feat: add Carbide provider implementation

isvctl/configs/aws/eks-layered.yaml

@@ -0,0 +1,71 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: LicenseRef-NvidiaProprietary
+
+# NVIDIA CORPORATION, its affiliates and licensors retain all intellectual
+# property and proprietary rights in and to this material, related
+# documentation and any modifications thereto. Any use, reproduction,
+# disclosure or distribution of this material and related documentation
+# without an express license agreement from NVIDIA CORPORATION or
+# its affiliates is strictly prohibited.
+
+# AWS EKS - Layered Provider Configuration
+#
+# Supplies commands (Terraform stubs) and context overrides for the
+# kaas template. Use with the template for composable validation:
+#
+#   isvctl test run \
+#     -f isvctl/configs/templates/kaas.yaml \
+#     -f isvctl/configs/aws/eks-layered.yaml
+#
+# For a self-contained config (no template needed), use eks.yaml instead.
+#
+# Environment Variables:
+#   TF_AUTO_APPROVE     — Skip Terraform approval prompts (default: false)
+#   TF_VAR_*            — Terraform variables (region, instance types, etc.)
+#   AWS_SKIP_TEARDOWN   — Preserve resources after test (default: false)
+#   NGC_API_KEY         — NGC API key for NIM workloads
+#   AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY — AWS credentials
+
+version: "1.0"
+
+# =============================================================================
+# Provider-specific commands (Terraform stubs)
+# =============================================================================
+commands:
+  kubernetes:
+    phases: ["setup", "test", "teardown"]
+    steps:
+      - name: provision_cluster
+        phase: setup
+        command: "../stubs/aws/eks/setup.sh"
+        timeout: 1800
+        env:
+          TF_AUTO_APPROVE: "true"
+          TF_VAR_region: "us-west-2"
+          TF_VAR_gpu_node_instance_types: '["g5.xlarge"]'
+          TF_VAR_gpu_node_desired_size: "1"
+          # Override with your IP CIDR for security (e.g., '["203.0.113.0/24"]')
+          # TF_VAR_cluster_endpoint_public_access_cidrs: '["0.0.0.0/0"]'
+
+      - name: teardown_cluster
+        phase: teardown
+        command: "../stubs/aws/eks/teardown.sh"
+        timeout: 1800
+        env:
+          TF_AUTO_APPROVE: "true"
+
+# =============================================================================
+# Context overrides for template defaults
+# =============================================================================
+# Single g5.xlarge GPU node = 1 GPU total (template defaults to 3)
+context:
+  total_gpus: "1"
+
+# =============================================================================
+# Validation overrides (optional)
+# =============================================================================
+# The template provides all checks with sensible defaults. Override only
+# what differs for this provider. Use {__merge__: true} to merge into
+# the template's check list instead of replacing it.
+tests:
+  description: "AWS EKS GPU cluster validation"

isvctl/configs/carbide/README.md

@@ -0,0 +1,88 @@
+# Carbide Provider
+
+Provider implementation for [NVIDIA Carbide](https://github.com/fabiendupont/cloud-provider-nvidia-carbide) bare-metal infrastructure management. Uses `carbidecli` to interact with the Carbide API.
+
+## Template Coverage
+
+| Template | Carbide Config | Status |
+|----------|---------------|--------|
+| `control-plane` | `control-plane.yaml` | SSH key + VPC lifecycle |
+| `network` | `network.yaml` | VPC, subnet, prefix, NSG |
+| `image-registry` | `image-registry.yaml` | OperatingSystem + InstanceType CRUD |
+| `bm` | `bm.yaml` | Instance launch/describe/reboot/teardown |
+| `iam` | `iam.yaml` | Token validation, scope coverage, write access |
+| `vm` | — | Not applicable (VMs are a platform concern, e.g., KubeVirt) |
+| `kaas` | — | Not applicable (K8s installation is a platform concern) |
+
+## Usage
+
+```bash
+# IAM: token validation + scope coverage (run first)
+isvctl test run \
+  -f isvctl/configs/templates/iam.yaml \
+  -f isvctl/configs/carbide/iam.yaml
+
+# Control plane validation
+isvctl test run \
+  -f isvctl/configs/templates/control-plane.yaml \
+  -f isvctl/configs/carbide/control-plane.yaml
+
+# Network validation
+CARBIDE_SITE_ID=<uuid> isvctl test run \
+  -f isvctl/configs/templates/network.yaml \
+  -f isvctl/configs/carbide/network.yaml
+
+# Image registry validation
+CARBIDE_SITE_ID=<uuid> isvctl test run \
+  -f isvctl/configs/templates/image-registry.yaml \
+  -f isvctl/configs/carbide/image-registry.yaml
+
+# Bare metal instance validation
+CARBIDE_SITE_ID=<uuid> CARBIDE_OS_ID=<uuid> CARBIDE_INSTANCE_TYPE=<uuid> \
+  isvctl test run \
+    -f isvctl/configs/templates/bm.yaml \
+    -f isvctl/configs/carbide/bm.yaml
+```
+
+## Authentication
+
+`carbidecli` handles authentication via its own config (`~/.carbide/config.yaml`) or environment variables:
+
+| Variable | Description |
+|----------|-------------|
+| `CARBIDE_TOKEN` | API bearer token |
+| `CARBIDE_API_KEY` | NGC API key |
+| `CARBIDE_ORG` | Organization/tenant name |
+
+## Required Environment Variables
+
+| Variable | Used by | Description |
+|----------|---------|-------------|
+| `CARBIDE_SITE_ID` | network, image-registry, bm | Site UUID for resource creation |
+| `CARBIDE_OS_ID` | bm | Operating system UUID for instance provisioning |
+| `CARBIDE_INSTANCE_TYPE` | bm | Instance type UUID (hardware profile) |
+| `CARBIDE_VPC_ID` | bm (optional) | Pre-existing VPC to use |
+| `CARBIDE_SSH_KEY_GROUP` | bm (optional) | SSH key group for instance access |
+
+## Extending for Platforms
+
+Carbide provides bare-metal infrastructure. Platforms (OpenShift, RHEL+Slurm, etc.) build on top:
+
+```bash
+# OpenShift on Carbide
+isvctl test run \
+  -f isvctl/configs/templates/kaas.yaml \
+  -f isvctl/configs/openshift/kaas-provision.yaml    # AI + Carbide orchestration
+  -f isvctl/configs/openshift/kaas-overrides.yaml     # OpenShift-specific checks
+
+# RHEL + Slurm on Carbide
+isvctl test run \
+  -f isvctl/configs/templates/bm.yaml \
+  -f isvctl/configs/carbide/bm.yaml \
+  -f isvctl/configs/slurm/bm-overrides.yaml           # Slurm-specific checks
+```
+
+The platform layer handles:
+- Orchestrating K8s/Slurm installation on Carbide bare metal
+- Platform-specific operators (GPU Operator, Network Operator)
+- Platform-specific validations (KubeVirt, DRA, ComputeDomains)

isvctl/configs/carbide/bm.yaml

@@ -0,0 +1,146 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: LicenseRef-NvidiaProprietary
+
+# NVIDIA CORPORATION, its affiliates and licensors retain all intellectual
+# property and proprietary rights in and to this material, related
+# documentation and any modifications thereto. Any use, reproduction,
+# disclosure or distribution of this material and related documentation
+# without an express license agreement from NVIDIA CORPORATION or
+# its affiliates is strictly prohibited.
+
+# Carbide Bare Metal (BMaaS) - Layered Provider Configuration
+#
+# Supplies commands (carbidecli stubs) for the bm template.
+# Tests bare-metal GPU instance lifecycle: launch, list, describe,
+# reboot, NIM deploy, teardown, and verification.
+#
+# Mapping to template concepts:
+#   launch_instance    → carbidecli instance create
+#   list_instances     → carbidecli instance list
+#   describe_instance  → carbidecli instance get
+#   reboot_instance    → carbidecli instance reboot
+#   reinstall_instance → skip (not supported by Carbide)
+#   deploy_nim         → shared NIM deploy script (SSH-based)
+#   teardown_nim       → shared NIM teardown script (SSH-based)
+#   teardown           → carbidecli instance delete
+#   verify_teardown    → carbidecli instance get (verify terminated)
+#
+# Usage:
+#   isvctl test run \
+#     -f isvctl/configs/templates/bm.yaml \
+#     -f isvctl/configs/carbide/bm.yaml
+#
+# Environment:
+#   carbidecli handles auth via config or env vars:
+#     CARBIDE_TOKEN / CARBIDE_API_KEY  — Authentication
+#     CARBIDE_ORG                      — Organization
+#     CARBIDE_SITE_ID                  — Site UUID (required)
+#     CARBIDE_OS_ID                    — Operating system UUID (required)
+#     CARBIDE_INSTANCE_TYPE            — Instance type (required)
+
+version: "1.0"
+
+commands:
+  bm:
+    phases: ["setup", "test", "teardown"]
+    steps:
+      # Launch bare-metal GPU instance
+      - name: launch_instance
+        phase: setup
+        command: "python3 ../stubs/carbide/bm/launch_instance.py"
+        args:
+          - "--site-id"
+          - "{{ context.site_id }}"
+          - "--os-id"
+          - "{{ context.os_id }}"
+          - "--instance-type"
+          - "{{ context.instance_type }}"
+        timeout: 1200
+
+      # List instances - verify instance is visible
+      - name: list_instances
+        phase: test
+        command: "python3 ../stubs/carbide/bm/list_instances.py"
+        args:
+          - "--site-id"
+          - "{{ context.site_id }}"
+          - "--instance-id"
+          - "{{steps.launch_instance.instance_id}}"
+        timeout: 120
+
+      # Describe instance - test phase anchor for SSH/GPU validations
+      - name: describe_instance
+        phase: test
+        command: "python3 ../stubs/carbide/bm/describe_instance.py"
+        args:
+          - "--instance-id"
+          - "{{steps.launch_instance.instance_id}}"
+        timeout: 120
+
+      # Reboot instance and validate recovery
+      - name: reboot_instance
+        phase: test
+        command: "python3 ../stubs/carbide/bm/reboot_instance.py"
+        args:
+          - "--instance-id"
+          - "{{steps.launch_instance.instance_id}}"
+          - "--public-ip"
+          - "{{steps.launch_instance.public_ip}}"
+        timeout: 1800
+
+      # Reinstall not supported by Carbide - always skipped
+      - name: reinstall_instance
+        phase: test
+        skip: true
+        command: "python3 ../stubs/carbide/bm/reinstall_instance.py"
+        timeout: 60
+
+      # Deploy NIM container via SSH (shared script)
+      # Requires NGC_API_KEY env var
+      - name: deploy_nim
+        phase: test
+        command: "python3 ../stubs/common/deploy_nim.py"
+        args:
+          - "--host"
+          - "{{steps.launch_instance.public_ip}}"
+          - "--key-file"
+          - "{{steps.launch_instance.key_file}}"
+        timeout: 1800
+
+      # Teardown NIM container via SSH (shared script)
+      - name: teardown_nim
+        phase: teardown
+        command: "python3 ../stubs/common/teardown_nim.py"
+        args:
+          - "--host"
+          - "{{steps.launch_instance.public_ip}}"
+          - "--key-file"
+          - "{{steps.launch_instance.key_file}}"
+        timeout: 120
+
+      # Teardown bare-metal instance
+      - name: teardown
+        phase: teardown
+        command: "python3 ../stubs/carbide/bm/teardown.py"
+        args:
+          - "--instance-id"
+          - "{{steps.launch_instance.instance_id}}"
+        timeout: 600
+
+      # Verify instance is terminated
+      - name: verify_teardown
+        phase: teardown
+        command: "python3 ../stubs/carbide/bm/verify_terminated.py"
+        args:
+          - "--instance-id"
+          - "{{steps.launch_instance.instance_id}}"
+        timeout: 120
+
+# Provider-specific context
+context:
+  site_id: "{{ env.CARBIDE_SITE_ID | default('') }}"
+  os_id: "{{ env.CARBIDE_OS_ID | default('') }}"
+  instance_type: "{{ env.CARBIDE_INSTANCE_TYPE | default('') }}"
+
+tests:
+  description: "Carbide bare metal (BMaaS): instance lifecycle, GPU, NIM deploy"