Repository: intel/intel-device-plugins-for-kubernetes
Pull request #1149 (2022-09-09 14:38:46)

Add GPU plugin README prerequisites section
This was inspired by ticket https://github.com/intel/intel-device-plugins-for-kubernetes/issues/1109, and fills one of the  items listed in ticket https://github.com/intel/intel-device-plugins-for-kubernetes/issues/1060, by documenting how to get suitable kernel and user-space drivers.  It also slightly updates other related sections.

Note: Kernel driver installation section is quite large because currently there does not seem to be any official documentation on how to install Intel discrete GPU kernel drivers.  When there is, that section needs rewrite.

For now, I put installation of both kernel driver (= cluster admin responsibility), and user-space drivers (= WL developer responsibility) under prerequisites section, although it could be argued that latter could belong also to a (currently missing) "GPU plugin usage" section [1].

PS. I looked into splitting prerequisites and usage parts out of the fractionalization install section, but gave up.  I think @uniemimu or @tkatila are the the only ones who can do that.  After those are split out, there's actually some meat for the "GPU plugin usage" section.

[1] ticket https://github.com/intel/intel-device-plugins-for-kubernetes/issues/1045  asks for role-based documentation split-up.

codecov-commenter: # [Codecov](https://codecov.io/gh/intel/intel-device-plugins-for-kubernetes/pull/1149?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=intel) Report
> Merging [#1149](https://codecov.io/gh/intel/intel-device-plugins-for-kubernetes/pull/1149?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=intel) (4c1e2ad) into [main](https://codecov.io/gh/intel/intel-device-plugins-for-kubernetes/commit/2ee4b61b2910c5f3e629ef0f39e7d3c09ec8ef7a?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=intel) (2ee4b61) will **not change** coverage.
> The diff coverage is `n/a`.

```diff
@@           Coverage Diff           @@
##             main    #1149   +/-   ##
=======================================
  Coverage   52.96%   52.96%           
=======================================
  Files          40       40           
  Lines        4358     4358           
=======================================
  Hits         2308     2308           
  Misses       1923     1923           
  Partials      127      127           
```



:mega: We’re building smart automated test selection to slash your CI/CD build times. [Learn more](https://about.codecov.io/iterative-testing/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=intel)

eero-t: Rebased to "main" to resolve conflicts with recently merged documentation changes.

Patch:
diff --git a/Makefile b/Makefile
index 05ebf246..c77fc132 100644
--- a/Makefile
+++ b/Makefile
@@ -9,7 +9,7 @@ BUILDER ?= "docker"
 EXTRA_BUILD_ARGS ?= ""
 
 CERT_MANAGER_VERSION ?= v1.8.1
-CONTROLLER_GEN_VERSION ?= v0.10.0
+CONTROLLER_GEN_VERSION ?= v0.9.2
 GOLANGCI_LINT_VERSION ?= v1.48.0
 KIND_VERSION ?= v0.14.0
 GOLICENSES_VERSION ?= v1.2.0
diff --git a/cmd/gpu_plugin/README.md b/cmd/gpu_plugin/README.md
index 9dbc42ea..5ff09e22 100644
--- a/cmd/gpu_plugin/README.md
+++ b/cmd/gpu_plugin/README.md
@@ -5,6 +5,11 @@ Table of Contents
 * [Introduction](#introduction)
 * [Modes and Configuration Options](#modes-and-configuration-options)
 * [Installation](#installation)
+    * [Prerequisites](#prerequisites)
+        * [Drivers for discrete GPUs](#drivers-for-discrete-gpus)
+            * [Kernel driver](#kernel-driver)
+            * [User-space drivers](#user-space-drivers)
+        * [Drivers for older (integrated) GPUs](#drivers-for-older-integrated-gpus)
     * [Pre-built Images](#pre-built-images)
          * [Install to all nodes](#install-to-all-nodes)
          * [Install to nodes with Intel GPUs with NFD](#install-to-nodes-with-intel-gpus-with-nfd)
@@ -19,7 +24,8 @@ Table of Contents
 ## Introduction
 
 Intel GPU plugin facilitates Kubernetes workload offloading by providing access to
-discrete (including Intel® Data Center GPU Flex Series) and integrated Intel GPU device files.
+discrete (including Intel® Data Center GPU Flex Series) and integrated Intel GPU devices
+supported by the host kernel.
 
 Use cases include, but are not limited to:
 - Media transcode
@@ -50,6 +56,73 @@ The following sections detail how to obtain, build, deploy and test the GPU devi
 
 Examples are provided showing how to deploy the plugin either using a DaemonSet or by hand on a per-node basis.
 
+### Prerequisites
+
+Access to a GPU device requires firmware, kernel and user-space
+drivers supporting it.  Firmware and kernel driver need to be on the
+host, user-space drivers in the GPU workload containers.
+
+Intel GPU devices supported by the current kernel can be listed with:
+```
+$ grep i915 /sys/class/drm/card?/device/uevent
+/sys/class/drm/card0/device/uevent:DRIVER=i915
+/sys/class/drm/card1/device/uevent:DRIVER=i915
+```
+
+#### Drivers for discrete GPUs
+
+##### Kernel driver
+
+For now, kernel needs to be built from sources. Later on there will
+also be pre-built kernels and/or DKMS GPU module distro packages for
+the enterprise / long-term-support kernels.
+
+While last 5.x upstream Linux kernel releases already had preliminary
+discrete Intel GPU support, one should really use kernel v6.x.
+
+In upstream kernels, discrete GPU support needs to be enabled with kernel
+`i915.force_probe=<PCI_ID>` command line option until relevant kernel
+driver features have been completed in upstream:
+https://www.kernel.org/doc/html/latest/gpu/rfc/index.html
+
+PCI IDs for the Intel GPUs on given host can be listed with:
+```
+$ lspci | grep -e VGA -e Display | grep Intel
+88:00.0 Display controller: Intel Corporation Device 56c1 (rev 05)
+8d:00.0 Display controller: Intel Corporation Device 56c1 (rev 05)
+```
+
+(`lspci` lists GPUs with display support as "VGA compatible controller",
+and server GPUs without display support, as "Display controller".)
+
+Mesa "Iris" 3D driver header provides a mapping between GPU PCI IDs and their Intel brand names:
+https://gitlab.freedesktop.org/mesa/mesa/-/blob/main/include/pci_ids/iris_pci_ids.h
+
+If your kernel build does not find the correct firmware version for
+a given GPU from the host (see `dmesg | grep i915` output), latest
+firmware versions are available in upstream:
+https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/tree/i915
+
+##### User-space drivers
+
+Until new enough user-space drivers (supporting also discrete GPUs)
+are available directly from distribution package repositories, they
+can be installed to containers from Intel package repositories. See:
+https://dgpu-docs.intel.com/installation-guides/index.html
+
+Example container is listed in [Testing and demos](#testing-and-demos).
+
+Validation status against *upstream* kernel is listed in the user-space drivers release notes:
+* Media driver: https://github.com/intel/media-driver/releases
+* Compute driver: https://github.com/intel/compute-runtime/releases
+
+#### Drivers for older (integrated) GPUs
+
+For the older (integrated) GPUs, new enough firmware and kernel driver
+are typically included already with the host OS, and new enough
+user-space drivers (for the GPU containers) are in the host OS
+repositories.
+
 ### Pre-built Images
 
 [Pre-built images](https://hub.docker.com/r/intel/intel-gpu-plugin)
@@ -155,8 +228,8 @@ master
 ## Testing and Demos
 
 We can test the plugin is working by deploying an OpenCL image and running `clinfo`.
-The sample OpenCL image can be built using `make intel-opencl-icd` and must be made
-available in the cluster.
+[intel-opencl-icd](../../demo/intel-opencl-icd/) sample OpenCL image, built using
+`make intel-opencl-icd` and available from DockerHub, is used for this.
 
 1. Create a job:
 
@@ -174,8 +247,8 @@ available in the cluster.
     <log output>
     ```
 
-    If the pod did not successfully launch, possibly because it could not obtain the gpu
-    resource, it will be stuck in the `Pending` status:
+    If the pod did not successfully launch, possibly because it could not obtain
+    the requested GPU resource, it will be stuck in the `Pending` status:
 
     ```bash
     $ kubectl get pods
diff --git a/deployments/dlb_plugin/base/intel-dlb-plugin.yaml b/deployments/dlb_plugin/base/intel-dlb-plugin.yaml
index 354f3c9c..60adf69b 100644
--- a/deployments/dlb_plugin/base/intel-dlb-plugin.yaml
+++ b/deployments/dlb_plugin/base/intel-dlb-plugin.yaml
@@ -13,7 +13,6 @@ spec:
       labels:
         app: intel-dlb-plugin
     spec:
-      automountServiceAccountToken: false
       containers:
       - name: intel-dlb-plugin
         env:
diff --git a/deployments/dsa_plugin/base/intel-dsa-plugin.yaml b/deployments/dsa_plugin/base/intel-dsa-plugin.yaml
index 7bb8cc47..a7a3d605 100644
--- a/deployments/dsa_plugin/base/intel-dsa-plugin.yaml
+++ b/deployments/dsa_plugin/base/intel-dsa-plugin.yaml
@@ -13,7 +13,6 @@ spec:
       labels:
         app: intel-dsa-plugin
     spec:
-      automountServiceAccountToken: false
       containers:
       - name: intel-dsa-plugin
         env:
diff --git a/deployments/fpga_admissionwebhook/crd/bases/fpga.intel.com_acceleratorfunctions.yaml b/deployments/fpga_admissionwebhook/crd/bases/fpga.intel.com_acceleratorfunctions.yaml
index 716acdee..47972089 100644
--- a/deployments/fpga_admissionwebhook/crd/bases/fpga.intel.com_acceleratorfunctions.yaml
+++ b/deployments/fpga_admissionwebhook/crd/bases/fpga.intel.com_acceleratorfunctions.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.10.0
+    controller-gen.kubebuilder.io/version: v0.9.2
   creationTimestamp: null
   name: acceleratorfunctions.fpga.intel.com
 spec:
diff --git a/deployments/fpga_admissionwebhook/crd/bases/fpga.intel.com_fpgaregions.yaml b/deployments/fpga_admissionwebhook/crd/bases/fpga.intel.com_fpgaregions.yaml
index 170bc10f..bbdacf76 100644
--- a/deployments/fpga_admissionwebhook/crd/bases/fpga.intel.com_fpgaregions.yaml
+++ b/deployments/fpga_admissionwebhook/crd/bases/fpga.intel.com_fpgaregions.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.10.0
+    controller-gen.kubebuilder.io/version: v0.9.2
   creationTimestamp: null
   name: fpgaregions.fpga.intel.com
 spec:
diff --git a/deployments/gpu_plugin/overlays/fractional_resources/add-nodeselector-intel-gpu.yaml b/deployments/gpu_plugin/overlays/fractional_resources/add-nodeselector-intel-gpu.yaml
deleted file mode 100644
index 5f0fe703..00000000
--- a/deployments/gpu_plugin/overlays/fractional_resources/add-nodeselector-intel-gpu.yaml
+++ /dev/null
@@ -1,9 +0,0 @@
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: intel-gpu-plugin
-spec:
-  template:
-    spec:
-      nodeSelector:
-        intel.feature.node.kubernetes.io/gpu: "true"
diff --git a/deployments/gpu_plugin/overlays/fractional_resources/kustomization.yaml b/deployments/gpu_plugin/overlays/fractional_resources/kustomization.yaml
index c4581ec4..08e364f5 100644
--- a/deployments/gpu_plugin/overlays/fractional_resources/kustomization.yaml
+++ b/deployments/gpu_plugin/overlays/fractional_resources/kustomization.yaml
@@ -8,4 +8,3 @@ patches:
   - path: add-serviceaccount.yaml
   - path: add-podresource-mount.yaml
   - path: add-args.yaml
-  - path: add-nodeselector-intel-gpu.yaml
diff --git a/deployments/iaa_plugin/base/intel-iaa-plugin.yaml b/deployments/iaa_plugin/base/intel-iaa-plugin.yaml
index 5f2731d8..e9f19800 100644
--- a/deployments/iaa_plugin/base/intel-iaa-plugin.yaml
+++ b/deployments/iaa_plugin/base/intel-iaa-plugin.yaml
@@ -13,7 +13,6 @@ spec:
       labels:
         app: intel-iaa-plugin
     spec:
-      automountServiceAccountToken: false
       containers:
       - name: intel-iaa-plugin
         env:
diff --git a/deployments/nfd/overlays/node-feature-rules/node-feature-rules-openshift.yaml b/deployments/nfd/overlays/node-feature-rules/node-feature-rules-openshift.yaml
index 2e75c75c..95fb610f 100755
--- a/deployments/nfd/overlays/node-feature-rules/node-feature-rules-openshift.yaml
+++ b/deployments/nfd/overlays/node-feature-rules/node-feature-rules-openshift.yaml
@@ -55,7 +55,7 @@ spec:
             class: {op: In, value: ["0300", "0380"]}
         - feature: kernel.loadedmodule
           matchExpressions:
-            i915: {op: Exists}
+            drm: {op: Exists}
 
     - name: "intel.iaa"
       labels:
diff --git a/deployments/nfd/overlays/node-feature-rules/node-feature-rules.yaml b/deployments/nfd/overlays/node-feature-rules/node-feature-rules.yaml
index 856d8a3b..48886616 100644
--- a/deployments/nfd/overlays/node-feature-rules/node-feature-rules.yaml
+++ b/deployments/nfd/overlays/node-feature-rules/node-feature-rules.yaml
@@ -59,7 +59,7 @@ spec:
             class: {op: In, value: ["0300", "0380"]}
         - feature: kernel.loadedmodule
           matchExpressions:
-            i915: {op: Exists}
+            drm: {op: Exists}
 
     - name: "intel.iaa"
       labels:
diff --git a/deployments/operator/crd/bases/deviceplugin.intel.com_dlbdeviceplugins.yaml b/deployments/operator/crd/bases/deviceplugin.intel.com_dlbdeviceplugins.yaml
index b72b06e6..9d8ec8f1 100644
--- a/deployments/operator/crd/bases/deviceplugin.intel.com_dlbdeviceplugins.yaml
+++ b/deployments/operator/crd/bases/deviceplugin.intel.com_dlbdeviceplugins.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.10.0
+    controller-gen.kubebuilder.io/version: v0.9.2
   creationTimestamp: null
   name: dlbdeviceplugins.deviceplugin.intel.com
 spec:
diff --git a/deployments/operator/crd/bases/deviceplugin.intel.com_dsadeviceplugins.yaml b/deployments/operator/crd/bases/deviceplugin.intel.com_dsadeviceplugins.yaml
index 084a5f52..a53966af 100644
--- a/deployments/operator/crd/bases/deviceplugin.intel.com_dsadeviceplugins.yaml
+++ b/deployments/operator/crd/bases/deviceplugin.intel.com_dsadeviceplugins.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.10.0
+    controller-gen.kubebuilder.io/version: v0.9.2
   creationTimestamp: null
   name: dsadeviceplugins.deviceplugin.intel.com
 spec:
diff --git a/deployments/operator/crd/bases/deviceplugin.intel.com_fpgadeviceplugins.yaml b/deployments/operator/crd/bases/deviceplugin.intel.com_fpgadeviceplugins.yaml
index e7b6a574..336b6e99 100644
--- a/deployments/operator/crd/bases/deviceplugin.intel.com_fpgadeviceplugins.yaml
+++ b/deployments/operator/crd/bases/deviceplugin.intel.com_fpgadeviceplugins.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.10.0
+    controller-gen.kubebuilder.io/version: v0.9.2
   creationTimestamp: null
   name: fpgadeviceplugins.deviceplugin.intel.com
 spec:
diff --git a/deployments/operator/crd/bases/deviceplugin.intel.com_gpudeviceplugins.yaml b/deployments/operator/crd/bases/deviceplugin.intel.com_gpudeviceplugins.yaml
index 6fc07cff..045a31d1 100644
--- a/deployments/operator/crd/bases/deviceplugin.intel.com_gpudeviceplugins.yaml
+++ b/deployments/operator/crd/bases/deviceplugin.intel.com_gpudeviceplugins.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.10.0
+    controller-gen.kubebuilder.io/version: v0.9.2
   creationTimestamp: null
   name: gpudeviceplugins.deviceplugin.intel.com
 spec:
diff --git a/deployments/operator/crd/bases/deviceplugin.intel.com_iaadeviceplugins.yaml b/deployments/operator/crd/bases/deviceplugin.intel.com_iaadeviceplugins.yaml
index b684fbd3..84aa0a27 100644
--- a/deployments/operator/crd/bases/deviceplugin.intel.com_iaadeviceplugins.yaml
+++ b/deployments/operator/crd/bases/deviceplugin.intel.com_iaadeviceplugins.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.10.0
+    controller-gen.kubebuilder.io/version: v0.9.2
   creationTimestamp: null
   name: iaadeviceplugins.deviceplugin.intel.com
 spec:
diff --git a/deployments/operator/crd/bases/deviceplugin.intel.com_qatdeviceplugins.yaml b/deployments/operator/crd/bases/deviceplugin.intel.com_qatdeviceplugins.yaml
index ded8755a..8bf3668e 100644
--- a/deployments/operator/crd/bases/deviceplugin.intel.com_qatdeviceplugins.yaml
+++ b/deployments/operator/crd/bases/deviceplugin.intel.com_qatdeviceplugins.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.10.0
+    controller-gen.kubebuilder.io/version: v0.9.2
   creationTimestamp: null
   name: qatdeviceplugins.deviceplugin.intel.com
 spec:
diff --git a/deployments/operator/crd/bases/deviceplugin.intel.com_sgxdeviceplugins.yaml b/deployments/operator/crd/bases/deviceplugin.intel.com_sgxdeviceplugins.yaml
index be2c62f6..3ec342bf 100644
--- a/deployments/operator/crd/bases/deviceplugin.intel.com_sgxdeviceplugins.yaml
+++ b/deployments/operator/crd/bases/deviceplugin.intel.com_sgxdeviceplugins.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.10.0
+    controller-gen.kubebuilder.io/version: v0.9.2
   creationTimestamp: null
   name: sgxdeviceplugins.deviceplugin.intel.com
 spec:
diff --git a/deployments/operator/crd/bases/fpga.intel.com_acceleratorfunctions.yaml b/deployments/operator/crd/bases/fpga.intel.com_acceleratorfunctions.yaml
index 716acdee..47972089 100644
--- a/deployments/operator/crd/bases/fpga.intel.com_acceleratorfunctions.yaml
+++ b/deployments/operator/crd/bases/fpga.intel.com_acceleratorfunctions.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.10.0
+    controller-gen.kubebuilder.io/version: v0.9.2
   creationTimestamp: null
   name: acceleratorfunctions.fpga.intel.com
 spec:
diff --git a/deployments/operator/crd/bases/fpga.intel.com_fpgaregions.yaml b/deployments/operator/crd/bases/fpga.intel.com_fpgaregions.yaml
index 170bc10f..bbdacf76 100644
--- a/deployments/operator/crd/bases/fpga.intel.com_fpgaregions.yaml
+++ b/deployments/operator/crd/bases/fpga.intel.com_fpgaregions.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.10.0
+    controller-gen.kubebuilder.io/version: v0.9.2
   creationTimestamp: null
   name: fpgaregions.fpga.intel.com
 spec:
diff --git a/deployments/operator/webhook/manifests.yaml b/deployments/operator/webhook/manifests.yaml
index 8428db3a..b0b271ce 100644
--- a/deployments/operator/webhook/manifests.yaml
+++ b/deployments/operator/webhook/manifests.yaml
@@ -134,7 +134,6 @@ webhooks:
       path: /mutate-deviceplugin-intel-com-v1-sgxdeviceplugin
   failurePolicy: Fail
   name: msgxdeviceplugin.kb.io
-  reinvocationPolicy: IfNeeded
   rules:
   - apiGroups:
     - deviceplugin.intel.com
@@ -173,9 +172,9 @@ webhooks:
       name: webhook-service
       namespace: system
       path: /pods-sgx
+  reinvocationPolicy: IfNeeded
   failurePolicy: Ignore
   name: sgx.mutator.webhooks.intel.com
-  reinvocationPolicy: IfNeeded
   rules:
   - apiGroups:
     - ""
diff --git a/deployments/qat_plugin/base/intel-qat-plugin.yaml b/deployments/qat_plugin/base/intel-qat-plugin.yaml
index dfe9414e..e46214d1 100644
--- a/deployments/qat_plugin/base/intel-qat-plugin.yaml
+++ b/deployments/qat_plugin/base/intel-qat-plugin.yaml
@@ -13,13 +13,10 @@ spec:
       labels:
         app: intel-qat-plugin
     spec:
-      automountServiceAccountToken: false
       containers:
       - name: intel-qat-plugin
         image: intel/intel-qat-plugin:devel
         securityContext:
-          seLinuxOptions:
-            type: "container_device_plugin_t"
           readOnlyRootFilesystem: true
           allowPrivilegeEscalation: false
         imagePullPolicy: IfNotPresent
diff --git a/deployments/sgx_admissionwebhook/webhook/manifests.yaml b/deployments/sgx_admissionwebhook/webhook/manifests.yaml
index ef3d2689..6d2b2089 100644
--- a/deployments/sgx_admissionwebhook/webhook/manifests.yaml
+++ b/deployments/sgx_admissionwebhook/webhook/manifests.yaml
@@ -1,3 +1,4 @@
+
 ---
 apiVersion: admissionregistration.k8s.io/v1
 kind: MutatingWebhookConfiguration
@@ -12,9 +13,9 @@ webhooks:
       name: webhook-service
       namespace: system
       path: /pods-sgx
+  reinvocationPolicy: IfNeeded
   failurePolicy: Ignore
   name: sgx.mutator.webhooks.intel.com
-  reinvocationPolicy: IfNeeded
   rules:
   - apiGroups:
     - ""
diff --git a/deployments/sgx_plugin/base/intel-sgx-plugin.yaml b/deployments/sgx_plugin/base/intel-sgx-plugin.yaml
index 9e402028..7e5499d5 100644
--- a/deployments/sgx_plugin/base/intel-sgx-plugin.yaml
+++ b/deployments/sgx_plugin/base/intel-sgx-plugin.yaml
@@ -13,7 +13,6 @@ spec:
       labels:
         app: intel-sgx-plugin
     spec:
-      automountServiceAccountToken: false
       containers:
       - name: intel-sgx-plugin
         image: intel/intel-sgx-plugin:devel
diff --git a/deployments/vpu_plugin/base/intel-vpu-plugin.yaml b/deployments/vpu_plugin/base/intel-vpu-plugin.yaml
index 47065704..92af8cb9 100644
--- a/deployments/vpu_plugin/base/intel-vpu-plugin.yaml
+++ b/deployments/vpu_plugin/base/intel-vpu-plugin.yaml
@@ -13,7 +13,6 @@ spec:
       labels:
         app: intel-vpu-plugin
     spec:
-      automountServiceAccountToken: false
       containers:
       - name: intel-vpu-plugin
         env:
diff --git a/go.mod b/go.mod
index 4d394c6f..e82260ae 100644
--- a/go.mod
+++ b/go.mod
@@ -9,7 +9,7 @@ require (
 	github.com/google/go-cmp v0.5.9
 	github.com/google/gousb v1.1.2
 	github.com/klauspost/cpuid/v2 v2.1.1
-	github.com/onsi/ginkgo/v2 v2.2.0
+	github.com/onsi/ginkgo/v2 v2.1.6
 	github.com/onsi/gomega v1.20.2
 	github.com/pkg/errors v0.9.1
 	golang.org/x/sys v0.0.0-20220808155132-1c4a2a72c664
diff --git a/go.sum b/go.sum
index 413a030a..13ba5b6e 100644
--- a/go.sum
+++ b/go.sum
@@ -251,8 +251,8 @@ github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e h1:fD57ERR4JtEqsWb
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
 github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
 github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
-github.com/onsi/ginkgo/v2 v2.2.0 h1:3ZNA3L1c5FYDFTTxbFeVGGD8jYvjYauHD30YgLxVsNI=
-github.com/onsi/ginkgo/v2 v2.2.0/go.mod h1:MEH45j8TBi6u9BMogfbp0stKC5cdGjumZj5Y7AG4VIk=
+github.com/onsi/ginkgo/v2 v2.1.6 h1:Fx2POJZfKRQcM1pH49qSZiYeu319wji004qX+GDovrU=
+github.com/onsi/ginkgo/v2 v2.1.6/go.mod h1:MEH45j8TBi6u9BMogfbp0stKC5cdGjumZj5Y7AG4VIk=
 github.com/onsi/gomega v1.20.2 h1:8uQq0zMgLEfa0vRrrBgaJF2gyW9Da9BmfGV+OyUzfkY=
 github.com/onsi/gomega v1.20.2/go.mod h1:iYAIXgPSaDHak0LCMA+AWBpIKBr8WZicMxnE8luStNc=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
diff --git a/pkg/apis/deviceplugin/v1/sgxdeviceplugin_webhook.go b/pkg/apis/deviceplugin/v1/sgxdeviceplugin_webhook.go
index af82a393..5947b670 100644
--- a/pkg/apis/deviceplugin/v1/sgxdeviceplugin_webhook.go
+++ b/pkg/apis/deviceplugin/v1/sgxdeviceplugin_webhook.go
@@ -42,7 +42,7 @@ func (r *SgxDevicePlugin) SetupWebhookWithManager(mgr ctrl.Manager) error {
 		Complete()
 }
 
-// +kubebuilder:webhook:path=/mutate-deviceplugin-intel-com-v1-sgxdeviceplugin,mutating=true,failurePolicy=fail,groups=deviceplugin.intel.com,resources=sgxdeviceplugins,verbs=create;update,versions=v1,name=msgxdeviceplugin.kb.io,sideEffects=None,admissionReviewVersions=v1,reinvocationPolicy=IfNeeded
+// +kubebuilder:webhook:path=/mutate-deviceplugin-intel-com-v1-sgxdeviceplugin,mutating=true,failurePolicy=fail,groups=deviceplugin.intel.com,resources=sgxdeviceplugins,verbs=create;update,versions=v1,name=msgxdeviceplugin.kb.io,sideEffects=None,admissionReviewVersions=v1
 
 var _ webhook.Defaulter = &SgxDevicePlugin{}
 
diff --git a/pkg/controllers/qat/controller.go b/pkg/controllers/qat/controller.go
index 75900052..a062927c 100644
--- a/pkg/controllers/qat/controller.go
+++ b/pkg/controllers/qat/controller.go
@@ -222,9 +222,6 @@ func setInitContainer(dsSpec *v1.PodSpec, dpSpec devicepluginv1.QatDevicePluginS
 				Value: strings.Join(enablingPfPciIDs, " "),
 			}},
 			SecurityContext: &v1.SecurityContext{
-				SELinuxOptions: &v1.SELinuxOptions{
-					Type: "container_device_plugin_init_t",
-				},
 				Privileged:             &yes,
 				ReadOnlyRootFilesystem: &yes,
 			},
diff --git a/pkg/webhooks/sgx/sgx.go b/pkg/webhooks/sgx/sgx.go
index 406681a7..da8ed1e2 100644
--- a/pkg/webhooks/sgx/sgx.go
+++ b/pkg/webhooks/sgx/sgx.go
@@ -27,7 +27,7 @@ import (
 	"github.com/intel/intel-device-plugins-for-kubernetes/pkg/internal/containers"
 )
 
-// +kubebuilder:webhook:path=/pods-sgx,mutating=true,failurePolicy=ignore,groups="",resources=pods,verbs=create;update,versions=v1,name=sgx.mutator.webhooks.intel.com,sideEffects=None,admissionReviewVersions=v1,reinvocationPolicy=IfNeeded
+// +kubebuilder:webhook:path=/pods-sgx,mutating=true,failurePolicy=ignore,groups="",resources=pods,verbs=create;update,versions=v1,name=sgx.mutator.webhooks.intel.com,sideEffects=None,admissionReviewVersions=v1
 
 // Mutator annotates Pods.
 type Mutator struct {


Test patch:
diff --git a/pkg/controllers/dlb/controller_test.go b/pkg/controllers/dlb/controller_test.go
index a93ac487..2d4b50ef 100644
--- a/pkg/controllers/dlb/controller_test.go
+++ b/pkg/controllers/dlb/controller_test.go
@@ -60,7 +60,6 @@ func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet
 					},
 				},
 				Spec: v1.PodSpec{
-					AutomountServiceAccountToken: &no,
 					Containers: []v1.Container{
 						{
 							Name: appLabel,
diff --git a/pkg/controllers/dsa/controller_test.go b/pkg/controllers/dsa/controller_test.go
index 42fe129c..535fee1a 100644
--- a/pkg/controllers/dsa/controller_test.go
+++ b/pkg/controllers/dsa/controller_test.go
@@ -61,7 +61,6 @@ func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet
 					},
 				},
 				Spec: v1.PodSpec{
-					AutomountServiceAccountToken: &no,
 					Containers: []v1.Container{
 						{
 							Name: appLabel,
diff --git a/pkg/controllers/iaa/controller_test.go b/pkg/controllers/iaa/controller_test.go
deleted file mode 100644
index 76ec2074..00000000
--- a/pkg/controllers/iaa/controller_test.go
+++ /dev/null
@@ -1,168 +0,0 @@
-// Copyright 2022 Intel Corporation. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package iaa
-
-import (
-	"reflect"
-	"testing"
-
-	apps "k8s.io/api/apps/v1"
-	v1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/util/diff"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-
-	devicepluginv1 "github.com/intel/intel-device-plugins-for-kubernetes/pkg/apis/deviceplugin/v1"
-)
-
-const appLabel = "intel-iaa-plugin"
-
-// newDaemonSetExpected creates plugin daemonset
-// it's copied from the original controller code (before the usage of go:embed).
-func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet {
-	devicePlugin := rawObj.(*devicepluginv1.IaaDevicePlugin)
-
-	yes := true
-	no := false
-	daemonSet := apps.DaemonSet{
-		TypeMeta: metav1.TypeMeta{
-			Kind:       "DaemonSet",
-			APIVersion: "apps/v1",
-		},
-		ObjectMeta: metav1.ObjectMeta{
-			Namespace: c.ns,
-			Name:      appLabel,
-			Labels: map[string]string{
-				"app": appLabel,
-			},
-		},
-		Spec: apps.DaemonSetSpec{
-			Selector: &metav1.LabelSelector{
-				MatchLabels: map[string]string{
-					"app": appLabel,
-				},
-			},
-			Template: v1.PodTemplateSpec{
-				ObjectMeta: metav1.ObjectMeta{
-					Labels: map[string]string{
-						"app": appLabel,
-					},
-				},
-				Spec: v1.PodSpec{
-					AutomountServiceAccountToken: &no,
-					Containers: []v1.Container{
-						{
-							Name: appLabel,
-							Env: []v1.EnvVar{
-								{
-									Name: "NODE_NAME",
-									ValueFrom: &v1.EnvVarSource{
-										FieldRef: &v1.ObjectFieldSelector{
-											FieldPath: "spec.nodeName",
-										},
-									},
-								},
-							},
-							Args:            getPodArgs(devicePlugin),
-							Image:           devicePlugin.Spec.Image,
-							ImagePullPolicy: "IfNotPresent",
-							SecurityContext: &v1.SecurityContext{
-								ReadOnlyRootFilesystem:   &yes,
-								AllowPrivilegeEscalation: &no,
-							},
-							VolumeMounts: []v1.VolumeMount{
-								{
-									Name:      "devfs",
-									MountPath: "/dev/iax",
-									ReadOnly:  true,
-								},
-								{
-									Name:      "chardevs",
-									MountPath: "/dev/char",
-									ReadOnly:  true,
-								},
-								{
-									Name:      "sysfs",
-									MountPath: "/sys/bus/dsa/devices",
-									ReadOnly:  true,
-								},
-								{
-									Name:      "kubeletsockets",
-									MountPath: "/var/lib/kubelet/device-plugins",
-								},
-							},
-						},
-					},
-					NodeSelector: map[string]string{"kubernetes.io/arch": "amd64"},
-					Volumes: []v1.Volume{
-						{
-							Name: "devfs",
-							VolumeSource: v1.VolumeSource{
-								HostPath: &v1.HostPathVolumeSource{
-									Path: "/dev/iax",
-								},
-							},
-						},
-						{
-							Name: "chardevs",
-							VolumeSource: v1.VolumeSource{
-								HostPath: &v1.HostPathVolumeSource{
-									Path: "/dev/char",
-								},
-							},
-						},
-						{
-							Name: "sysfs",
-							VolumeSource: v1.VolumeSource{
-								HostPath: &v1.HostPathVolumeSource{
-									Path: "/sys/bus/dsa/devices",
-								},
-							},
-						},
-						{
-							Name: "kubeletsockets",
-							VolumeSource: v1.VolumeSource{
-								HostPath: &v1.HostPathVolumeSource{
-									Path: "/var/lib/kubelet/device-plugins",
-								},
-							},
-						},
-					},
-				},
-			},
-		},
-	}
-
-	// add the optional init container
-	if devicePlugin.Spec.InitImage != "" {
-		addInitContainer(&daemonSet, devicePlugin)
-	}
-
-	return &daemonSet
-}
-
-// Test that IAA daemonset created by using go:embed is
-// equal to the expected daemonset.
-func TestNewDaemonSetIAA(t *testing.T) {
-	plugin := &devicepluginv1.IaaDevicePlugin{}
-	c := &controller{}
-
-	expected := c.newDaemonSetExpected(plugin)
-	actual := c.NewDaemonSet(plugin)
-
-	if !reflect.DeepEqual(expected, actual) {
-		t.Errorf("expected and actuall daemonsets differ: %+s", diff.ObjectGoPrintDiff(expected, actual))
-	}
-}
diff --git a/pkg/controllers/qat/controller_test.go b/pkg/controllers/qat/controller_test.go
index 3b7a4905..9876beb1 100644
--- a/pkg/controllers/qat/controller_test.go
+++ b/pkg/controllers/qat/controller_test.go
@@ -65,7 +65,6 @@ func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet
 					Annotations: pluginAnnotations,
 				},
 				Spec: v1.PodSpec{
-					AutomountServiceAccountToken: &no,
 					Containers: []v1.Container{
 						{
 							Name:            appLabel,
@@ -73,9 +72,6 @@ func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet
 							Image:           devicePlugin.Spec.Image,
 							ImagePullPolicy: "IfNotPresent",
 							SecurityContext: &v1.SecurityContext{
-								SELinuxOptions: &v1.SELinuxOptions{
-									Type: "container_device_plugin_t",
-								},
 								ReadOnlyRootFilesystem:   &yes,
 								AllowPrivilegeEscalation: &no,
 							},
diff --git a/pkg/controllers/sgx/controller_test.go b/pkg/controllers/sgx/controller_test.go
index f4a7b20d..2dd184ce 100644
--- a/pkg/controllers/sgx/controller_test.go
+++ b/pkg/controllers/sgx/controller_test.go
@@ -63,7 +63,6 @@ func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet
 					},
 				},
 				Spec: v1.PodSpec{
-					AutomountServiceAccountToken: &no,
 					Containers: []v1.Container{
 						{
 							Name:            appLabel,