Add NRI plugin for CDI device injection #327
Conversation
|
/cc @klihub |
I can take a look at adding native CDI injection support to NRI based on this/an earlier very similar CDI injection sample plugin we had in the first versions of v0.2.0 NRI PR... |
Signed-off-by: Evan Lezar <elezar@nvidia.com>
Signed-off-by: Evan Lezar <elezar@nvidia.com>
elezar
force-pushed
the
add-cdi-device-injector
branch
from
bd77fb9
to
2ac463d
Compare
This change adds an allowed-cdi-device-pattern command line option to the CDI device injector to allow CDI device names to be filtered. Signed-off-by: Evan Lezar <elezar@nvidia.com>
elezar
force-pushed
the
add-cdi-device-injector
branch
from
2ac463d
to
0719394
Compare
|
@elezar @kad @askervin I rolled a proof-of-concept/initial implementation of CDI device injection in NRI, directly supported by the protocol and supporting libraries. I also updated containerd 1.7 and main/2.0 and cri-o main to allow CDI injection through. The NRI bits also update the test/sample device-injector plugin (in the NRI repo itself) to allow injecting CDI devices by annotation. This is what I used for testing against all of the updated containerd and cri-o trees. Here are the related working trees/branches:
Based on this, it looks technically feasible, fairly straightforward, and not very intrusive to implement. Next we should decide if we want to push this or not. It has pros but maybe semantically it is a bit of an outlier compared to the rest of our features. |
|
|
||
| var allowedCDIDevices []string | ||
| for _, cdiDevice := range cdiDevices { | ||
| match, _ := filepath.Match(p.allowedCDIDevicePattern, cdiDevice) |
There was a problem hiding this comment.
I think it would be better to use path.Match() for globbing instead of filepath.Match().
This PR adds a plugin for CDI injection.
The values of defined pod annotations are interpreted as a comma-separated list of CDI devices. The local CDI cache is read and the corresponding container adjusments are generated.
Some items to do:
In the longer-term, it should also be possible to restrict the injection of devices to containers in a particular namespace / based on properties of a namespace.