Add repoConfig.nodeLocalPaths for node-local package repositories

api/nvidia/v1/clusterpolicy_types.go

@@ -1280,6 +1280,30 @@ type DriverRepoConfigSpec struct {
 	// +operator-sdk:gen-csv:customresourcedefinitions.specDescriptors.displayName="ConfigMap Name"
 	// +operator-sdk:gen-csv:customresourcedefinitions.specDescriptors.x-descriptors="urn:alm:descriptor:com.tectonic.ui:text"
 	ConfigMapName string `json:"configMapName,omitempty"`
+
+	// NodeLocalPaths is an optional list of absolute directory paths on the host which hold a
+	// node-local package repository referenced by the repository configuration in
+	// ConfigMapName (for example "URIs: file:///opt/local-packages"). Each path is
+	// bind-mounted read-only into the NVIDIA driver container at the same path, so that the
+	// package manager running inside the container can resolve file:// repository URIs.
+	//
+	// Each directory must exist on every node targeted by the driver DaemonSet; the driver
+	// pod will not start on a node where it is missing. Ignored when precompiled drivers are
+	// used, and rejected when ConfigMapName is empty.
+	//
+	// Packages installed from a node-local repository are compiled into a kernel module which
+	// is loaded into the host kernel, so the repository is part of the node's trusted
+	// computing base. The directory and all of its parents should be owned by root and not be
+	// group or world writable, and the repository should be GPG signed where possible.
+	// +kubebuilder:validation:Optional
+	// +kubebuilder:validation:MaxItems=8
+	// +kubebuilder:validation:items:MinLength=2
+	// +kubebuilder:validation:items:MaxLength=4096
+	// +kubebuilder:validation:items:Pattern="^/"
+	// +listType=set
+	// +operator-sdk:gen-csv:customresourcedefinitions.specDescriptors=true
+	// +operator-sdk:gen-csv:customresourcedefinitions.specDescriptors.displayName="Node-local package repository paths"
+	NodeLocalPaths []string `json:"nodeLocalPaths,omitempty"`
 }
 
 // DriverCertConfigSpec defines custom certificates configuration for NVIDIA Driver container

api/nvidia/v1alpha1/nvidiadriver_types.go

@@ -453,6 +453,30 @@ type DriverRepoConfigSpec struct {
 	// +operator-sdk:gen-csv:customresourcedefinitions.specDescriptors.displayName="ConfigMap Name"
 	// +operator-sdk:gen-csv:customresourcedefinitions.specDescriptors.x-descriptors="urn:alm:descriptor:com.tectonic.ui:text"
 	Name string `json:"name,omitempty"`
+
+	// NodeLocalPaths is an optional list of absolute directory paths on the host which hold a
+	// node-local package repository referenced by the repository configuration in Name (for
+	// example "URIs: file:///opt/local-packages"). Each path is bind-mounted read-only into
+	// the NVIDIA driver container at the same path, so that the package manager running
+	// inside the container can resolve file:// repository URIs.
+	//
+	// Each directory must exist on every node targeted by the driver DaemonSet; the driver
+	// pod will not start on a node where it is missing. Ignored when precompiled drivers are
+	// used, and rejected when Name is empty.
+	//
+	// Packages installed from a node-local repository are compiled into a kernel module which
+	// is loaded into the host kernel, so the repository is part of the node's trusted
+	// computing base. The directory and all of its parents should be owned by root and not be
+	// group or world writable, and the repository should be GPG signed where possible.
+	// +kubebuilder:validation:Optional
+	// +kubebuilder:validation:MaxItems=8
+	// +kubebuilder:validation:items:MinLength=2
+	// +kubebuilder:validation:items:MaxLength=4096
+	// +kubebuilder:validation:items:Pattern="^/"
+	// +listType=set
+	// +operator-sdk:gen-csv:customresourcedefinitions.specDescriptors=true
+	// +operator-sdk:gen-csv:customresourcedefinitions.specDescriptors.displayName="Node-local package repository paths"
+	NodeLocalPaths []string `json:"nodeLocalPaths,omitempty"`
 }
 
 // DriverLicensingConfigSpec defines licensing server configuration for NVIDIA Driver container
@@ -772,6 +796,15 @@ func (d *NVIDIADriverSpec) IsRepoConfigEnabled() bool {
 	return d.RepoConfig.Name != ""
 }
 
+// RepoConfigNodeLocalPaths returns the node-local package repository host paths configured
+// for the driver, or nil if none are set.
+func (d *NVIDIADriverSpec) RepoConfigNodeLocalPaths() []string {
+	if d.RepoConfig == nil {
+		return nil
+	}
+	return d.RepoConfig.NodeLocalPaths
+}
+
 // IsCertConfigEnabled returns true if additional certificate config is provided
 func (d *NVIDIADriverSpec) IsCertConfigEnabled() bool {
 	if d.CertConfig == nil {

bundle/manifests/nvidia.com_clusterpolicies.yaml

@@ -1137,6 +1137,30 @@ spec:
                     properties:
                       configMapName:
                         type: string
+                      nodeLocalPaths:
+                        description: |-
+                          NodeLocalPaths is an optional list of absolute directory paths on the host which hold a
+                          node-local package repository referenced by the repository configuration in
+                          ConfigMapName (for example "URIs: file:///opt/local-packages"). Each path is
+                          bind-mounted read-only into the NVIDIA driver container at the same path, so that the
+                          package manager running inside the container can resolve file:// repository URIs.
+
+                          Each directory must exist on every node targeted by the driver DaemonSet; the driver
+                          pod will not start on a node where it is missing. Ignored when precompiled drivers are
+                          used, and rejected when ConfigMapName is empty.
+
+                          Packages installed from a node-local repository are compiled into a kernel module which
+                          is loaded into the host kernel, so the repository is part of the node's trusted
+                          computing base. The directory and all of its parents should be owned by root and not be
+                          group or world writable, and the repository should be GPG signed where possible.
+                        items:
+                          maxLength: 4096
+                          minLength: 2
+                          pattern: ^/
+                          type: string
+                        maxItems: 8
+                        type: array
+                        x-kubernetes-list-type: set
                     type: object
                   repository:
                     description: NVIDIA Driver image repository

bundle/manifests/nvidia.com_nvidiadrivers.yaml

@@ -834,6 +834,30 @@ spec:
                 properties:
                   name:
                     type: string
+                  nodeLocalPaths:
+                    description: |-
+                      NodeLocalPaths is an optional list of absolute directory paths on the host which hold a
+                      node-local package repository referenced by the repository configuration in Name (for
+                      example "URIs: file:///opt/local-packages"). Each path is bind-mounted read-only into
+                      the NVIDIA driver container at the same path, so that the package manager running
+                      inside the container can resolve file:// repository URIs.
+
+                      Each directory must exist on every node targeted by the driver DaemonSet; the driver
+                      pod will not start on a node where it is missing. Ignored when precompiled drivers are
+                      used, and rejected when Name is empty.
+
+                      Packages installed from a node-local repository are compiled into a kernel module which
+                      is loaded into the host kernel, so the repository is part of the node's trusted
+                      computing base. The directory and all of its parents should be owned by root and not be
+                      group or world writable, and the repository should be GPG signed where possible.
+                    items:
+                      maxLength: 4096
+                      minLength: 2
+                      pattern: ^/
+                      type: string
+                    maxItems: 8
+                    type: array
+                    x-kubernetes-list-type: set
                 type: object
               repository:
                 description: NVIDIA Driver repository

config/crd/bases/nvidia.com_clusterpolicies.yaml

@@ -1137,6 +1137,30 @@ spec:
                     properties:
                       configMapName:
                         type: string
+                      nodeLocalPaths:
+                        description: |-
+                          NodeLocalPaths is an optional list of absolute directory paths on the host which hold a
+                          node-local package repository referenced by the repository configuration in
+                          ConfigMapName (for example "URIs: file:///opt/local-packages"). Each path is
+                          bind-mounted read-only into the NVIDIA driver container at the same path, so that the
+                          package manager running inside the container can resolve file:// repository URIs.
+
+                          Each directory must exist on every node targeted by the driver DaemonSet; the driver
+                          pod will not start on a node where it is missing. Ignored when precompiled drivers are
+                          used, and rejected when ConfigMapName is empty.
+
+                          Packages installed from a node-local repository are compiled into a kernel module which
+                          is loaded into the host kernel, so the repository is part of the node's trusted
+                          computing base. The directory and all of its parents should be owned by root and not be
+                          group or world writable, and the repository should be GPG signed where possible.
+                        items:
+                          maxLength: 4096
+                          minLength: 2
+                          pattern: ^/
+                          type: string
+                        maxItems: 8
+                        type: array
+                        x-kubernetes-list-type: set
                     type: object
                   repository:
                     description: NVIDIA Driver image repository

config/crd/bases/nvidia.com_nvidiadrivers.yaml

@@ -834,6 +834,30 @@ spec:
                 properties:
                   name:
                     type: string
+                  nodeLocalPaths:
+                    description: |-
+                      NodeLocalPaths is an optional list of absolute directory paths on the host which hold a
+                      node-local package repository referenced by the repository configuration in Name (for
+                      example "URIs: file:///opt/local-packages"). Each path is bind-mounted read-only into
+                      the NVIDIA driver container at the same path, so that the package manager running
+                      inside the container can resolve file:// repository URIs.
+
+                      Each directory must exist on every node targeted by the driver DaemonSet; the driver
+                      pod will not start on a node where it is missing. Ignored when precompiled drivers are
+                      used, and rejected when Name is empty.
+
+                      Packages installed from a node-local repository are compiled into a kernel module which
+                      is loaded into the host kernel, so the repository is part of the node's trusted
+                      computing base. The directory and all of its parents should be owned by root and not be
+                      group or world writable, and the repository should be GPG signed where possible.
+                    items:
+                      maxLength: 4096
+                      minLength: 2
+                      pattern: ^/
+                      type: string
+                    maxItems: 8
+                    type: array
+                    x-kubernetes-list-type: set
                 type: object
               repository:
                 description: NVIDIA Driver repository

config/samples/nvidia_v1alpha1_nvidiadriver.yaml

@@ -43,6 +43,10 @@ spec:
   # Private mirror repository configuration
   repoConfig:
     name: ""
+    # absolute host directories holding a node-local package repository referenced
+    # by the repo config above, bind-mounted read-only at the same path
+    # nodeLocalPaths:
+    #   - /opt/local-packages
   # custom ssl key/certificate configuration
   certConfig:
     name: ""

config/samples/v1_clusterpolicy.yaml

@@ -85,6 +85,10 @@ spec:
     # private mirror repository configuration
     repoConfig:
       configMapName: ""
+      # absolute host directories holding a node-local package repository referenced
+      # by the repo config above, bind-mounted read-only at the same path
+      # nodeLocalPaths:
+      #   - /opt/local-packages
     # custom ssl key/certificate configuration
     certConfig:
       name: ""

controllers/object_controls.go

@@ -3722,6 +3722,22 @@ func transformDriverContainer(obj *appsv1.DaemonSet, config *gpuv1.ClusterPolicy
 		}
 		driverContainer.VolumeMounts = append(driverContainer.VolumeMounts, volumeMounts...)
 		podSpec.Volumes = append(podSpec.Volumes, createConfigMapVolume(config.Driver.RepoConfig.ConfigMapName, itemsToInclude))
+
+		// expose any node-local package repositories referenced by the repo configuration
+		// (e.g. "URIs: file:///opt/local-packages") to the driver container
+		if len(config.Driver.RepoConfig.NodeLocalPaths) > 0 {
+			repoVolumes, repoVolumeMounts, err := utils.NodeLocalRepoVolumes(config.Driver.RepoConfig.NodeLocalPaths)
+			if err != nil {
+				return fmt.Errorf("ERROR: invalid repoConfig.nodeLocalPaths: %w", err)
+			}
+			n.logger.Info("Mounting node-local package repositories into the driver container",
+				"nodeLocalPaths", config.Driver.RepoConfig.NodeLocalPaths)
+			driverContainer.VolumeMounts = append(driverContainer.VolumeMounts, repoVolumeMounts...)
+			podSpec.Volumes = append(podSpec.Volumes, repoVolumes...)
+		}
+	} else if config.Driver.RepoConfig != nil && len(config.Driver.RepoConfig.NodeLocalPaths) > 0 {
+		return fmt.Errorf("ERROR: driver.repoConfig.nodeLocalPaths is set but driver.repoConfig.configMapName is empty; " +
+			"nodeLocalPaths only applies when a custom repository configuration is provided")
 	}
 
 	// set any custom ssl key/certificate configuration provided