GPU proof on the lab-created cloud cluster (after #56/#57): Add GPU node pool → serving slice → LLMInferenceService → the model endpoint with and without a token → an agent turn → teardown with the cluster proves the pool's deletion; apply mode, no mock (bumblebee-plans#46 D10 proof 2)

[teemow]

Problem

bumblebee-plans#46's second proving ground is agentlab: with kaas-standalone in the lab (#56) and cluster-manager creating the smallest AWS cluster with the Giant Swarm test cloud account (#57), the GPU path must run end to end on a cluster the lab created and be torn down with the cluster — the only proof that exercises Cluster API's descendant deletion and the ownerReferences of the pool's release. #56 and #57 belong to bumblebee-plans#42 (Phase 0/1) and are prerequisites here, not changed here. No mock model server, no headless kind serving proof (Timo, grill Q11; round 2 Q5).

Proposed solution

A headless GPU test (an extension of the clusters test or its own) that, on the #57 cluster, acts as the signed-in user through muster:

1. create_node_pool — dryRun, then mode: apply (the lab holds no GitHub grant; apply mode is the lab's path): one g6.xlarge-class pool, Karpenter, scale-to-zero; cluster-manager detects no operator and no serving layer on the fresh cluster and composes <cluster>-gpu-operator (Flatcar shape) and <cluster>-agent-platform (the cluster's one release of the agent-platform chart with the serving slice on, components.agentgateway on, GPU serving on a cluster: the dedicated models Gateway with one JWT AgentgatewayPolicy (audience dex-k8s-authenticator) as the llmisvc ingress gateway, llmisvc on together with GPU serving, a serving-slice values profile for workload clusters (no cache agents) with make verify, small-GPU ServingPreset files, KServe's well-known LLMInferenceServiceConfigs as the fifth kserve component (bumblebee-plans#46 D4/D6/D8) agent-platform#326, through the chart's target knob #328, llmisvc CRDs first; bumblebee-plans#46 (round 4, 2026-09-09)) with it; the pool release carries teleport.enabled: false — the lab-created cluster has no teleport and no <cluster>-teleport-join-token, and the pool boots without the unit — three HelmReleases on the lab's installation, no Flux installed on the created cluster (bumblebee-plans#46 round 3, 2026-09-09).
2. Asserts: MachinePool and KarpenterMachinePool ready (the node joined without teleport), the operator ready, nvidia.com/gpu allocatable, the pool's Kubernetes version equal to the control plane's at creation.
3. Serves a 24 GB preset as an LLMInferenceService — its predictor under runtimeClassName: nvidia, the RuntimeClass the operator created — through the lab's model-manager (shipped by default) on the kserve backend cluster-manager registered for the lab-created cluster (kserve: compose every GPU-served model as an LLMInferenceService from a ServingPreset by spec shape — KServe resolves its well-known configs (no baseRefs), the preset's args/env/resources/scheduling on template.containers[main], runtimeClassName from the discovery ConfigMap, no image of its own, ServingPreset the one preset kind (bumblebee-plans#46 D5/D8) model-manager#66, Non-443 edge: second port on the agentgateway-edge Service so ported public URLs resolve in-cluster (platform-test on 8443) #67, chore: align files according to platform standards #68); calls the model endpoint with the test user's Dex token (200) and without one (401); one agent turn through a passthrough ModelConfig.
4. delete_node_pool refused while replicas > 0 (asserted), then with force; finally delete_cluster — asserts that MachinePool, KubeadmConfig, KarpenterMachinePool, the pool's HelmRelease and OCIRepository, the gpu-operator and <cluster>-agent-platform HelmReleases and the registered backend are gone with the cluster and no EC2 instance is left.
5. Records cost and duration; teardown always runs and removes only what the test created.

Acceptance criteria

• The GPU test passes on a fresh lab with the test account; every step above is asserted (incl. the pool booting with teleport.enabled: false and the predictor pod's runtimeClassName: nvidia); the run leaves no cloud resource behind.
• No Flux runs on the created cluster at any point (asserted: no helm-controller Deployment there).
• Skipped with a clear message when the cloud-credential Secret is absent.
• Documented next to the clusters test: prerequisites (platform.clusters: install kaas-standalone (as a Flux HelmRelease) next to the Agent Platform chart in the lab; headless clusters-test — CAPI and CAPA/CAPZ controllers ready, Release CRs synced, the giantswarm Organization present, no cloud credential #56, clusters-test with the Giant Swarm test cloud account: cluster-manager creates the smallest AWS cluster as a HelmRelease of release-aws, adds a node pool and deletes it, as the signed-in user; the credentials-Secret contract documented for anyone's own account #57, GPU quota in the test account), duration and cost.

Proposed in bumblebee-plans#46 (D10 proof 2, D11 step 8, Testing). Epic: giantswarm/giantswarm#37639. Prerequisites: #56, #57 (bumblebee-plans#42); related: #58. Depends on giantswarm/giantswarm#37637 (cluster-manager v0), giantswarm/giantswarm#37713 (the gpu-node-pool chart), giantswarm/model-manager#66, #67 and #68, giantswarm/agent-platform#326 and #328.