feat: topology-aware drift disruption ordering via DriftPolicy

[BrunoChauvet]

Description

When many nodes are drifted at once, Karpenter fans out disruption across all availability zones simultaneously. This is fast, but it can reduce availability for workloads that are sensitive to how replacements roll across failure domains.

For instance stateful workloads replicating data across topology domains, may be impacted of nodes holding the same partition across distinct domains are concurrently disrupted.

This PR adds an opt-in DriftPolicy field to NodePool.Spec.Disruption that lets cluster operators control how drift disruption proceeds across topology domains. When topologyKey is set, Karpenter disrupts one domain at a time — finishing replacements in us-east-1a before moving to us-east-1b, for example — rather than spreading disruption across all zones at once. An optional maxConcurrentPerDomain field (absolute or percentage) controls how many nodes can be replaced simultaneously within the active domain.

The active domain is selected alphabetically, which gives stable and predictable behaviour across controller restarts and as replacements progress. Nodes that do not carry the topology label are unaffected and remain eligible for disruption regardless. Without DriftPolicy set, behaviour is unchanged from today.

# Disrupt one zone at a time, one node at a time
disruption:
  driftPolicy:
    topologyKey: topology.kubernetes.io/zone

# Disrupt one zone at a time, up to 3 nodes at once
disruption:
  driftPolicy:
    topologyKey: topology.kubernetes.io/zone
    maxConcurrentPerDomain: "3"

DriftPolicy is intentionally separate from Budget — budgets control how many disruptions are allowed in total; DriftPolicy controls the order in which domains are disrupted. The two are orthogonal and can be combined.

Documentation update aws/karpenter-provider-aws#9073

How was this change tested?

• Unit tests for DriftPolicy API validation (valid keys, invalid keys, percentage values)
• Integration tests for domain selection ordering, per-domain budget gating, configurable concurrency, unlabelled node fall-through, and the empty-first invariant within the active domain
• CRDs regenerated and verified
• make presubmit

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: BrunoChauvet / name: Bruno Chauvet (10ad50b, 2e662e5, 2f5165f, 3301d85, 355d0f6, 3c38a39, 4b7154f, 6c46780, 782aeb6, 8633aa5, 9a02bac, ac367a4, c006f82, d5176cb, e3deeee, e87b757, fc8139a)

[k8s-ci-robot]

Hi @BrunoChauvet. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: BrunoChauvet
Once this PR has been reviewed and has the lgtm label, please assign jonathan-innis for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[BrunoChauvet]

/easycla

[BrunoChauvet]

/easycla