Mount devices with Smarter Device Management

NOTES.md

@@ -0,0 +1,77 @@
+# Device exposure
+
+For [Jellyfin Hardware Acceleration](https://jellyfin.org/docs/general/administration/hardware-acceleration/), following instructions [here](https://github.com/kubernetes/kubernetes/issues/7890#issuecomment-766088805) (originally from [here](https://old.reddit.com/r/jellyfin/comments/i2r4h9/how_to_enable_hardware_acceleration_with_docker/)), I used [smarter-device-manager](https://gitlab.com/arm-research/smarter/smarter-device-manager) to expose devices from the host node (`epsilon`) into containers.
+
+This was installed via a manual `kubectl apply`, though it should be migrated into GitOps-managed definitions - though I had to make some alterations to get ConfigMap to be read.
+
+```yaml
+# smarter-management-configmap.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: smarter-device-manager
+  namespace: smarter-device-management
+data:
+  conf.yaml: |
+        - devicematch: ^fb0$
+          nummaxdevices: 2
+
+# smarter-management-pod.yaml
+apiVersion: v1
+kind: Pod
+metadata:
+  name: smarter-device-management
+  namespace: smarter-device-management
+spec:
+  # Mark this pod as a critical add-on; when enabled, the critical add-on
+  # scheduler reserves resources for critical add-on pods so that they can
+  # be rescheduled after a failure.
+  # See https://kubernetes.io/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/
+  priorityClassName: "system-node-critical"
+  hostNetwork: true
+  dnsPolicy: ClusterFirstWithHostNet
+  hostname: smarter-device-management
+  nodeName: epsilon
+  containers:
+  - name: smarter-device-manager
+    image: registry.gitlab.com/arm-research/smarter/smarter-device-manager:v1.20.11
+    imagePullPolicy: IfNotPresent
+    securityContext:
+      allowPrivilegeEscalation: false
+      capabilities:
+        drop: ["ALL"]
+    resources:
+      limits:
+        cpu: 100m
+        memory: 10Mi
+      requests:
+        cpu: 10m
+        memory: 10Mi
+    volumeMounts:
+      - name: device-plugin
+        mountPath: /var/lib/kubelet/device-plugins
+      - name: dev-dir
+        mountPath: /dev
+      - name: sys-dir
+        mountPath: /sys
+      - name: config
+        mountPath: /root/config
+  volumes:
+    - name: device-plugin
+      hostPath:
+        path: /var/lib/kubelet/device-plugins
+    - name: dev-dir
+      hostPath:
+            path: /dev
+    - name: sys-dir
+      hostPath:
+            path: /sys
+    - name: config
+      configMap:
+            name: smarter-device-manager
+  terminationGracePeriodSeconds: 30
+```
+
+Re: `device-plugin` path, that apparently changed (from `/var/lib/rancher/k3s/agent/kubelet/device-plugins`, which was the provided value) [some time ago](https://github.com/k3s-io/k3s/issues/2664#issuecomment-742013918)
+
+This also required the [Device Plugin Feature Gate](https://github.com/k3s-io/k3s/discussions/4596) to be enabled.

charts/jellyfin/templates/deployment.yaml

@@ -45,8 +45,6 @@ spec:
               name: jf-config
             - mountPath: /cache
               name: jf-cache
-            - mountPath: /dev/video0
-              name: dev-video0
       tolerations:
         - key: face
           operator: Equal
@@ -65,9 +63,6 @@ spec:
         - name: jf-cache
           persistentVolumeClaim:
             claimName: jf-cache-pvc
-        - name: dev-video0
-          hostPath:
-            path: /dev/fb0
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}

charts/jellyfin/values.yaml

@@ -31,8 +31,9 @@ podSecurityContext: {}
 securityContext:
   runAsUser: 1000
   fsGroup: 1000
-  privileged: true
+  capabilities:
-  # capabilities:
+    add:
+      - "SYS_ADMIN"
   #   drop:
   #   - ALL
   # readOnlyRootFilesystem: true
@@ -59,7 +60,12 @@ ingress:
   #    hosts:
   #      - chart-example.local
 
-resources: {}
+# https://github.com/kubernetes/kubernetes/issues/7890#issuecomment-766088805
+resources:
+  requests:
+    smarter-devices/fb0: 1
+  limits:
+    smarter-devices/fb0: 1
   # We usually recommend not to specify default resources and to leave this as a conscious
   # choice for the user. This also increases chances charts run on environments with little
   # resources, such as Minikube. If you do want to specify resources, uncomment the following