|
| 1 | +# NicClusterPolicy for L40S OKE (OCI) SR-IOV RoCE. |
| 2 | +# |
| 3 | +# The network-operator Helm chart installs the operator + CRD but does not template |
| 4 | +# a NicClusterPolicy CR (values-oke-l40s.yaml sets deployCR: false). This manifest |
| 5 | +# creates it so the operator reconciles the RoCE fabric stack. Hand-rendered from |
| 6 | +# AOR's network-operator/nicclusterpolicy.yaml.tmpl (provider: oci branch, with |
| 7 | +# network.type == roce → nvIpam + secondaryNetwork included). |
| 8 | +# |
| 9 | +# OCI specifics (vs Forge IB): NO ofedDriver — OCI nodes carry host MOFED, consumed |
| 10 | +# by the GPU Operator driver via driver.rdma.useHostMofed (l40s-oke-ubuntu leaf). One |
| 11 | +# sriovDevicePlugin resource, nvidia.com/mlnxnics, selecting the OCI ConnectX VF |
| 12 | +# device IDs (101a = ConnectX-5 Ex VF, 101e = mlx5Gen VF). RoCE also needs nv-ipam |
| 13 | +# (VF IP allocation) + secondaryNetwork/multus (attach the VF into workload pods). |
| 14 | +# vendor 15b3 = Mellanox. |
| 15 | +apiVersion: mellanox.com/v1alpha1 |
| 16 | +kind: NicClusterPolicy |
| 17 | +metadata: |
| 18 | + name: nic-cluster-policy |
| 19 | + annotations: |
| 20 | + helm.sh/hook: post-install,post-upgrade |
| 21 | + helm.sh/hook-weight: "5" |
| 22 | + helm.sh/hook-delete-policy: before-hook-creation |
| 23 | + labels: |
| 24 | + app.kubernetes.io/managed-by: {{ .Release.Service }} |
| 25 | + helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} |
| 26 | +spec: |
| 27 | + # RoCE: allocate IPs for the RDMA VFs and wire them into pods via multus. |
| 28 | + nvIpam: |
| 29 | + image: nvidia-k8s-ipam |
| 30 | + repository: ghcr.io/mellanox |
| 31 | + version: v0.2.0 |
| 32 | + enableWebhook: false |
| 33 | + containerResources: |
| 34 | + - name: nv-ipam-node |
| 35 | + requests: |
| 36 | + cpu: 500m |
| 37 | + memory: 1Gi |
| 38 | + limits: |
| 39 | + cpu: "1" |
| 40 | + memory: 2Gi |
| 41 | + secondaryNetwork: |
| 42 | + cniPlugins: |
| 43 | + image: plugins |
| 44 | + repository: ghcr.io/k8snetworkplumbingwg |
| 45 | + version: v1.6.2-update.1 |
| 46 | + multus: |
| 47 | + image: multus-cni |
| 48 | + repository: ghcr.io/k8snetworkplumbingwg |
| 49 | + version: v4.2.1 |
| 50 | + sriovDevicePlugin: |
| 51 | + image: sriov-network-device-plugin |
| 52 | + repository: ghcr.io/k8snetworkplumbingwg |
| 53 | + version: v3.9.0 |
| 54 | + config: | |
| 55 | + { |
| 56 | + "resourceList": [ |
| 57 | + { |
| 58 | + "resourcePrefix": "nvidia.com", |
| 59 | + "resourceName": "mlnxnics", |
| 60 | + "selectors": {"isRdma":true,"vendors":["15b3"],"devices":["101a","101e"]} |
| 61 | + } |
| 62 | + ] |
| 63 | + } |
| 64 | + # Operator DaemonSet placement: system/monitoring nodes only (matches AOR). |
| 65 | + deploymentTolerations: |
| 66 | + - key: CriticalAddonsOnly |
| 67 | + operator: Exists |
| 68 | + tolerations: |
| 69 | + # RDMA DaemonSets must land on tainted GPU nodes. |
| 70 | + - key: nvidia.com/gpu |
| 71 | + operator: Exists |
| 72 | + - key: CriticalAddonsOnly |
| 73 | + operator: Exists |
0 commit comments