Don't mount /dev/vfio
With latest SR-IOV device plugins, they now correctly allocate the right
/dev/vfio/<NUM> device node to the pod, so we don't need access to the host
path anymore. Apart from simplification, this change also improves security
since the launcher pod no longer can access IOMMU groups used by other
containers.
@@ -370,20 +370,6 @@ func (t *templateService) RenderLaunchManifest(vmi *v1.VirtualMachineInstance) (
},
},
})
-
- // libvirt uses vfio-pci to pass host devices through
- volumeMounts = append(volumeMounts, k8sv1.VolumeMount{
- Name: "dev-vfio",
- MountPath: "/dev/vfio/",
- })
- volumes = append(volumes, k8sv1.Volume{
- Name: "dev-vfio",
- VolumeSource: k8sv1.VolumeSource{
- HostPath: &k8sv1.HostPathVolumeSource{
- Path: "/dev/vfio/",
- },
- },
- })
}
serviceAccountName := ""
