Fix DRA for in-tree driver mode: nodeSelector and NetworkPolicy egress

- Use module selector (not kernel version-based selector) for DRA
  DaemonSet when moduleLoader is nil (in-tree driver mode)
- Add allow-all egress rule to DRA NetworkPolicy so the kubelet
  plugin can reach the API server to manage ResourceSlices

Signed-off-by: Anthony Byrne <abyrne@redhat.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: abyrne55

internal/controllers/dra_reconciler.go

@@ -483,6 +483,8 @@ func (dsci *draDaemonSetCreatorImpl) setDRAAsDesired(
 		versionLabel := utils.GetSchedulePluginVersionLabelName(mod.Namespace, mod.Name)
 		standardLabels[versionLabel] = mod.Spec.ModuleLoader.Container.Version
 		nodeSelector[versionLabel] = mod.Spec.ModuleLoader.Container.Version
+	} else if mod.Spec.ModuleLoader == nil {
+		nodeSelector = mod.Spec.Selector
 	}
 
 	ds.SetLabels(

internal/networkpolicy/networkpolicy.go

@@ -201,6 +201,9 @@ func (np *networkPolicy) DRANetworkPolicy(namespace string) *networkingv1.Networ
 					"app.kubernetes.io/component": "dra",
 				},
 			},
+			Egress: []networkingv1.NetworkPolicyEgressRule{
+				{}, // Allow all egress — DRA kubelet plugin needs API server access for ResourceSlice management
+			},
 			PolicyTypes: []networkingv1.PolicyType{
 				networkingv1.PolicyTypeIngress,
 				networkingv1.PolicyTypeEgress,