NVIDIA / gpu-operator / 30139365334

32%

main: 34%

push

github

feat(driver): mount vGPU licensing config as a directory for live updates

The licensing Secret/ConfigMap is mounted into the driver container only via
subPath mounts at /drivers/gridd.conf and
/drivers/ClientConfigToken/client_configuration_token.tok. subPath mounts are
resolved once when the container starts and kubelet explicitly excludes them
from its atomic-symlink refresh, so an in-place update of the backing object
(for example an NLS token rotated by ExternalSecrets/Vault) is never visible to
a running nvidia-driver-daemonset pod. Recovering the new license today
requires a `kubectl rollout restart`, which unloads the kernel module and
evicts every GPU workload on the node.

Add a third mount of the same licensing volume as a plain directory at
/drivers/licensing-config with no subPath, so kubelet keeps its contents in
sync while the pod runs. This gives the driver container entrypoint a live view
of gridd.conf (and client_configuration_token.tok when NLS is enabled) that it
can watch in order to restart nvidia-gridd in place instead of rolling the
daemonset.

The volume is reused rather than duplicated: the Items projection is identical,
so a second volume would only add a redundant copy of the same projected keys
and a second source of truth to keep in sync. Keys are still projected through
Items so that extra keys carried by a user's Secret do not land in the mount.

The two existing subPath mounts are retained unchanged. Every published driver
image entrypoint copies from those exact paths, and removing them would break
all of them.

Applied to both the NVIDIADriver CR path (internal/state) and the ClusterPolicy
path (controllers), which is still live whenever driver.useNvidiaDriverCRD is
false (the default).

Refs #2279

7 of 7 new or added lines in 2 files covered. (100.0%)

4195 of 13043 relevant lines covered (32.16%)

0.37 hits per line