Aleksei Sviridkin ccaef2f877 feat(gpu-node-agent): restrict the agent to its own node's GPUNode ...

RBAC cannot name the caller's node, so the agent's role lets every
agent write every GPUNode, and a compromised node could rewrite the
inventory, and through resourceNames the cluster's GPU resource-name
set, of any other node. The pod-bound service account token carries
the node name as a user extra, which a ValidatingAdmissionPolicy can
compare with the object name.

A token without that extra is refused rather than let through: the
policy matches only the agent's service account, so failing closed
stops the agent and nobody else.

Assisted-by: LLM
Signed-off-by: Aleksei Sviridkin <f@lex.la>

2026-10-21 06:33:46 +03:00

..

images/gpu-node-agent

feat(gpu-node-agent): add the agent command, image and chart

2026-10-21 06:33:45 +03:00

templates

feat(gpu-node-agent): restrict the agent to its own node's GPUNode

2026-10-21 06:33:46 +03:00

tests

feat(gpu-node-agent): restrict the agent to its own node's GPUNode

2026-10-21 06:33:46 +03:00

Chart.yaml

feat(gpu-node-agent): add the agent command, image and chart

2026-10-21 06:33:45 +03:00

Makefile

feat(gpu-node-agent): add the agent command, image and chart

2026-10-21 06:33:45 +03:00

values.yaml

feat(gpu-node-agent): add the agent command, image and chart

2026-10-21 06:33:45 +03:00