Merge pull request #1257 from mythi/PR-2022-083

release-0.25: 0.25.1

Jenkinsfile

@@ -142,7 +142,7 @@ pipeline {
         stage('make test-with-kind') {
           steps {
             dir(path: "$REPO_DIR") {
-              sh "make test-with-kind REG=intel/ TAG=0.25.0"
+              sh "make test-with-kind REG=intel/ TAG=0.25.1"
             }
           }
         }

Makefile

@@ -138,7 +138,7 @@ clean:
 
 ORG?=intel
 REG?=$(ORG)/
-TAG?=0.25.0
+TAG?=0.25.1
 export TAG
 
 e2e-fpga:

build/docker/intel-qat-initcontainer.Dockerfile

@@ -62,4 +62,4 @@ LABEL summary='Intel® QAT initcontainer for Kubernetes'
 LABEL description='Intel QAT initcontainer initializes devices'
 COPY --from=builder /install_root /
 COPY demo/qat-init.sh /usr/local/bin/
-ENTRYPOINT ["/usr/local/bin/qat-init.sh"]
+ENTRYPOINT [ "/bin/bash", "/usr/local/bin/qat-init.sh"]

build/docker/templates/intel-qat-initcontainer.Dockerfile.in

@@ -21,4 +21,4 @@ COPY --from=builder /install_root /
 
 COPY demo/qat-init.sh /usr/local/bin/
 
-ENTRYPOINT ["/usr/local/bin/qat-init.sh"]
+ENTRYPOINT [ "/bin/bash", "/usr/local/bin/qat-init.sh"]

cmd/gpu_nfdhook/labeler.go

@@ -463,7 +463,7 @@ func createNumaNodeMappingLabel(mapping map[int][]string) string {
 
 	sort.Ints(numas)
 
-	for numaNode := range numas {
+	for _, numaNode := range numas {
 		gpus := mapping[numaNode]
 		numaString := strconv.FormatInt(int64(numaNode), 10)
 		gpusString := strings.Join(gpus, ".")

cmd/gpu_nfdhook/labeler_test.go

@@ -537,6 +537,42 @@ func getTestCases() []testcase {
 				"gpu.intel.com/numa-gpu-map":            "0-0_1-1",
 			},
 		},
+		{
+			sysfsdirs: []string{
+				"card0/device/drm/card0",
+				"card1/device/drm/card1",
+				"card1/gt/gt0",
+			},
+			sysfsfiles: map[string][]byte{
+				"card0/device/vendor":    []byte("0xfefe"),
+				"card0/device/numa_node": []byte("0"),
+				"card1/device/vendor":    []byte("0x8086"),
+				"card1/lmem_total_bytes": []byte("8000"),
+				"card1/device/numa_node": []byte("1"),
+			},
+			name:           "successful labeling with one 0x8086 card and numa node info",
+			memoryOverride: 16000000000,
+			capabilityFile: map[string][]byte{
+				"1/i915_capabilities": []byte(
+					"platform: newnew\n" +
+						"gen: 9"),
+			},
+			expectedRetval: nil,
+			expectedLabels: labelMap{
+				"gpu.intel.com/graphics_version":        "9",
+				"gpu.intel.com/media_version":           "9",
+				"gpu.intel.com/millicores":              "1000",
+				"gpu.intel.com/memory.max":              "8000",
+				"gpu.intel.com/platform_newnew.count":   "1",
+				"gpu.intel.com/platform_newnew.present": "true",
+				"gpu.intel.com/platform_newnew.tiles":   "1",
+				"gpu.intel.com/platform_gen":            "9",
+				"gpu.intel.com/gpu-numbers":             "1",
+				"gpu.intel.com/cards":                   "card1",
+				"gpu.intel.com/tiles":                   "1",
+				"gpu.intel.com/numa-gpu-map":            "1-1",
+			},
+		},
 		{
 			sysfsdirs: []string{
 				"card0/device/drm/card0",

demo/dlb-libdlb-demo-pf-pod.yaml

@@ -6,7 +6,7 @@ spec:
   restartPolicy: Never
   containers:
   - name: dlb-libdlb-demo-pf-pod
-    image: intel/dlb-libdlb-demo:0.25.0
+    image: intel/dlb-libdlb-demo:0.25.1
     imagePullPolicy: IfNotPresent
     resources:
       limits:

demo/dlb-libdlb-demo-pod.yaml

@@ -6,7 +6,7 @@ spec:
   restartPolicy: Never
   containers:
   - name: pf
-    image: intel/dlb-libdlb-demo:0.25.0
+    image: intel/dlb-libdlb-demo:0.25.1
     imagePullPolicy: IfNotPresent
     resources:
       limits:
@@ -18,7 +18,7 @@ spec:
         cpu: 1
         memory: 200Mi
   - name: vf
-    image: intel/dlb-libdlb-demo:0.25.0
+    image: intel/dlb-libdlb-demo:0.25.1
     imagePullPolicy: IfNotPresent
     resources:
       limits:

demo/dlb-libdlb-demo-vf-pod.yaml

@@ -6,7 +6,7 @@ spec:
   restartPolicy: Never
   containers:
   - name: dlb-libdlb-demo-vf-pod
-    image: intel/dlb-libdlb-demo:0.25.0
+    image: intel/dlb-libdlb-demo:0.25.1
     command: [ "sh", "-c", "/usr/local/bin/dir_traffic -n 8 -w epoll -d $(ls /dev/dlb* | sed 's/\\/dev\\/dlb//')" ]
     imagePullPolicy: IfNotPresent
     resources:

demo/dsa-accel-config-demo-pod.yaml

@@ -7,7 +7,7 @@ metadata:
 spec:
   containers:
   - name: dsa-accel-config-demo
-    image: intel/accel-config-demo:0.25.0
+    image: intel/accel-config-demo:0.25.1
     imagePullPolicy: IfNotPresent
     resources:
       limits:

demo/iaa-accel-config-demo-pod.yaml

@@ -7,7 +7,7 @@ metadata:
 spec:
   containers:
   - name: iaa-accel-config-demo
-    image: intel/accel-config-demo:0.25.0
+    image: intel/accel-config-demo:0.25.1
     command: [ "/bin/bash", "-c", "cd /test && /bin/bash -e ./iaa_user_test_runner.sh" ]
     imagePullPolicy: IfNotPresent
     resources:

demo/intelfpga-job.yaml

@@ -13,7 +13,7 @@ spec:
       restartPolicy: Never
       containers:
         - name: intelfpga-demo-job-1
-          image: intel/opae-nlb-demo:0.25.0
+          image: intel/opae-nlb-demo:0.25.1
           imagePullPolicy: IfNotPresent
           securityContext:
             capabilities:

demo/openssl-qat-engine-cpa-sample-pod.yaml

@@ -7,7 +7,7 @@ metadata:
 spec:
   containers:
   - name: openssl-qat-engine
-    image: intel/openssl-qat-engine:0.25.0
+    image: intel/openssl-qat-engine:0.25.1
     imagePullPolicy: IfNotPresent
     command: [ "cpa_sample_code", "runTests=4", "signOfLife=1" ]
     securityContext:

demo/qat-init.sh

@@ -1,11 +1,17 @@
-#!/bin/bash
+#!/bin/sh -eu
 ENABLED_QAT_PF_PCIIDS=${ENABLED_QAT_PF_PCIIDS:-37c8 4940 4942}
 DEVS=$(for pf in $ENABLED_QAT_PF_PCIIDS; do lspci -n | grep -e "$pf" | grep -o -e "^\\S*"; done)
 
 for dev in $DEVS; do
   DEVPATH="/sys/bus/pci/devices/0000:$dev"
   NUMVFS="$DEVPATH/sriov_numvfs"
-  if test -w "$NUMVFS" -a "$(cat "$NUMVFS")" -eq 0 ; then
+  if ! test -w "$NUMVFS"; then
+    echo "error: $NUMVFS is not found or not writable. Check if QAT driver module is loaded"
+    exit 1
+  fi
+  if [ "$(cat "$NUMVFS")" -ne 0 ]; then
+    echo "$DEVPATH already configured"
+  else
     tee "$NUMVFS" < "$DEVPATH/sriov_totalvfs"
   fi
 done

demo/test-fpga-orchestrated.yaml

@@ -5,7 +5,7 @@ metadata:
 spec:
   containers:
   - name: test-container
-    image: intel/opae-nlb-demo:0.25.0
+    image: intel/opae-nlb-demo:0.25.1
     imagePullPolicy: IfNotPresent
     securityContext:
       capabilities:

demo/test-fpga-preprogrammed.yaml

@@ -5,7 +5,7 @@ metadata:
 spec:
   containers:
   - name: test-container
-    image: intel/opae-nlb-demo:0.25.0
+    image: intel/opae-nlb-demo:0.25.1
     imagePullPolicy: IfNotPresent
     securityContext:
       capabilities:

deployments/dlb_plugin/base/intel-dlb-plugin.yaml

@@ -21,7 +21,7 @@ spec:
             valueFrom:
               fieldRef:
                 fieldPath: spec.nodeName
-        image: intel/intel-dlb-plugin:0.25.0
+        image: intel/intel-dlb-plugin:0.25.1
         imagePullPolicy: IfNotPresent
         securityContext:
           readOnlyRootFilesystem: true

deployments/dlb_plugin/overlays/dlb_initcontainer/dlb_initcontainer.yaml

@@ -7,7 +7,7 @@ spec:
     spec:
       initContainers:
       - name: intel-dlb-initcontainer
-        image: intel/intel-dlb-initcontainer:0.25.0
+        image: intel/intel-dlb-initcontainer:0.25.1
         securityContext:
           readOnlyRootFilesystem: true
           privileged: true

deployments/dsa_plugin/base/intel-dsa-plugin.yaml

@@ -21,7 +21,7 @@ spec:
             valueFrom:
               fieldRef:
                 fieldPath: spec.nodeName
-        image: intel/intel-dsa-plugin:0.25.0
+        image: intel/intel-dsa-plugin:0.25.1
         imagePullPolicy: IfNotPresent
         securityContext:
           readOnlyRootFilesystem: true

deployments/dsa_plugin/overlays/dsa_initcontainer/dsa_initcontainer.yaml

@@ -12,7 +12,7 @@ spec:
             valueFrom:
               fieldRef:
                 fieldPath: spec.nodeName
-        image: intel/intel-idxd-config-initcontainer:0.25.0
+        image: intel/intel-idxd-config-initcontainer:0.25.1
         securityContext:
           readOnlyRootFilesystem: true
           privileged: true

deployments/fpga_admissionwebhook/manager/manager.yaml

@@ -16,7 +16,7 @@ spec:
         control-plane: controller-manager
     spec:
       containers:
-      - image: intel/intel-fpga-admissionwebhook:0.25.0
+      - image: intel/intel-fpga-admissionwebhook:0.25.1
         imagePullPolicy: IfNotPresent
         name: manager
         securityContext:

deployments/fpga_plugin/base/intel-fpga-plugin-daemonset.yaml

@@ -16,7 +16,7 @@ spec:
     spec:
       initContainers:
       - name: intel-fpga-initcontainer
-        image: intel/intel-fpga-initcontainer:0.25.0
+        image: intel/intel-fpga-initcontainer:0.25.1
         imagePullPolicy: IfNotPresent
         securityContext:
           readOnlyRootFilesystem: true
@@ -33,7 +33,7 @@ spec:
             valueFrom:
               fieldRef:
                 fieldPath: spec.nodeName
-        image: intel/intel-fpga-plugin:0.25.0
+        image: intel/intel-fpga-plugin:0.25.1
         imagePullPolicy: IfNotPresent
         args:
           - -mode=af

deployments/gpu_plugin/base/intel-gpu-plugin.yaml

@@ -15,7 +15,7 @@ spec:
     spec:
       initContainers:
       - name: intel-gpu-initcontainer
-        image: intel/intel-gpu-initcontainer:0.25.0
+        image: intel/intel-gpu-initcontainer:0.25.1
         imagePullPolicy: IfNotPresent
         securityContext:
           seLinuxOptions:
@@ -32,7 +32,7 @@ spec:
             valueFrom:
               fieldRef:
                 fieldPath: spec.nodeName
-        image: intel/intel-gpu-plugin:0.25.0
+        image: intel/intel-gpu-plugin:0.25.1
         imagePullPolicy: IfNotPresent
         securityContext:
           seLinuxOptions:

deployments/iaa_plugin/base/intel-iaa-plugin.yaml

@@ -21,7 +21,7 @@ spec:
             valueFrom:
               fieldRef:
                 fieldPath: spec.nodeName
-        image: intel/intel-iaa-plugin:0.25.0
+        image: intel/intel-iaa-plugin:0.25.1
         imagePullPolicy: IfNotPresent
         securityContext:
           readOnlyRootFilesystem: true

deployments/iaa_plugin/overlays/iaa_initcontainer/iaa_initcontainer.yaml

@@ -14,7 +14,7 @@ spec:
                 fieldPath: spec.nodeName
           - name: IDXD_DEVICE_TYPE
             value: "iax"
-        image: intel/intel-idxd-config-initcontainer:0.25.0
+        image: intel/intel-idxd-config-initcontainer:0.25.1
         securityContext:
           readOnlyRootFilesystem: true
           privileged: true

deployments/operator/default/manager_auth_proxy_patch.yaml

@@ -10,11 +10,12 @@ spec:
     spec:
       containers:
       - name: kube-rbac-proxy
-        image: gcr.io/kubebuilder/kube-rbac-proxy:v0.8.0
+        image: gcr.io/kubebuilder/kube-rbac-proxy:v0.13.1
         args:
         - "--secure-listen-address=0.0.0.0:8443"
         - "--upstream=http://127.0.0.1:8080/"
         - "--logtostderr=true"
+        - "--tls-cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305"
         - "--v=10"
         ports:
         - containerPort: 8443

deployments/operator/manager/manager.yaml

@@ -23,7 +23,7 @@ spec:
         control-plane: controller-manager
     spec:
       containers:
-      - image: intel/intel-deviceplugin-operator:0.25.0
+      - image: intel/intel-deviceplugin-operator:0.25.1
         imagePullPolicy: IfNotPresent
         name: manager
         resources:

deployments/operator/manifests/bases/intel-device-plugins-operator.clusterserviceversion.yaml

@@ -5,7 +5,7 @@ metadata:
     alm-examples: '[]'
     capabilities: Seamless Upgrades
     categories: Drivers and plugins
-    containerImage: intel/intel-deviceplugin-operator:0.25.0
+    containerImage: intel/intel-deviceplugin-operator:0.25.1
     createdAt: "2022-05-20"
     description: This operator is a Kubernetes custom controller whose goal is to
       serve the installation and lifecycle management of Intel device plugins for

deployments/operator/samples/deviceplugin_v1_dlbdeviceplugin.yaml

@@ -9,8 +9,8 @@ metadata:
   # annotations:
   #   container.apparmor.security.beta.kubernetes.io/intel-dlb-plugin: unconfined
 spec:
-  image: intel/intel-dlb-plugin:0.25.0
+  image: intel/intel-dlb-plugin:0.25.1
-  initImage: intel/intel-dlb-initcontainer:0.25.0
+  initImage: intel/intel-dlb-initcontainer:0.25.1
   logLevel: 4
   nodeSelector:
     intel.feature.node.kubernetes.io/dlb: 'true'

deployments/operator/samples/deviceplugin_v1_dsadeviceplugin.yaml

@@ -3,7 +3,7 @@ kind: DsaDevicePlugin
 metadata:
   name: dsadeviceplugin-sample
 spec:
-  image: intel/intel-dsa-plugin:0.25.0
+  image: intel/intel-dsa-plugin:0.25.1
   sharedDevNum: 10
   logLevel: 4
   nodeSelector:

deployments/operator/samples/deviceplugin_v1_fpgadeviceplugin.yaml

@@ -3,8 +3,8 @@ kind: FpgaDevicePlugin
 metadata:
   name: fpgadeviceplugin-sample
 spec:
-  image: intel/intel-fpga-plugin:0.25.0
+  image: intel/intel-fpga-plugin:0.25.1
-  initImage: intel/intel-fpga-initcontainer:0.25.0
+  initImage: intel/intel-fpga-initcontainer:0.25.1
   mode: region
   logLevel: 4
   nodeSelector:

deployments/operator/samples/deviceplugin_v1_gpudeviceplugin.yaml

@@ -3,8 +3,8 @@ kind: GpuDevicePlugin
 metadata:
   name: gpudeviceplugin-sample
 spec:
-  image: intel/intel-gpu-plugin:0.25.0
+  image: intel/intel-gpu-plugin:0.25.1
-  initImage: intel/intel-gpu-initcontainer:0.25.0
+  initImage: intel/intel-gpu-initcontainer:0.25.1
   sharedDevNum: 10
   logLevel: 4
   nodeSelector:

deployments/operator/samples/deviceplugin_v1_iaadeviceplugin.yaml

@@ -3,7 +3,7 @@ kind: IaaDevicePlugin
 metadata:
   name: iaadeviceplugin-sample
 spec:
-  image: intel/intel-iaa-plugin:0.25.0
+  image: intel/intel-iaa-plugin:0.25.1
   sharedDevNum: 10
   logLevel: 4
   nodeSelector:

deployments/operator/samples/deviceplugin_v1_qatdeviceplugin.yaml

@@ -9,8 +9,8 @@ metadata:
   # annotations:
   #   container.apparmor.security.beta.kubernetes.io/intel-qat-plugin: unconfined
 spec:
-  image: intel/intel-qat-plugin:0.25.0
+  image: intel/intel-qat-plugin:0.25.1
-  initImage: intel/intel-qat-initcontainer:0.25.0
+  initImage: intel/intel-qat-initcontainer:0.25.1
   dpdkDriver: vfio-pci
   kernelVfDrivers:
     - c6xxvf

deployments/operator/samples/deviceplugin_v1_sgxdeviceplugin.yaml

@@ -3,8 +3,8 @@ kind: SgxDevicePlugin
 metadata:
   name: sgxdeviceplugin-sample
 spec:
-  image: intel/intel-sgx-plugin:0.25.0
+  image: intel/intel-sgx-plugin:0.25.1
-  initImage: intel/intel-sgx-initcontainer:0.25.0
+  initImage: intel/intel-sgx-initcontainer:0.25.1
   enclaveLimit: 110
   provisionLimit: 110
   logLevel: 4

deployments/qat_dpdk_app/base/crypto-perf-dpdk-pod-requesting-qat.yaml

@@ -5,7 +5,7 @@ metadata:
 spec:
   containers:
   - name: crypto-perf
-    image: intel/crypto-perf:0.25.0
+    image: intel/crypto-perf:0.25.1
     imagePullPolicy: IfNotPresent
     command: [ "/bin/bash", "-c", "--" ]
     args: [ "while true; do sleep 300000; done;" ]

deployments/qat_plugin/base/intel-qat-kernel-plugin.yaml

@@ -19,7 +19,7 @@ spec:
           readOnlyRootFilesystem: true
           allowPrivilegeEscalation: false
           privileged: true
-        image: intel/intel-qat-plugin:0.25.0
+        image: intel/intel-qat-plugin:0.25.1
         imagePullPolicy: IfNotPresent
         args: ["-mode", "kernel"]
         volumeMounts:

deployments/qat_plugin/base/intel-qat-plugin.yaml

@@ -16,7 +16,7 @@ spec:
       automountServiceAccountToken: false
       containers:
       - name: intel-qat-plugin
-        image: intel/intel-qat-plugin:0.25.0
+        image: intel/intel-qat-plugin:0.25.1
         securityContext:
           seLinuxOptions:
             type: "container_device_plugin_t"

deployments/qat_plugin/overlays/sriov_numvfs/sriov_numvfs_init.yaml

@@ -7,7 +7,7 @@ spec:
     spec:
       initContainers:
       - name: sriov-numvfs
-        image: intel/intel-qat-initcontainer:0.25.0
+        image: intel/intel-qat-initcontainer:0.25.1
         securityContext:
           readOnlyRootFilesystem: true
           privileged: true

deployments/sgx_admissionwebhook/manager/manager.yaml

@@ -16,7 +16,7 @@ spec:
         control-plane: controller-manager
     spec:
       containers:
-      - image: intel/intel-sgx-admissionwebhook:0.25.0
+      - image: intel/intel-sgx-admissionwebhook:0.25.1
         imagePullPolicy: IfNotPresent
         name: manager
         securityContext:

deployments/sgx_plugin/base/intel-sgx-plugin.yaml

@@ -16,7 +16,7 @@ spec:
       automountServiceAccountToken: false
       containers:
       - name: intel-sgx-plugin
-        image: intel/intel-sgx-plugin:0.25.0
+        image: intel/intel-sgx-plugin:0.25.1
         securityContext:
           seLinuxOptions:
             type: "container_device_plugin_t"

deployments/sgx_plugin/overlays/epc-hook-initcontainer/add-epc-nfd-initcontainer.yaml

@@ -7,7 +7,7 @@ spec:
     spec:
       initContainers:
       - name: intel-sgx-initcontainer
-        image: intel/intel-sgx-initcontainer:0.25.0
+        image: intel/intel-sgx-initcontainer:0.25.1
         imagePullPolicy: IfNotPresent
         securityContext:
           readOnlyRootFilesystem: true

deployments/sgx_plugin/overlays/epc-nfd/add-epc-nfd-initcontainer.yaml

@@ -7,7 +7,7 @@ spec:
     spec:
       initContainers:
       - name: intel-sgx-initcontainer
-        image: intel/intel-sgx-initcontainer:0.25.0
+        image: intel/intel-sgx-initcontainer:0.25.1
         imagePullPolicy: IfNotPresent
         securityContext:
           readOnlyRootFilesystem: true

deployments/sgx_plugin/overlays/epc-register/init-daemonset.yaml

@@ -16,7 +16,7 @@ spec:
       serviceAccountName: sgx-plugin
       containers:
       - name: sgx-node-init
-        image: intel/intel-sgx-initcontainer:0.25.0
+        image: intel/intel-sgx-initcontainer:0.25.1
         imagePullPolicy: IfNotPresent
         command:
           - /usr/local/bin/sgx-sw/intel-sgx-epchook

deployments/vpu_plugin/base/intel-vpu-plugin.yaml

@@ -21,7 +21,7 @@ spec:
             valueFrom:
               fieldRef:
                 fieldPath: spec.nodeName
-        image: intel/intel-vpu-plugin:0.25.0
+        image: intel/intel-vpu-plugin:0.25.1
         imagePullPolicy: IfNotPresent
         securityContext:
           readOnlyRootFilesystem: true

pkg/controllers/fpga/controller_test.go

@@ -181,7 +181,7 @@ func TestNewDaemonSetFPGA(t *testing.T) {
 
 	plugin := &devicepluginv1.FpgaDevicePlugin{
 		Spec: devicepluginv1.FpgaDevicePluginSpec{
-			InitImage: "intel/intel-fpga-initcontainer:0.25.0",
+			InitImage: "intel/intel-fpga-initcontainer:0.25.1",
 		},
 	}
 

pkg/controllers/gpu/controller_test.go

@@ -189,7 +189,7 @@ func TestNewDamonSetGPU(t *testing.T) {
 		}
 
 		if tc.isInitImage {
-			plugin.Spec.InitImage = "intel/intel-gpu-initcontainer:0.25.0"
+			plugin.Spec.InitImage = "intel/intel-gpu-initcontainer:0.25.1"
 		}
 
 		t.Run(tc.name, func(t *testing.T) {

pkg/controllers/reconciler.go

@@ -37,7 +37,7 @@ import (
 
 var (
 	bKeeper         = &bookKeeper{}
-	ImageMinVersion = versionutil.MustParseSemantic("0.25.0")
+	ImageMinVersion = versionutil.MustParseSemantic("0.25.1")
 )
 
 func init() {

test/e2e/fpga/fpga.go

@@ -101,7 +101,7 @@ func runTestCase(fmw *framework.Framework, pluginKustomizationPath, mappingsColl
 	}
 
 	resource = v1.ResourceName(podResource)
-	image := "intel/opae-nlb-demo:0.25.0"
+	image := "intel/opae-nlb-demo:0.25.1"
 
 	ginkgo.By("submitting a pod requesting correct FPGA resources")