validations

func CheckAcceleratedSelectorMissing ¶

func CheckAcceleratedSelectorMissing(ctx context.Context, componentName string, recipeResult *recipe.RecipeResult, bundlerConfig *config.Config, conditions map[string][]string) ([]string, []error)

CheckAcceleratedSelectorMissing checks if accelerated-node-selector is missing when conditions are met. This is a generic check that can be used by any component.

func CheckDriverOwnershipCoherence ¶ added in v0.18.0

func CheckDriverOwnershipCoherence(ctx context.Context, componentName string, recipeResult *recipe.RecipeResult, bundlerConfig *config.Config, conditions map[string][]string) ([]string, []error)

CheckDriverOwnershipCoherence fails a bundle whose FINAL effective values (recipe merge plus all --set/--set-json/--set-file overrides) render an incoherent GPU driver-ownership profile. Two rules:

Rule 1 (driverless cluster, gated on recorded snapshot state): when the snapshot that produced the recipe observed no NVIDIA kernel driver on the sampled GPU node (metadata.gpuDriverState=absent — recorded by pkg/client/v1's snapshot-driven resolution, the `--gpu-driver none` signature), the effective config must have the operator install the full stack: driver.enabled=true and, when declared, toolkit.enabled not false. Deploying the preinstalled-driver assumption onto that cluster leaves GPU nodes driverless — nothing on the node provides a driver and the recipe does not install one. Recipes without a recorded state (criteria-only resolves, older recipes, snapshots without a usable driver-loaded reading) are not gated by this rule. A recorded state outside the two documented constants is rejected outright — the empty-string disarm is deliberate, an unrecognized nonempty spelling in a loaded or hand-edited recipe is not.

Rule 2 (DRA driver-root lockstep, metadata-independent): when nvidia-dra-driver-gpu is bundled alongside gpu-operator, its nvidiaDriverRoot must track the driver owner — see pkg/recipe/driver_root_lockstep_test.go for the full invariant rationale (issue #1087). With driver.enabled=true the DRA kubelet plugin must read the operator install dir (hostPaths.driverInstallDir), or CDI spec generation fails and DRA-allocated pods stall in ContainerCreating; with driver.enabled=false the root must not be the operator container root /run/nvidia/driver, which nothing populates in that mode — the signature of a legacy pre-flip recipe whose valuesFile now resolves the preinstalled-driver defaults while its baked DRA override still points at the operator path. Because this rule evaluates effective values only, it catches those legacy recipes with no recorded gpuDriverState.

Independent of both rules, an explicitly declared gpu-operator hostPaths.driverInstallDir that cleans to "/" is always rejected: it is the host path the operator-validator bind-mounts as the driver-validation container's rootfs target, and runc rejects a mount whose destination is "/" — the issue #1106 regression (see pkg/recipe/driver_root_lockstep_test.go, invariant 1). The DRA nvidiaDriverRoot of "/" is NOT flagged — it is the legitimate preinstalled-driver value.

The check runs at bundle generation — not at snapshot-driven recipe resolution, which only warns — because this is the first point where the user's --set ownership overrides are known: `aicr recipe` has no --set, so a resolution-time hard failure would leave supported GPU-Operator-managed clusters unable to reach the documented override. Registered with severity error on gpu-operator (recipes/registry.yaml), which converts the returned messages into a blocking ErrCodeInvalidRequest in RunValidations. The check returns hard errors only when a component's effective values cannot be resolved or the user's overrides cannot be reapplied to them (see effectiveComponentValues): either way the values this gate must verify cannot be reconstructed, so coherence fails closed.

func CheckHostMofedWithoutNetworkOperator ¶ added in v0.13.0

func CheckHostMofedWithoutNetworkOperator(ctx context.Context, componentName string, recipeResult *recipe.RecipeResult, bundlerConfig *config.Config, conditions map[string][]string) ([]string, []error)

CheckHostMofedWithoutNetworkOperator warns when network-operator is disabled via --set but gpu-operator still has driver.rdma.useHostMofed=true (the AKS default). Without network-operator, no host MOFED is present and useHostMofed should be set to false.

func CheckWildcardAcceleratedToleration ¶ added in v0.17.0

func CheckWildcardAcceleratedToleration(ctx context.Context, componentName string, recipeResult *recipe.RecipeResult, bundlerConfig *config.Config, conditions map[string][]string) ([]string, []error)

CheckWildcardAcceleratedToleration reports when the effective accelerated-node tolerations for a component include a wildcard (keyless operator: Exists) toleration. Scope it via registry conditions to services where the wildcard is harmful — on AKS, admission collapses a pod's toleration list to just the wildcard when one is present, which defeats the nodewright operator's drain exemption for its own package pods and deadlocks packages that declare interrupts (NVIDIA/nodewright#296). That deadlock requires manual node cordon/reboot to recover, so the registry wires this at severity: error to block the bundle until a keyed toleration is supplied.

The default bundle path always hits this: with no --accelerated-node-toleration flag the CLI falls back to snapshotter.DefaultTolerations() (a single bare operator: Exists). An empty toleration list is flagged too, because the tuning manifest template renders its own wildcard fallback when none are injected.

A component disabled via --set (e.g. the documented RDMA opt-out --set nodewrightcustomizations:enabled=false) renders no package pods and cannot deadlock, so it is skipped regardless of the toleration shape.

func CheckWorkloadSelectorMissing ¶

func CheckWorkloadSelectorMissing(ctx context.Context, componentName string, recipeResult *recipe.RecipeResult, bundlerConfig *config.Config, conditions map[string][]string) ([]string, []error)

CheckWorkloadSelectorMissing checks if workload-selector is missing when conditions are met. This is a generic check that can be used by any component.

func GetAll ¶

func GetAll() []string

GetAll returns all registered validation function names.

func Register ¶

func Register(name string, fn ValidationFunc)

Register adds a validation function to the registry. This allows components to register custom validation functions. It's also called from init() functions in check files for auto-registration.

func RunComponentValidations ¶ added in v0.18.0

func RunComponentValidations(ctx context.Context, recipeResult *recipe.RecipeResult, bundlerConfig *config.Config) ([]string, error)

RunComponentValidations executes every registry-declared validation for each component present in recipeResult, in ComponentRefs order. It is the shared component preflight behind DefaultBundler.Make (which passes its bundle config so --set/--set-json overrides participate) and Client.BundleComponents (which passes a nil config — that path has no bundle-time overrides, and every validation that acts solely on bundle-time flags no-ops on a nil config). Returns the accumulated non-blocking warnings and the first blocking error; warnings gathered before a blocking error are still returned so the caller can surface them alongside it.

func RunValidations ¶

func RunValidations(ctx context.Context, componentName string, validations []recipe.ComponentValidationConfig, recipeResult *recipe.RecipeResult, bundlerConfig *config.Config) (warnings []string, errors []error)

RunValidations executes all validations for a component and returns warnings and errors. The optional message from the validation config is appended to each warning/error. Severity determines whether check results become warnings or errors.