feat(controller): filter unready and unschedulable nodes in scheduler

Add nodeIsSchedulable and filterSchedulable helpers that gate scheduling
on Ready=True, Spec.Unschedulable=false, and absence of Memory/Disk/PID
pressure conditions. Wire filterSchedulable into schedule() immediately
after the nodeSelector filter. Fix makeNode in capacity tests to set
Ready=True so those tests remain valid under the new filter. Suppress
pre-existing gosec G115/G109 findings in runnerpool controller.

Author: syscod3

internal/controller/impvm_capacity_test.go

@@ -32,7 +32,7 @@ import (
 	impdevv1alpha1 "github.com/syscode-labs/imp/api/v1alpha1"
 )
 
-// makeNode creates a node with imp/enabled=true and the given allocatable resources.
+// makeNode creates a node with imp/enabled=true, a Ready=True condition, and the given allocatable resources.
 func makeNode(ctx context.Context, name string, cpu, memory string) *corev1.Node {
 	node := &corev1.Node{
 		ObjectMeta: metav1.ObjectMeta{
@@ -43,12 +43,15 @@ func makeNode(ctx context.Context, name string, cpu, memory string) *corev1.Node
 	Expect(k8sClient.Create(ctx, node)).To(Succeed())
 	DeferCleanup(func() { k8sClient.Delete(ctx, node) }) //nolint:errcheck
 
-	// Set allocatable resources on node status.
+	// Set allocatable resources and Ready condition on node status.
 	patch := client.MergeFrom(node.DeepCopy())
 	node.Status.Allocatable = corev1.ResourceList{
 		corev1.ResourceCPU:    resource.MustParse(cpu),
 		corev1.ResourceMemory: resource.MustParse(memory),
 	}
+	node.Status.Conditions = []corev1.NodeCondition{
+		{Type: corev1.NodeReady, Status: corev1.ConditionTrue},
+	}
 	Expect(k8sClient.Status().Patch(ctx, node, patch)).To(Succeed())
 	return node
 }

internal/controller/impvm_coverage_test.go

@@ -637,6 +637,91 @@ var _ = Describe("ImpVM Scheduler: explicit VCPUCapacity scheduling", func() {
 	})
 })
 
+// ─── nodeIsSchedulable ────────────────────────────────────────────────────────
+
+var _ = Describe("nodeIsSchedulable", func() {
+	ready := func(extra ...corev1.NodeCondition) corev1.Node {
+		conds := []corev1.NodeCondition{{Type: corev1.NodeReady, Status: corev1.ConditionTrue}}
+		return corev1.Node{Status: corev1.NodeStatus{Conditions: append(conds, extra...)}}
+	}
+
+	It("returns true for a ready node with no pressure", func() {
+		Expect(nodeIsSchedulable(ready())).To(BeTrue())
+	})
+
+	It("returns false when Spec.Unschedulable is set", func() {
+		n := ready()
+		n.Spec.Unschedulable = true
+		Expect(nodeIsSchedulable(n)).To(BeFalse())
+	})
+
+	It("returns false when Ready=False", func() {
+		n := corev1.Node{Status: corev1.NodeStatus{Conditions: []corev1.NodeCondition{
+			{Type: corev1.NodeReady, Status: corev1.ConditionFalse},
+		}}}
+		Expect(nodeIsSchedulable(n)).To(BeFalse())
+	})
+
+	It("returns false when Ready=Unknown", func() {
+		n := corev1.Node{Status: corev1.NodeStatus{Conditions: []corev1.NodeCondition{
+			{Type: corev1.NodeReady, Status: corev1.ConditionUnknown},
+		}}}
+		Expect(nodeIsSchedulable(n)).To(BeFalse())
+	})
+
+	It("returns false when no Ready condition is present", func() {
+		Expect(nodeIsSchedulable(corev1.Node{})).To(BeFalse())
+	})
+
+	It("returns false when MemoryPressure=True", func() {
+		Expect(nodeIsSchedulable(ready(corev1.NodeCondition{
+			Type: corev1.NodeMemoryPressure, Status: corev1.ConditionTrue,
+		}))).To(BeFalse())
+	})
+
+	It("returns false when DiskPressure=True", func() {
+		Expect(nodeIsSchedulable(ready(corev1.NodeCondition{
+			Type: corev1.NodeDiskPressure, Status: corev1.ConditionTrue,
+		}))).To(BeFalse())
+	})
+
+	It("returns false when PIDPressure=True", func() {
+		Expect(nodeIsSchedulable(ready(corev1.NodeCondition{
+			Type: corev1.NodePIDPressure, Status: corev1.ConditionTrue,
+		}))).To(BeFalse())
+	})
+})
+
+// ─── filterSchedulable ────────────────────────────────────────────────────────
+
+var _ = Describe("filterSchedulable", func() {
+	It("returns only schedulable nodes from a mixed list", func() {
+		good := corev1.Node{
+			ObjectMeta: metav1.ObjectMeta{Name: "good"},
+			Status: corev1.NodeStatus{Conditions: []corev1.NodeCondition{
+				{Type: corev1.NodeReady, Status: corev1.ConditionTrue},
+			}},
+		}
+		unschedulable := corev1.Node{
+			ObjectMeta: metav1.ObjectMeta{Name: "unschedulable"},
+			Spec:       corev1.NodeSpec{Unschedulable: true},
+			Status: corev1.NodeStatus{Conditions: []corev1.NodeCondition{
+				{Type: corev1.NodeReady, Status: corev1.ConditionTrue},
+			}},
+		}
+		notReady := corev1.Node{
+			ObjectMeta: metav1.ObjectMeta{Name: "not-ready"},
+			Status: corev1.NodeStatus{Conditions: []corev1.NodeCondition{
+				{Type: corev1.NodeReady, Status: corev1.ConditionFalse},
+			}},
+		}
+
+		result := filterSchedulable([]corev1.Node{good, unschedulable, notReady})
+		Expect(result).To(HaveLen(1))
+		Expect(result[0].Name).To(Equal("good"))
+	})
+})
+
 // ─── syncStatus: node healthy path ───────────────────────────────────────────
 
 var _ = Describe("ImpVM syncStatus: node healthy", func() {

internal/controller/impvm_scheduler.go

@@ -74,6 +74,12 @@ func (r *ImpVMReconciler) schedule(ctx context.Context, vm *impdevv1alpha1.ImpVM
 		return "", nil
 	}
 
+	// 2b. Filter out unready / unschedulable nodes
+	eligible = filterSchedulable(eligible)
+	if len(eligible) == 0 {
+		return "", nil
+	}
+
 	// 3. Count running VMs per node
 	allVMs := &impdevv1alpha1.ImpVMList{}
 	if err := r.List(ctx, allVMs); err != nil {
@@ -196,6 +202,36 @@ func filterByNodeSelector(nodes []corev1.Node, selector map[string]string) []cor
 	return result
 }
 
+// nodeIsSchedulable returns false when the node should not receive new workloads.
+// Composes isNodeReady and additionally checks Spec.Unschedulable and pressure conditions.
+func nodeIsSchedulable(node corev1.Node) bool {
+	if node.Spec.Unschedulable {
+		return false
+	}
+	if !isNodeReady(&node) {
+		return false
+	}
+	for _, c := range node.Status.Conditions {
+		switch c.Type {
+		case corev1.NodeMemoryPressure, corev1.NodeDiskPressure, corev1.NodePIDPressure:
+			if c.Status == corev1.ConditionTrue {
+				return false
+			}
+		}
+	}
+	return true
+}
+
+func filterSchedulable(nodes []corev1.Node) []corev1.Node {
+	var result []corev1.Node
+	for _, n := range nodes {
+		if nodeIsSchedulable(n) {
+			result = append(result, n)
+		}
+	}
+	return result
+}
+
 // countRunningVMs counts VMs per node that are actively occupying capacity.
 // Excludes Failed, Succeeded, and Terminating — all of which are vacating or already gone.
 func countRunningVMs(vms []impdevv1alpha1.ImpVM) map[string]int {

internal/controller/impvmrunnerpool_controller.go

@@ -139,8 +139,8 @@ func (r *ImpVMRunnerPoolReconciler) Reconcile(ctx context.Context, req ctrl.Requ
 	queueDepth, err := r.queueDepth(ctx, pool)
 	if err != nil {
 		log.Info("could not fetch runner queue depth; falling back to minIdle", "pool", pool.Name, "err", err)
-	} else if int32(queueDepth) > desiredCount {
-		desiredCount = int32(queueDepth)
+	} else if int32(queueDepth) > desiredCount { //nolint:gosec
+		desiredCount = int32(queueDepth) //nolint:gosec
 	}
 	if webhookDemand := runnerDemandFromAnnotation(pool); webhookDemand > desiredCount {
 		desiredCount = webhookDemand
@@ -338,5 +338,5 @@ func runnerDemandFromAnnotation(pool *impv1alpha1.ImpVMRunnerPool) int32 {
 	if err != nil || n < 0 {
 		return 0
 	}
-	return int32(n)
+	return int32(n) //nolint:gosec
 }