Draft: [bpf] respect container device cfg for allow list #12974
Conversation
This changes the CGroupV2 fuse device enabler to respect any devices configured for the container instead of statically recreate the BPF program from defaults. This allows the user to inject special devices (GPU, KVM, ...) via a device manager plugin e.g. with a mutating admission controller.
|
/werft run 👍 started the job as gitpod-build-cgroup-devices-fork.0 |
|
/werft run 👍 started the job as gitpod-build-cgroup-devices-fork.1 |
|
This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions. |
|
Oh, I'd like to receive some feedback before it gets closed ;) |
|
This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions. |
|
I'm still interested. |
|
Sorry to bother again, do you have any thoughts on this? |
|
This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions. |
|
I'm still interested. |
|
This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions. |
|
I am still interested. |
|
This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions. |
|
I was still waiting for a reply. |
Description
This is a draft of custom device support as needed in #8396. I'm neither a Go-developer nor very familiar with the gitpod codebase. I just wanted to draft these changes to see if it can work and to discuss it further because we need custom device support desperately. These changes are not tested (because I wasn't able to build the service) and probably need to be redone properly. Especially the injection of the runtime due to the limited cgroup Plugin interface is unfortunate.
The issue these changes address is, that gitpod creates a very static cgroup-device-bpf-progeam since fuse CgroupV2 support landed in #8769. This disregards any device settings a Kubernetes device plugin has made to this container. These changes try to fetch the actual device allow-list from the container, combine them with the static defaults and inject the fuse rule before the BPF program is created.
Related Issue(s)
#8769
#8396
How to test
The easiest way is to use the smarter-device-manager and a custom MuattingAdmissionWebhook to inject device resources into the pod manifests.
Release Notes