feat: support modal

.env.example

@@ -0,0 +1,21 @@
+# Nebula provider credentials — SECRETS ONLY.
+#
+# Copy to .env and fill in real values. .env is gitignored — never commit tokens.
+# Consumed by hack/deploy.sh (make deploy-all), which turns these into one
+# Kubernetes Secret PER PROVIDER. Non-secret config (image, namespace, Kind
+# cluster) is NOT here — pass it as make variables, e.g.
+#   make deploy-all IMG=myrepo/nebula:v1 DEPLOY_KIND_CLUSTER=nebula-test-e2e
+#
+#   cp .env.example .env
+#   # edit .env
+#   make deploy-all
+
+# --- Modal provider --------------------------------------------------------
+# From `modal token new`. Leave blank to skip creating the Modal secret (the
+# provider is then skipped at registration — not fatal).
+MODAL_TOKEN_ID=
+MODAL_TOKEN_SECRET=
+
+# --- Additional providers (add as adapters land) ---------------------------
+# Each provider gets its OWN secret (see hack/deploy.sh PROVIDER_SECRETS), e.g.:
+# RUNPOD_API_KEY=

.github/workflows/lint.yml

@@ -0,0 +1,23 @@
+name: Lint
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  lint:
+    name: Run on Ubuntu
+    runs-on: ubuntu-latest
+    steps:
+      - name: Clone the code
+        uses: actions/checkout@v4
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - name: Run linter
+        uses: golangci/golangci-lint-action@v8
+        with:
+          version: v2.1.6

.github/workflows/test-e2e.yml

@@ -0,0 +1,37 @@
+name: E2E Tests
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  test-e2e:
+    name: Run on Ubuntu
+    runs-on: ubuntu-latest
+    steps:
+      - name: Clone the code
+        uses: actions/checkout@v4
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - name: Install the latest version of kind
+        run: |
+          curl -Lo ./kind https://kind.sigs.k8s.io/dl/latest/kind-linux-amd64
+          chmod +x ./kind
+          sudo mv ./kind /usr/local/bin/kind
+
+      - name: Verify kind installation
+        run: kind version
+
+      - name: Running Test e2e
+        # Nebula does not use cert-manager: the webhook serving cert is a
+        # self-signed Secret from hack/gen-webhook-cert.sh (see the e2e BeforeAll),
+        # so skip the suite's cert-manager install/uninstall entirely.
+        env:
+          CERT_MANAGER_INSTALL_SKIP: "true"
+        run: |
+          go mod tidy
+          make test-e2e

.github/workflows/test.yml

@@ -0,0 +1,23 @@
+name: Tests
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  test:
+    name: Run on Ubuntu
+    runs-on: ubuntu-latest
+    steps:
+      - name: Clone the code
+        uses: actions/checkout@v4
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - name: Running Tests
+        run: |
+          go mod tidy
+          make test

.gitignore

@@ -17,6 +17,10 @@ Dockerfile.cross
 
 !vendor/**/zz_generated.*
 
+# local environment / credentials — never commit real tokens
+.env
+.env.local
+
 # editor and IDE paraphernalia
 .idea
 .vscode
@@ -31,3 +35,6 @@ __pycache__
 *.pyc
 .pytest_cache
 *.tgz
+
+.devcontainer
+bin

.golangci.yml

@@ -0,0 +1,61 @@
+version: "2"
+run:
+  allow-parallel-runners: true
+linters:
+  default: none
+  enable:
+    - copyloopvar
+    - dupl
+    - errcheck
+    - ginkgolinter
+    - goconst
+    - gocyclo
+    - govet
+    - ineffassign
+    - lll
+    - misspell
+    - nakedret
+    - prealloc
+    - revive
+    - staticcheck
+    - unconvert
+    - unparam
+    - unused
+  settings:
+    revive:
+      rules:
+        - name: comment-spacings
+        - name: import-shadowing
+  exclusions:
+    generated: lax
+    rules:
+      - linters:
+          - lll
+        path: api/*
+      - linters:
+          - dupl
+          - lll
+        path: internal/*
+      # Test helpers intentionally take name/namespace params for readable call
+      # sites even when the current tests all pass the same value; unparam's
+      # "always receives X" is noise there (and removing the param hurts clarity).
+      # goconst likewise flags repeated fixture strings ("inst-1", …) that read
+      # fine inline — extracting a const per fixture adds indirection, not clarity.
+      - linters:
+          - goconst
+          - unparam
+        path: _test\.go
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
+formatters:
+  enable:
+    - gofmt
+    - goimports
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$

Dockerfile

@@ -0,0 +1,39 @@
+# Build the manager binary
+FROM golang:1.24 AS builder
+ARG TARGETOS
+ARG TARGETARCH
+# VERSION is stamped into the binary (pkg/version) and surfaces as the virtual
+# node's kubelet VERSION. Passed by `make docker-build` (defaults to git describe).
+ARG VERSION=nebula-dev
+
+WORKDIR /workspace
+# Copy the Go Modules manifests
+COPY go.mod go.mod
+COPY go.sum go.sum
+# cache deps before building and copying source so that we don't need to re-download as much
+# and so that source changes don't invalidate our downloaded layer
+RUN go mod download
+
+# Copy the go source
+COPY cmd/main.go cmd/main.go
+COPY api/ api/
+COPY internal/ internal/
+COPY pkg/ pkg/
+
+# Build
+# the GOARCH has not a default value to allow the binary be built according to the host where the command
+# was called. For example, if we call make docker-build in a local env which has the Apple Silicon M1 SO
+# the docker BUILDPLATFORM arg will be linux/arm64 when for Apple x86 it will be linux/amd64. Therefore,
+# by leaving it empty we can ensure that the container and binary shipped on it will have the same platform.
+RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} \
+    go build -a -ldflags "-X github.com/InftyAI/Nebula/pkg/version.gitVersion=${VERSION}" \
+    -o manager cmd/main.go
+
+# Use distroless as minimal base image to package the manager binary
+# Refer to https://github.com/GoogleContainerTools/distroless for more details
+FROM gcr.io/distroless/static:nonroot
+WORKDIR /
+COPY --from=builder /workspace/manager .
+USER 65532:65532
+
+ENTRYPOINT ["/manager"]