diff --git a/deployments/gpu-operator/templates/clusterpolicy.yaml b/deployments/gpu-operator/templates/clusterpolicy.yaml index af7f098e75..ecbfb11faa 100644 --- a/deployments/gpu-operator/templates/clusterpolicy.yaml +++ b/deployments/gpu-operator/templates/clusterpolicy.yaml @@ -56,6 +56,9 @@ spec: rollingUpdate: maxUnavailable: {{ .Values.daemonsets.rollingUpdate.maxUnavailable | quote }} {{- end }} + {{- if .Values.daemonsets.podSecurityContext }} + podSecurityContext: {{ toYaml .Values.daemonsets.podSecurityContext | nindent 6 }} + {{- end }} validator: {{- if .Values.validator.repository }} repository: {{ .Values.validator.repository }} diff --git a/deployments/gpu-operator/values.yaml b/deployments/gpu-operator/values.yaml index a197ee757b..ccd21352cd 100644 --- a/deployments/gpu-operator/values.yaml +++ b/deployments/gpu-operator/values.yaml @@ -54,6 +54,14 @@ daemonsets: # maximum number of nodes to simultaneously apply pod updates on. # can be specified either as number or percentage of nodes. Default 1. maxUnavailable: "1" + # Optional: pod-level security context applied to ALL operand DaemonSets. + # Example (SELinux): + # podSecurityContext: + # seLinuxOptions: + # type: spc_t + # level: s0 + # Note: This must be rendered into ClusterPolicy by the Helm template. + # Per-operand overrides are not supported yet. validator: repository: nvcr.io/nvidia