DRA Admin Access integration

[ritazh]

Leverage the DRA Admin Access feature in Kubernetes to reduce elevated privilege required today.

[guptaNswati]

Hello. Can you share more about your use case, what are you trying to solve with this feature? Would be best if you can share any example of how you would use this in your workflow.

[ritazh]

More context provided by @klueska:

Yes — this is the exact use case that this feature is designed for. At the moment it leverages a bit of a hack in our NViDIA container stack to get access to the GPUs (and all the driver libraries) without allocating them via the device plugin.

Even if the containers are running privileged they still rely on our hack to get access to all the driver libs, etc.

With DRA and this new feature, users don’t need to be running with the nvidia-runtime anymore and they don’t need to exploit the hack necessary to get access to the driver libs using it. With the DRA approach, no hacks are necessary as the driver libs are pulled directly in using CDI.

https://kubernetes.slack.com/archives/C0409NGC1TK/p1743679428377339?thread_ts=1743669817.687889&cid=C0409NGC1TK

[klueska]

@guptaNswati this will give us a DRA-native way of supporting "management containers" like DCGM that want access to all GPUs, but want to leave them as allocatable to other pods.

[guptaNswati]

Ack.