Red Hat build of MicroShift

Deploy applications that use generic devices

After the Generic Device Plugin (GDP) is configured and enabled in MicroShift, you can deploy Kubernetes workloads, such as pods, deployments, or StatefulSets, that request access to the host devices that you have exposed. Devices are made available inside the container without requiring the pod to run with elevated privileges.

Prerequisites

You installed MicroShift.
You enabled and configured GDP.
You installed OpenShift CLI (oc).

Procedure

Define the device request in your Pod specification:

apiVersion: v1
kind: Pod
metadata:
  name: device-app
spec:
  containers:
  - name: container
    image: <your_application_image> 
    command: ["/path/to/your/app"] 
    args: ["--device_path=/dev/video0"] 
    resources:
      limits: 
        device.microshift.io/video: 1 
    securityContext: 
      allowPrivilegeEscalation: false
      capabilities:
        drop: ["ALL"]
      runAsNonRoot: true
      seccompProfile:
        type: "RuntimeDefault"

	Replace with your container image.
	Replace with the command for your application.
	For example, how your application might use the device.
	The resource name must follow the pattern `device.microshift.io/<device_name>`, where `<device_name>` matches the `name` that you specified in your configuration file.
	A request for one instance of the `video` device.
	Define and configure with the least privilege value to ensure that the container has only required permissions, such as access to the device file, and to restrict other capabilities for the container.

Deploy the Kubernetes workload by applying the manifest to the MicroShift node by running the following command:
```
$ oc apply -f <your-workload-manifest.yaml> 
```
Replace <your_workload_manifest> with the name of your workload manifest.

Results

After the pod is running, the specified host device is available at its original path, or mountPath if specified, inside the container. Your application can then interact with it as if it were a local device.

For example, if you requested device.microshift.io/serial, which maps to /dev/ttyUSB*, your application might find the device at /dev/ttyUSB0 or a similar path inside the container.

Verification

Verify device access by running the following command inside the running pod:
```
$ oc exec -it <pod_name> -- ls -l /dev/video0 
```
Replace <pod_name> with the name of the pod.