
+    )
+    error_message = "Each tenant Karpenter NodePool must declare the EBS CSI bootstrap taint as a startup taint."
+  }
 }
 
 run "arc_migration_contract" {