Add custom labels, securityContext to DaemonSets#2120
Open
faganihajizada wants to merge 1 commit intoNVIDIA:mainfrom
Open
Add custom labels, securityContext to DaemonSets#2120faganihajizada wants to merge 1 commit intoNVIDIA:mainfrom
faganihajizada wants to merge 1 commit intoNVIDIA:mainfrom
Conversation
faganihajizada
requested review from
ArangoGutierrez,
cdesiniotis,
karthikvetrivel,
shivamerla and
tariq1890
as code owners
Allow users to configure pod-level and container-level security contexts
globally for all DaemonSets via spec.daemonsets.podSecurityContext and
spec.daemonsets.securityContext. Pod-level replaces the existing context;
container-level merges into each container, preserving fields already set
by component transforms.
Propagate custom labels and annotations from the validator DaemonSet pod
template onto CUDA and plugin workload pods, skipping protected selector
labels ("app", "app.kubernetes.io/part-of").
Add commonLabels support to the NFD Helm subchart so users can inject
additional labels onto all NFD resources.
faganihajizada
force-pushed
the
feat/custom-labels-and-security-context
branch
from
57fee73 to
cc94407
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Closes #1030
Adds three capabilities to ClusterPolicy:
Custom labels/annotations on validator workload pods: spec.daemonsets.labels and spec.daemonsets.annotations now propagate from the validator DaemonSet pod template onto the standalone CUDA and plugin validator workload pods. Protected selector labels (app, app.kubernetes.io/part-of) are skipped to preserve pod identity.
Custom labels on NFD components: New commonLabels value in the NFD Helm subchart, injected into the shared node-feature-discovery.labels template. Applies to all NFD-managed resources (DaemonSets, Deployments, etc.) without affecting selector labels.
Custom securityContext on DaemonSets:
Design notes
Pod-level SecurityContext is full replace, not merge. This matches the existing pattern for tolerations and priorityClassName in applyCommonDaemonsetConfig. No embedded DaemonSet manifest currently sets a pod-level SecurityContext, so there is nothing to lose on replace.
Container-level SecurityContext uses nil-field merge. Every container in the operator's DaemonSet manifests already sets privileged: true. A full replace would wipe that. The merge ensures global defaults only fill in what components haven't explicitly set.
applyCommonDaemonsetConfigruns before component transforms(t(obj, ...)), so transforms can still override individual fields afterward.mergeSecurityContext is explicit field-by-field (all 12 SecurityContext fields). This is deliberate over reflection or a library, it's readable, has no external dependencies, and matches the codebase style of explicit struct handling.
The issue references "Jobs" but the cuda-validator and plugin-validator are standalone Pods created by the validator DaemonSet, not Jobs. The label propagation targets these Pods.
Checklist
make lint)make validate-generated-assets)make validate-modules)Testing
mergeSecurityContext(5 cases: nil target, nil defaults, empty target, merge with existing, no-overwrite)applyCommonDaemonsetConfig(4 new cases: podSecurityContext, nil container SecurityContext, merge into existing, initContainers)applyDaemonsetMetadataToPod(4 cases: no-op, label skip, annotations, nil labels)applyCommonDaemonsetMetadata(existing tests still pass)