Define restrict_profiling

README.md

@@ -659,6 +659,20 @@ For VGPU, the driver source is cloud provider specific and has to be specified
 via either `profile::gpu::install::vgpu::rpm::source` for rpms or
 `profile::gpu::install::vgpu::bin::source` for binary installer.
 
+### parameters
+
+| Variable               | Description                                                    | Type          |
+| :--------------------- | :------------------------------------------------------------- | :------------ |
+| `restrict_profiling`   | Restrict access to NVIDIA GPU Performance Counters to root     | Boolean       |
+
+<details>
+<summary>default values</summary>
+
+```yaml
+profile::gpu::restrict_profiling: false
+```
+</details>
+
 ## `profile::jupyterhub::hub`
 
 > JupyterHub is a multi-user server for Jupyter Notebooks. It is designed to support many users by

site/profile/manifests/gpu.pp

@@ -1,4 +1,6 @@
-class profile::gpu {
+class profile::gpu (
+  Boolean $restrict_profiling = false,
+) {
   if $facts['nvidia_gpu_count'] > 0 {
     require profile::gpu::install
     if ! $facts['nvidia_grid_vgpu'] {
@@ -21,8 +23,8 @@
 
 class profile::gpu::install (
   String $lib_symlink_path = undef,
-  Boolean $allow_profiling_for_all = false
 ) {
+  $restrict_profiling = lookup('profile::gpu::restrict_profiling')
   ensure_resource('file', '/etc/nvidia', { 'ensure' => 'directory' })
   ensure_packages(['kernel-devel'], { 'name' => "kernel-devel-${facts['kernelrelease']}" })
   ensure_packages(['kernel-headers'], { 'name' => "kernel-headers-${facts['kernelrelease']}" })
@@ -33,6 +35,19 @@
     source_pp => 'puppet:///modules/profile/gpu/nvidia-gpu.pp',
   }
 
+  file { '/etc/modprobe.d/nvidia.conf':
+    ensure => file,
+    owner  => 'root',
+    group  => 'root',
+    mode   => '0755',
+  }
+  file_line { 'nvidia_restrict_profiling':
+    path    => '/etc/modprobe.d/nvidia.conf',
+    line    => "options nvidia NVreg_RestrictProfilingToAdminUsers=${Integer($restrict_profiling)}",
+    require => File['/etc/modprobe.d/nvidia.conf'],
+    notify  => Kmod::Load[$nvidia_kmod],
+  }
+
   if ! $facts['nvidia_grid_vgpu'] {
     include profile::gpu::install::passthrough
     Class['profile::gpu::install::passthrough'] -> Exec['dkms_nvidia']
@@ -60,21 +75,6 @@
 
   kmod::load { $nvidia_kmod: }
 
-  if $allow_profiling_for_all {
-    file { '/etc/modprobe.d/nvidia.conf':
-      ensure => file,
-      owner  => 'root',
-      group  => 'root',
-      mode   => '0755',
-    }
-    file_line { 'allow_profiling_for_all':
-      path    => '/etc/modprobe.d/nvidia.conf',
-      line    => 'options nvidia NVreg_RestrictProfilingToAdminUsers=0',
-      require => File['/etc/modprobe.d/nvidia.conf'],
-      before  => (if ! $facts['nvidia_grid_gpu'] { Class['profile::gpu::install::passthrough'] } else { Class['profile::gpu::install::vgpu'] }),
-    }
-  }
-
   if $lib_symlink_path {
     $lib_symlink_path_split = split($lib_symlink_path, '/')
     $lib_symlink_dir = Hash(