Add configurable securityContext and dnsConfig for the operator Deployment

deployments/gpu-operator/templates/cleanup_crd.yaml

@@ -32,10 +32,28 @@ spec:
       {{- end }}
       nodeSelector:
         {{- toYaml .Values.operator.nodeSelector | nindent 8 }}
+      {{- with .Values.operator.securityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if .Values.operator.dnsPolicy }}
+      dnsPolicy: {{ .Values.operator.dnsPolicy }}
+      {{- end }}
+      {{- with .Values.operator.dnsConfig }}
+      dnsConfig:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         - name: cleanup-crd
           image: {{ include "gpu-operator.fullimage" . }}
           imagePullPolicy: {{ .Values.operator.imagePullPolicy }}
+        {{- with .Values.operator.containerSecurityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+        {{- end }}
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
           command:
             - /usr/bin/manage-crds
           args:
@@ -46,5 +64,8 @@ spec:
         {{- if .Values.nfd.enabled }}
             - --filepath=/opt/gpu-operator/nfd-api-crds.yaml
         {{- end }}
+      volumes:
+        - name: tmp
+          emptyDir: {}
       restartPolicy: OnFailure
 {{- end }}

deployments/gpu-operator/templates/cleanup_gpucluster.yaml

@@ -37,12 +37,33 @@ spec:
       {{- end }}
       nodeSelector:
         {{- toYaml .Values.operator.nodeSelector | nindent 8 }}
+      {{- with .Values.operator.securityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if .Values.operator.dnsPolicy }}
+      dnsPolicy: {{ .Values.operator.dnsPolicy }}
+      {{- end }}
+      {{- with .Values.operator.dnsConfig }}
+      dnsConfig:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         - name: cleanup-gpucluster
           image: {{ include "gpu-operator.fullimage" . }}
           imagePullPolicy: {{ .Values.operator.imagePullPolicy }}
+        {{- with .Values.operator.containerSecurityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+        {{- end }}
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
           command:
             - /usr/bin/cleanup-gpuclusters
             - --gpucluster-name
             - {{ include "gpu-operator.gpucluster-name" . }}
+      volumes:
+        - name: tmp
+          emptyDir: {}
       restartPolicy: OnFailure

deployments/gpu-operator/templates/operator.yaml

@@ -33,6 +33,17 @@ spec:
       {{- if .Values.operator.priorityClassName }}
       priorityClassName: {{ .Values.operator.priorityClassName }}
       {{- end }}
+      {{- with .Values.operator.securityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if .Values.operator.dnsPolicy }}
+      dnsPolicy: {{ .Values.operator.dnsPolicy }}
+      {{- end }}
+      {{- with .Values.operator.dnsConfig }}
+      dnsConfig:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
       - name: gpu-operator
         image: {{ include "gpu-operator.fullimage" . }}
@@ -80,9 +91,19 @@ spec:
         resources:
           {{- toYaml . | nindent 10 }}
       {{- end }}
+        {{- with .Values.operator.containerSecurityContext }}
+        securityContext:
+          {{- toYaml . | nindent 10 }}
+        {{- end }}
+        volumeMounts:
+          - name: tmp
+            mountPath: /tmp
         ports:
           - name: metrics
             containerPort: 8080
+      volumes:
+        - name: tmp
+          emptyDir: {}
     {{- with .Values.operator.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}

deployments/gpu-operator/templates/upgrade_crd.yaml

@@ -81,10 +81,28 @@ spec:
       {{- end }}
       nodeSelector:
         {{- toYaml .Values.operator.nodeSelector | nindent 8 }}
+      {{- with .Values.operator.securityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if .Values.operator.dnsPolicy }}
+      dnsPolicy: {{ .Values.operator.dnsPolicy }}
+      {{- end }}
+      {{- with .Values.operator.dnsConfig }}
+      dnsConfig:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         - name: upgrade-crd
           image: {{ include "gpu-operator.fullimage" . }}
           imagePullPolicy: {{ .Values.operator.imagePullPolicy }}
+        {{- with .Values.operator.containerSecurityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+        {{- end }}
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
           command:
             - /usr/bin/manage-crds
           args:
@@ -95,5 +113,8 @@ spec:
         {{- if .Values.nfd.enabled }}
             - --filepath=/opt/gpu-operator/nfd-api-crds.yaml
         {{- end }}
+      volumes:
+        - name: tmp
+          emptyDir: {}
       restartPolicy: OnFailure
 {{- end }}

deployments/gpu-operator/values.yaml

@@ -118,6 +118,23 @@ operator:
     requests:
       cpu: 200m
       memory: 100Mi
+  # Restricted defaults for the operator Deployment (not operand DaemonSets).
+  # Do not pin runAsUser/runAsGroup/fsGroup: the image already uses USER 1000:1000
+  # on vanilla Kubernetes, and a hardcoded UID fails OpenShift namespaces whose
+  # allocated range does not include 1000 (restricted-readonly SCC is MustRunAsRange).
+  securityContext:
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    readOnlyRootFilesystem: true
+    capabilities:
+      drop:
+        - ALL
+  # Empty dnsPolicy keeps the cluster default (ClusterFirst).
+  dnsPolicy: ""
+  dnsConfig: {}
   # metrics:
   #   serviceMonitor:
   #     interval: 15s