feat: unify GPU permissions across deployments

README.md

@@ -88,14 +88,15 @@ A successful install looks like this:
 
 ```text
 This operation needs root privileges. Requesting sudo password...
-  ✓ [1/8] Detecting GPU  (0.2s)
-  ✓ [2/8] Generating values overlay (initial)  (0.0s)
-  ✓ [3/8] Installing helm + k9s  (0.0s)
-  ✓ [4/8] Installing K3s (single-node)  (3.8s)
-  ✓ [5/8] Pulling custom + external images  (25.0s)
-  ✓ [6/8] Deploying ROCm GPU device plugin + node labeller  (0.2s)
-  ✓ [7/8] Refreshing values overlay from node labels  (0.2s)
-  ✓ [8/8] Deploying JupyterHub runtime (helm install + wait)  (9.2s)
+  ✓ [1/9] Detecting GPU  (0.2s)
+  ✓ [2/9] Provisioning GPU device access  (0.1s)
+  ✓ [3/9] Generating values overlay (initial)  (0.0s)
+  ✓ [4/9] Installing helm + k9s  (0.0s)
+  ✓ [5/9] Installing K3s (single-node)  (3.8s)
+  ✓ [6/9] Pulling custom + external images  (25.0s)
+  ✓ [7/9] Deploying ROCm GPU device plugin + node labeller  (0.2s)
+  ✓ [8/9] Refreshing values overlay from node labels  (0.2s)
+  ✓ [9/9] Deploying JupyterHub runtime (helm install + wait)  (9.2s)
 
    _    _   _ ____    _                          _                  ____ _                 _
   / \  | | | |  _ \  | |    ___  __ _ _ __ _ __ (_)_ __   __ _     / ___| | ___  _   _  __| |
@@ -111,6 +112,13 @@ This operation needs root privileges. Requesting sudo password...
     kubectl is configured at $HOME/.kube/config; try `kubectl get nodes`
 ```
 
+The GPU access stage installs AMD's `amdgpu-insecure-instinct-udev-rules`
+package, pinned to `30.30.4.0-2341068.24.04`. It sets mode `0666` only on
+`/dev/kfd` and DRM `renderD*` nodes; `card*` keeps the normal system policy. The
+device plugin remains a separate allocation layer, and the tested ROCm compute
+path needs no supplemental GPU group. The offline `pack` bundle carries the
+pinned deb for installation without network access.
+
 See the full guide at [Quick Start](https://amdresearch.github.io/aup-learning-cloud/installation/quick-start.html) and [Single-Node Deployment](https://amdresearch.github.io/aup-learning-cloud/installation/single-node.html).
 
 ### Uninstall

auplc_installer/cli.py

@@ -15,13 +15,16 @@
 import time
 from collections.abc import Sequence
 from pathlib import Path
+from typing import NoReturn
 
 from auplc_installer import __version__
 from auplc_installer.catalog import parse_selection_spec
 from auplc_installer.gpu import (
     detect_and_configure_gpu,
     refine_gpu_config_from_node_labels,
 )
+from auplc_installer.gpu_access import provision_gpu_access
+from auplc_installer.gpu_hardware import GpuHardware, classify_gpu_hardware
 from auplc_installer.helm import (
     deploy_runtime,
     dev_quick_rollout,
@@ -319,6 +322,22 @@ def cmd_install(state: InstallerState, *, pull: bool) -> None:
         keepalive.stop()
 
 
+def _raise_unreachable_gpu_hardware(hardware: GpuHardware) -> NoReturn:
+    raise AssertionError(f"Unhandled GPU hardware classification: {hardware!r}")
+
+
+def _provision_gpu_access_for_local_hardware(*, offline_mode: bool, bundle_dir: Path | None) -> None:
+    match classify_gpu_hardware():
+        case GpuHardware.GPU:
+            provision_gpu_access(offline_mode=offline_mode, bundle_dir=bundle_dir)
+        case GpuHardware.CPU:
+            return
+        case GpuHardware.UNKNOWN:
+            raise InstallerError("Could not determine local AMD GPU hardware; refusing to modify installer state")
+        case unreachable:
+            _raise_unreachable_gpu_hardware(unreachable)
+
+
 def _cmd_install_inner(state: InstallerState, *, pull: bool) -> None:
     """Body of ``cmd_install`` after sudo session has been primed."""
     # Pre-compute the image-stage label so the user knows up-front which path
@@ -330,13 +349,16 @@ def _cmd_install_inner(state: InstallerState, *, pull: bool) -> None:
     else:
         image_stage_label = "Pulling external images & building custom images"
 
-    total = 8
+    total = 9
 
     with stage("Detecting GPU", idx=1, total=total):
         detect_and_configure_gpu(state.gpu, gpu_type_override=state.gpu_type)
+
+    with stage("Provisioning GPU device access", idx=2, total=total):
+        _provision_gpu_access_for_local_hardware(offline_mode=state.offline_mode, bundle_dir=state.bundle_dir)
     paths = state.runtime_paths()
 
-    with stage("Generating values overlay (initial)", idx=2, total=total):
+    with stage("Generating values overlay (initial)", idx=3, total=total):
         # First pass: use local detection so image pulls / builds get the
         # right GPU_TARGET. Overlay is regenerated again below from
         # labeller-published labels.
@@ -349,18 +371,18 @@ def _cmd_install_inner(state: InstallerState, *, pull: bool) -> None:
             overlay_path=paths.overlay_path,
         )
 
-    with stage("Installing helm + k9s", idx=3, total=total):
+    with stage("Installing helm + k9s", idx=4, total=total):
         install_tools(offline_mode=state.offline_mode, bundle_dir=state.bundle_dir)
 
-    with stage("Installing K3s (single-node)", idx=4, total=total):
+    with stage("Installing K3s (single-node)", idx=5, total=total):
         install_k3s_single_node(
             offline_mode=state.offline_mode,
             bundle_dir=state.bundle_dir,
             use_docker=state.use_docker,
             mirror_prefix=state.mirror_prefix,
         )
 
-    with stage(image_stage_label, idx=5, total=total):
+    with stage(image_stage_label, idx=6, total=total):
         if state.offline_mode and state.bundle_dir is not None:
             load_offline_images(state.bundle_dir)
         elif pull:
@@ -397,13 +419,13 @@ def _cmd_install_inner(state: InstallerState, *, pull: bool) -> None:
                 k3s_images_dir=state.k3s_images_dir,
             )
 
-    with stage("Deploying ROCm GPU device plugin + node labeller", idx=6, total=total):
+    with stage("Deploying ROCm GPU device plugin + node labeller", idx=7, total=total):
         deploy_rocm_gpu_device_plugin(
             offline_mode=state.offline_mode,
             bundle_dir=state.bundle_dir,
         )
 
-    with stage("Refreshing values overlay from node labels", idx=7, total=total):
+    with stage("Refreshing values overlay from node labels", idx=8, total=total):
         refine_gpu_config_from_node_labels(state.gpu)
         generate_values_overlay(
             state.gpu,
@@ -414,7 +436,7 @@ def _cmd_install_inner(state: InstallerState, *, pull: bool) -> None:
             overlay_path=paths.overlay_path,
         )
 
-    with stage("Deploying JupyterHub runtime (helm install + wait)", idx=8, total=total):
+    with stage("Deploying JupyterHub runtime (helm install + wait)", idx=9, total=total):
         deploy_runtime(paths)
 
     _print_success_banner()
@@ -582,6 +604,7 @@ def cmd_dev_quick(state: InstallerState) -> None:
 
 
 def cmd_dev_deploy(state: InstallerState) -> None:
+    _provision_gpu_access_for_local_hardware(offline_mode=state.offline_mode, bundle_dir=state.bundle_dir)
     detect_and_configure_gpu(state.gpu, gpu_type_override=state.gpu_type)
     paths = state.runtime_paths()
     refine_gpu_config_from_node_labels(state.gpu)
@@ -597,6 +620,7 @@ def cmd_dev_deploy(state: InstallerState) -> None:
 
 
 def cmd_dev_upgrade(state: InstallerState) -> None:
+    _provision_gpu_access_for_local_hardware(offline_mode=state.offline_mode, bundle_dir=state.bundle_dir)
     detect_and_configure_gpu(state.gpu, gpu_type_override=state.gpu_type)
     paths = state.runtime_paths()
     refine_gpu_config_from_node_labels(state.gpu)
@@ -613,6 +637,7 @@ def cmd_dev_upgrade(state: InstallerState) -> None:
 
 
 def cmd_dev_reinstall(state: InstallerState) -> None:
+    _provision_gpu_access_for_local_hardware(offline_mode=state.offline_mode, bundle_dir=state.bundle_dir)
     with contextlib.suppress(InstallerError):
         remove_runtime()
     time.sleep(0.5)
@@ -623,6 +648,7 @@ def cmd_dev_reinstall(state: InstallerState) -> None:
 
 
 def cmd_rt_install(state: InstallerState) -> None:
+    _provision_gpu_access_for_local_hardware(offline_mode=state.offline_mode, bundle_dir=state.bundle_dir)
     detect_and_configure_gpu(state.gpu, gpu_type_override=state.gpu_type)
     paths = state.runtime_paths()
     refine_gpu_config_from_node_labels(state.gpu)
@@ -638,6 +664,7 @@ def cmd_rt_install(state: InstallerState) -> None:
 
 
 def cmd_rt_upgrade(state: InstallerState) -> None:
+    _provision_gpu_access_for_local_hardware(offline_mode=state.offline_mode, bundle_dir=state.bundle_dir)
     detect_and_configure_gpu(state.gpu, gpu_type_override=state.gpu_type)
     paths = state.runtime_paths()
     refine_gpu_config_from_node_labels(state.gpu)
@@ -678,6 +705,7 @@ def cmd_rt_remove(state: InstallerState) -> None:
 
 
 def cmd_rt_reinstall(state: InstallerState) -> None:
+    _provision_gpu_access_for_local_hardware(offline_mode=state.offline_mode, bundle_dir=state.bundle_dir)
     with contextlib.suppress(InstallerError):
         remove_runtime()
     time.sleep(0.5)