RBAC cannot name the caller's node, so the agent's role lets every
agent write every GPUNode, and a compromised node could rewrite the
inventory, and through resourceNames the cluster's GPU resource-name
set, of any other node. The pod-bound service account token carries
the node name as a user extra, which a ValidatingAdmissionPolicy can
compare with the object name.
A token without that extra is refused rather than let through: the
policy matches only the agent's service account, so failing closed
stops the agent and nobody else.
Assisted-by: LLM
Signed-off-by: Aleksei Sviridkin <f@lex.la>
The inventory has to run next to kubelet: a DaemonSet reading the
host's sysfs and kubelet's pod-resources socket, both mounted
read-only. Connecting to the socket needs root, so the agent runs as
root but with no capabilities and no privilege escalation.
The manager's cached client would watch every pod in the cluster, so
the agent uses a direct client and lists only its own node's pods.
RBAC cannot name the caller's node, so the role is cluster-wide; it
holds only the verbs the agent uses, and the DaemonSet selects the
nodes node-feature-discovery marks as carrying an NVIDIA device, so
the token does not sit on nodes with nothing to report.
The image is in the root build list so that every build path stamps
its reference; the committed tag is replaced by the first build.
Assisted-by: LLM
Signed-off-by: Aleksei Sviridkin <f@lex.la>
Aleksei Sviridkin