24 lines
1018 B
YAML
24 lines
1018 B
YAML
|
# Namespace for GPU node-level plumbing (device plugin, and later DCGM).
|
||
|
|
#
|
||
|
|
# PodSecurity must be `privileged` here. The cluster default from the Talos
|
||
|
|
# controlplane config is `enforce: baseline` with exemptions only for
|
||
|
|
# kube-system, and a device plugin cannot satisfy baseline: it has to mount the
|
||
|
|
# kubelet device-plugin socket and the CDI/driver directories as hostPath
|
||
|
|
# volumes, which baseline forbids outright:
|
||
|
|
#
|
||
|
|
# Error creating: pods "nvidia-device-plugin-xxxxx" is forbidden:
|
||
|
|
# violates PodSecurity "baseline:latest": hostPath volumes
|
||
|
|
# (volumes "kubelet-device-plugins-dir", "mps-root", "mps-shm", "cdi-root")
|
||
|
|
#
|
||
|
|
# This is inherent to how device plugins work, not a workaround. Scope is
|
||
|
|
# limited to this namespace; the engine namespace (llm-serving) stays on the
|
||
|
|
# cluster default.
|
||
|
|
apiVersion: v1
|
||
|
|
kind: Namespace
|
||
|
|
metadata:
|
||
|
|
name: gpu-system
|
||
|
|
labels:
|
||
|
|
pod-security.kubernetes.io/enforce: privileged
|
||
|
|
pod-security.kubernetes.io/audit: privileged
|
||
|
|
pod-security.kubernetes.io/warn: privileged
|