Add writable-cgroups experimental plugin

[chrishenzie]

Adds a new writable-cgroups plugin, designed to enable safe delegation of cgroup management to containers. This plugin allows containers to mount /sys/fs/cgroup as read-write, enabling workloads (like AI/ML frameworks) to manage their own sub-cgroups.

This plugin serves as a reference implementation and test-bed for validating the nsdelegate security model proposed in KEP-5474 as an alternative to introducing new Kubernetes API fields.

@Divya063 @samuelkarp

[chrishenzie]

I'm still unsure on the name, because all the other NRI plugins have "verb-focused" names. Maybe cgroup-adjuster is more appropriate?

[klihub]

nit: Anything against using writable-cgroups.noderesource.dev as the annotation key ?

[chrishenzie]

Works for me. The only limitation is there is a 63 character limit for Pod annotations, so if a container name is long, it might push us over the edge when appended with the .container.<container_name> suffix.

>>> len("writable-cgroups.noderesource.dev.container.")
44

So long as a container name is less than 19 characters it should be fine. We could potentially remove .container and save an extra 10 characters. I'm okay with keeping as-is though.

[klihub]

I'm still unsure on the name, because all the other NRI plugins have "verb-focused" names. Maybe cgroup-adjuster is more appropriate?

cgroup-adjuster sounds very generic to me compared to what the plugin does, implying more adjustments to containers' cgroups rather than their cgroup mounts. Maybe cgroup-mount-adjuster ?

[klihub]

@chrishenzie I only skimmed through it quickly yet, but it LGTM. Should we also add a contrib/kustomize/writable-cgroups (or whatever we end up calling this) like we have for the other plugins ?

[samuelkarp]

I think writable-cgroups is a fine name. We don't have to have everything named -adjuster.