Aleksei Sviridkin f6a79815a4 feat(cozystack-basics): keep tenants off GPUClaim finalizers and mark ...

Whoever orders GPUClaim objects must not touch two parts of a claim. The
claim finalizer keeps a released claim, its binding and its usage record
until no VMI uses it, so a tenant who could drop it could take a held
claim out of the usage records. The template-claim label is the mark the
GPU controller sets on claims it creates from a claimTemplate, and it
deletes claims so marked with their VMI, so on a tenant's own order it
would get that order deleted. Both are refused for everyone but platform
callers, matched by group like the other cozystack-basics policies:
cozy-system and kube-system service accounts and cluster admins, plus
kube-controller-manager, which has no group of its own. The orphan and
foregroundDeletion finalizers belong to the API server and the garbage
collector and stay free.

Assisted-by: LLM
Signed-off-by: Aleksei Sviridkin <f@lex.la>

2026-10-23 03:53:32 +03:00

..

apitest

feat(api): add gpu.cozystack.io GPUClass, GPUClaim and GPUNode

2026-10-23 03:40:46 +03:00

controller

feat(gpu): define the shared GPU keys, settings and start contract

2026-10-23 03:40:47 +03:00

model

feat(gpu): add the shared GPU placement and budget model

2026-10-23 03:40:49 +03:00

policytest

feat(cozystack-basics): keep tenants off GPUClaim finalizers and mark

2026-10-23 03:53:32 +03:00

webhook

feat(gpu): define the shared GPU keys, settings and start contract

2026-10-23 03:40:47 +03:00

config.go

feat(gpu): define the shared GPU keys, settings and start contract

2026-10-23 03:40:47 +03:00

consts.go

feat(gpu): define the shared GPU keys, settings and start contract

2026-10-23 03:40:47 +03:00

doc.go

feat(gpu): define the shared GPU keys, settings and start contract

2026-10-23 03:40:47 +03:00