Slide 35
Slide 35 text
Mutating Admission Policy の機能検証: 環境変数 NVIDIA_VISIBLE_DEVICES に none を強制
Webhook サーバ実装と CEL 記述の比較
35
func (m *mutator) mutate(_ context.Context, logger logr.Logger, pod *corev1.Pod) error {
m.mutateContainers(logger, pod.Spec.InitContainers)
m.mutateContainers(logger, pod.Spec.Containers)
return nil
}
func (m *mutator) mutateContainers(logger logr.Logger, containers []corev1.Container) {
for i, ctr := range containers {
gpu := ctr.Resources.Limits["nvidia.com/gpu"]
if gpu.CmpInt64(0) == 0 {
envs := m.mutateEnv(ctr.Env)
ctr.Env = envs
}
containers[i] = ctr
}
}
func (m *mutator) mutateEnv(envs []corev1.EnvVar) []corev1.EnvVar {
found := false
for i, env := range envs {
if env.Name == "NVIDIA_VISIBLE_DEVICES" {
found = true
if env.Value != "none" {
env.Value = "none"
envs[i] = env
}
}
}
if !found {
envs = append(envs, corev1.EnvVar{
Name: "NVIDIA_VISIBLE_DEVICES",
Value: "none",
})
}
return envs
}
Object {
spec: Object.spec{
initContainers: object.spec.?initContainers.orValue([]).filter(
ct,
quantity(ct.resources.?limits['nvidia.com/gpu'].orValue("0")).asInteger() == 0
).map(ct, Object.spec.containers {
name: ct.name,
env: [Object.spec.containers.env {
name: 'NVIDIA_VISIBLE_DEVICES',
value: 'none',
}]
}),
containers: object.spec.?containers.orValue([]).filter(
ct,
quantity(ct.resources.?limits['nvidia.com/gpu'].orValue("0")).asInteger() == 0
).map(ct, Object.spec.containers {
name: ct.name,
env: [Object.spec.containers.env {
name: 'NVIDIA_VISIBLE_DEVICES',
value: 'none',
}]
})
}
}
✅ パッチを用意すればよいので簡潔
❌ 関数定義できないので冗長になりがち
❌ 静的テストツールがない（kaptest に期待）
コンテナに対する処理を共通化したいが
関数が定義できない😣