Merge pull request #978 from NVIDIA/no-privileged-toolkit-validation

disable privileged mode for toolkit-validation init containers

Author: tariq1890

assets/gpu-feature-discovery/0500_daemonset.yaml

@@ -30,12 +30,10 @@ spec:
           image: "FILLED BY THE OPERATOR"
           command: ['sh', '-c']
           args: ["until [ -f /run/nvidia/validations/toolkit-ready ]; do echo waiting for nvidia container stack to be setup; sleep 5; done"]
-          securityContext:
-            privileged: true
           volumeMounts:
             - name: run-nvidia
               mountPath: /run/nvidia
-              mountPropagation: Bidirectional
+              mountPropagation: HostToContainer
         - name: config-manager-init
           image: "FILLED BY THE OPERATOR"
           command: ["config-manager"]

assets/state-dcgm-exporter/0900_daemonset.yaml

@@ -29,8 +29,6 @@ spec:
         image: "FILLED BY THE OPERATOR"
         command: ['sh', '-c']
         args: ["until [ -f /run/nvidia/validations/toolkit-ready ]; do echo waiting for nvidia container stack to be setup; sleep 5; done"]
-        securityContext:
-          privileged: true
         volumeMounts:
           - name: run-nvidia
             mountPath: "/run/nvidia"

assets/state-dcgm/0400_dcgm.yml

@@ -29,8 +29,6 @@ spec:
         image: "FILLED BY THE OPERATOR"
         command: ['sh', '-c']
         args: ["until [ -f /run/nvidia/validations/toolkit-ready ]; do echo waiting for nvidia container stack to be setup; sleep 5; done"]
-        securityContext:
-          privileged: true
         volumeMounts:
           - name: run-nvidia
             mountPath: /run/nvidia

assets/state-device-plugin/0500_daemonset.yaml

@@ -29,8 +29,6 @@ spec:
         name: toolkit-validation
         command: ['sh', '-c']
         args: ["until [ -f /run/nvidia/validations/toolkit-ready ]; do echo waiting for nvidia container stack to be setup; sleep 5; done"]
-        securityContext:
-          privileged: true
         volumeMounts:
           - name: run-nvidia-validations
             mountPath: /run/nvidia/validations

assets/state-mig-manager/0600_daemonset.yaml

@@ -29,8 +29,6 @@ spec:
           image: "FILLED BY THE OPERATOR"
           command: ['sh', '-c']
           args: ["until [ -f /run/nvidia/validations/toolkit-ready ]; do echo waiting for nvidia container toolkit to be setup; sleep 5; done"]
-          securityContext:
-            privileged: true
           volumeMounts:
             - name: run-nvidia-validations
               mountPath: /run/nvidia/validations

assets/state-mps-control-daemon/0400_daemonset.yaml

@@ -30,8 +30,6 @@ spec:
           name: toolkit-validation
           command: ['sh', '-c']
           args: ["until [ -f /run/nvidia/validations/toolkit-ready ]; do echo waiting for nvidia container stack to be setup; sleep 5; done"]
-          securityContext:
-            privileged: true
           volumeMounts:
             - name: run-nvidia
               mountPath: /run/nvidia

assets/state-sandbox-device-plugin/0500_daemonset.yaml

@@ -35,8 +35,6 @@ spec:
           env:
             - name: NVIDIA_VISIBLE_DEVICES
               value: void
-          securityContext:
-            privileged: true
           volumeMounts:
             - name: run-nvidia-validations
               mountPath: /run/nvidia/validations