Skip to content

Commit 0ed747c

Browse files
committed
Add anyuid SCC to compute domain service account on OpenShift
Red Hat OpenShift blocks writing into `/etc`, causing the following error in compute-domain-daemon pods: ``` IMEXDaemonUpdateLoop failed, initiate shutdown: writeNodesConfig failed: failed to create nodes config file: open /etc/nvidia-imex/nodes_config.cfg: permission denied ``` Binding `anyuid` SCC to the service account when run on OpenShift solves this problem. Signed-off-by: Vitaliy Emporopulo <[email protected]>
1 parent dce473e commit 0ed747c

File tree

1 file changed

+16
-1
lines changed

1 file changed

+16
-1
lines changed

deployments/helm/nvidia-dra-driver-gpu/templates/compute-domain-daemon-service-account.yaml

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,4 +26,19 @@ subjects:
2626
roleRef:
2727
kind: ClusterRole
2828
name: compute-domain-daemon-role
29-
apiGroup: rbac.authorization.k8s.io
29+
apiGroup: rbac.authorization.k8s.io
30+
{{- if .Capabilities.APIVersions.Has "security.openshift.io/v1/SecurityContextConstraints" }}
31+
---
32+
apiVersion: rbac.authorization.k8s.io/v1
33+
kind: ClusterRoleBinding
34+
metadata:
35+
name: compute-domain-daemon-anyuid-role-binding
36+
subjects:
37+
- kind: ServiceAccount
38+
name: compute-domain-daemon-service-account
39+
namespace: {{ include "nvidia-dra-driver-gpu.namespace" . }}
40+
roleRef:
41+
kind: ClusterRole
42+
name: system:openshift:scc:anyuid
43+
apiGroup: rbac.authorization.k8s.io
44+
{{- end }}

0 commit comments

Comments
 (0)