fix(chart): ship the karpenter core CRDs so the controller can start (#44)

The chart only shipped HCloudNodeClass, so a clean install per the README
left the controller crash-looping on its own watches:

  "if kind is a CRD, it should be installed before calling Start"
  kind=NodeClaim.karpenter.sh error=no matches for kind "NodeClaim" in
  version "karpenter.sh/v1"

controllers.NewControllers() watches NodePool and NodeClaim unconditionally,
so neither is optional. Vendor both from the pinned sigs.k8s.io/karpenter
v1.14.0; each serves v1, matching the version the controller requests.

Copy them in `make generate` rather than checking in a hand-copied snapshot,
so a sigs.k8s.io/karpenter bump that changes either schema fails the existing
`make generate-verify` gate in CI instead of silently shipping a stale CRD.

NodeOverlay and CapacityBuffer are deliberately not vendored: both sit behind
feature gates defaulting to false, and the chart does not expose them.

README: correct the claim that a single CRD ships, and document that Helm
never upgrades resources in crds/, with the server-side apply to run before
`helm upgrade`.

Fixes #43

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: stubbi

Makefile

@@ -1,4 +1,4 @@
-.PHONY: build test lint generate generate-verify docker-build test-envtest
+.PHONY: build test lint generate generate-verify vendor-core-crds docker-build test-envtest
 
 BINARY         := karpenter-provider-hetzner
 IMAGE          := ghcr.io/paperclipinc/karpenter-provider-hetzner
@@ -16,10 +16,26 @@ test:
 lint:
 	golangci-lint run ./...
 
-generate:
+generate: vendor-core-crds
 	$(CONTROLLER_GEN) object paths="./pkg/apis/..."
 	$(CONTROLLER_GEN) crd paths="./pkg/apis/..." output:crd:dir=charts/karpenter-provider-hetzner/crds
 
+# Copy the karpenter core CRDs (NodePool, NodeClaim) out of the pinned
+# sigs.k8s.io/karpenter module and into the chart. The controller watches both,
+# so the chart is unusable without them. Sourcing them from the module rather
+# than checking in a hand-copied snapshot means a version bump that changes the
+# schema is caught by `make generate-verify` in CI.
+#
+# NodeOverlay and CapacityBuffer are deliberately not vendored: both sit behind
+# feature gates that default to false, and this chart does not expose them.
+vendor-core-crds:
+	@set -eu; \
+	dir="$$(go list -m -f '{{.Dir}}' sigs.k8s.io/karpenter)"; \
+	for crd in karpenter.sh_nodepools.yaml karpenter.sh_nodeclaims.yaml; do \
+		cp "$$dir/pkg/apis/crds/$$crd" charts/karpenter-provider-hetzner/crds/$$crd; \
+		chmod u+w charts/karpenter-provider-hetzner/crds/$$crd; \
+	done
+
 generate-verify: generate
 	@if [ -n "$$(git status --porcelain pkg/apis charts/karpenter-provider-hetzner/crds)" ]; then \
 		echo "generated files are out of date; run 'make generate' and commit"; \

README.md

@@ -67,7 +67,13 @@ helm install karpenter-provider-hetzner \
 
 `clusterName` is **required** — it scopes which servers this controller manages. The controller fails fast if it is unset.
 
-The CRD ships in the chart's `crds/` directory and is installed automatically by Helm.
+Three CRDs ship in the chart's `crds/` directory and are installed automatically by Helm: `HCloudNodeClass` (this provider) plus the `NodePool` and `NodeClaim` core CRDs from `karpenter.sh`, which the controller watches. No separate CRD install step is needed.
+
+> **Upgrading:** Helm only ever *installs* resources from `crds/`; it never updates them. When upgrading to a chart whose karpenter core version changed, apply the CRDs yourself before `helm upgrade`:
+>
+> ```bash
+> kubectl apply --server-side -f https://raw.githubusercontent.com/paperclipinc/karpenter-provider-hetzner/main/charts/karpenter-provider-hetzner/crds/
+> ```
 
 ## Usage