Render daemonsets.podSecurityContext in Helm ClusterPolicy template

[kevinbiebuyck]

Render ClusterPolicy daemonsets.podSecurityContext from Helm values

Problem

ClusterPolicy.spec.daemonsets.podSecurityContext is already supported by the CRD and by the operator controller (applyCommonDaemonsetConfig). Helm values such as:

daemonsets:
  podSecurityContext:
    seLinuxOptions:
      type: spc_t
      level: s0

were silently ignored because deployments/gpu-operator/templates/clusterpolicy.yaml never emitted the field.

This breaks SELinux / OpenShift-style deployments that rely on chart values alone (no manual ClusterPolicy edit).

Change

• Render daemonsets.podSecurityContext into the ClusterPolicy when set in values.
• Document the option in values.yaml.

Follow-up request

Global daemonsets.podSecurityContext applies to all operand DaemonSets. We would also like optional per-operand podSecurityContext (e.g. under driver, toolkit, devicePlugin) so SELinux types can be scoped without granting every DaemonSet the same domain. Happy to follow up in a separate PR if preferred.

Test plan

• helm template with daemonsets.podSecurityContext.seLinuxOptions set → ClusterPolicy includes the field under spec.daemonsets
• helm template without the value → field absent
• Install / upgrade: operator applies PSC to operand DaemonSet pod templates

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[myeolenv]

Thanks for the contribution. We will review this PR.

[rahulait]

/ok to test 7f86174

[rahulait]

LGTM. @tariq1890 let me know your thoughts on this.

[tariq1890]

Thanks @kbix2000! Please make sure the commit is signed.

[rahulait]

@kevinbiebuyck can you please make sure the commit is signed.