install.yaml

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: fluxbind
rules:
  - apiGroups:
      - ""
    resources:
      - nodes
    verbs:
      - get
  - apiGroups:
      - "resource.k8s.io"
    resources:
      - resourceslices
    verbs:
      - list
      - watch
      - create
      - update
      - delete
  - apiGroups:
    - "resource.k8s.io"
    resources:
      - resourceclaims
      - deviceclasses
      - resourceslices
      - resourceclaims/status
    verbs:
      - get
      - create
      - update
      - patch
      - delete
      - update
      - list
  - apiGroups:
      - ""
    resources:
      - pods
    verbs:
      - get
      - list
      - watch
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: fluxbind
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: fluxbind
subjects:
- kind: ServiceAccount
  name: fluxbind
  namespace: kube-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: fluxbind
  namespace: kube-system
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: fluxbind
  namespace: kube-system
  labels:
    tier: node
    app: fluxbind
    k8s-app: fluxbind
spec:
  selector:
    matchLabels:
      app: fluxbind
  template:
    metadata:
      labels:
        tier: node
        app: fluxbind
        k8s-app: fluxbind
    spec:
      hostNetwork: true
      tolerations:
      - operator: Exists
        effect: NoSchedule
      serviceAccountName: fluxbind
      hostPID: true
      initContainers:
      - name: enable-nri-and-cdi
        image: busybox:stable
        volumeMounts:
        - mountPath: /etc
          name: etc
        securityContext:
          privileged: true
        # Taken from dracpu
        command:
        - /bin/sh
        - -c
        - |
          set -o errexit
          set -o pipefail
          set -o nounset
          set -x
          CONFIG_CHANGED=false
          CONTAINERD_CONFIG_PATH="/etc/containerd/config.toml"
          # --- Enable CDI ---
          if grep -q '^\s*enable_cdi\s*=\s*true' "$CONTAINERD_CONFIG_PATH"; then
            echo "containerd config already has CDI enabled; taking no action"
          else
            echo "containerd config does not have CDI enabled, thus enabling it";
            sed -i '/\[plugins\."io\.containerd\.grpc\.v1\.cri"\]/a \  enable_cdi = true' "$CONTAINERD_CONFIG_PATH"
            CONFIG_CHANGED=true
          fi
          # --- CDI Spec Dirs Configuration ---
          if grep -q '^\s*cdi_spec_dirs\s*=' "$CONTAINERD_CONFIG_PATH"; then
            echo "containerd config already configures cdi_spec_dirs; taking no action"
          else
            echo "containerd config does not configure cdi_spec_dirs, thus setting it";
            sed -i '/\[plugins\."io\.containerd\.grpc\.v1\.cri"\]/a \  cdi_spec_dirs = ["/etc/cdi", "/var/run/cdi"]' "$CONTAINERD_CONFIG_PATH"
            CONFIG_CHANGED=true
          fi
          # --- Enable NRI ---
          if grep -q "io.containerd.nri.v1.nri" "$CONTAINERD_CONFIG_PATH"
          then
             echo "containerd config contains NRI reference already; taking no action"
          else
             echo "containerd config does not mention NRI, thus enabling it";
             printf '%s\n' "[plugins.\"io.containerd.nri.v1.nri\"]" "  disable = false" "  disable_connections = false" "  plugin_config_path = \"/etc/nri/conf.d\"" "  plugin_path = \"/opt/nri/plugins\"" "  plugin_registration_timeout = \"5s\"" "  plugin_request_timeout = \"5s\"" "  socket_path = \"/var/run/nri/nri.sock\"" >> "$CONTAINERD_CONFIG_PATH"
             CONFIG_CHANGED=true
          fi
          mkdir -p /etc/nri/conf.d

          # Create a config file that tells containerd where to find your plugin's socket.
          cat <<EOF > /etc/nri/conf.d/fluxbind.conf
          # NRI v1 plugin configuration for fluxbind
          idx = 10
          addr = "/var/run/nri/nri.sock"
          EOF
          echo "Created NRI v1 plugin configuration for fluxbind."

          if [ "$CONFIG_CHANGED" = true ]; then
            echo "restarting containerd"
            nsenter -t 1 -m -u -i -n -p -- systemctl restart containerd
          fi
      containers:
      - name: nri-sidecar
        image: ghcr.io/converged-computing/fluxbind-dra-driver:nri
        imagePullPolicy: Never
        securityContext:
          privileged: true
        volumeMounts:
        - name: nri-plugin
          mountPath: /var/run/nri
        - name: fluxbind-shared
          mountPath: /run/fluxbind
        args:
        - "--name=fluxbind"
        - "--idx=01"
      - name: fluxbind
        args:
        - fluxbind-dra-driver
        - --v=4
        image: ghcr.io/converged-computing/fluxbind-dra-driver
        imagePullPolicy: Never
        # imagePullPolicy: Always
        env:
        - name: NODE_NAME
          valueFrom:
            fieldRef:
              fieldPath: spec.nodeName
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        resources:
          requests:
            cpu: "100m"
            memory: "50Mi"
        securityContext:
          capabilities:
            add: ["NET_ADMIN", "SYS_ADMIN"]
        volumeMounts:
        - name: device-plugin
          mountPath: /var/lib/kubelet/plugins
        - name: plugin-registry
          mountPath: /var/lib/kubelet/plugins_registry
        - name: nri-plugin
          mountPath: /var/run/nri
        - name: fluxbind-shared
          mountPath: /run/fluxbind
        - name: cdi-dir
          mountPath: /var/run/cdi
      volumes:
      - name: device-plugin
        hostPath:
          path: /var/lib/kubelet/plugins
      - name: plugin-registry
        hostPath:
          path: /var/lib/kubelet/plugins_registry
      - name: nri-plugin
        hostPath:
          path: /var/run/nri
      - name: fluxbind-shared
        hostPath:
          path: /run/fluxbind
      - name: netns
        hostPath:
          path: /var/run/netns
      - name: infiniband
        hostPath:
          path: /dev/infiniband
      - name: etc
        hostPath:
          path: /etc
      - name: cdi-dir
        hostPath:
          path: /var/run/cdi
          type: DirectoryOrCreate
---
apiVersion: resource.k8s.io/v1
kind: DeviceClass
metadata:
  name: shape
spec:
  selectors:
    - cel:
        expression: device.driver == "fluxbind"