Add writable-cgroups experimental plugin #269
Conversation
|
I'm still unsure on the name, because all the other NRI plugins have "verb-focused" names. Maybe |
Adds a new `writable-cgroups` plugin, designed to enable safe delegation of cgroup management to containers. This plugin allows containers to mount `/sys/fs/cgroup` as read-write, enabling workloads (like AI/ML frameworks) to manage their own sub-cgroups. This plugin serves as a reference implementation and test-bed for validating the `nsdelegate` security model proposed in KEP-5474 as an alternative to introducing new Kubernetes API fields. Signed-off-by: Chris Henzie <chrishenzie@gmail.com>
chrishenzie
force-pushed
the
writable-cgroups-experiment
branch
from
c8215f8 to
78fbc4d
Compare
|
|
||
| const ( | ||
| // WritableCgroupsAnnotation is the annotation key that enables writable cgroups. | ||
| WritableCgroupsAnnotation = "cgroups.noderesource.dev/writable" |
There was a problem hiding this comment.
nit: Anything against using writable-cgroups.noderesource.dev as the annotation key ?
|
|
@chrishenzie I only skimmed through it quickly yet, but it LGTM. Should we also add a |
2 participants
Adds a new
writable-cgroupsplugin, designed to enable safe delegation of cgroup management to containers. This plugin allows containers to mount/sys/fs/cgroupas read-write, enabling workloads (like AI/ML frameworks) to manage their own sub-cgroups.This plugin serves as a reference implementation and test-bed for validating the
nsdelegatesecurity model proposed in KEP-5474 as an alternative to introducing new Kubernetes API fields.@Divya063 @samuelkarp