-
Notifications
You must be signed in to change notification settings - Fork 205
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
qat: drop AppArmor annotations #1860
base: main
Are you sure you want to change the base?
Conversation
84e99cb
to
d40efb3
Compare
TODO: @hj-johannes-lee is still checking whether the |
Unfortunately |
I took a closer look. |
setupDeviceIDs() is obsoleted and the preferred approach is driver_override. The new_id mechanism was added way before we had the initcontainer support in place. Furthermore, at least for vfio-pci we don't need it at all if the driver uses ids=8086:<qat VF dev IDs>. Drop write attemps to new_id and move the corresponding functionality to qat-init.sh. With this, we can drop the Apparmor policies from the plugin. Signed-off-by: Mikko Ylinen <[email protected]>
"unconfined" annotation was needed to get writes to new_id / bind to succeed. However, many things have changed: * new_id should not be used anymore and it was dropped in the plugin. * QAT initcontainer has assumed the role of HW initialization. * vfio-pci is the preferred "dpdkDriver" and starting with QAT Gen4, it is the only available VF driver so unbind isn't necessary. The suggested approach is to configure ids=8086:<qat VF IDs> to vfio-pci parameters. Alternatively, the initcontainer will take care of binding QAT VFs to vfio-pci through driver_override. Signed-off-by: Mikko Ylinen <[email protected]>
It's been GA since k8s 1.30 so we can enable it unconditionally starting with our 0.32 release.
Fixes: #1818
Fixes: #1887