WIP: Change GPU plugin NFD init container to run-time container

Because:
* To work around kustomize inability to enforce correct init container order
* This is more likely how things will work once NFD drops support for hooks:
  kubernetes-sigs/node-feature-discovery#856

Signed-off-by: Eero Tamminen <[email protected]>

Author: eero-t

deployments/gpu_plugin/overlays/fake_devices/use-nfd-feature-file.yaml deployments/gpu_plugin/overlays/fake_devices/add-nfd-feature-file.yaml

@@ -5,16 +5,24 @@ metadata:
 spec:
   template:
     spec:
-      initContainers:
-      - name: intel-gpu-initcontainer
+      containers:
+      - name: intel-gpu-nfd
+        # convert generated sysfs content to NFD feature labels file
+        image: intel/intel-gpu-initcontainer:devel
+        imagePullPolicy: IfNotPresent
+        securityContext:
+          readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop: [ "ALL" ]
         volumeMounts:
         - name: nfd-features
           mountPath: /nfd
           readOnly: false
         workingDir: /usr/local/bin/gpu-sw
         # needed until GPU plugin drops NFD hook usage due to:
         # https://github.com/kubernetes-sigs/node-feature-discovery/issues/856
-        command: ["sh", "-c", "./intel-gpu-nfdhook | tee /nfd/fake-gpu"]
+        command: ["sh", "-c", "while true; do ./intel-gpu-nfdhook | tee /nfd/fake-gpu; sleep 99999; done"]
       volumes:
       - name: nfd-features
         hostPath:

deployments/gpu_plugin/overlays/fake_devices/del-intel-gpu-initcontainer.yaml

@@ -0,0 +1,10 @@
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: intel-gpu-plugin
+spec:
+  template:
+    spec:
+      initContainers:
+      - name: intel-gpu-initcontainer
+        $patch: delete

deployments/gpu_plugin/overlays/fake_devices/fake-device-volumes.yaml

@@ -18,13 +18,13 @@ spec:
           readOnly: false
         # files are generated under CWD
         workingDir: /tmp/fakedev
-      - name: intel-gpu-initcontainer
+      containers:
+      - name: intel-gpu-nfd
         # expects sysfs here
         volumeMounts:
         - name: sysfs
           mountPath: /host-sys
           readOnly: true
-      containers:
       - name: intel-gpu-plugin
         args: [
           "-prefix=/tmp/fakedev",

deployments/gpu_plugin/overlays/fake_devices/generate-fake-devices.yaml

@@ -11,7 +11,7 @@ spec:
           name: fakedev-config
       initContainers:
       - name: fakedev-generator
-        image: intel/intel-gpu-fakedev:latest
+        image: intel/intel-gpu-fakedev:devel
         securityContext:
           runAsUser: 0
           readOnlyRootFilesystem: false
@@ -22,5 +22,3 @@ spec:
           readOnly: true
         # generate fake sysfs / devfs files for GPU plugin based on config
         command: ["/generator", "-json", "/config/fakedev.json", "-verbose"]
-      # try to make sure generator is (run) before this
-      - name: intel-gpu-initcontainer

deployments/gpu_plugin/overlays/fake_devices/kustomization.yaml

@@ -9,6 +9,7 @@ configMapGenerator:
 patches:
   - fake-device-volumes.yaml
   - generate-fake-devices.yaml
-  # NFD feature file change is obsolete after GPU plugin moves away from NFD hooks:
+  # NFD feature file changes is obsolete after GPU plugin moves away from NFD hooks
   # https://github.com/kubernetes-sigs/node-feature-discovery/issues/856
-  - use-nfd-feature-file.yaml
+  - del-intel-gpu-initcontainer.yaml
+  - add-nfd-feature-file.yaml