github/intel-device-plugins-for-kubernetes
7
0
Fork 0
mirror of https://github.com/intel/intel-device-plugins-for-kubernetes.git synced 2025-06-03 03:59:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

add selinux labels for GPU plugins

Browse Source
This commit is contained in:
Manish Regmi 2022-09-01 11:29:09 -07:00 committed by Chaitanya
parent 399c1dd232
commit 22e9d5f882
3 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
deployments/gpu_plugin/base/intel-gpu-plugin.yaml
View File

@ -18,6 +18,8 @@ spec:
image: intel/intel-gpu-initcontainer:devel
imagePullPolicy: IfNotPresent
securityContext:
seLinuxOptions:
type: "container_device_plugin_init_t"
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
volumeMounts:
@ -33,6 +35,8 @@ spec:
image: intel/intel-gpu-plugin:devel
imagePullPolicy: IfNotPresent
securityContext:
seLinuxOptions:
type: "container_device_plugin_t"
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
volumeMounts:

3
pkg/controllers/gpu/controller.go
View File

@ -196,6 +196,9 @@ func setInitContainer(spec *v1.PodSpec, imageName string) {
ImagePullPolicy: "IfNotPresent",
Name: "intel-gpu-initcontainer",
SecurityContext: &v1.SecurityContext{
SELinuxOptions: &v1.SELinuxOptions{
Type: "container_device_plugin_init_t",
},
ReadOnlyRootFilesystem: &yes,
},
VolumeMounts: []v1.VolumeMount{

3
pkg/controllers/gpu/controller_test.go
View File

@ -79,6 +79,9 @@ func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet
Image: devicePlugin.Spec.Image,
ImagePullPolicy: "IfNotPresent",
SecurityContext: &v1.SecurityContext{
SELinuxOptions: &v1.SELinuxOptions{
Type: "container_device_plugin_t",
},
ReadOnlyRootFilesystem: &yes,
AllowPrivilegeEscalation: &no,
},