Merge "Add intel-fpga-device-plugin to ansible playbook"

playbookconfig/src/playbooks/host_vars/bootstrap/default.yml

@@ -299,3 +299,4 @@ wipe_ceph_osds: false
 k8s_plugins:
 #  intel-gpu-plugin: intelgpu=enabled
 #  intel-qat-plugin: intelqat=enabled
+#  intel-fpga-plugin: intelfpga=enabled

playbookconfig/src/playbooks/roles/bootstrap/plugins/tasks/intel-fpga-plugin.yml

@@ -0,0 +1,8 @@
+---
+- name: Create Intel FPGA device plugin config file
+  template:
+    src: "intel-fpga-plugin.yaml.j2"
+    dest: /etc/kubernetes/intel-fpga-daemonset.yaml
+
+- name: Activate Intel FPGA device plugin
+  command: "kubectl --kubeconfig=/etc/kubernetes/admin.conf apply -f /etc/kubernetes/intel-fpga-daemonset.yaml"

playbookconfig/src/playbooks/roles/bootstrap/plugins/templates/intel-fpga-plugin.yaml.j2

@@ -0,0 +1,93 @@
+# Intel FPGA  device plugin
+# Based on:
+# https://github.com/intel/intel-device-plugins-for-kubernetes/blob/master/deployments/fpga_plugin/fpga_plugin.yaml
+# and
+# https://github.com/intel/intel-device-plugins-for-kubernetes/blob/master/deployments/fpga_plugin/fpga_plugin_service_account.yaml
+#
+# The following modifications have been made:
+#  - A nodeSelector of 'intelfpga' has been added to ensure the fpga device plugin
+#   pods only run on appropriately labelled nodes.
+#  - The daemonset is modified to tolerate all NoSchedule taints
+#  - A initContainers clause has been removed. The intel-fpga-initcontainer,
+#  that reprogramm FPGA on a container's startup, only works with CRI-O.
+
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: intel-fpga-plugin-controller
+  namespace: kube-system
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: node-getter
+rules:
+- apiGroups: [""]
+  resources: ["nodes"]
+  verbs: ["get"]
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: get-nodes
+  namespace: kube-system
+subjects:
+- kind: ServiceAccount
+  name: intel-fpga-plugin-controller
+  namespace: kube-system
+roleRef:
+  kind: ClusterRole
+  name: node-getter
+  apiGroup: rbac.authorization.k8s.io
+---
+
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: intel-fpga-plugin
+  namespace: kube-system
+  labels:
+    app: intel-fpga-plugin
+spec:
+  selector:
+    matchLabels:
+      app: intel-fpga-plugin
+  template:
+    metadata:
+      labels:
+        app: intel-fpga-plugin
+    spec:
+      nodeSelector:
+        intelfpga: enabled
+      tolerations:
+      - operator: Exists
+        effect: NoSchedule
+      serviceAccountName: intel-fpga-plugin-controller
+      containers:
+      - name: intel-fpga-plugin
+        env:
+          - name: NODE_NAME
+            valueFrom:
+              fieldRef:
+                fieldPath: spec.nodeName
+        image: "{{ docker_registry.url }}/starlingx/intel-fpga-plugin:master-distroless-stable-latest"
+        imagePullPolicy: IfNotPresent
+        securityContext:
+          readOnlyRootFilesystem: true
+        volumeMounts:
+        - name: devfs
+          mountPath: /dev
+        - name: sysfs
+          mountPath: /sys
+        - name: kubeletsockets
+          mountPath: /var/lib/kubelet/device-plugins
+      volumes:
+      - name: devfs
+        hostPath:
+          path: /dev
+      - name: sysfs
+        hostPath:
+          path: /sys
+      - name: kubeletsockets
+        hostPath:
+          path: /var/lib/kubelet/device-plugins