Repository: intel/intel-device-plugins-for-kubernetes
Pull request #1088 (2022-07-28 09:25:31)

dlb: add initcontainer to plugin
Closes: #1053 

initcontainer enables vfs and configures vfs
 - the number of pfs and vfs per pf can be configurable by users
add dlb-initcontainer kustomize overlay
update CRD to have initImage
implment operator to run initcontainer
update e2e test to run initcontainer overlay
pudate envtest to test initimage

Signed-off-by: Hyeongju Johannes Lee <hyeongju.lee@intel.com>

---
TO BE DISCUSSED & IMPROVED:
1. Do we actually keep the variable "REMAINING_NUM_PFS"? Or find another way?
2. How to have no 'default' values for variables ("REMAINING_NUM_PFS", "NUM_VFS_PER_PF) in the script, yaml, etc.
3. This PR does not have any change of CRD for the variables. Do we include here, or later in another PR?

*There will be no more work for this PR until September.

bart0sh: > initcontainer enables 4 vfs from each pf and configures vfs (this might need to be improved, but for now, I and Mikko agreed to just set static number 4 for each pf.)

This most probably won't work in Simics. I was only able to create one VF per PF there.
hj-johannes-lee: > This most probably won't work in Simics. I was only able to create one VF per PF there.

:(
What is the desirable thing to run with initcontainer image?
Do we run with docker image?
bart0sh: 
>  What is the desirable thing to run with initcontainer image? Do we run with docker?
CI doesn't have docker as far as I know. It uses either CRI-O or Containerd.


codecov-commenter: # [Codecov](https://codecov.io/gh/intel/intel-device-plugins-for-kubernetes/pull/1088?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=intel) Report
> Merging [#1088](https://codecov.io/gh/intel/intel-device-plugins-for-kubernetes/pull/1088?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=intel) (e76f4a8) into [main](https://codecov.io/gh/intel/intel-device-plugins-for-kubernetes/commit/aefdc3fb0974000c3d9982fb0d8741bef7630aea?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=intel) (aefdc3f) will **decrease** coverage by `0.53%`.
> The diff coverage is `21.42%`.

```diff
@@            Coverage Diff             @@
##             main    #1088      +/-   ##
==========================================
- Coverage   53.01%   52.48%   -0.54%     
==========================================
  Files          40       40              
  Lines        4350     4413      +63     
==========================================
+ Hits         2306     2316      +10     
- Misses       1917     1968      +51     
- Partials      127      129       +2     
```


| [Impacted Files](https://codecov.io/gh/intel/intel-device-plugins-for-kubernetes/pull/1088?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=intel) | Coverage Δ | |
|---|---|---|
| [pkg/controllers/dlb/controller.go](https://codecov.io/gh/intel/intel-device-plugins-for-kubernetes/pull/1088/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=intel#diff-cGtnL2NvbnRyb2xsZXJzL2RsYi9jb250cm9sbGVyLmdv) | `16.40% <21.42%> (-0.52%)` | :arrow_down: |
| [pkg/controllers/reconciler.go](https://codecov.io/gh/intel/intel-device-plugins-for-kubernetes/pull/1088/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=intel#diff-cGtnL2NvbnRyb2xsZXJzL3JlY29uY2lsZXIuZ28=) | `4.25% <0.00%> (ø)` | |

:mega: Codecov can now indicate which changes are the most critical in Pull Requests. [Learn more](https://about.codecov.io/product/feature/runtime-insights/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=intel)

hj-johannes-lee: @bart0sh @mythi e2e fails because pf is not available anymore after vfs are made.
What decision would we need to make for this?
bart0sh: > e2e fails because pf is not available anymore after vfs are made. What decision would we need to make for this?

Why it's not available? e2e test from main works with VF and PF as far as I can see here: https://github.com/intel/intel-device-plugins-for-kubernetes/blob/main/test/e2e/dlb/dlb.go#L63:L68
hj-johannes-lee: @bart0sh Do you have an idea on the default value for PF and VF?
I just set it as 4 and 4, but if you think it's better to set with other numbers, let me change it.!
bart0sh: > Do you have an idea on the default value for PF and VF?
I'd not use default values for them if possible. It depends on the workload requirements I guess, so I don't see any reasons for setting default values.
bart0sh: @hj-johannes-lee before merging it we need to ensure we can remove DLB configuration script from CI images.
hj-johannes-lee: > @mythi @hj-johannes-lee before merging it we need to ensure we can remove DLB configuration script from CI images.

@bart0sh Would the failure of e2e test of DLB be related to what you said before? Well, since you told many times, I am anyway aware that there should be some changes in the simics for dlb, but idk whether it is related to the failure of this e2e test.!
bart0sh: > @bart0sh Would the failure of e2e test of DLB be related to what you said before?

It's hard to say based on e2e test output. I'd suggest to get the initcontainer logs in the e2e code and include them into the output. This way you can see why did it fail.


hj-johannes-lee: @bart0sh When I test in an spr machine, then e2e test successfully runs without any problem.!
Thank you for your suggestion, but I already somewhat guess the cause of it is. Can I just confirm one thing before doing as you suggested?
Are there two pfs inside the simics, and one of them is used for configuration of vf?
mythi: Note that the test does not seem to fail due to missing `dlb.intel.com` resources but because the initcontainer does not run.


okartau: What about testing on dev-side e2e where I can temporarily disable bmaas-activated part in dev-dedicated instance(s)
mythi: > What about testing on dev-side e2e where I can temporarily disable bmaas-activated part in dev-dedicated instance(s)

makes sense as we will anyway need to test without the setup script. 
hj-johannes-lee: e2e-dlb passed, shellchecked. 
hj-johannes-lee: @bart0sh No. If there is vf, then the pf used for configuring vf is not configured again.

> dev=$(realpath /sys/bus/pci/drivers/dlb2/????:??:??\.0 | head -1)

First, only first PF is the device that is considered to be configured.

>   if test -w "$SRIOV_NUMVFS_PATH" -a "$(cat "$SRIOV_NUMVFS_PATH")" -eq 0 ; then  

Second, if the PF is already configured (if sriov_numvfs != 0), then we skip configuration.
hj-johannes-lee: One thing stupid in the script is.. that
1. We can set only one vf because there is "default" values for resources (num_atomic_inflights, num_dir_credits, etc).
2. There is still 'for' loop that is meant for setting multiple vfs...
bart0sh: @hj-johannes-lee before merging this PR I'd like to see it working in dev environment. Please send PR there and make sure all tests succeed.

Patch:
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 3c9963fe..1467a834 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -10,7 +10,7 @@ on:
       - 'release-*'
 env:
   GO_VERSION: 1.19
-  K8S_VERSION: 1.25.0
+  K8S_VERSION: 1.24.2
 permissions:
   contents: read
 
@@ -58,7 +58,7 @@ jobs:
       - name: golangci-lint
         uses: golangci/golangci-lint-action@v3
         with:
-          version: v1.49.0
+          version: v1.48.0
           args: -v --timeout 5m
 
   build:
@@ -120,6 +120,7 @@ jobs:
           - intel-iaa-plugin
           - intel-idxd-config-initcontainer
           - intel-dlb-plugin
+          - intel-dlb-initcontainer
 
           # Demo images
           - crypto-perf
diff --git a/.golangci.yml b/.golangci.yml
index 92ca0c4c..f866ee03 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -10,6 +10,7 @@ linters:
   enable:
     - asciicheck
     - bodyclose
+    - deadcode
     - dogsled
     - errcheck
     - exportloopref
@@ -32,11 +33,14 @@ linters:
     - nolintlint
     - prealloc
     - revive
+    - rowserrcheck
     - staticcheck
+    - structcheck
     - stylecheck
     - typecheck
     - unconvert
     - unused
+    - varcheck
     - whitespace
     - wsl
 
diff --git a/DEVEL.md b/DEVEL.md
index a92627fb..ac75de46 100644
--- a/DEVEL.md
+++ b/DEVEL.md
@@ -93,7 +93,7 @@ $ make <image-build-target>
 Repeat the last step only, unless you change library dependencies. If you pull in new sources, start again from `make vendor`.
 
 **Note:** The image build tool can be changed from the default `docker` by setting the `BUILDER` argument
-to the [`Makefile`](Makefile): `make <image-build-target> BUILDER=<builder>`. Supported values are `docker`, `buildah`, and `podman`.
+to the [`Makefile`](Makefile): `make <image-build-target> BUILDER=buildah`.
 
 ### Build Against a Newer Version of Kubernetes
 
diff --git a/Jenkinsfile b/Jenkinsfile
index 3b215644..fd09d44b 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -8,8 +8,8 @@ pipeline {
   environment {
     GO111MODULE="on"
     REG="cloud-native-image-registry.westus.cloudapp.azure.com/"
-    K8S_VERSION="1.25.0"
-    GOLANGCI_LINT_VERSION="v1.49.0"
+    K8S_VERSION="1.24.2"
+    GOLANGCI_LINT_VERSION="v1.48.0"
     GO_VERSION="1.19"
     GO_TAR="go${GO_VERSION}.linux-amd64.tar.gz"
     GOROOT="/usr/local/go"
diff --git a/Makefile b/Makefile
index c9a16b94..c77fc132 100644
--- a/Makefile
+++ b/Makefile
@@ -8,11 +8,11 @@ BUILDTAGS ?= ""
 BUILDER ?= "docker"
 EXTRA_BUILD_ARGS ?= ""
 
-CERT_MANAGER_VERSION ?= v1.9.1
-CONTROLLER_GEN_VERSION ?= v0.10.0
-GOLANGCI_LINT_VERSION ?= v1.49.0
-KIND_VERSION ?= v0.16.0
-GOLICENSES_VERSION ?= v1.4.0
+CERT_MANAGER_VERSION ?= v1.8.1
+CONTROLLER_GEN_VERSION ?= v0.9.2
+GOLANGCI_LINT_VERSION ?= v1.48.0
+KIND_VERSION ?= v0.14.0
+GOLICENSES_VERSION ?= v1.2.0
 # Current Operator version
 OPERATOR_VERSION ?= 0.24.0
 # Default bundle image tag
@@ -176,7 +176,7 @@ terrascan:
 
 pre-pull:
 ifeq ($(TAG),devel)
-	@$(BUILDER) pull golang:1.19-bullseye
+	@$(BUILDER) pull golang:1.18-bullseye
 	@$(BUILDER) pull debian:unstable-slim
 	@$(BUILDER) pull clearlinux:latest
 	@$(BUILDER) pull ubuntu:20.04
@@ -273,6 +273,13 @@ _work/venv/.stamp: docs/requirements.txt
 	. ${@D}/bin/activate && pip install wheel && pip install -r $<
 	touch $@
 
+helm:
+	$(CONTROLLER_GEN) crd:crdVersions=v1 \
+		paths="./pkg/apis/..." \
+		output:crd:artifacts:config=charts/operator/crds
+	helm package charts/operator
+	helm package charts/sgx
+
 clean-licenses:
 	rm -rf licenses
 
diff --git a/README.md b/README.md
index d3594dd5..6120d6fb 100644
--- a/README.md
+++ b/README.md
@@ -93,7 +93,7 @@ The [FPGA prestart CRI-O hook](cmd/fpga_crihook/README.md) performs discovery
 of the requested FPGA function bitstream and programs FPGA devices based on the
 environment variables in the workload description.
 
-### [QAT](https://developer.intel.com/quickassist) Device Plugin
+### [QAT](https://01.org/intel-quick-assist-technology) Device Plugin
 
 The [QAT plugin](cmd/qat_plugin/README.md) supports device plugin for Intel QAT adapters, and includes
 code [showing deployment](cmd/qat_plugin/dpdkdrv) via [DPDK](https://doc.dpdk.org/guides/cryptodevs/qat.html).
@@ -316,9 +316,4 @@ A related Intel SRIOV network device plugin can be found in
 
 ### Helm Charts
 
-Device Plugins Helm Charts are located in Intel Helm Charts repository [Intel Helm Charts](https://github.com/intel/helm-charts). This is another way of distributing Kubernetes resources of the device plugins framework.
-
-To add repo:
-```
-helm repo add intel https://intel.github.io/helm-charts
-```
+The [helm charts](charts/README.md) is one way of distributing Kubernetes resources of the device plugins framework.
diff --git a/build/docker/build-image.sh b/build/docker/build-image.sh
index f13a9cf5..e1ad6da6 100755
--- a/build/docker/build-image.sh
+++ b/build/docker/build-image.sh
@@ -16,7 +16,7 @@ fi
 
 shift
 
-if [ "$1" = 'docker' -o "$1" = 'buildah' -o "$1" = 'podman' ]; then
+if [ "$1" = 'docker' -o "$1" = 'buildah' ]; then
     BUILDER=$1
     shift
 fi
@@ -30,8 +30,8 @@ if [ -d $(dirname $0)/../../vendor ] ; then
 fi
 
 BUILD_ARGS="${BUILD_ARGS} --build-arg FINAL_BASE=gcr.io/distroless/static"
-if [ -z "${BUILDER}" -o "${BUILDER}" = 'docker' -o "${BUILDER}" = 'podman' ] ; then
-    ${BUILDER} build --pull -t ${IMG}:${TAG} ${BUILD_ARGS} -f ${DOCKERFILE} .
+if [ -z "${BUILDER}" -o "${BUILDER}" = 'docker' ] ; then
+    docker build --pull -t ${IMG}:${TAG} ${BUILD_ARGS} -f ${DOCKERFILE} .
 elif [ "${BUILDER}" = 'buildah' ] ; then
     BUILDAH_RUNTIME=runc buildah bud --pull-always -t ${IMG}:${TAG} ${BUILD_ARGS} -f ${DOCKERFILE} .
 else
diff --git a/build/docker/intel-dlb-initcontainer.Dockerfile b/build/docker/intel-dlb-initcontainer.Dockerfile
new file mode 100644
index 00000000..3f7f2c1f
--- /dev/null
+++ b/build/docker/intel-dlb-initcontainer.Dockerfile
@@ -0,0 +1,61 @@
+## This is a generated file, do not edit directly. Edit build/docker/templates/intel-dlb-initcontainer.Dockerfile.in instead.
+##
+## Copyright 2022 Intel Corporation. All Rights Reserved.
+##
+## Licensed under the Apache License, Version 2.0 (the "License");
+## you may not use this file except in compliance with the License.
+## You may obtain a copy of the License at
+##
+## http://www.apache.org/licenses/LICENSE-2.0
+##
+## Unless required by applicable law or agreed to in writing, software
+## distributed under the License is distributed on an "AS IS" BASIS,
+## WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+## See the License for the specific language governing permissions and
+## limitations under the License.
+###
+## FINAL_BASE can be used to configure the base image of the final image.
+##
+## This is used in two ways:
+## 1) make <image-name> BUILDER=<docker|buildah>
+## 2) docker build ... -f <image-name>.Dockerfile
+##
+## The project default is 1) which sets FINAL_BASE=gcr.io/distroless/static
+## (see build-image.sh).
+## 2) and the default FINAL_BASE is primarily used to build Redhat Certified Openshift Operator container images that must be UBI based.
+## The RedHat build tool does not allow additional image build parameters.
+ARG FINAL_BASE=registry.access.redhat.com/ubi8-micro
+###
+##
+## GOLANG_BASE can be used to make the build reproducible by choosing an
+## image by its hash:
+## GOLANG_BASE=golang@sha256:9d64369fd3c633df71d7465d67d43f63bb31192193e671742fa1c26ebc3a6210
+##
+## This is used on release branches before tagging a stable version.
+## The main branch defaults to using the latest Golang base image.
+ARG GOLANG_BASE=golang:1.19-bullseye
+###
+FROM ${GOLANG_BASE} as builder
+ARG DIR=/intel-device-plugins-for-kubernetes
+WORKDIR $DIR
+COPY . .
+ARG TOYBOX_VERSION="0.8.7"
+ARG TOYBOX_SHA256="b6f43d5738df54623ed21c32f430d1d5c5ac7ef465a6a883890f104b59d5d9e4"
+ARG ROOT=/install_root
+RUN apt update && apt -y install musl musl-tools musl-dev
+RUN curl -SL https://github.com/landley/toybox/archive/refs/tags/$TOYBOX_VERSION.tar.gz -o toybox.tar.gz \
+    && echo "$TOYBOX_SHA256 toybox.tar.gz" | sha256sum -c - \
+    && tar -xzf toybox.tar.gz \
+    && rm toybox.tar.gz \
+    && cd toybox-$TOYBOX_VERSION \
+    && KCONFIG_CONFIG=${DIR}/build/docker/toybox-config LDFLAGS="--static" CC=musl-gcc PREFIX=$ROOT V=2 make toybox install \
+    && install -D LICENSE $ROOT/licenses/toybox \
+    && cp -r /usr/share/doc/musl $ROOT/licenses/
+###
+FROM ${FINAL_BASE}
+LABEL vendor='Intel®'
+LABEL version='devel'
+LABEL release='1'
+COPY --from=builder /install_root /
+COPY demo/dlb-init.sh /usr/bin/
+ENTRYPOINT [ "/bin/bash", "dlb-init.sh"]
diff --git a/build/docker/templates/intel-dlb-initcontainer.Dockerfile.in b/build/docker/templates/intel-dlb-initcontainer.Dockerfile.in
new file mode 100644
index 00000000..0e5fb605
--- /dev/null
+++ b/build/docker/templates/intel-dlb-initcontainer.Dockerfile.in
@@ -0,0 +1,19 @@
+#include "final_base.docker"
+#include "golang_base.docker"
+
+FROM ${GOLANG_BASE} as builder
+
+ARG DIR=/intel-device-plugins-for-kubernetes
+WORKDIR $DIR
+COPY . .
+
+#include "toybox_build.docker"
+
+FROM ${FINAL_BASE}
+
+#include "default_labels.docker"
+
+COPY --from=builder /install_root /
+
+COPY demo/dlb-init.sh /usr/bin/
+ENTRYPOINT [ "/bin/bash", "dlb-init.sh"]
diff --git a/build/docker/toybox-config b/build/docker/toybox-config
index bc1f288f..0014707e 100644
--- a/build/docker/toybox-config
+++ b/build/docker/toybox-config
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
 # ToyBox version: KCONFIG_VERSION
-# Wed Jun  8 09:08:35 2022
+# Thu Sep 29 05:22:30 2022
 #
 CONFIG_TOYBOX_CONTAINER=y
 CONFIG_TOYBOX_FIFREEZE=y
@@ -19,7 +19,7 @@ CONFIG_TOYBOX_COPYFILERANGE=y
 #
 # Posix commands
 #
-# CONFIG_BASENAME is not set
+CONFIG_BASENAME=y
 # CONFIG_CAL is not set
 CONFIG_CAT=y
 # CONFIG_CHGRP is not set
@@ -38,7 +38,7 @@ CONFIG_CP=y
 # CONFIG_DF is not set
 # CONFIG_DIRNAME is not set
 # CONFIG_DU is not set
-# CONFIG_ECHO is not set
+CONFIG_ECHO=y
 # CONFIG_ENV is not set
 # CONFIG_EXPAND is not set
 # CONFIG_FALSE is not set
@@ -48,7 +48,7 @@ CONFIG_CP=y
 CONFIG_GREP=y
 CONFIG_EGREP=y
 CONFIG_FGREP=y
-# CONFIG_HEAD is not set
+CONFIG_HEAD=y
 # CONFIG_ICONV is not set
 # CONFIG_ID is not set
 # CONFIG_ID_Z is not set
@@ -263,7 +263,7 @@ CONFIG_LSPCI=y
 # CONFIG_READAHEAD is not set
 # CONFIG_READELF is not set
 # CONFIG_READLINK is not set
-# CONFIG_REALPATH is not set
+CONFIG_REALPATH=y
 # CONFIG_REBOOT is not set
 # CONFIG_RESET is not set
 # CONFIG_REV is not set
diff --git a/charts/README.md b/charts/README.md
new file mode 100644
index 00000000..4ee3c4a2
--- /dev/null
+++ b/charts/README.md
@@ -0,0 +1,20 @@
+## Helm charts
+
+Make "helm" target provides a way to to create a versioned chart archive file:
+
+```
+$ make helm
+```
+
+The generated chart archives can be uploaded to helm package repository to enable further distribution. It is also needed to generate an index file and upload it to the repository.
+
+```
+helm repo index intel-device-plugins-operator-VERSION.tgz
+```
+
+To download a chart directly from a repository, use the following commands:
+
+```
+$ helm pull intel-device-plugins-chart-repo/intel-device-plugins-helm-chart
+$ helm install intel-device-plugins intel-device-plugins-chart-repo/intel-device-plugins-helm-chart
+```
diff --git a/charts/operator/.helmignore b/charts/operator/.helmignore
new file mode 100644
index 00000000..0e8a0eb3
--- /dev/null
+++ b/charts/operator/.helmignore
@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
diff --git a/charts/operator/Chart.yaml b/charts/operator/Chart.yaml
new file mode 100644
index 00000000..37a729f9
--- /dev/null
+++ b/charts/operator/Chart.yaml
@@ -0,0 +1,6 @@
+apiVersion: v2
+name: intel-device-plugins-operator
+description: A Helm chart for Intel Device Plugins Operator for Kubernetes
+type: application
+version: 0.1.0
+appVersion: "0.23.0"
diff --git a/charts/operator/templates/NOTES.txt b/charts/operator/templates/NOTES.txt
new file mode 100644
index 00000000..c5615c64
--- /dev/null
+++ b/charts/operator/templates/NOTES.txt
@@ -0,0 +1,1 @@
+Thank you for installing {{ .Chart.Name }}.
diff --git a/charts/operator/templates/operator.yaml b/charts/operator/templates/operator.yaml
new file mode 100644
index 00000000..b4841bae
--- /dev/null
+++ b/charts/operator/templates/operator.yaml
@@ -0,0 +1,836 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: inteldeviceplugins-leader-election-role
+  namespace: {{ .Release.Namespace | quote }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - ""
+  resources:
+  - configmaps/status
+  verbs:
+  - get
+  - update
+  - patch
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - create
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  creationTimestamp: null
+  name: inteldeviceplugins-gpu-manager-role
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - list
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  creationTimestamp: null
+  name: inteldeviceplugins-manager-role
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - serviceaccounts
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - watch
+- apiGroups:
+  - apps
+  resources:
+  - daemonsets
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - coordination.k8s.io
+  resources:
+  - leases
+  verbs:
+  - create
+- apiGroups:
+  - coordination.k8s.io
+  resourceNames:
+  - d1c7b6d5.intel.com
+  resources:
+  - leases
+  verbs:
+  - get
+  - update
+- apiGroups:
+  - deviceplugin.intel.com
+  resources:
+  - dlbdeviceplugins
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - deviceplugin.intel.com
+  resources:
+  - dlbdeviceplugins/finalizers
+  verbs:
+  - update
+- apiGroups:
+  - deviceplugin.intel.com
+  resources:
+  - dlbdeviceplugins/status
+  verbs:
+  - get
+  - patch
+  - update
+- apiGroups:
+  - deviceplugin.intel.com
+  resources:
+  - dsadeviceplugins
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - deviceplugin.intel.com
+  resources:
+  - dsadeviceplugins/finalizers
+  verbs:
+  - update
+- apiGroups:
+  - deviceplugin.intel.com
+  resources:
+  - dsadeviceplugins/status
+  verbs:
+  - get
+  - patch
+  - update
+- apiGroups:
+  - deviceplugin.intel.com
+  resources:
+  - fpgadeviceplugins
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - deviceplugin.intel.com
+  resources:
+  - fpgadeviceplugins/finalizers
+  verbs:
+  - update
+- apiGroups:
+  - deviceplugin.intel.com
+  resources:
+  - fpgadeviceplugins/status
+  verbs:
+  - get
+  - patch
+  - update
+- apiGroups:
+  - deviceplugin.intel.com
+  resources:
+  - gpudeviceplugins
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - deviceplugin.intel.com
+  resources:
+  - gpudeviceplugins/finalizers
+  verbs:
+  - update
+- apiGroups:
+  - deviceplugin.intel.com
+  resources:
+  - gpudeviceplugins/status
+  verbs:
+  - get
+  - patch
+  - update
+- apiGroups:
+  - deviceplugin.intel.com
+  resources:
+  - iaadeviceplugins
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - deviceplugin.intel.com
+  resources:
+  - iaadeviceplugins/status
+  verbs:
+  - get
+  - patch
+  - update
+- apiGroups:
+  - deviceplugin.intel.com
+  resources:
+  - qatdeviceplugins
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - deviceplugin.intel.com
+  resources:
+  - qatdeviceplugins/finalizers
+  verbs:
+  - update
+- apiGroups:
+  - deviceplugin.intel.com
+  resources:
+  - qatdeviceplugins/status
+  verbs:
+  - get
+  - patch
+  - update
+- apiGroups:
+  - deviceplugin.intel.com
+  resources:
+  - sgxdeviceplugins
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - deviceplugin.intel.com
+  resources:
+  - sgxdeviceplugins/finalizers
+  verbs:
+  - update
+- apiGroups:
+  - deviceplugin.intel.com
+  resources:
+  - sgxdeviceplugins/status
+  verbs:
+  - get
+  - patch
+  - update
+- apiGroups:
+  - fpga.intel.com
+  resources:
+  - acceleratorfunctions
+  - fpgaregions
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - rbac.authorization.k8s.io
+  resources:
+  - clusterrolebindings
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - watch
+- apiGroups:
+  - security.openshift.io
+  resourceNames:
+  - privileged
+  resources:
+  - securitycontextconstraints
+  verbs:
+  - use
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: inteldeviceplugins-metrics-reader
+rules:
+- nonResourceURLs:
+  - /metrics
+  verbs:
+  - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: inteldeviceplugins-proxy-role
+rules:
+- apiGroups:
+  - authentication.k8s.io
+  resources:
+  - tokenreviews
+  verbs:
+  - create
+- apiGroups:
+  - authorization.k8s.io
+  resources:
+  - subjectaccessreviews
+  verbs:
+  - create
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: inteldeviceplugins-leader-election-rolebinding
+  namespace: {{ .Release.Namespace | quote }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: inteldeviceplugins-leader-election-role
+subjects:
+- kind: ServiceAccount
+  name: default
+  namespace: {{ .Release.Namespace | quote }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: inteldeviceplugins-manager-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: inteldeviceplugins-manager-role
+subjects:
+- kind: ServiceAccount
+  name: default
+  namespace: {{ .Release.Namespace | quote }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: inteldeviceplugins-proxy-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: inteldeviceplugins-proxy-role
+subjects:
+- kind: ServiceAccount
+  name: default
+  namespace: {{ .Release.Namespace | quote }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    control-plane: controller-manager
+  name: inteldeviceplugins-controller-manager-metrics-service
+  namespace: {{ .Release.Namespace | quote }}
+spec:
+  ports:
+  - name: https
+    port: 8443
+    targetPort: https
+  selector:
+    control-plane: controller-manager
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: inteldeviceplugins-webhook-service
+  namespace: {{ .Release.Namespace | quote }}
+spec:
+  ports:
+  - port: 443
+    targetPort: 9443
+  selector:
+    control-plane: controller-manager
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    control-plane: controller-manager
+  name: inteldeviceplugins-controller-manager
+  namespace: {{ .Release.Namespace | quote }}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      control-plane: controller-manager
+  template:
+    metadata:
+      labels:
+        control-plane: controller-manager
+    spec:
+      containers:
+      - args:
+        {{- if .Values.controllerExtraArgs }}
+        {{- with .Values.controllerExtraArgs }}
+        {{- tpl . $ | trim | nindent 8 }}
+        {{- end }}
+        {{- end }}
+        env:
+        - name: DEVICEPLUGIN_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        image: "{{ .Values.image.hub }}/intel-deviceplugin-operator:{{ .Values.image.tag }}"
+        imagePullPolicy: {{ .Values.image.pullPolicy }}
+        name: manager
+        ports:
+        - containerPort: 9443
+          name: webhook-server
+          protocol: TCP
+        resources:
+          limits:
+            cpu: 100m
+            memory: 50Mi
+          requests:
+            cpu: 100m
+            memory: 20Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsGroup: 65532
+          runAsNonRoot: true
+          runAsUser: 65532
+          seccompProfile:
+            type: RuntimeDefault
+        volumeMounts:
+        - mountPath: /tmp/k8s-webhook-server/serving-certs
+          name: cert
+          readOnly: true
+      - args:
+        - --secure-listen-address=0.0.0.0:8443
+        - --upstream=http://127.0.0.1:8080/
+        - --logtostderr=true
+        - --v=10
+        image: gcr.io/kubebuilder/kube-rbac-proxy:v0.8.0
+        name: kube-rbac-proxy
+        ports:
+        - containerPort: 8443
+          name: https
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          runAsGroup: 1000
+          runAsNonRoot: true
+          runAsUser: 1000
+      serviceAccountName: default
+      terminationGracePeriodSeconds: 10
+      volumes:
+      - name: cert
+        secret:
+          defaultMode: 420
+          secretName: webhook-server-cert
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: inteldeviceplugins-serving-cert
+  namespace: {{ .Release.Namespace | quote }}
+spec:
+  dnsNames:
+  - inteldeviceplugins-webhook-service.{{ .Release.Namespace }}.svc
+  - inteldeviceplugins-webhook-service.{{ .Release.Namespace }}.svc.cluster.local
+  issuerRef:
+    kind: Issuer
+    name: inteldeviceplugins-selfsigned-issuer
+  secretName: webhook-server-cert
+---
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: inteldeviceplugins-selfsigned-issuer
+  namespace: {{ .Release.Namespace | quote }}
+spec:
+  selfSigned: {}
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: MutatingWebhookConfiguration
+metadata:
+  annotations:
+    cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/inteldeviceplugins-serving-cert
+  name: inteldeviceplugins-mutating-webhook-configuration
+webhooks:
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: inteldeviceplugins-webhook-service
+      namespace: {{ .Release.Namespace | quote }}
+      path: /mutate-deviceplugin-intel-com-v1-dlbdeviceplugin
+  failurePolicy: Fail
+  name: mdlbdeviceplugin.kb.io
+  rules:
+  - apiGroups:
+    - deviceplugin.intel.com
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - dlbdeviceplugins
+  sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: inteldeviceplugins-webhook-service
+      namespace: {{ .Release.Namespace | quote }}
+      path: /mutate-deviceplugin-intel-com-v1-dsadeviceplugin
+  failurePolicy: Fail
+  name: mdsadeviceplugin.kb.io
+  rules:
+  - apiGroups:
+    - deviceplugin.intel.com
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - dsadeviceplugins
+  sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: inteldeviceplugins-webhook-service
+      namespace: {{ .Release.Namespace | quote }}
+      path: /mutate-deviceplugin-intel-com-v1-fpgadeviceplugin
+  failurePolicy: Fail
+  name: mfpgadeviceplugin.kb.io
+  rules:
+  - apiGroups:
+    - deviceplugin.intel.com
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - fpgadeviceplugins
+  sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: inteldeviceplugins-webhook-service
+      namespace: {{ .Release.Namespace | quote }}
+      path: /mutate-deviceplugin-intel-com-v1-gpudeviceplugin
+  failurePolicy: Fail
+  name: mgpudeviceplugin.kb.io
+  rules:
+  - apiGroups:
+    - deviceplugin.intel.com
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - gpudeviceplugins
+  sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: inteldeviceplugins-webhook-service
+      namespace: {{ .Release.Namespace | quote }}
+      path: /mutate-deviceplugin-intel-com-v1-iaadeviceplugin
+  failurePolicy: Fail
+  name: miaadeviceplugin.kb.io
+  rules:
+  - apiGroups:
+    - deviceplugin.intel.com
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - iaadeviceplugins
+  sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: inteldeviceplugins-webhook-service
+      namespace: {{ .Release.Namespace | quote }}
+      path: /mutate-deviceplugin-intel-com-v1-qatdeviceplugin
+  failurePolicy: Fail
+  name: mqatdeviceplugin.kb.io
+  rules:
+  - apiGroups:
+    - deviceplugin.intel.com
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - qatdeviceplugins
+  sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: inteldeviceplugins-webhook-service
+      namespace: {{ .Release.Namespace | quote }}
+      path: /mutate-deviceplugin-intel-com-v1-sgxdeviceplugin
+  failurePolicy: Fail
+  name: msgxdeviceplugin.kb.io
+  rules:
+  - apiGroups:
+    - deviceplugin.intel.com
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - sgxdeviceplugins
+  sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: inteldeviceplugins-webhook-service
+      namespace: {{ .Release.Namespace | quote }}
+      path: /pods
+  failurePolicy: Ignore
+  name: fpga.mutator.webhooks.intel.com
+  rules:
+  - apiGroups:
+    - ""
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - pods
+  sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: inteldeviceplugins-webhook-service
+      namespace: {{ .Release.Namespace | quote }}
+      path: /pods-sgx
+  failurePolicy: Ignore
+  name: sgx.mutator.webhooks.intel.com
+  reinvocationPolicy: IfNeeded
+  rules:
+  - apiGroups:
+    - ""
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - pods
+  sideEffects: None
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+  annotations:
+    cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/inteldeviceplugins-serving-cert
+  name: inteldeviceplugins-validating-webhook-configuration
+webhooks:
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: inteldeviceplugins-webhook-service
+      namespace: {{ .Release.Namespace | quote }}
+      path: /validate-deviceplugin-intel-com-v1-dlbdeviceplugin
+  failurePolicy: Fail
+  name: vdlbdeviceplugin.kb.io
+  rules:
+  - apiGroups:
+    - deviceplugin.intel.com
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - dlbdeviceplugins
+  sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: inteldeviceplugins-webhook-service
+      namespace: {{ .Release.Namespace | quote }}
+      path: /validate-deviceplugin-intel-com-v1-dsadeviceplugin
+  failurePolicy: Fail
+  name: vdsadeviceplugin.kb.io
+  rules:
+  - apiGroups:
+    - deviceplugin.intel.com
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - dsadeviceplugins
+  sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: inteldeviceplugins-webhook-service
+      namespace: {{ .Release.Namespace | quote }}
+      path: /validate-deviceplugin-intel-com-v1-fpgadeviceplugin
+  failurePolicy: Fail
+  name: vfpgadeviceplugin.kb.io
+  rules:
+  - apiGroups:
+    - deviceplugin.intel.com
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - fpgadeviceplugins
+  sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: inteldeviceplugins-webhook-service
+      namespace: {{ .Release.Namespace | quote }}
+      path: /validate-deviceplugin-intel-com-v1-gpudeviceplugin
+  failurePolicy: Fail
+  name: vgpudeviceplugin.kb.io
+  rules:
+  - apiGroups:
+    - deviceplugin.intel.com
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - gpudeviceplugins
+  sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: inteldeviceplugins-webhook-service
+      namespace: {{ .Release.Namespace | quote }}
+      path: /validate-deviceplugin-intel-com-v1-iaadeviceplugin
+  failurePolicy: Fail
+  name: viaadeviceplugin.kb.io
+  rules:
+  - apiGroups:
+    - deviceplugin.intel.com
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - iaadeviceplugins
+  sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: inteldeviceplugins-webhook-service
+      namespace: {{ .Release.Namespace | quote }}
+      path: /validate-deviceplugin-intel-com-v1-qatdeviceplugin
+  failurePolicy: Fail
+  name: vqatdeviceplugin.kb.io
+  rules:
+  - apiGroups:
+    - deviceplugin.intel.com
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - qatdeviceplugins
+  sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: inteldeviceplugins-webhook-service
+      namespace: {{ .Release.Namespace | quote }}
+      path: /validate-deviceplugin-intel-com-v1-sgxdeviceplugin
+  failurePolicy: Fail
+  name: vsgxdeviceplugin.kb.io
+  rules:
+  - apiGroups:
+    - deviceplugin.intel.com
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - sgxdeviceplugins
+  sideEffects: None
diff --git a/charts/operator/values.yaml b/charts/operator/values.yaml
new file mode 100644
index 00000000..2fe11121
--- /dev/null
+++ b/charts/operator/values.yaml
@@ -0,0 +1,9 @@
+image:
+  hub: intel
+  tag: "devel"
+  pullPolicy: IfNotPresent
+
+# Arguments for the controller
+controllerExtraArgs: |-
+  - --metrics-bind-address=:8080
+  - --leader-elect=false
diff --git a/charts/qat/.helmignore b/charts/qat/.helmignore
new file mode 100644
index 00000000..0e8a0eb3
--- /dev/null
+++ b/charts/qat/.helmignore
@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
diff --git a/charts/qat/Chart.yaml b/charts/qat/Chart.yaml
new file mode 100644
index 00000000..3c61f8c3
--- /dev/null
+++ b/charts/qat/Chart.yaml
@@ -0,0 +1,6 @@
+apiVersion: v2
+name: intel-device-plugins-qat
+description: A Helm chart for Intel QAT Device Plugin
+type: application
+version: 0.1.0
+appVersion: "0.24.0"
diff --git a/charts/qat/templates/NOTES.txt b/charts/qat/templates/NOTES.txt
new file mode 100644
index 00000000..c5615c64
--- /dev/null
+++ b/charts/qat/templates/NOTES.txt
@@ -0,0 +1,1 @@
+Thank you for installing {{ .Chart.Name }}.
diff --git a/charts/qat/templates/qat.yaml b/charts/qat/templates/qat.yaml
new file mode 100644
index 00000000..31b6d00f
--- /dev/null
+++ b/charts/qat/templates/qat.yaml
@@ -0,0 +1,24 @@
+{{- /*
+based on
+deployments/operator/samples/deviceplugin_v1_qatdeviceplugin.yaml
+*/}}
+
+apiVersion: deviceplugin.intel.com/v1
+kind: QatDevicePlugin
+metadata:
+  name: {{ .Values.qat.metadata.name }}
+  annotations:
+    {{ toYaml .Values.qat.metadata.annotations | indent 4 }}
+spec:
+  image: {{ .Values.qat.spec.image }}
+  {{- if .Values.qat.spec.initImage }}
+    initImage: {{ .Values.qat.spec.initImage }}
+  {{- end }}  
+  dpdkDriver: {{ .Values.qat.spec.dpdkDriver }}
+  kernelVfDrivers:
+    {{- range .Values.qat.spec.kernelVfDrivers }}
+    - {{ . }}
+    {{- end  }}
+  maxNumDevices: {{ .Values.qat.spec.maxNumDevices }}
+  logLevel:  {{ .Values.qat.spec.logLevel }}
+  nodeSelector: {{ .Values.qat.spec.nodeSelector | toYaml | nindent 4 }}
diff --git a/charts/qat/values.yaml b/charts/qat/values.yaml
new file mode 100644
index 00000000..a2529bf3
--- /dev/null
+++ b/charts/qat/values.yaml
@@ -0,0 +1,14 @@
+qat:
+  metadata:
+    name: qatdeviceplugin-sample
+  spec:
+    image: intel/intel-qat-plugin:0.24.0
+    initImage: intel/intel-qat-initcontainer:0.24.0
+    dpdkDriver: vfio-pci
+    kernelVfDrivers:
+      - c6xxvf
+      - 4xxxvf
+    maxNumDevices: 128
+    logLevel: 4
+    nodeSelector:
+      intel.feature.node.kubernetes.io/qat: 'true'
diff --git a/charts/sgx/.helmignore b/charts/sgx/.helmignore
new file mode 100644
index 00000000..0e8a0eb3
--- /dev/null
+++ b/charts/sgx/.helmignore
@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
diff --git a/charts/sgx/Chart.yaml b/charts/sgx/Chart.yaml
new file mode 100644
index 00000000..bccb792d
--- /dev/null
+++ b/charts/sgx/Chart.yaml
@@ -0,0 +1,6 @@
+apiVersion: v2
+name: intel-device-plugins-sgx
+description: A Helm chart for Intel Device Plugins SGX
+type: application
+version: 0.1.0
+appVersion: "0.24.0"
diff --git a/charts/sgx/templates/sgx.yaml b/charts/sgx/templates/sgx.yaml
new file mode 100644
index 00000000..2133cb60
--- /dev/null
+++ b/charts/sgx/templates/sgx.yaml
@@ -0,0 +1,16 @@
+{{- /*
+based on
+deployments/operator/samples/deviceplugin_v1_sgxdeviceplugin.yaml
+*/}}
+
+apiVersion: deviceplugin.intel.com/v1
+kind: SgxDevicePlugin
+metadata:
+  name: {{ .Values.sgx.metadata.name }}
+spec:
+  image: {{ .Values.sgx.spec.image }}
+  initImage: {{ .Values.sgx.spec.initImage }}
+  enclaveLimit: {{ .Values.sgx.spec.enclaveLimit }}
+  provisionLimit: {{ .Values.sgx.spec.provisionLimit }}
+  logLevel:  {{ .Values.sgx.spec.logLevel }}
+  nodeSelector: {{- .Values.sgx.spec.nodeSelector | toYaml | nindent 4 }}
diff --git a/charts/sgx/values.yaml b/charts/sgx/values.yaml
new file mode 100644
index 00000000..e7ee0c19
--- /dev/null
+++ b/charts/sgx/values.yaml
@@ -0,0 +1,11 @@
+sgx:
+  metadata:
+    name: sgxdeviceplugin-sample
+  spec:
+    image: intel/intel-sgx-plugin:0.24.0
+    initImage: intel/intel-sgx-initcontainer:0.24.0
+    enclaveLimit: 110
+    provisionLimit: 110
+    logLevel: 4
+    nodeSelector:
+      intel.feature.node.kubernetes.io/sgx: 'true'
diff --git a/cmd/gpu_nfdhook/README.md b/cmd/gpu_nfdhook/README.md
index 2735f847..9cc558d8 100644
--- a/cmd/gpu_nfdhook/README.md
+++ b/cmd/gpu_nfdhook/README.md
@@ -40,7 +40,7 @@ Following labels are created by default. You may turn numeric labels into extend
 name | type | description|
 -----|------|------|
 |`gpu.intel.com/millicores`| number | node GPU count * 1000. Can be used as a finer grained shared execution fraction.
-|`gpu.intel.com/memory.max`| number | sum of detected [GPU memory amounts](#gpu-memory) in bytes OR environment variable value * GPU count
+|`gpu.intel.com/memory.max`| number | sum of detected [GPU memory amounts](#GPU-memory) in bytes OR environment variable value * GPU count
 |`gpu.intel.com/cards`| string | list of card names separated by '`.`'. The names match host `card*`-folders under `/sys/class/drm/`. Deprecated, use `gpu-numbers`.
 |`gpu.intel.com/gpu-numbers`| string | list of numbers separated by '`.`'. The numbers correspond to device file numbers for the primary nodes of given GPUs in kernel DRI subsystem, listed as `/dev/dri/card<num>` in devfs, and `/sys/class/drm/card<num>` in sysfs.
 |`gpu.intel.com/tiles`| number | sum of all detected GPU tiles in the system.
diff --git a/cmd/gpu_plugin/README.md b/cmd/gpu_plugin/README.md
index b459f698..ad76e9c9 100644
--- a/cmd/gpu_plugin/README.md
+++ b/cmd/gpu_plugin/README.md
@@ -5,16 +5,8 @@ Table of Contents
 * [Introduction](#introduction)
 * [Modes and Configuration Options](#modes-and-configuration-options)
 * [Installation](#installation)
-    * [Prerequisites](#prerequisites)
-        * [Drivers for discrete GPUs](#drivers-for-discrete-gpus)
-            * [Kernel driver](#kernel-driver)
-            * [User-space drivers](#user-space-drivers)
-        * [Drivers for older (integrated) GPUs](#drivers-for-older-integrated-gpus)
     * [Pre-built Images](#pre-built-images)
-         * [Install to all nodes](#install-to-all-nodes)
-         * [Install to nodes with Intel GPUs with NFD](#install-to-nodes-with-intel-gpus-with-nfd)
-         * [Install to nodes with Intel GPUs with Fractional resources](#install-to-nodes-with-intel-gpus-with-fractional-resources)
-              * [Fractional resources details](#fractional-resources-details)
+         * [Fractional Resources](#fractional-resources)
     * [Verify Plugin Registration](#verify-plugin-registration)
 * [Testing and Demos](#testing-and-demos)
 * [Issues with media workloads on multi-GPU setups](#issues-with-media-workloads-on-multi-gpu-setups)
@@ -24,8 +16,7 @@ Table of Contents
 ## Introduction
 
 Intel GPU plugin facilitates Kubernetes workload offloading by providing access to
-discrete (including Intel® Data Center GPU Flex Series) and integrated Intel GPU devices
-supported by the host kernel.
+discrete (including Intel® Data Center GPU Flex Series) and integrated Intel GPU device files.
 
 Use cases include, but are not limited to:
 - Media transcode
@@ -56,70 +47,6 @@ The following sections detail how to obtain, build, deploy and test the GPU devi
 
 Examples are provided showing how to deploy the plugin either using a DaemonSet or by hand on a per-node basis.
 
-### Prerequisites
-
-Access to a GPU device requires firmware, kernel and user-space
-drivers supporting it.  Firmware and kernel driver need to be on the
-host, user-space drivers in the GPU workload containers.
-
-Intel GPU devices supported by the current kernel can be listed with:
-```
-$ grep i915 /sys/class/drm/card?/device/uevent
-/sys/class/drm/card0/device/uevent:DRIVER=i915
-/sys/class/drm/card1/device/uevent:DRIVER=i915
-```
-
-#### Drivers for discrete GPUs
-
-##### Kernel driver
-
-For now, kernel needs to be built from sources. `i915` GPU driver DKMS package
-sources for a subset of older kernels in enterprise / LTS distributions, are in
-[intel-gpu-i915-backports](https://github.com/intel-gpu/intel-gpu-i915-backports).
-
-With upstream 6.x kernels, discrete GPU support needs to be enabled using
-kernel `i915.force_probe=<PCI_ID>` command line option until relevant kernel
-driver features have been completed also in upstream:
-https://www.kernel.org/doc/html/latest/gpu/rfc/index.html
-
-PCI IDs for the Intel GPUs on given host can be listed with:
-```
-$ lspci | grep -e VGA -e Display | grep Intel
-88:00.0 Display controller: Intel Corporation Device 56c1 (rev 05)
-8d:00.0 Display controller: Intel Corporation Device 56c1 (rev 05)
-```
-
-(`lspci` lists GPUs with display support as "VGA compatible controller",
-and server GPUs without display support, as "Display controller".)
-
-Mesa "Iris" 3D driver header provides a mapping between GPU PCI IDs and their Intel brand names:
-https://gitlab.freedesktop.org/mesa/mesa/-/blob/main/include/pci_ids/iris_pci_ids.h
-
-If your kernel build does not find the correct firmware version for
-a given GPU from the host (see `dmesg | grep i915` output), latest
-firmware versions are available in upstream:
-https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/tree/i915
-
-##### User-space drivers
-
-Until new enough user-space drivers (supporting also discrete GPUs)
-are available directly from distribution package repositories, they
-can be installed to containers from Intel package repositories. See:
-https://dgpu-docs.intel.com/installation-guides/index.html
-
-Example container is listed in [Testing and demos](#testing-and-demos).
-
-Validation status against *upstream* kernel is listed in the user-space drivers release notes:
-* Media driver: https://github.com/intel/media-driver/releases
-* Compute driver: https://github.com/intel/compute-runtime/releases
-
-#### Drivers for older (integrated) GPUs
-
-For the older (integrated) GPUs, new enough firmware and kernel driver
-are typically included already with the host OS, and new enough
-user-space drivers (for the GPU containers) are in the host OS
-repositories.
-
 ### Pre-built Images
 
 [Pre-built images](https://hub.docker.com/r/intel/intel-gpu-plugin)
@@ -130,34 +57,27 @@ Release tagged images of the components are also available on the Docker hub, ta
 release version numbers in the format `x.y.z`, corresponding to the branches and releases in this
 repository. Thus the easiest way to deploy the plugin in your cluster is to run this command
 
-Note: Replace `<RELEASE_VERSION>` with the desired [release tag](https://github.com/intel/intel-device-plugins-for-kubernetes/tags) or `main` to get `devel` images.
-
-See [the development guide](../../DEVEL.md) for details if you want to deploy a customized version of the plugin.
-
-#### Install to all nodes
-
-Simplest option to enable use of Intel GPUs in Kubernetes Pods.
-
 ```bash
 $ kubectl apply -k https://github.com/intel/intel-device-plugins-for-kubernetes/deployments/gpu_plugin?ref=<RELEASE_VERSION>
+daemonset.apps/intel-gpu-plugin created
 ```
 
-#### Install to nodes with Intel GPUs with NFD
+Where `<RELEASE_VERSION>` needs to be substituted with the desired [release tag](https://github.com/intel/intel-device-plugins-for-kubernetes/tags) or `main` to get `devel` images.
 
-Deploying GPU plugin to only nodes that have Intel GPU attached. [Node Feature Discovery](https://github.com/kubernetes-sigs/node-feature-discovery) is required to detect the presence of Intel GPUs.
+Alternatively, if your cluster runs
+[Node Feature Discovery](https://github.com/kubernetes-sigs/node-feature-discovery),
+you can deploy the device plugin only on nodes with Intel GPU.
+The [nfd_labeled_nodes](../../deployments/gpu_plugin/overlays/nfd_labeled_nodes/)
+kustomization adds the nodeSelector to the DaemonSet:
 
 ```bash
-# Start NFD - if your cluster doesn't have NFD installed yet
-$ kubectl apply -k https://github.com/intel/intel-device-plugins-for-kubernetes/deployments/nfd?ref=<RELEASE_VERSION>
-
-# Create NodeFeatureRules for detecting GPUs on nodes
-$ kubectl apply -k https://github.com/intel/intel-device-plugins-for-kubernetes/deployments/nfd/overlays/node-feature-rules?ref=<RELEASE_VERSION>
-
-# Create GPU plugin daemonset
 $ kubectl apply -k https://github.com/intel/intel-device-plugins-for-kubernetes/deployments/gpu_plugin/overlays/nfd_labeled_nodes?ref=<RELEASE_VERSION>
+daemonset.apps/intel-gpu-plugin created
 ```
 
-#### Install to nodes with Intel GPUs with Fractional resources
+Nothing else is needed. See [the development guide](../../DEVEL.md) for details if you want to deploy a customized version of the plugin.
+
+#### Fractional resources
 
 With the experimental fractional resource feature you can use additional kubernetes extended
 resources, such as GPU memory, which can then be consumed by deployments. PODs will then only
@@ -173,18 +93,13 @@ take care of, which are explained below. For the RBAC-permissions, gRPC service
 the flag enabling, it is recommended to use kustomization by running:
 
 ```bash
-# Start NFD with GPU related configuration changes
-$ kubectl apply -k https://github.com/intel/intel-device-plugins-for-kubernetes/deployments/nfd/overlays/gpu?ref=<RELEASE_VERSION>
-
-# Create NodeFeatureRules for detecting GPUs on nodes
-$ kubectl apply -k https://github.com/intel/intel-device-plugins-for-kubernetes/deployments/nfd/overlays/node-feature-rules?ref=<RELEASE_VERSION>
-
-# Create GPU plugin daemonset
-$ kubectl apply -k https://github.com/intel/intel-device-plugins-for-kubernetes/deployments/gpu_plugin/overlays/fractional_resources?ref=<RELEASE_VERSION>
+$ kubectl apply -k deployments/gpu_plugin/overlays/fractional_resources
+serviceaccount/resource-reader-sa created
+clusterrole.rbac.authorization.k8s.io/resource-reader created
+clusterrolebinding.rbac.authorization.k8s.io/resource-reader-rb created
+daemonset.apps/intel-gpu-plugin created
 ```
 
-##### Fractional resources details
-
 Usage of these fractional GPU resources requires that the cluster has node
 extended resources with the name prefix `gpu.intel.com/`. Those can be created with NFD
 by running the [hook](/cmd/gpu_nfdhook/) installed by the plugin initcontainer. When fractional resources are
@@ -225,8 +140,8 @@ master
 ## Testing and Demos
 
 We can test the plugin is working by deploying an OpenCL image and running `clinfo`.
-The sample [intel-opencl-icd](../../demo/intel-opencl-icd/) OpenCL image can be built
-using `make intel-opencl-icd` and must be made available in the cluster.
+The sample OpenCL image can be built using `make intel-opencl-icd` and must be made
+available in the cluster.
 
 1. Create a job:
 
@@ -244,8 +159,8 @@ using `make intel-opencl-icd` and must be made available in the cluster.
     <log output>
     ```
 
-    If the pod did not successfully launch, possibly because it could not obtain
-    the requested GPU resource, it will be stuck in the `Pending` status:
+    If the pod did not successfully launch, possibly because it could not obtain the gpu
+    resource, it will be stuck in the `Pending` status:
 
     ```bash
     $ kubectl get pods
diff --git a/cmd/qat_plugin/README.md b/cmd/qat_plugin/README.md
index 9c546f78..218f4d92 100644
--- a/cmd/qat_plugin/README.md
+++ b/cmd/qat_plugin/README.md
@@ -219,6 +219,6 @@ for i in 0442 0443 18a1 37c9 6f55 19e3 4941 4943; do lspci -d 8086:$i; done
 [2]:https://www.intel.com/content/www/us/en/design/products-and-solutions/processors-and-chipsets/denverton/ns/atom-processor-c3000-series.html
 [3]:https://www.intel.com/content/www/us/en/ethernet-products/gigabit-server-adapters/quickassist-adapter-8950-brief.html
 [6]:https://github.com/kata-containers/documentation/blob/master/use-cases/using-Intel-QAT-and-kata.md
-[7]:https://www.intel.com/content/www/us/en/content-details/710060/intel-quickassist-technology-software-for-linux-programmer-s-guide-hw-version-1-7.html
+[7]:https://01.org/sites/default/files/downloads//336210-009qatswprogrammersguide.pdfhttps://01.org/sites/default/files/downloads//336210-009qatswprogrammersguide.pdf
 [8]:https://github.com/kata-containers/documentation/blob/master/use-cases/using-Intel-QAT-and-kata.md#build-openssl-intel-qat-engine-container
-[9]:https://www.intel.com/content/www/us/en/content-details/710059/intel-quickassist-technology-software-for-linux-getting-started-guide-hw-version-1-7.html
+[9]:https://01.org/sites/default/files/downloads/intelr-quickassist-technology/336212qatswgettingstartedguiderev003.pdf
diff --git a/cmd/sgx_plugin/README.md b/cmd/sgx_plugin/README.md
index c593994d..80a258eb 100644
--- a/cmd/sgx_plugin/README.md
+++ b/cmd/sgx_plugin/README.md
@@ -54,8 +54,8 @@ The component has the same basic dependencies as the
 [generic plugin framework dependencies](../../README.md#about).
 
 The SGX device plugin requires Linux Kernel SGX drivers to be available. These drivers
-are available in Linux since 5.11. [The SGX DCAP out-of-tree driver](https://github.com/intel/SGXDataCenterAttestationPrimitives)
-(v1.41 and later) is also known to work.
+are available in Linux 5.11. [The SGX DCAP out-of-tree driver v1.41](https://github.com/intel/SGXDataCenterAttestationPrimitives)
+is also known to work.
 
 The hardware platform must support SGX Flexible Launch Control.
 
@@ -166,7 +166,7 @@ For the SGX ECDSA Remote Attestation demo to work, the platform must be correctl
 
 For documentation to set up Intel® reference PCCS, refer to:
 [Intel® Software Guard Extensions (Intel® SGX) Services](https://api.portal.trustedservices.intel.com/) and
-[Intel® Software Guard Extensions SDK for Linux](https://www.intel.com/content/www/us/en/developer/tools/software-guard-extensions/overview.html)
+[Intel® Software Guard Extensions SDK for Linux](https://01.org/intel-software-guard-extensions)
 
 Furthermore, the Kubernetes cluster must be set up according the [instructions above](#deploying-with-pre-built-images).
 
diff --git a/demo/build-image.sh b/demo/build-image.sh
index df2e9f82..b6757c07 100755
--- a/demo/build-image.sh
+++ b/demo/build-image.sh
@@ -17,8 +17,8 @@ fi
 CWD=`dirname $0`
 TAG=${TAG:-devel}
 
-if [ -z "$BUILDER" -o "$BUILDER" = 'docker' -o "$BUILDER" = 'podman' ] ; then
-    ${BUILDER} build --pull -t ${IMG}:${TAG} "$CWD/$DIR/"
+if [ -z "$BUILDER" -o "$BUILDER" = 'docker' ] ; then
+    docker build --pull -t ${IMG}:${TAG} "$CWD/$DIR/"
 elif [ "$BUILDER" = 'buildah' ] ; then
     buildah bud  --pull-always -t ${IMG}:${TAG} "$CWD/$DIR/"
 else
diff --git a/demo/dlb-init.sh b/demo/dlb-init.sh
new file mode 100755
index 00000000..041ed171
--- /dev/null
+++ b/demo/dlb-init.sh
@@ -0,0 +1,49 @@
+#!/bin/sh -eu
+
+enable_and_configure_vfs() {
+  devpath=$1
+  
+  sriov_numvfs_path="$devpath/sriov_numvfs"
+  if ! test -w "$sriov_numvfs_path"; then
+    echo "error: $sriov_numvfs_path is not found or not writable. Check if dlb driver module is loaded"
+    exit 1
+  fi
+  if [ "$(cat "$sriov_numvfs_path")" -ne 0 ]; then
+    echo "$devpath already configured"
+    exit 0
+  fi
+
+  # enable sriov
+  echo -n 1 > "$sriov_numvfs_path"
+
+  # configure vf
+  # unbind vf
+  vf_pciid=$(basename "$(realpath "$devpath/virtfn0")")
+  dlb_pci_driver_path=/sys/bus/pci/drivers/dlb2
+  echo -n "$vf_pciid" > $dlb_pci_driver_path/unbind
+
+  # assign resources to vf
+  vf_resources_path="$devpath/vf0_resources"
+  echo -n 2048 > "$vf_resources_path/num_atomic_inflights"
+  echo -n 2048 > "$vf_resources_path/num_dir_credits"
+  echo -n 8 > "$vf_resources_path/num_dir_ports"
+  echo -n 2048 > "$vf_resources_path/num_hist_list_entries"
+  echo -n 8192 > "$vf_resources_path/num_ldb_credits"
+  echo -n 4 > "$vf_resources_path/num_ldb_ports"
+  echo -n 32 > "$vf_resources_path/num_ldb_queues"
+  echo -n 32 > "$vf_resources_path/num_sched_domains"
+  echo -n 2 > "$vf_resources_path/num_sn0_slots"
+  echo -n 2 > "$vf_resources_path/num_sn1_slots"
+  # bind vf back to dlb2 driver
+  echo -n "$vf_pciid" > $dlb_pci_driver_path/bind
+
+  echo "$devpath configured"
+  # TODO: Due to unknown e2e-dlb (Simics) limitations, it is not possible to configure per VF resources based on values
+  # reported in /sys/bus/pci/devices/<dev_name>/total_resources/<resource_name>. Therefore, only one VF with 
+  # values known to work is enabled. This will be improved in the future to make the scrip more meaningful for real-world
+  # deployments (see #1145).
+}
+
+# use first dlb device to configure a vf
+DEVPATH=$(realpath /sys/bus/pci/drivers/dlb2/????:??:??\.0 | head -1)
+enable_and_configure_vfs "$DEVPATH"
diff --git a/deployments/dlb_plugin/base/intel-dlb-plugin.yaml b/deployments/dlb_plugin/base/intel-dlb-plugin.yaml
index 354f3c9c..60adf69b 100644
--- a/deployments/dlb_plugin/base/intel-dlb-plugin.yaml
+++ b/deployments/dlb_plugin/base/intel-dlb-plugin.yaml
@@ -13,7 +13,6 @@ spec:
       labels:
         app: intel-dlb-plugin
     spec:
-      automountServiceAccountToken: false
       containers:
       - name: intel-dlb-plugin
         env:
diff --git a/deployments/dlb_plugin/overlays/dlb_initcontainer/dlb_initcontainer.yaml b/deployments/dlb_plugin/overlays/dlb_initcontainer/dlb_initcontainer.yaml
new file mode 100644
index 00000000..182f24b6
--- /dev/null
+++ b/deployments/dlb_plugin/overlays/dlb_initcontainer/dlb_initcontainer.yaml
@@ -0,0 +1,25 @@
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: intel-dlb-plugin
+spec:
+  template:
+    spec:
+      initContainers:
+      - name: intel-dlb-initcontainer
+        image: intel/intel-dlb-initcontainer:devel
+        securityContext:
+          readOnlyRootFilesystem: true
+          privileged: true
+        volumeMounts:
+        - name: sysfs-driver-dlb2
+          mountPath: /sys/bus/pci/drivers/dlb2
+        - name: sysfs-devices
+          mountPath: /sys/devices
+      volumes:
+      - name: sysfs-driver-dlb2
+        hostPath:
+          path: /sys/bus/pci/drivers/dlb2
+      - name: sysfs-devices
+        hostPath:
+          path: /sys/devices
diff --git a/deployments/dlb_plugin/overlays/dlb_initcontainer/kustomization.yaml b/deployments/dlb_plugin/overlays/dlb_initcontainer/kustomization.yaml
new file mode 100644
index 00000000..1dd41902
--- /dev/null
+++ b/deployments/dlb_plugin/overlays/dlb_initcontainer/kustomization.yaml
@@ -0,0 +1,4 @@
+bases:
+- ../../base
+patches:
+- path: dlb_initcontainer.yaml
diff --git a/deployments/dsa_plugin/base/intel-dsa-plugin.yaml b/deployments/dsa_plugin/base/intel-dsa-plugin.yaml
index 7bb8cc47..a7a3d605 100644
--- a/deployments/dsa_plugin/base/intel-dsa-plugin.yaml
+++ b/deployments/dsa_plugin/base/intel-dsa-plugin.yaml
@@ -13,7 +13,6 @@ spec:
       labels:
         app: intel-dsa-plugin
     spec:
-      automountServiceAccountToken: false
       containers:
       - name: intel-dsa-plugin
         env:
diff --git a/deployments/fpga_admissionwebhook/crd/bases/fpga.intel.com_acceleratorfunctions.yaml b/deployments/fpga_admissionwebhook/crd/bases/fpga.intel.com_acceleratorfunctions.yaml
index 716acdee..47972089 100644
--- a/deployments/fpga_admissionwebhook/crd/bases/fpga.intel.com_acceleratorfunctions.yaml
+++ b/deployments/fpga_admissionwebhook/crd/bases/fpga.intel.com_acceleratorfunctions.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.10.0
+    controller-gen.kubebuilder.io/version: v0.9.2
   creationTimestamp: null
   name: acceleratorfunctions.fpga.intel.com
 spec:
diff --git a/deployments/fpga_admissionwebhook/crd/bases/fpga.intel.com_fpgaregions.yaml b/deployments/fpga_admissionwebhook/crd/bases/fpga.intel.com_fpgaregions.yaml
index 170bc10f..bbdacf76 100644
--- a/deployments/fpga_admissionwebhook/crd/bases/fpga.intel.com_fpgaregions.yaml
+++ b/deployments/fpga_admissionwebhook/crd/bases/fpga.intel.com_fpgaregions.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.10.0
+    controller-gen.kubebuilder.io/version: v0.9.2
   creationTimestamp: null
   name: fpgaregions.fpga.intel.com
 spec:
diff --git a/deployments/fpga_admissionwebhook/rbac/leader_election_role.yaml b/deployments/fpga_admissionwebhook/rbac/leader_election_role.yaml
index 4190ec80..eaa79158 100644
--- a/deployments/fpga_admissionwebhook/rbac/leader_election_role.yaml
+++ b/deployments/fpga_admissionwebhook/rbac/leader_election_role.yaml
@@ -17,21 +17,16 @@ rules:
   - patch
   - delete
 - apiGroups:
-  - coordination.k8s.io
+  - ""
   resources:
-  - leases
+  - configmaps/status
   verbs:
   - get
-  - list
-  - watch
-  - create
   - update
   - patch
-  - delete
 - apiGroups:
   - ""
   resources:
   - events
   verbs:
   - create
-  - patch
diff --git a/deployments/gpu_plugin/base/intel-gpu-plugin.yaml b/deployments/gpu_plugin/base/intel-gpu-plugin.yaml
index f793d845..1d1d184b 100644
--- a/deployments/gpu_plugin/base/intel-gpu-plugin.yaml
+++ b/deployments/gpu_plugin/base/intel-gpu-plugin.yaml
@@ -18,8 +18,6 @@ spec:
         image: intel/intel-gpu-initcontainer:devel
         imagePullPolicy: IfNotPresent
         securityContext:
-          seLinuxOptions:
-            type: "container_device_plugin_init_t"
           readOnlyRootFilesystem: true
           allowPrivilegeEscalation: false
         volumeMounts:
@@ -35,8 +33,6 @@ spec:
         image: intel/intel-gpu-plugin:devel
         imagePullPolicy: IfNotPresent
         securityContext:
-          seLinuxOptions:
-            type: "container_device_plugin_t"
           readOnlyRootFilesystem: true
           allowPrivilegeEscalation: false
         volumeMounts:
diff --git a/deployments/gpu_plugin/overlays/fractional_resources/add-nodeselector-intel-gpu.yaml b/deployments/gpu_plugin/overlays/fractional_resources/add-nodeselector-intel-gpu.yaml
deleted file mode 100644
index 5f0fe703..00000000
--- a/deployments/gpu_plugin/overlays/fractional_resources/add-nodeselector-intel-gpu.yaml
+++ /dev/null
@@ -1,9 +0,0 @@
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: intel-gpu-plugin
-spec:
-  template:
-    spec:
-      nodeSelector:
-        intel.feature.node.kubernetes.io/gpu: "true"
diff --git a/deployments/gpu_plugin/overlays/fractional_resources/add-serviceaccount.yaml b/deployments/gpu_plugin/overlays/fractional_resources/add-serviceaccount.yaml
index 396363a2..2926657b 100644
--- a/deployments/gpu_plugin/overlays/fractional_resources/add-serviceaccount.yaml
+++ b/deployments/gpu_plugin/overlays/fractional_resources/add-serviceaccount.yaml
@@ -5,4 +5,4 @@ metadata:
 spec:
   template:
     spec:
-      serviceAccountName: gpu-manager-sa
+      serviceAccountName: resource-reader-sa
diff --git a/deployments/gpu_plugin/overlays/fractional_resources/kustomization.yaml b/deployments/gpu_plugin/overlays/fractional_resources/kustomization.yaml
index 702053d0..08e364f5 100644
--- a/deployments/gpu_plugin/overlays/fractional_resources/kustomization.yaml
+++ b/deployments/gpu_plugin/overlays/fractional_resources/kustomization.yaml
@@ -1,11 +1,10 @@
 bases:
   - ../../base
 resources:
-  - gpu-manager-rolebinding.yaml
-  - gpu-manager-role.yaml
-  - gpu-manager-sa.yaml
+  - resource-cluster-role-binding.yaml
+  - resource-cluster-role.yaml
+  - resource-reader-sa.yaml
 patches:
   - path: add-serviceaccount.yaml
   - path: add-podresource-mount.yaml
   - path: add-args.yaml
-  - path: add-nodeselector-intel-gpu.yaml
diff --git a/deployments/gpu_plugin/overlays/fractional_resources/gpu-manager-rolebinding.yaml b/deployments/gpu_plugin/overlays/fractional_resources/resource-cluster-role-binding.yaml
similarity index 71%
rename from deployments/gpu_plugin/overlays/fractional_resources/gpu-manager-rolebinding.yaml
rename to deployments/gpu_plugin/overlays/fractional_resources/resource-cluster-role-binding.yaml
index 444fc67b..f46439f3 100644
--- a/deployments/gpu_plugin/overlays/fractional_resources/gpu-manager-rolebinding.yaml
+++ b/deployments/gpu_plugin/overlays/fractional_resources/resource-cluster-role-binding.yaml
@@ -1,12 +1,12 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: gpu-manager-rolebinding
+  name: resource-reader-rb
 subjects:
 - kind: ServiceAccount
-  name: gpu-manager-sa
+  name: resource-reader-sa
   namespace: default
 roleRef:
   kind: ClusterRole
-  name: gpu-manager-role
+  name: resource-reader
   apiGroup: rbac.authorization.k8s.io
diff --git a/deployments/gpu_plugin/overlays/fractional_resources/gpu-manager-role.yaml b/deployments/gpu_plugin/overlays/fractional_resources/resource-cluster-role.yaml
similarity index 84%
rename from deployments/gpu_plugin/overlays/fractional_resources/gpu-manager-role.yaml
rename to deployments/gpu_plugin/overlays/fractional_resources/resource-cluster-role.yaml
index 17bca25f..cca48ccc 100644
--- a/deployments/gpu_plugin/overlays/fractional_resources/gpu-manager-role.yaml
+++ b/deployments/gpu_plugin/overlays/fractional_resources/resource-cluster-role.yaml
@@ -1,7 +1,7 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: gpu-manager-role
+  name: resource-reader
 rules:
 - apiGroups: [""]
   resources: ["pods"]
diff --git a/deployments/gpu_plugin/overlays/fractional_resources/gpu-manager-sa.yaml b/deployments/gpu_plugin/overlays/fractional_resources/resource-reader-sa.yaml
similarity index 63%
rename from deployments/gpu_plugin/overlays/fractional_resources/gpu-manager-sa.yaml
rename to deployments/gpu_plugin/overlays/fractional_resources/resource-reader-sa.yaml
index 76b459d0..a2879ece 100644
--- a/deployments/gpu_plugin/overlays/fractional_resources/gpu-manager-sa.yaml
+++ b/deployments/gpu_plugin/overlays/fractional_resources/resource-reader-sa.yaml
@@ -1,4 +1,4 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: gpu-manager-sa
+  name: resource-reader-sa
diff --git a/deployments/gpu_plugin/overlays/nfd_labeled_nodes/add-nodeselector-intel-gpu.yaml b/deployments/gpu_plugin/overlays/nfd_labeled_nodes/add-nodeselector-intel-gpu.yaml
index 5f0fe703..953a56e4 100644
--- a/deployments/gpu_plugin/overlays/nfd_labeled_nodes/add-nodeselector-intel-gpu.yaml
+++ b/deployments/gpu_plugin/overlays/nfd_labeled_nodes/add-nodeselector-intel-gpu.yaml
@@ -6,4 +6,4 @@ spec:
   template:
     spec:
       nodeSelector:
-        intel.feature.node.kubernetes.io/gpu: "true"
+        feature.node.kubernetes.io/pci-0300_8086.present: "true"
diff --git a/deployments/iaa_plugin/base/intel-iaa-plugin.yaml b/deployments/iaa_plugin/base/intel-iaa-plugin.yaml
index 5f2731d8..e9f19800 100644
--- a/deployments/iaa_plugin/base/intel-iaa-plugin.yaml
+++ b/deployments/iaa_plugin/base/intel-iaa-plugin.yaml
@@ -13,7 +13,6 @@ spec:
       labels:
         app: intel-iaa-plugin
     spec:
-      automountServiceAccountToken: false
       containers:
       - name: intel-iaa-plugin
         env:
diff --git a/deployments/nfd/components/gpu/kustomization.yaml b/deployments/nfd/components/gpu/kustomization.yaml
deleted file mode 100644
index c4eee0c6..00000000
--- a/deployments/nfd/components/gpu/kustomization.yaml
+++ /dev/null
@@ -1,16 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1alpha1
-kind: Component
-
-patchesJson6902:
-- target:
-    group: apps
-    version: v1
-    kind: Deployment
-    name: nfd-master
-  path: master-args.yaml
-- target:
-    group: rbac.authorization.k8s.io
-    version: v1
-    kind: ClusterRole
-    name: nfd-master
-  path: master-rbac.yaml
diff --git a/deployments/nfd/components/gpu/master-args.yaml b/deployments/nfd/components/gpu/master-args.yaml
deleted file mode 100644
index 07e2ffec..00000000
--- a/deployments/nfd/components/gpu/master-args.yaml
+++ /dev/null
@@ -1,3 +0,0 @@
-- op: add
-  path: /spec/template/spec/containers/0/args
-  value: ["--resource-labels=gpu.intel.com/memory.max,gpu.intel.com/millicores,gpu.intel.com/tiles", "--extra-label-ns=gpu.intel.com"]
diff --git a/deployments/nfd/components/gpu/master-rbac.yaml b/deployments/nfd/components/gpu/master-rbac.yaml
deleted file mode 100644
index 62fa8272..00000000
--- a/deployments/nfd/components/gpu/master-rbac.yaml
+++ /dev/null
@@ -1,3 +0,0 @@
-- op: add
-  path: /rules/0/resources
-  value: ["nodes", "nodes/status"]
diff --git a/deployments/nfd/overlays/gpu/kustomization.yaml b/deployments/nfd/overlays/gpu/kustomization.yaml
deleted file mode 100644
index 3b2eac27..00000000
--- a/deployments/nfd/overlays/gpu/kustomization.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-bases:
-- ../../base
-
-components:
-- ../../components/gpu
diff --git a/deployments/nfd/overlays/node-feature-rules/node-feature-rules-openshift.yaml b/deployments/nfd/overlays/node-feature-rules/node-feature-rules-openshift.yaml
index 2e75c75c..95fb610f 100755
--- a/deployments/nfd/overlays/node-feature-rules/node-feature-rules-openshift.yaml
+++ b/deployments/nfd/overlays/node-feature-rules/node-feature-rules-openshift.yaml
@@ -55,7 +55,7 @@ spec:
             class: {op: In, value: ["0300", "0380"]}
         - feature: kernel.loadedmodule
           matchExpressions:
-            i915: {op: Exists}
+            drm: {op: Exists}
 
     - name: "intel.iaa"
       labels:
diff --git a/deployments/nfd/overlays/node-feature-rules/node-feature-rules.yaml b/deployments/nfd/overlays/node-feature-rules/node-feature-rules.yaml
index 856d8a3b..48886616 100644
--- a/deployments/nfd/overlays/node-feature-rules/node-feature-rules.yaml
+++ b/deployments/nfd/overlays/node-feature-rules/node-feature-rules.yaml
@@ -59,7 +59,7 @@ spec:
             class: {op: In, value: ["0300", "0380"]}
         - feature: kernel.loadedmodule
           matchExpressions:
-            i915: {op: Exists}
+            drm: {op: Exists}
 
     - name: "intel.iaa"
       labels:
diff --git a/deployments/operator/crd/bases/deviceplugin.intel.com_dlbdeviceplugins.yaml b/deployments/operator/crd/bases/deviceplugin.intel.com_dlbdeviceplugins.yaml
index b72b06e6..bb259754 100644
--- a/deployments/operator/crd/bases/deviceplugin.intel.com_dlbdeviceplugins.yaml
+++ b/deployments/operator/crd/bases/deviceplugin.intel.com_dlbdeviceplugins.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.10.0
+    controller-gen.kubebuilder.io/version: v0.9.2
   creationTimestamp: null
   name: dlbdeviceplugins.deviceplugin.intel.com
 spec:
@@ -53,6 +53,10 @@ spec:
               image:
                 description: Image is a container image with DLB device plugin executable.
                 type: string
+              initImage:
+                description: InitImage is a container image with a script that initializes
+                  devices.
+                type: string
               logLevel:
                 description: LogLevel sets the plugin's log level.
                 minimum: 0
diff --git a/deployments/operator/crd/bases/deviceplugin.intel.com_dsadeviceplugins.yaml b/deployments/operator/crd/bases/deviceplugin.intel.com_dsadeviceplugins.yaml
index 084a5f52..a53966af 100644
--- a/deployments/operator/crd/bases/deviceplugin.intel.com_dsadeviceplugins.yaml
+++ b/deployments/operator/crd/bases/deviceplugin.intel.com_dsadeviceplugins.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.10.0
+    controller-gen.kubebuilder.io/version: v0.9.2
   creationTimestamp: null
   name: dsadeviceplugins.deviceplugin.intel.com
 spec:
diff --git a/deployments/operator/crd/bases/deviceplugin.intel.com_fpgadeviceplugins.yaml b/deployments/operator/crd/bases/deviceplugin.intel.com_fpgadeviceplugins.yaml
index e7b6a574..336b6e99 100644
--- a/deployments/operator/crd/bases/deviceplugin.intel.com_fpgadeviceplugins.yaml
+++ b/deployments/operator/crd/bases/deviceplugin.intel.com_fpgadeviceplugins.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.10.0
+    controller-gen.kubebuilder.io/version: v0.9.2
   creationTimestamp: null
   name: fpgadeviceplugins.deviceplugin.intel.com
 spec:
diff --git a/deployments/operator/crd/bases/deviceplugin.intel.com_gpudeviceplugins.yaml b/deployments/operator/crd/bases/deviceplugin.intel.com_gpudeviceplugins.yaml
index 6fc07cff..045a31d1 100644
--- a/deployments/operator/crd/bases/deviceplugin.intel.com_gpudeviceplugins.yaml
+++ b/deployments/operator/crd/bases/deviceplugin.intel.com_gpudeviceplugins.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.10.0
+    controller-gen.kubebuilder.io/version: v0.9.2
   creationTimestamp: null
   name: gpudeviceplugins.deviceplugin.intel.com
 spec:
diff --git a/deployments/operator/crd/bases/deviceplugin.intel.com_iaadeviceplugins.yaml b/deployments/operator/crd/bases/deviceplugin.intel.com_iaadeviceplugins.yaml
index b684fbd3..84aa0a27 100644
--- a/deployments/operator/crd/bases/deviceplugin.intel.com_iaadeviceplugins.yaml
+++ b/deployments/operator/crd/bases/deviceplugin.intel.com_iaadeviceplugins.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.10.0
+    controller-gen.kubebuilder.io/version: v0.9.2
   creationTimestamp: null
   name: iaadeviceplugins.deviceplugin.intel.com
 spec:
diff --git a/deployments/operator/crd/bases/deviceplugin.intel.com_qatdeviceplugins.yaml b/deployments/operator/crd/bases/deviceplugin.intel.com_qatdeviceplugins.yaml
index ded8755a..8bf3668e 100644
--- a/deployments/operator/crd/bases/deviceplugin.intel.com_qatdeviceplugins.yaml
+++ b/deployments/operator/crd/bases/deviceplugin.intel.com_qatdeviceplugins.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.10.0
+    controller-gen.kubebuilder.io/version: v0.9.2
   creationTimestamp: null
   name: qatdeviceplugins.deviceplugin.intel.com
 spec:
diff --git a/deployments/operator/crd/bases/deviceplugin.intel.com_sgxdeviceplugins.yaml b/deployments/operator/crd/bases/deviceplugin.intel.com_sgxdeviceplugins.yaml
index be2c62f6..3ec342bf 100644
--- a/deployments/operator/crd/bases/deviceplugin.intel.com_sgxdeviceplugins.yaml
+++ b/deployments/operator/crd/bases/deviceplugin.intel.com_sgxdeviceplugins.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.10.0
+    controller-gen.kubebuilder.io/version: v0.9.2
   creationTimestamp: null
   name: sgxdeviceplugins.deviceplugin.intel.com
 spec:
diff --git a/deployments/operator/crd/bases/fpga.intel.com_acceleratorfunctions.yaml b/deployments/operator/crd/bases/fpga.intel.com_acceleratorfunctions.yaml
index 716acdee..47972089 100644
--- a/deployments/operator/crd/bases/fpga.intel.com_acceleratorfunctions.yaml
+++ b/deployments/operator/crd/bases/fpga.intel.com_acceleratorfunctions.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.10.0
+    controller-gen.kubebuilder.io/version: v0.9.2
   creationTimestamp: null
   name: acceleratorfunctions.fpga.intel.com
 spec:
diff --git a/deployments/operator/crd/bases/fpga.intel.com_fpgaregions.yaml b/deployments/operator/crd/bases/fpga.intel.com_fpgaregions.yaml
index 170bc10f..bbdacf76 100644
--- a/deployments/operator/crd/bases/fpga.intel.com_fpgaregions.yaml
+++ b/deployments/operator/crd/bases/fpga.intel.com_fpgaregions.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.10.0
+    controller-gen.kubebuilder.io/version: v0.9.2
   creationTimestamp: null
   name: fpgaregions.fpga.intel.com
 spec:
diff --git a/deployments/operator/rbac/leader_election_role.yaml b/deployments/operator/rbac/leader_election_role.yaml
index 4190ec80..eaa79158 100644
--- a/deployments/operator/rbac/leader_election_role.yaml
+++ b/deployments/operator/rbac/leader_election_role.yaml
@@ -17,21 +17,16 @@ rules:
   - patch
   - delete
 - apiGroups:
-  - coordination.k8s.io
+  - ""
   resources:
-  - leases
+  - configmaps/status
   verbs:
   - get
-  - list
-  - watch
-  - create
   - update
   - patch
-  - delete
 - apiGroups:
   - ""
   resources:
   - events
   verbs:
   - create
-  - patch
diff --git a/deployments/operator/samples/deviceplugin_v1_dlbdeviceplugin.yaml b/deployments/operator/samples/deviceplugin_v1_dlbdeviceplugin.yaml
index 0feab0f7..1c004f16 100644
--- a/deployments/operator/samples/deviceplugin_v1_dlbdeviceplugin.yaml
+++ b/deployments/operator/samples/deviceplugin_v1_dlbdeviceplugin.yaml
@@ -10,6 +10,7 @@ metadata:
   #   container.apparmor.security.beta.kubernetes.io/intel-dlb-plugin: unconfined
 spec:
   image: intel/intel-dlb-plugin:0.24.0
+  initImage: intel/intel-dlb-initcontainer:0.24.0
   logLevel: 4
   nodeSelector:
     intel.feature.node.kubernetes.io/dlb: 'true'
diff --git a/deployments/operator/webhook/manifests.yaml b/deployments/operator/webhook/manifests.yaml
index 8428db3a..b0b271ce 100644
--- a/deployments/operator/webhook/manifests.yaml
+++ b/deployments/operator/webhook/manifests.yaml
@@ -134,7 +134,6 @@ webhooks:
       path: /mutate-deviceplugin-intel-com-v1-sgxdeviceplugin
   failurePolicy: Fail
   name: msgxdeviceplugin.kb.io
-  reinvocationPolicy: IfNeeded
   rules:
   - apiGroups:
     - deviceplugin.intel.com
@@ -173,9 +172,9 @@ webhooks:
       name: webhook-service
       namespace: system
       path: /pods-sgx
+  reinvocationPolicy: IfNeeded
   failurePolicy: Ignore
   name: sgx.mutator.webhooks.intel.com
-  reinvocationPolicy: IfNeeded
   rules:
   - apiGroups:
     - ""
diff --git a/deployments/qat_plugin/base/intel-qat-plugin.yaml b/deployments/qat_plugin/base/intel-qat-plugin.yaml
index dfe9414e..e46214d1 100644
--- a/deployments/qat_plugin/base/intel-qat-plugin.yaml
+++ b/deployments/qat_plugin/base/intel-qat-plugin.yaml
@@ -13,13 +13,10 @@ spec:
       labels:
         app: intel-qat-plugin
     spec:
-      automountServiceAccountToken: false
       containers:
       - name: intel-qat-plugin
         image: intel/intel-qat-plugin:devel
         securityContext:
-          seLinuxOptions:
-            type: "container_device_plugin_t"
           readOnlyRootFilesystem: true
           allowPrivilegeEscalation: false
         imagePullPolicy: IfNotPresent
diff --git a/deployments/sgx_admissionwebhook/webhook/manifests.yaml b/deployments/sgx_admissionwebhook/webhook/manifests.yaml
index ef3d2689..6d2b2089 100644
--- a/deployments/sgx_admissionwebhook/webhook/manifests.yaml
+++ b/deployments/sgx_admissionwebhook/webhook/manifests.yaml
@@ -1,3 +1,4 @@
+
 ---
 apiVersion: admissionregistration.k8s.io/v1
 kind: MutatingWebhookConfiguration
@@ -12,9 +13,9 @@ webhooks:
       name: webhook-service
       namespace: system
       path: /pods-sgx
+  reinvocationPolicy: IfNeeded
   failurePolicy: Ignore
   name: sgx.mutator.webhooks.intel.com
-  reinvocationPolicy: IfNeeded
   rules:
   - apiGroups:
     - ""
diff --git a/deployments/sgx_plugin/base/intel-sgx-plugin.yaml b/deployments/sgx_plugin/base/intel-sgx-plugin.yaml
index 9e402028..7e5499d5 100644
--- a/deployments/sgx_plugin/base/intel-sgx-plugin.yaml
+++ b/deployments/sgx_plugin/base/intel-sgx-plugin.yaml
@@ -13,7 +13,6 @@ spec:
       labels:
         app: intel-sgx-plugin
     spec:
-      automountServiceAccountToken: false
       containers:
       - name: intel-sgx-plugin
         image: intel/intel-sgx-plugin:devel
diff --git a/deployments/vpu_plugin/base/intel-vpu-plugin.yaml b/deployments/vpu_plugin/base/intel-vpu-plugin.yaml
index 47065704..92af8cb9 100644
--- a/deployments/vpu_plugin/base/intel-vpu-plugin.yaml
+++ b/deployments/vpu_plugin/base/intel-vpu-plugin.yaml
@@ -13,7 +13,6 @@ spec:
       labels:
         app: intel-vpu-plugin
     spec:
-      automountServiceAccountToken: false
       containers:
       - name: intel-vpu-plugin
         env:
diff --git a/go.mod b/go.mod
index 23fdd2f0..e82260ae 100644
--- a/go.mod
+++ b/go.mod
@@ -9,19 +9,19 @@ require (
 	github.com/google/go-cmp v0.5.9
 	github.com/google/gousb v1.1.2
 	github.com/klauspost/cpuid/v2 v2.1.1
-	github.com/onsi/ginkgo/v2 v2.2.0
+	github.com/onsi/ginkgo/v2 v2.1.6
 	github.com/onsi/gomega v1.20.2
 	github.com/pkg/errors v0.9.1
 	golang.org/x/sys v0.0.0-20220808155132-1c4a2a72c664
 	golang.org/x/text v0.3.7
 	google.golang.org/grpc v1.49.0
-	k8s.io/api v0.25.2
-	k8s.io/apimachinery v0.25.2
+	k8s.io/api v0.25.0
+	k8s.io/apimachinery v0.25.0
 	k8s.io/client-go v1.5.2
-	k8s.io/component-base v0.25.2
+	k8s.io/component-base v0.25.0
 	k8s.io/klog/v2 v2.70.1
-	k8s.io/kubelet v1.25.2
-	k8s.io/kubernetes v1.25.2
+	k8s.io/kubelet v0.25.0-rc.0
+	k8s.io/kubernetes v1.25.0
 	k8s.io/pod-security-admission v0.0.0
 	k8s.io/utils v0.0.0-20220728103510-ee6ede2d64ed
 	sigs.k8s.io/controller-runtime v0.13.0
@@ -91,8 +91,8 @@ require (
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	k8s.io/apiextensions-apiserver v0.25.0 // indirect
-	k8s.io/apiserver v0.25.2 // indirect
-	k8s.io/component-helpers v0.25.2 // indirect
+	k8s.io/apiserver v0.25.0 // indirect
+	k8s.io/component-helpers v0.25.0 // indirect
 	k8s.io/kube-openapi v0.0.0-20220803162953-67bda5d908f1 // indirect
 	k8s.io/kubectl v0.0.0 // indirect
 	sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.32 // indirect
@@ -101,32 +101,32 @@ require (
 )
 
 replace (
-	k8s.io/api => k8s.io/api v0.25.2
-	k8s.io/apiextensions-apiserver => k8s.io/apiextensions-apiserver v0.25.2
-	k8s.io/apimachinery => k8s.io/apimachinery v0.25.3-rc.0
-	k8s.io/apiserver => k8s.io/apiserver v0.25.2
-	k8s.io/cli-runtime => k8s.io/cli-runtime v0.25.2
-	k8s.io/client-go => k8s.io/client-go v0.25.2
-	k8s.io/cloud-provider => k8s.io/cloud-provider v0.25.2
-	k8s.io/cluster-bootstrap => k8s.io/cluster-bootstrap v0.25.2
-	k8s.io/code-generator => k8s.io/code-generator v0.25.3-rc.0
-	k8s.io/component-base => k8s.io/component-base v0.25.2
-	k8s.io/component-helpers => k8s.io/component-helpers v0.25.2
-	k8s.io/controller-manager => k8s.io/controller-manager v0.25.2
-	k8s.io/cri-api => k8s.io/cri-api v0.25.3-rc.0
-	k8s.io/csi-translation-lib => k8s.io/csi-translation-lib v0.25.2
-	k8s.io/kube-aggregator => k8s.io/kube-aggregator v0.25.2
-	k8s.io/kube-controller-manager => k8s.io/kube-controller-manager v0.25.2
-	k8s.io/kube-proxy => k8s.io/kube-proxy v0.25.2
-	k8s.io/kube-scheduler => k8s.io/kube-scheduler v0.25.2
-	k8s.io/kubectl => k8s.io/kubectl v0.25.2
-	k8s.io/kubelet => k8s.io/kubelet v0.25.2
-	k8s.io/legacy-cloud-providers => k8s.io/legacy-cloud-providers v0.25.2
-	k8s.io/metrics => k8s.io/metrics v0.25.2
-	k8s.io/mount-utils => k8s.io/mount-utils v0.25.3-rc.0
-	k8s.io/sample-apiserver => k8s.io/sample-apiserver v0.25.2
-	k8s.io/sample-cli-plugin => k8s.io/sample-cli-plugin v0.25.2
-	k8s.io/sample-controller => k8s.io/sample-controller v0.25.2
+	k8s.io/api => k8s.io/api v0.25.0
+	k8s.io/apiextensions-apiserver => k8s.io/apiextensions-apiserver v0.25.0
+	k8s.io/apimachinery => k8s.io/apimachinery v0.26.0-alpha.0
+	k8s.io/apiserver => k8s.io/apiserver v0.25.0
+	k8s.io/cli-runtime => k8s.io/cli-runtime v0.25.0
+	k8s.io/client-go => k8s.io/client-go v0.25.0
+	k8s.io/cloud-provider => k8s.io/cloud-provider v0.25.0
+	k8s.io/cluster-bootstrap => k8s.io/cluster-bootstrap v0.25.0
+	k8s.io/code-generator => k8s.io/code-generator v0.25.1-rc.0
+	k8s.io/component-base => k8s.io/component-base v0.25.0
+	k8s.io/component-helpers => k8s.io/component-helpers v0.25.0
+	k8s.io/controller-manager => k8s.io/controller-manager v0.25.0
+	k8s.io/cri-api => k8s.io/cri-api v0.25.1-rc.0
+	k8s.io/csi-translation-lib => k8s.io/csi-translation-lib v0.25.0
+	k8s.io/kube-aggregator => k8s.io/kube-aggregator v0.25.0
+	k8s.io/kube-controller-manager => k8s.io/kube-controller-manager v0.25.0
+	k8s.io/kube-proxy => k8s.io/kube-proxy v0.25.0
+	k8s.io/kube-scheduler => k8s.io/kube-scheduler v0.25.0
+	k8s.io/kubectl => k8s.io/kubectl v0.25.0
+	k8s.io/kubelet => k8s.io/kubelet v0.25.0
+	k8s.io/legacy-cloud-providers => k8s.io/legacy-cloud-providers v0.25.0
+	k8s.io/metrics => k8s.io/metrics v0.25.0
+	k8s.io/mount-utils => k8s.io/mount-utils v0.25.1-rc.0
+	k8s.io/sample-apiserver => k8s.io/sample-apiserver v0.25.0
+	k8s.io/sample-cli-plugin => k8s.io/sample-cli-plugin v0.25.0
+	k8s.io/sample-controller => k8s.io/sample-controller v0.25.0
 )
 
-replace k8s.io/pod-security-admission => k8s.io/pod-security-admission v0.25.2
+replace k8s.io/pod-security-admission => k8s.io/pod-security-admission v0.25.0
diff --git a/go.sum b/go.sum
index 06e146c1..13ba5b6e 100644
--- a/go.sum
+++ b/go.sum
@@ -251,8 +251,8 @@ github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e h1:fD57ERR4JtEqsWb
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
 github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
 github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
-github.com/onsi/ginkgo/v2 v2.2.0 h1:3ZNA3L1c5FYDFTTxbFeVGGD8jYvjYauHD30YgLxVsNI=
-github.com/onsi/ginkgo/v2 v2.2.0/go.mod h1:MEH45j8TBi6u9BMogfbp0stKC5cdGjumZj5Y7AG4VIk=
+github.com/onsi/ginkgo/v2 v2.1.6 h1:Fx2POJZfKRQcM1pH49qSZiYeu319wji004qX+GDovrU=
+github.com/onsi/ginkgo/v2 v2.1.6/go.mod h1:MEH45j8TBi6u9BMogfbp0stKC5cdGjumZj5Y7AG4VIk=
 github.com/onsi/gomega v1.20.2 h1:8uQq0zMgLEfa0vRrrBgaJF2gyW9Da9BmfGV+OyUzfkY=
 github.com/onsi/gomega v1.20.2/go.mod h1:iYAIXgPSaDHak0LCMA+AWBpIKBr8WZicMxnE8luStNc=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
@@ -663,33 +663,33 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
 honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-k8s.io/api v0.25.2 h1:v6G8RyFcwf0HR5jQGIAYlvtRNrxMJQG1xJzaSeVnIS8=
-k8s.io/api v0.25.2/go.mod h1:qP1Rn4sCVFwx/xIhe+we2cwBLTXNcheRyYXwajonhy0=
-k8s.io/apiextensions-apiserver v0.25.2 h1:8uOQX17RE7XL02ngtnh3TgifY7EhekpK+/piwzQNnBo=
-k8s.io/apiextensions-apiserver v0.25.2/go.mod h1:iRwwRDlWPfaHhuBfQ0WMa5skdQfrE18QXJaJvIDLvE8=
-k8s.io/apimachinery v0.25.3-rc.0 h1:nhztVhLsZuw2xENfIrVXcsNUiemnlH/r+Bb8hbl/1gA=
-k8s.io/apimachinery v0.25.3-rc.0/go.mod h1:hqqA1X0bsgsxI6dXsJ4HnNTBOmJNxyPp8dw3u2fSHwA=
-k8s.io/apiserver v0.25.2 h1:YePimobk187IMIdnmsMxsfIbC5p4eX3WSOrS9x6FEYw=
-k8s.io/apiserver v0.25.2/go.mod h1:30r7xyQTREWCkG2uSjgjhQcKVvAAlqoD+YyrqR6Cn+I=
-k8s.io/client-go v0.25.2 h1:SUPp9p5CwM0yXGQrwYurw9LWz+YtMwhWd0GqOsSiefo=
-k8s.io/client-go v0.25.2/go.mod h1:i7cNU7N+yGQmJkewcRD2+Vuj4iz7b30kI8OcL3horQ4=
-k8s.io/component-base v0.25.2 h1:Nve/ZyHLUBHz1rqwkjXm/Re6IniNa5k7KgzxZpTfSQY=
-k8s.io/component-base v0.25.2/go.mod h1:90W21YMr+Yjg7MX+DohmZLzjsBtaxQDDwaX4YxDkl60=
-k8s.io/component-helpers v0.25.2 h1:A4xQEFq7tbnhB3CTwZTLcQtyEhFFZN2TyQjNgziuSEI=
-k8s.io/component-helpers v0.25.2/go.mod h1:iuyfZG2jGWYvR5F/yGFUYNdL/IFz2smcwpNaOqP+YNM=
+k8s.io/api v0.25.0 h1:H+Q4ma2U/ww0iGB78ijZx6DRByPz6/733jIuFpX70e0=
+k8s.io/api v0.25.0/go.mod h1:ttceV1GyV1i1rnmvzT3BST08N6nGt+dudGrquzVQWPk=
+k8s.io/apiextensions-apiserver v0.25.0 h1:CJ9zlyXAbq0FIW8CD7HHyozCMBpDSiH7EdrSTCZcZFY=
+k8s.io/apiextensions-apiserver v0.25.0/go.mod h1:3pAjZiN4zw7R8aZC5gR0y3/vCkGlAjCazcg1me8iB/E=
+k8s.io/apimachinery v0.26.0-alpha.0 h1:cnXW2EigxCOrD+s52R9r5AZOcu1Nbv508gOCgSQkbo4=
+k8s.io/apimachinery v0.26.0-alpha.0/go.mod h1:qMx9eAk0sZQGsXGu86fab8tZdffHbwUfsvzqKn4mfB0=
+k8s.io/apiserver v0.25.0 h1:8kl2ifbNffD440MyvHtPaIz1mw4mGKVgWqM0nL+oyu4=
+k8s.io/apiserver v0.25.0/go.mod h1:BKwsE+PTC+aZK+6OJQDPr0v6uS91/HWxX7evElAH6xo=
+k8s.io/client-go v0.25.0 h1:CVWIaCETLMBNiTUta3d5nzRbXvY5Hy9Dpl+VvREpu5E=
+k8s.io/client-go v0.25.0/go.mod h1:lxykvypVfKilxhTklov0wz1FoaUZ8X4EwbhS6rpRfN8=
+k8s.io/component-base v0.25.0 h1:haVKlLkPCFZhkcqB6WCvpVxftrg6+FK5x1ZuaIDaQ5Y=
+k8s.io/component-base v0.25.0/go.mod h1:F2Sumv9CnbBlqrpdf7rKZTmmd2meJq0HizeyY/yAFxk=
+k8s.io/component-helpers v0.25.0 h1:vNzYfqnVXj7f+CPksduKVv2Z9kC+IDsOs9yaOyxZrj0=
+k8s.io/component-helpers v0.25.0/go.mod h1:auaFj2bvb5Zmy0mLk4WJNmwP0w4e7Zk+/Tu9FFBGA20=
 k8s.io/klog/v2 v2.0.0/go.mod h1:PBfzABfn139FHAV07az/IF9Wp1bkk3vpT2XSJ76fSDE=
 k8s.io/klog/v2 v2.70.1 h1:7aaoSdahviPmR+XkS7FyxlkkXs6tHISSG03RxleQAVQ=
 k8s.io/klog/v2 v2.70.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
 k8s.io/kube-openapi v0.0.0-20220803162953-67bda5d908f1 h1:MQ8BAZPZlWk3S9K4a9NCkIFQtZShWqoha7snGixVgEA=
 k8s.io/kube-openapi v0.0.0-20220803162953-67bda5d908f1/go.mod h1:C/N6wCaBHeBHkHUesQOQy2/MZqGgMAFPqGsGQLdbZBU=
-k8s.io/kubectl v0.25.2 h1:2993lTeVimxKSWx/7z2PiJxUILygRa3tmC4QhFaeioA=
-k8s.io/kubectl v0.25.2/go.mod h1:eoBGJtKUj7x38KXelz+dqVtbtbKwCqyKzJWmBHU0prg=
-k8s.io/kubelet v0.25.2 h1:L0PXLc2kTfIf6bm+wv4/1dIWwgXWDRTxTErxqFR4nqc=
-k8s.io/kubelet v0.25.2/go.mod h1:/ASc/pglUA3TeRMG4hRKSjTa7arT0D6yqLzwqSxwMlY=
-k8s.io/kubernetes v1.25.2 h1:khlfsw0tr0YIbs0fs4uNAy4TcQJuBwhjpyHpkrCNWvs=
-k8s.io/kubernetes v1.25.2/go.mod h1:OlhMy4mww2SLr1KtdV1vC014/MwfYlts/C66gtnDkKE=
-k8s.io/pod-security-admission v0.25.2 h1:sR3cU0fkfPQIXYIZllukBjLu8iElRl8R0Bskxsi15EU=
-k8s.io/pod-security-admission v0.25.2/go.mod h1:v3wLmYecYm4nJB/w2Qu2jBcmI3OaMwsUmcks7vibDnA=
+k8s.io/kubectl v0.25.0 h1:/Wn1cFqo8ik3iee1EvpxYre3bkWsGLXzLQI6uCCAkQc=
+k8s.io/kubectl v0.25.0/go.mod h1:n16ULWsOl2jmQpzt2o7Dud1t4o0+Y186ICb4O+GwKAU=
+k8s.io/kubelet v0.25.0 h1:eTS5B1u1o63ndExAHKLJytzz/GBy86ROcxYtu0VK3RA=
+k8s.io/kubelet v0.25.0/go.mod h1:J6aQxrZdSsGPrskYrhZdEn6PCnGha+GNvF0g9aWfQnw=
+k8s.io/kubernetes v1.25.0 h1:NwTRyLrdXTORd5V7DLlUltxDbl/KZjYDiRgwI+pBYGE=
+k8s.io/kubernetes v1.25.0/go.mod h1:UdtILd5Zg1vGZvShiO1EYOqmjzM2kZOG1hzwQnM5JxY=
+k8s.io/pod-security-admission v0.25.0 h1:Sceq45pO7E7RTaYAr3Br94ZMDISJIngvXXcAfcZJufk=
+k8s.io/pod-security-admission v0.25.0/go.mod h1:b/UC586Th2LijoNV+ssyyAryUvmaTrEWms5ZzBEkVsA=
 k8s.io/utils v0.0.0-20220728103510-ee6ede2d64ed h1:jAne/RjBTyawwAy0utX5eqigAwz/lQhTmy+Hr/Cpue4=
 k8s.io/utils v0.0.0-20220728103510-ee6ede2d64ed/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
diff --git a/pkg/apis/deviceplugin/v1/dlbdeviceplugin_types.go b/pkg/apis/deviceplugin/v1/dlbdeviceplugin_types.go
index cd7fd70e..9b552c5a 100644
--- a/pkg/apis/deviceplugin/v1/dlbdeviceplugin_types.go
+++ b/pkg/apis/deviceplugin/v1/dlbdeviceplugin_types.go
@@ -31,6 +31,9 @@ type DlbDevicePluginSpec struct {
 	// Image is a container image with DLB device plugin executable.
 	Image string `json:"image,omitempty"`
 
+	// InitImage is a container image with a script that initializes devices.
+	InitImage string `json:"initImage,omitempty"`
+
 	// LogLevel sets the plugin's log level.
 	// +kubebuilder:validation:Minimum=0
 	LogLevel int `json:"logLevel,omitempty"`
diff --git a/pkg/apis/deviceplugin/v1/dlbdeviceplugin_webhook.go b/pkg/apis/deviceplugin/v1/dlbdeviceplugin_webhook.go
index 4ac45166..1b35eb56 100644
--- a/pkg/apis/deviceplugin/v1/dlbdeviceplugin_webhook.go
+++ b/pkg/apis/deviceplugin/v1/dlbdeviceplugin_webhook.go
@@ -85,5 +85,11 @@ func (r *DlbDevicePlugin) ValidateDelete() error {
 }
 
 func (r *DlbDevicePlugin) validatePlugin() error {
+	if r.Spec.InitImage != "" {
+		if err := validatePluginImage(r.Spec.InitImage, "intel-dlb-initcontainer", dlbMinVersion); err != nil {
+			return err
+		}
+	}
+
 	return validatePluginImage(r.Spec.Image, "intel-dlb-plugin", dlbMinVersion)
 }
diff --git a/pkg/apis/deviceplugin/v1/gpudeviceplugin_webhook.go b/pkg/apis/deviceplugin/v1/gpudeviceplugin_webhook.go
index 91deb57c..286a245b 100644
--- a/pkg/apis/deviceplugin/v1/gpudeviceplugin_webhook.go
+++ b/pkg/apis/deviceplugin/v1/gpudeviceplugin_webhook.go
@@ -95,9 +95,5 @@ func (r *GpuDevicePlugin) validatePlugin() error {
 		return errors.Errorf("PreferredAllocationPolicy is valid only when setting sharedDevNum > 1")
 	}
 
-	if r.Spec.SharedDevNum == 1 && r.Spec.ResourceManager {
-		return errors.Errorf("resourceManager is valid only when setting sharedDevNum > 1")
-	}
-
 	return validatePluginImage(r.Spec.Image, "intel-gpu-plugin", gpuMinVersion)
 }
diff --git a/pkg/apis/deviceplugin/v1/sgxdeviceplugin_webhook.go b/pkg/apis/deviceplugin/v1/sgxdeviceplugin_webhook.go
index af82a393..5947b670 100644
--- a/pkg/apis/deviceplugin/v1/sgxdeviceplugin_webhook.go
+++ b/pkg/apis/deviceplugin/v1/sgxdeviceplugin_webhook.go
@@ -42,7 +42,7 @@ func (r *SgxDevicePlugin) SetupWebhookWithManager(mgr ctrl.Manager) error {
 		Complete()
 }
 
-// +kubebuilder:webhook:path=/mutate-deviceplugin-intel-com-v1-sgxdeviceplugin,mutating=true,failurePolicy=fail,groups=deviceplugin.intel.com,resources=sgxdeviceplugins,verbs=create;update,versions=v1,name=msgxdeviceplugin.kb.io,sideEffects=None,admissionReviewVersions=v1,reinvocationPolicy=IfNeeded
+// +kubebuilder:webhook:path=/mutate-deviceplugin-intel-com-v1-sgxdeviceplugin,mutating=true,failurePolicy=fail,groups=deviceplugin.intel.com,resources=sgxdeviceplugins,verbs=create;update,versions=v1,name=msgxdeviceplugin.kb.io,sideEffects=None,admissionReviewVersions=v1
 
 var _ webhook.Defaulter = &SgxDevicePlugin{}
 
diff --git a/pkg/controllers/dlb/controller.go b/pkg/controllers/dlb/controller.go
index e027a710..964bbc0b 100644
--- a/pkg/controllers/dlb/controller.go
+++ b/pkg/controllers/dlb/controller.go
@@ -22,6 +22,7 @@ import (
 	"strings"
 
 	apps "k8s.io/api/apps/v1"
+	v1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/client-go/tools/reference"
 	ctrl "sigs.k8s.io/controller-runtime"
@@ -67,7 +68,7 @@ func (c *controller) CreateEmptyObject() client.Object {
 
 func (c *controller) Upgrade(ctx context.Context, obj client.Object) bool {
 	dp := obj.(*devicepluginv1.DlbDevicePlugin)
-	return controllers.UpgradeImages(&dp.Spec.Image, nil)
+	return controllers.UpgradeImages(&dp.Spec.Image, &dp.Spec.InitImage)
 }
 
 func (c *controller) GetTotalObjectCount(ctx context.Context, clnt client.Client) (int, error) {
@@ -82,17 +83,24 @@ func (c *controller) GetTotalObjectCount(ctx context.Context, clnt client.Client
 func (c *controller) NewDaemonSet(rawObj client.Object) *apps.DaemonSet {
 	devicePlugin := rawObj.(*devicepluginv1.DlbDevicePlugin)
 
-	daemonSet := deployments.DLBPluginDaemonSet()
+	ds := deployments.DLBPluginDaemonSet()
 	if len(devicePlugin.Spec.NodeSelector) > 0 {
-		daemonSet.Spec.Template.Spec.NodeSelector = devicePlugin.Spec.NodeSelector
+		ds.Spec.Template.Spec.NodeSelector = devicePlugin.Spec.NodeSelector
 	}
 
-	daemonSet.ObjectMeta.Namespace = c.ns
+	if devicePlugin.Spec.InitImage == "" {
+		ds.Spec.Template.Spec.InitContainers = nil
+		ds.Spec.Template.Spec.Volumes = removeVolume(ds.Spec.Template.Spec.Volumes, "sysfs-devices", "sysfs-driver-dlb2")
+	} else {
+		setInitContainer(&ds.Spec.Template.Spec, devicePlugin.Spec)
+	}
+
+	ds.ObjectMeta.Namespace = c.ns
 
-	daemonSet.Spec.Template.Spec.Containers[0].Args = getPodArgs(devicePlugin)
-	daemonSet.Spec.Template.Spec.Containers[0].Image = devicePlugin.Spec.Image
+	ds.Spec.Template.Spec.Containers[0].Args = getPodArgs(devicePlugin)
+	ds.Spec.Template.Spec.Containers[0].Image = devicePlugin.Spec.Image
 
-	return daemonSet
+	return ds
 }
 
 func (c *controller) UpdateDaemonSet(rawObj client.Object, ds *apps.DaemonSet) (updated bool) {
@@ -103,6 +111,17 @@ func (c *controller) UpdateDaemonSet(rawObj client.Object, ds *apps.DaemonSet) (
 		updated = true
 	}
 
+	if dp.Spec.InitImage == "" {
+		if ds.Spec.Template.Spec.InitContainers != nil {
+			ds.Spec.Template.Spec.InitContainers = nil
+			ds.Spec.Template.Spec.Volumes = removeVolume(ds.Spec.Template.Spec.Volumes, "sysfs-devices", "sysfs-driver-dlb2")
+			updated = true
+		}
+	} else {
+		setInitContainer(&ds.Spec.Template.Spec, dp.Spec)
+		updated = true
+	}
+
 	if len(dp.Spec.NodeSelector) > 0 {
 		if !reflect.DeepEqual(ds.Spec.Template.Spec.NodeSelector, dp.Spec.NodeSelector) {
 			ds.Spec.Template.Spec.NodeSelector = dp.Spec.NodeSelector
@@ -153,6 +172,70 @@ func (c *controller) UpdateStatus(rawObj client.Object, ds *apps.DaemonSet, node
 	return updated, nil
 }
 
+func removeVolume(volumes []v1.Volume, names ...string) []v1.Volume {
+	newVolumes := []v1.Volume{}
+
+	for _, volume := range volumes {
+		for i, name := range names {
+			if volume.Name == name {
+				break
+			}
+
+			if i == len(names)-1 {
+				newVolumes = append(newVolumes, volume)
+			}
+		}
+	}
+
+	return newVolumes
+}
+
+func setInitContainer(dsSpec *v1.PodSpec, dpSpec devicepluginv1.DlbDevicePluginSpec) {
+	yes := true
+
+	dsSpec.InitContainers = []v1.Container{
+		{
+			Image:           dpSpec.InitImage,
+			ImagePullPolicy: "IfNotPresent",
+			Name:            "enable-vfs",
+			SecurityContext: &v1.SecurityContext{
+				Privileged:             &yes,
+				ReadOnlyRootFilesystem: &yes,
+			},
+			VolumeMounts: []v1.VolumeMount{
+				{
+					Name:      "sysfs-devices",
+					MountPath: "/sys/devices",
+				},
+				{
+					Name:      "sysfs-driver-dlb2",
+					MountPath: "/sys/bus/pci/drivers/dlb2",
+				},
+			},
+		}}
+
+	addVolumeIfMissing(dsSpec, "sysfs-devices", "/sys/devices", v1.HostPathDirectoryOrCreate)
+	addVolumeIfMissing(dsSpec, "sysfs-driver-dlb2", "/sys/bus/pci/drivers/dlb2", v1.HostPathDirectoryOrCreate)
+}
+
+func addVolumeIfMissing(spec *v1.PodSpec, name, path string, hpType v1.HostPathType) {
+	for _, vol := range spec.Volumes {
+		if vol.Name == name {
+			return
+		}
+	}
+
+	spec.Volumes = append(spec.Volumes, v1.Volume{
+		Name: name,
+		VolumeSource: v1.VolumeSource{
+			HostPath: &v1.HostPathVolumeSource{
+				Path: path,
+				Type: &hpType,
+			},
+		},
+	})
+}
+
 func getPodArgs(gdp *devicepluginv1.DlbDevicePlugin) []string {
 	args := make([]string, 0, 4)
 	args = append(args, "-v", strconv.Itoa(gdp.Spec.LogLevel))
diff --git a/pkg/controllers/gpu/controller.go b/pkg/controllers/gpu/controller.go
index 54705d6b..ab3878e4 100644
--- a/pkg/controllers/gpu/controller.go
+++ b/pkg/controllers/gpu/controller.go
@@ -196,9 +196,6 @@ func setInitContainer(spec *v1.PodSpec, imageName string) {
 			ImagePullPolicy: "IfNotPresent",
 			Name:            "intel-gpu-initcontainer",
 			SecurityContext: &v1.SecurityContext{
-				SELinuxOptions: &v1.SELinuxOptions{
-					Type: "container_device_plugin_init_t",
-				},
 				ReadOnlyRootFilesystem: &yes,
 			},
 			VolumeMounts: []v1.VolumeMount{
diff --git a/pkg/controllers/qat/controller.go b/pkg/controllers/qat/controller.go
index 75900052..a062927c 100644
--- a/pkg/controllers/qat/controller.go
+++ b/pkg/controllers/qat/controller.go
@@ -222,9 +222,6 @@ func setInitContainer(dsSpec *v1.PodSpec, dpSpec devicepluginv1.QatDevicePluginS
 				Value: strings.Join(enablingPfPciIDs, " "),
 			}},
 			SecurityContext: &v1.SecurityContext{
-				SELinuxOptions: &v1.SELinuxOptions{
-					Type: "container_device_plugin_init_t",
-				},
 				Privileged:             &yes,
 				ReadOnlyRootFilesystem: &yes,
 			},
diff --git a/pkg/webhooks/sgx/sgx.go b/pkg/webhooks/sgx/sgx.go
index 406681a7..da8ed1e2 100644
--- a/pkg/webhooks/sgx/sgx.go
+++ b/pkg/webhooks/sgx/sgx.go
@@ -27,7 +27,7 @@ import (
 	"github.com/intel/intel-device-plugins-for-kubernetes/pkg/internal/containers"
 )
 
-// +kubebuilder:webhook:path=/pods-sgx,mutating=true,failurePolicy=ignore,groups="",resources=pods,verbs=create;update,versions=v1,name=sgx.mutator.webhooks.intel.com,sideEffects=None,admissionReviewVersions=v1,reinvocationPolicy=IfNeeded
+// +kubebuilder:webhook:path=/pods-sgx,mutating=true,failurePolicy=ignore,groups="",resources=pods,verbs=create;update,versions=v1,name=sgx.mutator.webhooks.intel.com,sideEffects=None,admissionReviewVersions=v1
 
 // Mutator annotates Pods.
 type Mutator struct {
diff --git a/scripts/set-version.sh b/scripts/set-version.sh
index 2e769ec7..72b6c4a4 100755
--- a/scripts/set-version.sh
+++ b/scripts/set-version.sh
@@ -1,4 +1,4 @@
-#!/bin/sh -eu
+#!/bin/sh
 #
 # Copyright 2019-2021 Intel Corporation.
 #
@@ -15,8 +15,6 @@ if [ $# != 1 ] || [ "$1" = "?" ] || [ "$1" = "--help" ]; then
     exit 1
 fi
 
-files=$(git grep -l '^TAG?*=\|intel/accel-config-demo:\|intel/crypto-perf:\|intel/opae-nlb-demo:\|intel/openssl-qat-engine:\|intel/dlb-libdlb-demo:\|intel/intel-[^ ]*:\|version=\|appVersion:\|tag:' Makefile deployments demo/*accel-config*.yaml demo/*fpga*.yaml demo/*openssl*.yaml demo/dlb-libdlb*.yaml pkg/controllers/*/*_test.go build/docker/*.Dockerfile test/e2e/*/*.go)
-
-for file in $files; do
+for file in $(git grep -l '^TAG?*=\|intel/accel-config-demo:\|intel/crypto-perf:\|intel/opae-nlb-demo:\|intel/openssl-qat-engine:\|intel/dlb-libdlb-demo:\|intel/intel-[^ ]*:\|version=\|appVersion:\|tag:' Makefile deployments demo/*accel-config*.yaml demo/*fpga*.yaml demo/*openssl*.yaml demo/dlb-libdlb*.yaml pkg/controllers/*/*_test.go build/docker/*.Dockerfile charts test/e2e/*/*.go); do
     sed -i -e "s;\(^TAG?*=\|intel/accel-config-demo:\|intel/crypto-perf:\|intel/opae-nlb-demo:\|intel/openssl-qat-engine:\|intel/dlb-libdlb-demo:\|intel/intel-[^ ]*:\|version=\|appVersion: [^ ]\|tag: [^ ]\)[^ \"]*;\1$1;g" "$file";
 done


Test patch:
diff --git a/.github/workflows/e2e-dlb.yml b/.github/workflows/e2e-dlb.yml
index 49ba3746..67e619f6 100644
--- a/.github/workflows/e2e-dlb.yml
+++ b/.github/workflows/e2e-dlb.yml
@@ -13,7 +13,7 @@ on:
       - 'release-*'
 
 env:
-  IMAGES: 'intel-dlb-plugin dlb-libdlb-demo'
+  IMAGES: 'intel-dlb-plugin intel-dlb-initcontainer dlb-libdlb-demo'
 
 permissions:
   contents: read
diff --git a/.github/workflows/e2e-dsa.yml b/.github/workflows/e2e-dsa.yml
index 09eae503..dc008d40 100644
--- a/.github/workflows/e2e-dsa.yml
+++ b/.github/workflows/e2e-dsa.yml
@@ -21,11 +21,7 @@ permissions:
 jobs:
   e2e-dsa:
     name: e2e-dsa
-    strategy:
-      fail-fast: false
-      matrix:
-        runner: [simics-spr, simics-gnr]
-    runs-on: ${{ matrix.runner }}
+    runs-on: [simics-spr]
     steps:
       - uses: actions/checkout@v3
         with:
diff --git a/.github/workflows/e2e-fpga.yml b/.github/workflows/e2e-fpga.yml
index cd4f28be..0c08cef8 100644
--- a/.github/workflows/e2e-fpga.yml
+++ b/.github/workflows/e2e-fpga.yml
@@ -2,7 +2,7 @@ name: e2e-fpga
 on:
   workflow_dispatch:
   schedule:
-    - cron: '0 4 * * *'
+    - cron: '0 3 * * *'
   pull_request:
     branches:
       - main
diff --git a/.github/workflows/e2e-iaa.yml b/.github/workflows/e2e-iaa.yml
index 01efd319..25ae5eff 100644
--- a/.github/workflows/e2e-iaa.yml
+++ b/.github/workflows/e2e-iaa.yml
@@ -21,11 +21,7 @@ permissions:
 jobs:
   e2e-iaa:
     name: e2e-iaa
-    strategy:
-      fail-fast: false
-      matrix:
-        runner: [simics-spr, simics-gnr]
-    runs-on: ${{ matrix.runner }}
+    runs-on: [simics-spr]
     steps:
       - uses: actions/checkout@v3
         with:
diff --git a/.github/workflows/e2e-qat.yml b/.github/workflows/e2e-qat.yml
index 993eed5c..75905b99 100644
--- a/.github/workflows/e2e-qat.yml
+++ b/.github/workflows/e2e-qat.yml
@@ -2,7 +2,7 @@ name: e2e-qat
 on:
   workflow_dispatch:
   schedule:
-    - cron: '0 4 * * *'
+    - cron: '20 3 * * *'
   pull_request:
     branches:
       - main
diff --git a/.github/workflows/e2e-qat4.yml b/.github/workflows/e2e-qat4.yml
index db2c5951..1911c3bb 100644
--- a/.github/workflows/e2e-qat4.yml
+++ b/.github/workflows/e2e-qat4.yml
@@ -2,7 +2,7 @@ name: e2e-qat4
 on:
   workflow_dispatch:
   schedule:
-    - cron: '0 4 * * *'
+    - cron: '20 3 * * *'
   pull_request:
     branches:
       - main
diff --git a/.github/workflows/e2e-sgx.yml b/.github/workflows/e2e-sgx.yml
index b0e2c2d2..2fa2bac7 100644
--- a/.github/workflows/e2e-sgx.yml
+++ b/.github/workflows/e2e-sgx.yml
@@ -2,7 +2,7 @@ name: e2e-sgx
 on:
   workflow_dispatch:
   schedule:
-    - cron: '0 4 * * *'
+    - cron: '40 3 * * *'
   pull_request:
     branches:
       - main
diff --git a/pkg/controllers/dlb/controller_test.go b/pkg/controllers/dlb/controller_test.go
index a93ac487..2d4b50ef 100644
--- a/pkg/controllers/dlb/controller_test.go
+++ b/pkg/controllers/dlb/controller_test.go
@@ -60,7 +60,6 @@ func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet
 					},
 				},
 				Spec: v1.PodSpec{
-					AutomountServiceAccountToken: &no,
 					Containers: []v1.Container{
 						{
 							Name: appLabel,
diff --git a/pkg/controllers/dsa/controller_test.go b/pkg/controllers/dsa/controller_test.go
index 42fe129c..535fee1a 100644
--- a/pkg/controllers/dsa/controller_test.go
+++ b/pkg/controllers/dsa/controller_test.go
@@ -61,7 +61,6 @@ func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet
 					},
 				},
 				Spec: v1.PodSpec{
-					AutomountServiceAccountToken: &no,
 					Containers: []v1.Container{
 						{
 							Name: appLabel,
diff --git a/pkg/controllers/gpu/controller_test.go b/pkg/controllers/gpu/controller_test.go
index 622fa54d..ba0a5e1e 100644
--- a/pkg/controllers/gpu/controller_test.go
+++ b/pkg/controllers/gpu/controller_test.go
@@ -79,9 +79,6 @@ func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet
 							Image:           devicePlugin.Spec.Image,
 							ImagePullPolicy: "IfNotPresent",
 							SecurityContext: &v1.SecurityContext{
-								SELinuxOptions: &v1.SELinuxOptions{
-									Type: "container_device_plugin_t",
-								},
 								ReadOnlyRootFilesystem:   &yes,
 								AllowPrivilegeEscalation: &no,
 							},
diff --git a/pkg/controllers/iaa/controller_test.go b/pkg/controllers/iaa/controller_test.go
deleted file mode 100644
index 76ec2074..00000000
--- a/pkg/controllers/iaa/controller_test.go
+++ /dev/null
@@ -1,168 +0,0 @@
-// Copyright 2022 Intel Corporation. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package iaa
-
-import (
-	"reflect"
-	"testing"
-
-	apps "k8s.io/api/apps/v1"
-	v1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/util/diff"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-
-	devicepluginv1 "github.com/intel/intel-device-plugins-for-kubernetes/pkg/apis/deviceplugin/v1"
-)
-
-const appLabel = "intel-iaa-plugin"
-
-// newDaemonSetExpected creates plugin daemonset
-// it's copied from the original controller code (before the usage of go:embed).
-func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet {
-	devicePlugin := rawObj.(*devicepluginv1.IaaDevicePlugin)
-
-	yes := true
-	no := false
-	daemonSet := apps.DaemonSet{
-		TypeMeta: metav1.TypeMeta{
-			Kind:       "DaemonSet",
-			APIVersion: "apps/v1",
-		},
-		ObjectMeta: metav1.ObjectMeta{
-			Namespace: c.ns,
-			Name:      appLabel,
-			Labels: map[string]string{
-				"app": appLabel,
-			},
-		},
-		Spec: apps.DaemonSetSpec{
-			Selector: &metav1.LabelSelector{
-				MatchLabels: map[string]string{
-					"app": appLabel,
-				},
-			},
-			Template: v1.PodTemplateSpec{
-				ObjectMeta: metav1.ObjectMeta{
-					Labels: map[string]string{
-						"app": appLabel,
-					},
-				},
-				Spec: v1.PodSpec{
-					AutomountServiceAccountToken: &no,
-					Containers: []v1.Container{
-						{
-							Name: appLabel,
-							Env: []v1.EnvVar{
-								{
-									Name: "NODE_NAME",
-									ValueFrom: &v1.EnvVarSource{
-										FieldRef: &v1.ObjectFieldSelector{
-											FieldPath: "spec.nodeName",
-										},
-									},
-								},
-							},
-							Args:            getPodArgs(devicePlugin),
-							Image:           devicePlugin.Spec.Image,
-							ImagePullPolicy: "IfNotPresent",
-							SecurityContext: &v1.SecurityContext{
-								ReadOnlyRootFilesystem:   &yes,
-								AllowPrivilegeEscalation: &no,
-							},
-							VolumeMounts: []v1.VolumeMount{
-								{
-									Name:      "devfs",
-									MountPath: "/dev/iax",
-									ReadOnly:  true,
-								},
-								{
-									Name:      "chardevs",
-									MountPath: "/dev/char",
-									ReadOnly:  true,
-								},
-								{
-									Name:      "sysfs",
-									MountPath: "/sys/bus/dsa/devices",
-									ReadOnly:  true,
-								},
-								{
-									Name:      "kubeletsockets",
-									MountPath: "/var/lib/kubelet/device-plugins",
-								},
-							},
-						},
-					},
-					NodeSelector: map[string]string{"kubernetes.io/arch": "amd64"},
-					Volumes: []v1.Volume{
-						{
-							Name: "devfs",
-							VolumeSource: v1.VolumeSource{
-								HostPath: &v1.HostPathVolumeSource{
-									Path: "/dev/iax",
-								},
-							},
-						},
-						{
-							Name: "chardevs",
-							VolumeSource: v1.VolumeSource{
-								HostPath: &v1.HostPathVolumeSource{
-									Path: "/dev/char",
-								},
-							},
-						},
-						{
-							Name: "sysfs",
-							VolumeSource: v1.VolumeSource{
-								HostPath: &v1.HostPathVolumeSource{
-									Path: "/sys/bus/dsa/devices",
-								},
-							},
-						},
-						{
-							Name: "kubeletsockets",
-							VolumeSource: v1.VolumeSource{
-								HostPath: &v1.HostPathVolumeSource{
-									Path: "/var/lib/kubelet/device-plugins",
-								},
-							},
-						},
-					},
-				},
-			},
-		},
-	}
-
-	// add the optional init container
-	if devicePlugin.Spec.InitImage != "" {
-		addInitContainer(&daemonSet, devicePlugin)
-	}
-
-	return &daemonSet
-}
-
-// Test that IAA daemonset created by using go:embed is
-// equal to the expected daemonset.
-func TestNewDaemonSetIAA(t *testing.T) {
-	plugin := &devicepluginv1.IaaDevicePlugin{}
-	c := &controller{}
-
-	expected := c.newDaemonSetExpected(plugin)
-	actual := c.NewDaemonSet(plugin)
-
-	if !reflect.DeepEqual(expected, actual) {
-		t.Errorf("expected and actuall daemonsets differ: %+s", diff.ObjectGoPrintDiff(expected, actual))
-	}
-}
diff --git a/pkg/controllers/qat/controller_test.go b/pkg/controllers/qat/controller_test.go
index 3b7a4905..9876beb1 100644
--- a/pkg/controllers/qat/controller_test.go
+++ b/pkg/controllers/qat/controller_test.go
@@ -65,7 +65,6 @@ func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet
 					Annotations: pluginAnnotations,
 				},
 				Spec: v1.PodSpec{
-					AutomountServiceAccountToken: &no,
 					Containers: []v1.Container{
 						{
 							Name:            appLabel,
@@ -73,9 +72,6 @@ func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet
 							Image:           devicePlugin.Spec.Image,
 							ImagePullPolicy: "IfNotPresent",
 							SecurityContext: &v1.SecurityContext{
-								SELinuxOptions: &v1.SELinuxOptions{
-									Type: "container_device_plugin_t",
-								},
 								ReadOnlyRootFilesystem:   &yes,
 								AllowPrivilegeEscalation: &no,
 							},
diff --git a/pkg/controllers/sgx/controller_test.go b/pkg/controllers/sgx/controller_test.go
index f4a7b20d..2dd184ce 100644
--- a/pkg/controllers/sgx/controller_test.go
+++ b/pkg/controllers/sgx/controller_test.go
@@ -63,7 +63,6 @@ func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet
 					},
 				},
 				Spec: v1.PodSpec{
-					AutomountServiceAccountToken: &no,
 					Containers: []v1.Container{
 						{
 							Name:            appLabel,
diff --git a/test/e2e/dlb/dlb.go b/test/e2e/dlb/dlb.go
index 6cfb6d2a..2637489a 100644
--- a/test/e2e/dlb/dlb.go
+++ b/test/e2e/dlb/dlb.go
@@ -30,7 +30,7 @@ import (
 )
 
 const (
-	kustomizationYaml = "deployments/dlb_plugin/kustomization.yaml"
+	kustomizationYaml = "deployments/dlb_plugin/overlays/dlb_initcontainer/kustomization.yaml"
 	demoPFYaml        = "demo/dlb-libdlb-demo-pf-pod.yaml"
 	demoVFYaml        = "demo/dlb-libdlb-demo-vf-pod.yaml"
 )
diff --git a/test/envtest/dlbdeviceplugin_controller_test.go b/test/envtest/dlbdeviceplugin_controller_test.go
index af5eebbe..5ad8ad1b 100644
--- a/test/envtest/dlbdeviceplugin_controller_test.go
+++ b/test/envtest/dlbdeviceplugin_controller_test.go
@@ -37,6 +37,7 @@ var _ = Describe("DlbDevicePlugin Controller", func() {
 		It("should handle DlbDevicePlugin objects correctly", func() {
 			spec := devicepluginv1.DlbDevicePluginSpec{
 				Image:        "dlb-testimage",
+				InitImage:    "dlb-testinitimage",
 				NodeSelector: map[string]string{"feature.node.kubernetes.io/dlb": "true"},
 			}
 
@@ -65,13 +66,18 @@ var _ = Describe("DlbDevicePlugin Controller", func() {
 			ds := &apps.DaemonSet{}
 			_ = k8sClient.Get(context.Background(), types.NamespacedName{Namespace: ns, Name: "intel-dlb-plugin"}, ds)
 			Expect(ds.Spec.Template.Spec.Containers[0].Image).To(Equal(spec.Image))
+			Expect(ds.Spec.Template.Spec.InitContainers).To(HaveLen(1))
+			Expect(ds.Spec.Template.Spec.InitContainers[0].Image).To(Equal(spec.InitImage))
 			Expect(ds.Spec.Template.Spec.NodeSelector).To(Equal(spec.NodeSelector))
 
 			By("updating DlbDevicePlugin successfully")
 			updatedImage := "updated-dlb-testimage"
+			updatedInitImage := "updated-dlb-testinitimage"
 			updatedNodeSelector := map[string]string{"updated-dlb-nodeselector": "true"}
 			updatedLogLevel := 3
+
 			fetched.Spec.Image = updatedImage
+			fetched.Spec.InitImage = updatedInitImage
 			fetched.Spec.NodeSelector = updatedNodeSelector
 			fetched.Spec.LogLevel = updatedLogLevel
 
@@ -92,10 +98,15 @@ var _ = Describe("DlbDevicePlugin Controller", func() {
 			}
 			Expect(ds.Spec.Template.Spec.Containers[0].Image).Should(Equal(updatedImage))
 			Expect(ds.Spec.Template.Spec.Containers[0].Args).Should(ConsistOf(expectArgs))
+			Expect(ds.Spec.Template.Spec.InitContainers).To(HaveLen(1))
+			Expect(ds.Spec.Template.Spec.InitContainers[0].Image).To(Equal(updatedInitImage))
 			Expect(ds.Spec.Template.Spec.NodeSelector).Should(Equal(updatedNodeSelector))
 
 			By("updating DlbDevicePlugin with different values successfully")
+			updatedInitImage = ""
 			updatedNodeSelector = map[string]string{}
+
+			fetched.Spec.InitImage = updatedInitImage
 			fetched.Spec.NodeSelector = updatedNodeSelector
 
 			Expect(k8sClient.Update(context.Background(), fetched)).Should(Succeed())
@@ -122,11 +133,12 @@ var _ = Describe("DlbDevicePlugin Controller", func() {
 	It("upgrades", func() {
 		dp := &devicepluginv1.DlbDevicePlugin{}
 
-		var image string
+		var image, initimage string
 
-		testUpgrade("dlb", dp, &image, nil)
+		testUpgrade("dlb", dp, &image, &initimage)
 
 		Expect(dp.Spec.Image == image).To(BeTrue())
+		Expect(dp.Spec.InitImage == initimage).To(BeTrue())
 	})
 
 	var _ = AfterEach(func() {
diff --git a/test/envtest/suite_test.go b/test/envtest/suite_test.go
index a51483df..005409b8 100644
--- a/test/envtest/suite_test.go
+++ b/test/envtest/suite_test.go
@@ -198,7 +198,8 @@ func makeDevicePlugin(name, image, initimage string) client.Object {
 	case "dlb":
 		obj = &devicepluginv1.DlbDevicePlugin{
 			Spec: devicepluginv1.DlbDevicePluginSpec{
-				Image: image,
+				Image:     image,
+				InitImage: initimage,
 			},
 		}
 	case "dsa":