You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: INSTALL.md
+11
Original file line number
Diff line number
Diff line change
@@ -1,5 +1,16 @@
1
1
# Installing device plugins to cluster
2
2
3
+
## Pod security admission
4
+
5
+
In Kubernetes clusters where [Pod Security admission](https://kubernetes.io/docs/concepts/security/pod-security-admission/) is enabled, device plugins deployed directly from the [deployments](deployments/) will fail to get scheduled to the cluster. Device plugins require access to the underlying host via [hostpaths](https://kubernetes.io/docs/concepts/storage/volumes/#hostpath), and hostpath use is reserved for privileged Pods. If the plugins are deployed from the `deployments` directory, the target namespace will require these labels:
6
+
```
7
+
pod-security.kubernetes.io/enforce: privileged
8
+
pod-security.kubernetes.io/audit: privileged
9
+
pod-security.kubernetes.io/warn: privileged
10
+
```
11
+
12
+
Since the 0.32.1 release the Device Plugin Operator sets the required admission labels automatically in its deployment. The device plugins deployed via the operator are scheduled to the same namespace as the operator, and do not then need any other configuration.
13
+
3
14
## Install device plugins via a DaemonSet
4
15
5
16
Each plugin can be installed via a DaemonSet. The install changes slightly based on the desired plugin. See install instructions per [plugin](README.md#plugins).
0 commit comments