Tutorial: Writing a Preflight Check
Tutorial: Writing a Preflight Check
This tutorial walks you through building preflight-demo-gpu-visible — a preflight check that runs nvidia-smi -L, requires at least MIN_GPU_COUNT GPUs, reports via gRPC, and exits — from an empty Go module to a container image registered in the preflight webhook and verified on a GPU pod.
By the end you will have:
- A working init-container check that validates GPUs are visible before the workload starts.
- A container image for it, registered in the preflight Helm chart.
- Verification that a failing check blocks pod startup and emits a health event.
Who is this for? Teams already running NVSentinel preflight who want to add a custom diagnostic (or ship a third-party image) without changing the webhook code.
Just want the AI to do it? Jump to Appendix: One-shot AI prompt.
Prerequisites
go1.26+ anddocker— build the check image.kubectlwith access to a cluster where:- NVSentinel is running (
platform-connectorsat minimum). - Preflight is enabled (
global.preflight.enabled: true). - At least one namespace is labeled
nvsentinel.nvidia.com/preflight=enabled. - You can schedule a GPU pod (device plugin or DRA).
- NVSentinel is running (
See Preflight overview, ADR-026, and Preflight configuration for how preflight works. DEVELOPMENT.md covers local dev cluster setup.
1. Scaffold the module
Create a standalone Go module (it can live in any repository; you only need the image URI at deploy time):
Add the NVSentinel protobuf module (not published as tagged releases — pin a commit):
2. Write the check
Create main.go. Structure: parse env → run diagnostic → send health event → exit.
Tidy and build (on a machine without nvidia-smi, go build still succeeds — the binary only shells out at runtime):
For production code, copy the retry/backoff reporter from preflight-checks/nccl-loopback/pkg/health/reporter.go instead of the inline sendEvent above.
3. Containerize
Build and push to a registry your cluster can pull from. Example using NGC (nvcr.io):
4. Register and deploy
Add your check to distros/kubernetes/nvsentinel/charts/preflight/values.yaml:
Upgrade the release:
Because defaultEnabled: false, pods must select this check via annotation (see ADR-034):
5. Test and verify
Manual container smoke test
On a GPU node where platform-connectors is running (or docker run --gpus all on that host):
Verify on a GPU pod
Label the namespace so the preflight webhook injects init containers:
To test the fail path, set MIN_GPU_COUNT unreasonably high in Helm, upgrade, and recreate the pod. The pod should stay Init:Error.
E2E (in-repo checks only)
If you contributed the check under preflight-checks/ in the NVSentinel repo (build context and Makefile differ — see DEVELOPMENT.md):
Appendix: One-shot AI prompt
Paste this to an AI coding agent. It is self-contained: the check is a standalone Go module and container image that can live in any repository (it does not need to be inside the NVSentinel repo).