node-feature-discovery/master/data.json

[{"layout":"default","title":null,"content":"--\ntitle: \"Feature discovery\"\nlayout: default\nsort: 4\n---\n\n# Feature discovery\n{: .no_toc}\n\n## Table of contents\n{: .no_toc .text-delta}\n\n1. TOC\n{:toc}\n\n---\n\nFeature discovery in nfd-worker is performed by a set of separate modules\ncalled feature sources. Most of them are specifically responsible for certain\ndomain of features (e.g. cpu). In addition there are two highly customizable\nfeature sources that work accross the system.\n\n## Feature labels\n\nEach discovered feature is advertised a label in the Kubernetes Node object.\nThe published node labels encode a few pieces of information:\n\n- Namespace\n - all built-in labels use `feature.node.kubernetes.io`\n - user-specified custom labels ([custom](#custom) and\n [local](#local--user-specific-features) feature sources)\n - `feature.node.kubernetes.io` and `profile.node.kubernetes.io` plus their\n sub-namespaces (e.g. `vendor.profile.node.kubernetes.io` and\n `sub.ns.profile.node.kubernetes.io`) are allowed by default\n - additional namespaces may be enabled with the\n [`-extra-label-ns`](../advanced/master-commandline-reference#-extra-label-ns)\n command line flag of nfd-master\n- The source for each label (e.g. `cpu`).\n- The name of the discovered feature as it appears in the underlying\n source, (e.g. `cpuid.AESNI` from cpu).\n- The value of the discovered feature.\n\nFeature label names adhere to the following pattern:\n\n```plaintext\n<namespace>/<source name>-<feature name>[.<attribute name>]\n```\n\nThe last component (i.e. `attribute-name`) is optional, and only used if a\nfeature logically has sub-hierarchy, e.g. `sriov.capable` and\n`sriov.configure` from the `network` source.\n\nThe `-label-sources` flag controls which sources to enable for label\ngeneration.\n\n*Note: Consecutive runs of nfd-worker will update the labels on a\ngiven node. If features are not discovered on a consecutive run, the corresponding\nlabel will be removed. This includes any restrictions placed on the consecutive run,\nsuch as restricting discovered features with the -label-whitelist option.*\n\n## Feature sources\n\n### CPU\n\nThe **cpu** feature source supports the following labels:\n\n| Feature name | Attribute | Description |\n| ----------------------- | ------------------ | ----------------------------- |\n| cpuid | &lt;cpuid flag&gt; | CPU capability is supported\n| hardware_multithreading | | Hardware multithreading, such as Intel HTT, enabled (number of logical CPUs is greater than physical CPUs)\n| power | sst_bf.enabled | Intel SST-BF ([Intel Speed Select Technology][intel-sst] - Base frequency) enabled\n| [pstate][intel-pstate] | status | The status of the Intel pstate driver when in use and enabled, either 'active' or 'passive'.\n| | turbo | Set to 'true' if turbo frequencies are enabled in Intel pstate driver, set to 'false' if they have been disabled.\n| | scaling_governor | The value of the Intel pstate scaling_governor when in use, either 'powersave' or 'performance'.\n| cstate | enabled | Set to 'true' if cstates are set in the intel_idle driver, otherwise set to 'false'. Unset if intel_idle cpuidle driver is not active.\n| [rdt][intel-rdt] | RDTMON | Intel RDT Monitoring Technology\n| | RDTCMT | Intel Cache Monitoring (CMT)\n| | RDTMBM | Intel Memory Bandwidth Monitoring (MBM)\n| | RDTL3CA | Intel L3 Cache Allocation Technology\n| | RDTL2CA | Intel L2 Cache Allocation Technology\n| | RDTMBA | Intel Memory Bandwidth Allocation (MBA) Technology\n| sgx | enabled | Set to 'true' if Intel SGX is enabled in BIOS (based a non-zero sum value of SGX EPC section sizes).\n\nThe (sub-)set of CPUID attributes to publish is configurable via the\n`attributeBlacklist` and `attributeWhitelist` cpuid options of the cpu source.\nIf whitelist is specified, only whitelisted attributes will be published. With\nblacklist, only blacklisted attributes are filtered out. `attributeWhitelist`\nhas priority over `attributeBlacklist`. For examples and more information\nabout configurability, see\n[configuration](deployment-and-usage#worker-configuration).\nBy default, the following CPUID flags have been blacklisted:\nBMI1, BMI2, CLMUL, CMOV, CX16, ERMS, F16C, HTT, LZCNT, MMX, MMXEXT, NX, POPCNT,\nRDRAND, RDSEED, RDTSCP, SGX, SSE, SSE2, SSE3, SSE4, SSE42 and SSSE3.\n\n**NOTE** The cpuid features advertise *supported* CPU capabilities, that is, a\ncapability might be supported but not enabled.\n\n#### X86 CPUID attributes (partial list)\n\n| Attribute | Description |\n| --------- | ---------------------------------------------------------------- |\n| ADX | Multi-Precision Add-Carry Instruction Extensions (ADX)\n| AESNI | Advanced Encryption Standard (AES) New Instructions (AES-NI)\n| AVX | Advanced Vector Extensions (AVX)\n| AVX2 | Advanced Vector Extensions 2 (AVX2)\n\nSee the full list in [github.com/klauspost/cpuid][klauspost-cpuid].\n\n#### Arm CPUID attribute (partial list)\n\n| Attribute | Description |\n| --------- | ---------------------------------------------------------------- |\n| IDIVA | Integer divide instructions available in ARM mode\n| IDIVT | Integer divide instructions available in Thumb mode\n| THUMB | Thumb instructions\n| FASTMUL | Fast multiplication\n| VFP | Vector floating point instruction extension (VFP)\n| VFPv3 | Vector floating point extension v3\n| VFPv4 | Vector floating point extension v4\n| VFPD32 | VFP with 32 D-registers\n| HALF | Half-word loads and stores\n| EDSP | DSP extensions\n| NEON | NEON SIMD instructions\n| LPAE | Large Physical Address Extensions\n\n#### Arm64 CPUID attribute (partial list)\n\n| Attribute | Description |\n| --------- | ---------------------------------------------------------------- |\n| AES | Announcing the Advanced Encryption Standard\n| EVSTRM | Event Stream Frequency Features\n| FPHP | Half Precision(16bit) Floating Point Data Processing Instructions\n| ASIMDHP | Half Precision(16bit) Asimd Data Processing Instructions\n| ATOMICS | Atomic Instructions to the A64\n| ASIMRDM | Support for Rounding Double Multiply Add/Subtract\n| PMULL | Optional Cryptographic and CRC32 Instructions\n| JSCVT | Perform Conversion to Match Javascript\n| DCPOP | Persistent Memory Support\n\n### Custom\n\nThe Custom feature source allows the user to define features based on a mix of\npredefined rules. A rule is provided input witch affects its process of\nmatching for a defined feature. The rules are specified in the\nnfd-worker configuration file. See\n[configuration](/node-feature-discovery/master/get-started/deployment-and-usage.html#worker-configuration) for instructions\nand examples how to set-up and manage the worker configuration.\n\nTo aid in making Custom Features clearer, we define a general and a per rule\nnomenclature, keeping things as consistent as possible.\n\n#### Additional configuration directory\n\nAdditionally to the rules defined in the nfd-worker configuration file, the\nCustom feature can read more configuration files located in the\n`/etc/kubernetes/node-feature-discovery/custom.d/` directory. This makes more\ndynamic and flexible configuration easier. This directory must be available\ninside the NFD worker container, so Volumes and VolumeMounts must be used for\nmounting e.g. ConfigMap(s). The example deployment manifests provide an example\n(commented out) for providing Custom configuration with an additional\nConfigMap, mounted into the `custom.d` directory.\n\n#### General nomenclature & definitions\n\n```plaintext\nRule :Represents a matching logic that is used to match on a feature.\nRule Input :The input a Rule is provided. This determines how a Rule performs the match operation.\nMatcher :A composition of Rules, each Matcher may be composed of at most one instance of each Rule.\n```\n\n#### Custom features format (using the nomenclature defined above)\n\nRules are specified under `sources.custom` in the nfd-worker configuration\nfile.\n\n```yaml\nsources:\n custom:\n - name: <feature name>\n value: <optional feature value, defaults to \"true\">\n matchOn:\n - <Rule-1>: <Rule-1 Input>\n [<Rule-2>: <Rule-2 Input>]\n - <Matcher-2>\n - ...\n - ...\n - <Matcher-N>\n - <custom feature 2>\n - ...\n - ...\n - <custom feature M>\n```\n\n#### Matching process\n\nSpecifying Rules to match on a feature is done by providing a list of Matchers.\nEach Matcher contains one or more Rules.\n\nLogical _OR_ is performed between Matchers and logical _AND_ is performed\nbetween Rules of a given Matcher.\n\n#### Rules\n\n##### pciid rule\n\n###### Nomenclature\n\n```plaintext\nAttribute :A PCI attribute.\nElement :An identifier of the PCI attribute.\n```\n\nThe PciId Rule allows matching the PCI devices in the system on the following\nAttributes: `class`,`vendor` and `device`. A list of Elements is provided for\neach Attribute.\n\n###### Format\n\n```yaml\npciId :\n class: [<class id>, ...]\n vendor: [<vendor id>, ...]\n device: [<device id>, ...]\n```\n\nMatching is done by performing a logical _OR_ between Elements of an Attribute\nand logical _AND_ between the specified Attributes for each PCI device in the\nsystem. At least one Attribute must be specified. Missing attributes will not\npartake in the matching process.\n\n##### UsbId rule\n\n###### Nomenclature\n\n```plaintext\nAttribute :A USB attribute.\nElement :An identifier of the USB attribute.\n```\n\nThe UsbId Rule allows matching the USB devices in the system on the following\nAttributes: `class`,`vendor`, `device` and `serial`. A list of Elements is\nprovided for each Attribute.\n\n###### Format\n\n```yaml\nusbId :\n class: [<class id>, ...]\n vendor: [<vendor id>, ...]\n device: [<device id>, ...]\n serial: [<serial>, ...]\n```\n\nMatching is done by performing a logical _OR_ between Elements of an Attribute\nand logical _AND_ between the specified Attributes for each USB device in the\nsystem. At least one Attribute must be specified. Missing attributes will not\npartake in the matching process.\n\n##### LoadedKMod rule\n\n###### Nomenclature\n\n```plaintext\nElement :A kernel module\n```\n\nThe LoadedKMod Rule allows matching the loaded kernel modules in the system\nagainst a provided list of Elements.\n\n###### Format\n\n```yaml\nloadedKMod : [<kernel module>, ...]\n```\n\nMatching is done by performing logical _AND_ for each provided Element, i.e\nthe Rule will match if all provided Elements (kernel modules) are loaded in the\nsystem.\n\n##### CpuId rule\n\n###### Nomenclature\n\n```plaintext\nElement :A CPUID flag\n```\n\nThe Rule allows matching the available CPUID flags in the system against a\nprovided list of Elements.\n\n###### Format\n\n```yaml\ncpuId : [<CPUID flag string>, ...]\n```\n\nMatching is done by performing logical _AND_ for each provided Element, i.e the\nRule will match if all provided Elements (CPUID flag strings) are available in\nthe system.\n\n##### Kconfig rule\n\n###### Nomenclature\n\n```plaintext\nElement :A Kconfig option\n```\n\nThe Rule allows matching the kconfig options in the system against a provided\nlist of Elements.\n\n###### Format\n\n```yaml\nkConfig: [<kernel config option ('y' or 'm') or '=<value>'>, ...]\n```\n\nMatching is done by performing logical _AND_ for each provided Element, i.e the\nRule will match if all provided Elements (kernel config options) are enabled\n(`y` or `m`) or matching `=<value>` in the kernel.\n\n##### Nodename rule\n\n###### Nomenclature\n\n```plaintext\nElement :A nodename regexp pattern\n```\n\nThe Rule allows matching the node's name against a provided list of Elements.\n\n###### Format\n\n```yaml\nnodename: [ <nodename regexp pattern>, ... ]\n```\n\nMatching is done by performing logical _OR_ for each provided Element, i.e the\nRule will match if one of the provided Elements (nodename regexp pattern)\nmatches the node's name.\n\n#### Example\n\n```yaml\ncustom:\n - name: \"my.kernel.feature\"\n matchOn:\n - loadedKMod: [\"kmod1\", \"kmod2\"]\n - name: \"my.pci.feature\"\n matchOn:\n - pciId:\n vendor: [\"15b3\"]\n device: [\"1014\", \"1017\"]\n - name: \"my.usb.feature\"\n matchOn:\n - usbId:\n vendor: [\"1d6b\"]\n device: [\"0003\"]\n serial: [\"090129a\"]\n - name: \"my.combined.feature\"\n matchOn:\n - loadedKMod : [\"vendor_kmod1\", \"vendor_kmod2\"]\n pciId:\n vendor: [\"15b3\"]\n device: [\"1014\", \"1017\"]\n - name: \"vendor.feature.node.kubernetes.io/accumulated.feature\"\n matchOn:\n - loadedKMod : [\"some_kmod1\", \"some_kmod2\"]\n - pciId:\n vendor: [\"15b3\"]\n device: [\"1014\", \"1017\"]\n - name: \"my.kernel.featureneedscpu\"\n matchOn:\n - kConfig: [\"KVM_INTEL\"]\n - cpuId: [\"VMX\"]\n - name: \"my.kernel.modulecompiler\"\n matchOn:\n - kConfig: [\"GCC_VERSION=100101\"]\n loadedKMod: [\"kmod1\"]\n - name: \"profile.node.kubernetes.io/my-datacenter\"\n value: \"datacenter-1\"\n matchOn:\n - nodename: [ \"node-datacenter1-rack.*-server.*\" ]\n```\n\n__In the example above:__\n\n- A node would contain the label:\n `feature.node.kubernetes.io/custom-my.kernel.feature=true` if the node has\n `kmod1` _AND_ `kmod2` kernel modules loaded.\n- A node would contain the label:\n `feature.node.kubernetes.io/custom-my.pci.feature=true` if the node contains\n a PCI device with a PCI vendor ID of `15b3` _AND_ PCI device ID of `1014` _OR_\n `1017`.\n- A node would contain the label:\n `feature.node.kubernetes.io/custom-my.usb.feature=true` if the node contains\n a USB device with a USB vendor ID of `1d6b` _AND_ USB device ID of `0003`.\n- A node would contain the label:\n `feature.node.kubernetes.io/custom-my.combined.feature=true` if\n `vendor_kmod1` _AND_ `vendor_kmod2` kernel modules are loaded __AND__ the node\n contains a PCI device\n with a PCI vendor ID of `15b3` _AND_ PCI device ID of `1014` _or_ `1017`.\n- A node would contain the label:\n `vendor.feature.node.kubernetes.io/accumulated.feature=true` if\n `some_kmod1` _AND_ `some_kmod2` kernel modules are loaded __OR__ the node\n contains a PCI device\n with a PCI vendor ID of `15b3` _AND_ PCI device ID of `1014` _OR_ `1017`.\n- A node would contain the label:\n `feature.node.kubernetes.io/custom-my.kernel.featureneedscpu=true` if\n `KVM_INTEL` kernel config is enabled __AND__ the node CPU supports `VMX`\n virtual machine extensions\n- A node would contain the label:\n `feature.node.kubernetes.io/custom-my.kernel.modulecompiler=true` if the\n in-tree `kmod1` kernel module is loaded __AND__ it's built with\n `GCC_VERSION=100101`.\n- A node would contain the label:\n `profile.node.kubernetes.io/my-datacenter=datacenter-1` if the node's name\n matches the `node-datacenter1-rack.*-server.*` pattern, e.g.\n `node-datacenter1-rack2-server42`\n\n#### Statically defined features\n\nSome feature labels which are common and generic are defined statically in the\n`custom` feature source. A user may add additional Matchers to these feature\nlabels by defining them in the `nfd-worker` configuration file.\n\n| Feature | Attribute | Description |\n| ------- | --------- | -----------|\n| rdma | capable | The node has an RDMA capable Network adapter |\n| rdma | enabled | The node has the needed RDMA modules loaded to run RDMA traffic |\n\n### IOMMU\n\nThe **iommu** feature source supports the following labels:\n\n| Feature name | Description |\n| :------------: | :---------------------------------------------------------: |\n| enabled | IOMMU is present and enabled in the kernel\n\n### Kernel\n\nThe **kernel** feature source supports the following labels:\n\n| Feature | Attribute | Description |\n| ------- | ------------------- | -------------------------------------------- |\n| config | &lt;option name&gt; | Kernel config option is enabled (set 'y' or 'm'). Default options are `NO_HZ`, `NO_HZ_IDLE`, `NO_HZ_FULL` and `PREEMPT`\n| selinux | enabled | Selinux is enabled on the node\n| version | full | Full kernel version as reported by `/proc/sys/kernel/osrelease` (e.g. '4.5.6-7-g123abcde')\n| | major | First component of the kernel version (e.g. '4')\n| | minor | Second component of the kernel version (e.g. '5')\n| | revision | Third component of the kernel version (e.g. '6')\n\nKernel config file to use, and, the set of config options to be detected are\nconfigurable. See [configuration](deployment-and-usage#worker-configuration)\nfor more information.\n\n### Memory\n\nThe **memory** feature source supports the following labels:\n\n| Feature | Attribute | Description |\n| ------- | --------- | ------------------------------------------------------ |\n| numa | | Multiple memory nodes i.e. NUMA architecture detected\n| nv | present | NVDIMM device(s) are present\n| nv | dax | NVDIMM region(s) configured in DAX mode are present\n\n### Network\n\nThe **network** feature source supports the following labels:\n\n| Feature | Attribute | Description |\n| ------- | ---------- | ----------------------------------------------------- |\n| sriov | capable | [Single Root Input/Output Virtualization][sriov] (SR-IOV) enabled Network Interface Card(s) present\n| | configured | SR-IOV virtual functions have been configured\n\n### PCI\n\nThe **pci** feature source supports the following labels:\n\n| Feature | Attribute | Description |\n| -------------------- | ------------- | ------------------------------------- |\n| &lt;device label&gt; | present | PCI device is detected\n| &lt;device label&gt; | sriov.capable | [Single Root Input/Output Virtualization][sriov] (SR-IOV) enabled PCI device present\n\n`<device label>` is composed of raw PCI IDs, separated by underscores. The set\nof fields used in `<device label>` is configurable, valid fields being `class`,\n`vendor`, `device`, `subsystem_vendor` and `subsystem_device`. Defaults are\n`class` and `vendor`. An example label using the default label fields:\n\n```plaintext\nfeature.node.kubernetes.io/pci-1200_8086.present=true\n```\n\nAlso the set of PCI device classes that the feature source detects is\nconfigurable. By default, device classes (0x)03, (0x)0b40 and (0x)12, i.e.\nGPUs, co-processors and accelerator cards are detected.\n\n### USB\n\nThe **usb** feature source supports the following labels:\n\n| Feature | Attribute | Description |\n| -------------------- | ------------- | ------------------------------------- |\n| &lt;device label&gt; | present | USB device is detected\n\n`<device label>` is composed of raw USB IDs, separated by underscores. The set\nof fields used in `<device label>` is configurable, valid fields being `class`,\n`vendor`, `device` and `serial`. Defaults are `class`, `vendor` and `device`.\nAn example label using the default label fields:\n\n```plaintext\nfeature.node.kubernetes.io/usb-fe_1a6e_089a.present=true\n```\n\nSee [configuration](deployment-and-usage#worker-configuration) for more\ninformation on NFD config.\n\n### Storage\n\nThe **storage** feature source supports the following labels:\n\n| Feature name | Description |\n| ------------------ | ------------------------------------------------------- |\n| nonrotationaldisk | Non-rotational disk, like SSD, is present in the node\n\n### System\n\nThe **system** feature source supports the following labels:\n\n| Feature | Attribute | Description |\n| ----------- | ---------------- | --------------------------------------------|\n| os_release | ID | Operating system identifier\n| | VERSION_ID | Operating system version identifier (e.g. '6.7')\n| | VERSION_ID.major | First component of the OS version id (e.g. '6')\n| | VERSION_ID.minor | Second component of the OS version id (e.g. '7')\n\n### Local -- user-specific features\n\nNFD has a special feature source named *local* which is designed for getting\nthe labels from user-specific feature detector. It provides a mechanism for\nusers to implement custom feature sources in a pluggable way, without modifying\nnfd source code or Docker images. The local feature source can be used to\nadvertise new user-specific features, and, for overriding labels created by the\nother feature sources.\n\nThe *local* feature source gets its labels by two different ways:\n\n- It tries to execute files found under\n `/etc/kubernetes/node-feature-discovery/source.d/` directory. The hook files\n must be executable and they are supposed to print all discovered features in\n `stdout`, one per line. With ELF binaries static linking is recommended as\n the selection of system libraries available in the NFD release image is very\n limited. Other runtimes currently supported by the NFD stock image are bash\n and perl.\n- It reads files found under\n `/etc/kubernetes/node-feature-discovery/features.d/` directory. The file\n content is expected to be similar to the hook output (described above).\n\n**NOTE:** The [minimal](deployment-and-usage#minimal) image variant only\nsupports running statically linked binaries.\n\nThese directories must be available inside the Docker image so Volumes and\nVolumeMounts must be used if standard NFD images are used. The given template\nfiles mount by default the `source.d` and the `features.d` directories\nrespectively from `/etc/kubernetes/node-feature-discovery/source.d/` and\n`/etc/kubernetes/node-feature-discovery/features.d/` from the host. You should\nupdate them to match your needs.\n\nIn both cases, the labels can be binary or non binary, using either `<name>` or\n`<name>=<value>` format.\n\nUnlike the other feature sources, the name of the file, instead of the name of\nthe feature source (that would be `local` in this case), is used as a prefix in\nthe label name, normally. However, if the `<name>` of the label starts with a\nslash (`/`) it is used as the label name as is, without any additional prefix.\nThis makes it possible for the user to fully control the feature label names,\ne.g. for overriding labels created by other feature sources.\n\nYou can also override the default namespace of your labels using this format:\n`<namespace>/<name>[=<value>]`. If using something else than\n`[<sub-ns>.]feature.node.kubernetes.io` or\n`[<sub-ns>.]profile.node.kubernetes.io`, you must whitelist your namespace\nusing the `-extra-label-ns` option on the master.\nIn this case, the name of the\nfile will not be added to the label name. For example, if you want to add the\nlabel `my.namespace.org/my-label=value`, your hook output or file must contains\n`my.namespace.org/my-label=value` and you must add\n`-extra-label-ns=my.namespace.org` on the master command line.\n\n`stderr` output of the hooks is propagated to NFD log so it can be used for\ndebugging and logging.\n\n#### Injecting labels from other pods\n\nOne use case for the hooks and/or feature files is detecting features in other\nPods outside NFD, e.g. in Kubernetes device plugins. It is possible to mount\nthe `source.d` and/or `features.d` directories common with the NFD Pod and\ndeploy the custom hooks/features there. NFD will periodically scan the\ndirectories and run any hooks and read any feature files it finds. The\ndefault deployments contain `hostPath` mounts for `sources.d` and `features.d`\ndirectories. By using the same mounts in the secondary Pod (e.g. device plugin)\nyou have created a shared area for delivering hooks and feature files to NFD.\n\n#### A hook example\n\nUser has a shell script\n`/etc/kubernetes/node-feature-discovery/source.d/my-source` which has the\nfollowing `stdout` output:\n\n```plaintext\nMY_FEATURE_1\nMY_FEATURE_2=myvalue\n/override_source-OVERRIDE_BOOL\n/override_source-OVERRIDE_VALUE=123\noverride.namespace/value=456\n```\n\nwhich, in turn, will translate into the following node labels:\n\n```plaintext\nfeature.node.kubernetes.io/my-source-MY_FEATURE_1=true\nfeature.node.kubernetes.io/my-source-MY_FEATURE_2=myvalue\nfeature.node.kubernetes.io/override_source-OVERRIDE_BOOL=true\nfeature.node.kubernetes.io/override_source-OVERRIDE_VALUE=123\noverride.namespace/value=456\n```\n\n#### A file example\n\nUser has a file `/etc/kubernetes/node-feature-discovery/features.d/my-source`\nwhich contains the following lines:\n\n```plaintext\nMY_FEATURE_1\nMY_FEATURE_2=myvalue\n/override_source-OVERRIDE_BOOL\n/override_source-OVERRIDE_VALUE=123\noverride.namespace/value=456\n```\n\nwhich, in turn, will translate into the following node labels:\n\n```plaintext\nfeature.node.kubernetes.io/my-source-MY_FEATURE_1=true\nfeature.node.kubernetes.io/my-source-MY_FEATURE_2=myvalue\nfeature.node.kubernetes.io/override_source-OVERRIDE_BOOL=true\nfeature.node.kubernetes.io/override_source-OVERRIDE_VALUE=123\noverride.namespace/value=456\n```\n\nNFD tries to run any regular files found from the hooks directory. Any\nadditional data files your hook might need (e.g. a configuration file) should\nbe placed in a separate directory in order to avoid NFD unnecessarily trying to\nexecute these. You can use a subdirectory under the hooks directory, for\nexample `/etc/kubernetes/node-feature-discovery/source.d/conf/`.\n\n**NOTE!** NFD will blindly run any executables placed/mounted in the hooks\ndirectory. It is the user's responsibility to review the hooks for e.g.\npossible security implications.\n\n**NOTE!** Be careful when creating and/or updating hook or feature files while\nNFD is running. In order to avoid race conditions you should write into a\ntemporary file (outside the `source.d` and `features.d` directories), and,\natomically create/update the original file by doing a filesystem move\noperation.\n\n## Extended resources\n\nThis feature is experimental and by no means a replacement for the usage of\ndevice plugins.\n\nLabels which have integer values, can be promoted to Kubernetes extended\nresources by listing them to the master `-resource-labels` command line flag.\nThese labels won't then show in the node label section, they will appear only\nas extended resources.\n\nAn example use-case for the extended resources could be based on a hook which\ncreates a label for the node SGX EPC memory section size. By giving the name of\nthat label in the `-resource-labels` flag, that value will then turn into an\nextended resource of the node, allowing PODs to request that resource and the\nKubernetes scheduler to schedule such PODs to only those nodes which have a\nsufficient capacity of said resource left.\n\nSimilar to labels, the default namespace `feature.node.kubernetes.io` is\nautomatically prefixed to the extended resource, if the promoted label doesn't\nhave a namespace.\n\nExample usage of the command line arguments, using a new namespace:\n`nfd-master -resource-labels=my_source-my.feature,sgx.some.ns/epc -extra-label-ns=sgx.some.ns`\n\nThe above would result in following extended resources provided that related\nlabels exist:\n\n```plaintext\n sgx.some.ns/epc: <label value>\n feature.node.kubernetes.io/my_source-my.feature: <label value>\n```\n\n<!-- Links -->\n[klauspost-cpuid]: https://github.com/klauspost/cpuid#x86-cpu-instructions\n[intel-rdt]: http://www.intel.com/content/www/us/en/architecture-and-technology/resource-director-technology.html\n[intel-pstate]: https://www.kernel.org/doc/Documentation/cpu-freq/intel-pstate.txt\n[intel-sst]: https://www.intel.com/content/www/us/en/architecture-and-technology/speed-select-technology-article.html\n[sriov]: http://www.intel.com/content/www/us/en/pci-express/pci-sig-sr-iov-primer-sr-iov-technology-paper.html\n","dir":"/get-started/","name":"features.md","path":"get-started/features.md","url":"/get-started/features.html"},{"title":"Get started","layout":"default","sort":1,"content":"<h1 id=\"node-feature-discovery\">Node Feature Discovery</h1>\n\n<p>Welcome to Node Feature Discovery – a Kubernetes add-on for detecting hardware\nfeatures and system configuration!</p>\n\n<p>Continue to:</p>\n\n<ul>\n <li>\n <p><strong><a href=\"/node-feature-discovery/master/get-started/introduction.html\">Introduction</a></strong> for more details on the\nproject.</p>\n </li>\n <li>\n <p><strong><a href=\"/node-feature-discovery/master/get-started/quick-start.html\">Quick start</a></strong> for quick step-by-step\ninstructions on how to get NFD running on your cluster.</p>\n </li>\n</ul>\n\n<h2 id=\"quick-start--the-short-short-version\">Quick-start – the short-short version</h2>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code><span class=\"nv\">$ </span>kubectl apply <span class=\"nt\">-k</span> https://github.com/kubernetes-sigs/node-feature-discovery/deployment/overlays/default?ref<span class=\"o\">=</span>master\n  namespace/node-feature-discovery created\n  serviceaccount/nfd-master created\n  clusterrole.rbac.authorization.k8s.io/nfd-master created\n  clusterrolebinding.rbac.authorization.k8s.io/nfd-master created\n  configmap/nfd-worker-conf created\n  service/nfd-master created\n  deployment.apps/nfd-master created\n  daemonset.apps/nfd-worker created\n\n<span class=\"nv\">$ </span>kubectl <span class=\"nt\">-n</span> node-feature-discovery get all\n  NAME                              READY   STATUS    RESTARTS   AGE\n  pod/nfd-master-555458dbbc-sxg6w   1/1     Running   0          56s\n  pod/nfd-worker-mjg9f              1/1     Running   0          17s\n...\n\n<span class=\"nv\">$ </span>kubectl get no <span class=\"nt\">-o</span> json | jq .items[].metadata.labels\n  <span class=\"o\">{</span>\n    <span class=\"s2\">\"beta.kubernetes.io/arch\"</span>: <span class=\"s2\">\"amd64\"</span>,\n    <span class=\"s2\">\"beta.kubernetes.io/os\"</span>: <span class=\"s2\">\"linux\"</span>,\n    <span class=\"s2\">\"feature.node.kubernetes.io/cpu-cpuid.ADX\"</span>: <span class=\"s2\">\"true\"</span>,\n    <span class=\"s2\">\"feature.node.kubernetes.io/cpu-cpuid.AESNI\"</span>: <span class=\"s2\">\"true\"</span>,\n...\n\n</code></pre>  </div></div>\n","dir":"/get-started/","name":"index.md","path":"get-started/index.md","url":"/get-started/"},{"title":"Developer guide","layout":"default","sort":1,"content":"<h1 class=\"no_toc\" id=\"developer-guide\">Developer guide</h1>\n\n<h2 class=\"no_toc text-delta\" id=\"table-of-contents\">Table of contents</h2>\n\n<ol id=\"markdown-toc\">\n <li><a href=\"#building-from-source\" id=\"markdown-toc-building-from-source\">Building from source</a> <ol>\n <li><a href=\"#download-the-source-code\" id=\"markdown-toc-download-the-source-code\">Download the source code</a></li>\n <li><a href=\"#docker-build\" id=\"markdown-toc-docker-build\">Docker build</a></li>\n <li><a href=\"#deployment\" id=\"markdown-toc-deployment\">Deployment</a></li>\n <li><a href=\"#building-locally\" id=\"markdown-toc-building-locally\">Building locally</a></li>\n <li><a href=\"#customizing-the-build\" id=\"markdown-toc-customizing-the-build\">Customizing the build</a></li>\n <li><a href=\"#testing\" id=\"markdown-toc-testing\">Testing</a></li>\n </ol>\n </li>\n <li><a href=\"#running-locally\" id=\"markdown-toc-running-locally\">Running locally</a> <ol>\n <li><a href=\"#nfd-master\" id=\"markdown-toc-nfd-master\">NFD-Master</a></li>\n <li><a href=\"#nfd-worker\" id=\"markdown-toc-nfd-worker\">NFD-Worker</a></li>\n <li><a href=\"#nfd-topology-updater\" id=\"markdown-toc-nfd-topology-updater\">NFD-Topology-Updater</a></li>\n </ol>\n </li>\n <li><a href=\"#documentation\" id=\"markdown-toc-documentation\">Documentation</a></li>\n</ol>\n\n<hr />\n\n<h2 id=\"building-from-source\">Building from source</h2>\n\n<h3 id=\"download-the-source-code\">Download the source code</h3>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>git clone https://github.com/kubernetes-sigs/node-feature-discovery\n<span class=\"nb\">cd </span>node-feature-discovery\n</code></pre>  </div></div>\n\n<h3 id=\"docker-build\">Docker build</h3>\n\n<h4 id=\"build-the-container-image\">Build the container image</h4>\n\n<p>See <a href=\"#customizing-the-build\">customizing the build</a> below for altering the\ncontainer image registry, for example.</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>make\n</code></pre>  </div></div>\n\n<h4 id=\"push-the-container-image\">Push the container image</h4>\n\n<p>Optional, this example with Docker.</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>docker push &lt;IMAGE_TAG&gt;\n</code></pre>  </div></div>\n\n<h4 id=\"change-the-job-spec-to-use-your-custom-image-optional\">Change the job spec to use your custom image (optional)</h4>\n\n<p>To use your published image from the step above instead of the\n<code class=\"language-plaintext highlighter-rouge\">k8s.gcr.io/nfd/node-feature-discovery</code> image, edit <code class=\"language-plaintext highlighter-rouge\">image</code>\nattribute in the spec template(s) to the new location\n(<code class=\"language-plaintext highlighter-rouge\">&lt;registry-name&gt;/&lt;image-name&gt;[:&lt;version&gt;]</code>).</p>\n\n<h3 id=\"deployment\">Deployment</h3>\n\n<p>The <code class=\"language-plaintext highlighter-rouge\">yamls</code> makefile generates a <code class=\"language-plaintext highlighter-rouge\">kustomization.yaml</code> matching your locally\nbuilt image and using the <code class=\"language-plaintext highlighter-rouge\">deploy/overlays/default</code> deployment. See\n<a href=\"#customizing-the-build\">build customization</a> below for configurability, e.g.\nchanging the deployment namespace.</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code><span class=\"nv\">K8S_NAMESPACE</span><span class=\"o\">=</span>my-ns make yamls\nkubectl apply <span class=\"nt\">-k</span> <span class=\"nb\">.</span>\n</code></pre>  </div></div>\n\n<p>You can use alternative deployment methods by modifying the auto-generated\nkustomization file. For example, deploying worker and master in the same pod by\npointing to <code class=\"language-plaintext highlighter-rouge\">deployment/overlays/default-combined</code>.</p>\n\n<h3 id=\"building-locally\">Building locally</h3>\n\n<p>You can also build the binaries locally</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>make build\n</code></pre>  </div></div>\n\n<p>This will compile binaries under <code class=\"language-plaintext highlighter-rouge\">bin/</code></p>\n\n<h3 id=\"customizing-the-build\">Customizing the build</h3>\n\n<p>There are several Makefile variables that control the build process and the\nname of the resulting container image. The following are targeted targeted for\nbuild customization and they can be specified via environment variables or\nmakefile overrides.</p>\n\n<table>\n <thead>\n <tr>\n <th>Variable</th>\n <th>Description</th>\n <th>Default value</th>\n </tr>\n </thead>\n <tbody>\n <tr>\n <td>HOSTMOUNT_PREFIX</td>\n <td>Prefix of system directories for feature discovery (local builds)</td>\n <td>/ (<em>local builds</em>) /host- (<em>container builds</em>)</td>\n </tr>\n <tr>\n <td>IMAGE_BUILD_CMD</td>\n <td>Command to build the image</td>\n <td>docker build</td>\n </tr>\n <tr>\n <td>IMAGE_BUILD_EXTRA_OPTS</td>\n <td>Extra options to pass to build command</td>\n <td><em>empty</em></td>\n </tr>\n <tr>\n <td>IMAGE_PUSH_CMD</td>\n <td>Command to push the image to remote registry</td>\n <td>docker push</td>\n </tr>\n <tr>\n <td>IMAGE_REGISTRY</td>\n <td>Container image registry to use</td>\n <td>k8s.gcr.io/nfd</td>\n </tr>\n <tr>\n <td>IMAGE_TAG_NAME</td>\n <td>Container image tag name</td>\n <td>&lt;nfd version&gt;</td>\n </tr>\n <tr>\n <td>IMAGE_EXTRA_TAG_NAMES</td>\n <td>Additional container image tag(s) to create when building image</td>\n <td><em>empty</em></td>\n </tr>\n <tr>\n <td>K8S_NAMESPACE</td>\n <td>nfd-master and nfd-worker namespace</td>\n <td>kube-system</td>\n </tr>\n <tr>\n <td>KUBECONFIG</td>\n <td>Kubeconfig for running e2e-tests</td>\n <td><em>empty</em></td>\n </tr>\n <tr>\n <td>E2E_TEST_CONFIG</td>\n <td>Parameterization file of e2e-tests (see <a href=\"https://github.com/kubernetes-sigs/node-feature-discovery/blob/master/test/e2e/e2e-test-config.exapmle.yaml\">example</a>)</td>\n <td><em>empty</em></td>\n </tr>\n <tr>\n <td>OPENSHIFT</td>\n <td>Non-empty value enables OpenShift specific support (currently only effective in e2e tests)</td>\n <td><em>empty</em></td>\n </tr>\n <tr>\n <td>BASE_IMAGE_FULL</td>\n <td>Container base image for target image full (–target full)</td>\n <td>debian:buster-slim</td>\n </tr>\n <tr>\n <td>BASE_IMAGE_MINIMAL</td>\n <td>Container base image for target image minimal (–target minimal)</td>\n <td>gcr.io/distroless/base</td>\n </tr>\n </tbody>\n</table>\n\n<p>For example, to use a custom registry:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>make <span class=\"nv\">IMAGE_REGISTRY</span><span class=\"o\">=</span>&lt;my custom registry uri&gt;\n</code></pre>  </div></div>\n\n<p>Or to specify a build tool different from Docker, It can be done in 2 ways:</p>\n\n<ol>\n <li>\n <p>via environment</p>\n\n <div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code> <span class=\"nv\">IMAGE_BUILD_CMD</span><span class=\"o\">=</span><span class=\"s2\">\"buildah bud\"</span> make\n</code></pre>  </div> </div>\n </li>\n <li>\n <p>by overriding the variable value</p>\n\n <div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code> make  <span class=\"nv\">IMAGE_BUILD_CMD</span><span class=\"o\">=</span><span class=\"s2\">\"buildah bud\"</span>\n</code></pre>  </div> </div>\n </li>\n</ol>\n\n<h3 id=\"testing\">Testing</h3>\n\n<p>Unit tests are automatically run as part of the container image build. You can\nalso run them manually in the source code tree by simply running:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>make <span class=\"nb\">test</span>\n</code></pre>  </div></div>\n\n<p>End-to-end tests are built on top of the e2e test framework of Kubernetes, and,\nthey required a cluster to run them on. For running the tests on your test\ncluster you need to specify the kubeconfig to be used:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>make e2e-test <span class=\"nv\">KUBECONFIG</span><span class=\"o\">=</span><span class=\"nv\">$HOME</span>/.kube/config\n</code></pre>  </div></div>\n\n<h2 id=\"running-locally\">Running locally</h2>\n\n<p>You can run NFD locally, either directly on your host OS or in containers for\ntesting and development purposes. This may be useful e.g. for checking\nfeatures-detection.</p>\n\n<h3 id=\"nfd-master\">NFD-Master</h3>\n\n<p>When running as a standalone container labeling is expected to fail because\nKubernetes API is not available. Thus, it is recommended to use <code class=\"language-plaintext highlighter-rouge\">-no-publish</code>\ncommand line flag. E.g.</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code><span class=\"nv\">$ </span><span class=\"nb\">export </span><span class=\"nv\">NFD_CONTAINER_IMAGE</span><span class=\"o\">=</span>gcr.io/k8s-staging-nfd/node-feature-discovery:master\n<span class=\"nv\">$ </span>docker run <span class=\"nt\">--rm</span> <span class=\"nt\">--name</span><span class=\"o\">=</span>nfd-test <span class=\"k\">${</span><span class=\"nv\">NFD_CONTAINER_IMAGE</span><span class=\"k\">}</span> nfd-master <span class=\"nt\">-no-publish</span>\n2019/02/01 14:48:21 Node Feature Discovery Master &lt;NFD_VERSION&gt;\n2019/02/01 14:48:21 gRPC server serving on port: 8080\n</code></pre>  </div></div>\n\n<h3 id=\"nfd-worker\">NFD-Worker</h3>\n\n<p>In order to run nfd-worker as a “stand-alone” container against your\nstandalone nfd-master you need to run them in the same network namespace:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code><span class=\"nv\">$ </span>docker run <span class=\"nt\">--rm</span> <span class=\"nt\">--network</span><span class=\"o\">=</span>container:nfd-test <span class=\"k\">${</span><span class=\"nv\">NFD_CONTAINER_IMAGE</span><span class=\"k\">}</span> nfd-worker\n2019/02/01 14:48:56 Node Feature Discovery Worker &lt;NFD_VERSION&gt;\n...\n</code></pre>  </div></div>\n\n<p>If you just want to try out feature discovery without connecting to nfd-master,\npass the <code class=\"language-plaintext highlighter-rouge\">-no-publish</code> flag to nfd-worker.</p>\n\n<p><strong>NOTE</strong> Some feature sources need certain directories and/or files from the\nhost mounted inside the NFD container. Thus, you need to provide Docker with the\ncorrect <code class=\"language-plaintext highlighter-rouge\">--volume</code> options in order for them to work correctly when run\nstand-alone directly with <code class=\"language-plaintext highlighter-rouge\">docker run</code>. See the\n<a href=\"https://github.com/kubernetes-sigs/node-feature-discovery/blob/master/deployment/components/common/worker-mounts.yaml\">default deployment</a>\nfor up-to-date information about the required volume mounts.</p>\n\n<h3 id=\"nfd-topology-updater\">NFD-Topology-Updater</h3>\n\n<p>In order to run nfd-topology-updater as a “stand-alone” container against your\nstandalone nfd-master you need to run them in the same network namespace:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code><span class=\"nv\">$ </span>docker run <span class=\"nt\">--rm</span> <span class=\"nt\">--network</span><span class=\"o\">=</span>container:nfd-test <span class=\"k\">${</span><span class=\"nv\">NFD_CONTAINER_IMAGE</span><span class=\"k\">}</span> nfd-topology-updater\n2019/02/01 14:48:56 Node Feature Discovery Topology Updater &lt;NFD_VERSION&gt;\n...\n</code></pre>  </div></div>\n\n<p>If you just want to try out feature discovery without connecting to nfd-master,\npass the <code class=\"language-plaintext highlighter-rouge\">-no-publish</code> flag to nfd-topology-updater.</p>\n\n<p>Command line flags of nfd-topology-updater:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code><span class=\"nv\">$ </span>docker run <span class=\"nt\">--rm</span> <span class=\"k\">${</span><span class=\"nv\">NFD_CONTAINER_IMAGE</span><span class=\"k\">}</span> nfd-topology-updater <span class=\"nt\">-help</span>\ndocker run <span class=\"nt\">--rm</span>  quay.io/swsehgal/node-feature-discovery:v0.10.0-devel-64-g93a0a9f-dirty nfd-topology-updater <span class=\"nt\">-help</span>\nUsage of nfd-topology-updater:\n  <span class=\"nt\">-add_dir_header</span>\n       If <span class=\"nb\">true</span>, adds the file directory to the header of the log messages\n  <span class=\"nt\">-alsologtostderr</span>\n       log to standard error as well as files\n  <span class=\"nt\">-ca-file</span> string\n       Root certificate <span class=\"k\">for </span>verifying connections\n  <span class=\"nt\">-cert-file</span> string\n       Certificate used <span class=\"k\">for </span>authenticating connections\n  <span class=\"nt\">-key-file</span> string\n       Private key matching <span class=\"nt\">-cert-file</span>\n  <span class=\"nt\">-kubeconfig</span> string\n       Kube config file.\n  <span class=\"nt\">-kubelet-config-file</span> string\n       Kubelet config file path. <span class=\"o\">(</span>default <span class=\"s2\">\"/host-var/lib/kubelet/config.yaml\"</span><span class=\"o\">)</span>\n  <span class=\"nt\">-log_backtrace_at</span> value\n       when logging hits line file:N, emit a stack trace\n  <span class=\"nt\">-log_dir</span> string\n       If non-empty, write log files <span class=\"k\">in </span>this directory\n  <span class=\"nt\">-log_file</span> string\n       If non-empty, use this log file\n  <span class=\"nt\">-log_file_max_size</span> uint\n       Defines the maximum size a log file can grow to. Unit is megabytes. If the value is 0, the maximum file size is unlimited. <span class=\"o\">(</span>default 1800<span class=\"o\">)</span>\n  <span class=\"nt\">-logtostderr</span>\n       log to standard error instead of files <span class=\"o\">(</span>default <span class=\"nb\">true</span><span class=\"o\">)</span>\n  <span class=\"nt\">-no-publish</span>\n       Do not publish discovered features to the cluster-local Kubernetes API server.\n  <span class=\"nt\">-one_output</span>\n       If <span class=\"nb\">true</span>, only write logs to their native severity level <span class=\"o\">(</span>vs also writing to each lower severity level<span class=\"o\">)</span>\n  <span class=\"nt\">-oneshot</span>\n       Update once and <span class=\"nb\">exit</span>\n  <span class=\"nt\">-podresources-socket</span> string\n       Pod Resource Socket path to use. <span class=\"o\">(</span>default <span class=\"s2\">\"/host-var/lib/kubelet/pod-resources/kubelet.sock\"</span><span class=\"o\">)</span>\n  <span class=\"nt\">-server</span> string\n       NFD server address to connecto to. <span class=\"o\">(</span>default <span class=\"s2\">\"localhost:8080\"</span><span class=\"o\">)</span>\n  <span class=\"nt\">-server-name-override</span> string\n       Hostname expected from server certificate, useful <span class=\"k\">in </span>testing\n  <span class=\"nt\">-skip_headers</span>\n       If <span class=\"nb\">true</span>, avoid header prefixes <span class=\"k\">in </span>the log messages\n  <span class=\"nt\">-skip_log_headers</span>\n       If <span class=\"nb\">true</span>, avoid headers when opening log files\n  <span class=\"nt\">-sleep-interval</span> duration\n       Time to <span class=\"nb\">sleep </span>between CR updates. Non-positive value implies no CR updatation <span class=\"o\">(</span>i.e. infinite <span class=\"nb\">sleep</span><span class=\"o\">)</span><span class=\"nb\">.</span> <span class=\"o\">[</span>Default: 60s] <span class=\"o\">(</span>default 1m0s<span class=\"o\">)</span>\n  <span class=\"nt\">-stderrthreshold</span> value\n       logs at or above this threshold go to stderr <span class=\"o\">(</span>default 2<span class=\"o\">)</span>\n  <span class=\"nt\">-v</span> value\n       number <span class=\"k\">for </span>the log level verbosity\n  <span class=\"nt\">-version</span>\n       Print version and exit.\n  <span class=\"nt\">-vmodule</span> value\n       comma-separated list of <span class=\"nv\">pattern</span><span class=\"o\">=</span>N settings <span class=\"k\">for </span>file-filtered logging\n  <span class=\"nt\">-watch-namespace</span> string\n       Namespace to watch pods <span class=\"o\">(</span><span class=\"k\">for </span>testing/debugging purpose<span class=\"o\">)</span><span class=\"nb\">.</span> Use <span class=\"k\">*</span> <span class=\"k\">for </span>all namespaces. <span class=\"o\">(</span>default <span class=\"s2\">\"*\"</span><span class=\"o\">)</span>\n</code></pre>  </div></div>\n\n<p>NOTE:</p>\n\n<p>NFD topology updater needs certain directories and/or files from the\nhost mounted inside the NFD container. Thus, you need to provide Docker with the\ncorrect <code class=\"language-plaintext highlighter-rouge\">--volume</code> options in order for them to work correctly when run\nstand-alone directly with <code class=\"language-plaintext highlighter-rouge\">docker run</code>. See the\n<a href=\"https://github.com/kubernetes-sigs/node-feature-discovery/blob/master/deployment/components/topology-updater/topologyupdater-mounts.yaml\">template spec</a>\nfor up-to-date information about the required volume mounts.</p>\n\n<p><a href=\"https://kubernetes.io/docs/concepts/extend-kubernetes/compute-storage-net/device-plugins/#monitoring-device-plugin-resources\">PodResource API</a> is a prerequisite for nfd-topology-updater.\nPreceding Kubernetes v1.23, the <code class=\"language-plaintext highlighter-rouge\">kubelet</code> must be started with the following flag:\n<code class=\"language-plaintext highlighter-rouge\">--feature-gates=KubeletPodResourcesGetAllocatable=true</code>.\nStarting Kubernetes v1.23, the <code class=\"language-plaintext highlighter-rouge\">GetAllocatableResources</code> is enabled by default\nthrough <code class=\"language-plaintext highlighter-rouge\">KubeletPodResourcesGetAllocatable</code> <a href=\"https://kubernetes.io/docs/reference/command-line-tools-reference/feature-gates\">feature gate</a>.</p>\n\n<h2 id=\"documentation\">Documentation</h2>\n\n<p>All documentation resides under the\n<a href=\"https://github.com/kubernetes-sigs/node-feature-discovery/tree/master/docs\">docs</a>\ndirectory in the source tree. It is designed to be served as a html site by\n<a href=\"https://pages.github.com/\">GitHub Pages</a>.</p>\n\n<p>Building the documentation is containerized in order to fix the build\nenvironment. The recommended way for developing documentation is to run:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>make site-serve\n</code></pre>  </div></div>\n\n<p>This will build the documentation in a container and serve it under\n<a href=\"http://localhost:4000/\">localhost:4000/</a> making it easy to verify the results.\nAny changes made to the <code class=\"language-plaintext highlighter-rouge\">docs/</code> will automatically re-trigger a rebuild and are\nreflected in the served content and can be inspected with a simple browser\nrefresh.</p>\n\n<p>In order to just build the html documentation run:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>make site-build\n</code></pre>  </div></div>\n\n<p>This will generate html documentation under <code class=\"language-plaintext highlighter-rouge\">docs/_site/</code>.</p>\n\n<!-- Links -->\n","dir":"/advanced/","name":"developer-guide.md","path":"advanced/developer-guide.md","url":"/advanced/developer-guide.html"},{"title":"Introduction","layout":"default","sort":1,"content":"<h1 class=\"no_toc\" id=\"introduction\">Introduction</h1>\n\n<h2 class=\"no_toc text-delta\" id=\"table-of-contents\">Table of contents</h2>\n\n<ol id=\"markdown-toc\">\n <li><a href=\"#nfd-master\" id=\"markdown-toc-nfd-master\">NFD-Master</a></li>\n <li><a href=\"#nfd-worker\" id=\"markdown-toc-nfd-worker\">NFD-Worker</a></li>\n <li><a href=\"#nfd-topology-updater\" id=\"markdown-toc-nfd-topology-updater\">NFD-Topology-Updater</a></li>\n <li><a href=\"#feature-discovery\" id=\"markdown-toc-feature-discovery\">Feature Discovery</a></li>\n <li><a href=\"#node-annotations\" id=\"markdown-toc-node-annotations\">Node annotations</a></li>\n <li><a href=\"#noderesourcetopology-cr\" id=\"markdown-toc-noderesourcetopology-cr\">NodeResourceTopology CR</a></li>\n</ol>\n\n<hr />\n\n<p>This software enables node feature discovery for Kubernetes. It detects\nhardware features available on each node in a Kubernetes cluster, and\nadvertises those features using node labels.</p>\n\n<p>NFD consists of three software components:</p>\n\n<ol>\n <li>nfd-master</li>\n <li>nfd-worker</li>\n <li>nfd-topology-updater</li>\n</ol>\n\n<h2 id=\"nfd-master\">NFD-Master</h2>\n\n<p>NFD-Master is the daemon responsible for communication towards the Kubernetes\nAPI. That is, it receives labeling requests from the worker and modifies node\nobjects accordingly.</p>\n\n<h2 id=\"nfd-worker\">NFD-Worker</h2>\n\n<p>NFD-Worker is a daemon responsible for feature detection. It then communicates\nthe information to nfd-master which does the actual node labeling. One\ninstance of nfd-worker is supposed to be running on each node of the cluster,</p>\n\n<h2 id=\"nfd-topology-updater\">NFD-Topology-Updater</h2>\n\n<p>NFD-Topology-Updater is a daemon responsible for examining allocated\nresources on a worker node to account for resources available to be allocated\nto new pod on a per-zone basis (where a zone can be a NUMA node). It then\ncommunicates the information to nfd-master which does the\n<a href=\"#noderesourcetopology-cr\">NodeResourceTopology CR</a> creation corresponding\nto all the nodes in the cluster. One instance of nfd-topology-updater is\nsupposed to be running on each node of the cluster.</p>\n\n<h2 id=\"feature-discovery\">Feature Discovery</h2>\n\n<p>Feature discovery is divided into domain-specific feature sources:</p>\n\n<ul>\n <li>CPU</li>\n <li>IOMMU</li>\n <li>Kernel</li>\n <li>Memory</li>\n <li>Network</li>\n <li>PCI</li>\n <li>Storage</li>\n <li>System</li>\n <li>USB</li>\n <li>Custom (rule-based custom features)</li>\n <li>Local (hooks for user-specific features)</li>\n</ul>\n\n<p>Each feature source is responsible for detecting a set of features which. in\nturn, are turned into node feature labels. Feature labels are prefixed with\n<code class=\"language-plaintext highlighter-rouge\">feature.node.kubernetes.io/</code> and also contain the name of the feature source.\nNon-standard user-specific feature labels can be created with the local and\ncustom feature sources.</p>\n\n<p>An overview of the default feature labels:</p>\n\n<div class=\"language-json highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code><span class=\"p\">{</span><span class=\"w\">\n  </span><span class=\"nl\">\"feature.node.kubernetes.io/cpu-&lt;feature-name&gt;\"</span><span class=\"p\">:</span><span class=\"w\"> </span><span class=\"s2\">\"true\"</span><span class=\"p\">,</span><span class=\"w\">\n  </span><span class=\"nl\">\"feature.node.kubernetes.io/custom-&lt;feature-name&gt;\"</span><span class=\"p\">:</span><span class=\"w\"> </span><span class=\"s2\">\"true\"</span><span class=\"p\">,</span><span class=\"w\">\n  </span><span class=\"nl\">\"feature.node.kubernetes.io/iommu-&lt;feature-name&gt;\"</span><span class=\"p\">:</span><span class=\"w\"> </span><span class=\"s2\">\"true\"</span><span class=\"p\">,</span><span class=\"w\">\n  </span><span class=\"nl\">\"feature.node.kubernetes.io/kernel-&lt;feature name&gt;\"</span><span class=\"p\">:</span><span class=\"w\"> </span><span class=\"s2\">\"&lt;feature value&gt;\"</span><span class=\"p\">,</span><span class=\"w\">\n  </span><span class=\"nl\">\"feature.node.kubernetes.io/memory-&lt;feature-name&gt;\"</span><span class=\"p\">:</span><span class=\"w\"> </span><span class=\"s2\">\"true\"</span><span class=\"p\">,</span><span class=\"w\">\n  </span><span class=\"nl\">\"feature.node.kubernetes.io/network-&lt;feature-name&gt;\"</span><span class=\"p\">:</span><span class=\"w\"> </span><span class=\"s2\">\"true\"</span><span class=\"p\">,</span><span class=\"w\">\n  </span><span class=\"nl\">\"feature.node.kubernetes.io/pci-&lt;device label&gt;.present\"</span><span class=\"p\">:</span><span class=\"w\"> </span><span class=\"s2\">\"true\"</span><span class=\"p\">,</span><span class=\"w\">\n  </span><span class=\"nl\">\"feature.node.kubernetes.io/storage-&lt;feature-name&gt;\"</span><span class=\"p\">:</span><span class=\"w\"> </span><span class=\"s2\">\"true\"</span><span class=\"p\">,</span><span class=\"w\">\n  </span><span class=\"nl\">\"feature.node.kubernetes.io/system-&lt;feature name&gt;\"</span><span class=\"p\">:</span><span class=\"w\"> </span><span class=\"s2\">\"&lt;feature value&gt;\"</span><span class=\"p\">,</span><span class=\"w\">\n  </span><span class=\"nl\">\"feature.node.kubernetes.io/usb-&lt;device label&gt;.present\"</span><span class=\"p\">:</span><span class=\"w\"> </span><span class=\"s2\">\"&lt;feature value&gt;\"</span><span class=\"p\">,</span><span class=\"w\">\n  </span><span class=\"nl\">\"feature.node.kubernetes.io/&lt;file name&gt;-&lt;feature name&gt;\"</span><span class=\"p\">:</span><span class=\"w\"> </span><span class=\"s2\">\"&lt;feature value&gt;\"</span><span class=\"w\">\n</span><span class=\"p\">}</span><span class=\"w\">\n</span></code></pre>  </div></div>\n\n<h2 id=\"node-annotations\">Node annotations</h2>\n\n<p>NFD also annotates nodes it is running on:</p>\n\n<table>\n <thead>\n <tr>\n <th>Annotation</th>\n <th>Description</th>\n </tr>\n </thead>\n <tbody>\n <tr>\n <td>[&lt;instance&gt;.]nfd.node.kubernetes.io/master.version</td>\n <td>Version of the nfd-master instance running on the node. Informative use only.</td>\n </tr>\n <tr>\n <td>[&lt;instance&gt;.]nfd.node.kubernetes.io/worker.version</td>\n <td>Version of the nfd-worker instance running on the node. Informative use only.</td>\n </tr>\n <tr>\n <td>[&lt;instance&gt;.]nfd.node.kubernetes.io/feature-labels</td>\n <td>Comma-separated list of node labels managed by NFD. NFD uses this internally so must not be edited by users.</td>\n </tr>\n <tr>\n <td>[&lt;instance&gt;.]nfd.node.kubernetes.io/extended-resources</td>\n <td>Comma-separated list of node extended resources managed by NFD. NFD uses this internally so must not be edited by users.</td>\n </tr>\n </tbody>\n</table>\n\n<p>NOTE: the <a href=\"/node-feature-discovery/master/advanced/master-commandline-reference.html#instance\"><code class=\"language-plaintext highlighter-rouge\">-instance</code></a>\ncommand line flag affects the annotation names</p>\n\n<p>Unapplicable annotations are not created, i.e. for example master.version is\nonly created on nodes running nfd-master.</p>\n\n<h2 id=\"noderesourcetopology-cr\">NodeResourceTopology CR</h2>\n\n<p>When run with NFD-Topology-Updater, NFD creates CR instances corresponding to\nnode resource hardware topology such as:</p>\n\n<div class=\"language-yaml highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code><span class=\"na\">apiVersion</span><span class=\"pi\">:</span> <span class=\"s\">topology.node.k8s.io/v1alpha1</span>\n<span class=\"na\">kind</span><span class=\"pi\">:</span> <span class=\"s\">NodeResourceTopology</span>\n<span class=\"na\">metadata</span><span class=\"pi\">:</span>\n  <span class=\"na\">name</span><span class=\"pi\">:</span> <span class=\"s\">node1</span>\n<span class=\"na\">topologyPolicies</span><span class=\"pi\">:</span> <span class=\"pi\">[</span><span class=\"s2\">\"</span><span class=\"s\">SingleNUMANodeContainerLevel\"</span><span class=\"pi\">]</span>\n<span class=\"na\">zones</span><span class=\"pi\">:</span>\n  <span class=\"pi\">-</span> <span class=\"na\">name</span><span class=\"pi\">:</span> <span class=\"s\">node-0</span>\n    <span class=\"na\">type</span><span class=\"pi\">:</span> <span class=\"s\">Node</span>\n    <span class=\"na\">resources</span><span class=\"pi\">:</span>\n      <span class=\"pi\">-</span> <span class=\"na\">name</span><span class=\"pi\">:</span> <span class=\"s\">cpu</span>\n        <span class=\"na\">capacity</span><span class=\"pi\">:</span> <span class=\"m\">20</span>\n        <span class=\"na\">allocatable</span><span class=\"pi\">:</span> <span class=\"m\">16</span>\n        <span class=\"na\">available</span><span class=\"pi\">:</span> <span class=\"m\">10</span>\n      <span class=\"pi\">-</span> <span class=\"na\">name</span><span class=\"pi\">:</span> <span class=\"s\">vendor/nic1</span>\n        <span class=\"na\">capacity</span><span class=\"pi\">:</span> <span class=\"m\">3</span>\n        <span class=\"na\">allocatable</span><span class=\"pi\">:</span> <span class=\"m\">3</span>\n        <span class=\"na\">available</span><span class=\"pi\">:</span> <span class=\"m\">3</span>\n  <span class=\"pi\">-</span> <span class=\"na\">name</span><span class=\"pi\">:</span> <span class=\"s\">node-1</span>\n    <span class=\"na\">type</span><span class=\"pi\">:</span> <span class=\"s\">Node</span>\n    <span class=\"na\">resources</span><span class=\"pi\">:</span>\n      <span class=\"pi\">-</span> <span class=\"na\">name</span><span class=\"pi\">:</span> <span class=\"s\">cpu</span>\n        <span class=\"na\">capacity</span><span class=\"pi\">:</span> <span class=\"m\">30</span>\n        <span class=\"na\">allocatable</span><span class=\"pi\">:</span> <span class=\"m\">30</span>\n        <span class=\"na\">available</span><span class=\"pi\">:</span> <span class=\"m\">15</span>\n      <span class=\"pi\">-</span> <span class=\"na\">name</span><span class=\"pi\">:</span> <span class=\"s\">vendor/nic2</span>\n        <span class=\"na\">capacity</span><span class=\"pi\">:</span> <span class=\"m\">6</span>\n        <span class=\"na\">allocatable</span><span class=\"pi\">:</span> <span class=\"m\">6</span>\n        <span class=\"na\">available</span><span class=\"pi\">:</span> <span class=\"m\">6</span>\n  <span class=\"pi\">-</span> <span class=\"na\">name</span><span class=\"pi\">:</span> <span class=\"s\">node-2</span>\n    <span class=\"na\">type</span><span class=\"pi\">:</span> <span class=\"s\">Node</span>\n    <span class=\"na\">resources</span><span class=\"pi\">:</span>\n      <span class=\"pi\">-</span> <span class=\"na\">name</span><span class=\"pi\">:</span> <span class=\"s\">cpu</span>\n        <span class=\"na\">capacity</span><span class=\"pi\">:</span> <span class=\"m\">30</span>\n        <span class=\"na\">allocatable</span><span class=\"pi\">:</span> <span class=\"m\">30</span>\n        <span class=\"na\">available</span><span class=\"pi\">:</span> <span class=\"m\">15</span>\n      <span class=\"pi\">-</span> <span class=\"na\">name</span><span class=\"pi\">:</span> <span class=\"s\">vendor/nic1</span>\n        <span class=\"na\">capacity</span><span class=\"pi\">:</span> <span class=\"m\">3</span>\n        <span class=\"na\">allocatable</span><span class=\"pi\">:</span> <span class=\"m\">3</span>\n        <span class=\"na\">available</span><span class=\"pi\">:</span> <span class=\"m\">3</span>\n</code></pre>  </div></div>\n","dir":"/get-started/","name":"introduction.md","path":"get-started/introduction.md","url":"/get-started/introduction.html"},{"title":"Advanced","layout":"default","sort":2,"content":"<h1 id=\"advanced\">Advanced</h1>\n\n<p>Advanced topics and reference.</p>\n","dir":"/advanced/","name":"index.md","path":"advanced/index.md","url":"/advanced/"},{"title":"Master cmdline reference","layout":"default","sort":2,"content":"<h1 class=\"no_toc\" id=\"commandline-flags-of-nfd-master\">Commandline flags of nfd-master</h1>\n\n<h2 class=\"no_toc text-delta\" id=\"table-of-contents\">Table of contents</h2>\n\n<ol id=\"markdown-toc\">\n <li><a href=\"#-h--help\" id=\"markdown-toc--h--help\">-h, -help</a></li>\n <li><a href=\"#-version\" id=\"markdown-toc--version\">-version</a></li>\n <li><a href=\"#-prune\" id=\"markdown-toc--prune\">-prune</a></li>\n <li><a href=\"#-port\" id=\"markdown-toc--port\">-port</a></li>\n <li><a href=\"#-instance\" id=\"markdown-toc--instance\">-instance</a></li>\n <li><a href=\"#-ca-file\" id=\"markdown-toc--ca-file\">-ca-file</a></li>\n <li><a href=\"#-cert-file\" id=\"markdown-toc--cert-file\">-cert-file</a></li>\n <li><a href=\"#-key-file\" id=\"markdown-toc--key-file\">-key-file</a></li>\n <li><a href=\"#-verify-node-name\" id=\"markdown-toc--verify-node-name\">-verify-node-name</a></li>\n <li><a href=\"#-no-publish\" id=\"markdown-toc--no-publish\">-no-publish</a></li>\n <li><a href=\"#-featurerules-controller\" id=\"markdown-toc--featurerules-controller\">-featurerules-controller</a></li>\n <li><a href=\"#-label-whitelist\" id=\"markdown-toc--label-whitelist\">-label-whitelist</a></li>\n <li><a href=\"#-extra-label-ns\" id=\"markdown-toc--extra-label-ns\">-extra-label-ns</a></li>\n <li><a href=\"#-resource-labels\" id=\"markdown-toc--resource-labels\">-resource-labels</a></li>\n <li><a href=\"#logging\" id=\"markdown-toc-logging\">Logging</a></li>\n</ol>\n\n<hr />\n\n<p>To quickly view available command line flags execute <code class=\"language-plaintext highlighter-rouge\">nfd-master -help</code>.\nIn a docker container:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>docker run gcr.io/k8s-staging-nfd/node-feature-discovery:master nfd-master <span class=\"nt\">-help</span>\n</code></pre>  </div></div>\n\n<h3 id=\"-h--help\">-h, -help</h3>\n\n<p>Print usage and exit.</p>\n\n<h3 id=\"-version\">-version</h3>\n\n<p>Print version and exit.</p>\n\n<h3 id=\"-prune\">-prune</h3>\n\n<p>The <code class=\"language-plaintext highlighter-rouge\">-prune</code> flag is a sub-command like option for cleaning up the cluster. It\ncauses nfd-master to remove all NFD related labels, annotations and extended\nresources from all Node objects of the cluster and exit.</p>\n\n<h3 id=\"-port\">-port</h3>\n\n<p>The <code class=\"language-plaintext highlighter-rouge\">-port</code> flag specifies the TCP port that nfd-master listens for incoming requests.</p>\n\n<p>Default: 8080</p>\n\n<p>Example:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>nfd-master <span class=\"nt\">-port</span><span class=\"o\">=</span>443\n</code></pre>  </div></div>\n\n<h3 id=\"-instance\">-instance</h3>\n\n<p>The <code class=\"language-plaintext highlighter-rouge\">-instance</code> flag makes it possible to run multiple NFD deployments in\nparallel. In practice, it separates the node annotations between deployments so\nthat each of them can store metadata independently. The instance name must\nstart and end with an alphanumeric character and may only contain alphanumeric\ncharacters, <code class=\"language-plaintext highlighter-rouge\">-</code>, <code class=\"language-plaintext highlighter-rouge\">_</code> or <code class=\"language-plaintext highlighter-rouge\">.</code>.</p>\n\n<p>Default: <em>empty</em></p>\n\n<p>Example:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>nfd-master <span class=\"nt\">-instance</span><span class=\"o\">=</span>network\n</code></pre>  </div></div>\n\n<h3 id=\"-ca-file\">-ca-file</h3>\n\n<p>The <code class=\"language-plaintext highlighter-rouge\">-ca-file</code> is one of the three flags (together with <code class=\"language-plaintext highlighter-rouge\">-cert-file</code> and\n<code class=\"language-plaintext highlighter-rouge\">-key-file</code>) controlling master-worker mutual TLS authentication on the\nnfd-master side. This flag specifies the TLS root certificate that is used for\nauthenticating incoming connections. NFD-Worker side needs to have matching key\nand cert files configured in order for the incoming requests to be accepted.</p>\n\n<p>Default: <em>empty</em></p>\n\n<p>Note: Must be specified together with <code class=\"language-plaintext highlighter-rouge\">-cert-file</code> and <code class=\"language-plaintext highlighter-rouge\">-key-file</code></p>\n\n<p>Example:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>nfd-master <span class=\"nt\">-ca-file</span><span class=\"o\">=</span>/opt/nfd/ca.crt <span class=\"nt\">-cert-file</span><span class=\"o\">=</span>/opt/nfd/master.crt <span class=\"nt\">-key-file</span><span class=\"o\">=</span>/opt/nfd/master.key\n</code></pre>  </div></div>\n\n<h3 id=\"-cert-file\">-cert-file</h3>\n\n<p>The <code class=\"language-plaintext highlighter-rouge\">-cert-file</code> is one of the three flags (together with <code class=\"language-plaintext highlighter-rouge\">-ca-file</code> and\n<code class=\"language-plaintext highlighter-rouge\">-key-file</code>) controlling master-worker mutual TLS authentication on the\nnfd-master side. This flag specifies the TLS certificate presented for\nauthenticating outgoing traffic towards nfd-worker.</p>\n\n<p>Default: <em>empty</em></p>\n\n<p>Note: Must be specified together with <code class=\"language-plaintext highlighter-rouge\">-ca-file</code> and <code class=\"language-plaintext highlighter-rouge\">-key-file</code></p>\n\n<p>Example:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>nfd-master <span class=\"nt\">-cert-file</span><span class=\"o\">=</span>/opt/nfd/master.crt <span class=\"nt\">-key-file</span><span class=\"o\">=</span>/opt/nfd/master.key <span class=\"nt\">-ca-file</span><span class=\"o\">=</span>/opt/nfd/ca.crt\n</code></pre>  </div></div>\n\n<h3 id=\"-key-file\">-key-file</h3>\n\n<p>The <code class=\"language-plaintext highlighter-rouge\">-key-file</code> is one of the three flags (together with <code class=\"language-plaintext highlighter-rouge\">-ca-file</code> and\n<code class=\"language-plaintext highlighter-rouge\">-cert-file</code>) controlling master-worker mutual TLS authentication on the\nnfd-master side. This flag specifies the private key corresponding the given\ncertificate file (<code class=\"language-plaintext highlighter-rouge\">-cert-file</code>) that is used for authenticating outgoing\ntraffic.</p>\n\n<p>Default: <em>empty</em></p>\n\n<p>Note: Must be specified together with <code class=\"language-plaintext highlighter-rouge\">-cert-file</code> and <code class=\"language-plaintext highlighter-rouge\">-ca-file</code></p>\n\n<p>Example:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>nfd-master <span class=\"nt\">-key-file</span><span class=\"o\">=</span>/opt/nfd/master.key <span class=\"nt\">-cert-file</span><span class=\"o\">=</span>/opt/nfd/master.crt <span class=\"nt\">-ca-file</span><span class=\"o\">=</span>/opt/nfd/ca.crt\n</code></pre>  </div></div>\n\n<h3 id=\"-verify-node-name\">-verify-node-name</h3>\n\n<p>The <code class=\"language-plaintext highlighter-rouge\">-verify-node-name</code> flag controls the NodeName based authorization of\nincoming requests and only has effect when mTLS authentication has been enabled\n(with <code class=\"language-plaintext highlighter-rouge\">-ca-file</code>, <code class=\"language-plaintext highlighter-rouge\">-cert-file</code> and <code class=\"language-plaintext highlighter-rouge\">-key-file</code>). If enabled, the worker node\nname of the incoming must match with the CN or a SAN in its TLS certificate. Thus,\nworkers are only able to label the node they are running on (or the node whose\ncertificate they present).</p>\n\n<p>Node Name based authorization is disabled by default.</p>\n\n<p>Default: <em>false</em></p>\n\n<p>Example:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>nfd-master <span class=\"nt\">-verify-node-name</span> <span class=\"nt\">-ca-file</span><span class=\"o\">=</span>/opt/nfd/ca.crt <span class=\"se\">\\</span>\n    <span class=\"nt\">-cert-file</span><span class=\"o\">=</span>/opt/nfd/master.crt <span class=\"nt\">-key-file</span><span class=\"o\">=</span>/opt/nfd/master.key\n</code></pre>  </div></div>\n\n<h3 id=\"-no-publish\">-no-publish</h3>\n\n<p>The <code class=\"language-plaintext highlighter-rouge\">-no-publish</code> flag disables updates to the Node objects in the Kubernetes\nAPI server, making a “dry-run” flag for nfd-master. No Labels, Annotations or\nExtendedResources of nodes are updated.</p>\n\n<p>Default: <em>false</em></p>\n\n<p>Example:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>nfd-master <span class=\"nt\">-no-publish</span>\n</code></pre>  </div></div>\n\n<h3 id=\"-featurerules-controller\">-featurerules-controller</h3>\n\n<p>The <code class=\"language-plaintext highlighter-rouge\">-featurerules-controller</code> flag controlers the processing of\nNodeFeatureRule objects, effectively enabling/disabling labels from these\ncustom labeling rules.</p>\n\n<p>Default: <em>true</em></p>\n\n<p>Example:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>nfd-master <span class=\"nt\">-featurerules-controller</span><span class=\"o\">=</span><span class=\"nb\">false</span>\n</code></pre>  </div></div>\n\n<h3 id=\"-label-whitelist\">-label-whitelist</h3>\n\n<p>The <code class=\"language-plaintext highlighter-rouge\">-label-whitelist</code> specifies a regular expression for filtering feature\nlabels based on their name. Each label must match against the given reqular\nexpression in order to be published.</p>\n\n<p>Note: The regular expression is only matches against the “basename” part of the\nlabel, i.e. to the part of the name after ‘/’. The label namespace is omitted.</p>\n\n<p>Default: <em>empty</em></p>\n\n<p>Example:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>nfd-master <span class=\"nt\">-label-whitelist</span><span class=\"o\">=</span><span class=\"s1\">'.*cpuid\\.'</span>\n</code></pre>  </div></div>\n\n<h3 id=\"-extra-label-ns\">-extra-label-ns</h3>\n\n<p>The <code class=\"language-plaintext highlighter-rouge\">-extra-label-ns</code> flag specifies a comma-separated list of allowed feature\nlabel namespaces. By default, nfd-master only allows creating labels in the\ndefault <code class=\"language-plaintext highlighter-rouge\">feature.node.kubernetes.io</code> and <code class=\"language-plaintext highlighter-rouge\">profile.node.kubernetes.io</code> label\nnamespaces and their sub-namespaces (e.g. <code class=\"language-plaintext highlighter-rouge\">vendor.feature.node.kubernetes.io</code>\nand <code class=\"language-plaintext highlighter-rouge\">sub.ns.profile.node.kubernetes.io</code>). This option can be used to allow\nother vendor or application specific namespaces for custom labels from the\nlocal and custom feature sources.</p>\n\n<p>The same namespace control and this flag applies Extended Resources (created\nwith <code class=\"language-plaintext highlighter-rouge\">-resource-labels</code>), too.</p>\n\n<p>Default: <em>empty</em></p>\n\n<p>Example:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>nfd-master <span class=\"nt\">-extra-label-ns</span><span class=\"o\">=</span>vendor-1.com,vendor-2.io\n</code></pre>  </div></div>\n\n<h3 id=\"-resource-labels\">-resource-labels</h3>\n\n<p>The <code class=\"language-plaintext highlighter-rouge\">-resource-labels</code> flag specifies a comma-separated list of features to be\nadvertised as extended resources instead of labels. Features that have integer\nvalues can be published as Extended Resources by listing them in this flag.</p>\n\n<p>Default: <em>empty</em></p>\n\n<p>Example:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>nfd-master <span class=\"nt\">-resource-labels</span><span class=\"o\">=</span>vendor-1.com/feature-1,vendor-2.io/feature-2\n</code></pre>  </div></div>\n\n<h3 id=\"logging\">Logging</h3>\n\n<p>The following logging-related flags are inherited from the\n<a href=\"https://pkg.go.dev/k8s.io/klog/v2\">klog</a> package.</p>\n\n<h4 id=\"-add_dir_header\">-add_dir_header</h4>\n\n<p>If true, adds the file directory to the header of the log messages.</p>\n\n<p>Default: false</p>\n\n<h4 id=\"-alsologtostderr\">-alsologtostderr</h4>\n\n<p>Log to standard error as well as files.</p>\n\n<p>Default: false</p>\n\n<h4 id=\"-log_backtrace_at\">-log_backtrace_at</h4>\n\n<p>When logging hits line file:N, emit a stack trace.</p>\n\n<p>Default: <em>empty</em></p>\n\n<h4 id=\"-log_dir\">-log_dir</h4>\n\n<p>If non-empty, write log files in this directory.</p>\n\n<p>Default: <em>empty</em></p>\n\n<h4 id=\"-log_file\">-log_file</h4>\n\n<p>If non-empty, use this log file.</p>\n\n<p>Default: <em>empty</em></p>\n\n<h4 id=\"-log_file_max_size\">-log_file_max_size</h4>\n\n<p>Defines the maximum size a log file can grow to. Unit is megabytes. If the\nvalue is 0, the maximum file size is unlimited.</p>\n\n<p>Default: 1800</p>\n\n<h4 id=\"-logtostderr\">-logtostderr</h4>\n\n<p>Log to standard error instead of files</p>\n\n<p>Default: true</p>\n\n<h4 id=\"-skip_headers\">-skip_headers</h4>\n\n<p>If true, avoid header prefixes in the log messages.</p>\n\n<p>Default: false</p>\n\n<h4 id=\"-skip_log_headers\">-skip_log_headers</h4>\n\n<p>If true, avoid headers when opening log files.</p>\n\n<p>Default: false</p>\n\n<h4 id=\"-stderrthreshold\">-stderrthreshold</h4>\n\n<p>Logs at or above this threshold go to stderr.</p>\n\n<p>Default: 2</p>\n\n<h4 id=\"-v\">-v</h4>\n\n<p>Number for the log level verbosity.</p>\n\n<p>Default: 0</p>\n\n<h4 id=\"-vmodule\">-vmodule</h4>\n\n<p>Comma-separated list of <code class=\"language-plaintext highlighter-rouge\">pattern=N</code> settings for file-filtered logging.</p>\n\n<p>Default: <em>empty</em></p>\n","dir":"/advanced/","name":"master-commandline-reference.md","path":"advanced/master-commandline-reference.md","url":"/advanced/master-commandline-reference.html"},{"title":"Quick start","layout":"default","sort":2,"content":"<h1 id=\"quick-start\">Quick start</h1>\n\n<p>Minimal steps to deploy latest released version of NFD in your cluster.</p>\n\n<h2 id=\"installation\">Installation</h2>\n\n<p>Deploy with kustomize – creates a new namespace, service and required RBAC\nrules and deploys nfd-master and nfd-worker daemons.</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>kubectl apply <span class=\"nt\">-k</span> https://github.com/kubernetes-sigs/node-feature-discovery/deployment/overlays/default?ref<span class=\"o\">=</span>master\n</code></pre>  </div></div>\n\n<h2 id=\"verify\">Verify</h2>\n\n<p>Wait until NFD master and NFD worker are running.</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code><span class=\"nv\">$ </span>kubectl <span class=\"nt\">-n</span> node-feature-discovery get ds,deploy\nNAME                         DESIRED   CURRENT   READY   UP-TO-DATE   AVAILABLE   NODE SELECTOR   AGE\ndaemonset.apps/nfd-worker    2         2         2       2            2           &lt;none&gt;          10s\n\nNAME                         READY   UP-TO-DATE   AVAILABLE   AGE\ndeployment.apps/nfd-master   1/1     1            1           17s\n\n</code></pre>  </div></div>\n\n<p>Check that NFD feature labels have been created</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code><span class=\"nv\">$ </span>kubectl get no <span class=\"nt\">-o</span> json | jq .items[].metadata.labels\n<span class=\"o\">{</span>\n  <span class=\"s2\">\"beta.kubernetes.io/arch\"</span>: <span class=\"s2\">\"amd64\"</span>,\n  <span class=\"s2\">\"beta.kubernetes.io/os\"</span>: <span class=\"s2\">\"linux\"</span>,\n  <span class=\"s2\">\"feature.node.kubernetes.io/cpu-cpuid.ADX\"</span>: <span class=\"s2\">\"true\"</span>,\n  <span class=\"s2\">\"feature.node.kubernetes.io/cpu-cpuid.AESNI\"</span>: <span class=\"s2\">\"true\"</span>,\n  <span class=\"s2\">\"feature.node.kubernetes.io/cpu-cpuid.AVX\"</span>: <span class=\"s2\">\"true\"</span>,\n...\n</code></pre>  </div></div>\n\n<h2 id=\"use-node-labels\">Use node labels</h2>\n\n<p>Create a pod targeting a distinguishing feature (select a valid feature from\nthe list printed on the previous step)</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code><span class=\"nv\">$ </span><span class=\"nb\">cat</span> <span class=\"o\">&lt;&lt;</span> <span class=\"no\">EOF</span><span class=\"sh\"> | kubectl apply -f -\napiVersion: v1\nkind: Pod\nmetadata:\n  name: feature-dependent-pod\nspec:\n  containers:\n  - image: k8s.gcr.io/pause\n    name: pause\n  nodeSelector:\n    # Select a valid feature\n    feature.node.kubernetes.io/cpu-cpuid.AESNI: 'true'\n</span><span class=\"no\">EOF\n</span>pod/feature-dependent-pod created\n</code></pre>  </div></div>\n\n<p>See that the pod is running on a desired node</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code><span class=\"nv\">$ </span>kubectl get po feature-dependent-pod <span class=\"nt\">-o</span> wide\nNAME                    READY   STATUS    RESTARTS   AGE   IP          NODE     NOMINATED NODE   READINESS GATES\nfeature-dependent-pod   1/1     Running   0          23s   10.36.0.4   node-2   &lt;none&gt;           &lt;none&gt;\n</code></pre>  </div></div>\n\n<h2 id=\"additional-optional-installation-steps\">Additional Optional Installation Steps</h2>\n\n<p>In order to deploy nfd-master and nfd-topology-updater daemons\nuse <code class=\"language-plaintext highlighter-rouge\">topologyupdater</code> overlay.</p>\n\n<p>Deploy with kustomize – creates a new namespace, service and required RBAC\nrules and nfd-master and nfd-topology-updater daemons.</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>kubectl apply <span class=\"nt\">-k</span> https://github.com/kubernetes-sigs/node-feature-discovery/deployment/overlays/topologyupdater?ref<span class=\"o\">=</span>master\n</code></pre>  </div></div>\n\n<p><strong>NOTE:</strong></p>\n\n<p><a href=\"https://kubernetes.io/docs/concepts/extend-kubernetes/compute-storage-net/device-plugins/#monitoring-device-plugin-resources\">PodResource API</a> is a prerequisite for nfd-topology-updater.</p>\n\n<p>Preceding Kubernetes v1.23, the <code class=\"language-plaintext highlighter-rouge\">kubelet</code> must be started with the following flag:</p>\n\n<p><code class=\"language-plaintext highlighter-rouge\">--feature-gates=KubeletPodResourcesGetAllocatable=true</code></p>\n\n<p>Starting Kubernetes v1.23, the <code class=\"language-plaintext highlighter-rouge\">GetAllocatableResources</code> is enabled by default\nthrough <code class=\"language-plaintext highlighter-rouge\">KubeletPodResourcesGetAllocatable</code> <a href=\"https://kubernetes.io/docs/reference/command-line-tools-reference/feature-gates\">feature gate</a>.</p>\n\n<h2 id=\"verify-1\">Verify</h2>\n\n<p>Wait until NFD master and NFD topologyupdater are running.</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code><span class=\"nv\">$ </span>kubectl <span class=\"nt\">-n</span> node-feature-discovery get ds,deploy\nNAME                                  DESIRED   CURRENT   READY   UP-TO-DATE   AVAILABLE   NODE SELECTOR   AGE\ndaemonset.apps/nfd-topology-updater   2         2         2       2            2           &lt;none&gt;          5s\n\nNAME                         READY   UP-TO-DATE   AVAILABLE   AGE\ndeployment.apps/nfd-master   1/1     1            1           17s\n\n</code></pre>  </div></div>\n\n<p>Check that the NodeResourceTopology CR instances are created</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code><span class=\"nv\">$ </span>kubectl get noderesourcetopologies.topology.node.k8s.io\nNAME                 AGE\nkind-control-plane   23s\nkind-worker          23s\n</code></pre>  </div></div>\n\n<h2 id=\"show-the-cr-instances\">Show the CR instances</h2>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code><span class=\"nv\">$ </span>kubectl describe noderesourcetopologies.topology.node.k8s.io kind-control-plane\nName:         kind-control-plane\nNamespace:    default\nLabels:       &lt;none&gt;\nAnnotations:  &lt;none&gt;\nAPI Version:  topology.node.k8s.io/v1alpha1\nKind:         NodeResourceTopology\n...\nTopology Policies:\n  SingleNUMANodeContainerLevel\nZones:\n    Name:             node-0\n    Costs:\n      node-0:  10\n      node-1:  20\n    Resources:\n        Name:         Cpu\n        Allocatable:  3\n        Capacity:     3\n        Available:    3\n        Name:         vendor/nic1\n        Allocatable:  2\n        Capacity:     2\n        Available:    2\n        Name:         vendor/nic2\n        Allocatable:  2\n        Capacity:     2\n        Available:    2\n    Type:             Node\n    Name:             node-1\n    Costs:\n      node-0:  20\n      node-1:  10\n    Resources:\n        Name:         Cpu\n        Allocatable:  4\n        Capacity:     4\n        Available:    4\n        Name:         vendor/nic1\n        Allocatable:  2\n        Capacity:     2\n        Available:    2\n        Name:         vendor/nic2\n        Allocatable:  2\n        Capacity:     2\n        Available:    2\n    Type:             Node\nEvents:               &lt;none&gt;\n</code></pre>  </div></div>\n\n<p>The CR instances created can be used to gain insight into the allocatable\nresources along with the granularity of those resources at a per-zone level\n(represented by node-0 and node-1 in the above example) or can be used by an\nexternal entity (e.g. topology-aware scheduler plugin) to take an action based\non the gathered information.</p>\n\n<!-- Links -->\n","dir":"/get-started/","name":"quick-start.md","path":"get-started/quick-start.md","url":"/get-started/quick-start.html"},{"title":"Contributing","layout":"default","sort":3,"content":"<h1 id=\"contributing\">Contributing</h1>\n\n<hr />\n\n<h2 id=\"community\">Community</h2>\n\n<p>You can reach us via the following channels:</p>\n\n<ul>\n <li><a href=\"https://kubernetes.slack.com/messages/node-feature-discovery\">#node-feature-discovery</a>\nchannel in <a href=\"https://slack.k8s.io/\">Kubernetes Slack</a></li>\n <li><a href=\"https://groups.google.com/g/kubernetes-sig-node\">SIG-Node</a> mailing list</li>\n <li>File an\n<a href=\"https://github.com/kubernetes-sigs/node-feature-discovery/issues/new\">issue</a>\nin this repository</li>\n</ul>\n\n<h2 id=\"governance\">Governance</h2>\n\n<p>This is a\n<a href=\"https://github.com/kubernetes/community/blob/master/sig-node/README.md\">SIG-node</a>\nsubproject, hosted under the\n<a href=\"https://github.com/kubernetes-sigs\">Kubernetes SIGs</a> organization in Github.\nThe project was established in 2016 and was migrated to Kubernetes SIGs in 2018.</p>\n\n<h2 id=\"license\">License</h2>\n\n<p>This is open source software released under the <a href=\"LICENSE\">Apache 2.0 License</a>.</p>\n","dir":"/contributing/","name":"index.md","path":"contributing/index.md","url":"/contributing/"},{"title":"Worker cmdline reference","layout":"default","sort":3,"content":"<h1 class=\"no_toc\" id=\"commandline-flags-of-nfd-worker\">Commandline flags of nfd-worker</h1>\n\n<h2 class=\"no_toc text-delta\" id=\"table-of-contents\">Table of contents</h2>\n\n<ol id=\"markdown-toc\">\n <li><a href=\"#-h--help\" id=\"markdown-toc--h--help\">-h, -help</a></li>\n <li><a href=\"#-version\" id=\"markdown-toc--version\">-version</a></li>\n <li><a href=\"#-config\" id=\"markdown-toc--config\">-config</a></li>\n <li><a href=\"#-options\" id=\"markdown-toc--options\">-options</a></li>\n <li><a href=\"#-server\" id=\"markdown-toc--server\">-server</a></li>\n <li><a href=\"#-ca-file\" id=\"markdown-toc--ca-file\">-ca-file</a></li>\n <li><a href=\"#-cert-file\" id=\"markdown-toc--cert-file\">-cert-file</a></li>\n <li><a href=\"#-key-file\" id=\"markdown-toc--key-file\">-key-file</a></li>\n <li><a href=\"#-server-name-override\" id=\"markdown-toc--server-name-override\">-server-name-override</a></li>\n <li><a href=\"#-label-sources\" id=\"markdown-toc--label-sources\">-label-sources</a></li>\n <li><a href=\"#-sources\" id=\"markdown-toc--sources\">-sources</a></li>\n <li><a href=\"#-no-publish\" id=\"markdown-toc--no-publish\">-no-publish</a></li>\n <li><a href=\"#-label-whitelist\" id=\"markdown-toc--label-whitelist\">-label-whitelist</a></li>\n <li><a href=\"#-oneshot\" id=\"markdown-toc--oneshot\">-oneshot</a></li>\n <li><a href=\"#-sleep-interval\" id=\"markdown-toc--sleep-interval\">-sleep-interval</a></li>\n <li><a href=\"#logging\" id=\"markdown-toc-logging\">Logging</a></li>\n</ol>\n\n<hr />\n\n<p>To quickly view available command line flags execute <code class=\"language-plaintext highlighter-rouge\">nfd-worker -help</code>.\nIn a docker container:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>docker run gcr.io/k8s-staging-nfd/node-feature-discovery:master nfd-worker <span class=\"nt\">-help</span>\n</code></pre>  </div></div>\n\n<h3 id=\"-h--help\">-h, -help</h3>\n\n<p>Print usage and exit.</p>\n\n<h3 id=\"-version\">-version</h3>\n\n<p>Print version and exit.</p>\n\n<h3 id=\"-config\">-config</h3>\n\n<p>The <code class=\"language-plaintext highlighter-rouge\">-config</code> flag specifies the path of the nfd-worker configuration file to\nuse.</p>\n\n<p>Default: /etc/kubernetes/node-feature-discovery/nfd-worker.conf</p>\n\n<p>Example:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>nfd-worker <span class=\"nt\">-config</span><span class=\"o\">=</span>/opt/nfd/worker.conf\n</code></pre>  </div></div>\n\n<h3 id=\"-options\">-options</h3>\n\n<p>The <code class=\"language-plaintext highlighter-rouge\">-options</code> flag may be used to specify and override configuration file\noptions directly from the command line. The required format is the same as in\nthe config file i.e. JSON or YAML. Configuration options specified via this\nflag will override those from the configuration file:</p>\n\n<p>Default: <em>empty</em></p>\n\n<p>Example:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>nfd-worker <span class=\"nt\">-options</span><span class=\"o\">=</span><span class=\"s1\">'{\"sources\":{\"cpu\":{\"cpuid\":{\"attributeWhitelist\":[\"AVX\",\"AVX2\"]}}}}'</span>\n</code></pre>  </div></div>\n\n<h3 id=\"-server\">-server</h3>\n\n<p>The <code class=\"language-plaintext highlighter-rouge\">-server</code> flag specifies the address of the nfd-master endpoint where to\nconnect to.</p>\n\n<p>Default: localhost:8080</p>\n\n<p>Example:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>nfd-worker <span class=\"nt\">-server</span><span class=\"o\">=</span>nfd-master.nfd.svc.cluster.local:443\n</code></pre>  </div></div>\n\n<h3 id=\"-ca-file\">-ca-file</h3>\n\n<p>The <code class=\"language-plaintext highlighter-rouge\">-ca-file</code> is one of the three flags (together with <code class=\"language-plaintext highlighter-rouge\">-cert-file</code> and\n<code class=\"language-plaintext highlighter-rouge\">-key-file</code>) controlling the mutual TLS authentication on the worker side.\nThis flag specifies the TLS root certificate that is used for verifying the\nauthenticity of nfd-master.</p>\n\n<p>Default: <em>empty</em></p>\n\n<p>Note: Must be specified together with <code class=\"language-plaintext highlighter-rouge\">-cert-file</code> and <code class=\"language-plaintext highlighter-rouge\">-key-file</code></p>\n\n<p>Example:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>nfd-worker <span class=\"nt\">-ca-file</span><span class=\"o\">=</span>/opt/nfd/ca.crt <span class=\"nt\">-cert-file</span><span class=\"o\">=</span>/opt/nfd/worker.crt <span class=\"nt\">-key-file</span><span class=\"o\">=</span>/opt/nfd/worker.key\n</code></pre>  </div></div>\n\n<h3 id=\"-cert-file\">-cert-file</h3>\n\n<p>The <code class=\"language-plaintext highlighter-rouge\">-cert-file</code> is one of the three flags (together with <code class=\"language-plaintext highlighter-rouge\">-ca-file</code> and\n<code class=\"language-plaintext highlighter-rouge\">-key-file</code>) controlling mutual TLS authentication on the worker side. This\nflag specifies the TLS certificate presented for authenticating outgoing\nrequests.</p>\n\n<p>Default: <em>empty</em></p>\n\n<p>Note: Must be specified together with <code class=\"language-plaintext highlighter-rouge\">-ca-file</code> and <code class=\"language-plaintext highlighter-rouge\">-key-file</code></p>\n\n<p>Example:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>nfd-workerr <span class=\"nt\">-cert-file</span><span class=\"o\">=</span>/opt/nfd/worker.crt <span class=\"nt\">-key-file</span><span class=\"o\">=</span>/opt/nfd/worker.key <span class=\"nt\">-ca-file</span><span class=\"o\">=</span>/opt/nfd/ca.crt\n</code></pre>  </div></div>\n\n<h3 id=\"-key-file\">-key-file</h3>\n\n<p>The <code class=\"language-plaintext highlighter-rouge\">-key-file</code> is one of the three flags (together with <code class=\"language-plaintext highlighter-rouge\">-ca-file</code> and\n<code class=\"language-plaintext highlighter-rouge\">-cert-file</code>) controlling the mutual TLS authentication on the worker side.\nThis flag specifies the private key corresponding the given certificate file\n(<code class=\"language-plaintext highlighter-rouge\">-cert-file</code>) that is used for authenticating outgoing requests.</p>\n\n<p>Default: <em>empty</em></p>\n\n<p>Note: Must be specified together with <code class=\"language-plaintext highlighter-rouge\">-cert-file</code> and <code class=\"language-plaintext highlighter-rouge\">-ca-file</code></p>\n\n<p>Example:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>nfd-worker <span class=\"nt\">-key-file</span><span class=\"o\">=</span>/opt/nfd/worker.key <span class=\"nt\">-cert-file</span><span class=\"o\">=</span>/opt/nfd/worker.crt <span class=\"nt\">-ca-file</span><span class=\"o\">=</span>/opt/nfd/ca.crt\n</code></pre>  </div></div>\n\n<h3 id=\"-server-name-override\">-server-name-override</h3>\n\n<p>The <code class=\"language-plaintext highlighter-rouge\">-server-name-override</code> flag specifies the common name (CN) which to\nexpect from the nfd-master TLS certificate. This flag is mostly intended for\ndevelopment and debugging purposes.</p>\n\n<p>Default: <em>empty</em></p>\n\n<p>Example:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>nfd-worker <span class=\"nt\">-server-name-override</span><span class=\"o\">=</span>localhost\n</code></pre>  </div></div>\n\n<h3 id=\"-label-sources\">-label-sources</h3>\n\n<p>The <code class=\"language-plaintext highlighter-rouge\">-label-sources</code> flag specifies a comma-separated list of enabled label\nsources. A special value <code class=\"language-plaintext highlighter-rouge\">all</code> enables all sources. Consider using the\n<code class=\"language-plaintext highlighter-rouge\">core.labelSources</code> config file option, instead, allowing dynamic\nconfigurability.</p>\n\n<p>Note: This flag takes precedence over the <code class=\"language-plaintext highlighter-rouge\">core.labelSources</code> configuration\nfile option.</p>\n\n<p>Default: all</p>\n\n<p>Example:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>nfd-worker <span class=\"nt\">-label-sources</span><span class=\"o\">=</span>kernel,system,local\n</code></pre>  </div></div>\n\n<h3 id=\"-sources\">-sources</h3>\n\n<p><strong>DEPRECATED</strong>: use <a href=\"#-label-sources\"><code class=\"language-plaintext highlighter-rouge\">-label-sources</code></a> instead.</p>\n\n<h3 id=\"-no-publish\">-no-publish</h3>\n\n<p>The <code class=\"language-plaintext highlighter-rouge\">-no-publish</code> flag disables all communication with the nfd-master, making\nit a “dry-run” flag for nfd-worker. NFD-Worker runs feature detection normally,\nbut no labeling requests are sent to nfd-master.</p>\n\n<p>Default: <em>false</em></p>\n\n<p>Example:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>nfd-worker <span class=\"nt\">-no-publish</span>\n</code></pre>  </div></div>\n\n<h3 id=\"-label-whitelist\">-label-whitelist</h3>\n\n<p>The <code class=\"language-plaintext highlighter-rouge\">-label-whitelist</code> specifies a regular expression for filtering feature\nlabels based on their name. Each label must match against the given reqular\nexpression in order to be published.</p>\n\n<p>Note: The regular expression is only matches against the “basename” part of the\nlabel, i.e. to the part of the name after ‘/’. The label namespace is omitted.</p>\n\n<p>Note: This flag takes precedence over the <code class=\"language-plaintext highlighter-rouge\">core.labelWhiteList</code> configuration\nfile option.</p>\n\n<p>Default: <em>empty</em></p>\n\n<p>Example:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>nfd-worker <span class=\"nt\">-label-whitelist</span><span class=\"o\">=</span><span class=\"s1\">'.*cpuid\\.'</span>\n</code></pre>  </div></div>\n\n<p><strong>DEPRECATED</strong>: you should use the <code class=\"language-plaintext highlighter-rouge\">core.labelWhiteList</code> option in the\nconfiguration file, instead.</p>\n\n<h3 id=\"-oneshot\">-oneshot</h3>\n\n<p>The <code class=\"language-plaintext highlighter-rouge\">-oneshot</code> flag causes nfd-worker to exit after one pass of feature\ndetection.</p>\n\n<p>Default: <em>false</em></p>\n\n<p>Example:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>nfd-worker <span class=\"nt\">-oneshot</span> <span class=\"nt\">-no-publish</span>\n</code></pre>  </div></div>\n\n<h3 id=\"-sleep-interval\">-sleep-interval</h3>\n\n<p>The <code class=\"language-plaintext highlighter-rouge\">-sleep-interval</code> specifies the interval between feature re-detection (and\nnode re-labeling). A non-positive value implies infinite sleep interval, i.e.\nno re-detection or re-labeling is done.</p>\n\n<p>Note: This flag takes precedence over the <code class=\"language-plaintext highlighter-rouge\">core.sleepInterval</code> configuration\nfile option.</p>\n\n<p>Default: 60s</p>\n\n<p>Example:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>nfd-worker <span class=\"nt\">-sleep-interval</span><span class=\"o\">=</span>1h\n</code></pre>  </div></div>\n\n<p><strong>DEPRECATED</strong>: you should use the <code class=\"language-plaintext highlighter-rouge\">core.sleepInterval</code> option in the\nconfiguration file, instead.</p>\n\n<h3 id=\"logging\">Logging</h3>\n\n<p>The following logging-related flags are inherited from the\n<a href=\"https://pkg.go.dev/k8s.io/klog/v2\">klog</a> package.</p>\n\n<p>Note: The logger setup can also be specified via the <code class=\"language-plaintext highlighter-rouge\">core.klog</code> configuration\nfile options. However, the command line flags take precedence over any\ncorresponding config file options specified.</p>\n\n<h4 id=\"-add_dir_header\">-add_dir_header</h4>\n\n<p>If true, adds the file directory to the header of the log messages.</p>\n\n<p>Default: false</p>\n\n<h4 id=\"-alsologtostderr\">-alsologtostderr</h4>\n\n<p>Log to standard error as well as files.</p>\n\n<p>Default: false</p>\n\n<h4 id=\"-log_backtrace_at\">-log_backtrace_at</h4>\n\n<p>When logging hits line file:N, emit a stack trace.</p>\n\n<p>Default: <em>empty</em></p>\n\n<h4 id=\"-log_dir\">-log_dir</h4>\n\n<p>If non-empty, write log files in this directory.</p>\n\n<p>Default: <em>empty</em></p>\n\n<h4 id=\"-log_file\">-log_file</h4>\n\n<p>If non-empty, use this log file.</p>\n\n<p>Default: <em>empty</em></p>\n\n<h4 id=\"-log_file_max_size\">-log_file_max_size</h4>\n\n<p>Defines the maximum size a log file can grow to. Unit is megabytes. If the\nvalue is 0, the maximum file size is unlimited.</p>\n\n<p>Default: 1800</p>\n\n<h4 id=\"-logtostderr\">-logtostderr</h4>\n\n<p>Log to standard error instead of files</p>\n\n<p>Default: true</p>\n\n<h4 id=\"-skip_headers\">-skip_headers</h4>\n\n<p>If true, avoid header prefixes in the log messages.</p>\n\n<p>Default: false</p>\n\n<h4 id=\"-skip_log_headers\">-skip_log_headers</h4>\n\n<p>If true, avoid headers when opening log files.</p>\n\n<p>Default: false</p>\n\n<h4 id=\"-stderrthreshold\">-stderrthreshold</h4>\n\n<p>Logs at or above this threshold go to stderr.</p>\n\n<p>Default: 2</p>\n\n<h4 id=\"-v\">-v</h4>\n\n<p>Number for the log level verbosity.</p>\n\n<p>Default: 0</p>\n\n<h4 id=\"-vmodule\">-vmodule</h4>\n\n<p>Comma-separated list of <code class=\"language-plaintext highlighter-rouge\">pattern=N</code> settings for file-filtered logging.</p>\n\n<p>Default: <em>empty</em></p>\n","dir":"/advanced/","name":"worker-commandline-reference.md","path":"advanced/worker-commandline-reference.md","url":"/advanced/worker-commandline-reference.html"},{"title":"Deployment and usage","layout":"default","sort":3,"content":"<h1 class=\"no_toc\" id=\"deployment-and-usage\">Deployment and usage</h1>\n\n<h2 class=\"no_toc text-delta\" id=\"table-of-contents\">Table of contents</h2>\n\n<ol id=\"markdown-toc\">\n <li><a href=\"#requirements\" id=\"markdown-toc-requirements\">Requirements</a></li>\n <li><a href=\"#image-variants\" id=\"markdown-toc-image-variants\">Image variants</a> <ol>\n <li><a href=\"#full\" id=\"markdown-toc-full\">Full</a></li>\n <li><a href=\"#minimal\" id=\"markdown-toc-minimal\">Minimal</a></li>\n </ol>\n </li>\n <li><a href=\"#deployment-options\" id=\"markdown-toc-deployment-options\">Deployment options</a> <ol>\n <li><a href=\"#operator\" id=\"markdown-toc-operator\">Operator</a></li>\n <li><a href=\"#deployment-with-kustomize\" id=\"markdown-toc-deployment-with-kustomize\">Deployment with kustomize</a></li>\n <li><a href=\"#deployment-with-helm\" id=\"markdown-toc-deployment-with-helm\">Deployment with Helm</a></li>\n <li><a href=\"#build-your-own\" id=\"markdown-toc-build-your-own\">Build your own</a></li>\n </ol>\n </li>\n <li><a href=\"#usage\" id=\"markdown-toc-usage\">Usage</a> <ol>\n <li><a href=\"#nfd-master\" id=\"markdown-toc-nfd-master\">NFD-Master</a></li>\n <li><a href=\"#nfd-worker\" id=\"markdown-toc-nfd-worker\">NFD-Worker</a></li>\n <li><a href=\"#nfd-topology-updater\" id=\"markdown-toc-nfd-topology-updater\">NFD-Topology-Updater</a></li>\n <li><a href=\"#communication-security-with-tls\" id=\"markdown-toc-communication-security-with-tls\">Communication security with TLS</a></li>\n </ol>\n </li>\n <li><a href=\"#worker-configuration\" id=\"markdown-toc-worker-configuration\">Worker configuration</a></li>\n <li><a href=\"#using-node-labels\" id=\"markdown-toc-using-node-labels\">Using node labels</a></li>\n <li><a href=\"#uninstallation\" id=\"markdown-toc-uninstallation\">Uninstallation</a> <ol>\n <li><a href=\"#operator-was-used-for-deployment\" id=\"markdown-toc-operator-was-used-for-deployment\">Operator was used for deployment</a></li>\n <li><a href=\"#manual\" id=\"markdown-toc-manual\">Manual</a></li>\n <li><a href=\"#removing-feature-labels\" id=\"markdown-toc-removing-feature-labels\">Removing feature labels</a></li>\n </ol>\n </li>\n</ol>\n\n<hr />\n\n<h2 id=\"requirements\">Requirements</h2>\n\n<ol>\n <li>Linux (x86_64/Arm64/Arm)</li>\n <li><a href=\"https://kubernetes.io/docs/tasks/tools/install-kubectl\">kubectl</a> v1.21 or\nlater (properly set up and configured to work with your Kubernetes cluster)</li>\n</ol>\n\n<h2 id=\"image-variants\">Image variants</h2>\n\n<p>NFD currently offers two variants of the container image. The “full” variant is\ncurrently deployed by default.</p>\n\n<h3 id=\"full\">Full</h3>\n\n<p>This image is based on\n<a href=\"https://hub.docker.com/_/debian\">debian:buster-slim</a> and contains a full Linux\nsystem for running shell-based nfd-worker hooks and doing live debugging and\ndiagnosis of the NFD images.</p>\n\n<h3 id=\"minimal\">Minimal</h3>\n\n<p>This is a minimal image based on\n<a href=\"https://github.com/GoogleContainerTools/distroless/blob/master/base/README.md\">gcr.io/distroless/base</a>\nand only supports running statically linked binaries.</p>\n\n<p>The container image tag has suffix <code class=\"language-plaintext highlighter-rouge\">-minimal</code>\n(e.g. <code class=\"language-plaintext highlighter-rouge\">gcr.io/k8s-staging-nfd/node-feature-discovery:master-minimal</code>)</p>\n\n<h2 id=\"deployment-options\">Deployment options</h2>\n\n<h3 id=\"operator\">Operator</h3>\n\n<p>Deployment using the\n<a href=\"https://github.com/kubernetes-sigs/node-feature-discovery-operator\">Node Feature Discovery Operator</a>\nis recommended to be done via\n<a href=\"https://operatorhub.io/operator/nfd-operator\">operatorhub.io</a>.</p>\n\n<ol>\n <li>You need to have\n<a href=\"https://github.com/operator-framework/operator-lifecycle-manager\">OLM</a>\ninstalled. If you don’t, take a look at the\n<a href=\"https://github.com/operator-framework/operator-lifecycle-manager/releases/latest\">latest release</a>\nfor detailed instructions.</li>\n <li>\n <p>Install the operator:</p>\n\n <div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code> kubectl create <span class=\"nt\">-f</span> https://operatorhub.io/install/nfd-operator.yaml\n</code></pre>  </div> </div>\n </li>\n <li>\n <p>Create NodeFeatureDiscovery resource (in <code class=\"language-plaintext highlighter-rouge\">nfd</code> namespace here):</p>\n\n <div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code> <span class=\"nb\">cat</span> <span class=\"o\">&lt;&lt;</span> <span class=\"no\">EOF</span><span class=\"sh\"> | kubectl apply -f -\n apiVersion: v1\n kind: Namespace\n metadata:\n   name: nfd\n ---\n apiVersion: nfd.kubernetes.io/v1alpha1\n kind: NodeFeatureDiscovery\n metadata:\n   name: my-nfd-deployment\n   namespace: nfd\n</span><span class=\"no\"> EOF\n</span></code></pre>  </div> </div>\n </li>\n</ol>\n\n<p>In order to deploy the <a href=\"#minimal\">minimal</a> image you need to add</p>\n\n<div class=\"language-yaml highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>  <span class=\"na\">image</span><span class=\"pi\">:</span> <span class=\"s\">gcr.io/k8s-staging-nfd/node-feature-discovery:master-minimal</span>\n</code></pre>  </div></div>\n\n<p>to the metadata of NodeFeatureDiscovery object above.</p>\n\n<h3 id=\"deployment-with-kustomize\">Deployment with kustomize</h3>\n\n<p>The kustomize overlays provided in the repo can be used directly:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>kubectl apply <span class=\"nt\">-k</span> https://github.com/kubernetes-sigs/node-feature-discovery/deployment/overlays/default?ref<span class=\"o\">=</span>master\n</code></pre>  </div></div>\n\n<p>This will required RBAC rules and deploy nfd-master (as a deployment) and\nnfd-worker (as daemonset) in the <code class=\"language-plaintext highlighter-rouge\">node-feature-discovery</code> namespace.</p>\n\n<p><strong>NOTE:</strong> nfd-topology-updater is not deployed as part of the <code class=\"language-plaintext highlighter-rouge\">default</code> overlay.\nPlease refer to the <a href=\"#master-worker-topologyupdater\">Master Worker Topologyupdater</a>\nand <a href=\"#topology-updater\">Topologyupdater</a> below.</p>\n\n<p>Alternatively you can clone the repository and customize the deployment by\ncreating your own overlays. For example, to deploy the <a href=\"#minimal\">minimal</a>\nimage. See <a href=\"https://github.com/kubernetes-sigs/kustomize\">kustomize</a> for more information about managing\ndeployment configurations.</p>\n\n<h4 id=\"default-overlays\">Default overlays</h4>\n\n<p>The NFD repository hosts a set of overlays for different usages and deployment\nscenarios under\n<a href=\"https://github.com/kubernetes-sigs/node-feature-discovery/blob/master/deployment/overlays\"><code class=\"language-plaintext highlighter-rouge\">deployment/overlays</code></a></p>\n\n<ul>\n <li><a href=\"https://github.com/kubernetes-sigs/node-feature-discovery/blob/master/deployment/overlays/default\"><code class=\"language-plaintext highlighter-rouge\">default</code></a>:\ndefault deployment of nfd-worker as a daemonset, descibed above</li>\n <li><a href=\"https://github.com/kubernetes-sigs/node-feature-discovery/blob/master/deployment/overlays/default-combined\"><code class=\"language-plaintext highlighter-rouge\">default-combined</code></a>\nsee <a href=\"#master-worker-pod\">Master-worker pod</a> below</li>\n <li><a href=\"https://github.com/kubernetes-sigs/node-feature-discovery/blob/master/deployment/overlays/default-job\"><code class=\"language-plaintext highlighter-rouge\">default-job</code></a>:\nsee <a href=\"#worker-one-shot\">Worker one-shot</a> below</li>\n <li><a href=\"https://github.com/kubernetes-sigs/node-feature-discovery/blob/master/deployment/overlays/master-worker-topologyupdater\"><code class=\"language-plaintext highlighter-rouge\">master-worker-topologyupdater</code></a>:\nsee <a href=\"#master-worker-topologyupdater\">Master Worker Topologyupdater</a> below</li>\n <li><a href=\"https://github.com/kubernetes-sigs/node-feature-discovery/blob/master/deployment/overlays/topologyupdater\"><code class=\"language-plaintext highlighter-rouge\">topologyupdater</code></a>:\nsee <a href=\"#topology-updater\">Topology Updater</a> below</li>\n <li><a href=\"https://github.com/kubernetes-sigs/node-feature-discovery/blob/master/deployment/overlays/prune\"><code class=\"language-plaintext highlighter-rouge\">prune</code></a>:\nclean up the cluster after uninstallation, see\n<a href=\"#removing-feature-labels\">Removing feature labels</a></li>\n <li><a href=\"https://github.com/kubernetes-sigs/node-feature-discovery/blob/master/deployment/overlays/samples/cert-manager\"><code class=\"language-plaintext highlighter-rouge\">samples/cert-manager</code></a>:\nan example for supplementing the default deployment with cert-manager for TLS\nauthentication, see\n<a href=\"#automated-tls-certificate-management-using-cert-manager\">Automated TLS certificate management using cert-manager</a>\nfor details</li>\n <li><a href=\"https://github.com/kubernetes-sigs/node-feature-discovery/blob/master/deployment/overlays/samples/custom-rules\"><code class=\"language-plaintext highlighter-rouge\">samples/custom-rules</code></a>:\nan example for spicing up the default deployment with a separately managed\nconfigmap of custom labeling rules, see\n<a href=\"#features.md#custom\">Custom feature source</a> for more information about\ncustom node labels</li>\n</ul>\n\n<h4 id=\"master-worker-pod\">Master-worker pod</h4>\n\n<p>You can also run nfd-master and nfd-worker inside the same pod</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>kubectl apply <span class=\"nt\">-k</span> https://github.com/kubernetes-sigs/node-feature-discovery/deployment/overlays/default-combined?ref<span class=\"o\">=</span>master\n\n</code></pre>  </div></div>\n\n<p>This creates a DaemonSet that runs nfd-worker and nfd-master in the same Pod.\nIn this case no nfd-master is run on the master node(s), but, the worker nodes\nare able to label themselves which may be desirable e.g. in single-node setups.</p>\n\n<p><strong>NOTE:</strong> nfd-topology-updater is not deployed by the default-combined overlay.\nTo enable nfd-topology-updater in this scenario,the users must customize the\ndeployment themselves.</p>\n\n<h4 id=\"worker-one-shot\">Worker one-shot</h4>\n\n<p>Feature discovery can alternatively be configured as a one-shot job.\nThe <code class=\"language-plaintext highlighter-rouge\">default-job</code> overlay may be used to achieve this:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code><span class=\"nv\">NUM_NODES</span><span class=\"o\">=</span><span class=\"si\">$(</span>kubectl get no <span class=\"nt\">-o</span> <span class=\"nv\">jsonpath</span><span class=\"o\">=</span><span class=\"s1\">'{.items[*].metadata.name}'</span> | <span class=\"nb\">wc</span> <span class=\"nt\">-w</span><span class=\"si\">)</span>\nkubectl kustomize https://github.com/kubernetes-sigs/node-feature-discovery/deployment/overlays/default-job?ref<span class=\"o\">=</span>master | <span class=\"se\">\\</span>\n    <span class=\"nb\">sed </span>s<span class=\"s2\">\"/NUM_NODES/</span><span class=\"nv\">$NUM_NODES</span><span class=\"s2\">/\"</span> | <span class=\"se\">\\</span>\n    kubectl apply <span class=\"nt\">-f</span> -\n</code></pre>  </div></div>\n\n<p>The example above launches as many jobs as there are non-master nodes. Note that\nthis approach does not guarantee running once on every node. For example,\ntainted, non-ready nodes or some other reasons in Job scheduling may cause some\nnode(s) will run extra job instance(s) to satisfy the request.</p>\n\n<h4 id=\"master-worker-topologyupdater\">Master Worker Topologyupdater</h4>\n\n<p>NFD Master, NFD worker and NFD Topologyupdater can be configured to be deployed\nas separate pods. The <code class=\"language-plaintext highlighter-rouge\">master-worker-topologyupdater</code> overlay may be used to\nachieve this:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>kubectl apply <span class=\"nt\">-k</span> https://github.com/kubernetes-sigs/node-feature-discovery/deployment/overlays/master-worker-topologyupdater?ref<span class=\"o\">=</span>master\n\n</code></pre>  </div></div>\n\n<h4 id=\"topologyupdater\">Topologyupdater</h4>\n\n<p>In order to deploy just NFD master and NFD Topologyupdater (without nfd-worker)\nuse the <code class=\"language-plaintext highlighter-rouge\">topologyupdater</code> overlay:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>kubectl apply <span class=\"nt\">-k</span> https://github.com/kubernetes-sigs/node-feature-discovery/deployment/overlays/topologyupdater?ref<span class=\"o\">=</span>master\n\n</code></pre>  </div></div>\n\n<p>NFD Topologyupdater can be configured along with the <code class=\"language-plaintext highlighter-rouge\">default</code> overlay\n(which deploys NFD worker and NFD master) where all the software components\nare deployed as separate pods. The <code class=\"language-plaintext highlighter-rouge\">topologyupdater</code> overlay may be used\nalong with <code class=\"language-plaintext highlighter-rouge\">default</code> overlay to achieve this:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>\nkubectl apply <span class=\"nt\">-k</span> https://github.com/kubernetes-sigs/node-feature-discovery/deployment/overlays/default?ref<span class=\"o\">=</span>master\nkubectl apply <span class=\"nt\">-k</span> https://github.com/kubernetes-sigs/node-feature-discovery/deployment/overlays/topologyupdater?ref<span class=\"o\">=</span>master\n\n</code></pre>  </div></div>\n\n<h3 id=\"deployment-with-helm\">Deployment with Helm</h3>\n\n<p>Node Feature Discovery Helm chart allow to easily deploy and manage NFD.</p>\n\n<h4 id=\"prerequisites\">Prerequisites</h4>\n\n<p><a href=\"https://helm.sh/\">Helm package manager</a> should be installed.</p>\n\n<h4 id=\"deployment\">Deployment</h4>\n\n<p>To install the latest stable version:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code><span class=\"nb\">export </span><span class=\"nv\">NFD_NS</span><span class=\"o\">=</span>node-feature-discovery\nhelm repo add nfd https://kubernetes-sigs.github.io/node-feature-discovery/charts\nhelm repo update\nhelm <span class=\"nb\">install </span>nfd/node-feature-discovery <span class=\"nt\">--namespace</span> <span class=\"nv\">$NFD_NS</span> <span class=\"nt\">--create-namespace</span> <span class=\"nt\">--generate-name</span>\n</code></pre>  </div></div>\n\n<p>To install the latest development version you need to clone the NFD Git\nrepository and install from there.</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>git clone https://github.com/kubernetes-sigs/node-feature-discovery/\n<span class=\"nb\">cd </span>node-feature-discovery/deployment/helm\n<span class=\"nb\">export </span><span class=\"nv\">NFD_NS</span><span class=\"o\">=</span>node-feature-discovery\nhelm <span class=\"nb\">install </span>node-feature-discovery ./node-feature-discovery/ <span class=\"nt\">--namespace</span> <span class=\"nv\">$NFD_NS</span> <span class=\"nt\">--create-namespace</span>\n</code></pre>  </div></div>\n\n<p>See the <a href=\"#configuration\">configuration</a> section below for instructions how to\nalter the deployment parameters.</p>\n\n<p>In order to deploy the <a href=\"#minimal\">minimal</a> image you need to override the image\ntag:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>helm <span class=\"nb\">install </span>node-feature-discovery ./node-feature-discovery/ <span class=\"nt\">--set</span> image.tag<span class=\"o\">=</span>master-minimal <span class=\"nt\">--namespace</span> <span class=\"nv\">$NFD_NS</span> <span class=\"nt\">--create-namespace</span>\n</code></pre>  </div></div>\n\n<h4 id=\"configuration\">Configuration</h4>\n\n<p>You can override values from <code class=\"language-plaintext highlighter-rouge\">values.yaml</code> and provide a file with custom values:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code><span class=\"nb\">export </span><span class=\"nv\">NFD_NS</span><span class=\"o\">=</span>node-feature-discovery\nhelm <span class=\"nb\">install </span>nfd/node-feature-discovery <span class=\"nt\">-f</span> &lt;path/to/custom/values.yaml&gt; <span class=\"nt\">--namespace</span> <span class=\"nv\">$NFD_NS</span> <span class=\"nt\">--create-namespace</span>\n</code></pre>  </div></div>\n\n<p>To specify each parameter separately you can provide them to helm install command:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code><span class=\"nb\">export </span><span class=\"nv\">NFD_NS</span><span class=\"o\">=</span>node-feature-discovery\nhelm <span class=\"nb\">install </span>nfd/node-feature-discovery <span class=\"nt\">--set</span> <span class=\"nv\">nameOverride</span><span class=\"o\">=</span>NFDinstance <span class=\"nt\">--set</span> master.replicaCount<span class=\"o\">=</span>2 <span class=\"nt\">--namespace</span> <span class=\"nv\">$NFD_NS</span> <span class=\"nt\">--create-namespace</span>\n</code></pre>  </div></div>\n\n<h4 id=\"uninstalling-the-chart\">Uninstalling the chart</h4>\n\n<p>To uninstall the <code class=\"language-plaintext highlighter-rouge\">node-feature-discovery</code> deployment:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code><span class=\"nb\">export </span><span class=\"nv\">NFD_NS</span><span class=\"o\">=</span>node-feature-discovery\nhelm uninstall node-feature-discovery <span class=\"nt\">--namespace</span> <span class=\"nv\">$NFD_NS</span>\n</code></pre>  </div></div>\n\n<p>The command removes all the Kubernetes components associated with the chart and\ndeletes the release.</p>\n\n<h4 id=\"chart-parameters\">Chart parameters</h4>\n\n<p>In order to tailor the deployment of the Node Feature Discovery to your cluster needs\nWe have introduced the following Chart parameters.</p>\n\n<h5 id=\"general-parameters\">General parameters</h5>\n\n<table>\n <thead>\n <tr>\n <th>Name</th>\n <th>Type</th>\n <th>Default</th>\n <th>description</th>\n </tr>\n </thead>\n <tbody>\n <tr>\n <td><code class=\"language-plaintext highlighter-rouge\">image.repository</code></td>\n <td>string</td>\n <td><code class=\"language-plaintext highlighter-rouge\">gcr.io/k8s-staging-nfd/node-feature-discovery</code></td>\n <td>NFD image repository</td>\n </tr>\n <tr>\n <td><code class=\"language-plaintext highlighter-rouge\">image.tag</code></td>\n <td>string</td>\n <td><code class=\"language-plaintext highlighter-rouge\">master</code></td>\n <td>NFD image tag</td>\n </tr>\n <tr>\n <td><code class=\"language-plaintext highlighter-rouge\">image.pullPolicy</code></td>\n <td>string</td>\n <td><code class=\"language-plaintext highlighter-rouge\">Always</code></td>\n <td>Image pull policy</td>\n </tr>\n <tr>\n <td><code class=\"language-plaintext highlighter-rouge\">imagePullSecrets</code></td>\n <td>list</td>\n <td>[]</td>\n <td>ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec. If specified, these secrets will be passed to individual puller implementations for them to use. For example, in the case of docker, only DockerConfig type secrets are honored. <a href=\"https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod\">More info</a></td>\n </tr>\n <tr>\n <td><code class=\"language-plaintext highlighter-rouge\">serviceAccount.create</code></td>\n <td>bool</td>\n <td>true</td>\n <td>Specifies whether a service account should be created</td>\n </tr>\n <tr>\n <td><code class=\"language-plaintext highlighter-rouge\">serviceAccount.annotations</code></td>\n <td>dict</td>\n <td>{}</td>\n <td>Annotations to add to the service account</td>\n </tr>\n <tr>\n <td><code class=\"language-plaintext highlighter-rouge\">serviceAccount.name</code></td>\n <td>string</td>\n <td> </td>\n <td>The name of the service account to use. If not set and create is true, a name is generated using the fullname template</td>\n </tr>\n <tr>\n <td><code class=\"language-plaintext highlighter-rouge\">rbac</code></td>\n <td>dict</td>\n <td> </td>\n <td>RBAC <a href=\"https://kubernetes.io/docs/reference/access-authn-authz/rbac/\">parameteres</a></td>\n </tr>\n <tr>\n <td><code class=\"language-plaintext highlighter-rouge\">nameOverride</code></td>\n <td>string</td>\n <td> </td>\n <td>Override the name of the chart</td>\n </tr>\n <tr>\n <td><code class=\"language-plaintext highlighter-rouge\">fullnameOverride</code></td>\n <td>string</td>\n <td> </td>\n <td>Override a default fully qualified app name</td>\n </tr>\n <tr>\n <td><code class=\"language-plaintext highlighter-rouge\">nodeFeatureRule.createCRD</code></td>\n <td>bool</td>\n <td>true</td>\n <td>Specifies whether to create the NodeFeatureRule CRD</td>\n </tr>\n </tbody>\n</table>\n\n<h5 id=\"master-pod-parameters\">Master pod parameters</h5>\n\n<table>\n <thead>\n <tr>\n <th>Name</th>\n <th>Type</th>\n <th>Default</th>\n <th>description</th>\n </tr>\n </thead>\n <tbody>\n <tr>\n <td><code class=\"language-plaintext highlighter-rouge\">master.*</code></td>\n <td>dict</td>\n <td> </td>\n <td>NFD master deployment configuration</td>\n </tr>\n <tr>\n <td><code class=\"language-plaintext highlighter-rouge\">master.instance</code></td>\n <td>string</td>\n <td> </td>\n <td>Instance name. Used to separate annotation namespaces for multiple parallel deployments</td>\n </tr>\n <tr>\n <td><code class=\"language-plaintext highlighter-rouge\">master.extraLabelNs</code></td>\n <td>array</td>\n <td>[]</td>\n <td>List of allowed extra label namespaces</td>\n </tr>\n <tr>\n <td><code class=\"language-plaintext highlighter-rouge\">master.featureRulesController</code></td>\n <td>bool</td>\n <td>True</td>\n <td>Specifies whether the controller for processing of NodeFeatureRule objects is enable.</td>\n </tr>\n <tr>\n <td><code class=\"language-plaintext highlighter-rouge\">master.replicaCount</code></td>\n <td>integer</td>\n <td>1</td>\n <td>Number of desired pods. This is a pointer to distinguish between explicit zero and not specified</td>\n </tr>\n <tr>\n <td><code class=\"language-plaintext highlighter-rouge\">master.podSecurityContext</code></td>\n <td>dict</td>\n <td>{}</td>\n <td>SecurityContext holds pod-level security attributes and common container settings</td>\n </tr>\n <tr>\n <td><code class=\"language-plaintext highlighter-rouge\">master.service.type</code></td>\n <td>string</td>\n <td>ClusterIP</td>\n <td>NFD master service type</td>\n </tr>\n <tr>\n <td><code class=\"language-plaintext highlighter-rouge\">master.service.port</code></td>\n <td>integer</td>\n <td>port</td>\n <td>NFD master service port</td>\n </tr>\n <tr>\n <td><code class=\"language-plaintext highlighter-rouge\">master.resources</code></td>\n <td>dict</td>\n <td>{}</td>\n <td>NFD master pod <a href=\"https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/\">resources management</a></td>\n </tr>\n <tr>\n <td><code class=\"language-plaintext highlighter-rouge\">master.nodeSelector</code></td>\n <td>dict</td>\n <td>{}</td>\n <td>NFD master pod <a href=\"https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector\">node selector</a></td>\n </tr>\n <tr>\n <td><code class=\"language-plaintext highlighter-rouge\">master.tolerations</code></td>\n <td>dict</td>\n <td><em>Scheduling to master node is disabled</em></td>\n <td>NFD master pod <a href=\"https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/\">tolerations</a></td>\n </tr>\n <tr>\n <td><code class=\"language-plaintext highlighter-rouge\">master.annotations</code></td>\n <td>dict</td>\n <td>{}</td>\n <td>NFD master pod <a href=\"https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/\">metadata</a></td>\n </tr>\n <tr>\n <td><code class=\"language-plaintext highlighter-rouge\">master.affinity</code></td>\n <td>dict</td>\n <td> </td>\n <td>NFD master pod required <a href=\"https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes-using-node-affinity/\">node affinity</a></td>\n </tr>\n </tbody>\n</table>\n\n<h5 id=\"worker-pod-parameters\">Worker pod parameters</h5>\n\n<table>\n <thead>\n <tr>\n <th>Name</th>\n <th>Type</th>\n <th>Default</th>\n <th>description</th>\n </tr>\n </thead>\n <tbody>\n <tr>\n <td><code class=\"language-plaintext highlighter-rouge\">worker.*</code></td>\n <td>dict</td>\n <td> </td>\n <td>NFD worker daemonset configuration</td>\n </tr>\n <tr>\n <td><code class=\"language-plaintext highlighter-rouge\">worker.config</code></td>\n <td>dict</td>\n <td> </td>\n <td>NFD worker <a href=\"/node-feature-discovery/master/advanced/worker-configuration-reference.html\">configuration</a></td>\n </tr>\n <tr>\n <td><code class=\"language-plaintext highlighter-rouge\">worker.podSecurityContext</code></td>\n <td>dict</td>\n <td>{}</td>\n <td>SecurityContext holds pod-level security attributes and common container settings</td>\n </tr>\n <tr>\n <td><code class=\"language-plaintext highlighter-rouge\">worker.securityContext</code></td>\n <td>dict</td>\n <td>{}</td>\n <td>Container <a href=\"https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod\">security settings</a></td>\n </tr>\n <tr>\n <td><code class=\"language-plaintext highlighter-rouge\">worker.resources</code></td>\n <td>dict</td>\n <td>{}</td>\n <td>NFD worker pod <a href=\"https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/\">resources management</a></td>\n </tr>\n <tr>\n <td><code class=\"language-plaintext highlighter-rouge\">worker.nodeSelector</code></td>\n <td>dict</td>\n <td>{}</td>\n <td>NFD worker pod <a href=\"https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector\">node selector</a></td>\n </tr>\n <tr>\n <td><code class=\"language-plaintext highlighter-rouge\">worker.tolerations</code></td>\n <td>dict</td>\n <td>{}</td>\n <td>NFD worker pod <a href=\"https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/\">node tolerations</a></td>\n </tr>\n <tr>\n <td><code class=\"language-plaintext highlighter-rouge\">worker.annotations</code></td>\n <td>dict</td>\n <td>{}</td>\n <td>NFD worker pod <a href=\"https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/\">metadata</a></td>\n </tr>\n </tbody>\n</table>\n\n<h5 id=\"topology-updater-parameters\">Topology updater parameters</h5>\n\n<table>\n <thead>\n <tr>\n <th>Name</th>\n <th>Type</th>\n <th>Default</th>\n <th>description</th>\n </tr>\n </thead>\n <tbody>\n <tr>\n <td><code class=\"language-plaintext highlighter-rouge\">topologyUpdater.*</code></td>\n <td>dict</td>\n <td> </td>\n <td>NFD Topology Updater configuration</td>\n </tr>\n <tr>\n <td><code class=\"language-plaintext highlighter-rouge\">topologyUpdater.enable</code></td>\n <td>bool</td>\n <td>false</td>\n <td>Specifies whether the NFD Topology Updater should be created</td>\n </tr>\n <tr>\n <td><code class=\"language-plaintext highlighter-rouge\">topologyUpdater.createCRDs</code></td>\n <td>bool</td>\n <td>false</td>\n <td>Specifies whether the NFD Topology Updater CRDs should be created</td>\n </tr>\n <tr>\n <td><code class=\"language-plaintext highlighter-rouge\">topologyUpdater.serviceAccount.create</code></td>\n <td>bool</td>\n <td>true</td>\n <td>Specifies whether the service account for topology updater should be created</td>\n </tr>\n <tr>\n <td><code class=\"language-plaintext highlighter-rouge\">topologyUpdater.serviceAccount.annotations</code></td>\n <td>dict</td>\n <td>{}</td>\n <td>Annotations to add to the service account for topology updater</td>\n </tr>\n <tr>\n <td><code class=\"language-plaintext highlighter-rouge\">topologyUpdater.serviceAccount.name</code></td>\n <td>string</td>\n <td> </td>\n <td>The name of the service account for topology updater to use. If not set and create is true, a name is generated using the fullname template and <code class=\"language-plaintext highlighter-rouge\">-topology-updater</code> suffix</td>\n </tr>\n <tr>\n <td><code class=\"language-plaintext highlighter-rouge\">topologyUpdater.rbac</code></td>\n <td>dict</td>\n <td> </td>\n <td>RBAC <a href=\"https://kubernetes.io/docs/reference/access-authn-authz/rbac/\">parameteres</a> for the topology updater</td>\n </tr>\n <tr>\n <td><code class=\"language-plaintext highlighter-rouge\">topologyUpdater.rbac.create</code></td>\n <td>bool</td>\n <td>false</td>\n <td>Specifies whether the cluster role and binding for topology updater should be created</td>\n </tr>\n <tr>\n <td><code class=\"language-plaintext highlighter-rouge\">topologyUpdater.kubeletConfigPath</code></td>\n <td>string</td>\n <td>””</td>\n <td>Specifies the kubelet config host path</td>\n </tr>\n <tr>\n <td><code class=\"language-plaintext highlighter-rouge\">topologyUpdater.kubeletPodResourcesSockPath</code></td>\n <td>string</td>\n <td>””</td>\n <td>Specifies the kubelet sock path to read pod resources</td>\n </tr>\n <tr>\n <td><code class=\"language-plaintext highlighter-rouge\">topologyUpdater.updateInterval</code></td>\n <td>string</td>\n <td>60s</td>\n <td>Time to sleep between CR updates. Non-positive value implies no CR update.</td>\n </tr>\n <tr>\n <td><code class=\"language-plaintext highlighter-rouge\">topologyUpdater.watchNamespace</code></td>\n <td>string</td>\n <td><code class=\"language-plaintext highlighter-rouge\">*</code></td>\n <td>Namespace to watch pods, <code class=\"language-plaintext highlighter-rouge\">*</code> for all namespaces</td>\n </tr>\n <tr>\n <td><code class=\"language-plaintext highlighter-rouge\">topologyUpdater.podSecurityContext</code></td>\n <td>dict</td>\n <td>{}</td>\n <td>SecurityContext holds pod-level security attributes and common container settings</td>\n </tr>\n <tr>\n <td><code class=\"language-plaintext highlighter-rouge\">topologyUpdater.securityContext</code></td>\n <td>dict</td>\n <td>{}</td>\n <td>Container <a href=\"https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod\">security settings</a></td>\n </tr>\n <tr>\n <td><code class=\"language-plaintext highlighter-rouge\">topologyUpdater.resources</code></td>\n <td>dict</td>\n <td>{}</td>\n <td>Topology updater pod <a href=\"https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/\">resources management</a></td>\n </tr>\n <tr>\n <td><code class=\"language-plaintext highlighter-rouge\">topologyUpdater.nodeSelector</code></td>\n <td>dict</td>\n <td>{}</td>\n <td>Topology updater pod <a href=\"https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector\">node selector</a></td>\n </tr>\n <tr>\n <td><code class=\"language-plaintext highlighter-rouge\">topologyUpdater.tolerations</code></td>\n <td>dict</td>\n <td>{}</td>\n <td>Topology updater pod <a href=\"https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/\">node tolerations</a></td>\n </tr>\n <tr>\n <td><code class=\"language-plaintext highlighter-rouge\">topologyUpdater.annotations</code></td>\n <td>dict</td>\n <td>{}</td>\n <td>Topology updater pod <a href=\"https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/\">metadata</a></td>\n </tr>\n <tr>\n <td><code class=\"language-plaintext highlighter-rouge\">topologyUpdater.affinity</code></td>\n <td>dict</td>\n <td>{}</td>\n <td>Topology updater pod <a href=\"https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes-using-node-affinity/\">affinity</a></td>\n </tr>\n </tbody>\n</table>\n\n<h3 id=\"build-your-own\">Build your own</h3>\n\n<p>If you want to use the latest development version (master branch) you need to\nbuild your own custom image.\nSee the <a href=\"../advanced/developer-guide\">Developer Guide</a> for instructions how to\nbuild images and deploy them on your cluster.</p>\n\n<h2 id=\"usage\">Usage</h2>\n\n<h3 id=\"nfd-master\">NFD-Master</h3>\n\n<p>NFD-Master runs as a deployment (with a replica count of 1), by default\nit prefers running on the cluster’s master nodes but will run on worker\nnodes if no master nodes are found.</p>\n\n<p>For High Availability, you should simply increase the replica count of\nthe deployment object. You should also look into adding\n<a href=\"https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity\">inter-pod</a>\naffinity to prevent masters from running on the same node.\nHowever note that inter-pod affinity is costly and is not recommended\nin bigger clusters.</p>\n\n<p>NFD-Master listens for connections from nfd-worker(s) and connects to the\nKubernetes API server to add node labels advertised by them.</p>\n\n<p>If you have RBAC authorization enabled (as is the default e.g. with clusters\ninitialized with kubeadm) you need to configure the appropriate ClusterRoles,\nClusterRoleBindings and a ServiceAccount in order for NFD to create node\nlabels. The provided template will configure these for you.</p>\n\n<h3 id=\"nfd-worker\">NFD-Worker</h3>\n\n<p>NFD-Worker is preferably run as a Kubernetes DaemonSet. This assures\nre-labeling on regular intervals capturing changes in the system configuration\nand makes sure that new nodes are labeled as they are added to the cluster.\nWorker connects to the nfd-master service to advertise hardware features.</p>\n\n<p>When run as a daemonset, nodes are re-labeled at an default interval of 60s.\nThis can be changed by using the\n<a href=\"../advanced/worker-configuration-reference.html#coresleepinterval\"><code class=\"language-plaintext highlighter-rouge\">core.sleepInterval</code></a>\nconfig option (or\n<a href=\"../advanced/worker-commandline-reference.html#-sleep-interval\"><code class=\"language-plaintext highlighter-rouge\">-sleep-interval</code></a>\ncommand line flag).</p>\n\n<p>The worker configuration file is watched and re-read on every change which\nprovides a simple mechanism of dynamic run-time reconfiguration. See\n<a href=\"#worker-configuration\">worker configuration</a> for more details.</p>\n\n<h3 id=\"nfd-topology-updater\">NFD-Topology-Updater</h3>\n\n<p>NFD-Topology-Updater is preferably run as a Kubernetes DaemonSet. This assures\nre-examination (and CR updates) on regular intervals capturing changes in\nthe allocated resources and hence the allocatable resources on a per zone\nbasis. It makes sure that more CR instances are created as new nodes get\nadded to the cluster. Topology-Updater connects to the nfd-master service\nto create CR instances corresponding to nodes.</p>\n\n<p>When run as a daemonset, nodes are re-examined for the allocated resources\n(to determine the information of the allocatable resources on a per zone basis\nwhere a zone can be a NUMA node) at an interval specified using the\n<code class=\"language-plaintext highlighter-rouge\">-sleep-interval</code> option. The default sleep interval is set to 60s which is the\n the value when no -sleep-interval is specified.</p>\n\n<h3 id=\"communication-security-with-tls\">Communication security with TLS</h3>\n\n<p>NFD supports mutual TLS authentication between the nfd-master and nfd-worker\ninstances. That is, nfd-worker and nfd-master both verify that the other end\npresents a valid certificate.</p>\n\n<p>TLS authentication is enabled by specifying <code class=\"language-plaintext highlighter-rouge\">-ca-file</code>, <code class=\"language-plaintext highlighter-rouge\">-key-file</code> and\n<code class=\"language-plaintext highlighter-rouge\">-cert-file</code> args, on both the nfd-master and nfd-worker instances.\nThe template specs provided with NFD contain (commented out) example\nconfiguration for enabling TLS authentication.</p>\n\n<p>The Common Name (CN) of the nfd-master certificate must match the DNS name of\nthe nfd-master Service of the cluster. By default, nfd-master only check that\nthe nfd-worker has been signed by the specified root certificate (-ca-file).\nAdditional hardening can be enabled by specifying -verify-node-name in\nnfd-master args, in which case nfd-master verifies that the NodeName presented\nby nfd-worker matches the Common Name (CN) or a Subject Alternative Name (SAN)\nof its certificate.</p>\n\n<h4 id=\"automated-tls-certificate-management-using-cert-manager\">Automated TLS certificate management using cert-manager</h4>\n\n<p><a href=\"https://cert-manager.io/\">cert-manager</a> can be used to automate certificate\nmanagement between nfd-master and the nfd-worker pods.</p>\n\n<p>NFD source code repository contains an example kustomize overlay that can be\nused to deploy NFD with cert-manager supplied certificates enabled. The\ninstructions below describe steps how to generate a self-signed CA certificate\nand set up cert-manager’s\n<a href=\"https://cert-manager.io/docs/configuration/ca/\">CA Issuer</a> to sign\n<code class=\"language-plaintext highlighter-rouge\">Certificate</code> requests for NFD components in <code class=\"language-plaintext highlighter-rouge\">node-feature-discovery</code>\nnamespace.</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>kubectl apply <span class=\"nt\">-f</span> https://github.com/jetstack/cert-manager/releases/download/v1.5.1/cert-manager.yaml\nopenssl genrsa <span class=\"nt\">-out</span> deployment/overlays/samples/cert-manager/tls.key 2048\nopenssl req <span class=\"nt\">-x509</span> <span class=\"nt\">-new</span> <span class=\"nt\">-nodes</span> <span class=\"nt\">-key</span> deployment/overlays/samples/cert-manager/tls.key <span class=\"nt\">-subj</span> <span class=\"s2\">\"/CN=nfd-ca\"</span> <span class=\"se\">\\</span>\n        <span class=\"nt\">-days</span> 10000 <span class=\"nt\">-out</span> deployment/overlays/samples/cert-manager/tls.crt\nkubectl apply <span class=\"nt\">-k</span> deployment/overlays/samples/cert-manager\n</code></pre>  </div></div>\n\n<h2 id=\"worker-configuration\">Worker configuration</h2>\n\n<p>NFD-Worker supports dynamic configuration through a configuration file. The\ndefault location is <code class=\"language-plaintext highlighter-rouge\">/etc/kubernetes/node-feature-discovery/nfd-worker.conf</code>,\nbut, this can be changed by specifying the<code class=\"language-plaintext highlighter-rouge\">-config</code> command line flag.\nConfiguration file is re-read whenever it is modified which makes run-time\nre-configuration of nfd-worker straightforward.</p>\n\n<p>Worker configuration file is read inside the container, and thus, Volumes and\nVolumeMounts are needed to make your configuration available for NFD. The\npreferred method is to use a ConfigMap which provides easy deployment and\nre-configurability.</p>\n\n<p>The provided nfd-worker deployment templates create an empty configmap and\nmount it inside the nfd-worker containers. In kustomize deployments,\nconfiguration can be edited with:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>kubectl <span class=\"nt\">-n</span> <span class=\"k\">${</span><span class=\"nv\">NFD_NS</span><span class=\"k\">}</span> edit configmap nfd-worker-conf\n</code></pre>  </div></div>\n\n<p>In Helm deployments, <a href=\"#worker-pod-parameters\">Worker pod parameter</a>\n<code class=\"language-plaintext highlighter-rouge\">worker.config</code> can be used to edit the respective configuration.</p>\n\n<p>See\n<a href=\"/node-feature-discovery/master/advanced/worker-configuration-reference.html\">nfd-worker configuration file reference</a>\nfor more details.\nThe (empty-by-default)\n<a href=\"https://github.com/kubernetes-sigs/node-feature-discovery/blob/master/deployment/components/worker-config/nfd-worker.conf.example\">example config</a>\ncontains all available configuration options and can be used as a reference\nfor creating creating a configuration.</p>\n\n<p>Configuration options can also be specified via the <code class=\"language-plaintext highlighter-rouge\">-options</code> command line\nflag, in which case no mounts need to be used. The same format as in the config\nfile must be used, i.e. JSON (or YAML). For example:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code><span class=\"nt\">-options</span><span class=\"o\">=</span><span class=\"s1\">'{\"sources\": { \"pci\": { \"deviceClassWhitelist\": [\"12\"] } } }'</span>\n</code></pre>  </div></div>\n\n<p>Configuration options specified from the command line will override those read\nfrom the config file.</p>\n\n<h2 id=\"using-node-labels\">Using node labels</h2>\n\n<p>Nodes with specific features can be targeted using the <code class=\"language-plaintext highlighter-rouge\">nodeSelector</code> field. The\nfollowing example shows how to target nodes with Intel TurboBoost enabled.</p>\n\n<div class=\"language-yaml highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code><span class=\"na\">apiVersion</span><span class=\"pi\">:</span> <span class=\"s\">v1</span>\n<span class=\"na\">kind</span><span class=\"pi\">:</span> <span class=\"s\">Pod</span>\n<span class=\"na\">metadata</span><span class=\"pi\">:</span>\n  <span class=\"na\">labels</span><span class=\"pi\">:</span>\n    <span class=\"na\">env</span><span class=\"pi\">:</span> <span class=\"s\">test</span>\n  <span class=\"na\">name</span><span class=\"pi\">:</span> <span class=\"s\">golang-test</span>\n<span class=\"na\">spec</span><span class=\"pi\">:</span>\n  <span class=\"na\">containers</span><span class=\"pi\">:</span>\n    <span class=\"pi\">-</span> <span class=\"na\">image</span><span class=\"pi\">:</span> <span class=\"s\">golang</span>\n      <span class=\"na\">name</span><span class=\"pi\">:</span> <span class=\"s\">go1</span>\n  <span class=\"na\">nodeSelector</span><span class=\"pi\">:</span>\n    <span class=\"s\">feature.node.kubernetes.io/cpu-pstate.turbo</span><span class=\"pi\">:</span> <span class=\"s1\">'</span><span class=\"s\">true'</span>\n</code></pre>  </div></div>\n\n<p>For more details on targeting nodes, see\n<a href=\"https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/\">node selection</a>.</p>\n\n<h2 id=\"uninstallation\">Uninstallation</h2>\n\n<h3 id=\"operator-was-used-for-deployment\">Operator was used for deployment</h3>\n\n<p>If you followed the deployment instructions above you can simply do:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>kubectl <span class=\"nt\">-n</span> nfd delete NodeFeatureDiscovery my-nfd-deployment\n</code></pre>  </div></div>\n\n<p>Optionally, you can also remove the namespace:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>kubectl delete ns nfd\n</code></pre>  </div></div>\n\n<p>See the <a href=\"https://github.com/kubernetes-sigs/node-feature-discovery-operator\">node-feature-discovery-operator</a> and <a href=\"https://github.com/operator-framework/operator-lifecycle-manager\">OLM</a> project\ndocumentation for instructions for uninstalling the operator and operator\nlifecycle manager, respectively.</p>\n\n<h3 id=\"manual\">Manual</h3>\n\n<p>Simplest way is to invoke <code class=\"language-plaintext highlighter-rouge\">kubectl delete</code> on the deployment files you used.\nBeware that this will also delete the namespace that NFD is running in. For\nexample, in case the default deployment from the repo was used:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>\nkubectl delete <span class=\"nt\">-k</span> https://github.com/kubernetes-sigs/node-feature-discovery/deployment/overlays/default?ref<span class=\"o\">=</span>master\n</code></pre>  </div></div>\n\n<p>Alternatively you can delete create objects one-by-one, depending on the type\nof deployment, for example:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code><span class=\"nv\">NFD_NS</span><span class=\"o\">=</span>node-feature-discovery\nkubectl <span class=\"nt\">-n</span> <span class=\"nv\">$NFD_NS</span> delete ds nfd-worker\nkubectl <span class=\"nt\">-n</span> <span class=\"nv\">$NFD_NS</span> delete deploy nfd-master\nkubectl <span class=\"nt\">-n</span> <span class=\"nv\">$NFD_NS</span> delete svc nfd-master\nkubectl <span class=\"nt\">-n</span> <span class=\"nv\">$NFD_NS</span> delete sa nfd-master\nkubectl delete clusterrole nfd-master\nkubectl delete clusterrolebinding nfd-master\n</code></pre>  </div></div>\n\n<h3 id=\"removing-feature-labels\">Removing feature labels</h3>\n\n<p>NFD-Master has a special <code class=\"language-plaintext highlighter-rouge\">-prune</code> command line flag for removing all\nnfd-related node labels, annotations and extended resources from the cluster.</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>kubectl apply <span class=\"nt\">-k</span> https://github.com/kubernetes-sigs/node-feature-discovery/deployment/overlays/prune?ref<span class=\"o\">=</span>master\nkubectl <span class=\"nt\">-n</span> node-feature-discovery <span class=\"nb\">wait </span>job.batch/nfd-prune <span class=\"nt\">--for</span><span class=\"o\">=</span><span class=\"nv\">condition</span><span class=\"o\">=</span><span class=\"nb\">complete</span> <span class=\"o\">&amp;&amp;</span> <span class=\"se\">\\</span>\n    kubectl delete <span class=\"nt\">-k</span> https://github.com/kubernetes-sigs/node-feature-discovery/deployment/overlays/prune?ref<span class=\"o\">=</span>master\n</code></pre>  </div></div>\n\n<p><strong>NOTE:</strong> You must run prune before removing the RBAC rules (serviceaccount,\nclusterrole and clusterrolebinding).</p>\n\n<!-- Links -->\n","dir":"/get-started/","name":"deployment-and-usage.md","path":"get-started/deployment-and-usage.md","url":"/get-started/deployment-and-usage.html"},{"title":"Worker config reference","layout":"default","sort":4,"content":"<h1 class=\"no_toc\" id=\"configuration-file-reference-of-nfd-worker\">Configuration file reference of nfd-worker</h1>\n\n<h2 class=\"no_toc text-delta\" id=\"table-of-contents\">Table of contents</h2>\n\n<ol id=\"markdown-toc\">\n <li><a href=\"#core\" id=\"markdown-toc-core\">core</a> <ol>\n <li><a href=\"#coresleepinterval\" id=\"markdown-toc-coresleepinterval\">core.sleepInterval</a></li>\n <li><a href=\"#corelabelsources\" id=\"markdown-toc-corelabelsources\">core.labelSources</a></li>\n <li><a href=\"#coresources\" id=\"markdown-toc-coresources\">core.sources</a></li>\n <li><a href=\"#corelabelwhitelist\" id=\"markdown-toc-corelabelwhitelist\">core.labelWhiteList</a></li>\n <li><a href=\"#corenopublish\" id=\"markdown-toc-corenopublish\">core.noPublish</a></li>\n <li><a href=\"#coreklog\" id=\"markdown-toc-coreklog\">core.klog</a></li>\n </ol>\n </li>\n <li><a href=\"#sources\" id=\"markdown-toc-sources\">sources</a> <ol>\n <li><a href=\"#sourcescpu\" id=\"markdown-toc-sourcescpu\">sources.cpu</a></li>\n <li><a href=\"#sourceskernel\" id=\"markdown-toc-sourceskernel\">sources.kernel</a></li>\n <li><a href=\"#sourespci\" id=\"markdown-toc-sourespci\">soures.pci</a></li>\n <li><a href=\"#sourcesusb\" id=\"markdown-toc-sourcesusb\">sources.usb</a></li>\n <li><a href=\"#sourcescustom\" id=\"markdown-toc-sourcescustom\">sources.custom</a></li>\n </ol>\n </li>\n</ol>\n\n<hr />\n\n<p>See the\n<a href=\"https://github.com/kubernetes-sigs/node-feature-discovery/blob/master/deployment/components/worker-config/nfd-worker.conf.example\">sample configuration file</a>\nfor a full example configuration.</p>\n\n<h2 id=\"core\">core</h2>\n\n<p>The <code class=\"language-plaintext highlighter-rouge\">core</code> section contains common configuration settings that are not specific\nto any particular feature source.</p>\n\n<h3 id=\"coresleepinterval\">core.sleepInterval</h3>\n\n<p><code class=\"language-plaintext highlighter-rouge\">core.sleepInterval</code> specifies the interval between consecutive passes of\nfeature (re-)detection, and thus also the interval between node re-labeling. A\nnon-positive value implies infinite sleep interval, i.e. no re-detection or\nre-labeling is done.</p>\n\n<p>Note: Overridden by the deprecated <code class=\"language-plaintext highlighter-rouge\">-sleep-interval</code> command line flag (if\nspecified).</p>\n\n<p>Default: <code class=\"language-plaintext highlighter-rouge\">60s</code></p>\n\n<p>Example:</p>\n\n<div class=\"language-yaml highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code><span class=\"na\">core</span><span class=\"pi\">:</span>\n  <span class=\"na\">sleepInterval</span><span class=\"pi\">:</span> <span class=\"s\">60s</span>\n</code></pre>  </div></div>\n\n<h3 id=\"corelabelsources\">core.labelSources</h3>\n\n<p><code class=\"language-plaintext highlighter-rouge\">core.labelSources</code> specifies the list of enabled label sources. A special\nvalue <code class=\"language-plaintext highlighter-rouge\">all</code> enables all sources.</p>\n\n<p>Note: Overridden by the <code class=\"language-plaintext highlighter-rouge\">-label-sources</code> command line flag (if specified).</p>\n\n<p>Default: <code class=\"language-plaintext highlighter-rouge\">[all]</code></p>\n\n<p>Example:</p>\n\n<div class=\"language-yaml highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code><span class=\"na\">core</span><span class=\"pi\">:</span>\n  <span class=\"na\">sources</span><span class=\"pi\">:</span>\n    <span class=\"pi\">-</span> <span class=\"s\">system</span>\n    <span class=\"pi\">-</span> <span class=\"s\">custom</span>\n</code></pre>  </div></div>\n\n<h3 id=\"coresources\">core.sources</h3>\n\n<p><strong>DEPRECATED</strong>: use <a href=\"#core.labelSources\"><code class=\"language-plaintext highlighter-rouge\">core.labelSources</code></a> instead.</p>\n\n<p>Note: <code class=\"language-plaintext highlighter-rouge\">core.sources</code> takes precedence over the <code class=\"language-plaintext highlighter-rouge\">core.labelSources</code>\nconfiguration file option.</p>\n\n<h3 id=\"corelabelwhitelist\">core.labelWhiteList</h3>\n\n<p><code class=\"language-plaintext highlighter-rouge\">core.labelWhiteList</code> specifies a regular expression for filtering feature\nlabels based on the label name. Non-matching labels are not published.</p>\n\n<p>Note: The regular expression is only matches against the “basename” part of the\nlabel, i.e. to the part of the name after ‘/’. The label prefix (or namespace)\nis omitted.</p>\n\n<p>Note: Overridden by the deprecated <code class=\"language-plaintext highlighter-rouge\">-label-whitelist</code> command line flag (if\nspecified).</p>\n\n<p>Default: <code class=\"language-plaintext highlighter-rouge\">null</code></p>\n\n<p>Example:</p>\n\n<div class=\"language-yaml highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code><span class=\"na\">core</span><span class=\"pi\">:</span>\n  <span class=\"na\">labelWhiteList</span><span class=\"pi\">:</span> <span class=\"s1\">'</span><span class=\"s\">^cpu-cpuid'</span>\n</code></pre>  </div></div>\n\n<h3 id=\"corenopublish\">core.noPublish</h3>\n\n<p>Setting <code class=\"language-plaintext highlighter-rouge\">core.noPublish</code> to <code class=\"language-plaintext highlighter-rouge\">true</code> disables all communication with the\nnfd-master. It is effectively a “dry-run” flag: nfd-worker runs feature\ndetection normally, but no labeling requests are sent to nfd-master.</p>\n\n<p>Note: Overridden by the <code class=\"language-plaintext highlighter-rouge\">-no-publish</code> command line flag (if specified).</p>\n\n<p>Default: <code class=\"language-plaintext highlighter-rouge\">false</code></p>\n\n<p>Example:</p>\n\n<div class=\"language-yaml highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code><span class=\"na\">core</span><span class=\"pi\">:</span>\n  <span class=\"na\">noPublish</span><span class=\"pi\">:</span> <span class=\"no\">true</span>\n</code></pre>  </div></div>\n\n<h3 id=\"coreklog\">core.klog</h3>\n\n<p>The following options specify the logger configuration. Most of which can be\ndynamically adjusted at run-time.</p>\n\n<p>Note: The logger options can also be specified via command line flags which\ntake precedence over any corresponding config file options.</p>\n\n<h4 id=\"coreklogadddirheader\">core.klog.addDirHeader</h4>\n\n<p>If true, adds the file directory to the header of the log messages.</p>\n\n<p>Default: <code class=\"language-plaintext highlighter-rouge\">false</code></p>\n\n<p>Run-time configurable: yes</p>\n\n<h4 id=\"coreklogalsologtostderr\">core.klog.alsologtostderr</h4>\n\n<p>Log to standard error as well as files.</p>\n\n<p>Default: <code class=\"language-plaintext highlighter-rouge\">false</code></p>\n\n<p>Run-time configurable: yes</p>\n\n<h4 id=\"corekloglogbacktraceat\">core.klog.logBacktraceAt</h4>\n\n<p>When logging hits line file:N, emit a stack trace.</p>\n\n<p>Default: <em>empty</em></p>\n\n<p>Run-time configurable: yes</p>\n\n<h4 id=\"corekloglogdir\">core.klog.logDir</h4>\n\n<p>If non-empty, write log files in this directory.</p>\n\n<p>Default: <em>empty</em></p>\n\n<p>Run-time configurable: no</p>\n\n<h4 id=\"corekloglogfile\">core.klog.logFile</h4>\n\n<p>If non-empty, use this log file.</p>\n\n<p>Default: <em>empty</em></p>\n\n<p>Run-time configurable: no</p>\n\n<h4 id=\"corekloglogfilemaxsize\">core.klog.logFileMaxSize</h4>\n\n<p>Defines the maximum size a log file can grow to. Unit is megabytes. If the\nvalue is 0, the maximum file size is unlimited.</p>\n\n<p>Default: <code class=\"language-plaintext highlighter-rouge\">1800</code></p>\n\n<p>Run-time configurable: no</p>\n\n<h4 id=\"corekloglogtostderr\">core.klog.logtostderr</h4>\n\n<p>Log to standard error instead of files</p>\n\n<p>Default: <code class=\"language-plaintext highlighter-rouge\">true</code></p>\n\n<p>Run-time configurable: yes</p>\n\n<h4 id=\"coreklogskipheaders\">core.klog.skipHeaders</h4>\n\n<p>If true, avoid header prefixes in the log messages.</p>\n\n<p>Default: <code class=\"language-plaintext highlighter-rouge\">false</code></p>\n\n<p>Run-time configurable: yes</p>\n\n<h4 id=\"coreklogskiplogheaders\">core.klog.skipLogHeaders</h4>\n\n<p>If true, avoid headers when opening log files.</p>\n\n<p>Default: <code class=\"language-plaintext highlighter-rouge\">false</code></p>\n\n<p>Run-time configurable: no</p>\n\n<h4 id=\"coreklogstderrthreshold\">core.klog.stderrthreshold</h4>\n\n<p>Logs at or above this threshold go to stderr (default 2)</p>\n\n<p>Run-time configurable: yes</p>\n\n<h4 id=\"coreklogv\">core.klog.v</h4>\n\n<p>Number for the log level verbosity.</p>\n\n<p>Default: <code class=\"language-plaintext highlighter-rouge\">0</code></p>\n\n<p>Run-time configurable: yes</p>\n\n<h4 id=\"coreklogvmodule\">core.klog.vmodule</h4>\n\n<p>Comma-separated list of <code class=\"language-plaintext highlighter-rouge\">pattern=N</code> settings for file-filtered logging.</p>\n\n<p>Default: <em>empty</em></p>\n\n<p>Run-time configurable: yes</p>\n\n<h2 id=\"sources\">sources</h2>\n\n<p>The <code class=\"language-plaintext highlighter-rouge\">sources</code> section contains feature source specific configuration parameters.</p>\n\n<h3 id=\"sourcescpu\">sources.cpu</h3>\n\n<h4 id=\"sourcescpucpuid\">sources.cpu.cpuid</h4>\n\n<h5 id=\"sourcescpucpuidattributeblacklist\">sources.cpu.cpuid.attributeBlacklist</h5>\n\n<p>Prevent publishing cpuid features listed in this option.</p>\n\n<p>Note: overridden by <code class=\"language-plaintext highlighter-rouge\">sources.cpu.cpuid.attributeWhitelist</code> (if specified)</p>\n\n<p>Default: <code class=\"language-plaintext highlighter-rouge\">[BMI1, BMI2, CLMUL, CMOV, CX16, ERMS, F16C, HTT, LZCNT, MMX, MMXEXT,\nNX, POPCNT, RDRAND, RDSEED, RDTSCP, SGX, SGXLC, SSE, SSE2, SSE3, SSE4.1,\nSSE4.2, SSSE3]</code></p>\n\n<p>Example:</p>\n\n<div class=\"language-yaml highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code><span class=\"na\">sources</span><span class=\"pi\">:</span>\n  <span class=\"na\">cpu</span><span class=\"pi\">:</span>\n    <span class=\"na\">cpuid</span><span class=\"pi\">:</span>\n      <span class=\"na\">attributeBlacklist</span><span class=\"pi\">:</span> <span class=\"pi\">[</span><span class=\"nv\">MMX</span><span class=\"pi\">,</span> <span class=\"nv\">MMXEXT</span><span class=\"pi\">]</span>\n</code></pre>  </div></div>\n\n<h5 id=\"sourcescpucpuidattributewhitelist\">sources.cpu.cpuid.attributeWhitelist</h5>\n\n<p>Only publish the cpuid features listed in this option.</p>\n\n<p>Note: takes precedence over <code class=\"language-plaintext highlighter-rouge\">sources.cpu.cpuid.attributeBlacklist</code></p>\n\n<p>Default: <em>empty</em></p>\n\n<p>Example:</p>\n\n<div class=\"language-yaml highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code><span class=\"na\">sources</span><span class=\"pi\">:</span>\n  <span class=\"na\">cpu</span><span class=\"pi\">:</span>\n    <span class=\"na\">cpuid</span><span class=\"pi\">:</span>\n      <span class=\"na\">attributeWhitelist</span><span class=\"pi\">:</span> <span class=\"pi\">[</span><span class=\"nv\">AVX512BW</span><span class=\"pi\">,</span> <span class=\"nv\">AVX512CD</span><span class=\"pi\">,</span> <span class=\"nv\">AVX512DQ</span><span class=\"pi\">,</span> <span class=\"nv\">AVX512F</span><span class=\"pi\">,</span> <span class=\"nv\">AVX512VL</span><span class=\"pi\">]</span>\n</code></pre>  </div></div>\n\n<h3 id=\"sourceskernel\">sources.kernel</h3>\n\n<h4 id=\"sourceskernelkconfigfile\">sources.kernel.kconfigFile</h4>\n\n<p>Path of the kernel config file. If empty, NFD runs a search in the well-known\nstandard locations.</p>\n\n<p>Default: <em>empty</em></p>\n\n<p>Example:</p>\n\n<div class=\"language-yaml highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code><span class=\"na\">sources</span><span class=\"pi\">:</span>\n  <span class=\"na\">kernel</span><span class=\"pi\">:</span>\n    <span class=\"na\">kconfigFile</span><span class=\"pi\">:</span> <span class=\"s2\">\"</span><span class=\"s\">/path/to/kconfig\"</span>\n</code></pre>  </div></div>\n\n<h4 id=\"sourceskernelconfigopts\">sources.kernel.configOpts</h4>\n\n<p>Kernel configuration options to publish as feature labels.</p>\n\n<p>Default: <code class=\"language-plaintext highlighter-rouge\">[NO_HZ, NO_HZ_IDLE, NO_HZ_FULL, PREEMPT]</code></p>\n\n<p>Example:</p>\n\n<div class=\"language-yaml highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code><span class=\"na\">sources</span><span class=\"pi\">:</span>\n  <span class=\"na\">kernel</span><span class=\"pi\">:</span>\n    <span class=\"na\">configOpts</span><span class=\"pi\">:</span> <span class=\"pi\">[</span><span class=\"nv\">NO_HZ</span><span class=\"pi\">,</span> <span class=\"nv\">X86</span><span class=\"pi\">,</span> <span class=\"nv\">DMI</span><span class=\"pi\">]</span>\n</code></pre>  </div></div>\n\n<h3 id=\"sourespci\">soures.pci</h3>\n\n<h4 id=\"sourespcideviceclasswhitelist\">soures.pci.deviceClassWhitelist</h4>\n\n<p>List of PCI <a href=\"https://pci-ids.ucw.cz/read/PD\">device class</a> IDs for which to\npublish a label. Can be specified as a main class only (e.g. <code class=\"language-plaintext highlighter-rouge\">03</code>) or full\nclass-subclass combination (e.g. <code class=\"language-plaintext highlighter-rouge\">0300</code>) - the former implies that all\nsubclasses are accepted. The format of the labels can be further configured\nwith <a href=\"#soures.pci.deviceLabelFields\">deviceLabelFields</a>.</p>\n\n<p>Default: <code class=\"language-plaintext highlighter-rouge\">[\"03\", \"0b40\", \"12\"]</code></p>\n\n<p>Example:</p>\n\n<div class=\"language-yaml highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code><span class=\"na\">sources</span><span class=\"pi\">:</span>\n  <span class=\"na\">pci</span><span class=\"pi\">:</span>\n    <span class=\"na\">deviceClassWhitelist</span><span class=\"pi\">:</span> <span class=\"pi\">[</span><span class=\"s2\">\"</span><span class=\"s\">0200\"</span><span class=\"pi\">,</span> <span class=\"s2\">\"</span><span class=\"s\">03\"</span><span class=\"pi\">]</span>\n</code></pre>  </div></div>\n\n<h4 id=\"sourespcidevicelabelfields\">soures.pci.deviceLabelFields</h4>\n\n<p>The set of PCI ID fields to use when constructing the name of the feature\nlabel. Valid fields are <code class=\"language-plaintext highlighter-rouge\">class</code>, <code class=\"language-plaintext highlighter-rouge\">vendor</code>, <code class=\"language-plaintext highlighter-rouge\">device</code>, <code class=\"language-plaintext highlighter-rouge\">subsystem_vendor</code> and\n<code class=\"language-plaintext highlighter-rouge\">subsystem_device</code>.</p>\n\n<p>Default: <code class=\"language-plaintext highlighter-rouge\">[class, vendor]</code></p>\n\n<p>Example:</p>\n\n<div class=\"language-yaml highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code><span class=\"na\">sources</span><span class=\"pi\">:</span>\n  <span class=\"na\">pci</span><span class=\"pi\">:</span>\n    <span class=\"na\">deviceLabelFields</span><span class=\"pi\">:</span> <span class=\"pi\">[</span><span class=\"nv\">class</span><span class=\"pi\">,</span> <span class=\"nv\">vendor</span><span class=\"pi\">,</span> <span class=\"nv\">device</span><span class=\"pi\">]</span>\n</code></pre>  </div></div>\n\n<p>With the example config above NFD would publish labels like:\n<code class=\"language-plaintext highlighter-rouge\">feature.node.kubernetes.io/pci-&lt;class-id&gt;_&lt;vendor-id&gt;_&lt;device-id&gt;.present=true</code></p>\n\n<h3 id=\"sourcesusb\">sources.usb</h3>\n\n<h4 id=\"souresusbdeviceclasswhitelist\">soures.usb.deviceClassWhitelist</h4>\n\n<p>List of USB <a href=\"https://www.usb.org/defined-class-codes\">device class</a> IDs for\nwhich to publish a feature label. The format of the labels can be further\nconfigured with <a href=\"#soures.usb.deviceLabelFields\">deviceLabelFields</a>.</p>\n\n<p>Default: <code class=\"language-plaintext highlighter-rouge\">[\"0e\", \"ef\", \"fe\", \"ff\"]</code></p>\n\n<p>Example:</p>\n\n<div class=\"language-yaml highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code><span class=\"na\">sources</span><span class=\"pi\">:</span>\n  <span class=\"na\">usb</span><span class=\"pi\">:</span>\n    <span class=\"na\">deviceClassWhitelist</span><span class=\"pi\">:</span> <span class=\"pi\">[</span><span class=\"s2\">\"</span><span class=\"s\">ef\"</span><span class=\"pi\">,</span> <span class=\"s2\">\"</span><span class=\"s\">ff\"</span><span class=\"pi\">]</span>\n</code></pre>  </div></div>\n\n<h4 id=\"souresusbdevicelabelfields\">soures.usb.deviceLabelFields</h4>\n\n<p>The set of USB ID fields from which to compose the name of the feature label.\nValid fields are <code class=\"language-plaintext highlighter-rouge\">class</code>, <code class=\"language-plaintext highlighter-rouge\">vendor</code>, <code class=\"language-plaintext highlighter-rouge\">device</code> and <code class=\"language-plaintext highlighter-rouge\">serial</code>.</p>\n\n<p>Default: <code class=\"language-plaintext highlighter-rouge\">[class, vendor, device]</code></p>\n\n<p>Example:</p>\n\n<div class=\"language-yaml highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code><span class=\"na\">sources</span><span class=\"pi\">:</span>\n  <span class=\"na\">pci</span><span class=\"pi\">:</span>\n    <span class=\"na\">deviceLabelFields</span><span class=\"pi\">:</span> <span class=\"pi\">[</span><span class=\"nv\">class</span><span class=\"pi\">,</span> <span class=\"nv\">vendor</span><span class=\"pi\">]</span>\n</code></pre>  </div></div>\n\n<p>With the example config above NFD would publish labels like:\n<code class=\"language-plaintext highlighter-rouge\">feature.node.kubernetes.io/usb-&lt;class-id&gt;_&lt;vendor-id&gt;.present=true</code></p>\n\n<h3 id=\"sourcescustom\">sources.custom</h3>\n\n<p>List of rules to process in the custom feature source to create user-specific\nlabels. Refer to the documentation of the\n<a href=\"../get-started/features.html#custom\">custom feature source</a> for details of\nthe available rules and their configuration.</p>\n\n<p>Default: <em>empty</em></p>\n\n<p>Example:</p>\n\n<div class=\"language-yaml highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code><span class=\"na\">source</span><span class=\"pi\">:</span>\n  <span class=\"na\">custom</span><span class=\"pi\">:</span>\n  <span class=\"pi\">-</span> <span class=\"na\">name</span><span class=\"pi\">:</span> <span class=\"s2\">\"</span><span class=\"s\">my.custom.feature\"</span>\n    <span class=\"na\">matchOn</span><span class=\"pi\">:</span>\n    <span class=\"pi\">-</span> <span class=\"na\">loadedKMod</span><span class=\"pi\">:</span> <span class=\"pi\">[</span><span class=\"s2\">\"</span><span class=\"s\">e1000e\"</span><span class=\"pi\">]</span>\n    <span class=\"pi\">-</span> <span class=\"na\">pciId</span><span class=\"pi\">:</span>\n        <span class=\"na\">class</span><span class=\"pi\">:</span> <span class=\"pi\">[</span><span class=\"s2\">\"</span><span class=\"s\">0200\"</span><span class=\"pi\">]</span>\n        <span class=\"na\">vendor</span><span class=\"pi\">:</span> <span class=\"pi\">[</span><span class=\"s2\">\"</span><span class=\"s\">8086\"</span><span class=\"pi\">]</span>\n</code></pre>  </div></div>\n","dir":"/advanced/","name":"worker-configuration-reference.md","path":"advanced/worker-configuration-reference.md","url":"/advanced/worker-configuration-reference.html"},{"title":"Examples and demos","layout":"default","sort":5,"content":"<h1 class=\"no_toc\" id=\"examples-and-demos\">Examples and demos</h1>\n\n<h2 class=\"no_toc text-delta\" id=\"table-of-contents\">Table of contents</h2>\n\n<ol id=\"markdown-toc\">\n <li><a href=\"#demos\" id=\"markdown-toc-demos\">Demos</a> <ol>\n <li><a href=\"#usage-demo\" id=\"markdown-toc-usage-demo\">Usage demo</a></li>\n <li><a href=\"#demo-use-case\" id=\"markdown-toc-demo-use-case\">Demo use case</a></li>\n </ol>\n </li>\n</ol>\n\n<hr />\n\n<p>This page contains usage examples and demos.</p>\n\n<h2 id=\"demos\">Demos</h2>\n\n<h3 id=\"usage-demo\">Usage demo</h3>\n\n<p><a href=\"https://asciinema.org/a/247316\"><img src=\"https://asciinema.org/a/247316.svg\" alt=\"asciicast\" /></a></p>\n\n<h3 id=\"demo-use-case\">Demo use case</h3>\n\n<p>A demo on the benefits of using node feature discovery can be found in the\nsource code repository under\n<a href=\"https://github.com/kubernetes-sigs/node-feature-discovery/tree/master/demo\">demo/</a>.</p>\n","dir":"/get-started/","name":"examples-and-demos.md","path":"get-started/examples-and-demos.md","url":"/get-started/examples-and-demos.html"},{"title":"Topology Updater Cmdline Reference","layout":"default","sort":5,"content":"<h1 id=\"nfd-topology-updater-commandline-flags\">NFD-Topology-Updater Commandline Flags</h1>\n\n<h2 class=\"no_toc\" id=\"table-of-contents\">Table of Contents</h2>\n\n<ol class=\"no_toc text-delta\" id=\"markdown-toc\">\n <li><a href=\"#nfd-topology-updater-commandline-flags\" id=\"markdown-toc-nfd-topology-updater-commandline-flags\">NFD-Topology-Updater Commandline Flags</a> <ol>\n <li><a href=\"#-h--help\" id=\"markdown-toc--h--help\">-h, -help</a></li>\n <li><a href=\"#-version\" id=\"markdown-toc--version\">-version</a></li>\n <li><a href=\"#-server\" id=\"markdown-toc--server\">-server</a></li>\n <li><a href=\"#-ca-file\" id=\"markdown-toc--ca-file\">-ca-file</a></li>\n <li><a href=\"#-cert-file\" id=\"markdown-toc--cert-file\">-cert-file</a></li>\n <li><a href=\"#-key-file\" id=\"markdown-toc--key-file\">-key-file</a></li>\n <li><a href=\"#-server-name-override\" id=\"markdown-toc--server-name-override\">-server-name-override</a></li>\n <li><a href=\"#-no-publish\" id=\"markdown-toc--no-publish\">-no-publish</a></li>\n <li><a href=\"#-oneshot\" id=\"markdown-toc--oneshot\">-oneshot</a></li>\n <li><a href=\"#-sleep-interval\" id=\"markdown-toc--sleep-interval\">-sleep-interval</a></li>\n <li><a href=\"#-watch-namespace\" id=\"markdown-toc--watch-namespace\">-watch-namespace</a></li>\n <li><a href=\"#-kubelet-config-file\" id=\"markdown-toc--kubelet-config-file\">-kubelet-config-file</a></li>\n <li><a href=\"#-podresources-socket\" id=\"markdown-toc--podresources-socket\">-podresources-socket</a></li>\n </ol>\n </li>\n</ol>\n\n<hr />\n\n<p>To quickly view available command line flags execute <code class=\"language-plaintext highlighter-rouge\">nfd-topology-updater -help</code>.\nIn a docker container:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>docker run gcr.io/k8s-staging-nfd/node-feature-discovery:master nfd-topology-updater <span class=\"nt\">-help</span>\n</code></pre>  </div></div>\n\n<h3 id=\"-h--help\">-h, -help</h3>\n\n<p>Print usage and exit.</p>\n\n<h3 id=\"-version\">-version</h3>\n\n<p>Print version and exit.</p>\n\n<h3 id=\"-server\">-server</h3>\n\n<p>The <code class=\"language-plaintext highlighter-rouge\">-server</code> flag specifies the address of the nfd-master endpoint where to\nconnect to.</p>\n\n<p>Default: localhost:8080</p>\n\n<p>Example:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>nfd-topology-updater <span class=\"nt\">-server</span><span class=\"o\">=</span>nfd-master.nfd.svc.cluster.local:443\n</code></pre>  </div></div>\n\n<h3 id=\"-ca-file\">-ca-file</h3>\n\n<p>The <code class=\"language-plaintext highlighter-rouge\">-ca-file</code> is one of the three flags (together with <code class=\"language-plaintext highlighter-rouge\">-cert-file</code> and\n<code class=\"language-plaintext highlighter-rouge\">-key-file</code>) controlling the mutual TLS authentication on the topology-updater side.\nThis flag specifies the TLS root certificate that is used for verifying the\nauthenticity of nfd-master.</p>\n\n<p>Default: <em>empty</em></p>\n\n<p>Note: Must be specified together with <code class=\"language-plaintext highlighter-rouge\">-cert-file</code> and <code class=\"language-plaintext highlighter-rouge\">-key-file</code></p>\n\n<p>Example:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>nfd-topology-updater <span class=\"nt\">-ca-file</span><span class=\"o\">=</span>/opt/nfd/ca.crt <span class=\"nt\">-cert-file</span><span class=\"o\">=</span>/opt/nfd/updater.crt <span class=\"nt\">-key-file</span><span class=\"o\">=</span>/opt/nfd/updater.key\n</code></pre>  </div></div>\n\n<h3 id=\"-cert-file\">-cert-file</h3>\n\n<p>The <code class=\"language-plaintext highlighter-rouge\">-cert-file</code> is one of the three flags (together with <code class=\"language-plaintext highlighter-rouge\">-ca-file</code> and\n<code class=\"language-plaintext highlighter-rouge\">-key-file</code>) controlling mutual TLS authentication on the topology-updater\nside. This flag specifies the TLS certificate presented for authenticating\noutgoing requests.</p>\n\n<p>Default: <em>empty</em></p>\n\n<p>Note: Must be specified together with <code class=\"language-plaintext highlighter-rouge\">-ca-file</code> and <code class=\"language-plaintext highlighter-rouge\">-key-file</code></p>\n\n<p>Example:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>nfd-topology-updater <span class=\"nt\">-cert-file</span><span class=\"o\">=</span>/opt/nfd/updater.crt <span class=\"nt\">-key-file</span><span class=\"o\">=</span>/opt/nfd/updater.key <span class=\"nt\">-ca-file</span><span class=\"o\">=</span>/opt/nfd/ca.crt\n</code></pre>  </div></div>\n\n<h3 id=\"-key-file\">-key-file</h3>\n\n<p>The <code class=\"language-plaintext highlighter-rouge\">-key-file</code> is one of the three flags (together with <code class=\"language-plaintext highlighter-rouge\">-ca-file</code> and\n<code class=\"language-plaintext highlighter-rouge\">-cert-file</code>) controlling the mutual TLS authentication on topology-updater\nside. This flag specifies the private key corresponding the given certificate file\n(<code class=\"language-plaintext highlighter-rouge\">-cert-file</code>) that is used for authenticating outgoing requests.</p>\n\n<p>Default: <em>empty</em></p>\n\n<p>Note: Must be specified together with <code class=\"language-plaintext highlighter-rouge\">-cert-file</code> and <code class=\"language-plaintext highlighter-rouge\">-ca-file</code></p>\n\n<p>Example:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>nfd-topology-updater <span class=\"nt\">-key-file</span><span class=\"o\">=</span>/opt/nfd/updater.key <span class=\"nt\">-cert-file</span><span class=\"o\">=</span>/opt/nfd/updater.crt <span class=\"nt\">-ca-file</span><span class=\"o\">=</span>/opt/nfd/ca.crt\n</code></pre>  </div></div>\n\n<h3 id=\"-server-name-override\">-server-name-override</h3>\n\n<p>The <code class=\"language-plaintext highlighter-rouge\">-server-name-override</code> flag specifies the common name (CN) which to\nexpect from the nfd-master TLS certificate. This flag is mostly intended for\ndevelopment and debugging purposes.</p>\n\n<p>Default: <em>empty</em></p>\n\n<p>Example:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>nfd-topology-updater <span class=\"nt\">-server-name-override</span><span class=\"o\">=</span>localhost\n</code></pre>  </div></div>\n\n<h3 id=\"-no-publish\">-no-publish</h3>\n\n<p>The <code class=\"language-plaintext highlighter-rouge\">-no-publish</code> flag disables all communication with the nfd-master, making\nit a “dry-run” flag for nfd-topology-updater. NFD-Topology-Updater runs\nresource hardware topology detection normally, but no CR requests are sent to\nnfd-master.</p>\n\n<p>Default: <em>false</em></p>\n\n<p>Example:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>nfd-topology-updater <span class=\"nt\">-no-publish</span>\n</code></pre>  </div></div>\n\n<h3 id=\"-oneshot\">-oneshot</h3>\n\n<p>The <code class=\"language-plaintext highlighter-rouge\">-oneshot</code> flag causes nfd-topology-updater to exit after one pass of\nresource hardware topology detection.</p>\n\n<p>Default: <em>false</em></p>\n\n<p>Example:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>nfd-topology-updater <span class=\"nt\">-oneshot</span> <span class=\"nt\">-no-publish</span>\n</code></pre>  </div></div>\n\n<h3 id=\"-sleep-interval\">-sleep-interval</h3>\n\n<p>The <code class=\"language-plaintext highlighter-rouge\">-sleep-interval</code> specifies the interval between resource hardware\ntopology re-examination (and CR updates). A non-positive value implies\ninfinite sleep interval, i.e. no re-detection is done.</p>\n\n<p>Default: 60s</p>\n\n<p>Example:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>nfd-topology-updater <span class=\"nt\">-sleep-interval</span><span class=\"o\">=</span>1h\n</code></pre>  </div></div>\n\n<h3 id=\"-watch-namespace\">-watch-namespace</h3>\n\n<p>The <code class=\"language-plaintext highlighter-rouge\">-watch-namespace</code> specifies the namespace to ensure that resource\nhardware topology examination only happens for the pods running in the\nspecified namespace. Pods that are not running in the specified namespace\nare not considered during resource accounting. This is particularly useful\nfor testing/debugging purpose. A “*” value would mean that all the pods would\nbe considered during the accounting process.</p>\n\n<p>Default: “*”</p>\n\n<p>Example:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>nfd-topology-updater <span class=\"nt\">-watch-namespace</span><span class=\"o\">=</span>rte\n</code></pre>  </div></div>\n\n<h3 id=\"-kubelet-config-file\">-kubelet-config-file</h3>\n\n<p>The <code class=\"language-plaintext highlighter-rouge\">-kubelet-config-file</code> specifies the path to the Kubelet’s configuration\nfile.</p>\n\n<p>Default: /host-var/lib/kubelet/config.yaml</p>\n\n<p>Example:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>nfd-topology-updater <span class=\"nt\">-kubelet-config-file</span><span class=\"o\">=</span>/var/lib/kubelet/config.yaml\n</code></pre>  </div></div>\n\n<h3 id=\"-podresources-socket\">-podresources-socket</h3>\n\n<p>The <code class=\"language-plaintext highlighter-rouge\">-podresources-socket</code> specifies the path to the Unix socket where kubelet\nexports a gRPC service to enable discovery of in-use CPUs and devices, and to\nprovide metadata for them.</p>\n\n<p>Default: /host-var/lib/kubelet/pod-resources/kubelet.sock</p>\n\n<p>Example:</p>\n\n<div class=\"language-bash highlighter-rouge\"><div class=\"highlight\"><pre class=\"highlight\"><code>nfd-topology-updater <span class=\"nt\">-podresources-socket</span><span class=\"o\">=</span>/var/lib/kubelet/pod-resources/kubelet.sock\n</code></pre>  </div></div>\n","dir":"/advanced/","name":"topology-updater-commandline-reference.md","path":"advanced/topology-updater-commandline-reference.md","url":"/advanced/topology-updater-commandline-reference.html"}]