apiVersion: "helm-expt.confighub.com/v1alpha1" kind: "HelmPainReport" metadata: name: "nvidia-nvidia-device-plugin-0.19.3" spec: chart: name: "nvidia/nvidia-device-plugin" version: "0.19.3" source: "https://nvidia.github.io/k8s-device-plugin" digest: "8f01067500e712508fe55fe060b6f895814dc7efc1cb96323db2ce4f777f6e96" supportedScopeStatus: "no-unhandled-pain-points-for-supported-scopes" supportedScopes: [] supportedVariants: [] productionReadiness: "not-reviewed-for-production" notes: - "Three audited bases render into namespace gpu-operator with release name nvidia-device-plugin at kubeVersion 1.31.0: default and eks-inference render 5 objects each, nfd-enabled renders 26." - "Chart 0.19.3 (appVersion 0.19.3) vendors one dependency, node-feature-discovery 0.17.3, behind the condition nfd.enabled,gfd.enabled; both gates are off by chart default." - "Every base runs nvcr.io/nvidia/k8s-device-plugin:v0.19.3; the nfd-enabled base adds registry.k8s.io/nfd/node-feature-discovery:v0.17.3." - "The chart's one weird thing is the MPS control-daemon DaemonSet. It renders unconditionally whenever devicePlugin.enabled is true, but pins itself to nodes labeled nvidia.com/mps.capable=true, so on most clusters it exists as a permanently zero-pod DaemonSet running with hostPID." - "The chart-default nodeAffinity keys are NFD-published labels, yet the default base ships no NFD; scheduling under chart defaults relies on an out-of-band NFD install or the manual nvidia.com/gpu.present=true label." - "The chart refuses to render into the default namespace (templates/validation.yml hard-fails unless allowDefaultNamespace=true) and rejects any .Values.namespace override outright." - "nfd-enabled renders four hook-annotated post-delete documents as visible objects (ServiceAccount, ClusterRole, ClusterRoleBinding, and Job, all named nvidia-device-plugin-node-feature-discovery-prune) plus three NodeFeature CRDs; default and eks-inference render no hooks and no CRDs." - "The witness records zero lookups, zero Capabilities probes, zero generated Secrets, zero webhooks, zero namespace creation, and zero test hooks across the whole package." painPoints: - id: "source-lock" detectedPainPoint: "source-lock.yaml pins the exact artifact https://nvidia.github.io/k8s-device-plugin/nvidia-device-plugin-0.19.3.tgz with sha256 8f01067500e712508fe55fe060b6f895814dc7efc1cb96323db2ce4f777f6e96, resolution artifact-addressed. The same packageSHA256 appears in all three variant-revision digest inputs. Exact-artifact pinning is env-only (HELM_EXPT_CHART_ARTIFACT_URL and HELM_EXPT_CHART_ARTIFACT_SHA256) and the same env must be exported at verify time." evidence: - "source-lock.yaml" configHubHome: "source-lock" disposition: "absorbed-into-recipe" linkedReceipt: "source-lock.yaml" supportedVariantStatus: "handled" - id: "dependency-lock" detectedPainPoint: "the chart carries exactly one vendored dependency, node-feature-discovery 0.17.3 (Chart.yaml:3-8, Chart.lock present in the package), gated by the condition nfd.enabled,gfd.enabled" evidence: - "dependency-lock.yaml" configHubHome: "dependency-lock" disposition: "absorbed-into-recipe" linkedReceipt: "dependency-lock.yaml" supportedVariantStatus: "handled" - id: "capability-profile" detectedPainPoint: "all three variants pin kubeVersion 1.31.0 with an empty apiVersions list. The chart's own floor is kubeVersion >= 1.10.0-0 (Chart.yaml:11). No Capabilities probes exist in the package." evidence: - "control-points.yaml" configHubHome: "capability-profile" disposition: "handled-by-capability-profile" linkedReceipt: "revisions/default/r001/receipts/render-receipt.yaml" supportedVariantStatus: "handled" - id: "lifecycle-policy" detectedPainPoint: "all three variants declare hookPolicy hooks-rendered-visible and the render runs without --no-hooks. In the nfd-enabled base four hook-annotated post-delete documents render visibly (ServiceAccount, ClusterRole, ClusterRoleBinding, and Job, all named nvidia-device-plugin-node-feature-discovery-prune). The flattening verdict assigns that base a post-delete lifecycle route executed by the delivery runtime, and the route must cover all four prune objects, not just the Job." evidence: - "hooks-rendered-visible" configHubHome: "lifecycle-policy" disposition: "handled-by-lifecycle-policy" linkedReceipt: "revisions/default/r001/receipts/install-gate.yaml" supportedVariantStatus: "attention-required" - id: "crd-policy" detectedPainPoint: "default and eks-inference render zero CRDs because the gate is closed. nfd-enabled renders three NodeFeature CRDs (nodefeatures, nodefeaturegroups, nodefeaturerules in nfd.k8s-sigs.io) and its verdict requires a CRD ordering declaration to ship with the bundle. Renders include CRDs in every variant via --include-crds." evidence: - "control-points.yaml" configHubHome: "recipe" disposition: "needs-operator-decision" linkedReceipt: "revisions/default/r001/receipts/install-gate.yaml" supportedVariantStatus: "split-by-base" - id: "namespace" detectedPainPoint: "the chart creates no Namespace and every base renders into gpu-operator. templates/validation.yml hard-fails a default-namespace render unless allowDefaultNamespace=true and rejects .Values.namespace outright, so the render always needs an explicit --namespace. The installer's default supportObjects entry v1|Namespace||gpu-operator covers the missing Namespace object." evidence: - "control-points.yaml" configHubHome: "recipe" disposition: "absorbed-into-recipe" linkedReceipt: "revisions/default/r001/receipts/install-gate.yaml" supportedVariantStatus: "handled-with-guard" - id: "credentials-secrets" detectedPainPoint: "no Secrets render in any base, generated-secrets and lookup are absent, and imagePullSecrets stays empty. expectedSecretCount is 0 for every variant." evidence: - "control-points.yaml" configHubHome: "recipe" disposition: "needs-operator-decision" linkedReceipt: "revisions/default/r001/receipts/install-gate.yaml" supportedVariantStatus: "none-present" - id: "extension-slots" detectedPainPoint: "the config.name/config.map ConfigMap slot is empty in every base so no plugin ConfigMap renders, with validation enforcing one-of. gfd.enabled and the pre-wired nfd.master/nfd.worker config blocks (values.yaml:119-145) are further closed slots that only matter when the subchart gate opens." evidence: - "control-points.yaml" configHubHome: "extension-slot" disposition: "needs-operator-decision" linkedReceipt: "revisions/default/r001/receipts/install-gate.yaml" supportedVariantStatus: "open-unused" - id: "installer-support-object" detectedPainPoint: "installer-support-object affects v1|Namespace||gpu-operator" evidence: - "v1|Namespace||gpu-operator" configHubHome: "recipe" disposition: "absorbed-into-recipe" linkedReceipt: "revisions/default/r001/receipts/install-gate.yaml" supportedVariantStatus: "handled" - id: "scan-gate" detectedPainPoint: "Current scan gate is warn-production-blocked" evidence: - "helm-plan.yaml" - "scan receipts" - "install gates" configHubHome: "scan-gate" disposition: "handled-by-scan-or-gate" linkedReceipt: "revisions/default/r001/receipts/install-gate.yaml" supportedVariantStatus: "warn-production-blocked" - id: "value-model-diagnostics" detectedPainPoint: "Helm values can be unknown, dead, misspelled, shadowed, or ignored unless the values model records the analysis boundary." evidence: - "value-model.yaml" configHubHome: "value-model" disposition: "absorbed-into-value-model" linkedReceipt: "value-model.yaml" supportedVariantStatus: "unknown=not-checked; dead=not-checked; ignored=not-checked" answerForSkepticalHelmUser: "nvidia/nvidia-device-plugin@0.19.3 maps its detected Helm pain to 8 ConfigHub control areas: source-lock, dependency-lock, capability-profile, lifecycle-policy, recipe, extension-slot, scan-gate, value-model. No supported scopes are declared; production readiness remains not-reviewed-for-production."