node-feature-discovery/deployment/base/rbac/worker-role.yaml

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: nfd-worker
rules:
- apiGroups:
  - nfd.k8s-sigs.io
  resources:
  - nodefeatures
  verbs:
  - create
  - get
  - update
  - delete
- apiGroups:
  - ""
  resources:
  - pods
  verbs:
  - get
nfd-worker: support creating NodeFeatures object Support the new NodeFeatures object of the NFD CRD api. Add two new command line options to nfd-worker: -kubeconfig specifies the kubeconfig to use for connecting k8s api (defaults to empty which implies in-cluster config) -enable-nodefeature-api enable the NodeFeature CRD API for communicating node features to nfd-master, will also automatically disable gRPC (defgault to false) No config file option for selecting the API is available as there should be no need for dynamically selecting between gRPC and CRD. The nfd-master configuration must be changed in tandem and it is safer (and avoid awkward configuration races) to configure the whole NFD deployment at once. Default behavior of nfd-worker is not changed i.e. NodeFeatures object creation is not enabled by default (but must be enabled with the command line flag). The patch also updates the kustomize and Helm deployment, adding RBAC rules for nfd-worker and updating the example worker configuration. 2022-08-12 13:10:48 +03:00			`apiVersion: rbac.authorization.k8s.io/v1`
			`kind: Role`
			`metadata:`
			`name: nfd-worker`
			`rules:`
			`- apiGroups:`
			`- nfd.k8s-sigs.io`
			`resources:`
			`- nodefeatures`
			`verbs:`
			`- create`
			`- get`
			`- update`
Add support running with OwnerReferencesPermissionEnforcement when OwnerReferencesPermissionEnforcement validating webhook is enabled additional permissions are required to set/update owner ref field. NFD worker sets/updates NodeFeature owner ref field to the worker pod and owning daemonset. owner reference can only be updated if the worker has delete permissions for NodeFeatures. if owner reference has blockOwnerDeletion (as the case for the daemonset owner reference) then it requires update permissions to the finalizers of the owner, to avoid this, we set blockOwnerDeleteion to false for all owners referenced from NFD worker pod when setting/updating NodeFeature owner ref. Signed-off-by: adrianc <adrianc@nvidia.com> 2025-01-08 12:05:11 +02:00			`- delete`
Use worker DS OwnerReference for NF's Signed-off-by: Carlos Eduardo Arango Gutierrez <eduardoa@nvidia.com> 2024-07-03 16:17:32 +02:00			`- apiGroups:`
			`- ""`
			`resources:`
			`- pods`
			`verbs:`
			`- get`