apiVersion: operators.coreos.com/v1alpha1
kind: ClusterServiceVersion
metadata:
  annotations:
    alm-examples: |-
      [
        {
          "apiVersion": "nfd.openshift.io/v1",
          "kind": "NodeFeatureDiscovery",
          "metadata": {
            "name": "nfd-instance",
            "namespace": "openshift-nfd"
          },
          "spec": {
            "customConfig": {
              "configData": "#    - name: \"more.kernel.features\"\n#      matchOn:\n#      - loadedKMod: [\"example_kmod3\"]\n#    - name: \"more.features.by.nodename\"\n#      value: customValue\n#      matchOn:\n#      - nodename: [\"special-.*-node-.*\"]\n"
            },
            "operand": {
              "image": "quay.io/openshift/origin-node-feature-discovery:4.10",
              "servicePort": 12000
            },
            "workerConfig": {
              "configData": "core:\n#  labelWhiteList:\n#  noPublish: false\n  sleepInterval: 60s\n#  sources: [all]\n#  klog:\n#    addDirHeader: false\n#    alsologtostderr: false\n#    logBacktraceAt:\n#    logtostderr: true\n#    skipHeaders: false\n#    stderrthreshold: 2\n#    v: 0\n#    vmodule:\n##   NOTE: the following options are not dynamically run-time \n##          configurable and require a nfd-worker restart to take effect\n##          after being changed\n#    logDir:\n#    logFile:\n#    logFileMaxSize: 1800\n#    skipLogHeaders: false\nsources:\n#  cpu:\n#    cpuid:\n##     NOTE: whitelist has priority over blacklist\n#      attributeBlacklist:\n#        - \"BMI1\"\n#        - \"BMI2\"\n#        - \"CLMUL\"\n#        - \"CMOV\"\n#        - \"CX16\"\n#        - \"ERMS\"\n#        - \"F16C\"\n#        - \"HTT\"\n#        - \"LZCNT\"\n#        - \"MMX\"\n#        - \"MMXEXT\"\n#        - \"NX\"\n#        - \"POPCNT\"\n#        - \"RDRAND\"\n#        - \"RDSEED\"\n#        - \"RDTSCP\"\n#        - \"SGX\"\n#        - \"SSE\"\n#        - \"SSE2\"\n#        - \"SSE3\"\n#        - \"SSE4.1\"\n#        - \"SSE4.2\"\n#        - \"SSSE3\"\n#      attributeWhitelist:\n#  kernel:\n#    kconfigFile: \"/path/to/kconfig\"\n#    configOpts:\n#      - \"NO_HZ\"\n#      - \"X86\"\n#      - \"DMI\"\n  pci:\n    deviceClassWhitelist:\n      - \"0200\"\n      - \"03\"\n      - \"12\"\n    deviceLabelFields:\n#      - \"class\"\n      - \"vendor\"\n#      - \"device\"\n#      - \"subsystem_vendor\"\n#      - \"subsystem_device\"\n#  usb:\n#    deviceClassWhitelist:\n#      - \"0e\"\n#      - \"ef\"\n#      - \"fe\"\n#      - \"ff\"\n#    deviceLabelFields:\n#      - \"class\"\n#      - \"vendor\"\n#      - \"device\"\n#  custom:\n#    - name: \"my.kernel.feature\"\n#      matchOn:\n#        - loadedKMod: [\"example_kmod1\", \"example_kmod2\"]\n#    - name: \"my.pci.feature\"\n#      matchOn:\n#        - pciId:\n#            class: [\"0200\"]\n#            vendor: [\"15b3\"]\n#            device: [\"1014\", \"1017\"]\n#        - pciId :\n#            vendor: [\"8086\"]\n#            device: [\"1000\", \"1100\"]\n#    - name: \"my.usb.feature\"\n#      matchOn:\n#        - usbId:\n#          class: [\"ff\"]\n#          vendor: [\"03e7\"]\n#          device: [\"2485\"]\n#        - usbId:\n#          class: [\"fe\"]\n#          vendor: [\"1a6e\"]\n#          device: [\"089a\"]\n#    - name: \"my.combined.feature\"\n#      matchOn:\n#        - pciId:\n#            vendor: [\"15b3\"]\n#            device: [\"1014\", \"1017\"]\n#          loadedKMod : [\"vendor_kmod1\", \"vendor_kmod2\"]\n"
            }
          }
        },
        {
          "apiVersion": "nfd.openshift.io/v1alpha1",
          "kind": "NodeFeatureRule",
          "metadata": {
            "name": "my-sample-rule-object"
          },
          "spec": {
            "rules": [
              {
                "labels": {
                  "my-sample-feature": "true"
                },
                "matchFeatures": [
                  {
                    "feature": "kernel.loadedmodule",
                    "matchExpressions": {
                      "dummy": {
                        "op": "Exists"
                      }
                    }
                  },
                  {
                    "feature": "kernel.config",
                    "matchExpressions": {
                      "X86": {
                        "op": "In",
                        "value": [
                          "y"
                        ]
                      }
                    }
                  }
                ],
                "name": "my sample rule"
              }
            ]
          }
        }
      ]
    capabilities: Deep Insights
    categories: Integration & Delivery,OpenShift Optional
    containerImage: quay.io/openshift/origin-cluster-nfd-operator:4.10
    description: |-
      The Node Feature Discovery Operator manages the detection of hardware features and configuration in a Kubernetes cluster by labeling the nodes with hardware-specific information. The Node Feature Discovery (NFD) will label the host with node-specific attributes, like PCI cards, kernel, or OS version, and many more.

      NFD consists  of the following software components:

      The NFD Operator is based on the Operator Framework an open source toolkit to manage Kubernetes native applications, called Operators, in an effective, automated, and scalable way.

      ##NFD-Master
      NFD-Master is the daemon responsible for communication towards the Kubernetes API. That is, it receives labeling requests from the worker and modifies node objects accordingly.

      ##NFD-Worker
      NFD-Worker is a daemon responsible for feature detection. It then communicates the information to nfd-master which does the actual node labeling. One instance of nfd-worker is supposed to be running on each node of the cluster.

      ##NFD-Topology-Updater
      NFD-Topology-Updater is a daemon responsible for examining allocated resources on a worker node to account for resources available to be allocated to new pod on a per-zone basis (where a zone can be a NUMA node). It then communicates the information to nfd-master which does the NodeResourceTopology CR creation corresponding to all the nodes in the cluster. One instance of nfd-topology-updater is supposed to be running on each node of the cluster.
    olm.skipRange: '>=4.6.0 <4.11.0'
    operatorframework.io/cluster-monitoring: "true"
    operatorframework.io/suggested-namespace: openshift-nfd
    operators.openshift.io/infrastructure-features: '["disconnected"]'
    operators.operatorframework.io/builder: operator-sdk-v1.16.0+git
    operators.operatorframework.io/internal-objects: '["noderesourcetopologies.topology.node.k8s.io"]'
    operators.operatorframework.io/project_layout: go.kubebuilder.io/v3
    provider: Red Hat
    repository: https://github.com/openshift/cluster-nfd-operator
    support: Red Hat
  labels:
    operatorframework.io/arch.amd64: supported
    operatorframework.io/arch.arm64: supported
    operatorframework.io/arch.ppc64le: supported
    operatorframework.io/arch.s390x: supported
  name: nfd.v4.10.0
  namespace: placeholder
spec:
  apiservicedefinitions: {}
  customresourcedefinitions:
    owned:
    - description: |
        The NodeFeatureDiscovery instance is the CustomResource being watched by the NFD-Operator, and holds all the needed information to setup the behaviour of the master and worker pods
      kind: NodeFeatureDiscovery
      name: nodefeaturediscoveries.nfd.openshift.io
      version: v1
    - description: |
        NodeFeatureRule resource specifies a configuration for feature-based customization of node objects, such as node labeling.
      kind: NodeFeatureRule
      name: nodefeaturerules.nfd.openshift.io
      version: v1alpha1
    - description: |
        NodeResourceTopology resource describes node resources and their topology.
      kind: NodeResourceTopology
      name: noderesourcetopologies.topology.node.k8s.io
      version: v1alpha1
  description: |-
    The Node Feature Discovery Operator manages the detection of hardware features and configuration in a Kubernetes cluster by labeling the nodes with hardware-specific information. The Node Feature Discovery (NFD) will label the host with node-specific attributes, like PCI cards, kernel, or OS version, and many more.

    NFD consists  of the following software components:

    The NFD Operator is based on the Operator Framework an open source toolkit to manage Kubernetes native applications, called Operators, in an effective, automated, and scalable way.

    ##NFD-Master
    NFD-Master is the daemon responsible for communication towards the Kubernetes API. That is, it receives labeling requests from the worker and modifies node objects accordingly.

    ##NFD-Worker
    NFD-Worker is a daemon responsible for feature detection. It then communicates the information to nfd-master which does the actual node labeling. One instance of nfd-worker is supposed to be running on each node of the cluster.

    ##NFD-Topology-Updater
    NFD-Topology-Updater is a daemon responsible for examining allocated resources on a worker node to account for resources available to be allocated to new pod on a per-zone basis (where a zone can be a NUMA node). It then communicates the information to nfd-master which does the NodeResourceTopology CR creation corresponding to all the nodes in the cluster. One instance of nfd-topology-updater is supposed to be running on each node of the cluster.
  displayName: Node Feature Discovery Operator
  icon:
  - base64data: |
[encoded data, 16173 characters]
    mediatype: image/png
  install:
    spec:
      clusterPermissions:
      - rules:
        - apiGroups:
          - policy
          resourceNames:
          - nfd-worker
          resources:
          - podsecuritypolicies
          verbs:
          - use
        - apiGroups:
          - ""
          resources:
          - nodes/status
          verbs:
          - get
          - patch
          - update
        - apiGroups:
          - nfd.openshift.io
          resources:
          - nodefeaturerules
          verbs:
          - get
          - list
          - watch
        - apiGroups:
          - topology.node.k8s.io
          resources:
          - noderesourcetopologies
          verbs:
          - create
          - get
          - update
        - apiGroups:
          - apps
          resources:
          - daemonsets
          verbs:
          - create
          - delete
          - get
          - list
          - patch
          - update
          - watch
        - apiGroups:
          - apps
          resources:
          - deployments
          verbs:
          - create
          - delete
          - get
          - list
          - patch
          - update
          - watch
        - apiGroups:
          - cert-manager.io
          resources:
          - certificates
          verbs:
          - create
          - delete
          - get
          - list
          - patch
          - update
          - watch
        - apiGroups:
          - cert-manager.io
          resources:
          - issuers
          verbs:
          - create
          - delete
          - get
          - list
          - patch
          - update
          - watch
        - apiGroups:
          - config.openshift.io
          resources:
          - clusteroperators
          verbs:
          - create
          - delete
          - get
          - list
          - patch
          - update
          - watch
        - apiGroups:
          - config.openshift.io
          resources:
          - clusteroperators/status
          verbs:
          - create
          - delete
          - get
          - list
          - patch
          - update
          - watch
        - apiGroups:
          - config.openshift.io
          resources:
          - clusterversions
          verbs:
          - get
        - apiGroups:
          - config.openshift.io
          resources:
          - proxies
          verbs:
          - get
          - list
        - apiGroups:
          - coordination.k8s.io
          resources:
          - leases
          verbs:
          - create
          - delete
          - get
          - list
          - update
          - watch
        - apiGroups:
          - ""
          resources:
          - configmaps
          verbs:
          - create
          - delete
          - get
          - list
          - patch
          - update
          - watch
        - apiGroups:
          - ""
          resources:
          - endpoints
          verbs:
          - create
          - delete
          - get
          - list
          - patch
          - update
          - watch
        - apiGroups:
          - ""
          resources:
          - events
          verbs:
          - create
          - list
          - patch
          - update
          - watch
        - apiGroups:
          - ""
          resources:
          - imagestreams/layers
          verbs:
          - get
        - apiGroups:
          - ""
          resources:
          - namespaces
          verbs:
          - create
          - delete
          - get
          - list
          - patch
          - update
          - watch
        - apiGroups:
          - ""
          resources:
          - nodes
          verbs:
          - create
          - delete
          - get
          - list
          - patch
          - update
          - watch
        - apiGroups:
          - ""
          resources:
          - persistentvolumeclaims
          verbs:
          - get
          - list
          - update
          - watch
        - apiGroups:
          - ""
          resources:
          - persistentvolumes
          verbs:
          - create
          - delete
          - get
          - list
          - watch
        - apiGroups:
          - ""
          resources:
          - pods
          verbs:
          - create
          - delete
          - get
          - list
          - patch
          - update
          - watch
        - apiGroups:
          - ""
          resources:
          - pods/log
          verbs:
          - get
        - apiGroups:
          - ""
          resources:
          - secrets
          verbs:
          - create
          - delete
          - get
          - list
          - patch
          - update
          - watch
        - apiGroups:
          - ""
          resources:
          - serviceaccounts
          verbs:
          - create
          - delete
          - get
          - list
          - patch
          - update
          - watch
        - apiGroups:
          - ""
          resources:
          - services
          verbs:
          - create
          - delete
          - get
          - list
          - patch
          - update
          - watch
        - apiGroups:
          - monitoring.coreos.com
          resources:
          - prometheusrules
          verbs:
          - create
          - delete
          - get
          - list
          - patch
          - update
          - watch
        - apiGroups:
          - monitoring.coreos.com
          resources:
          - servicemonitors
          verbs:
          - create
          - delete
          - get
          - list
          - patch
          - update
          - watch
        - apiGroups:
          - nfd.openshift.io
          resources:
          - nodefeaturediscoveries
          verbs:
          - create
          - delete
          - get
          - list
          - patch
          - update
          - watch
        - apiGroups:
          - nfd.openshift.io
          resources:
          - nodefeaturediscoveries/finalizers
          verbs:
          - update
        - apiGroups:
          - nfd.openshift.io
          resources:
          - nodefeaturediscoveries/status
          verbs:
          - get
          - patch
          - update
        - apiGroups:
          - rbac.authorization.k8s.io
          resources:
          - clusterrolebindings
          verbs:
          - create
          - delete
          - get
          - list
          - patch
          - update
          - watch
        - apiGroups:
          - rbac.authorization.k8s.io
          resources:
          - clusterroles
          verbs:
          - create
          - delete
          - get
          - list
          - patch
          - update
          - watch
        - apiGroups:
          - rbac.authorization.k8s.io
          resources:
          - rolebindings
          verbs:
          - create
          - delete
          - get
          - list
          - patch
          - update
          - watch
        - apiGroups:
          - rbac.authorization.k8s.io
          resources:
          - roles
          verbs:
          - create
          - delete
          - get
          - list
          - patch
          - update
          - watch
        - apiGroups:
          - route.openshift.io
          resources:
          - routes
          verbs:
          - create
          - delete
          - get
          - list
          - patch
          - update
          - watch
        - apiGroups:
          - security.openshift.io
          resources:
          - securitycontextconstraints
          verbs:
          - create
          - delete
          - get
          - list
          - patch
          - update
          - use
          - watch
        - apiGroups:
          - authentication.k8s.io
          resources:
          - tokenreviews
          verbs:
          - create
        - apiGroups:
          - authorization.k8s.io
          resources:
          - subjectaccessreviews
          verbs:
          - create
        serviceAccountName: nfd-operator
      deployments:
      - name: nfd-controller-manager
        spec:
          replicas: 1
          selector:
            matchLabels:
              control-plane: controller-manager
          strategy: {}
          template:
            metadata:
              labels:
                control-plane: controller-manager
            spec:
              containers:
              - args:
                - --secure-listen-address=0.0.0.0:8443
                - --upstream=http://127.0.0.1:8080/
                - --logtostderr=true
                - --v=10
                - --tls-cert-file=/etc/secrets/tls.crt
                - --tls-private-key-file=/etc/secrets/tls.key
                - --tls-cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
                image: registry.redhat.io/openshift4/ose-kube-rbac-proxy
                name: kube-rbac-proxy
                ports:
                - containerPort: 8443
                  name: https
                resources:
                  limits:
                    cpu: 500m
                    memory: 128Mi
                  requests:
                    cpu: 250m
                    memory: 64Mi
                securityContext:
                  readOnlyRootFilesystem: true
                volumeMounts:
                - mountPath: /etc/secrets
                  name: node-feature-discovery-operator-tls
              - args:
                - --metrics-bind-address=127.0.0.1:8080
                - --leader-elect
                command:
                - /node-feature-discovery-operator
                env:
                - name: SSL_CERT_DIR
                  value: /etc/pki/tls/certs
                - name: WATCH_NAMESPACE
                  valueFrom:
                    fieldRef:
                      fieldPath: metadata.annotations['olm.targetNamespaces']
                - name: POD_NAME
                  valueFrom:
                    fieldRef:
                      fieldPath: metadata.name
                - name: OPERATOR_NAME
                  value: cluster-nfd-operator
                - name: NODE_FEATURE_DISCOVERY_IMAGE
                  value: quay.io/openshift/origin-node-feature-discovery:4.10
                image: quay.io/openshift/origin-cluster-nfd-operator:4.10
                livenessProbe:
                  httpGet:
                    path: /healthz
                    port: 8081
                  initialDelaySeconds: 15
                  periodSeconds: 20
                name: manager
                ports:
                - containerPort: 8080
                  name: metrics
                readinessProbe:
                  httpGet:
                    path: /readyz
                    port: 8081
                  initialDelaySeconds: 5
                  periodSeconds: 10
                resources: {}
                securityContext:
                  allowPrivilegeEscalation: false
                  capabilities:
                    drop:
                    - ALL
                  readOnlyRootFilesystem: true
              serviceAccountName: nfd-operator
              terminationGracePeriodSeconds: 10
              volumes:
              - name: node-feature-discovery-operator-tls
                secret:
                  secretName: node-feature-discovery-operator-tls
      permissions:
      - rules:
        - apiGroups:
          - ""
          - coordination.k8s.io
          resources:
          - configmaps
          - leases
          verbs:
          - get
          - list
          - watch
          - create
          - update
          - patch
          - delete
        - apiGroups:
          - ""
          resources:
          - events
          verbs:
          - create
          - patch
        - apiGroups:
          - rbac.authorization.k8s.io
          resources:
          - roles
          - rolebindings
          - clusterroles
          - clusterrolebindings
          verbs:
          - '*'
        - apiGroups:
          - ""
          resources:
          - pods
          - services
          - endpoints
          - persistentvolumeclaims
          - events
          - configmaps
          - secrets
          - serviceaccounts
          - nodes
          verbs:
          - '*'
        - apiGroups:
          - ""
          resources:
          - namespaces
          verbs:
          - get
          - list
          - watch
        - apiGroups:
          - apps
          resources:
          - deployments
          - daemonsets
          - replicasets
          - statefulsets
          verbs:
          - '*'
        - apiGroups:
          - monitoring.coreos.com
          resources:
          - servicemonitors
          verbs:
          - get
          - create
        - apiGroups:
          - nfd.openshift.io
          resources:
          - '*'
          verbs:
          - '*'
        serviceAccountName: nfd-operator
    strategy: deployment
  installModes:
  - supported: true
    type: OwnNamespace
  - supported: true
    type: SingleNamespace
  - supported: false
    type: MultiNamespace
  - supported: true
    type: AllNamespaces
  keywords:
  - feature-discovery
  - feature-detection
  - node-labels
  links:
  - name: Node Feature Discovery Operator
    url: https://docs.openshift.com/container-platform/4.9/hardware_enablement/psap-node-feature-discovery-operator.html
  - name: Node Feature Discovery Documentation
    url: https://kubernetes-sigs.github.io/node-feature-discovery/stable/get-started/index.html
  maintainers:
  - email: openshift-psap@redhat.com
    name: openshift-psap
  maturity: stable
  minKubeVersion: 1.22.0
  provider:
    name: Red Hat
    url: https://github.com/openshift/cluster-nfd-operator
  version: 4.10.0
