Chart 0.0.1 cannot be installed: `allowPrivilegeEscalation: false` with `privileged: true`

[kenji-mido]

What happened

helm install of chart 0.0.1 fails — the DaemonSet is never created:

DaemonSet.apps "amd-gpu-device-plugin-daemonset" is invalid:
spec.template.spec.containers[0].securityContext:
cannot set `allowPrivilegeEscalation` to false and `privileged` to true

Cause

helm/amd-gpu/values.yaml#L12-L17
sets both:

dp:
  securityContext:
    privileged: true
    allowPrivilegeEscalation: false

Kubernetes rejects that pair in core API validation
(ValidateSecurityContext). main has the same values.

Reproduce

The install command from the user guide. No GPU is involved — the pod template is rejected during API validation, before scheduling — so a stock kind cluster reproduces it:

$ kind create cluster --name adp-repro --image kindest/node:v1.34.8    # no GPU present

$ helm upgrade --install amd-gpu \
    https://github.com/Project-HAMi/amd-device-plugin/releases/download/amd-gpu-helm-0.0.1/amd-gpu-0.0.1.tgz \
    --namespace kube-system --create-namespace
Release "amd-gpu" does not exist. Installing it now.
Error: 1 error occurred:
	* DaemonSet.apps "amd-gpu-device-plugin-daemonset" is invalid: spec.template.spec.containers[0].securityContext: Invalid value: {"Capabilities":{"Add":null,"Drop":["ALL"]},"Privileged":true,"SELinuxOptions":null,"WindowsOptions":null,"RunAsUser":null,"RunAsGroup":null,"RunAsNonRoot":null,"ReadOnlyRootFilesystem":null,"AllowPrivilegeEscalation":false,"ProcMount":null,"SeccompProfile":null,"AppArmorProfile":null}: cannot set `allowPrivilegeEscalation` to false and `privileged` to true

$ helm list -n kube-system
NAME     NAMESPACE    REVISION  STATUS  CHART          APP VERSION
amd-gpu  kube-system  1         failed  amd-gpu-0.0.1  0.0.1

The shipped values, read back from the release artifact itself:

$ helm show values https://github.com/Project-HAMi/amd-device-plugin/releases/download/amd-gpu-helm-0.0.1/amd-gpu-0.0.1.tgz \
    | sed -n '/securityContext:/,+5p'
  securityContext:
    privileged: true
    allowPrivilegeEscalation: false
    capabilities:
      drop:
        - ALL

The same command with that one field removed installs:

$ helm upgrade --install amd-gpu <chart> --namespace kube-system --create-namespace \
    --set dp.securityContext.allowPrivilegeEscalation=null
STATUS: deployed

$ kubectl get daemonset -n kube-system amd-gpu-device-plugin-daemonset
NAME                              DESIRED   CURRENT   READY   UP-TO-DATE   AVAILABLE   AGE
amd-gpu-device-plugin-daemonset   1         1         0       1            0           0s

READY 0 only because that throwaway cluster has no AMD GPU. On our MI300X node the same workaround brings the DaemonSet up and the device registers normally.

Suggested fix

Set allowPrivilegeEscalation: true, which is what HAMi's own chart does for the same kind of container: charts/hami/values.yaml uses privileged: true + allowPrivilegeEscalation: true for devicePlugin, and keeps allowPrivilegeEscalation: false for the non-privileged vgpu-monitor container only. Those defaults were settled in Project-HAMi/HAMi#1888.

privileged itself is not removable here: the DaemonSet mounts no /dev, so it is what reaches /dev/kfd and /dev/dri.

Environment

chart/image 0.0.1, reproduced on both:

• Kubernetes v1.36.2 (k3s) · MI300X VF, ROCm 7.0.2 · HAMi master (0345bd8)
• Kubernetes v1.34.8 (kind) · no GPU

Happy to send the one-line PR if useful.

[kenji-mido]

#18 covers this — its fix(helm): drop allowPrivilegeEscalation from securityContext commit removes the field from helm/amd-gpu/values.yaml.
That is a different route from the true suggested above, but either resolves the conflict and dropping the field is the smaller change.

Linking the two since #18 does not reference this issue.