mirror of
https://github.com/cozystack/cozystack.git
synced 2026-10-29 08:07:33 +09:00
Aleksei Sviridkin
7d1d238f4d
With raw names forbidden a GPU reaches a VM only through a GPUDevice reference, which makes a held device a hard guarantee. A VMI carrying a GPU entry (any gpus entry, a hostDevices entry or a resource of a GPU resource name) without the device-reference label is refused, which covers a VM written by a tenant super-admin, a VMIReplicaSet and a worker pool. A pod requesting a GPU resource name is refused unless kubevirt-controller creates it with a VMI owner, as it does for virt-launcher and migration target pods. The GPU resource names come from the settings ConfigMap the controller publishes. The binding fails closed without it, and since the parameter is resolved before any expression runs, the bindings select tenant namespaces only; anything wider would block every pod in the cluster, the controller's own included, until the ConfigMap exists. The usage-monitor label policy now selects tenant namespaces the same way, so the two cannot disagree on what a tenant namespace is, and its ratchet also refuses changing the label's value, which could make an object labelled before the policy start matching the monitor. Assisted-by: LLM Signed-off-by: Aleksei Sviridkin <f@lex.la>