agentsclimarketplace
Sign in

Techtide nvidia gpu operator kubernetes hardening

Skill TechTideOhio/techtide-harness-kit/skills/nvidia/techtide-nvidia-gpu-operator-kubernetes-hardening

Use this skill when reviewing NVIDIA GPU Operator deployments on Kubernetes - device plugin, MIG manager, NFD labels, time-sliced GPU configuration, container toolkit, securityContext posture, namespace tenancy, and admission policy coverage. Trigger when the user asks whether GPUs are being shared safely across tenants, whether MIG profiles are enforced, or whether the GPU Operator is deployed per NVIDIA hardening guidance.From its SKILL.md

Install
npx -y skills add TechTideOhio/techtide-harness-kit --skill techtide-nvidia-gpu-operator-kubernetes-hardening

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

2.7 KB, 413 tokens by cl100k_base, as published. Nobody here has run it

NVIDIA GPU Operator on Kubernetes Hardening

Purpose

Review NVIDIA GPU Operator deployments on Kubernetes against NVIDIA documentation and Kubernetes pod-security hardening: device plugin posture, MIG manager configuration, time-sliced GPU configuration, NFD label usage, container toolkit isolation, securityContext posture for GPU workloads, and admission policy enforcement of GPU resource requests.

Lean operating rules

  • Prefer live evidence (kubectl -n gpu-operator get pods, kubectl get clusterpolicy, kubectl get nodes -L nvidia.com/gpu.product, MIG profile annotations) when the active client exposes it; otherwise fall back to NVIDIA GPU Operator documentation and sanitized manifests.
  • Separate confirmed facts from inference. If MIG strategy, time-slicing config, or admission posture was not directly queried, say so.
  • Treat GPU workload pods running with privileged: true outside of the GPU Operator's own DaemonSets as a critical finding - privilege creep across tenant workloads.
  • Treat MIG-capable nodes running in single strategy on multi-tenant clusters when mixed is required as a high finding - partition diversity is impossible.
  • Treat time-sliced GPU configuration shared across tenants without namespace-scoped admission as a high finding - noisy-neighbor and side-channel risk.
  • Treat absence of an admission policy (Kyverno / OPA / ValidatingAdmissionPolicy) gating nvidia.com/gpu requests by namespace as a high finding for multi-tenant clusters.
  • Treat default GPU Operator deployment with public, unsigned image pulls as a medium finding - add image-verification policy.
  • Treat node-feature-discovery labels absent on GPU nodes as a low finding - scheduling reliability is reduced.

Response minimum

Return, at minimum:

  • the scoped target (cluster, GPU Operator version, MIG strategy) and evidence level,
  • device plugin and toolkit posture,
  • MIG / time-slicing posture,
  • admission policy posture for GPU resources,
  • namespace tenancy posture,
  • image verification posture,
  • safe next actions and assumptions or blockers.

What ships with it: 1 file

1.4 KB alongside SKILL.md

Keep looking

Skills are one crate of 326,835. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.