fix: simplify and assume accept-nvidia-visible-devices-envvar-when-unprivileged is true

Author: kaixi-wang

helm/fiftyone-teams-app/README.md

@@ -885,7 +885,7 @@ If pods show unhealthy states (e.g., `0/1`, `CrashLoopBackOff`, `Pending`):
 | casSettings.volumes | list | `[]` | Volumes for `teams-cas`. [Reference][volumes]. |
 | delegatedOperatorDeployments.deployments | object | `{"teamsDoCpuDefault":{"enabled":false,"env":{"FIFTYONE_MEDIA_CACHE_DIR":"/opt/media_cache","FIFTYONE_MEDIA_CACHE_SIZE_BYTES":"2147483648"},"replicaCount":1,"resources":{"limits":{"cpu":4,"ephemeral-storage":"1Gi","memory":"16Gi"},"requests":{"cpu":4,"ephemeral-storage":"1Gi","memory":"16Gi"}},"volumeMounts":[{"mountPath":"/dev/shm","name":"shm-vol"},{"mountPath":"/opt/media_cache","name":"memory-media-cache-vol"}],"volumes":[{"emptyDir":{"medium":"Memory","sizeLimit":"2Gi"},"name":"shm-vol"},{"emptyDir":{"medium":"Memory","sizeLimit":"2.5Gi"},"name":"memory-media-cache-vol"}]}}` | Additional deployments to configure. Each template will use .Values.delegatedOperatorDeployments.template as a base. Each template value may be overridden. Maps/dictionaries will be merged key-wise, with the deployment instance taking precedence. List values will not be merged, but be overridden completely by the deployment instance. |
 | delegatedOperatorDeployments.deployments.teamsDoCpuDefault | object | `{"enabled":false,"env":{"FIFTYONE_MEDIA_CACHE_DIR":"/opt/media_cache","FIFTYONE_MEDIA_CACHE_SIZE_BYTES":"2147483648"},"replicaCount":1,"resources":{"limits":{"cpu":4,"ephemeral-storage":"1Gi","memory":"16Gi"},"requests":{"cpu":4,"ephemeral-storage":"1Gi","memory":"16Gi"}},"volumeMounts":[{"mountPath":"/dev/shm","name":"shm-vol"},{"mountPath":"/opt/media_cache","name":"memory-media-cache-vol"}],"volumes":[{"emptyDir":{"medium":"Memory","sizeLimit":"2Gi"},"name":"shm-vol"},{"emptyDir":{"medium":"Memory","sizeLimit":"2.5Gi"},"name":"memory-media-cache-vol"}]}` | Default (CPU-only) delegated operator runner. Defaults to an 4vCPU, 16Gi RAM runner. The deployment is backed with a 2.5Gi in-memory volume for caching media and an extra 2Gi of shared memory. |
-| delegatedOperatorDeployments.template | object | `{"affinity":{},"deploymentAnnotations":{},"description":"","env":{"FIFTYONE_DELEGATED_OPERATION_LOG_PATH":"","FIFTYONE_INTERNAL_SERVICE":true,"FIFTYONE_MEDIA_CACHE_SIZE_BYTES":-1},"image":{"pullPolicy":"Always","repository":"voxel51/fiftyone-teams-cv-full","tag":""},"labels":{},"liveness":{"failureThreshold":5,"periodSeconds":30,"timeoutSeconds":30},"nodeSelector":{},"podAnnotations":{},"podDisruptionBudget":{"enabled":false,"minAvailable":null},"podSecurityContext":{"fsGroup":1000,"runAsGroup":1000,"runAsNonRoot":true,"runAsUser":1000},"readiness":{"failureThreshold":5,"periodSeconds":30,"timeoutSeconds":30},"replicaCount":3,"resources":{"limits":{},"requests":{}},"secretEnv":{},"securityContext":{},"startup":{"failureThreshold":5,"periodSeconds":30,"timeoutSeconds":30},"telemetry":{"sidecar":{"env":{},"resources":{}}},"tolerations":[],"topologySpreadConstraints":[],"updateStrategy":{"type":"RollingUpdate"},"volumeMounts":[],"volumes":[]}` | A common template applied to all deployments. Each deployment can then override individual fields as needed by the operator. |
+| delegatedOperatorDeployments.template | object | `{"affinity":{},"deploymentAnnotations":{},"description":"","env":{"FIFTYONE_DELEGATED_OPERATION_LOG_PATH":"","FIFTYONE_INTERNAL_SERVICE":true,"FIFTYONE_MEDIA_CACHE_SIZE_BYTES":-1},"image":{"pullPolicy":"Always","repository":"voxel51/fiftyone-teams-cv-full","tag":""},"labels":{},"liveness":{"failureThreshold":5,"periodSeconds":30,"timeoutSeconds":30},"nodeSelector":{},"podAnnotations":{},"podDisruptionBudget":{"enabled":false,"minAvailable":null},"podSecurityContext":{"fsGroup":1000,"runAsGroup":1000,"runAsNonRoot":true,"runAsUser":1000},"readiness":{"failureThreshold":5,"periodSeconds":30,"timeoutSeconds":30},"replicaCount":3,"resources":{"limits":{},"requests":{}},"secretEnv":{},"securityContext":{},"startup":{"failureThreshold":5,"periodSeconds":30,"timeoutSeconds":30},"tolerations":[],"topologySpreadConstraints":[],"updateStrategy":{"type":"RollingUpdate"},"volumeMounts":[],"volumes":[]}` | A common template applied to all deployments. Each deployment can then override individual fields as needed by the operator. |
 | delegatedOperatorDeployments.template.affinity | object | `{}` | Affinity and anti-affinity for `delegated-operator-executor`. [Reference][affinity]. |
 | delegatedOperatorDeployments.template.deploymentAnnotations | object | `{}` | Annotations for the `teams-do` deployment. [Reference][annotations]. |
 | delegatedOperatorDeployments.template.description | string | `""` | A description for the delegated operator instance. This is unused in the template context. Each operator should either set their own description or, optionally, use the default. If unset at the operator context, it will be defaulted to `Long running operations delegated to $name` where `$name` is the name of the Deployment object. |
@@ -914,8 +914,6 @@ If pods show unhealthy states (e.g., `0/1`, `CrashLoopBackOff`, `Pending`):
 | delegatedOperatorDeployments.template.startup.failureThreshold | int | `5` | Number of times to retry the startup probe for the `teams-do`. [Reference][probes]. |
 | delegatedOperatorDeployments.template.startup.periodSeconds | int | `30` | How often (in seconds) to perform the startup probe for `teams-do`. [Reference][probes]. |
 | delegatedOperatorDeployments.template.startup.timeoutSeconds | int | `30` | Timeout for the startup probe for the `teams-do`. [Reference][probes]. |
-| delegatedOperatorDeployments.template.telemetry.sidecar.env | object | `{}` | Extra sidecar env vars. Rarely set; GPU env is auto-configured. |
-| delegatedOperatorDeployments.template.telemetry.sidecar.resources | object | `{}` | Sidecar resource overrides. Only needed on GKE-style clusters where GPU charts stay empty: give the sidecar a GPU (enable GPU time-sharing so it shares the operator's GPU). |
 | delegatedOperatorDeployments.template.tolerations | list | `[]` | Allow the k8s scheduler to schedule delegated-operator-executor pods with matching taints. [Reference][taints-and-tolerations]. |
 | delegatedOperatorDeployments.template.topologySpreadConstraints | list | `[]` | Control how Pods are spread across your distributed footprint. Label selectors will be defaulted to those of the `teams-do` deployment(s). [Reference][topology-spread-constraints]. |
 | delegatedOperatorDeployments.template.updateStrategy | object | `{"type":"RollingUpdate"}` | Control how `teams-do` pods are redeployed during an upgrade. [Reference][upgrade-strategies] |

helm/fiftyone-teams-app/templates/_telemetry.tpl

@@ -137,17 +137,15 @@ Inputs (dict):
 
 {{/*
 A regular spec.containers entry: telemetry-sidecar for api/app/plugins/DO deployments.
-Inputs: same dict as telemetry.sidecar-env, plus optional `sidecarResources` —
-when non-empty it replaces telemetry.sidecar.resources for this one sidecar
-(e.g. to request `nvidia.com/gpu` so the sidecar can read GPU metrics).
+Inputs: same dict as telemetry.sidecar-env.
 */}}
 {{- define "telemetry.sidecar" -}}
 - name: telemetry-sidecar
   image: "{{ .ctx.Values.telemetry.sidecar.image.repository }}:{{ .ctx.Values.telemetry.sidecar.image.tag | default .ctx.Chart.AppVersion }}"
   imagePullPolicy: {{ .ctx.Values.telemetry.sidecar.image.pullPolicy | default "Always" }}
   env:
     {{- include "telemetry.sidecar-env" . | nindent 4 }}
-  {{- with (.sidecarResources | default .ctx.Values.telemetry.sidecar.resources) }}
+  {{- with .ctx.Values.telemetry.sidecar.resources }}
   resources:
     {{- toYaml . | nindent 4 }}
   {{- end }}
@@ -177,7 +175,7 @@ would block Job completion.
   restartPolicy: Always
   env:
     {{- include "telemetry.sidecar-env" . | nindent 4 }}
-  {{- with (.sidecarResources | default .ctx.Values.telemetry.sidecar.resources) }}
+  {{- with .ctx.Values.telemetry.sidecar.resources }}
   resources:
     {{- toYaml . | nindent 4 }}
   {{- end }}

helm/fiftyone-teams-app/templates/delegated-operator-instance-deployment.yaml

@@ -17,17 +17,16 @@
 {{- $defaultDescription := printf "Long running operations delegated to %s" $name }}
 {{- $updateStrategy := merge (dict) ($v.updateStrategy|default dict) ($baseTpl.updateStrategy) }}
 {{- $mergedResources := merge (dict) ($v.resources | default dict) ($baseTpl.resources | default dict) }}
-{{- $sidecarOverride := (merge (dict) ($v.telemetry | default dict) ($baseTpl.telemetry | default dict)).sidecar | default dict }}
-{{- /* When the worker requests a GPU, expose it to the sidecar too so GPU
-       metrics are collected without any extra config. NVIDIA_VISIBLE_DEVICES is
-       honored where the NVIDIA runtime accepts it (most non-GKE setups); GKE
-       gates GPUs via the device plugin, so use telemetry.sidecar.resources there. */}}
+{{- /* When the executor requests a GPU, expose that same GPU to its telemetry
+       sidecar for read-only metrics. This sets env vars only — the sidecar never
+       requests its own nvidia.com/gpu, so it consumes no GPU quota and the
+       executor keeps the allocated GPU. Honored where the NVIDIA runtime accepts
+       NVIDIA_VISIBLE_DEVICES (most setups; GKE blocks env-based exposure). */}}
 {{- $gpuRequested := or (not (empty (dig "limits" "nvidia.com/gpu" "" $mergedResources))) (not (empty (dig "requests" "nvidia.com/gpu" "" $mergedResources))) }}
-{{- $autoSidecarEnv := dict }}
+{{- $sidecarEnv := dict }}
 {{- if $gpuRequested }}
-{{- $autoSidecarEnv = dict "NVIDIA_VISIBLE_DEVICES" "all" "NVIDIA_DRIVER_CAPABILITIES" "utility" }}
+{{- $sidecarEnv = dict "NVIDIA_VISIBLE_DEVICES" "all" "NVIDIA_DRIVER_CAPABILITIES" "compute,utility" }}
 {{- end }}
-{{- $sidecarEnv := merge (dict) ($sidecarOverride.env | default dict) $autoSidecarEnv }}
 {{- $mergedVolumeMounts := $v.volumeMounts | default $baseTpl.volumeMounts | default list }}
 {{- $mergedVolumes := $v.volumes | default $baseTpl.volumes | default list }}
 {{- if $.Values.telemetry.enabled }}
@@ -141,7 +140,7 @@ spec:
             periodSeconds: {{ ($v.startup).periodSeconds | default $baseTpl.startup.periodSeconds }}
             timeoutSeconds: {{ ($v.startup).timeoutSeconds | default $baseTpl.startup.timeoutSeconds }}
         {{- if $.Values.telemetry.enabled }}
-        {{- include "telemetry.sidecar" (dict "ctx" $ "serviceType" "delegated-operator" "targetName" "fiftyone delegated" "executor" true "sidecarEnv" $sidecarEnv "sidecarResources" ($sidecarOverride.resources | default dict)) | nindent 8 }}
+        {{- include "telemetry.sidecar" (dict "ctx" $ "serviceType" "delegated-operator" "targetName" "fiftyone delegated" "executor" true "sidecarEnv" $sidecarEnv) | nindent 8 }}
         {{- end }}
       {{- with (merge (dict) ($v.nodeSelector | default dict) ($baseTpl.nodeSelector)) }}
       nodeSelector:

helm/fiftyone-teams-app/values.schema.json

@@ -2288,33 +2288,6 @@
               "title": "startup",
               "type": "object"
             },
-            "telemetry": {
-              "description": "GPU metrics auto-enable when this operator requests a GPU. Only set the\noptions below if GPU charts stay empty while the operator uses the GPU.",
-              "properties": {
-                "sidecar": {
-                  "properties": {
-                    "env": {
-                      "description": "Extra sidecar env vars. Rarely set; GPU env is auto-configured.",
-                      "required": [],
-                      "title": "env",
-                      "type": "object"
-                    },
-                    "resources": {
-                      "description": "Sidecar resource overrides. Only needed on GKE-style clusters where\nGPU charts stay empty: give the sidecar a GPU (enable GPU time-sharing\nso it shares the operator's GPU).",
-                      "required": [],
-                      "title": "resources",
-                      "type": "object"
-                    }
-                  },
-                  "required": [],
-                  "title": "sidecar",
-                  "type": "object"
-                }
-              },
-              "required": [],
-              "title": "telemetry",
-              "type": "object"
-            },
             "tolerations": {
               "description": "Allow the k8s scheduler to schedule delegated-operator-executor pods with matching taints. [Reference][taints-and-tolerations].",
               "items": {

helm/fiftyone-teams-app/values.yaml

@@ -779,17 +779,6 @@ delegatedOperatorDeployments:
       #   cpu: 8
       #   memory: 16Gi
 
-    # GPU metrics auto-enable when this operator requests a GPU. Only set the
-    # options below if GPU charts stay empty while the operator uses the GPU.
-    telemetry:
-      sidecar:
-        # -- Extra sidecar env vars. Rarely set; GPU env is auto-configured.
-        env: {}
-        # -- Sidecar resource overrides. Only needed on GKE-style clusters where
-        # GPU charts stay empty: give the sidecar a GPU (enable GPU time-sharing
-        # so it shares the operator's GPU).
-        resources: {}
-
     # -- Affinity and anti-affinity for `delegated-operator-executor`. [Reference][affinity].
     affinity: {}
     # -- nodeSelector for `delegated-operator-executor`. [Reference][node-selector].
@@ -909,15 +898,8 @@ delegatedOperatorDeployments:
     #       cpu: 8
     #       ephemeral-storage: 1Gi
     #       memory: 16Gi
-    #   # Only on GKE-style clusters where GPU charts stay empty: give the
-    #   # sidecar a GPU too (turn on GPU time-sharing first).
-    #   telemetry:
-    #     sidecar:
-    #       resources:
-    #         limits:
-    #           nvidia.com/gpu: 1
-    #         requests:
-    #           nvidia.com/gpu: 1
+    #   # GPU metrics appear automatically — the telemetry sidecar reads this
+    #   # operator's GPU without requesting its own allocation.
     #   volumes:
     #     - name: shm-vol
     #       emptyDir: