Documentation
¶
Overview ¶
Package deviceplugin advertises host device nodes (for example /dev/kvm) to kubelet as extended resources, so a worker pod can be granted just those devices instead of running privileged.
Device access is gated by the cgroup v2 device controller, which denies by default before DAC is consulted: no capability, hostPath mount, or supplemental group grants it. Kubelet's device manager adds the narrow allow rule, emitting the device node and a matching cgroup allow for each device.
Index ¶
- Constants
- Variables
- type HostDevice
- type Plugin
- func (p *Plugin) Allocate(_ context.Context, req *pluginapi.AllocateRequest) (*pluginapi.AllocateResponse, error)
- func (p *Plugin) GetDevicePluginOptions(context.Context, *pluginapi.Empty) (*pluginapi.DevicePluginOptions, error)
- func (p *Plugin) ListAndWatch(_ *pluginapi.Empty, stream pluginapi.DevicePlugin_ListAndWatchServer) error
- func (p *Plugin) Run(ctx context.Context) error
Constants ¶
const ( // ResourceKVM grants /dev/kvm, which the micro-VM runtime needs to create a // VM (cloud-hypervisor fails with EPERM on VmCreate without it). ResourceKVM = "ate.dev/kvm" )
Extended resource names advertised by atelet and requested by worker pods. Both sides import these so the strings cannot drift apart.
Variables ¶
var SandboxDevices = []HostDevice{ {ResourceName: ResourceKVM, Path: "/dev/kvm"}, }
SandboxDevices are the host devices a sandbox runtime needs a grant for. atelet advertises whichever of these exist on its node.
Only devices the container runtime denies by default belong here. The micro-VM runtime also opens /dev/net/tun, but that is in the runtime's default allow-list, so the worker gets it as an ordinary bind mount instead.
Functions ¶
This section is empty.
Types ¶
type HostDevice ¶
type HostDevice struct {
// ResourceName is the fully-qualified extended resource name pods request,
// e.g. "ate.dev/kvm".
ResourceName string
// Path is the device node, e.g. "/dev/kvm". It is exposed to the container
// at the same path.
Path string
}
HostDevice is a device node advertised to kubelet under ResourceName.
func Available ¶
func Available(devs []HostDevice, devRoot string) []HostDevice
Available returns the subset of devs present on this node, looking under devRoot. atelet runs on every node, so advertising a resource only where its device exists keeps pods requesting it off nodes that cannot run them.
func (HostDevice) Present ¶
func (d HostDevice) Present(devRoot string) bool
Present reports whether the device node exists on the node as a character device. devRoot is where the node's /dev is mounted for inspection, our own container having a minimal /dev of its own; Allocate still reports Path, which kubelet resolves on the node.
type Plugin ¶
type Plugin struct {
pluginapi.UnimplementedDevicePluginServer
// contains filtered or unexported fields
}
Plugin serves the kubelet device plugin API for a single HostDevice.
func (*Plugin) Allocate ¶
func (p *Plugin) Allocate(_ context.Context, req *pluginapi.AllocateRequest) (*pluginapi.AllocateResponse, error)
Allocate returns the device node for each requested container. Kubelet turns each DeviceSpec into a device node plus a matching cgroup allow, so the container gets this device and no other.
func (*Plugin) GetDevicePluginOptions ¶
func (p *Plugin) GetDevicePluginOptions(context.Context, *pluginapi.Empty) (*pluginapi.DevicePluginOptions, error)
GetDevicePluginOptions implements the device plugin API; the defaults are correct here.
func (*Plugin) ListAndWatch ¶
func (p *Plugin) ListAndWatch(_ *pluginapi.Empty, stream pluginapi.DevicePlugin_ListAndWatchServer) error
ListAndWatch streams the device list to kubelet. The set is static, so send it once and hold the stream open until shutdown.
Source Files