Aleksei Sviridkin 0cb44dc919 feat(gpu-node-agent): add the agent command, image and chart ...

The inventory has to run next to kubelet: a DaemonSet reading the
host's sysfs and kubelet's pod-resources socket, both mounted
read-only. Connecting to the socket needs root, so the agent runs as
root but with no capabilities and no privilege escalation.

The manager's cached client would watch every pod in the cluster, so
the agent uses a direct client and lists only its own node's pods.
RBAC cannot name the caller's node, so the role is cluster-wide; it
holds only the verbs the agent uses, and the DaemonSet selects the
nodes node-feature-discovery marks as carrying an NVIDIA device, so
the token does not sit on nodes with nothing to report.

The image is in the root build list so that every build path stamps
its reference; the committed tag is replaced by the first build.

Assisted-by: LLM
Signed-off-by: Aleksei Sviridkin <f@lex.la>

2026-10-21 06:33:45 +03:00

..

main_test.go

feat(gpu-node-agent): add the agent command, image and chart

2026-10-21 06:33:45 +03:00

main.go

feat(gpu-node-agent): add the agent command, image and chart

2026-10-21 06:33:45 +03:00