refactor: helm chart testing

Signed-off-by: thxCode <thxcode0824@gmail.com>

Author: thxCode

.github/workflows/ci-chart.yml

@@ -1,6 +1,6 @@
-# This workflow lints and tests the Helm chart on pull requests that touch
-# chart-related files, and publishes it to the gh-pages Helm repository on
-# version tags.
+# This workflow lints and tests the Helm chart on pull requests/pushes that
+# touch chart-related files, and publishes it to the gh-pages Helm repository
+# on version tags.
 
 name: ci-chart
 
@@ -34,7 +34,6 @@ on:
 
 jobs:
   lint-test:
-    if: ${{ github.event_name == 'pull_request' }}
     timeout-minutes: 60
     runs-on: ubuntu-24.04
     steps:
@@ -58,11 +57,11 @@ jobs:
           key: chart-toolbox-${{ runner.os }}
           path: |-
             ${{ github.workspace }}/.sbin
-#      - name: Setup Kind
-#        uses: helm/kind-action@v1
-#        with:
-#          config: .github/configs/kind-config.yaml
-#          version: v0.32.0
+      - name: Setup Kind
+        uses: helm/kind-action@v1
+        with:
+          config: .github/configs/kind-config.yaml
+          version: v0.32.0
       - name: Generate
         run: make generate chart
       - name: Verify Generated
@@ -81,15 +80,17 @@ jobs:
           fi
       - name: Lint
         run: make lint chart
-#      # NB(thxCode): the worker installs Node Feature Discovery, Kueue and the CSI
-#      # drivers at runtime in this phase, so the test needs network egress and the
-#      # released operator image; the device-manager DaemonSets stay at 0 desired
-#      # on the GPU-less kind nodes.
-#      - name: Test
-#        run: make test chart
+      # NB(thxCode): the worker installs Node Feature Discovery, Kueue and the CSI
+      # drivers at runtime in this phase, so the test needs network egress and the
+      # released operator image; the device-manager DaemonSets stay at 0 desired
+      # on the GPU-less kind nodes.
+      - name: Test
+        run: make test chart
 
   pack:
     if: ${{ startsWith(github.ref, 'refs/tags/') }}
+    needs:
+      - lint-test
     timeout-minutes: 30
     runs-on: ubuntu-24.04
     permissions:

deploy/gpustack-operator/chart/templates/device-manager/daemonset.yaml

@@ -144,6 +144,12 @@ spec:
               mountPath: /dev
             - name: sys-dir
               mountPath: /sys
+            - name: tmp-dir
+              mountPath: /tmp
+            - name: containerd-run-dir
+              mountPath: /run/containerd
+            - name: docker-run-dir
+              mountPath: /run/docker
             - name: gpustack-data-dir
               mountPath: /var/lib/gpustack
             - name: cdi-dir
@@ -181,10 +187,6 @@ spec:
               mountPath: /usr/local/corex
               readOnly: true
             {{- end }}
-            {{- if eq $manu "nvidia" }}
-            - name: gpustack-nvidia-vgpulock-dir
-              mountPath: /tmp/vgpulock
-            {{- end }}
             {{- if eq $manu "metax" }}
             - name: gpustack-metax-driver
               mountPath: /opt/mxdriver
@@ -207,6 +209,17 @@ spec:
           hostPath:
             path: /sys
             type: Directory
+        - name: tmp-dir
+          hostPath:
+            path: /tmp
+        - name: containerd-run-dir
+          hostPath:
+            path: /run/containerd
+            type: DirectoryOrCreate
+        - name: docker-run-dir
+          hostPath:
+            path: /run/docker
+            type: DirectoryOrCreate
         - name: gpustack-data-dir
           hostPath:
             path: /var/lib/gpustack
@@ -257,12 +270,6 @@ spec:
             path: /usr/local/corex
             type: DirectoryOrCreate
         {{- end }}
-        {{- if eq $manu "nvidia" }}
-        - name: gpustack-nvidia-vgpulock-dir
-          hostPath:
-            path: /tmp/vgpulock
-            type: Directory
-        {{- end }}
         {{- if eq $manu "metax" }}
         - name: gpustack-metax-driver
           hostPath:

hack/lib/helm.sh

@@ -240,5 +240,5 @@ function gpustack::helm::test() {
     ct install \
     --charts "${target#"${ROOT_DIR}/"}" \
     --chart-repos "${chart_repos}" \
-    --helm-extra-args "--timeout 600s"
+    --helm-extra-args "--timeout 600s --wait"
 }

pkg/worker/webhooks/worker/nodefeature.go

@@ -24,9 +24,15 @@ import (
 // when the node's Devices CR is available) counts exceeding the card's hardware
 // MaxPartitions. Other NodeFeature objects are not validated.
 //
+// The webhook is scoped by an objectSelector to the worker-owned NodeFeatures
+// (label "app.kubernetes.io/part-of=gpustack-operator-worker") so that the
+// NFD worker's per-node NodeFeature publishing is never gated on this
+// FailurePolicy=Fail webhook's backend being reachable.
+//
 // nolint: lll
 // +k8s:webhook-gen:validating:group="nfd.k8s-sigs.io",version="v1alpha1",resource="nodefeatures",scope="Namespaced"
 // +k8s:webhook-gen:validating:operations=["CREATE","UPDATE"],failurePolicy="Fail",sideEffects="None",matchPolicy="Equivalent",timeoutSeconds=10
+// +k8s:webhook-gen:validating:objectSelector={"matchLabels":{"app.kubernetes.io/part-of":"gpustack-operator-worker"}}
 type NodeFeatureWebhook struct {
 	Client    ctrlcli.Client
 	APIReader ctrlcli.Reader