Skip to content

Commit aa5f947

Browse files
authored
Allow k8s-device-plugin daemonset run in nonpriveleged mode
1 parent 24e4a0e commit aa5f947

File tree

2 files changed

+12
-0
lines changed

2 files changed

+12
-0
lines changed

api/nvidia/v1/clusterpolicy_types.go

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -713,6 +713,7 @@ type DevicePluginSpec struct {
713713
// +operator-sdk:gen-csv:customresourcedefinitions.specDescriptors.displayName="Enable NVIDIA Device Plugin deployment through GPU Operator"
714714
// +operator-sdk:gen-csv:customresourcedefinitions.specDescriptors.x-descriptors="urn:alm:descriptor:com.tectonic.ui:booleanSwitch"
715715
Enabled *bool `json:"enabled,omitempty"`
716+
716717

717718
// NVIDIA Device Plugin image repository
718719
// +kubebuilder:validation:Optional
@@ -767,6 +768,12 @@ type DevicePluginSpec struct {
767768
// +operator-sdk:gen-csv:customresourcedefinitions.specDescriptors=true
768769
// +operator-sdk:gen-csv:customresourcedefinitions.specDescriptors.displayName="MPS related configuration for the NVIDIA Device Plugin"
769770
MPS *MPSConfig `json:"mps,omitempty"`
771+
772+
// Unpriveleged indicates NVIDIA Device Plugin should run with securityContext: priveleged: false
773+
// +operator-sdk:gen-csv:customresourcedefinitions.specDescriptors=true
774+
// +operator-sdk:gen-csv:customresourcedefinitions.specDescriptors.displayName="Run NVIDIA Device Plugin daemon set with privileged false, which alllows limiting NVIDIA_VISIBLE_DEVICES"
775+
// +operator-sdk:gen-csv:customresourcedefinitions.specDescriptors.x-descriptors="urn:alm:descriptor:com.tectonic.ui:booleanSwitch"
776+
Unprivileged *bool `json:"enabled,omitempty"`
770777
}
771778

772779
// DevicePluginConfig defines ConfigMap name for NVIDIA Device Plugin config

controllers/object_controls.go

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1359,6 +1359,11 @@ func TransformDevicePlugin(obj *appsv1.DaemonSet, config *gpuv1.ClusterPolicySpe
13591359
}
13601360
obj.Spec.Template.Spec.Containers[0].Image = image
13611361

1362+
// set privileged false if overriden
1363+
if config.Unprivileged {
1364+
obj.Spec.Template.Spec.Containers[0].SecurityContext.Privileged = false
1365+
}
1366+
13621367
// update image pull policy
13631368
obj.Spec.Template.Spec.Containers[0].ImagePullPolicy = gpuv1.ImagePullPolicy(config.DevicePlugin.ImagePullPolicy)
13641369

0 commit comments

Comments
 (0)