From 06a4a39c587f14bbf9fd8c24587b18297d518457 Mon Sep 17 00:00:00 2001 From: Jifei Wang Date: Wed, 12 Aug 2026 11:38:53 +0800 Subject: [PATCH 1/2] add openshift installation guide Signed-off-by: Jifei Wang --- docs/installation/openshift-installation.md | 211 ++++++++++++++++++ .../installation/openshift-installation.md | 211 ++++++++++++++++++ sidebars.js | 1 + 3 files changed, 423 insertions(+) create mode 100644 docs/installation/openshift-installation.md create mode 100644 i18n/zh/docusaurus-plugin-content-docs/current/installation/openshift-installation.md diff --git a/docs/installation/openshift-installation.md b/docs/installation/openshift-installation.md new file mode 100644 index 000000000..54aa71d0a --- /dev/null +++ b/docs/installation/openshift-installation.md @@ -0,0 +1,211 @@ +--- +title: Deploy HAMi on OpenShift +sidebar_label: HAMi on OpenShift +translated: true +--- + +This guide describes the recommended way to deploy HAMi on OpenShift, covering SCC, random UIDs, non-privileged ports, and SELinux. + +## Prerequisites + +- An OpenShift cluster with the NVIDIA GPU Operator installed +- NVIDIA drivers and Container Toolkit ready +- An NVIDIA RuntimeClass configured by the GPU Operator +- Permission to create cluster-scoped `SecurityContextConstraints` (SCC) + +Confirm the cluster setup: + +```bash +oc get runtimeclass +oc get nodes -L nvidia.com/gpu.present +oc describe node | grep -A5 Taints +``` + +The examples below use a common GPU Operator configuration: + +```text +RuntimeClass: nvidia +node label: nvidia.com/gpu.present=true +taint: nvidia.com/gpu=true:NoSchedule +driver root: /run/nvidia/driver +toolkit validation: /run/nvidia/validations +``` + +If your cluster uses different names or paths, adjust the values accordingly. + +## Recommended configuration + +Install HAMi into a dedicated project: + +```bash +oc new-project hami +``` + +Create `values-openshift.yaml`: + +```yaml +platform: + openshift: true + +openshift: + securityContextConstraints: + create: true + name: hami-device-plugin + +selinux: + enabled: true + type: container_file_t + level: s0 + +scheduler: + patch: + runAsUser: null + service: + httpPort: 443 + httpTargetPort: 9443 + +devicePlugin: + runtimeClassName: nvidia + nvidiaDriverRoot: /run/nvidia/driver + + gpuOperatorToolkitReady: + enabled: true + hostPath: /run/nvidia/validations + + nvidiaNodeSelector: + nvidia.com/gpu.present: "true" + + tolerations: + - key: nvidia.com/gpu + operator: Exists + effect: NoSchedule +``` + +Install HAMi: + +```bash +helm repo add hami-charts https://project-hami.github.io/HAMi/ +helm repo update + +helm upgrade --install hami hami-charts/hami \ + --namespace hami \ + --create-namespace \ + -f values-openshift.yaml +``` + +## Security model + +### Scheduler and admission + +The scheduler and admission components should use OpenShift `restricted-v2` or an equivalent restricted SCC. + +Recommended security context: + +```yaml +securityContext: + runAsNonRoot: true + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault +``` + +Leave `runAsUser` unset so OpenShift assigns a UID from the project UID range. + +The scheduler extender listens on non-privileged port `9443` inside the container, while the Service continues to expose `443`: + +```text +Service port 443 -> targetPort 9443 -> containerPort 9443 +``` + +The Deployment, Service, and kube-scheduler extender ConfigMap must use the same target port. + +### Device plugin + +The device plugin uses the Chart-created `hami-device-plugin` SCC. This SCC is granted only to the device-plugin ServiceAccount and allows the permissions required by the node component: + +- privileged container +- host PID +- hostPath +- `SYS_ADMIN` capability +- `RunAsAny` UID and SELinux context + +The SCC disables host IPC, host network, and host ports, and restricts allowed volume types. + +Scheduler, admission, and regular workload ServiceAccounts are not bound to this SCC. + +## SELinux + +Enable SELinux relabeling: + +```yaml +selinux: + enabled: true + type: container_file_t + level: s0 +``` + +The relabel initContainer only processes shared directories managed by HAMi that containers need to access: + +```text +/usr/local/vgpu +/usr/local/vgpu/containers +/tmp/vgpulock +``` + +These paths use `container_file_t` so restricted workload containers can access HAMi shared data under the normal SELinux container domain. + +The NVIDIA driver root is managed by the GPU Operator and mounted read-only into the device plugin and monitor: + +```text +/run/nvidia/driver +``` + +HAMi does not change the SELinux label of that path. + +## Verification + +Check the rendered manifests: + +```bash +helm template hami hami-charts/hami \ + --namespace hami \ + -f values-openshift.yaml > /tmp/hami-openshift.yaml + +grep -nE 'SecurityContextConstraints|system:openshift:scc|http_bind|targetPort|urlPrefix|runtimeClassName' \ + /tmp/hami-openshift.yaml +``` + +Check component status: + +```bash +oc rollout status deployment/hami-scheduler -n hami +oc rollout status daemonset/hami-device-plugin -n hami +``` + +Check which SCC each Pod uses: + +```bash +oc get pods -n hami \ + -o 'custom-columns=NAME:.metadata.name,SCC:.metadata.annotations.openshift\.io/scc' +``` + +Expected results: + +- scheduler and admission use a restricted SCC +- device-plugin uses the `hami-device-plugin` SCC +- scheduler extender listens on `9443` +- scheduler Service forwards `443` to `9443` +- device-plugin uses the configured NVIDIA RuntimeClass +- SELinux relabel covers only HAMi shared directories + +Check SELinux labels on the node: + +```bash +oc debug node/ -- chroot /host \ + ls -Zd /usr/local/vgpu /usr/local/vgpu/containers +``` + +HAMi shared directories should use the configured `container_file_t`. diff --git a/i18n/zh/docusaurus-plugin-content-docs/current/installation/openshift-installation.md b/i18n/zh/docusaurus-plugin-content-docs/current/installation/openshift-installation.md new file mode 100644 index 000000000..e8398913c --- /dev/null +++ b/i18n/zh/docusaurus-plugin-content-docs/current/installation/openshift-installation.md @@ -0,0 +1,211 @@ +--- +title: 在 OpenShift 上部署 HAMi +sidebar_label: OpenShift 上的 HAMi +translated: true +--- + +本文介绍 HAMi 在 OpenShift 上的推荐部署方式，重点涵盖 SCC、随机 UID、非特权端口和 SELinux。 + +## 前置条件 + +- OpenShift 集群已安装 NVIDIA GPU Operator； +- NVIDIA 驱动和 Container Toolkit 已就绪； +- 集群中存在 GPU Operator 配置的 NVIDIA RuntimeClass； +- 安装者有权创建集群级 `SecurityContextConstraints`（SCC）。 + +确认集群配置： + +```bash +oc get runtimeclass +oc get nodes -L nvidia.com/gpu.present +oc describe node | grep -A5 Taints +``` + +以下示例采用 GPU Operator 的常见配置： + +```text +RuntimeClass: nvidia +node label: nvidia.com/gpu.present=true +taint: nvidia.com/gpu=true:NoSchedule +driver root: /run/nvidia/driver +toolkit validation: /run/nvidia/validations +``` + +如果集群使用不同的名称或路径，请同步调整 values。 + +## 推荐配置 + +建议将 HAMi 安装到独立项目： + +```bash +oc new-project hami +``` + +创建 `values-openshift.yaml`： + +```yaml +platform: + openshift: true + +openshift: + securityContextConstraints: + create: true + name: hami-device-plugin + +selinux: + enabled: true + type: container_file_t + level: s0 + +scheduler: + patch: + runAsUser: null + service: + httpPort: 443 + httpTargetPort: 9443 + +devicePlugin: + runtimeClassName: nvidia + nvidiaDriverRoot: /run/nvidia/driver + + gpuOperatorToolkitReady: + enabled: true + hostPath: /run/nvidia/validations + + nvidiaNodeSelector: + nvidia.com/gpu.present: "true" + + tolerations: + - key: nvidia.com/gpu + operator: Exists + effect: NoSchedule +``` + +安装 HAMi： + +```bash +helm repo add hami-charts https://project-hami.github.io/HAMi/ +helm repo update + +helm upgrade --install hami hami-charts/hami \ + --namespace hami \ + --create-namespace \ + -f values-openshift.yaml +``` + +## 安全模型 + +### Scheduler 和 admission + +scheduler 和 admission 组件应使用 OpenShift 的 `restricted-v2` 或集群等价的 restricted SCC。 + +推荐安全上下文： + +```yaml +securityContext: + runAsNonRoot: true + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault +``` + +`runAsUser` 保持为空，由 OpenShift 从项目 UID range 自动分配 UID。 + +scheduler extender 在容器内监听非特权端口 `9443`，Service 对外继续提供 `443`： + +```text +Service port 443 -> targetPort 9443 -> containerPort 9443 +``` + +Deployment、Service 和 kube-scheduler extender ConfigMap 使用相同的 target port。 + +### Device plugin + +device-plugin 使用 Chart 创建的 `hami-device-plugin` SCC。该 SCC 只授予 device-plugin ServiceAccount，并允许当前节点组件需要的权限： + +- privileged container； +- host PID； +- hostPath； +- `SYS_ADMIN` capability； +- `RunAsAny` UID 和 SELinux context。 + +SCC 禁用 host IPC、host network 和 host ports，并限制允许的 volume 类型。 + +scheduler、admission 和普通业务 ServiceAccount 不绑定该 SCC。 + +## SELinux + +启用 SELinux relabel： + +```yaml +selinux: + enabled: true + type: container_file_t + level: s0 +``` + +relabel initContainer 只处理 HAMi 管理且需要容器访问的共享目录，包括： + +```text +/usr/local/vgpu +/usr/local/vgpu/containers +/tmp/vgpulock +``` + +这些路径使用 `container_file_t`，使受限业务容器能够在正常 SELinux container domain 下访问 HAMi 共享数据。 + +NVIDIA driver root 由 GPU Operator 管理，并以只读方式挂载给 device-plugin 和 monitor： + +```text +/run/nvidia/driver +``` + +HAMi 不修改该路径的 SELinux label。 + +## 验证 + +检查渲染结果： + +```bash +helm template hami hami-charts/hami \ + --namespace hami \ + -f values-openshift.yaml > /tmp/hami-openshift.yaml + +grep -nE 'SecurityContextConstraints|system:openshift:scc|http_bind|targetPort|urlPrefix|runtimeClassName' \ + /tmp/hami-openshift.yaml +``` + +检查组件状态： + +```bash +oc rollout status deployment/hami-scheduler -n hami +oc rollout status daemonset/hami-device-plugin -n hami +``` + +检查 Pod 使用的 SCC： + +```bash +oc get pods -n hami \ + -o 'custom-columns=NAME:.metadata.name,SCC:.metadata.annotations.openshift\.io/scc' +``` + +预期结果： + +- scheduler 和 admission 使用 restricted SCC； +- device-plugin 使用 `hami-device-plugin` SCC； +- scheduler extender 监听 `9443`； +- scheduler Service 将 `443` 转发到 `9443`； +- device-plugin 使用配置的 NVIDIA RuntimeClass； +- SELinux relabel 仅处理 HAMi 共享目录。 + +检查节点上的 SELinux label： + +```bash +oc debug node/ -- chroot /host \ + ls -Zd /usr/local/vgpu /usr/local/vgpu/containers +``` + +HAMi 共享目录应使用配置的 `container_file_t`。 diff --git a/sidebars.js b/sidebars.js index 3487c0e9f..dbf482ef7 100644 --- a/sidebars.js +++ b/sidebars.js @@ -56,6 +56,7 @@ module.exports = { "installation/uninstall", "installation/webui-installation", "installation/aws-installation", + "installation/openshift-installation", "installation/how-to-use-hami-dra", "installation/how-to-use-volcano-vgpu", "installation/how-to-use-volcano-ascend", From c3ca35598800229c217783c5f5036cf0525b7c62 Mon Sep 17 00:00:00 2001 From: Jifei Wang Date: Wed, 12 Aug 2026 14:23:18 +0800 Subject: [PATCH 2/2] update Signed-off-by: Jifei Wang --- docs/installation/openshift-installation.md | 70 ++++++++-------- .../installation/openshift-installation.md | 84 +++++++++---------- 2 files changed, 77 insertions(+), 77 deletions(-) diff --git a/docs/installation/openshift-installation.md b/docs/installation/openshift-installation.md index 54aa71d0a..9e2a6c384 100644 --- a/docs/installation/openshift-installation.md +++ b/docs/installation/openshift-installation.md @@ -4,16 +4,16 @@ sidebar_label: HAMi on OpenShift translated: true --- -This guide describes the recommended way to deploy HAMi on OpenShift, covering SCC, random UIDs, non-privileged ports, and SELinux. +This guide covers deploying HAMi on OpenShift, including SCC, random UIDs, non-privileged ports, and SELinux. ## Prerequisites -- An OpenShift cluster with the NVIDIA GPU Operator installed +- OpenShift cluster with the NVIDIA GPU Operator installed - NVIDIA drivers and Container Toolkit ready -- An NVIDIA RuntimeClass configured by the GPU Operator +- NVIDIA RuntimeClass configured by the GPU Operator - Permission to create cluster-scoped `SecurityContextConstraints` (SCC) -Confirm the cluster setup: +Verify the cluster: ```bash oc get runtimeclass @@ -21,7 +21,7 @@ oc get nodes -L nvidia.com/gpu.present oc describe node | grep -A5 Taints ``` -The examples below use a common GPU Operator configuration: +Example values in this guide assume the following GPU Operator layout. Adjust names and paths to match your cluster: ```text RuntimeClass: nvidia @@ -31,11 +31,9 @@ driver root: /run/nvidia/driver toolkit validation: /run/nvidia/validations ``` -If your cluster uses different names or paths, adjust the values accordingly. - ## Recommended configuration -Install HAMi into a dedicated project: +Create a dedicated project for HAMi: ```bash oc new-project hami @@ -58,8 +56,6 @@ selinux: level: s0 scheduler: - patch: - runAsUser: null service: httpPort: 443 httpTargetPort: 9443 @@ -74,11 +70,15 @@ devicePlugin: nvidiaNodeSelector: nvidia.com/gpu.present: "true" +``` + +To use the built-in OpenShift `privileged` SCC instead of creating a custom SCC: - tolerations: - - key: nvidia.com/gpu - operator: Exists - effect: NoSchedule +```yaml +openshift: + securityContextConstraints: + create: false + name: privileged ``` Install HAMi: @@ -97,9 +97,9 @@ helm upgrade --install hami hami-charts/hami \ ### Scheduler and admission -The scheduler and admission components should use OpenShift `restricted-v2` or an equivalent restricted SCC. +Scheduler and admission run under OpenShift `restricted-v2` or an equivalent restricted SCC. -Recommended security context: +Security context applied when OpenShift is enabled: ```yaml securityContext: @@ -112,29 +112,29 @@ securityContext: type: RuntimeDefault ``` -Leave `runAsUser` unset so OpenShift assigns a UID from the project UID range. +OpenShift assigns the container UID from the project UID range. On non-OpenShift clusters, the chart default remains `scheduler.patch.runAsUser: 2000`. -The scheduler extender listens on non-privileged port `9443` inside the container, while the Service continues to expose `443`: +Port mapping: ```text Service port 443 -> targetPort 9443 -> containerPort 9443 ``` -The Deployment, Service, and kube-scheduler extender ConfigMap must use the same target port. +The Deployment, Service, and kube-scheduler extender ConfigMap use the same target port. ### Device plugin -The device plugin uses the Chart-created `hami-device-plugin` SCC. This SCC is granted only to the device-plugin ServiceAccount and allows the permissions required by the node component: +The chart creates the `hami-device-plugin` SCC and grants it to the device-plugin ServiceAccount. The SCC allows: - privileged container - host PID - hostPath - `SYS_ADMIN` capability -- `RunAsAny` UID and SELinux context +- `RunAsAny` for UID and SELinux context -The SCC disables host IPC, host network, and host ports, and restricts allowed volume types. +Allowed volume types: `configMap`, `downwardAPI`, `emptyDir`, `hostPath`, `projected`, `secret`. Host IPC, host network, and host ports remain off. -Scheduler, admission, and regular workload ServiceAccounts are not bound to this SCC. +Scheduler, admission, and workload ServiceAccounts continue to use the platform restricted SCC. ## SELinux @@ -147,7 +147,7 @@ selinux: level: s0 ``` -The relabel initContainer only processes shared directories managed by HAMi that containers need to access: +The relabel initContainer applies `container_file_t` to HAMi shared directories: ```text /usr/local/vgpu @@ -155,7 +155,7 @@ The relabel initContainer only processes shared directories managed by HAMi that /tmp/vgpulock ``` -These paths use `container_file_t` so restricted workload containers can access HAMi shared data under the normal SELinux container domain. +Restricted workload containers can then access these paths under the standard SELinux container domain. The NVIDIA driver root is managed by the GPU Operator and mounted read-only into the device plugin and monitor: @@ -163,11 +163,11 @@ The NVIDIA driver root is managed by the GPU Operator and mounted read-only into /run/nvidia/driver ``` -HAMi does not change the SELinux label of that path. +SELinux labels on the driver root remain under GPU Operator ownership. After uninstall, restore host SELinux labels and directory permissions manually if the node requires it. ## Verification -Check the rendered manifests: +Render manifests: ```bash helm template hami hami-charts/hami \ @@ -178,14 +178,14 @@ grep -nE 'SecurityContextConstraints|system:openshift:scc|http_bind|targetPort|u /tmp/hami-openshift.yaml ``` -Check component status: +Check rollout status: ```bash oc rollout status deployment/hami-scheduler -n hami oc rollout status daemonset/hami-device-plugin -n hami ``` -Check which SCC each Pod uses: +Check assigned SCC: ```bash oc get pods -n hami \ @@ -194,18 +194,18 @@ oc get pods -n hami \ Expected results: -- scheduler and admission use a restricted SCC -- device-plugin uses the `hami-device-plugin` SCC +- scheduler and admission: restricted SCC +- device-plugin: `hami-device-plugin` SCC - scheduler extender listens on `9443` -- scheduler Service forwards `443` to `9443` +- scheduler Service maps `443` to `9443` - device-plugin uses the configured NVIDIA RuntimeClass -- SELinux relabel covers only HAMi shared directories +- SELinux relabel scope: HAMi shared directories Check SELinux labels on the node: ```bash oc debug node/ -- chroot /host \ - ls -Zd /usr/local/vgpu /usr/local/vgpu/containers + ls -Zd /usr/local/vgpu /usr/local/vgpu/containers /tmp/vgpulock ``` -HAMi shared directories should use the configured `container_file_t`. +HAMi shared directories should show the configured `container_file_t`. diff --git a/i18n/zh/docusaurus-plugin-content-docs/current/installation/openshift-installation.md b/i18n/zh/docusaurus-plugin-content-docs/current/installation/openshift-installation.md index e8398913c..68c0b6434 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/current/installation/openshift-installation.md +++ b/i18n/zh/docusaurus-plugin-content-docs/current/installation/openshift-installation.md @@ -4,14 +4,14 @@ sidebar_label: OpenShift 上的 HAMi translated: true --- -本文介绍 HAMi 在 OpenShift 上的推荐部署方式，重点涵盖 SCC、随机 UID、非特权端口和 SELinux。 +本文说明如何在 OpenShift 上部署 HAMi，涵盖 SCC、随机 UID、非特权端口和 SELinux。 ## 前置条件 -- OpenShift 集群已安装 NVIDIA GPU Operator； -- NVIDIA 驱动和 Container Toolkit 已就绪； -- 集群中存在 GPU Operator 配置的 NVIDIA RuntimeClass； -- 安装者有权创建集群级 `SecurityContextConstraints`（SCC）。 +- OpenShift 集群已安装 NVIDIA GPU Operator +- NVIDIA 驱动和 Container Toolkit 已就绪 +- 集群中已有 GPU Operator 配置的 NVIDIA RuntimeClass +- 具备创建集群级 `SecurityContextConstraints`（SCC）的权限 确认集群配置： @@ -21,7 +21,7 @@ oc get nodes -L nvidia.com/gpu.present oc describe node | grep -A5 Taints ``` -以下示例采用 GPU Operator 的常见配置： +下文示例基于常见的 GPU Operator 配置。若名称或路径不同，请按集群实际情况调整： ```text RuntimeClass: nvidia @@ -31,11 +31,9 @@ driver root: /run/nvidia/driver toolkit validation: /run/nvidia/validations ``` -如果集群使用不同的名称或路径，请同步调整 values。 - ## 推荐配置 -建议将 HAMi 安装到独立项目： +为 HAMi 创建独立项目： ```bash oc new-project hami @@ -58,8 +56,6 @@ selinux: level: s0 scheduler: - patch: - runAsUser: null service: httpPort: 443 httpTargetPort: 9443 @@ -74,11 +70,15 @@ devicePlugin: nvidiaNodeSelector: nvidia.com/gpu.present: "true" +``` + +若使用 OpenShift 内置 `privileged` SCC： - tolerations: - - key: nvidia.com/gpu - operator: Exists - effect: NoSchedule +```yaml +openshift: + securityContextConstraints: + create: false + name: privileged ``` 安装 HAMi： @@ -97,9 +97,9 @@ helm upgrade --install hami hami-charts/hami \ ### Scheduler 和 admission -scheduler 和 admission 组件应使用 OpenShift 的 `restricted-v2` 或集群等价的 restricted SCC。 +scheduler 与 admission 使用 OpenShift `restricted-v2` 或等价的 restricted SCC。 -推荐安全上下文： +启用 OpenShift 时应用的安全上下文： ```yaml securityContext: @@ -112,29 +112,29 @@ securityContext: type: RuntimeDefault ``` -`runAsUser` 保持为空，由 OpenShift 从项目 UID range 自动分配 UID。 +容器 UID 由 OpenShift 从项目 UID range 分配。非 OpenShift 集群仍使用 Chart 默认值 `scheduler.patch.runAsUser: 2000`。 -scheduler extender 在容器内监听非特权端口 `9443`，Service 对外继续提供 `443`： +端口映射： ```text Service port 443 -> targetPort 9443 -> containerPort 9443 ``` -Deployment、Service 和 kube-scheduler extender ConfigMap 使用相同的 target port。 +Deployment、Service 与 kube-scheduler extender ConfigMap 使用相同的 target port。 ### Device plugin -device-plugin 使用 Chart 创建的 `hami-device-plugin` SCC。该 SCC 只授予 device-plugin ServiceAccount，并允许当前节点组件需要的权限： +Chart 创建 `hami-device-plugin` SCC，并授予 device-plugin ServiceAccount。该 SCC 允许： -- privileged container； -- host PID； -- hostPath； -- `SYS_ADMIN` capability； -- `RunAsAny` UID 和 SELinux context。 +- privileged container +- host PID +- hostPath +- `SYS_ADMIN` capability +- UID 与 SELinux context 使用 `RunAsAny` -SCC 禁用 host IPC、host network 和 host ports，并限制允许的 volume 类型。 +允许的 volume 类型：`configMap`、`downwardAPI`、`emptyDir`、`hostPath`、`projected`、`secret`。host IPC、host network、host ports 保持关闭。 -scheduler、admission 和普通业务 ServiceAccount 不绑定该 SCC。 +scheduler、admission 与业务工作负载继续使用平台 restricted SCC。 ## SELinux @@ -147,7 +147,7 @@ selinux: level: s0 ``` -relabel initContainer 只处理 HAMi 管理且需要容器访问的共享目录，包括： +relabel initContainer 为 HAMi 共享目录设置 `container_file_t`： ```text /usr/local/vgpu @@ -155,19 +155,19 @@ relabel initContainer 只处理 HAMi 管理且需要容器访问的共享目录 /tmp/vgpulock ``` -这些路径使用 `container_file_t`，使受限业务容器能够在正常 SELinux container domain 下访问 HAMi 共享数据。 +受限业务容器即可在标准 SELinux container domain 下访问这些路径。 -NVIDIA driver root 由 GPU Operator 管理，并以只读方式挂载给 device-plugin 和 monitor： +NVIDIA driver root 由 GPU Operator 管理，并以只读方式挂载到 device-plugin 和 monitor： ```text /run/nvidia/driver ``` -HAMi 不修改该路径的 SELinux label。 +driver root 的 SELinux label 由 GPU Operator 维护。卸载后如需恢复宿主机 SELinux label 与目录权限，请手动处理。 ## 验证 -检查渲染结果： +渲染清单： ```bash helm template hami hami-charts/hami \ @@ -194,18 +194,18 @@ oc get pods -n hami \ 预期结果： -- scheduler 和 admission 使用 restricted SCC； -- device-plugin 使用 `hami-device-plugin` SCC； -- scheduler extender 监听 `9443`； -- scheduler Service 将 `443` 转发到 `9443`； -- device-plugin 使用配置的 NVIDIA RuntimeClass； -- SELinux relabel 仅处理 HAMi 共享目录。 +- scheduler 与 admission：restricted SCC +- device-plugin：`hami-device-plugin` SCC +- scheduler extender 监听 `9443` +- scheduler Service 将 `443` 映射到 `9443` +- device-plugin 使用配置的 NVIDIA RuntimeClass +- SELinux relabel 范围：HAMi 共享目录 -检查节点上的 SELinux label： +检查节点 SELinux label： ```bash oc debug node/ -- chroot /host \ - ls -Zd /usr/local/vgpu /usr/local/vgpu/containers + ls -Zd /usr/local/vgpu /usr/local/vgpu/containers /tmp/vgpulock ``` -HAMi 共享目录应使用配置的 `container_file_t`。 +HAMi 共享目录应显示配置的 `container_file_t`。