feat(helm): make device plugin security context configurable via values

[ilia-medvedev]

Summary

• hostPID and hostNetwork on the device plugin DaemonSet pod spec are now values-configurable (defaults: true / false — unchanged from current behaviour)
• securityContext for the main device-plugin container is now values-configurable (default: privileged: true, allowPrivilegeEscalation: true, SYS_ADMIN)
• securityContext for the vgpu-monitor container is now values-configurable (default: allowPrivilegeEscalation: false, SYS_ADMIN)
• gpuOperatorToolkitReady.securityContext for the toolkit-validation init container is now values-configurable (default: privileged: true, runAsUser: 0)

All defaults preserve the existing hardcoded values — this is a non-breaking change.

Motivation

Users deploying HAMi in environments with custom Pod Security Admission policies or restricted node configurations need to be able to tune these settings without patching the chart templates.

Through testing we found that not all security defaults — such as privileged: true and hostPID: true — are required for every use case. Making these configurable allows users to apply a least-privilege posture where their environment permits.

Closes #1888
Related: #1143

AI assistance used in drafting this PR.

Summary by CodeRabbit

• New Features

  • Added new configuration options to control whether the device plugin uses host PID and host networking.
  • Introduced configurable security settings for the device plugin, its monitoring component, and the toolkit validation step.

• Bug Fixes

  • Replaced previously hardcoded privilege and container security settings with deployment-driven controls, improving compatibility and flexibility across environments.

[gemini-code-assist]

Code Review

This pull request parameterizes the hostPID, hostNetwork, and securityContext settings for the NVIDIA device plugin DaemonSet, moving previously hardcoded values into values.yaml. The review feedback recommends wrapping the securityContext blocks in Helm with statements to better handle cases where values might be null or omitted. There is also a suggestion to adjust the placement of the new securityContext field in values.yaml to preserve the association between the resources field and its descriptive comments.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
unittests	59.05% <ø> (+0.45%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 27 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[mesutoezdil]

defaults are preserved correctly, all ci passes, and the {{- with }} pattern for securityContext is the right call. one issue with hostPID and hostNetwork.

[coderabbitai]

📝 Walkthrough

Walkthrough

hostPID, hostNetwork, and securityContext for the device-plugin, vgpu-monitor, and toolkit-validation containers in the DaemonSet template are now rendered from values.yaml instead of being hardcoded. Default values preserving existing behavior are added to values.yaml.

Changes

Configurable Device Plugin Security

Layer / File(s)	Summary
Default values for securityContext and host settings charts/hami/values.yaml	Adds securityContext under gpuOperatorToolkitReady (privileged: true, runAsUser: 0), under monitor (allowPrivilegeEscalation: false, capabilities drop ALL/add SYS_ADMIN), and under devicePlugin (privileged: true, allowPrivilegeEscalation: true, capabilities); also adds hostPID: true and hostNetwork: false.
DaemonSet template parameterization charts/hami/templates/device-plugin/daemonsetnvidia.yaml	Replaces hardcoded hostPID, hostNetwork, and per-container securityContext blocks with value-driven rendering from the new Helm values.

Estimated code review effort: 2 (Simple) | ~10 minutes

Poem

🐇 I hop through values, neat and new,
With flags and contexts set so true.
The daemonset now bends to you—
hostPID and friends can ebb and flow.
Carrots for least-privilege, too!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: making device plugin security context configurable via Helm values.
Linked Issues check	✅ Passed	The chart exposes the requested host and security context values for the device plugin, monitor, and toolkit-validation init container with preserved defaults.
Out of Scope Changes check	✅ Passed	The changes stay within the Helm chart device-plugin configuration and do not introduce unrelated functionality.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@charts/hami/templates/device-plugin/daemonsetnvidia.yaml`:
- Line 43: The hostPID templating in the device plugin DaemonSet is overriding
an explicit false value because default true treats false as empty. Update the
hostPID rendering logic in the daemonset template so devicePlugin.hostPID=false
is preserved as false instead of falling back to true, using the existing
hostPID value handling in the chart template.

In `@charts/hami/values.yaml`:
- Around line 272-274: The init container security context is currently defined
under gpuOperatorToolkitReady.securityContext, but the contract expects it at
devicePlugin.initContainerSecurityContext, so the configured value path is being
ignored. Move the default in values.yaml to the documented
devicePlugin.initContainerSecurityContext key and update the DaemonSet/template
lookup to read from that same path, using the relevant securityContext fields in
the init container rendering logic.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 088bf6e1-58bb-4841-8601-0d548997648c

📥 Commits

Reviewing files that changed from the base of the PR and between 98b8830 and 19f8a7d.

📒 Files selected for processing (2)

• charts/hami/templates/device-plugin/daemonsetnvidia.yaml
• charts/hami/values.yaml

[mesutoezdil]

The PR says Closes #1888 but 2 things from that issue are not working:

• Issue specifies devicePlugin.initContainerSecurityContext but the PR puts it under devicePlugin.gpuOperatorToolkitReady.securityContext.
  The path does not match.
• hostPID: false override does not work due to the boolean default bug mentioned above.

Both need to be fixed before this can actually close #1888.

[ilia-medvedev]

@mesutoezdil I've fixed the hostPID . as for the initContainer- it's cleaner to use the already existing parent value for it so using gpuOperatorToolkitReady.securityContext is the correct choice. I've adjusted the issue and the PR comment accordingly.

[mesutoezdil]

/lgtm

[archlitchi]

/lgtm

[hami-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: archlitchi, ilia-medvedev

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [archlitchi]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment