Fix Azure node-policy apply failures, resync API surface, align v1/v2 fields, add CRUD test harness

Makefile

@@ -49,8 +49,8 @@ TARGET_PROTO_DIR = internal/proto/api/v1
 TARGET_GEN_PB_DIR = internal/gen/api/v1
 TARGET_GEN_CONNECT_DIR = internal/gen/api/v1/apiv1connect
 
-PROTO_FILES       = common.proto instance.proto k8s.proto recommendation.proto cluster.proto profiling.proto
-GEN_PB_FILES      = common.pb.go instance.pb.go k8s.pb.go recommendation.pb.go cluster.pb.go cluster_grpc.pb.go profiling.pb.go profiling_grpc.pb.go
+PROTO_FILES       = common.proto instance.proto k8s.proto recommendation.proto cluster.proto profiling.proto hpa_connector.proto
+GEN_PB_FILES      = common.pb.go instance.pb.go k8s.pb.go recommendation.pb.go cluster.pb.go cluster_grpc.pb.go profiling.pb.go profiling_grpc.pb.go hpa_connector.pb.go
 GEN_CONNECT_FILES = k8s.connect.go recommendation.connect.go cluster.connect.go profiling.connect.go
 
 

docs/resources/node_policy.md

@@ -292,6 +292,7 @@ resource "devzero_node_policy" "azure_example" {
 - `azure` (Attributes) Azure-specific configuration for nodes provisioned with this policy. (see [below for nested schema](#nestedatt--azure))
 - `capacity_type_tip` (String) Tooltip for capacity types
 - `capacity_types` (Attributes) Capacity types selector (e.g., spot, on-demand, reserved) (see [below for nested schema](#nestedatt--capacity_types))
+- `cloud_provider_id` (Number) Cloud provider ID this policy is intended for: `1` = AWS, `2` = Azure, `3` = GCP, `4` = OCI. Informational/UI filter — compilation always uses the target cluster's provider.
 - `description` (String) Free-form description of the policy to help others understand its intent and scope.
 - `disruption` (Attributes) Configuration for node disruption policies including consolidation and expiration settings. (see [below for nested schema](#nestedatt--disruption))
 - `disruptions_tip` (String) Tooltip for disruptions
@@ -305,6 +306,7 @@ resource "devzero_node_policy" "azure_example" {
 - `instance_generations_tip` (String) Tooltip for instance generations
 - `instance_hypervisors` (Attributes) Instance hypervisors selector (see [below for nested schema](#nestedatt--instance_hypervisors))
 - `instance_hypervisors_tip` (String) Tooltip for instance hypervisors
+- `instance_local_nvme` (Attributes) Ephemeral NVMe storage per node in GiB (AWS only; karpenter.k8s.aws/instance-local-nvme) (see [below for nested schema](#nestedatt--instance_local_nvme))
 - `instance_sizes` (Attributes) Instance sizes selector (e.g., Standard_D4s for Azure, large for AWS) (see [below for nested schema](#nestedatt--instance_sizes))
 - `instance_sizes_tip` (String) Tooltip for instance sizes
 - `instance_types` (Attributes) Instance types selector — explicit full type names (e.g., m5.xlarge for AWS, Standard_D4s_v2 for Azure) (see [below for nested schema](#nestedatt--instance_types))
@@ -317,9 +319,11 @@ resource "devzero_node_policy" "azure_example" {
 - `operating_systems` (Attributes) Operating systems selector (e.g., linux, windows) (see [below for nested schema](#nestedatt--operating_systems))
 - `operating_systems_tip` (String) Tooltip for operating systems
 - `raw` (Attributes List) Raw Karpenter NodePool and NodeClass YAML specifications for advanced use cases. (see [below for nested schema](#nestedatt--raw))
+- `startup_taints` (Attributes List) List of Kubernetes taints applied to nodes only while they start up (Karpenter `startupTaints`). Removed once the node is ready. (see [below for nested schema](#nestedatt--startup_taints))
 - `taints` (Attributes List) List of Kubernetes taints to apply to nodes provisioned with this policy. (see [below for nested schema](#nestedatt--taints))
 - `taints_tip` (String) Tooltip for taints
 - `weight` (Number) Priority weight for this node policy. Higher weights are preferred when multiple policies match. Default: 10 (medium priority).
+- `zonal_shift` (Attributes) Behavior during an AWS ARC zonal shift. AWS only — silently ignored for other clouds. (see [below for nested schema](#nestedatt--zonal_shift))
 - `zones` (Attributes) Availability zones selector (see [below for nested schema](#nestedatt--zones))
 - `zones_tip` (String) Tooltip for zones
 
@@ -358,9 +362,12 @@ Optional:
 - `ami_selector_terms` (Attributes List) AMI selector terms (see [below for nested schema](#nestedatt--aws--ami_selector_terms))
 - `associate_public_ip_address` (Boolean) Associate public IP address with instances
 - `block_device_mappings` (Attributes List) Block device mappings (see [below for nested schema](#nestedatt--aws--block_device_mappings))
+- `capacity_reservation_selector_terms` (Attributes List) Selects EC2 Capacity Reservations that nodes launched by this policy may use. Terms are ORed; criteria within a term are ANDed. (see [below for nested schema](#nestedatt--aws--capacity_reservation_selector_terms))
+- `context` (String) Context passed through to EC2 Fleet launches (`spec.context` on the EC2NodeClass). Reserved for use by AWS.
 - `detailed_monitoring` (Boolean) Enable detailed CloudWatch monitoring
 - `instance_profile` (String) IAM instance profile
 - `instance_store_policy` (String) Policy for instance store volumes. Valid value: `RAID0`.
+- `kubelet` (Attributes) Kubelet configuration overrides applied to nodes launched by this policy (maps to the EC2NodeClass `spec.kubelet` block). (see [below for nested schema](#nestedatt--aws--kubelet))
 - `metadata_options` (Attributes) Configuration for EC2 instance metadata service. Defaults provide secure IMDS v2 configuration. (see [below for nested schema](#nestedatt--aws--metadata_options))
 - `role` (String) IAM role name
 - `security_group_selector_terms` (Attributes List) Security group selector terms (see [below for nested schema](#nestedatt--aws--security_group_selector_terms))
@@ -404,6 +411,35 @@ Optional:
 
 
 
+<a id="nestedatt--aws--capacity_reservation_selector_terms"></a>
+### Nested Schema for `aws.capacity_reservation_selector_terms`
+
+Optional:
+
+- `id` (String) Capacity reservation ID
+- `owner_id` (String) AWS account ID that owns the capacity reservation
+- `tags` (Map of String) Tags to match on the capacity reservation
+
+
+<a id="nestedatt--aws--kubelet"></a>
+### Nested Schema for `aws.kubelet`
+
+Optional:
+
+- `cluster_dns` (List of String) Cluster DNS server IPs
+- `cpu_cfs_quota` (Boolean) Enable CPU CFS quota enforcement for containers that specify CPU limits
+- `eviction_hard` (Map of String) Hard eviction thresholds (e.g. memory.available = 100Mi)
+- `eviction_max_pod_grace_period` (Number) Maximum pod termination grace period (seconds) used on soft eviction
+- `eviction_soft` (Map of String) Soft eviction thresholds
+- `eviction_soft_grace_period` (Map of String) Grace periods for soft eviction thresholds
+- `image_gc_high_threshold_percent` (Number) Disk usage percentage above which image garbage collection runs
+- `image_gc_low_threshold_percent` (Number) Disk usage percentage below which image garbage collection stops
+- `kube_reserved` (Map of String) Resources reserved for Kubernetes system daemons
+- `max_pods` (Number) Maximum number of pods per node
+- `pods_per_core` (Number) Maximum pods per CPU core
+- `system_reserved` (Map of String) Resources reserved for system daemons (e.g. cpu, memory, ephemeral-storage)
+
+
 <a id="nestedatt--aws--metadata_options"></a>
 ### Nested Schema for `aws.metadata_options`
 
@@ -442,11 +478,30 @@ Optional:
 
 - `fips_mode` (String) FIPS 140-2 mode. Valid values: `FIPS`, `Disabled`.
 - `image_family` (String) Azure image family. Valid values: `Ubuntu`, `Ubuntu2204`, `Ubuntu2404`, `AzureLinux`.
+- `image_version` (String) Pinned node image version. Requires the DevZero node operator >= 1.8.4.
+- `kubelet` (Attributes) Kubelet configuration overrides applied to nodes launched by this policy (maps to the AKSNodeClass `spec.kubelet` block). (see [below for nested schema](#nestedatt--azure--kubelet))
 - `max_pods` (Number) Maximum number of pods per node
 - `os_disk_size_gb` (Number) OS disk size in GB
 - `tags` (Map of String) Azure tags to apply to resources
 - `vnet_subnet_id` (String) VNet subnet ID
 
+<a id="nestedatt--azure--kubelet"></a>
+### Nested Schema for `azure.kubelet`
+
+Optional:
+
+- `allowed_unsafe_sysctls` (List of String) Unsafe sysctls or sysctl patterns allowed on the node
+- `container_log_max_files` (Number) Maximum number of container log files retained per container
+- `container_log_max_size` (String) Maximum size of a container log file before rotation (e.g. 50Mi)
+- `cpu_cfs_quota` (Boolean) Enable CPU CFS quota enforcement for containers that specify CPU limits
+- `cpu_cfs_quota_period` (String) CPU CFS quota period (e.g. 100ms)
+- `cpu_manager_policy` (String) CPU manager policy. Valid values: `none`, `static`.
+- `image_gc_high_threshold_percent` (Number) Disk usage percentage above which image garbage collection runs
+- `image_gc_low_threshold_percent` (Number) Disk usage percentage below which image garbage collection stops
+- `pod_pids_limit` (Number) Maximum number of PIDs per pod
+- `topology_manager_policy` (String) Topology manager policy. Valid values: `none`, `best-effort`, `restricted`, `single-numa-node`.
+
+
 
 <a id="nestedatt--capacity_types"></a>
 ### Nested Schema for `capacity_types`
@@ -604,6 +659,28 @@ Optional:
 
 
 
+<a id="nestedatt--instance_local_nvme"></a>
+### Nested Schema for `instance_local_nvme`
+
+Optional:
+
+- `match_expressions` (Attributes List) List of label selector requirements (see [below for nested schema](#nestedatt--instance_local_nvme--match_expressions))
+- `match_labels` (Map of String) Map of label key-value pairs to match
+
+<a id="nestedatt--instance_local_nvme--match_expressions"></a>
+### Nested Schema for `instance_local_nvme.match_expressions`
+
+Required:
+
+- `key` (String) Label key
+- `operator` (String) Operator for matching. Valid values: `In`, `NotIn`, `Exists`, `DoesNotExist`, `Gt`, `Lt`. `Gt`/`Lt` apply to numeric selectors such as `instance_generations` and `instance_cpus`.
+
+Optional:
+
+- `values` (List of String) List of values for In/NotIn operators
+
+
+
 <a id="nestedatt--instance_sizes"></a>
 ### Nested Schema for `instance_sizes`
 
@@ -688,6 +765,16 @@ Optional:
 - `nodepool_yaml` (String) Raw NodePool YAML
 
 
+<a id="nestedatt--startup_taints"></a>
+### Nested Schema for `startup_taints`
+
+Required:
+
+- `effect` (String) Taint effect. Valid values: `NoSchedule`, `PreferNoSchedule`, `NoExecute`.
+- `key` (String) Taint key
+- `value` (String) Taint value
+
+
 <a id="nestedatt--taints"></a>
 ### Nested Schema for `taints`
 
@@ -698,6 +785,16 @@ Required:
 - `value` (String) Taint value
 
 
+<a id="nestedatt--zonal_shift"></a>
+### Nested Schema for `zonal_shift`
+
+Optional:
+
+- `allow_zone_fallback` (Boolean) Expand a single-zone policy to other zones when its zone is impacted
+- `evict_impacted_nodes` (Boolean) Also terminate existing nodes in the impacted zone (respects PDBs)
+- `respect_zonal_shift` (Boolean) Master opt-in. When false the other fields are ignored
+
+
 <a id="nestedatt--zones"></a>
 ### Nested Schema for `zones`
 

docs/resources/node_policy_target.md

@@ -44,29 +44,20 @@ resource "devzero_node_policy_target" "comprehensive" {
   ]
 }
 
-# Example with multiple clusters
-resource "devzero_cluster" "us_east" {
-  name = "production-us-east-1"
+# The API allows at most ONE cluster per target — to cover several clusters,
+# create one target per cluster (for_each keeps it concise).
+resource "devzero_cluster" "production_regions" {
+  for_each = toset(["us-east-1", "us-west-2", "eu-west-1"])
+  name     = "production-${each.key}"
 }
 
-resource "devzero_cluster" "us_west" {
-  name = "production-us-west-2"
-}
-
-resource "devzero_cluster" "eu_west" {
-  name = "production-eu-west-1"
-}
-
-resource "devzero_node_policy_target" "multi_cluster" {
-  name        = "all-production-clusters"
-  description = "Apply cost optimization policy to all production clusters"
+resource "devzero_node_policy_target" "per_cluster" {
+  for_each    = devzero_cluster.production_regions
+  name        = "standard-nodes-${each.key}"
+  description = "Apply cost optimization policy to ${each.key}"
   policy_id   = devzero_node_policy.standard_nodes.id
   enabled     = true
-  cluster_ids = [
-    devzero_cluster.us_east.id,
-    devzero_cluster.us_west.id,
-    devzero_cluster.eu_west.id,
-  ]
+  cluster_ids = [each.value.id]
 }
 
 # Example of disabled target (for temporary disabling without destroying)
@@ -84,7 +75,7 @@ resource "devzero_node_policy_target" "disabled" {
 
 ### Required
 
-- `cluster_ids` (List of String) List of cluster IDs to apply the node policy to. Must reference existing cluster IDs.
+- `cluster_ids` (List of String) Cluster ID to apply the node policy to. The API accepts at most one cluster per target; create one target per cluster.
 - `name` (String) Human-friendly name for the target. Used for display in the DevZero UI.
 - `policy_id` (String) Node policy to attach this target to. Must reference an existing `devzero_node_policy` resource ID.