asymingt
diff --git a/‎.github/workflows/image.yaml‎
Lines changed: 7 additions & 1 deletion b/‎.github/workflows/image.yaml‎
Lines changed: 7 additions & 1 deletion
diff --git a/‎.nvidia-ci.yml‎
Lines changed: 3 additions & 43 deletions b/‎.nvidia-ci.yml‎
Lines changed: 3 additions & 43 deletions
diff --git a/‎Makefile‎
Lines changed: 8 additions & 1 deletion b/‎Makefile‎
Lines changed: 8 additions & 1 deletion
diff --git a/‎README.md‎
Lines changed: 1 addition & 18 deletions b/‎README.md‎
Lines changed: 1 addition & 18 deletions
diff --git a/‎api/nvidia.com/resource/v1beta1/api.go‎
Lines changed: 2 additions & 0 deletions b/‎api/nvidia.com/resource/v1beta1/api.go‎
Lines changed: 2 additions & 0 deletions
diff --git a/‎api/nvidia.com/resource/v1beta1/vfiodeviceconfig.go‎
Lines changed: 53 additions & 0 deletions b/‎api/nvidia.com/resource/v1beta1/vfiodeviceconfig.go‎
Lines changed: 53 additions & 0 deletions
diff --git a/‎api/nvidia.com/resource/v1beta1/zz_generated.deepcopy.go‎
Lines changed: 24 additions & 0 deletions b/‎api/nvidia.com/resource/v1beta1/zz_generated.deepcopy.go‎
Lines changed: 24 additions & 0 deletions
diff --git a/‎cmd/compute-domain-kubelet-plugin/root.go‎
Lines changed: 1 addition & 0 deletions b/‎cmd/compute-domain-kubelet-plugin/root.go‎
Lines changed: 1 addition & 0 deletions
@@ -31,7 +31,7 @@ jobs:
     steps:
       - uses: actions/checkout@v5
         name: Check out code
-      
+
       - name: Install Go
         uses: actions/setup-go@v6
         with:
@@ -61,3 +61,9 @@ jobs:
         run: |
           echo "${VERSION}"
           make -f deployments/container/Makefile build
+          # Push the image again, using a shorter tag (only the 8 character
+          # commit hash). That's for consumption in downstream CI (for copying
+          # the image from GHCR to elsewhere). See
+          # https://github.com/NVIDIA/k8s-dra-driver-gpu/issues/688
+          export IMAGE_TAG="$(echo $GITHUB_SHA | cut -c1-8)"
+          make -f deployments/container/Makefile build
@@ -38,13 +38,11 @@ variables:
   # Define the public staging registry
   STAGING_REGISTRY: ghcr.io/nvidia
   STAGING_VERSION: ${CI_COMMIT_SHORT_SHA}
-  ARTIFACTORY_REPO_BASE: "https://urm.nvidia.com/artifactory/sw-gpu-cloudnative"
   KITMAKER_RELEASE_FOLDER: "kitmaker"
   PACKAGE_ARCHIVE_RELEASE_FOLDER: "releases"
 
 stages:
   - pull
-  - scan
   - release
   - ngc-publish
 
@@ -69,7 +67,7 @@ workflow:
 # Download the regctl binary for use in the release steps
 .regctl-setup:
   before_script:
-    - export REGCTL_VERSION=v0.4.5
+    - export REGCTL_VERSION=v0.4.8
     - apk add --no-cache curl
     - mkdir -p bin
     - curl -sSLo bin/regctl https://github.com/regclient/regclient/releases/download/${REGCTL_VERSION}/regctl-linux-amd64
@@ -146,48 +144,11 @@ pull-images:
   script:
     - echo "Skipped in internal CI"
 
-# The .scan step forms the base of the image scan operation performed before releasing
-# images.
-scan-images:
-  stage: scan
-  needs:
-  - pull-images
-  image: "${PULSE_IMAGE}"
-  parallel:
-    matrix:
-        PLATFORM: ["linux/amd64", "linux/arm64"]
-  variables:
-    IMAGE: "${CI_REGISTRY_IMAGE}/k8s-dra-driver-gpu:${CI_COMMIT_SHORT_SHA}"
-    IMAGE_ARCHIVE: "k8s-dra-driver-gpu-${CI_JOB_ID}.tar"
-  allow_failure: true
-  script:
-    - |
-      docker login -u "${CI_REGISTRY_USER}" -p "${CI_REGISTRY_PASSWORD}" "${CI_REGISTRY}"
-      echo "Scanning image ${IMAGE} for ${PLATFORM}"
-      docker pull --platform="${PLATFORM}" "${IMAGE}"
-      docker save "${IMAGE}" -o "${IMAGE_ARCHIVE}"
-      AuthHeader=$(echo -n $SSA_CLIENT_ID:$SSA_CLIENT_SECRET | base64 -w0)
-      export SSA_TOKEN=$(curl --request POST --header "Authorization: Basic $AuthHeader" --header "Content-Type: application/x-www-form-urlencoded" ${SSA_ISSUER_URL} | jq ".access_token" |  tr -d '"')
-      if [ -z "$SSA_TOKEN" ]; then exit 1; else echo "SSA_TOKEN set!"; fi
-
-      pulse-cli -n $NSPECT_ID --ssa $SSA_TOKEN scan -i $IMAGE_ARCHIVE -p $CONTAINER_POLICY -o
-      rm -f "${IMAGE_ARCHIVE}"
-  artifacts:
-    when: always
-    expire_in: 1 week
-    paths:
-      - pulse-cli.log
-      - licenses.json
-      - sbom.json
-      - vulns.json
-      - policy_evaluation.json
 
 push-images-to-staging:
   extends:
     - .copy-images
   stage: release
-  needs:
-    - scan-images
   variables:
     IN_REGISTRY: "${CI_REGISTRY}"
     IN_REGISTRY_USER: "${CI_REGISTRY_USER}"
@@ -204,7 +165,6 @@ push-images-to-staging:
 .publish-images:
   stage: ngc-publish
   needs:
-    - scan-images
     - push-images-to-staging
   image:
     name: "${CNT_NGC_PUBLISH_IMAGE}"
@@ -254,15 +214,15 @@ push-images-to-staging:
       - "${PROJECT_NAME}.yaml"
 
 
-publish-images-to-ngc:
+create-ngc-publish-mr:
   extends:
     - .publish-images
   rules:
     - if: $CI_COMMIT_TAG
 
 # We create a dummy MR that exercises the publishing logic.
 # TODO: This MR should be closed automatically.
-publish-images-dummy:
+create-ngc-publish-mr-dummy:
   extends:
     - .publish-images
   variables:
 
@@ -221,7 +221,14 @@ PHONY: .shell
 		--user $$(id -u):$$(id -g) \
 		$(BUILDIMAGE)
 
-.PHONY: bats
+.PHONY: bats bats-cd bats-gpu
 bats:
 	make -f tests/bats/Makefile tests
 
+# Run compute domain specific tests
+bats-cd:
+	make -f tests/bats/Makefile tests-cd
+
+# Run GPU plugin specific tests
+bats-gpu:
+	make -f tests/bats/Makefile tests-gpu
@@ -42,26 +42,9 @@ For exploration and demonstration purposes, see the "demo" section below, and al
 
 ## Installation
 
-As of today, the recommended installation method is via Helm.
-Detailed instructions can (for now) be found [here](https://github.com/NVIDIA/k8s-dra-driver-gpu/discussions/249).
+Configuration and installation instructions can for now be found [in our Wiki](https://github.com/NVIDIA/k8s-dra-driver-gpu/wiki/Installation).
 In the future, this driver will be included in the [NVIDIA GPU Operator](https://github.com/NVIDIA/gpu-operator) and does not need to be installed separately anymore.
 
-### Validating Admission Webhook
-
-The validating admission webhook is disabled by default. To enable it, install cert-manager and its CRDs, then set the `webhook.enabled=true` value when the nvidia-dra-driver-gpu chart is installed.
-
-```bash
-helm install \
-  --repo https://charts.jetstack.io \
-  --version v1.16.3 \
-  --create-namespace \
-  --namespace cert-manager \
-  --wait \
-  --set crds.enabled=true \
-  cert-manager \
-  cert-manager
-```
-
 ## A (kind) demo
 
 Below, we demonstrate a basic use case: sharing a single GPU across two containers running in the same Kubernetes pod.
 
@@ -29,6 +29,7 @@ const (
 
 	GpuConfigKind                  = "GpuConfig"
 	MigDeviceConfigKind            = "MigDeviceConfig"
+	VfioDeviceConfigKind           = "VfioDeviceConfig"
 	ComputeDomainChannelConfigKind = "ComputeDomainChannelConfig"
 	ComputeDomainDaemonConfigKind  = "ComputeDomainDaemonConfig"
 	ComputeDomainKind              = "ComputeDomain"
@@ -66,6 +67,7 @@ func init() {
 	scheme.AddKnownTypes(schemeGroupVersion,
 		&GpuConfig{},
 		&MigDeviceConfig{},
+		&VfioDeviceConfig{},
 		&ComputeDomainChannelConfig{},
 		&ComputeDomainDaemonConfig{},
 		&ComputeDomain{},
 
@@ -0,0 +1,53 @@
+/*
+ * Copyright (c) 2025, NVIDIA CORPORATION.  All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package v1beta1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	"github.com/NVIDIA/k8s-dra-driver-gpu/pkg/featuregates"
+)
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// VfioDeviceConfig holds the set of parameters for configuring a VFIO device.
+type VfioDeviceConfig struct {
+	metav1.TypeMeta `json:",inline"`
+}
+
+// DefaultVfioDeviceConfig provides the default configuration of a VFIO device.
+func DefaultVfioDeviceConfig() *VfioDeviceConfig {
+	if !featuregates.Enabled(featuregates.PassthroughSupport) {
+		return nil
+	}
+	return &VfioDeviceConfig{
+		TypeMeta: metav1.TypeMeta{
+			APIVersion: GroupName + "/" + Version,
+			Kind:       VfioDeviceConfigKind,
+		},
+	}
+}
+
+// Normalize updates a VfioDeviceConfig config with implied default values based on other settings.
+func (c *VfioDeviceConfig) Normalize() error {
+	return nil
+}
+
+// Validate ensures that VfioDeviceConfig has a valid set of values.
+func (c *VfioDeviceConfig) Validate() error {
+	return nil
+}
@@ -48,6 +48,7 @@ func (r root) getDriverLibraryPath() (string, error) {
 // getNvidiaSMIPath returns path to the `nvidia-smi` executable in the driver root.
 func (r root) getNvidiaSMIPath() (string, error) {
 	binarySearchPaths := []string{
+		"/opt/bin",
 		"/usr/bin",
 		"/usr/sbin",
 		"/bin",