-
Notifications
You must be signed in to change notification settings - Fork 100
docs(tutorials): add RTX PRO 6000 Dynamic MIG lab #793
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
saiyam1814
wants to merge
6
commits into
Project-HAMi:master
Choose a base branch
from
saiyam1814:docs/dynamic-mig-rtx-pro-lab
base: master
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
Changes from all commits
Commits
Show all changes
6 commits
Select commit
Hold shift + click to select a range
d0d10ec
docs(tutorials): add RTX PRO 6000 Dynamic MIG lab
saiyam1814 19fba88
docs(tutorials): address review on the RTX PRO 6000 Dynamic MIG lab
saiyam1814 ddfebfa
docs(tutorials): credit both kubesimplify authors on the RTX PRO 6000…
saiyam1814 b0efd5f
docs(tutorials): derive both MIG exclusion lists from the chosen GPUs
saiyam1814 47ff08b
docs(tutorials): renumber the RTX PRO 6000 Dynamic MIG lab to Lab 17
saiyam1814 e2519a3
docs(tutorials): group the RTX PRO 6000 lab overview into three phases
saiyam1814 File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
43 changes: 43 additions & 0 deletions
43
...zh/docusaurus-plugin-content-docs-tutorials/current/labs/dynamic-mig-rtx-pro.md
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,43 @@ | ||
| --- | ||
| title: "实验 17: RTX PRO 6000 动态 MIG 生命周期" | ||
| description: "构建固定版本的 HAMi,并验证按 Pod 创建 MIG、混合规格、选择性回收、重启恢复和跨 GPU 调度。" | ||
| sidebar_label: "实验 17: 动态 MIG 生命周期" | ||
| lab: | ||
| level: Advanced | ||
| duration: 约 90 分钟 | ||
| environment: 配备 8 张 NVIDIA RTX PRO 6000 Blackwell GPU 的单节点 Kubernetes 服务器 | ||
| cost: 需要可计费的多 GPU 硬件 | ||
| authors: | ||
| - shkatara | ||
| - saiyam1814 | ||
| verified: "2026-08-11" | ||
| tags: | ||
| - gpu-partitioning | ||
| - nvidia | ||
| - hami | ||
| toc_max_heading_level: 2 | ||
| --- | ||
|
|
||
| :::caution[翻译进行中] | ||
|
|
||
| 本实验的完整中文翻译尚未完成。为避免命令、固定提交版本、安全警告和实测输出在翻译期间产生偏差,请暂时使用[英文版实验](/tutorials/labs/dynamic-mig-rtx-pro)。 | ||
|
|
||
| 英文版包含完整的端到端操作:构建 HAMi 提交 `634bf2b32e68`、备份与受控交接、MIG Manager 所有权警告、`operatingmode` 与 `migStrategy` 的区别、单个 `1g.24gb` 请求、四个位置饱和、`1g.24gb` 与 `2g.48gb` 混合部署、相邻 CUDA 工作负载持续运行时的选择性回收、设备插件重启后的 UUID 稳定性、第五个 Pod 溢出到第二张 GPU,以及清理和运维陷阱。 | ||
|
|
||
| ::: | ||
|
|
||
| ## 验证环境 | ||
|
|
||
| | 组件 | 实测值 | | ||
| | ----------- | ------------------------------------------------ | | ||
| | GPU | 8 × NVIDIA RTX PRO 6000 Blackwell Server Edition | | ||
| | NVIDIA 驱动 | `610.43.02` | | ||
| | Kubernetes | `v1.35.6` | | ||
| | 操作系统 | Ubuntu 24.04.4 LTS | | ||
| | HAMi 源码 | `634bf2b32e68e07d3fbcbd6da1ee079392fc07c1` | | ||
|
|
||
| :::danger[只能有一个 MIG 硬件状态管理者] | ||
|
|
||
| NVIDIA GPU Operator MIG Manager 与 HAMi Dynamic MIG 都会创建和销毁 GI/CI。两者不得同时管理同一张物理 GPU。迁移现有节点前,请遵循固定版本的 [Dynamic MIG 迁移指南](https://github.com/Project-HAMi/HAMi/blob/634bf2b32e68e07d3fbcbd6da1ee079392fc07c1/docs/develop/dynamic-mig-migration.md)。 | ||
|
|
||
| ::: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Large diffs are not rendered by default.
Oops, something went wrong.
55 changes: 55 additions & 0 deletions
55
tutorials/labs/examples/17-dynamic-mig-rtx-pro/create-mixed-pods.sh
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,55 @@ | ||
| #!/usr/bin/env bash | ||
| set -euo pipefail | ||
|
|
||
| : "${NODE:?Set NODE to the Kubernetes node name}" | ||
| : "${GPU_UUID:?Set GPU_UUID to the physical GPU UUID used for the mixed-profile test}" | ||
|
|
||
| NAMESPACE=${NAMESPACE:-hami-mig-retest} | ||
|
|
||
| create_mig_pod() { | ||
| local name=$1 | ||
| local memory=$2 | ||
|
|
||
| kubectl apply -f - <<EOF | ||
| apiVersion: v1 | ||
| kind: Pod | ||
| metadata: | ||
| name: ${name} | ||
| namespace: ${NAMESPACE} | ||
| annotations: | ||
| nvidia.com/vgpu-mode: "mig" | ||
| hami.io/gpu-scheduler-policy: "binpack" | ||
| nvidia.com/use-gpuuuid: "${GPU_UUID}" | ||
| spec: | ||
| schedulerName: hami-scheduler | ||
| nodeSelector: | ||
| kubernetes.io/hostname: ${NODE} | ||
| containers: | ||
| - name: cuda | ||
| image: nvcr.io/nvidia/k8s/cuda-sample:vectoradd-cuda12.5.0-ubuntu22.04 | ||
| imagePullPolicy: IfNotPresent | ||
| command: | ||
| - bash | ||
| - -lc | ||
| - | | ||
| set -euo pipefail | ||
| n=0 | ||
| echo 0 > /tmp/gpu-progress | ||
| while true; do | ||
| /cuda-samples/vectorAdd > /tmp/vectoradd.last 2>&1 | ||
| n=\$((n + 1)) | ||
| echo "\$n" > /tmp/gpu-progress.next | ||
| mv /tmp/gpu-progress.next /tmp/gpu-progress | ||
| done | ||
| resources: | ||
| limits: | ||
| nvidia.com/gpu: 1 | ||
| nvidia.com/gpumem: ${memory} | ||
| EOF | ||
| } | ||
|
|
||
| create_mig_pod mixed-small 8000 | ||
| create_mig_pod mixed-large 30000 | ||
|
|
||
| kubectl wait -n "${NAMESPACE}" --for=condition=Ready \ | ||
| pod/mixed-small pod/mixed-large --timeout=180s |
60 changes: 60 additions & 0 deletions
60
tutorials/labs/examples/17-dynamic-mig-rtx-pro/hami-values.yaml
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,60 @@ | ||
| global: | ||
| imageTag: master-634bf2b32e68 | ||
|
|
||
| scheduler: | ||
| defaultSchedulerPolicy: | ||
| nodeSchedulerPolicy: binpack | ||
| gpuSchedulerPolicy: binpack | ||
| extender: | ||
| image: | ||
| registry: localhost | ||
| repository: hami-dynamic-mig | ||
| tag: master-634bf2b32e68 | ||
| pullPolicy: Never | ||
|
|
||
| devicePlugin: | ||
| image: | ||
| registry: localhost | ||
| repository: hami-dynamic-mig | ||
| tag: master-634bf2b32e68 | ||
| pullPolicy: Never | ||
| monitor: | ||
| image: | ||
| registry: localhost | ||
| repository: hami-dynamic-mig | ||
| tag: master-634bf2b32e68 | ||
| pullPolicy: Never | ||
|
|
||
| # NVIDIA's static MIG resource exposure strategy. This is not HAMi's | ||
| # per-node Dynamic MIG operating mode below. | ||
| migStrategy: none | ||
|
|
||
| # Steps 3 and 8 of the lab fill in the node name and the excluded GPU index | ||
| # list below before rendering. The verified run excluded [0, 1, 2, 3, 5, 6, 7], | ||
| # which registers only GPU 4. | ||
| nodeConfiguration: | ||
| config: | | ||
| { | ||
| "nodeconfig": [ | ||
| { | ||
| "name": "__NODE_NAME__", | ||
| "operatingmode": "mig", | ||
| "devicememoryscaling": 1, | ||
| "devicecorescaling": 1, | ||
| "devicesplitcount": 10, | ||
| "preconfigureddevicememory": 0, | ||
| "enablenumatopology": false, | ||
| "migstrategy": "none", | ||
| "filterdevices": { | ||
| "uuid": [], | ||
| "index": [__EXCLUDED_GPU_INDICES__] | ||
| }, | ||
| "enablegetpreferredallocation": false | ||
| } | ||
| ] | ||
| } | ||
|
|
||
| # Use the device-config.yaml bundled with the pinned source chart. It contains | ||
| # the RTX PRO 6000 profile allowlist tested by this lab. | ||
| device-config: | ||
| content: "" |
42 changes: 42 additions & 0 deletions
42
tutorials/labs/examples/17-dynamic-mig-rtx-pro/mig-small-pack.yaml
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,42 @@ | ||
| apiVersion: apps/v1 | ||
| kind: Deployment | ||
| metadata: | ||
| name: mig-small-pack | ||
| namespace: hami-mig-retest | ||
| spec: | ||
| replicas: 1 | ||
| selector: | ||
| matchLabels: | ||
| app: mig-small-pack | ||
| template: | ||
| metadata: | ||
| labels: | ||
| app: mig-small-pack | ||
| annotations: | ||
| nvidia.com/vgpu-mode: "mig" | ||
| hami.io/gpu-scheduler-policy: "binpack" | ||
| spec: | ||
| schedulerName: hami-scheduler | ||
| nodeSelector: | ||
| kubernetes.io/hostname: __NODE_NAME__ | ||
| containers: | ||
| - name: cuda | ||
| image: nvcr.io/nvidia/k8s/cuda-sample:vectoradd-cuda12.5.0-ubuntu22.04 | ||
| imagePullPolicy: IfNotPresent | ||
| command: | ||
| - bash | ||
| - -lc | ||
| - | | ||
| set -euo pipefail | ||
| n=0 | ||
| echo 0 > /tmp/gpu-progress | ||
| while true; do | ||
| /cuda-samples/vectorAdd > /tmp/vectoradd.last 2>&1 | ||
| n=$((n + 1)) | ||
| echo "$n" > /tmp/gpu-progress.next | ||
| mv /tmp/gpu-progress.next /tmp/gpu-progress | ||
| done | ||
| resources: | ||
| limits: | ||
| nvidia.com/gpu: 1 | ||
| nvidia.com/gpumem: 8000 | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
Repository: Project-HAMi/website
Length of output: 202
🏁 Script executed:
Repository: Project-HAMi/website
Length of output: 9503
🌐 Web query:
nvcr.io/nvidia/k8s/cuda-sample:vectoradd-cuda12.5.0-ubuntu22.04 Dockerfile non-root UID 65532💡 Result:
The image nvcr.io/nvidia/k8s/cuda-sample:vectoradd-cuda12.5.0-ubuntu22.04 does not inherently enforce a non-root user [1][2]. Like many standard NVIDIA CUDA base images, it typically defaults to the root user [3]. The user ID 65532 mentioned in your query is a common non-root UID (often referred to as 'nonroot') used in specific NVIDIA hardened container images, such as those for the NVIDIA GPU Operator, to adhere to security best practices and the principle of least privilege [4][5]. If you need to run a container as a non-root user (e.g., UID 65532) while maintaining GPU access, keep the following technical considerations in mind: 1. Permission to Devices: Access to NVIDIA GPU devices is managed by the NVIDIA Container Toolkit [6]. The toolkit automatically injects the necessary group IDs (GIDs) from the host into the container, allowing non-root users to access device nodes (such as /dev/nvidia0) without needing root privileges [6]. 2. Group Warnings: You may see warnings about unresolved GIDs in the container's /etc/group file [6]. This is a cosmetic issue because the device access is granted via the group ID itself, not by resolving the group name [6]. 3. Custom Implementation: To run the referenced cuda-sample image as non-root, you would typically need to extend it via a Dockerfile or configure the Kubernetes Pod security context to run as the desired user [3]. Ensure that any directories required by your application (like cache or output paths) are owned by your chosen UID [3][5]. For environments requiring high security, refer to NVIDIA's hardened container guidelines, which emphasize using specific runtime images already configured for non-root execution [5].
Citations:
🏁 Script executed:
Repository: Project-HAMi/website
Length of output: 2618
Security Misconfiguration (CWE-250)
Reachability: Internal · Exploitability: Difficult
Apply a hardened security context to both workload paths.
Both workloads run the CUDA container without restrictions on its user or privilege-escalation policy. Add
runAsNonRoot,allowPrivilegeEscalation: false, dropped capabilities, andseccompProfile: RuntimeDefaultto bothcudacontainers. Use UID65532only after confirming that the image can execute/cuda-samples/vectorAddand write its files under/tmpas that UID.🧰 Tools
🪛 Checkov (3.3.11)
[medium] 1-42: Containers should not run with allowPrivilegeEscalation
(CKV_K8S_20)
[medium] 1-42: Minimize the admission of root containers
(CKV_K8S_23)
📍 Affects 2 files
tutorials/labs/examples/15-dynamic-mig-rtx-pro/mig-small-pack.yaml#L23-L25(this comment)tutorials/labs/examples/15-dynamic-mig-rtx-pro/create-mixed-pods.sh#L27-L30🤖 Prompt for AI Agents
Source: Linters/SAST tools