From 25ecd9cf773dc68555469668e75e2b2fe1f39547 Mon Sep 17 00:00:00 2001
From: Manuel Huber <manuelh@nvidia.com>
Date: Tue, 14 Jul 2026 20:41:34 +0000
Subject: [PATCH] kata-deploy: add NVIDIA CPU values file

Add a try-kata-nvidia-cpu.values.yaml example for the CPU-only
NVIDIA runtime classes and make the Kubernetes CI Helm helper use it
for qemu-nvidia-cpu handlers.

Signed-off-by: Manuel Huber <manuelh@nvidia.com>
Assisted-by: OpenAI Codex <codex@openai.com>
---
 docs/helm-configuration.md                    | 19 ++++++-
 tests/gha-run-k8s-common.sh                   |  6 +++
 .../try-kata-nvidia-cpu.values.yaml           | 51 +++++++++++++++++++
 3 files changed, 75 insertions(+), 1 deletion(-)
 create mode 100644 tools/packaging/kata-deploy/helm-chart/kata-deploy/try-kata-nvidia-cpu.values.yaml

diff --git a/docs/helm-configuration.md b/docs/helm-configuration.md
index 69f69b7e22..0d29d4097b 100644
--- a/docs/helm-configuration.md
+++ b/docs/helm-configuration.md
@@ -297,6 +297,24 @@ Includes:
 - `qemu-coco-dev` - Confidential Containers development (amd64, s390x)
 - `qemu-coco-dev-runtime-rs` - Confidential Containers development Rust runtime (amd64, arm64, s390x)
 
+### [`try-kata-nvidia-cpu.values.yaml`](https://github.com/kata-containers/kata-containers/blob/main/tools/packaging/kata-deploy/helm-chart/kata-deploy/try-kata-nvidia-cpu.values.yaml)
+
+This file enables only the NVIDIA CPU-only shims and installs them using the
+[`job` deployment mode](#deployment-modes-daemonset-vs-job) (no always-on
+DaemonSet on the node):
+
+```sh
+helm install kata-deploy oci://ghcr.io/kata-containers/kata-deploy-charts/kata-deploy \
+  --version VERSION \
+  -f try-kata-nvidia-cpu.values.yaml
+```
+
+Includes:
+
+- `qemu-nvidia-cpu` - NVIDIA base image without GPU passthrough (amd64, arm64)
+- `qemu-nvidia-cpu-runtime-rs` - NVIDIA base image without GPU passthrough,
+  using the Rust runtime (amd64, arm64)
+
 ### [`try-kata-nvidia-gpu.values.yaml`](https://github.com/kata-containers/kata-containers/blob/main/tools/packaging/kata-deploy/helm-chart/kata-deploy/try-kata-nvidia-gpu.values.yaml)
 
 This file enables only the NVIDIA GPU-enabled shims and installs them using the
@@ -504,4 +522,3 @@ no manual `runtimeClass.nodeSelector` is set for that shim.
 **Note**: NFD detection requires cluster access. During `helm template` (dry-run without a
 cluster), external NFD is not seen, so auto-injected labels are not added. Manual
 `runtimeClass.nodeSelector` values are still applied in all cases.
-
diff --git a/tests/gha-run-k8s-common.sh b/tests/gha-run-k8s-common.sh
index 3c93ba88ff..7c1ec34ee6 100644
--- a/tests/gha-run-k8s-common.sh
+++ b/tests/gha-run-k8s-common.sh
@@ -701,6 +701,12 @@ function helm_helper() {
 	local base_values_file="${helm_chart_dir}/values.yaml"
 	if [[ -n "${KATA_HYPERVISOR}" ]]; then
 		case "${KATA_HYPERVISOR}" in
+			*nvidia-cpu*)
+				# Use NVIDIA CPU example file
+				if [[ -f "${helm_chart_dir}/try-kata-nvidia-cpu.values.yaml" ]]; then
+					base_values_file="${helm_chart_dir}/try-kata-nvidia-cpu.values.yaml"
+				fi
+				;;
 			*nvidia-gpu*)
 				# Use NVIDIA GPU example file
 				if [[ -f "${helm_chart_dir}/try-kata-nvidia-gpu.values.yaml" ]]; then
diff --git a/tools/packaging/kata-deploy/helm-chart/kata-deploy/try-kata-nvidia-cpu.values.yaml b/tools/packaging/kata-deploy/helm-chart/kata-deploy/try-kata-nvidia-cpu.values.yaml
new file mode 100644
index 0000000000..991c96cb7b
--- /dev/null
+++ b/tools/packaging/kata-deploy/helm-chart/kata-deploy/try-kata-nvidia-cpu.values.yaml
@@ -0,0 +1,51 @@
+# Example values file to enable NVIDIA CPU shims
+# This includes all NVIDIA CPU-only shims: qemu-nvidia-cpu,
+# qemu-nvidia-cpu-runtime-rs.
+#
+# Usage:
+#   helm install kata-deploy oci://ghcr.io/kata-containers/kata-deploy-charts/kata-deploy \
+#     --version VERSION \
+#     -f try-kata-nvidia-cpu.values.yaml
+
+debug: false
+
+# Install Kata via short-lived per-node Jobs instead of an always-on DaemonSet.
+# A tiny dispatcher Job fans out one install Job per selected node and exits, so
+# nothing keeps running on the node once the install completes.
+deploymentMode: job
+
+snapshotter:
+  setup: []
+
+# Enable NVIDIA CPU shims
+# Disable all shims at once, then enable only the ones we need.
+shims:
+  disableAll: true
+
+  qemu-nvidia-cpu:
+    enabled: true
+    supportedArches:
+      - amd64
+      - arm64
+    allowedHypervisorAnnotations: []
+    containerd:
+      snapshotter: ""
+
+  qemu-nvidia-cpu-runtime-rs:
+    enabled: true
+    supportedArches:
+      - amd64
+      - arm64
+    allowedHypervisorAnnotations: []
+    containerd:
+      snapshotter: ""
+
+# Default shim per architecture.
+defaultShim:
+  amd64: qemu-nvidia-cpu
+  arm64: qemu-nvidia-cpu
+
+runtimeClasses:
+  enabled: true
+  createDefault: false
+  defaultName: "kata"