From c4c586d57ea439c247c4a1db169378c4d3824328 Mon Sep 17 00:00:00 2001
From: Cloud User <ubuntu@dv2-kr3-ins-bastion-01.novalocal>
Date: Wed, 4 Mar 2026 16:03:32 +0900
Subject: [PATCH] feat: add HostDeviceNetwork template, remove infiniband
 hostPath, disable privileged

- Add hostdevicenetwork.yaml template (whereabouts IPAM)
- New values: network.resourceName, networkNamespace, ipam.range/exclude
- Remove /dev/infiniband hostPath volume and volumeMount
- Set privileged: false in securityContext
- Bump chart version to 0.2.0
---
 nccl-perftest/Chart.yaml                      |  2 +-
 .../templates/hostdevicenetwork.yaml          | 21 +++++++++++++++++++
 nccl-perftest/templates/statefulset.yaml      |  8 +------
 nccl-perftest/values.yaml                     |  9 ++++++--
 4 files changed, 30 insertions(+), 10 deletions(-)
 create mode 100644 nccl-perftest/templates/hostdevicenetwork.yaml

diff --git a/nccl-perftest/Chart.yaml b/nccl-perftest/Chart.yaml
index 369f598..a7629b3 100644
--- a/nccl-perftest/Chart.yaml
+++ b/nccl-perftest/Chart.yaml
@@ -2,5 +2,5 @@ apiVersion: v2
 name: nccl-perftest
 description: Multi-node NCCL distributed training performance test
 type: application
-version: 0.1.0
+version: 0.2.0
 appVersion: "1.0.0"
diff --git a/nccl-perftest/templates/hostdevicenetwork.yaml b/nccl-perftest/templates/hostdevicenetwork.yaml
new file mode 100644
index 0000000..e2664a6
--- /dev/null
+++ b/nccl-perftest/templates/hostdevicenetwork.yaml
@@ -0,0 +1,21 @@
+apiVersion: mellanox.com/v1alpha1
+kind: HostDeviceNetwork
+metadata:
+  name: {{ .Values.network.nadName }}
+  labels:
+    {{- include "nccl-perftest.labels" . | nindent 4 }}
+spec:
+  ipam: |
+    {
+      "type": "whereabouts",
+      "datastore": "kubernetes",
+      "kubernetes": {
+        "kubeconfig": "/etc/cni/net.d/whereabouts.d/whereabouts.kubeconfig"
+      },
+      "range": {{ .Values.network.ipam.range | quote }},
+      "exclude": {{ .Values.network.ipam.exclude | toJson }},
+      "log_file": "/var/log/whereabouts.log",
+      "log_level": "info"
+    }
+  resourceName: {{ .Values.network.resourceName }}
+  networkNamespace: {{ .Values.network.networkNamespace }}
diff --git a/nccl-perftest/templates/statefulset.yaml b/nccl-perftest/templates/statefulset.yaml
index 95e2c16..4281c19 100644
--- a/nccl-perftest/templates/statefulset.yaml
+++ b/nccl-perftest/templates/statefulset.yaml
@@ -22,7 +22,7 @@ spec:
           image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           securityContext:
-            privileged: true
+            privileged: false
             capabilities:
               add:
                 - IPC_LOCK
@@ -55,8 +55,6 @@ spec:
               mountPath: /config_scripts
             - name: shared-memory
               mountPath: /dev/shm
-            - name: infiniband
-              mountPath: /dev/infiniband
             - name: cifar-data
               mountPath: /workspace/data/cifar-10-batches-py
       volumes:
@@ -68,10 +66,6 @@ spec:
           emptyDir:
             medium: Memory
             sizeLimit: {{ .Values.shmSize }}
-        - name: infiniband
-          hostPath:
-            path: {{ .Values.volumes.infiniband.hostPath }}
-            type: Directory
         - name: cifar-data
           hostPath:
             path: {{ .Values.volumes.dataset.hostPath }}
diff --git a/nccl-perftest/values.yaml b/nccl-perftest/values.yaml
index c8a2249..e62b6e4 100644
--- a/nccl-perftest/values.yaml
+++ b/nccl-perftest/values.yaml
@@ -21,6 +21,13 @@ shmSize: "128Gi"
 
 network:
   nadName: "hostdevice-net"
+  resourceName: "hostdev"
+  networkNamespace: "nvidia-network-operator"
+  ipam:
+    range: "10.100.0.0/28"
+    exclude:
+      - "10.100.0.0"
+      - "10.100.0.15"
 
 nccl:
   debug: "INFO"
@@ -31,7 +38,5 @@ nccl:
   debugFile: ""      # 비어있으면 설정 안 함
 
 volumes:
-  infiniband:
-    hostPath: "/dev/infiniband"
   dataset:
     hostPath: "/home/ubuntu/cifar-10-batches-py"