gpu01: grant GPU access to approved user groups

roles/gpu/files/apply-rocm-acls.sh

@@ -0,0 +1,19 @@
+#!/bin/bash
+# Define your target groups here (comma-separated for setfacl)
+GROUPS_TO_ALLOW="forge-ai-ml-members,forge-cle-members"
+
+# Apply read/write permissions to KFD
+if [ -e /dev/kfd ]; then
+    for grp in ${GROUPS_TO_ALLOW//,/ }; do
+        setfacl -m g:"$grp":rw /dev/kfd
+    done
+fi
+
+# Apply read/write permissions to DRI cards and render nodes
+for dev in /dev/dri/card* /dev/dri/renderD*; do
+    if [ -e "$dev" ]; then
+        for grp in ${GROUPS_TO_ALLOW//,/ }; do
+            setfacl -m g:"$grp":rw "$dev"
+        done
+    fi
+done

roles/gpu/files/rocm-custom-acl.rules

@@ -0,0 +1,5 @@
+# Apply ACLs to the AMD KFD compute device
+KERNEL=="kfd", SUBSYSTEM=="kfd", RUN+="/usr/local/bin/apply-rocm-acls.sh"
+
+# Apply ACLs to all DRI graphics/render devices
+SUBSYSTEM=="dri", KERNEL=="card*|renderD*", RUN+="/usr/local/bin/apply-rocm-acls.sh"

roles/gpu/tasks/main.yml

@@ -30,3 +30,23 @@
     mode: '0644'
   tags:
   - config
+
+- name: Install udev GPU rules
+  ansible.builtin.copy:
+    src: rocm-custom-acl.rules
+    dest: /etc/udev/rules.d/99-rocm-custom-acl.rules
+    owner: root
+    group: root
+    mode: '0644'
+  tags:
+  - config
+
+- name: Install udev GPU script
+  ansible.builtin.copy:
+    src: apply-rocm-acls.sh
+    dest: /usr/local/bin/apply-rocm-acls.sh
+    owner: root
+    group: root
+    mode: '0755'
+  tags:
+  - config