Merge pull request #29 from intel/update-gpu-chart

Update gpu chart

Author: byako

charts/intel-gpu-resource-driver/README.md

@@ -10,9 +10,22 @@ More info: [Intel Resource Drivers for Kubernetes](https://github.com/intel/inte
 ## Installing the chart
 
 ```
-helm install intel-gpu-resource-driver oci://ghcr.io/intel/intel-resource-drivers-for-kubernetes/intel-gpu-resource-driver \
+helm install \
+    --namespace "intel-gpu-resource-driver" \
     --create-namespace \
-    --namespace intel-gpu-resource-driver
+    intel-gpu-resource-driver oci://ghcr.io/intel/intel-resource-drivers-for-kubernetes/intel-gpu-resource-driver
+```
+
+> [!NOTE]
+> For Kubernetes clusters using [Pod Security Standards](https://kubernetes.io/docs/concepts/security/pod-security-standards/),
+> pre-create the namespace with the respective label allowing to use HostPath Volumes.
+
+```
+kubectl create namespace intel-gpu-resource-driver
+kubectl label --overwrite namespace intel-gpu-resource-driver pod-security.kubernetes.io/enforce=privileged
+helm install \
+    --namespace "intel-gpu-resource-driver" \
+    intel-gpu-resource-driver oci://ghcr.io/intel/intel-resource-drivers-for-kubernetes/intel-gpu-resource-driver
 ```
 
 ## Uninstalling the chart

charts/intel-gpu-resource-driver/templates/_helpers.tpl

@@ -20,10 +20,6 @@ intel-gpu-resource-driver
 {{- end -}}
 {{- end }}
 
-{{- define "intel-gpu-resource-driver.namespace" -}}
-{{- default .Release.Namespace .Values.namespaceOverride }}
-{{- end }}
-
 {{/* Labels for templates */}}
 {{- define "intel-gpu-resource-driver.labels" -}}
 helm.sh/chart: {{ include "intel-gpu-resource-driver.chart" . }}

charts/intel-gpu-resource-driver/templates/clusterrole.yaml

@@ -2,7 +2,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   name: {{ include "intel-gpu-resource-driver.clusterRoleName" . }}
-  namespace: {{ include "intel-gpu-resource-driver.namespace" . }}
+  namespace: {{ .Release.Namespace }}
 rules:
 - apiGroups: [""]
   resources: ["nodes"]

charts/intel-gpu-resource-driver/templates/clusterrolebinding.yaml

@@ -2,11 +2,11 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: {{ include "intel-gpu-resource-driver.clusterRoleBindingName" . }}
-  namespace: {{ include "intel-gpu-resource-driver.namespace" . }}
+  namespace: {{ .Release.Namespace }}
 subjects:
 - kind: ServiceAccount
   name: {{ include "intel-gpu-resource-driver.serviceAccountName" . }}
-  namespace: {{ include "intel-gpu-resource-driver.namespace" . }}
+  namespace: {{ .Release.Namespace }}
 roleRef:
   kind: ClusterRole
   name: {{ include "intel-gpu-resource-driver.clusterRoleName" . }}

charts/intel-gpu-resource-driver/templates/nfd.yaml renamed to charts/intel-gpu-resource-driver/templates/node-feature-rules.yaml

@@ -1,4 +1,4 @@
-{{- if .Values.nfd.enabled }}
+{{- if or .Values.nodeFeatureRules.enabled .Values.nfd.enabled }}
 apiVersion: nfd.k8s-sigs.io/v1alpha1
 kind: NodeFeatureRule
 metadata:

charts/intel-gpu-resource-driver/templates/resource-driver-namespace.yaml

@@ -2,7 +2,7 @@ apiVersion: apps/v1
 kind: DaemonSet
 metadata:
   name: intel-gpu-resource-driver-kubelet-plugin
-  namespace: {{ include "intel-gpu-resource-driver.namespace" . }}
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "intel-gpu-resource-driver.labels" . | nindent 4 }}
 spec:
@@ -14,7 +14,6 @@ spec:
       labels:
         app: intel-gpu-resource-driver
     spec:
-      serviceAccount: intel-gpu-resource-driver-service-account
       serviceAccountName: {{ include "intel-gpu-resource-driver.serviceAccountName" . }}
       containers:
       - name: kubelet-plugin
@@ -62,18 +61,18 @@ spec:
           path: /var/lib/kubelet/plugins
       - name: cdi
         hostPath:
-          path: /etc/cdi
+          path: {{ .Values.cdi.staticPath }}
       - name: varruncdi
         hostPath:
-          path: /var/run/cdi
+          path: {{ .Values.cdi.dynamicPath}}
       - name: sysfs
         hostPath:
           path: /sys
       {{- with .Values.kubeletPlugin.tolerations }}
       tolerations:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- if .Values.nfd.enabled }}
+      {{- if or .Values.nodeFeatureRules.enabled .Values.nfd.enabled }}
       nodeSelector:
         intel.feature.node.kubernetes.io/gpu: "true"
       {{- else }}

charts/intel-gpu-resource-driver/templates/resource-driver.yaml

@@ -2,7 +2,7 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: {{ include "intel-gpu-resource-driver.serviceAccountName" . }}
-  namespace: {{ include "intel-gpu-resource-driver.namespace" . }}
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "intel-gpu-resource-driver.labels" . | nindent 4 }}
   {{- with .Values.serviceAccount.annotations }}

charts/intel-gpu-resource-driver/templates/serviceaccount.yaml

@@ -13,7 +13,7 @@ spec:
   matchConditions:
   - name: isRestrictedUser
     expression: >-
-      request.userInfo.username == "system:serviceaccount:intel-gpu-resource-driver:intel-gpu-resource-driver-service-account"
+      request.userInfo.username == "system:serviceaccount:{{ .Release.Namespace }}:{{ include "intel-gpu-resource-driver.serviceAccountName" . }}"
   variables:
   - name: userNodeName
     expression: >-

charts/intel-gpu-resource-driver/templates/validating-admission-policy.yaml

@@ -1,6 +1,5 @@
 # Default values for intel-gpu-resource-driver.
 nameOverride: ""
-namespaceOverride: "intel-gpu-resource-driver"
 fullnameOverride: ""
 selectorLabelsOverride: {}
 
@@ -14,14 +13,12 @@ image:
 serviceAccount:
   create: true
   annotations: {}
-  name: intel-gpu-resource-driver-service-account
+  name: ""
   automount: true
 
 kubeletPlugin:
   podAnnotations: {}
-  nodeSelector: {}
-  # label used when nfd.enabled is true
-    #intel.feature.node.kubernetes.io/gpu: "true"
+  nodeSelector: {} # ignored when .Values.nodeFeatureRules.enabled or .Values.nfd.enabled
   tolerations:
     - key: node-role.kubernetes.io/master
       operator: Exists
@@ -37,6 +34,13 @@ kubeletPlugin:
       effect: "NoSchedule"
   affinity: {}
 
+cdi:
+  staticPath: /etc/cdi
+  dynamicPath: /var/run/cdi
+
+nodeFeatureRules:
+  enabled: false
+
 nfd:
   enabled: false # change to true to install NFD to the cluster
   nameOverride: intel-gpu-nfd