fix: only count topology domains the pod can actually reach

[lukeraphael]

Summary

A topology spread group seeded its domains from every NodePool's instance-type offerings, even domains no node the pod could land on can supply. In a cluster where some NodePools span another region and a pod is pinned to one pool (karpenter.sh/nodepool=monitoring), those foreign zones stay at count 0, so domainMinCount is pinned at 0 and no domain is within maxSkew: 1 of it — a DoNotSchedule zone spread becomes permanently unsatisfiable and drift/consolidation never converges (unsatisfiable topology constraint for topology spread, key=topology.kubernetes.io/zone). kube-scheduler doesn't hit this because it only counts zones of nodes matching the pod.

TopologyDomainGroup now remembers which NodePool contributed each domain, along with that pool's taints and requirements, and ForEachDomain takes the whole pod-aware TopologyNodeFilter instead of just the taint policy:

-type TopologyDomainGroup map[string][][]v1.Taint
+type TopologyDomainGroup map[string]map[string]TopologyDomainSource // domain -> nodepool -> {Taints, Requirements}

 func (t TopologyDomainGroup) ForEachDomain(pod, nodeFilter TopologyNodeFilter, f func(domain string)) {
     // keep a domain if *any* nodepool supplying it can host the pod
     taints tolerated (unless TaintPolicy==Ignore) &&
     !nodeFilter.ConflictsWithRequirements(source.Requirements) (unless AffinityPolicy==Ignore)
 }

The affinity check is deliberately conflict-only (Requirements.Intersects, not Compatible): a NodePool's stored requirements are the ones common to every node it can launch, so a label the pool leaves to the instance type is undefined there and must not count as a mismatch. Only an outright value conflict (e.g. pod wants nodepool=monitoring, source is nodepool=accelerators) drops a domain, so the filter can never hide a domain that a node from that pool could actually provide.

Domain groups stay candidate-invariant and cacheable — the pod-dependent filtering happens at NewTopologyGroup time.

Testing

• topologydomaingroup_internal_test.go: node selector, required node affinity, NodeAffinityPolicy: Ignore, taints/tolerations, and a pod selecting an instance-type-only label (domains kept).
• topology_test.go: end-to-end spread of 4 pods pinned to a 2-zone NodePool while another pool offers a third zone — expects skew 2,2. Reverting the affinity condition reproduces the exact production error and fails this test.
• Full pkg/controllers/provisioning/scheduling, provisioning, and disruption suites pass.

Link to Devin session: https://app.devin.ai/sessions/e2c5be51371140be96fe3a13f15e0260
Open in Devin Desktop: https://app.devin.ai/desktop/session/e2c5be51371140be96fe3a13f15e0260?variant=devin
Requested by: @lukeraphael

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

🔍 Devin Review: 1 flag

Not posted on this PR by your GitHub settings — view it in Devin Review. (Configure)

[exa-heron-staging]

Heron review

global-review-orchestrator-guardian

Verdict: ✅ Approve · 0 findings · head b90646ba14 · openai/gpt-5.6-luna · 3m 37s · session

_{Last updated 2026-08-28 08:02 UTC · reply @heron dismiss <reason> to dismiss on its comment thread}