node-feature-discovery
Helm chart
Request a free trial
Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.
Tag:
Compare:
1
image:
2
# -- NFD image repository
3
# @section -- General
4
repository: cgr.dev/chainguard-private/node-feature-discovery-fips
5
# @schema enum: [Always, IfNotPresent, Never]
6
# -- Image pull policy
7
# @section -- General
8
pullPolicy: IfNotPresent
9
# @schema type: [string, null]
10
# -- NFD image tag. If not specified Chart.AppVersion will be used.
11
# @section -- General
12
tag: 0.20.1-r0@sha256:c2f1b42650933dfd179721860d8ae3162048f09b376072d7af267a6c75574045
13
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.api.core.v1.PodSpec/properties/imagePullSecrets
14
# -- Image pull secrets. [More info](https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod).
15
# @section -- General
16
imagePullSecrets: []
17
# -- Override the name of the chart
18
# @section -- General
19
nameOverride: ""
20
# -- Override a default fully qualified app name
21
# @section -- General
22
fullnameOverride: ""
23
# -- Override the namespace to install the chart into. By default, the namespace is determined by Helm.
24
# @section -- General
25
namespaceOverride: ""
26
# @schema patternProperties: {"^[a-zA-Z]$": {type: string}}
27
# -- [Feature gates](https://kubernetes-sigs.github.io/node-feature-discovery/v0.20/reference/feature-gates) to enable/disable specific features.
28
# @section -- General
29
featureGates: {}
30
# -- Only checksum config values (not the full rendered ConfigMap template) for the rollout annotation.
31
# When enabled, pods will only restart when config values actually change, not on unrelated template changes.
32
# @section -- General
33
checksumValuesOnly: false
34
# -- The name of the PriorityClass to be used for the NFD pods.
35
# @section -- General
36
priorityClassName: ""
37
# -- Enable/disable the Helm post-delete hook.
38
# @section -- General
39
postDeleteCleanup: true
40
#
41
# Global configuration for NFD used as a sub-chart
42
#
43
global:
44
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.api.core.v1.PodSpec/properties/imagePullSecrets
45
# -- If `imagePullSecrets` is specified, it takes precedence over `global.imagePullSecrets`. [More info](https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod).
46
# @section -- Global
47
imagePullSecrets: []
48
#
49
# NFD-Master configuration
50
#
51
master:
52
# -- Specifies whether nfd-master should be deployed
53
# @section -- NFD-Master
54
enable: true
55
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.api.core.v1.Container/properties/args
56
# -- Additional [command line arguments](https://kubernetes-sigs.github.io/node-feature-discovery/v0.20/reference/master-commandline-reference) to pass to nfd-master.
57
# @section -- NFD-Master
58
extraArgs: []
59
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.api.core.v1.Container/properties/env
60
# -- Additional environment variables to set in the nfd-master container.
61
# @section -- NFD-Master
62
extraEnvs: []
63
# -- Run the container in the host's network namespace.
64
# @section -- NFD-Master
65
hostNetwork: false
66
# @schema type: [boolean, null]
67
# -- (bool) Run the container with host user ids. NOTE: if hostNetwork is true, hostUsers should be true.
68
# @section -- NFD-Master
69
hostUsers: ~ # @schema type: [boolean, null]
70
# @enum: [Default, ClusterFirst, ClusterFirstWithHostNet, None]
71
# -- NFD master pod [dnsPolicy](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy).
72
# @section -- NFD-Master
73
dnsPolicy: ClusterFirstWithHostNet
74
# @schema type: [object, null]
75
# -- (object) NFD master [configuration](https://kubernetes-sigs.github.io/node-feature-discovery/v0.20/reference/master-configuration-reference).
76
# @section -- NFD-Master
77
config: ### <NFD-MASTER-CONF-START-DO-NOT-REMOVE>
78
# noPublish: false
79
# extraLabelNs: ["added.ns.io","added.kubernets.io"]
80
# denyLabelNs: ["denied.ns.io","denied.kubernetes.io"]
81
# enableTaints: false
82
# informerPageSize: 200
83
# labelWhiteList: "foo"
84
# resyncPeriod: "2h"
85
# restrictions:
86
# disableLabels: true
87
# disableTaints: true
88
# disableExtendedResources: true
89
# disableAnnotations: true
90
# allowOverwrite: false
91
# denyNodeFeatureLabels: true
92
# nodeFeatureNamespaceSelector:
93
# matchLabels:
94
# kubernetes.io/metadata.name: "node-feature-discovery"
95
# matchExpressions:
96
# - key: "kubernetes.io/metadata.name"
97
# operator: "In"
98
# values:
99
# - "node-feature-discovery"
100
# klog:
101
# addDirHeader: false
102
# alsologtostderr: false
103
# logBacktraceAt:
104
# logtostderr: true
105
# skipHeaders: false
106
# stderrthreshold: 2
107
# v: 0
108
# vmodule:
109
# logDir:
110
# logFile:
111
# logFileMaxSize: 1800
112
# skipLogHeaders: false
113
# leaderElection:
114
# leaseDuration: 15s
115
# # this value has to be lower than leaseDuration and greater than retryPeriod*1.2
116
# renewDeadline: 10s
117
# # this value has to be greater than 0
118
# retryPeriod: 2s
119
# nfdApiParallelism: 10
120
### <NFD-MASTER-CONF-END-DO-NOT-REMOVE>
121
122
# @schema type: integer; minimum: 1; maximum: 65535
123
# -- Port on which to serve http for metrics and healthz endpoints.
124
# @section -- NFD-Master
125
port: 8080
126
# @schema type: [string, null]
127
# -- Instance name. Used to separate annotation namespaces for multiple parallel deployments.
128
# @section -- NFD-Master
129
instance:
130
# @schema type: [string, null]
131
# -- (string) NFD API controller resync period. Time duration string (e.g. "5m", "1h", "2h45m").
132
# @section -- NFD-Master
133
resyncPeriod:
134
# @schema item: string
135
# -- Label namespaces to deny. Labels with these prefixes will not be published to the nodes.
136
# @section -- NFD-Master
137
denyLabelNs: []
138
# @schema item: string
139
# -- Additional label namespaces to publish. Labels with these prefixes are allowed even if otherwise denied by `master.denyLabelNs`.
140
# @section -- NFD-Master
141
extraLabelNs: []
142
# -- Enable node tainting.
143
# @section -- NFD-Master
144
enableTaints: false
145
# @schema type: [integer, null]; minimum: 1; maximum: 100
146
# -- (int) The maximum number of concurrent node updates.
147
# @section -- NFD-Master
148
nfdApiParallelism:
149
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta/properties/annotations
150
# -- [Annotations](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations) to add to the nfd-master Deployment.
151
# @section -- NFD-Master
152
deploymentAnnotations: {}
153
# -- Number of the desired replicas for the nfd-master Deployment.
154
# @section -- NFD-Master
155
replicaCount: 1
156
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.api.core.v1.PodSecurityContext
157
# -- [Pod SecurityContext](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) of the nfd-master pods.
158
# @section -- NFD-Master
159
podSecurityContext: {}
160
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.api.core.v1.PodSpec/properties/initContainers
161
# -- [Init containers](https://kubernetes.io/docs/concepts/workloads/pods/init-containers/) to add to the nfd-master pods.
162
# @section -- NFD-Master
163
initContainers: []
164
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.api.core.v1.SecurityContext
165
# -- [SecurityContext](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) of the nfd-master container.
166
# @section -- NFD-Master
167
securityContext:
168
# @schema hidden
169
allowPrivilegeEscalation: false
170
# @schema hidden
171
capabilities:
172
drop: ["ALL"]
173
# @schema hidden
174
readOnlyRootFilesystem: true
175
# @schema hidden
176
runAsNonRoot: true
177
serviceAccount:
178
# -- Specifies whether a service account should be created.
179
# @section -- NFD-Master
180
create: true
181
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta/properties/annotations
182
# -- [Annotations](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations) to add to the service account
183
# @section -- NFD-Master
184
annotations: {}
185
# @schema type: [string, null]
186
# -- The name of the service account to use. If not set and create is true, a name is generated using the fullname template
187
# @section -- NFD-Master
188
name:
189
# @schema type: [integer, null]
190
# -- (int) Specifies the number of old ReplicaSets for the Deployment to retain. [revisionHistoryLimit](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#revision-history-limit)
191
# @section -- NFD-Master
192
revisionHistoryLimit:
193
rbac:
194
# -- Create [RBAC](https://kubernetes.io/docs/reference/access-authn-authz/rbac/) configuration for nfd-master.
195
# @section -- NFD-Master
196
create: true
197
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.api.core.v1.ResourceRequirements
198
resources:
199
# @schema hidden
200
# -- Resource [limits](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#requests-and-limits) for the nfd-master container.
201
# @section -- NFD-Master
202
limits:
203
memory: 4Gi
204
# @schema hidden
205
# -- Resource [requests](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#requests-and-limits) for the nfd-master container.
206
# @section -- NFD-Master
207
requests:
208
cpu: 100m
209
# You may want to use the same value for `requests.memory` and `limits.memory`. The “requests” value affects scheduling to accommodate pods on nodes.
210
# If there is a large difference between “requests” and “limits” and nodes experience memory pressure, the kernel may invoke
211
# the OOM Killer, even if the memory does not exceed the “limits” threshold. This can cause unexpected pod evictions. Memory
212
# cannot be compressed and once allocated to a pod, it can only be reclaimed by killing the pod.
213
# Natan Yellin 22/09/2022 https://home.robusta.dev/blog/kubernetes-memory-limit
214
memory: 128Mi
215
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.api.core.v1.PodSpec/properties/nodeSelector
216
# -- [Node selector](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector) for the nfd-master pods.
217
# @section -- NFD-Master
218
nodeSelector: {}
219
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.api.core.v1.PodSpec/properties/tolerations
220
# -- [Tolerations](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) for the nfd-master pods.
221
# @section -- NFD-Master
222
tolerations:
223
- # @schema hidden
224
key: "node-role.kubernetes.io/control-plane"
225
# @schema hidden
226
operator: "Equal"
227
# @schema hidden
228
value: ""
229
# @schema hidden
230
effect: "NoSchedule"
231
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.api.policy.v1.PodDisruptionBudgetSpec
232
podDisruptionBudget:
233
# -- Configure PodDisruptionBudget for the nfd-master Deployment.
234
# @section -- NFD-Master
235
enable: false
236
# @schema hidden
237
# -- Minimum number (or percentage) of pods that must be available after the eviction.
238
# @section -- NFD-Master
239
minAvailable: 1
240
# @schema hidden
241
# -- Policy to evict unhealthy pods when a PodDisruptionBudget is defined.
242
# @section -- NFD-Master
243
unhealthyPodEvictionPolicy: AlwaysAllow
244
# @section -- NFD-Master
245
networkPolicy:
246
# -- Should a networkPolicy be deployed for the nfd-master pods
247
# @section -- NFD-Master
248
enabled: false
249
# @schema itemRef: $k8s/_definitions.json#/definitions/io.k8s.api.networking.v1.NetworkPolicyEgressRule
250
# -- [Egress](https://kubernetes.io/docs/concepts/services-networking/network-policies/#network-traffic-filtering) for the nfd-master pods.
251
# The minimum egress ports required to function are: DNS (53/udp, 53/tcp, API server (80/tcp, 443/tcp, 6443/tcp). NOTE: OKD and Openshift use 6443/tcp
252
# @section -- NFD-Master
253
egress:
254
- ports: # @schema hidden
255
- port: 80
256
protocol: TCP
257
- port: 443
258
protocol: TCP
259
- port: 53
260
protocol: TCP
261
- port: 53
262
protocol: UDP
263
- port: 6443
264
protocol: TCP
265
# @schema itemRef: $k8s/_definitions.json#/definitions/io.k8s.api.networking.v1.NetworkPolicyIngressRule
266
# -- [Ingress](https://kubernetes.io/docs/concepts/services-networking/network-policies/#network-traffic-filtering) for the nfd-master pods.
267
# @section -- NFD-Master
268
ingress:
269
- ports: # @schema hidden
270
- protocol: TCP
271
port: http
272
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta/properties/annotations
273
# -- [Annotations](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations) to add to the nfd-master pods.
274
# @section -- NFD-Master
275
annotations: {}
276
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta/properties/labels
277
# -- [Labels](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/) to add to the nfd-master pods.
278
# @section -- NFD-Master
279
labels: {}
280
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.api.core.v1.Affinity
281
# -- [Affinity](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity) for the nfd-master pods.
282
# @section -- NFD-Master
283
affinity:
284
# @schema hidden
285
nodeAffinity:
286
preferredDuringSchedulingIgnoredDuringExecution:
287
- weight: 1
288
preference:
289
matchExpressions:
290
- key: "node-role.kubernetes.io/control-plane"
291
operator: In
292
values: [""]
293
# -- Startup probe configuration. [More information](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-startup-probes).
294
# @section -- NFD-Master
295
# @default -- -
296
startupProbe:
297
# @schema type: [integer, null]
298
# -- (int) The number of seconds after the container has started before probe is initiated.
299
# @section -- NFD-Master
300
initialDelaySeconds:
301
# @schema type: [integer, null]; minimum: 1
302
# -- (int) The number of seconds after which the probe times out.
303
# @section -- NFD-Master
304
timeoutSeconds:
305
# @schema type: [integer, null]; minimum: 1
306
# -- (int) How often (in seconds) to perform the probe.
307
# @section -- NFD-Master
308
periodSeconds:
309
# @schema type: [integer, null]; minimum: 1
310
# -- (int) The number of consecutive failures for the probe before considering the pod as not ready.
311
# @section -- NFD-Master
312
failureThreshold: 30
313
# -- Liveness probe configuration. [More information](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-a-liveness-http-request).
314
# @section -- NFD-Master
315
# @default -- -
316
livenessProbe:
317
# @schema type: [integer, null]
318
# -- (int) The number of seconds after the container has started before probe is initiated.
319
# @section -- NFD-Master
320
initialDelaySeconds:
321
# @schema type: [integer, null]; minimum: 1
322
# -- (int) The number of seconds after which the probe times out.
323
# @section -- NFD-Master
324
timeoutSeconds:
325
# @schema type: [integer, null]; minimum: 1
326
# -- (int) How often (in seconds) to perform the probe.
327
# @section -- NFD-Master
328
periodSeconds:
329
# @schema type: [integer, null]; minimum: 1
330
# -- (int) The number of consecutive failures for the probe before considering the container as failed and restarting it.
331
# @section -- NFD-Master
332
failureThreshold:
333
# -- Readiness probe configuration. [More information](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-readiness-probes).
334
# @section -- NFD-Master
335
# @default -- -
336
readinessProbe:
337
# @schema type: [integer, null]
338
# -- (int) The number of seconds after the container has started before probe is initiated.
339
# @section -- NFD-Master
340
initialDelaySeconds:
341
# @schema type: [integer, null]; minimum: 1
342
# -- (int) The number of seconds after which the probe times out.
343
# @section -- NFD-Master
344
timeoutSeconds:
345
# @schema type: [integer, null]; minimum: 1
346
# -- (int) How often (in seconds) to perform the probe.
347
# @section -- NFD-Master
348
periodSeconds:
349
# @schema type: [integer, null]; minimum: 1
350
# -- (int) Minimum consecutive successes for the probe before considering the pod as ready.
351
# @section -- NFD-Master
352
successThreshold:
353
# @schema type: [integer, null]; minimum: 1
354
# -- (int) The number of consecutive failures for the probe before considering the pod as not ready.
355
# @section -- NFD-Master
356
failureThreshold: 10
357
#
358
# NFD-Worker configuration
359
#
360
worker:
361
# -- Specifies whether nfd-worker should be deployed
362
# @section -- NFD-Worker
363
enable: true
364
# @schema uniqueItems:true;item:string;itemEnum:["node","pod","ds"]
365
# -- Objects used as owner references for NodeFeature objects. Valid values are `node`, `pod`, and `ds`. This value is passed through `-owner-refs` and takes precedence over `worker.config.core.ownerRefs`.
366
# @section -- NFD-Worker
367
ownerRefs:
368
- pod
369
- ds
370
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.api.core.v1.Container/properties/args
371
# -- Additional [command line arguments](https://kubernetes-sigs.github.io/node-feature-discovery/v0.20/reference/worker-commandline-reference) to pass to nfd-worker.
372
# @section -- NFD-Worker
373
extraArgs: []
374
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.api.core.v1.Container/properties/env
375
# -- Additional environment variables to set in the nfd-worker container.
376
# @section -- NFD-Worker
377
extraEnvs: []
378
# -- Run the container in the host's network namespace.
379
# @section -- NFD-Worker
380
hostNetwork: false
381
# @schema type: [boolean, null]
382
# -- (bool) Run the container with host user ids. NOTE: if hostNetwork is true, hostUsers should be true.
383
# @section -- NFD-Worker
384
hostUsers: ~ # @schema type: [boolean, null]
385
# @enum: [Default, ClusterFirst, ClusterFirstWithHostNet, None]
386
# -- NFD worker pod [dnsPolicy](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy).
387
# @section -- NFD-Worker
388
dnsPolicy: ClusterFirstWithHostNet
389
# @schema type: [object, null]
390
# -- (object) NFD worker [configuration](https://kubernetes-sigs.github.io/node-feature-discovery/v0.20/reference/worker-configuration-reference).
391
# @section -- NFD-Worker
392
config: ### <NFD-WORKER-CONF-START-DO-NOT-REMOVE>
393
#core:
394
# labelWhiteList:
395
# noPublish: false
396
# noOwnerRefs: false
397
# # Select from node, pod and ds. Use [] to disable owner references.
398
# ownerRefs: [pod, ds]
399
# sleepInterval: 60s
400
# featureSources: [all]
401
# labelSources: [all]
402
# # Discover these features but omit them from the published NodeFeature object
403
# # to reduce its size. Exact key or '*' prefix (e.g. pci.device, pci.*).
404
# # Only for features no NodeFeatureRule/NodeFeatureGroup consumes.
405
# noPublishFeatures: []
406
# klog:
407
# addDirHeader: false
408
# alsologtostderr: false
409
# logBacktraceAt:
410
# logtostderr: true
411
# skipHeaders: false
412
# stderrthreshold: 2
413
# v: 0
414
# vmodule:
415
# logDir:
416
# logFile:
417
# logFileMaxSize: 1800
418
# skipLogHeaders: false
419
#sources:
420
# cpu:
421
# cpuid:
422
## NOTE: whitelist has priority over blacklist
423
# attributeBlacklist:
424
# - "AVX10"
425
# - "BMI1"
426
# - "BMI2"
427
# - "CLMUL"
428
# - "CMOV"
429
# - "CX16"
430
# - "ERMS"
431
# - "F16C"
432
# - "HTT"
433
# - "LZCNT"
434
# - "MMX"
435
# - "MMXEXT"
436
# - "NX"
437
# - "POPCNT"
438
# - "RDRAND"
439
# - "RDSEED"
440
# - "RDTSCP"
441
# - "SGX"
442
# - "SGXLC"
443
# - "SSE"
444
# - "SSE2"
445
# - "SSE3"
446
# - "SSE4"
447
# - "SSE42"
448
# - "SSSE3"
449
# - "TDX_GUEST"
450
# attributeWhitelist:
451
# kernel:
452
# kconfigFile: "/path/to/kconfig"
453
# configOpts:
454
# - "NO_HZ"
455
# - "X86"
456
# - "DMI"
457
# pci:
458
# deviceClassWhitelist:
459
# - "0200"
460
# - "03"
461
# - "12"
462
# deviceLabelFields:
463
# - "class"
464
# - "vendor"
465
# - "device"
466
# - "subsystem_vendor"
467
# - "subsystem_device"
468
# usb:
469
# deviceClassWhitelist:
470
# - "0e"
471
# - "ef"
472
# - "fe"
473
# - "ff"
474
# deviceLabelFields:
475
# - "class"
476
# - "vendor"
477
# - "device"
478
# custom:
479
# # The following feature demonstrates the capabilities of the matchFeatures
480
# - name: "my custom rule"
481
# labels:
482
# "vendor.io/my-ng-feature": "true"
483
# # matchFeatures implements a logical AND over all matcher terms in the
484
# # list (i.e. all of the terms, or per-feature matchers, must match)
485
# matchFeatures:
486
# - feature: cpu.cpuid
487
# matchExpressions:
488
# AVX512F: {op: Exists}
489
# - feature: cpu.cstate
490
# matchExpressions:
491
# enabled: {op: IsTrue}
492
# - feature: cpu.pstate
493
# matchExpressions:
494
# no_turbo: {op: IsFalse}
495
# scaling_governor: {op: In, value: ["performance"]}
496
# - feature: cpu.rdt
497
# matchExpressions:
498
# RDTL3CA: {op: Exists}
499
# - feature: cpu.sst
500
# matchExpressions:
501
# bf.enabled: {op: IsTrue}
502
# - feature: cpu.topology
503
# matchExpressions:
504
# hardware_multithreading: {op: IsFalse}
505
#
506
# - feature: kernel.config
507
# matchExpressions:
508
# X86: {op: Exists}
509
# LSM: {op: InRegexp, value: ["apparmor"]}
510
# - feature: kernel.loadedmodule
511
# matchExpressions:
512
# e1000e: {op: Exists}
513
# - feature: kernel.selinux
514
# matchExpressions:
515
# enabled: {op: IsFalse}
516
# - feature: kernel.kvm
517
# matchExpressions:
518
# enabled: {op: IsFalse}
519
# - feature: kernel.version
520
# matchExpressions:
521
# major: {op: In, value: ["5"]}
522
# minor: {op: Gt, value: ["10"]}
523
#
524
# - feature: storage.block
525
# matchExpressions:
526
# rotational: {op: In, value: ["0"]}
527
# dax: {op: In, value: ["0"]}
528
#
529
# - feature: network.device
530
# matchExpressions:
531
# operstate: {op: In, value: ["up"]}
532
# speed: {op: Gt, value: ["100"]}
533
#
534
# - feature: memory.numa
535
# matchExpressions:
536
# node_count: {op: Gt, value: ["2"]}
537
# - feature: memory.nv
538
# matchExpressions:
539
# devtype: {op: In, value: ["nd_dax"]}
540
# mode: {op: In, value: ["memory"]}
541
#
542
# - feature: system.osrelease
543
# matchExpressions:
544
# ID: {op: In, value: ["fedora", "centos"]}
545
# - feature: system.name
546
# matchExpressions:
547
# nodename: {op: InRegexp, value: ["^worker-X"]}
548
#
549
# - feature: local.label
550
# matchExpressions:
551
# custom-feature-knob: {op: Gt, value: ["100"]}
552
#
553
# # The following feature demonstrates the capabilities of the matchAny
554
# - name: "my matchAny rule"
555
# labels:
556
# "vendor.io/my-ng-feature-2": "my-value"
557
# # matchAny implements a logical IF over all elements (sub-matchers) in
558
# # the list (i.e. at least one feature matcher must match)
559
# matchAny:
560
# - matchFeatures:
561
# - feature: kernel.loadedmodule
562
# matchExpressions:
563
# driver-module-X: {op: Exists}
564
# - feature: pci.device
565
# matchExpressions:
566
# vendor: {op: In, value: ["8086"]}
567
# class: {op: In, value: ["0200"]}
568
# - matchFeatures:
569
# - feature: kernel.loadedmodule
570
# matchExpressions:
571
# driver-module-Y: {op: Exists}
572
# - feature: usb.device
573
# matchExpressions:
574
# vendor: {op: In, value: ["8086"]}
575
# class: {op: In, value: ["02"]}
576
#
577
# - name: "avx wildcard rule"
578
# labels:
579
# "my-avx-feature": "true"
580
# matchFeatures:
581
# - feature: cpu.cpuid
582
# matchName: {op: InRegexp, value: ["^AVX512"]}
583
#
584
# # The following features demonstreate label templating capabilities
585
# - name: "my template rule"
586
# labelsTemplate: |
587
# {{ range .system.osrelease }}vendor.io/my-system-feature.{{ .Name }}={{ .Value }}
588
# {{ end }}
589
# matchFeatures:
590
# - feature: system.osrelease
591
# matchExpressions:
592
# ID: {op: InRegexp, value: ["^open.*"]}
593
# VERSION_ID.major: {op: In, value: ["13", "15"]}
594
#
595
# - name: "my template rule 2"
596
# labelsTemplate: |
597
# {{ range .pci.device }}vendor.io/my-pci-device.{{ .class }}-{{ .device }}=with-cpuid
598
# {{ end }}
599
# matchFeatures:
600
# - feature: pci.device
601
# matchExpressions:
602
# class: {op: InRegexp, value: ["^06"]}
603
# vendor: ["8086"]
604
# - feature: cpu.cpuid
605
# matchExpressions:
606
# AVX: {op: Exists}
607
#
608
# # The following examples demonstrate vars field and back-referencing
609
# # previous labels and vars
610
# - name: "my dummy kernel rule"
611
# labels:
612
# "vendor.io/my.kernel.feature": "true"
613
# matchFeatures:
614
# - feature: kernel.version
615
# matchExpressions:
616
# major: {op: Gt, value: ["2"]}
617
#
618
# - name: "my dummy rule with no labels"
619
# vars:
620
# "my.dummy.var": "1"
621
# matchFeatures:
622
# - feature: cpu.cpuid
623
# matchExpressions: {}
624
#
625
# - name: "my rule using backrefs"
626
# labels:
627
# "vendor.io/my.backref.feature": "true"
628
# matchFeatures:
629
# - feature: rule.matched
630
# matchExpressions:
631
# vendor.io/my.kernel.feature: {op: IsTrue}
632
# my.dummy.var: {op: Gt, value: ["0"]}
633
#
634
# - name: "kconfig template rule"
635
# labelsTemplate: |
636
# {{ range .kernel.config }}kconfig-{{ .Name }}={{ .Value }}
637
# {{ end }}
638
# matchFeatures:
639
# - feature: kernel.config
640
# matchName: {op: In, value: ["SWAP", "X86", "ARM"]}
641
### <NFD-WORKER-CONF-END-DO-NOT-REMOVE>
642
643
# @schema type: integer; minimum: 1; maximum: 65535
644
# -- Port on which to serve http for metrics and healthz endpoints.
645
# @section -- NFD-Worker
646
port: 8080
647
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta/properties/annotations
648
# -- [Annotations](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations) to add to the nfd-worker DaemonSet.
649
# @section -- NFD-Worker
650
daemonsetAnnotations: {}
651
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.api.core.v1.PodSecurityContext
652
# -- [Pod SecurityContext](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) of the nfd-worker pods.
653
# @section -- NFD-Worker
654
podSecurityContext: {}
655
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.api.core.v1.PodSpec/properties/initContainers
656
# -- [Init containers](https://kubernetes.io/docs/concepts/workloads/pods/init-containers/) to add to the nfd-worker pods.
657
# @section -- NFD-Worker
658
initContainers: []
659
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.api.core.v1.SecurityContext
660
# -- [SecurityContext](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) of the nfd-worker container.
661
# @section -- NFD-Worker
662
securityContext:
663
# @schema hidden
664
allowPrivilegeEscalation: false
665
# @schema hidden
666
capabilities:
667
drop: ["ALL"]
668
# @schema hidden
669
readOnlyRootFilesystem: true
670
# @schema hidden
671
runAsNonRoot: true
672
# -- Liveness probe configuration. [More information](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-a-liveness-http-request).
673
# @section -- NFD-Worker
674
# @default -- -
675
livenessProbe:
676
# @schema type: [integer, null]
677
# -- (int) The number of seconds after the container has started before probe is initiated.
678
# @section -- NFD-Worker
679
initialDelaySeconds: 10
680
# @schema type: [integer, null]; minimum: 1
681
# -- (int) The number of seconds after which the probe times out.
682
# @section -- NFD-Worker
683
timeoutSeconds:
684
# @schema type: [integer, null]; minimum: 1
685
# -- (int) How often (in seconds) to perform the probe.
686
# @section -- NFD-Worker
687
periodSeconds:
688
# @schema type: [integer, null]; minimum: 1
689
# -- (int) The number of consecutive failures for the probe before considering the container as failed and restarting it.
690
# @section -- NFD-Worker
691
failureThreshold:
692
# -- Readiness probe configuration. [More information](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-readiness-probes).
693
# @section -- NFD-Worker
694
# @default -- -
695
readinessProbe:
696
# @schema type: [integer, null]
697
# -- (int) The number of seconds after the container has started before probe is initiated.
698
# @section -- NFD-Worker
699
initialDelaySeconds: 5
700
# @schema type: [integer, null]; minimum: 1
701
# -- (int) The number of seconds after which the probe times out.
702
# @section -- NFD-Worker
703
timeoutSeconds:
704
# @schema type: [integer, null]; minimum: 1
705
# -- (int) How often (in seconds) to perform the probe.
706
# @section -- NFD-Worker
707
periodSeconds:
708
# @schema type: [integer, null]; minimum: 1
709
# -- (int) Minimum consecutive successes for the probe before considering the pod as ready.
710
# @section -- NFD-Worker
711
successThreshold:
712
# @schema type: [integer, null]; minimum: 1
713
# -- (int) The number of consecutive failures for the probe before considering the pod as not ready.
714
# @section -- NFD-Worker
715
failureThreshold: 10
716
serviceAccount:
717
# -- Specifies whether a service account should be created.
718
# @section -- NFD-Worker
719
create: true
720
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta/properties/annotations
721
# -- [Annotations](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations) to add to the service account
722
# @section -- NFD-Worker
723
annotations: {}
724
# @schema type: [string, null]
725
# -- Name of the service account to use. If not set and create is true, a name is generated using the fullname template
726
# @section -- NFD-Worker
727
name:
728
# @schema type: [integer, null]
729
# -- (int) Specifies the number of old history for the DaemonSet to retain to allow rollback.
730
# @section -- NFD-Worker
731
revisionHistoryLimit:
732
rbac:
733
# -- Create [RBAC](https://kubernetes.io/docs/reference/access-authn-authz/rbac/) configuration for nfd-worker.
734
# @section -- NFD-Worker
735
create: true
736
# Allow users to mount the hostPath /usr/src, useful for RHCOS on s390x
737
# Does not work on systems without /usr/src AND a read-only /usr, such as Talos
738
# -- Mount host path /usr/src inside the container. Does not work on systems without /usr/src AND a read-only /usr.
739
# @section -- NFD-Worker
740
mountUsrSrc: false
741
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.api.core.v1.ResourceRequirements
742
resources:
743
# @schema hidden
744
# -- Resource [limits](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#requests-and-limits) for the nfd-worker container.
745
# @section -- NFD-Worker
746
limits:
747
memory: 512Mi
748
# @schema hidden
749
# -- Resource [requests](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#requests-and-limits) for the nfd-worker container.
750
# @section -- NFD-Worker
751
requests:
752
cpu: 5m
753
memory: 64Mi
754
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.api.core.v1.PodSpec/properties/nodeSelector
755
# -- [Node selector](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector) for the nfd-worker pods.
756
# @section -- NFD-Worker
757
nodeSelector: {}
758
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.api.core.v1.PodSpec/properties/tolerations
759
# -- [Tolerations](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) for the nfd-worker pods.
760
# @section -- NFD-Worker
761
tolerations: []
762
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta/properties/annotations
763
# -- [Annotations](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations) to add to the nfd-worker pods.
764
# @section -- NFD-Worker
765
annotations: {}
766
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta/properties/labels
767
# -- [Labels](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/) to add to the nfd-worker pods.
768
# @section -- NFD-Worker
769
labels: {}
770
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.api.core.v1.Affinity
771
# -- [Affinity](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity) for the nfd-worker pods.
772
# @section -- NFD-Worker
773
affinity: {}
774
# @schema type: [string, null]
775
# -- The name of the PriorityClass to be used for the nfd-worker pods. Takes precedence over the top-level `priorityClassName`.
776
# @section -- NFD-Worker
777
priorityClassName:
778
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.api.apps.v1.DaemonSetUpdateStrategy
779
# -- Update strategy for the nfd-worker DaemonSet. The default updates
780
# multiple nodes in parallel on large clusters, so upgrades finish within
781
# Helm and Flux HelmRelease timeouts. Set `maxUnavailable: 1` to update one
782
# node at a time. To use `type: OnDelete`, also set `rollingUpdate: null`
783
# (Helm deep-merges maps).
784
# [More info](https://kubernetes.io/docs/tasks/manage-daemon/update-daemon-set)
785
# @section -- NFD-Worker
786
updateStrategy:
787
rollingUpdate:
788
# @schema type: [string, integer]
789
maxUnavailable: "10%"
790
# @section -- NFD-Worker
791
networkPolicy:
792
# -- Should a networkPolicy be deployed for the nfd-worker pods
793
# @section -- NFD-Worker
794
enabled: false
795
# @schema itemRef: $k8s/_definitions.json#/definitions/io.k8s.api.networking.v1.NetworkPolicyEgressRule
796
# -- [Egress](https://kubernetes.io/docs/concepts/services-networking/network-policies/#network-traffic-filtering) for the nfd-worker pods.
797
# The minimum egress ports required to function are: DNS (53/udp, 53/tcp, API server (80/tcp, 443/tcp, 6443/tcp). NOTE: OKD and Openshift use 6443/tcp
798
# @section -- NFD-Worker
799
egress:
800
- ports: # @schema hidden
801
- port: 80
802
protocol: TCP
803
- port: 443
804
protocol: TCP
805
- port: 53
806
protocol: TCP
807
- port: 53
808
protocol: UDP
809
- port: 6443
810
protocol: TCP
811
# @schema itemRef: $k8s/_definitions.json#/definitions/io.k8s.api.networking.v1.NetworkPolicyIngressRule
812
# -- [Ingress](https://kubernetes.io/docs/concepts/services-networking/network-policies/#network-traffic-filtering) for the nfd-worker pods.
813
# @section -- NFD-Worker
814
ingress:
815
- ports: # @schema hidden
816
- protocol: TCP
817
port: http
818
#
819
# NFD-Topology-Updater configuration
820
#
821
topologyUpdater:
822
# @schema type: [object, null]
823
# -- (object) Configuration for the topology updater. See the [configuration reference](https://kubernetes-sigs.github.io/node-feature-discovery/v0.20/reference/topology-updater-configuration-reference) for details.
824
# @section -- NFD-Topology-Updater
825
config: ### <NFD-TOPOLOGY-UPDATER-CONF-START-DO-NOT-REMOVE>
826
## key = node name, value = list of resources to be excluded.
827
## use * to exclude from all nodes.
828
## an example for how the exclude list should looks like
829
#excludeList:
830
# node1: [cpu]
831
# node2: [memory, example/deviceA]
832
# '*': [hugepages-2Mi]
833
### <NFD-TOPOLOGY-UPDATER-CONF-END-DO-NOT-REMOVE>
834
835
# -- Specifies whether nfd-topology-updater should be deployed.
836
# @section -- NFD-Topology-Updater
837
enable: false
838
# -- Create the NodeResourceTopology CRD. This MUST be set to true when
839
# 'enable' is true, unless the CRD is installed separately (e.g., by another
840
# Helm release or external tool). If the CRD is missing, the topology-updater
841
# pods keep running but publish nothing; they log "waiting for
842
# NodeResourceTopology CRD to be created" and retry indefinitely.
843
# @section -- NFD-Topology-Updater
844
createCRDs: false
845
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.api.core.v1.Container/properties/args
846
# -- Additional [command line arguments](https://kubernetes-sigs.github.io/node-feature-discovery/v0.20/reference/topology-updater-commandline-reference) to pass to nfd-topology-updater.
847
# @section -- NFD-Topology-Updater
848
extraArgs: []
849
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.api.core.v1.Container/properties/env
850
# -- Additional environment variables to set in the nfd-topology-updater container.
851
# @section -- NFD-Topology-Updater
852
extraEnvs: []
853
# -- Run the container in the host's network namespace.
854
# @section -- NFD-Topology-Updater
855
hostNetwork: false
856
# @schema type: [boolean, null]
857
# -- (bool) Run the container with host user ids. NOTE: if hostNetwork is true, hostUsers should be true.
858
# @section -- NFD-Topology-Updater
859
hostUsers: ~ # @schema type: [boolean, null]
860
# @enum: [Default, ClusterFirst, ClusterFirstWithHostNet, None]
861
# -- NFD topology updater pod [dnsPolicy](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy).
862
# @section -- NFD-Topology-Updater
863
dnsPolicy: ClusterFirstWithHostNet
864
serviceAccount:
865
# -- Specifies whether a service account should be created.
866
# @section -- NFD-Topology-Updater
867
create: true
868
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta/properties/annotations
869
# -- [Annotations](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations) to add to the service account.
870
# @section -- NFD-Topology-Updater
871
annotations: {}
872
# @schema type: [string, null]
873
# -- Name or the service account to use. If not set and create is true, a name is generated using the fullname template.
874
# @section -- NFD-Topology-Updater
875
name:
876
# @schema type: [integer, null]
877
# -- (int) Specifies the number of old history for the DaemonSet to retain to allow rollback.
878
# @section -- NFD-Topology-Updater
879
revisionHistoryLimit:
880
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.api.apps.v1.DaemonSetUpdateStrategy
881
# -- Update strategy for the nfd-topology-updater DaemonSet. The default
882
# updates multiple nodes in parallel on large clusters, so upgrades finish
883
# within Helm and Flux HelmRelease timeouts. Set `maxUnavailable: 1` to
884
# update one node at a time. To use `type: OnDelete`, also set
885
# `rollingUpdate: null` (Helm deep-merges maps).
886
# [More info](https://kubernetes.io/docs/tasks/manage-daemon/update-daemon-set)
887
# @section -- NFD-Topology-Updater
888
updateStrategy:
889
rollingUpdate:
890
# @schema type: [string, integer]
891
maxUnavailable: "10%"
892
rbac:
893
# -- Create [RBAC](https://kubernetes.io/docs/reference/access-authn-authz/rbac/) configuration for nfd-topology-updater.
894
# @section -- NFD-Topology-Updater
895
create: true
896
# @schema type: integer; minimum: 1; maximum: 65535
897
# -- Port on which to serve http for metrics and healthz endpoints.
898
# @section -- NFD-Topology-Updater
899
port: 8080
900
# @schema type: [string, null]
901
# -- Host path for the kubelet config file.
902
# @section -- NFD-Topology-Updater
903
kubeletConfigPath:
904
# @schema type: [string, null]
905
# -- Host path for the kubelet socket for podresources endpoint.
906
# @section -- NFD-Topology-Updater
907
kubeletPodResourcesSockPath:
908
# -- Time to sleep between CR updates. Non-positive value implies no CR update.
909
# @section -- NFD-Topology-Updater
910
updateInterval: 60s
911
# -- Namespace to watch pods, `*` for all namespaces.
912
# @section -- NFD-Topology-Updater
913
watchNamespace: "*"
914
# -- The kubelet state directory path for watching state and checkpoint files. Empty value disables kubelet state tracking.
915
# @section -- NFD-Topology-Updater
916
kubeletStateDir: /var/lib/kubelet
917
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.api.core.v1.PodSecurityContext
918
# -- [Pod SecurityContext](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) of the nfd-topology-updater pods.
919
# @section -- NFD-Topology-Updater
920
podSecurityContext: {}
921
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.api.core.v1.PodSpec/properties/initContainers
922
# -- [Init containers](https://kubernetes.io/docs/concepts/workloads/pods/init-containers/) to add to the nfd-topology-updater pods.
923
# @section -- NFD-Topology-Updater
924
initContainers: []
925
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.api.core.v1.SecurityContext
926
# -- [SecurityContext](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) of the nfd-topology-updater container.
927
# @section -- NFD-Topology-Updater
928
securityContext:
929
# @schema hidden
930
allowPrivilegeEscalation: false
931
# @schema hidden
932
capabilities:
933
drop: ["ALL"]
934
# @schema hidden
935
readOnlyRootFilesystem: true
936
# @schema hidden
937
runAsUser: 0
938
# -- Liveness probe configuration. [More information](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-a-liveness-http-request).
939
# @section -- NFD-Topology-Updater
940
# @default -- -
941
livenessProbe:
942
# @schema type: [integer, null]
943
# -- (int) The number of seconds after the container has started before probe is initiated.
944
# @section -- NFD-Topology-Updater
945
initialDelaySeconds: 10
946
# @schema type: [integer, null]; minimum: 1
947
# -- (int) The number of seconds after which the probe times out.
948
# @section -- NFD-Topology-Updater
949
timeoutSeconds:
950
# @schema type: [integer, null]; minimum: 1
951
# -- (int) How often (in seconds) to perform the probe.
952
# @section -- NFD-Topology-Updater
953
periodSeconds:
954
# @schema type: [integer, null]; minimum: 1
955
# -- (int) The number of consecutive failures for the probe before considering the container as failed and restarting it.
956
# @section -- NFD-Topology-Updater
957
failureThreshold:
958
# -- Readiness probe configuration. [More information](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-readiness-probes).
959
# @section -- NFD-Topology-Updater
960
# @default -- -
961
readinessProbe:
962
# @schema type: [integer, null]
963
# -- (int) The number of seconds after the container has started before probe is initiated.
964
# @section -- NFD-Topology-Updater
965
initialDelaySeconds: 5
966
# @schema type: [integer, null]; minimum: 1
967
# -- (int) The number of seconds after which the probe times out.
968
# @section -- NFD-Topology-Updater
969
timeoutSeconds:
970
# @schema type: [integer, null]; minimum: 1
971
# -- (int) How often (in seconds) to perform the probe.
972
# @section -- NFD-Topology-Updater
973
periodSeconds:
974
# @schema type: [integer, null]; minimum: 1
975
# -- (int) Minimum consecutive successes for the probe before considering the pod as ready.
976
# @section -- NFD-Topology-Updater
977
successThreshold:
978
# @schema type: [integer, null]; minimum: 1
979
# -- (int) The number of consecutive failures for the probe before considering the pod as not ready.
980
# @section -- NFD-Topology-Updater
981
failureThreshold: 10
982
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.api.core.v1.ResourceRequirements
983
resources:
984
# @schema hidden
985
# -- Resource [limits](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#requests-and-limits) for the nfd-topology-updater container.
986
# @section -- NFD-Topology-Updater
987
limits:
988
memory: 60Mi
989
# @schema hidden
990
# -- Resource [requests](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#requests-and-limits) for the nfd-topology-updater container.
991
# @section -- NFD-Topology-Updater
992
requests:
993
cpu: 50m
994
memory: 40Mi
995
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.api.core.v1.PodSpec/properties/nodeSelector
996
# -- [Node selector](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector) for the nfd-topology-updater pods.
997
# @section -- NFD-Topology-Updater
998
nodeSelector: {}
999
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.api.core.v1.PodSpec/properties/tolerations
1000
# -- [Tolerations](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) for the nfd-topology-updater pods.
1001
# @section -- NFD-Topology-Updater
1002
tolerations: []
1003
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta/properties/annotations
1004
# -- [Annotations](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations) to add to the nfd-topology-updater pods.
1005
# @section -- NFD-Topology-Updater
1006
annotations: {}
1007
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta/properties/labels
1008
# -- [Labels](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/) to add to the nfd-topology-updater pods.
1009
# @section -- NFD-Topology-Updater
1010
labels: {}
1011
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta/properties/annotations
1012
# -- [Annotations](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations) to add to the nfd-topology-updater DaemonSet.
1013
# @section -- NFD-Topology-Updater
1014
daemonsetAnnotations: {}
1015
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.api.core.v1.Affinity
1016
# -- [Affinity](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity) for the nfd-topology-updater pods.
1017
# @section -- NFD-Topology-Updater
1018
affinity: {}
1019
# -- Enables compute and report of pod fingerprint in NRT objects.
1020
# @section -- NFD-Topology-Updater
1021
podSetFingerprint: true
1022
# @section -- NFD-Topology-Updater
1023
networkPolicy:
1024
# -- Should a networkPolicy be deployed for the nfd-topology pods
1025
# @section -- NFD-Topology-Updater
1026
enabled: false
1027
# @schema itemRef: $k8s/_definitions.json#/definitions/io.k8s.api.networking.v1.NetworkPolicyEgressRule
1028
# -- [Egress](https://kubernetes.io/docs/concepts/services-networking/network-policies/#network-traffic-filtering) for the nfd-topology pods.
1029
# The minimum egress ports required to function are: DNS (53/udp, 53/tcp, API server (80/tcp, 443/tcp, 6443/tcp). NOTE: OKD and Openshift use 6443/tcp
1030
# @section -- NFD-Topology-Updater
1031
egress:
1032
- ports: # @schema hidden
1033
- port: 80
1034
protocol: TCP
1035
- port: 443
1036
protocol: TCP
1037
- port: 53
1038
protocol: TCP
1039
- port: 53
1040
protocol: UDP
1041
- port: 6443
1042
protocol: TCP
1043
# @schema itemRef: $k8s/_definitions.json#/definitions/io.k8s.api.networking.v1.NetworkPolicyIngressRule
1044
# -- [Ingress](https://kubernetes.io/docs/concepts/services-networking/network-policies/#network-traffic-filtering) for the nfd-topology pods.
1045
# @section -- NFD-Topology-Updater
1046
ingress:
1047
- ports: # @schema hidden
1048
- protocol: TCP
1049
port: http
1050
#
1051
# NFD-GC configuration
1052
#
1053
gc:
1054
# -- Specifies whether nfd-gc should be deployed.
1055
# @section -- NFD-GC
1056
enable: true
1057
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.api.core.v1.Container/properties/args
1058
# -- Additional [command line arguments](https://kubernetes-sigs.github.io/node-feature-discovery/v0.20/reference/gc-commandline-reference) to pass to nfd-gc.
1059
# @section -- NFD-GC
1060
extraArgs: []
1061
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.api.core.v1.Container/properties/env
1062
# -- Additional environment variables to set in the nfd-gc container.
1063
# @section -- NFD-GC
1064
extraEnvs: []
1065
# -- Run the container in the host's network namespace.
1066
# @section -- NFD-GC
1067
hostNetwork: false
1068
# @schema type: [boolean, null]
1069
# -- (bool) Run the container with host user ids. NOTE: if hostNetwork is true, hostUsers should be true.
1070
# @section -- NFD-GC
1071
hostUsers: ~ # @schema type: [boolean, null]
1072
# -- The number of desired replicas for the nfd-gc Deployment.
1073
# @section -- NFD-GC
1074
replicaCount: 1
1075
# @enum: [Default, ClusterFirst, ClusterFirstWithHostNet, None]
1076
# -- NFD gc pod [dnsPolicy](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy).
1077
# @section -- NFD-GC
1078
dnsPolicy: ClusterFirstWithHostNet
1079
serviceAccount:
1080
# -- Specifies whether a service account should be created.
1081
# @section -- NFD-GC
1082
create: true
1083
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta/properties/annotations
1084
# -- [Annotations](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations) to add to the service account.
1085
# @section -- NFD-GC
1086
annotations: {}
1087
# @schema type: [string, null]
1088
# -- Name of the service account to use. If not set and create is true, a name is generated using the fullname template.
1089
# @section -- NFD-GC
1090
name:
1091
rbac:
1092
# -- Create [RBAC](https://kubernetes.io/docs/reference/access-authn-authz/rbac/) configuration for nfd-gc.
1093
# @section -- NFD-GC
1094
create: true
1095
# -- Time between periodic garbage collector runs.
1096
# @section -- NFD-GC
1097
interval: 1h
1098
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.api.core.v1.PodSecurityContext
1099
# -- [Pod SecurityContext](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) of the nfd-gc pods.
1100
# @section -- NFD-GC
1101
podSecurityContext: {}
1102
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.api.core.v1.PodSpec/properties/initContainers
1103
# -- [Init containers](https://kubernetes.io/docs/concepts/workloads/pods/init-containers/) to add to the nfd-gc pods.
1104
# @section -- NFD-GC
1105
initContainers: []
1106
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.api.core.v1.SecurityContext
1107
# -- [SecurityContext](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) of the nfd-gc container.
1108
# @section -- NFD-GC
1109
securityContext:
1110
# @schema hidden
1111
allowPrivilegeEscalation: false
1112
# @schema hidden
1113
capabilities:
1114
drop: ["ALL"]
1115
# @schema hidden
1116
readOnlyRootFilesystem: true
1117
# @schema hidden
1118
runAsNonRoot: true
1119
# -- Liveness probe configuration. [More information](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-a-liveness-http-request).
1120
# @section -- NFD-GC
1121
# @default -- -
1122
livenessProbe:
1123
# @schema type: [integer, null]
1124
# -- (int) The number of seconds after the container has started before probe is initiated.
1125
# @section -- NFD-GC
1126
initialDelaySeconds: 10
1127
# @schema type: [integer, null]; minimum: 1
1128
# -- (int) The number of seconds after which the probe times out.
1129
# @section -- NFD-GC
1130
timeoutSeconds:
1131
# @schema type: [integer, null]; minimum: 1
1132
# -- (int) How often (in seconds) to perform the probe.
1133
# @section -- NFD-GC
1134
periodSeconds:
1135
# @schema type: [integer, null]; minimum: 1
1136
# -- (int) The number of consecutive failures for the probe before considering the container as failed and restarting it.
1137
# @section -- NFD-GC
1138
failureThreshold:
1139
# -- Readiness probe configuration. [More information](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-readiness-probes).
1140
# @section -- NFD-GC
1141
# @default -- -
1142
readinessProbe:
1143
# @schema type: [integer, null]
1144
# -- (int) The number of seconds after the container has started before probe is initiated.
1145
# @section -- NFD-GC
1146
initialDelaySeconds: 5
1147
# @schema type: [integer, null]; minimum: 1
1148
# -- (int) The number of seconds after which the probe times out.
1149
# @section -- NFD-GC
1150
timeoutSeconds:
1151
# @schema type: [integer, null]; minimum: 1
1152
# -- (int) How often (in seconds) to perform the probe.
1153
# @section -- NFD-GC
1154
periodSeconds:
1155
# @schema type: [integer, null]; minimum: 1
1156
# -- (int) Minimum consecutive successes for the probe before considering the pod as ready.
1157
# @section -- NFD-GC
1158
successThreshold:
1159
# @schema type: [integer, null]; minimum: 1
1160
# -- (int) The number of consecutive failures for the probe before considering the pod as not ready.
1161
# @section -- NFD-GC
1162
failureThreshold:
1163
resources:
1164
# @schema hidden
1165
# -- Resource [limits](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#requests-and-limits) for the nfd-gc container.
1166
# @section -- NFD-GC
1167
limits:
1168
memory: 1Gi
1169
# @schema hidden
1170
# -- Resource [requests](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#requests-and-limits) for the nfd-gc container.
1171
# @section -- NFD-GC
1172
requests:
1173
cpu: 10m
1174
memory: 128Mi
1175
# @schema type: integer; minimum: 1; maximum: 65535
1176
# -- Port on which to serve http for metrics and healthz endpoints.
1177
# @section -- NFD-GC
1178
port: 8080
1179
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.api.core.v1.PodSpec/properties/nodeSelector
1180
# -- [Node selector](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector) for the nfd-gc pods.
1181
# @section -- NFD-GC
1182
nodeSelector: {}
1183
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.api.core.v1.PodSpec/properties/tolerations
1184
# -- [Tolerations](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) for the nfd-gc pods.
1185
# @section -- NFD-GC
1186
tolerations: []
1187
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta/properties/annotations
1188
# -- [Annotations](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations) to add to the nfd-gc pods.
1189
# @section -- NFD-GC
1190
annotations: {}
1191
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta/properties/labels
1192
# -- [Labels](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/) to add to the nfd-gc pods.
1193
# @section -- NFD-GC
1194
labels: {}
1195
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta/properties/annotations
1196
# -- [Annotations](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations) to add to the nfd-gc Deployment.
1197
# @section -- NFD-GC
1198
deploymentAnnotations: {}
1199
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.api.core.v1.Affinity
1200
# -- [Affinity](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity) for the nfd-gc pods.
1201
# @section -- NFD-GC
1202
affinity: {}
1203
# @schema $ref: $k8s/_definitions.json#/definitions/io.k8s.api.policy.v1.PodDisruptionBudgetSpec
1204
podDisruptionBudget:
1205
# -- Configure PodDisruptionBudget for the nfd-gc Deployment.
1206
# @section -- NFD-GC
1207
enable: false
1208
# @schema hidden
1209
# -- Minimum number (or percentage) of pods that must be available after the eviction.
1210
# @section -- NFD-GC
1211
minAvailable: 1
1212
# @schema hidden
1213
# -- Policy to evict unhealthy pods when a PodDisruptionBudget is defined.
1214
# @section -- NFD-GC
1215
unhealthyPodEvictionPolicy: AlwaysAllow
1216
# @schema type: [integer, null]
1217
# -- (int) Specifies the number of old history for the Deployment to retain to allow rollback.
1218
# @section -- NFD-GC
1219
revisionHistoryLimit:
1220
# @section -- NFD-GC
1221
networkPolicy:
1222
# -- Should a networkPolicy be deployed for the nfd-gc pods
1223
# @section -- NFD-GC
1224
enabled: false
1225
# @schema itemRef: $k8s/_definitions.json#/definitions/io.k8s.api.networking.v1.NetworkPolicyEgressRule
1226
# -- [Egress](https://kubernetes.io/docs/concepts/services-networking/network-policies/#network-traffic-filtering) for the nfd-gc pods.
1227
# The minimum egress ports required to function are: DNS (53/udp, 53/tcp, API server (80/tcp, 443/tcp, 6443/tcp). NOTE: OKD and Openshift use 6443/tcp
1228
# @section -- NFD-GC
1229
egress:
1230
- ports: # @schema hidden
1231
- port: 80
1232
protocol: TCP
1233
- port: 443
1234
protocol: TCP
1235
- port: 53
1236
protocol: TCP
1237
- port: 53
1238
protocol: UDP
1239
- port: 6443
1240
protocol: TCP
1241
# @schema itemRef: $k8s/_definitions.json#/definitions/io.k8s.api.networking.v1.NetworkPolicyIngressRule
1242
# -- [Ingress](https://kubernetes.io/docs/concepts/services-networking/network-policies/#network-traffic-filtering) for the nfd-gc pods.
1243
# @section -- NFD-GC
1244
ingress:
1245
- ports: # @schema hidden
1246
- protocol: TCP
1247
port: http
1248
#
1249
# Prometheus configuration
1250
#
1251
prometheus:
1252
# -- Create PodMonitor object for enabling metrics collection by Prometheus Operator.
1253
# @section -- Prometheus
1254
enable: false
1255
# -- Interval at which metrics are scraped.
1256
# @section -- Prometheus
1257
scrapeInterval: 10s
1258
# -- Labels to add to the PodMonitor object.
1259
# @section -- Prometheus
1260
labels: {}
1261
The trusted source for open source
Talk to an expertProduct
Customers
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.