# Vendored copy of the NVIDIA k8s-device-plugin static DaemonSet, pinned at v0.16.2:
#   https://raw.githubusercontent.com/NVIDIA/k8s-device-plugin/v0.16.2/deployments/static/nvidia-device-plugin.yml
#
# Vendored (instead of `kubectl apply -f <upstream-url>`, which is what
# phase-2-capstone/gpu-node/diy-cluster.md used to do) so the exact manifest applied to
# this cluster is reviewable, diffable, and pinned in git rather than resolved from a
# moving upstream tag at apply time. See ../README.md for the full prereqs rationale.
#
# One change from upstream: `runtimeClassName: nvidia` is baked in below. diy-cluster.md
# used to apply this file unmodified and then `kubectl patch` the RuntimeClass on afterward
# (k3s auto-detects the NVIDIA Container Toolkit and creates the `nvidia` RuntimeClass
# itself — see diy-cluster.md — so the plugin just needs to ask for it). Vendoring
# collapses that to one `kubectl apply -f`.
#
# Original licensed under Apache-2.0, Copyright (c) 2019, NVIDIA CORPORATION.
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: nvidia-device-plugin-daemonset
  namespace: kube-system
spec:
  selector:
    matchLabels:
      name: nvidia-device-plugin-ds
  updateStrategy:
    type: RollingUpdate
  template:
    metadata:
      labels:
        name: nvidia-device-plugin-ds
    spec:
      runtimeClassName: nvidia
      tolerations:
        - key: nvidia.com/gpu
          operator: Exists
          effect: NoSchedule
      # Mark this pod as a critical add-on; when enabled, the critical add-on
      # scheduler reserves resources for critical add-on pods so that they can
      # be rescheduled after a failure.
      # See https://kubernetes.io/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/
      priorityClassName: "system-node-critical"
      containers:
        - image: nvcr.io/nvidia/k8s-device-plugin:v0.16.2
          name: nvidia-device-plugin-ctr
          env:
            - name: FAIL_ON_INIT_ERROR
              value: "false"
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: ["ALL"]
          volumeMounts:
            - name: device-plugin
              mountPath: /var/lib/kubelet/device-plugins
      volumes:
        - name: device-plugin
          hostPath:
            path: /var/lib/kubelet/device-plugins