mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-03 10:37:21 +09:00
Aleksei Sviridkin
3256155926
With raw names forbidden a GPU reaches a VM only through a GPUClaim reference, which makes a held claim a hard guarantee. A VMI carrying a GPU entry (any gpus entry, a hostDevices entry or a resource of a GPU resource name) without the claim-reference label is refused, which covers a VM written by a tenant super-admin, a VMIReplicaSet and a worker pool. A pod requesting a GPU resource name is refused unless kubevirt-controller creates it with a VMI owner, as it does for virt-launcher and migration target pods. The GPU resource names come from the settings ConfigMap the controller publishes. The binding fails closed without it, and since the parameter is resolved before any expression runs, the bindings select tenant namespaces only; anything wider would block every pod in the cluster, the controller's own included, until the ConfigMap exists. Assisted-by: LLM Signed-off-by: Aleksei Sviridkin <f@lex.la>