Skip to content

Commit 2e2f987

Browse files
e0nee0ne
committed
feat: Add STIG/FIPs-compliant Network Operator deployment instructions
Signed-off-by: Ivan Kolodiazhnyi <[email protected]>
1 parent f5cb15f commit 2e2f987

File tree

6 files changed

+202
-0
lines changed

6 files changed

+202
-0
lines changed

‎docs/common/vars.rst‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,8 @@
44
.. |doca-driver-version| replace:: doca3.2.0-25.10-1.2.8.0-0
55
.. |doca-driver-repository| replace:: nvcr.io/nvstaging/mellanox
66
.. |doca-driver-version-lts| replace:: 24.10-0.7.0.0-0
7+
.. |doca-driver-repository-stig| replace:: nvcr.io/nvstaging/mellanox
8+
.. |doca-driver-version-stig| replace:: doca3.2.0-25.10-1.2.2.0-0
79
.. |doca-init-container-version| replace:: network-operator-v25.10.0-rc.1
810
.. |doca-init-container-repository| replace:: nvcr.io/nvstaging/mellanox
911
.. |sriov-device-plugin-version| replace:: network-operator-v25.10.0-rc.1
@@ -24,6 +26,8 @@
2426
.. |nic-feature-discovery-repository| replace:: nvcr.io/nvstaging/mellanox
2527
.. |sriovnetop-version| replace:: network-operator-v25.10.0-rc.1
2628
.. |sriovnetop-repository| replace:: nvcr.io/nvstaging/mellanox
29+
.. |sriovnetop-config-daemon-stig-version| replace:: network-operator-v25.10.0-rc.1-stig-fips
30+
.. |sriovnetop-config-daemon-stig-repository| replace:: nvcr.io/nvstaging/mellanox
2731
.. |sriovnetop-sriov-cni-version| replace:: network-operator-v25.10.0-rc.1
2832
.. |sriovnetop-sriov-cni-repository| replace:: nvcr.io/nvstaging/mellanox
2933
.. |sriovnetop-ib-sriov-cni-version| replace:: network-operator-v25.10.0-rc.1

‎docs/index.rst‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525
Platform Support <platform-support.rst>
2626
Getting Started with Kubernetes <getting-started-with-kubernetes.rst>
2727
Getting Started with Red Hat OpenShift <getting-started-with-openshift.rst>
28+
NVIDIA Network Operator Government Ready <install-network-operator-gov-ready.rst>
2829
NIC Configuration Operator <nic-conf-operator/nic-configuration-operator.rst>
2930
[TECH PREVIEW] Configuration Assistance with Kubernetes Launch Kit <k8s-launch-kit.rst>
3031
Customization Options and CRDs <customizations/customization.rst>

‎docs/install-network-operator-gov-ready.rst‎

Lines changed: 191 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,191 @@
1+
.. license-header
2+
SPDX-FileCopyrightText: Copyright (c) 2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
3+
SPDX-License-Identifier: Apache-2.0
4+
5+
Licensed under the Apache License, Version 2.0 (the "License");
6+
you may not use this file except in compliance with the License.
7+
You may obtain a copy of the License at
8+
9+
http://www.apache.org/licenses/LICENSE-2.0
10+
11+
Unless required by applicable law or agreed to in writing, software
12+
distributed under the License is distributed on an "AS IS" BASIS,
13+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
See the License for the specific language governing permissions and
15+
limitations under the License.
16+
17+
.. headings # #, * *, =, -, ^, "
18+
.. include:: ./common/vars.rst
19+
20+
21+
.. _install-network-operator-gov-ready:
22+
23+
########################################
24+
NVIDIA Network Operator Government Ready
25+
########################################
26+
27+
The NVIDIA Network Operator now offers government-ready components for NVIDIA AI Enterprise customers.
28+
Government ready is NVIDIA's designation for software that meets applicable security requirements for deployment in your FedRAMP High or equivalent sovereign use case.
29+
For more information on NVIDIA's government-ready support, refer to the white paper `AI Software for Regulated Environments <https://docs.nvidia.com/ai-enterprise/planning-resource/ai-software-regulated-environments-white-paper/latest/index.html>`_.
30+
31+
=====================================
32+
Supported Network Operator Components
33+
=====================================
34+
The government-ready NVIDIA Network Operator includes the following components:
35+
36+
.. list-table::
37+
:header-rows: 1
38+
39+
* - Component
40+
- Version
41+
* - NVIDIA Network Operator
42+
- |network-operator-version|
43+
* - NVIDIA Network Operator Init Container
44+
- |doca-init-container-version|
45+
* - DOCA-OFED Driver Container
46+
- |doca-driver-version-stig|
47+
* - RDMA Shared Device Plugin
48+
- |k8s-rdma-shared-dev-plugin-version|
49+
* - IP Over Infiniband (IPoIB) CNI plugin
50+
- |ipoib-cni-version|
51+
* - SRIOV Network Operator Config
52+
- |sriovnetop-version|
53+
* - SRIOV Network Operator Config Config Daemon
54+
- |sriovnetop-config-daemon-stig-version|
55+
* - SR-IOV Network Device Plugin
56+
- |sriovnetop-sriov-device-plugin-version|
57+
* - SR-IOV CNI plugin
58+
- |sriovnetop-sriov-cni-version|
59+
* - InfiniBand SR-IOV CNI plugin
60+
- |sriovnetop-ib-sriov-cni-version|
61+
* - K8s CNI network plugins
62+
- |cni-plugins-version|
63+
* - Multus CNI
64+
- |multus-version|
65+
* - RDMA CNI plugin
66+
- |rdma-cni-repository|
67+
* - NVIDIA IPAM Plugin
68+
- |nvidia-ipam-version|
69+
70+
71+
Artifacts for these components are available from the `NVIDIA NGC Catalog <https://registry.ngc.nvidia.com/orgs/nvidia/teams/mellanox/containers/doca-driver-stig-fips>`_.
72+
73+
.. note::
74+
75+
Not all Network Operator components and features are available as government-ready containers in the v25.10.0 release.
76+
77+
78+
Validated Kubernetes Distributions
79+
==================================
80+
81+
The government-ready NVIDIA Network Operator has been validated on the following Kubernetes distributions:
82+
83+
- Canonical Kubernetes 1.34 with Ubuntu Pro 24.04 amd64 and FIPS-compliant kernel
84+
85+
Install Government-Ready NVIDIA Network Operator
86+
================================================
87+
88+
Once you have your :ref:`gov-ready-prerequisites` configured, use the following steps to install the NVIDIA Network Operator on Canonical Kubernetes distributions:
89+
90+
#. :ref:`create-ngc-api-pull-secret`
91+
#. :ref:`deploy-nvidia-network-operator-gov-ready`
92+
93+
.. _gov-ready-prerequisites:
94+
95+
Prerequisites
96+
-------------
97+
98+
- An active NVIDIA AI Enterprise subscription and NGC API token to access Network Operator government-ready containers.
99+
Refer to `Generating Your NGC API Key <https://docs.nvidia.com/ngc/gpu-cloud/ngc-user-guide/index.html#generating-api-key>`_ in the NVIDIA NGC User Guide for more information on NGC API tokens.
100+
101+
- An Ubuntu Pro token for Canonical Kubernetes deployments.
102+
This token is required for the driver container to download kernel headers and other necessary packages from the Canonical repository when using the FIPS-enabled kernel on Ubuntu 24.04.
103+
Refer to the `Ubuntu Pro documentation <https://documentation.ubuntu.com/pro-client/en/v30/howtoguides/get_token_and_attach/>`_ for more information on accessing Ubuntu Pro tokens.
104+
105+
- The ``helm`` CLI installed on a client machine.
106+
107+
You can run the following commands to install the Helm CLI:
108+
109+
.. code-block:: console
110+
111+
$ curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3 \
112+
&& chmod 700 get_helm.sh \
113+
&& ./get_helm.sh
114+
115+
- A namespace to deploy the NVIDIA Network Operator.
116+
The example install commands below use ``nvidia-network-operator`` as the namespace.
117+
118+
- Optionally, Service Mesh for intra-cluster traffic encryption.
119+
By default, the NVIDIA Network Operator does not encrypt traffic between its controller (and operands) and the Kubernetes API server.
120+
If you wish to encrypt this communication, you should deploy and maintain a service mesh application within the Kubernetes cluster to enable secure traffic.
121+
122+
.. _create-ngc-api-pull-secret:
123+
124+
Create NGC API Pull Secret
125+
--------------------------
126+
127+
Add a Docker registry secret for downloading the Network Operator artifacts from NVIDIA NGC in the same namespace where you are planning to deploy the NVIDIA Network Operator.
128+
Update ``ngc-api-key`` in the command below with your NGC API key.
129+
130+
.. code-block:: console
131+
132+
$ kubectl create secret -n nvidia-network-operator docker-registry ngc-secret \
133+
--docker-server=nvcr.io \
134+
--docker-username='$oauthtoken' \
135+
--docker-password=<ngc-api-key>
136+
137+
.. _deploy-nvidia-network-operator-gov-ready:
138+
139+
Install NVIDIA Network Operator Government-Ready Components
140+
-----------------------------------------------------------
141+
142+
#. Label your ``nvidia-network-operator`` namespace for the Operator to set the enforcement policy to privilege.
143+
144+
.. code-block:: console
145+
146+
$ kubectl label --overwrite ns nvidia-network-operator pod-security.kubernetes.io/enforce=privileged
147+
148+
#. Add the NVIDIA Helm repository:
149+
150+
.. code-block:: console
151+
152+
$ helm repo add nvidia https://helm.ngc.nvidia.com/nvidia \
153+
&& helm repo update
154+
155+
#. Install the NVIDIA Network Operator with SR-IOV Network Operator.
156+
157+
.. code-block:: console
158+
159+
$ helm install network-operator nvidia/network-operator \
160+
--namespace nvidia-network-operator \
161+
--set sriov-network-operator.images.sriovConfigDaemon=doca-driver-stig-fips \
162+
--set sriov-network-operator.imagePullSecrets={ngc-secret} \
163+
--set sriovNetworkOperator.enabled=true
164+
--set nfd.enabled=true
165+
166+
.. _update-ubuntu-pro-token-in-nicclusterpolicy:
167+
168+
Update Ubuntu Pro Token in NicClusterPolicy
169+
===========================================
170+
171+
``UBUNTU_PRO_TOKEN`` environment variable of the Network Operator NicClusterPolicy should be configured.
172+
173+
.. code-block:: yaml
174+
:substitutions:
175+
176+
apiVersion: mellanox.com/v1alpha1
177+
kind: NicClusterPolicy
178+
metadata:
179+
name: nic-cluster-policy
180+
spec:
181+
ofedDriver:
182+
image: doca-driver-stig-fips
183+
repository: |doca-driver-repository-stig|
184+
version: |doca-driver-version-stig|
185+
env:
186+
- name: UBUNTU_PRO_TOKEN
187+
value: "<YOUR_UBUNTU_PRO_TOKEN>"
188+
189+
190+
This token is required for the driver container to download kernel headers and other necessary packages from the Canonical repository when using the FIPS-enabled kernel on Ubuntu 24.04.
191+

‎docs/platform-support.rst‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -264,6 +264,7 @@ Limitations
264264
- Only ``generic`` kernel variant is tested and supported as a GA.
265265
- ``nvidia``, ``aws``, ``azure``, and ``oracle`` kernel variants are supported as a Tech Preview and have limited testing.
266266

267+
.. _network-operator-component-matrix:
267268

268269
=================================
269270
Network Operator Component Matrix

‎hack/release/release.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,7 @@ type Release struct {
6262
SriovNetworkOperator *ReleaseImageSpec
6363
SriovNetworkOperatorWebhook *ReleaseImageSpec
6464
SriovConfigDaemon *ReleaseImageSpec
65+
SriovConfigDaemonStigFips *ReleaseImageSpec
6566
SriovCni *ReleaseImageSpec
6667
SriovIbCni *ReleaseImageSpec
6768
Mofed *ReleaseImageSpec

‎hack/release/templates/vars/vars.template‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,8 @@
44
.. |doca-driver-version| replace:: {{ .Mofed.Version }}
55
.. |doca-driver-repository| replace:: {{ .Mofed.Repository }}
66
.. |doca-driver-version-lts| replace:: 24.10-0.7.0.0-0
7+
.. |doca-driver-repository-stig| replace:: {{ .MofedStigFips.Repository }}
8+
.. |doca-driver-version-stig| replace:: {{ .MofedStigFips.Version }}
79
.. |doca-init-container-version| replace:: {{ .NetworkOperatorInitContainer.Version }}
810
.. |doca-init-container-repository| replace:: {{ .NetworkOperatorInitContainer.Repository }}
911
.. |sriov-device-plugin-version| replace:: {{ .SriovDevicePlugin.Version }}
@@ -24,6 +26,8 @@
2426
.. |nic-feature-discovery-repository| replace:: {{ .NicFeatureDiscovery.Repository }}
2527
.. |sriovnetop-version| replace:: {{ .SriovNetworkOperator.Version }}
2628
.. |sriovnetop-repository| replace:: {{ .SriovNetworkOperator.Repository }}
29+
.. |sriovnetop-config-daemon-stig-version| replace:: {{ .SriovConfigDaemonStigFips.Version }}
30+
.. |sriovnetop-config-daemon-stig-repository| replace:: {{ .SriovConfigDaemonStigFips.Repository }}
2731
.. |sriovnetop-sriov-cni-version| replace:: {{ .SriovCni.Version }}
2832
.. |sriovnetop-sriov-cni-repository| replace:: {{ .SriovCni.Repository }}
2933
.. |sriovnetop-ib-sriov-cni-version| replace:: {{ .SriovIbCni.Version }}

0 commit comments

Comments
 (0)