Repository navigation
[fix]: Fix host subscription mounts with custom driver repositories - #3109
Conversation
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| HostPath: &corev1.HostPathVolumeSource{ | ||
| Path: "/etc/pki/entitlement", | ||
| Type: ptr.To(corev1.HostPathDirectory), | ||
| Type: new(corev1.HostPathDirectoryOrCreate), |
There was a problem hiding this comment.
🟨 Absent subscriptions modify host configuration
On unsubscribed nodes, DirectoryOrCreate and FileOrCreate create subscription paths on the host. Kubelet changes protected host configuration instead of leaving missing subscription data untouched.
Was this helpful? React with 👍 or 👎 to provide feedback.
ece7708 to
0ddf476
Compare
📝 Walkthrough
Priority: ⚪ Pending latest changes Severity of issue fixed: Medium Merge Risk: ⚪ Minimal · up to
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments: 2
controllers/transforms_test.go: 1
4878-4878: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAssert driver subscription mount destinations and names.
The driver assertion counts mounts and checks only
ReadOnly. The host-path helper validates volume sources, not mount destinations. A wrong driverMountPath, or a changed name that still starts withsubscription-config-, can therefore pass. Compare the driver subscription mounts against expectedcorev1.VolumeMountvalues, includingName,MountPath, andReadOnly, while keeping the RHEL parent-directory mount assertion on the manager container.internal/state/driver_test.go: 1
743-745: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winAssert required mounts in the rendered driver container.
The
configs.VolumeMountsassertions run before rendering. The DaemonSet check only rejects/run/secrets/yum.repos.d. If the template stops renderingAdditionalConfigs.VolumeMountsintonvidia-driver-ctr, this test still passes. Assert that the rendered driver container contains the expected subscription and custom repository mounts.
ℹ️ Review info
⚙️ Run configuration
- Source mode: Auto
- Repository: NVIDIA/gpu-operator
- Branch: main
- File: .coderabbit.yaml
- Commit: 8b109be
- Layers: Repository YAML
- Review profile: QUIET
- Plan: Enterprise
- Run ID:
c5dc7788-2ad8-4353-ae38-30950ce228e5
📒 Files selected for processing: 6
controllers/object_controls.gocontrollers/transforms_test.gointernal/state/driver.gointernal/state/driver_test.gointernal/state/driver_volumes.gomanifests/state-driver/0500_daemonset.yaml
Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.
|
The changes mostly look good, my only concern is we don't have an explicit repoConfig only mode now with the changes, we always create/mount the subscription folders and I am not sure if that can cause weird errors on air gapped hosts (I am not sure it will, it is just speculative on my part). Also it is not great that we will create these subscription folders on the host and leave them behind when they don't actually exist on the host. would it be possible for us to do some tests in an actual air gapped environment ? |
This reverts commit 835c3c0, reversing changes made to its first parent. Restore RHEL host subscription mounts when custom repositories are configured. Retain shared test helpers required by subsequent tests. Signed-off-by: Rahul Sharma <rahulsharm@nvidia.com>
Create missing RHEL subscription files and directories, and missing SUSE credentials directories, so hosts using mirrored repositories can mount subscription paths without new API fields or driver images. Mount the RHEL repository parent directory only in the driver-manager init container to support file creation without exposing additional host repository files to regular driver containers. Apply the changes to both ClusterPolicy and NVIDIADriver rendering, preserving existing OS/runtime eligibility checks. Add regression tests for exact subscription mounts and rendered custom repository mounts. Signed-off-by: Rahul Sharma <rahulsharm@nvidia.com>
0ddf476 to
21c6d32
Compare
|
@cdesiniotis can you take a look at this as well? |
|
/cherry-pick release-26.7 |
|
🤖 Backport PR created for |
Description
Restore RHEL subscription mounts when repoConfig is configured. Use DirectoryOrCreate and FileOrCreate to tolerate missing subscription paths on RHEL, SLES, and SL Micro.
Mount the RHEL repository parent directory only in the driver-manager init container to support file creation without exposing additional host repository files to regular driver containers.
Apply changes to both ClusterPolicy and NVIDIADriver rendering paths, preserving existing OS and runtime eligibility checks.
This PR reverts the changes done in #2391 and fixes the regression.
Fixes #2817
Checklist
make lint)make validate-generated-assets)make validate-modules)Testing
Tested it on a single node rhel k8s cluster and verified it passes all tests mentioned in the guide attached.
rhel-host-subscription-pr3109-public.md