Install each device stack only where its driver is claimed, adding CPU pools and AMD serving

.github/workflows/e2e-clouds.yml

@@ -34,7 +34,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        cloud: [eks, aks, gke, civo, nebius, vultr, existing]
+        cloud: [eks, aks, gke, civo, nebius, vultr, existing, existing-filtered]
 
     steps:
       # Two kind clusters and the serving stack need more disk than the runner

CONTRIBUTING.md

@@ -125,7 +125,7 @@ and it runs the pytest suite in `e2e/tests/`, exiting non-zero if a test fails.
 verify command is what the label-gated `E2E` workflow runs on CI (add the
 `test-e2e` label to a PR), so a green local `--verify` and a green CI run mean
 the same thing. `-- --cloud <cloud>` instead installs one cloud's serving
-stack onto KWOK-faked GPU pools and audits placement, still with no
+stack onto KWOK-faked device pools and audits placement, still with no
 credentials; its per-cloud CI matrix (the `E2E Clouds` workflow) runs on pull
 requests touching the serving stack or `e2e/`. See `e2e/README.md`.
 
@@ -429,7 +429,10 @@ checks to trip. In order:
    `dra` owns the DRA selector paths the upstream values don't. The fork
    is deleted the day NVIDIA/aicr#2517 lands.
 3. Expect `ALLOW`/`DROP` to fail closed on any component the new catalog
-   adds; classify it with a reason.
+   adds; classify it with a reason. An `ALLOW` entry also names the DRA
+   drivers whose device stacks the component belongs to (empty for a
+   component every cluster needs) - deciding that is part of classifying
+   it; see design/multi-accelerator.md.
 4. Expect `check_namespace_holds` to fail closed if the catalog moved a
    component's chart namespace: Helm can't move a release across
    namespaces, so existing clusters would wedge on a fresh-install

apis/aksclusters/definition.yaml

@@ -128,10 +128,13 @@ spec:
                         Determines what workloads this pool runs. System pools
                         host controllers, gateways, and infrastructure. GPU
                         pools host inference workloads and get the NVIDIA
-                        driver installed by AKS.
+                        driver installed by AKS. CPU pools host CPU inference
+                        workloads: no GPU driver, and the modelplane.ai/cpu
+                        label and taint.
                       enum:
                       - System
                       - GPU
+                      - CPU
                     vmSize:
                       type: string
                       description: >-

apis/civoclusters/definition.yaml

@@ -51,10 +51,14 @@ spec:
                 description: >-
                   Civo Kubernetes (k3s) version. Civo requires an exact
                   version string including the k3s build suffix (e.g.
-                  1.34.1-k3s1); list current versions with civo kubernetes
+                  1.36.0-k3s1); list current versions with civo kubernetes
                   versions. Choose 1.34 or newer so Dynamic Resource
-                  Allocation (how GPUs bind to pods) is generally available.
-                  Defaults to Civo's current default version.
+                  Allocation (how devices bind to pods) is generally
+                  available, and 1.36 or newer for a CPU pool: its cores are
+                  claimed as consumable capacity, which Kubernetes enables by
+                  default from 1.36 (DRAConsumableCapacity). Defaults to
+                  Civo's current default version, which may be older than a
+                  CPU pool needs.
                 minLength: 1
                 maxLength: 32
               credentials:
@@ -110,10 +114,13 @@ spec:
                         Determines what workloads this pool runs. System
                         pools host controllers, gateways, and infrastructure.
                         GPU pools host inference workloads and are tainted to
-                        exclude non-GPU pods.
+                        exclude non-GPU pods. CPU pools host CPU inference
+                        workloads: a non-GPU size and the modelplane.ai/cpu
+                        label and taint.
                       enum:
                       - System
                       - GPU
+                      - CPU
                     size:
                       type: string
                       description: >-

apis/eksclusters/definition.yaml

@@ -132,10 +132,13 @@ spec:
                         Determines what workloads this group runs. System
                         groups host controllers, gateways, and infrastructure.
                         GPU groups host inference workloads and use a
-                        GPU-enabled AMI.
+                        GPU-enabled AMI. CPU groups host CPU inference
+                        workloads: a standard AMI, no GPU, and the
+                        modelplane.ai/cpu label and taint.
                       enum:
                       - System
                       - GPU
+                      - CPU
                     instanceType:
                       type: string
                       description: >-

apis/gkeclusters/definition.yaml

@@ -124,10 +124,13 @@ spec:
                         Determines what workloads this pool runs. System pools
                         host controllers, gateways, and infrastructure. GPU
                         pools host inference workloads and are tainted to
-                        exclude non-GPU pods.
+                        exclude non-GPU pods. CPU pools host CPU inference
+                        workloads: a standard node image, no GPU, and the
+                        modelplane.ai/cpu label and taint.
                       enum:
                       - System
                       - GPU
+                      - CPU
                     machineType:
                       type: string
                       description: >-