kubevirt / hyperconverged-cluster-operator / 24301226622

80%

push

github

Deploy iommufd-device-plugin DaemonSet alongside AIE webhook (#4141)

* Deploy iommufd-device-plugin DaemonSet alongside AIE webhook

Deploy the iommufd-device-plugin as a DaemonSet when the
hco.kubevirt.io/deployAIE annotation is set to true. The device
plugin provides IOMMUFD file descriptors to virt-launcher containers via
Unix sockets, which is required by the AIE webhook when it injects the
devices.kubevirt.io/iommufd resource limit.

The annotation is also renamed from hco.kubevirt.io/deployAIEWebhook to
hco.kubevirt.io/deployAIE to reflect that it now gates more than just
the webhook.

The DaemonSet runs as a privileged container with hostPath volumes for
/dev, /var/lib/kubelet/device-plugins, and /var/run/kubevirt/fd-sockets.
A dedicated ServiceAccount and SCC (on OpenShift) are created to provide
the necessary permissions.

Also bumps the AIE webhook image from v1.0.0 to v1.1.0 which includes
iommufd resource injection support (kubevirt/kubevirt-aie-webhook#7) and
pins the iommufd-device-plugin image to v0.0.1.

Ref: CNV-83122

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Lee Yarwood <lyarwood@redhat.com>

* Generated manifests for iommufd-device-plugin deployment

Regenerated by running make build-manifests.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Lee Yarwood <lyarwood@redhat.com>

---------

Signed-off-by: Lee Yarwood <lyarwood@redhat.com>

194 of 198 new or added lines in 12 files covered. (97.98%)

10588 of 13190 relevant lines covered (80.27%)

2.07 hits per line