</code></pre></div></div><h3id="-h-help">-h, –help</h3><p>Print usage and exit.</p><h3id="version">–version</h3><p>Print version and exit.</p><h3id="prune">–prune</h3><p>The <codeclass="language-plaintext highlighter-rouge notranslate">--prune</code> flag is a sub-command like option for cleaning up the cluster. It causes nfd-master to remove all NFD related labels, annotations and extended resources from all Node objects of the cluster and exit.</p><h3id="port">–port</h3><p>The <codeclass="language-plaintext highlighter-rouge notranslate">--port</code> flag specifies the TCP port that nfd-master listens for incoming requests.</p><p>Default: 8080</p><p>Example:</p><divclass="language-bash highlighter-rouge notranslate"><divclass="highlight"><preclass="highlight"><code>nfd-master <spanclass="nt">--port</span><spanclass="o">=</span>443
</code></pre></div></div><h3id="ca-file">–ca-file</h3><p>The <codeclass="language-plaintext highlighter-rouge notranslate">--ca-file</code> is one of the three flags (together with <codeclass="language-plaintext highlighter-rouge notranslate">--cert-file</code> and <codeclass="language-plaintext highlighter-rouge notranslate">--key-file</code>) controlling master-worker mutual TLS authentication on the nfd-master side. This flag specifies the TLS root certificate that is used for authenticating incoming connections. NFD-Worker side needs to have matching key and cert files configured in order for the incoming requests to be accepted.</p><p>Default: <em>empty</em></p><p>Note: Must be specified together with <codeclass="language-plaintext highlighter-rouge notranslate">--cert-file</code> and <codeclass="language-plaintext highlighter-rouge notranslate">--key-file</code></p><p>Example:</p><divclass="language-bash highlighter-rouge notranslate"><divclass="highlight"><preclass="highlight"><code>nfd-master <spanclass="nt">--ca-file</span><spanclass="o">=</span>/opt/nfd/ca.crt <spanclass="nt">--cert-file</span><spanclass="o">=</span>/opt/nfd/master.crt <spanclass="nt">--key-file</span><spanclass="o">=</span>/opt/nfd/master.key
</code></pre></div></div><h3id="cert-file">–cert-file</h3><p>The <codeclass="language-plaintext highlighter-rouge notranslate">--cert-file</code> is one of the three flags (together with <codeclass="language-plaintext highlighter-rouge notranslate">--ca-file</code> and <codeclass="language-plaintext highlighter-rouge notranslate">--key-file</code>) controlling master-worker mutual TLS authentication on the nfd-master side. This flag specifies the TLS certificate presented for authenticating outgoing traffic towards nfd-worker.</p><p>Default: <em>empty</em></p><p>Note: Must be specified together with <codeclass="language-plaintext highlighter-rouge notranslate">--ca-file</code> and <codeclass="language-plaintext highlighter-rouge notranslate">--key-file</code></p><p>Example:</p><divclass="language-bash highlighter-rouge notranslate"><divclass="highlight"><preclass="highlight"><code>nfd-master <spanclass="nt">--cert-file</span><spanclass="o">=</span>/opt/nfd/master.crt <spanclass="nt">--key-file</span><spanclass="o">=</span>/opt/nfd/master.key <spanclass="nt">--ca-file</span><spanclass="o">=</span>/opt/nfd/ca.crt
</code></pre></div></div><h3id="key-file">–key-file</h3><p>The <codeclass="language-plaintext highlighter-rouge notranslate">--key-file</code> is one of the three flags (together with <codeclass="language-plaintext highlighter-rouge notranslate">--ca-file</code> and <codeclass="language-plaintext highlighter-rouge notranslate">--cert-file</code>) controlling master-worker mutual TLS authentication on the nfd-master side. This flag specifies the private key corresponding the given certificate file (<codeclass="language-plaintext highlighter-rouge notranslate">--cert-file</code>) that is used for authenticating outgoing traffic.</p><p>Default: <em>empty</em></p><p>Note: Must be specified together with <codeclass="language-plaintext highlighter-rouge notranslate">--cert-file</code> and <codeclass="language-plaintext highlighter-rouge notranslate">--ca-file</code></p><p>Example:</p><divclass="language-bash highlighter-rouge notranslate"><divclass="highlight"><preclass="highlight"><code>nfd-master <spanclass="nt">--key-file</span><spanclass="o">=</span>/opt/nfd/master.key <spanclass="nt">--cert-file</span><spanclass="o">=</span>/opt/nfd/master.crt <spanclass="nt">--ca-file</span><spanclass="o">=</span>/opt/nfd/ca.crt
</code></pre></div></div><h3id="verify-node-name">–verify-node-name</h3><p>The <codeclass="language-plaintext highlighter-rouge notranslate">--verify-node-name</code> flag controls the NodeName based authorization of incoming requests and only has effect when mTLS authentication has been enabled (with <codeclass="language-plaintext highlighter-rouge notranslate">--ca-file</code>, <codeclass="language-plaintext highlighter-rouge notranslate">--cert-file</code> and <codeclass="language-plaintext highlighter-rouge notranslate">--key-file</code>). If enabled, the worker node name of the incoming must match with the CN in its TLS certificate. Thus, workers are only able to label the node they are running on (or the node whose certificate they present), and, each worker must have an individual certificate.</p><p>Node Name based authorization is disabled by default and thus it is possible for all nfd-worker pods in the cluster to use one shared certificate, making NFD deployment much easier.</p><p>Default: <em>false</em></p><p>Example:</p><divclass="language-bash highlighter-rouge notranslate"><divclass="highlight"><preclass="highlight"><code>nfd-master <spanclass="nt">--verify-node-name</span><spanclass="nt">--ca-file</span><spanclass="o">=</span>/opt/nfd/ca.crt <spanclass="se">\</span>
</code></pre></div></div><h3id="no-publish">–no-publish</h3><p>The <codeclass="language-plaintext highlighter-rouge notranslate">--no-publish</code> flag disables all communication with the Kubernetes API server, making a "dry-run" flag for nfd-master. No Labels, Annotations or ExtendedResources (or any other properties of any Kubernetes API objects) are modified.</p><p>Default: <em>false</em></p><p>Example:</p><divclass="language-bash highlighter-rouge notranslate"><divclass="highlight"><preclass="highlight"><code>nfd-master <spanclass="nt">--no-publish</span>
</code></pre></div></div><h3id="label-whitelist">–label-whitelist</h3><p>The <codeclass="language-plaintext highlighter-rouge notranslate">--label-whitelist</code> specifies a regular expression for filtering feature labels based on their name. Each label must match against the given reqular expression in order to be published.</p><p>Note: The regular expression is only matches against the "basename" part of the label, i.e. to the part of the name after ‘/'. The label namespace is omitted.</p><p>Default: <em>empty</em></p><p>Example:</p><divclass="language-bash highlighter-rouge notranslate"><divclass="highlight"><preclass="highlight"><code>nfd-master <spanclass="nt">--label-whitelist</span><spanclass="o">=</span><spanclass="s1">'.*cpuid\.'</span>
</code></pre></div></div><h3id="extra-label-ns">–extra-label-ns</h3><p>The <codeclass="language-plaintext highlighter-rouge notranslate">--extra-label-ns</code> flag specifies a comma-separated list of allowed feature label namespaces. By default, nfd-master only allows creating labels in the default <codeclass="language-plaintext highlighter-rouge notranslate">feature.node.kubernetes.io</code> label namespace. This option can be used to allow vendor-specific namespaces for custom labels from the local and custom feature sources.</p><p>The same namespace control and this flag applies Extended Resources (created with <codeclass="language-plaintext highlighter-rouge notranslate">--resource-labels</code>), too.</p><p>Default: <em>empty</em></p><p>Example:</p><divclass="language-bash highlighter-rouge notranslate"><divclass="highlight"><preclass="highlight"><code>nfd-master <spanclass="nt">--extra-label-ns</span><spanclass="o">=</span>vendor-1.com,vendor-2.io
</code></pre></div></div><h3id="resource-labels">–resource-labels</h3><p>The <codeclass="language-plaintext highlighter-rouge notranslate">--resource-labels</code> flag specifies a comma-separated list of features to be advertised as extended resources instead of labels. Features that have integer values can be published as Extended Resources by listing them in this flag.</p><p>Default: <em>empty</em></p><p>Example:</p><divclass="language-bash highlighter-rouge notranslate"><divclass="highlight"><preclass="highlight"><code>nfd-master <spanclass="nt">--resource-labels</span><spanclass="o">=</span>vendor-1.com/feature-1,vendor-2.io/feature-2
