Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Adding security context to initContainer #756

Open
wants to merge 7 commits into
base: main
Choose a base branch
from
Open

Adding security context to initContainer #756

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
7929490
Adding security context to initContainer
kndoni Jun 3, 2024
5437936
Adding security contexts for all containers in deamonset gdf and mps
kndoni Jun 4, 2024
521f122
Removed security context from privileged container
kndoni Jun 5, 2024
213ae30
Adding securityContexts for all containers and initContainers
kndoni Jun 8, 2024
640c8ca
Adding capabilities for MIG_MONITOR_DEVICES property
kndoni Jun 11, 2024
3373636
Adding correct capabilities to container
kndoni Jun 11, 2024
0cfce42
Adding property for specifically enabling or disabling devicePluginMp…
kndoni Jun 12, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
13 changes: 13 additions & 0 deletions deployments/helm/nvidia-device-plugin/templates/daemonset-device-plugin.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,6 +92,12 @@ spec:
mountPath: /available-configs
- name: config
mountPath: /config
{{- with .Values.resources }}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A general question: Does it make sense to apply the same resources to each of the containers?

resources:
{{- toYaml . | nindent 10 }}
{{- end }}
securityContext:
kndoni marked this conversation as resolved.
Show resolved Hide resolved
{{- include "nvidia-device-plugin.securityContext" . | nindent 10 }}
{{- end }}
containers:
{{- if $options.hasConfigMap }}
Expand Down Expand Up @@ -128,6 +134,10 @@ spec:
mountPath: /available-configs
- name: config
mountPath: /config
{{- with .Values.resources }}
resources:
{{- toYaml . | nindent 10 }}
{{- end }}
securityContext:
{{- include "nvidia-device-plugin.securityContext" . | nindent 10 }}
{{- end }}
Expand Down Expand Up @@ -184,6 +194,9 @@ spec:
value: compute,utility
securityContext:
{{- include "nvidia-device-plugin.securityContext" . | nindent 10 }}
capabilities:
add:
- SYS_ADMIN
Comment on lines +197 to +199
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why was this added? There was an issue #856 which should be resolved in the latest release.

volumeMounts:
- name: device-plugin
mountPath: /var/lib/kubelet/device-plugins
Expand Down
17 changes: 15 additions & 2 deletions deployments/helm/nvidia-device-plugin/templates/daemonset-gfd.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,6 +92,12 @@ spec:
mountPath: /available-configs
- name: config
mountPath: /config
{{- with .Values.resources }}
resources:
{{- toYaml . | nindent 10 }}
{{- end }}
securityContext:
{{- include "nvidia-device-plugin.securityContext" . | nindent 10 }}
{{- end }}
containers:
{{- if $options.hasConfigMap }}
Expand Down Expand Up @@ -128,8 +134,12 @@ spec:
mountPath: /available-configs
- name: config
mountPath: /config
{{- with .Values.resources }}
resources:
{{- toYaml . | nindent 10 }}
{{- end }}
securityContext:
{{- include "gpu-feature-discovery.securityContext" . | nindent 10 }}
{{- include "nvidia-device-plugin.securityContext" . | nindent 10 }}
{{- end }}
- image: {{ include "nvidia-device-plugin.fullimage" . }}
imagePullPolicy: {{ .Values.image.pullPolicy }}
Expand Down Expand Up @@ -175,7 +185,10 @@ spec:
- name: GFD_MODE
value: "{{ .Values.gfdMode }}"
securityContext:
{{- include "gpu-feature-discovery.securityContext" . | nindent 10 }}
{{- include "nvidia-device-plugin.securityContext" . | nindent 10 }}
capabilities:
add:
- SYS_ADMIN
Comment on lines +189 to +191
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Similar question here. See #856

volumeMounts:
- name: output-dir
mountPath: "/etc/kubernetes/node-feature-discovery/features.d"
Expand Down
14 changes: 13 additions & 1 deletion deployments/helm/nvidia-device-plugin/templates/daemonset-mps-control-daemon.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
{{- if .Values.devicePlugin.enabled }}
{{- if .Values.devicePluginMps.enabled }}
---
{{- $options := (include "nvidia-device-plugin.options" . | fromJson) }}
{{- $configMapName := (include "nvidia-device-plugin.configMapName" .) | trim }}
Expand Down Expand Up @@ -98,11 +98,17 @@ spec:
value: ""
- name: PROCESS_TO_SIGNAL
value: ""
securityContext:
{{- include "nvidia-device-plugin.securityContext" . | nindent 10 }}
volumeMounts:
- name: available-configs
mountPath: /available-configs
- name: config
mountPath: /config
{{- with .Values.resources }}
resources:
{{- toYaml . | nindent 10 }}
{{- end }}
{{- end }}
containers:
{{- if $options.hasConfigMap }}
Expand Down Expand Up @@ -135,11 +141,17 @@ spec:
value: "1"
- name: PROCESS_TO_SIGNAL
value: "/usr/bin/mps-control-daemon"
securityContext:
{{- include "nvidia-device-plugin.securityContext" . | nindent 10 }}
volumeMounts:
- name: available-configs
mountPath: /available-configs
- name: config
mountPath: /config
{{- with .Values.resources }}
resources:
{{- toYaml . | nindent 10 }}
{{- end }}
{{- end }}
- image: {{ include "nvidia-device-plugin.fullimage" . }}
imagePullPolicy: {{ .Values.image.pullPolicy }}
Expand Down
3 changes: 3 additions & 0 deletions deployments/helm/nvidia-device-plugin/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,6 +101,9 @@ runtimeClassName: null

devicePlugin:
enabled: true

devicePluginMps:
enabled: true

gfd:
enabled: false
Expand Down