Skip to content

Commit 9ee0494

Browse files
e0nee0ne
committed
feat: Add STIG/FIPs-compliant Network Operator deployment instructions
Signed-off-by: Ivan Kolodiazhnyi <[email protected]>
1 parent 0aec51e commit 9ee0494

File tree

4 files changed

+213
-0
lines changed

4 files changed

+213
-0
lines changed

‎docs/common/vars.rst‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
.. |doca-driver-version| replace:: doca3.2.0-25.10-1.1.2.0-0
55
.. |doca-driver-repository| replace:: nvcr.io/nvstaging/mellanox
66
.. |doca-driver-version-lts| replace:: 24.10-0.7.0.0-0
7+
.. |doca-driver-version-lts| replace:: 24.10-0.7.0.0-0
78
.. |doca-init-container-version| replace:: network-operator-v25.10.0-beta.4
89
.. |doca-init-container-repository| replace:: nvcr.io/nvstaging/mellanox
910
.. |sriov-device-plugin-version| replace:: network-operator-v25.10.0-beta.4

‎docs/index.rst‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525
Platform Support <platform-support.rst>
2626
Getting Started with Kubernetes <getting-started-with-kubernetes.rst>
2727
Getting Started with Red Hat OpenShift <getting-started-with-openshift.rst>
28+
NVIDIA Network Operator Government Ready <install-network-operator-gov-ready.rst>
2829
NIC Configuration Operator <nic-conf-operator/nic-configuration-operator.rst>
2930
[TECH PREVIEW] Configuration Assistance with Kubernetes Launch Kit <k8s-launch-kit.rst>
3031
Customization Options and CRDs <customizations/customization.rst>

‎docs/install-network-operator-gov-ready.rst‎

Lines changed: 208 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,208 @@
1+
.. license-header
2+
SPDX-FileCopyrightText: Copyright (c) 2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
3+
SPDX-License-Identifier: Apache-2.0
4+
5+
Licensed under the Apache License, Version 2.0 (the "License");
6+
you may not use this file except in compliance with the License.
7+
You may obtain a copy of the License at
8+
9+
http://www.apache.org/licenses/LICENSE-2.0
10+
11+
Unless required by applicable law or agreed to in writing, software
12+
distributed under the License is distributed on an "AS IS" BASIS,
13+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
See the License for the specific language governing permissions and
15+
limitations under the License.
16+
17+
.. headings # #, * *, =, -, ^, "
18+
19+
20+
.. _install-network-operator-gov-ready:
21+
22+
########################################
23+
NVIDIA Network Operator Government Ready
24+
########################################
25+
26+
The NVIDIA Network Operator now offers government-ready components for NVIDIA AI Enterprise customers.
27+
Government ready is NVIDIA's designation for software that meets applicable security requirements for deployment in your FedRAMP High or equivalent sovereign use case.
28+
For more information on NVIDIA's government-ready support, refer to the white paper `AI Software for Regulated Environments <https://docs.nvidia.com/ai-enterprise/planning-resource/ai-software-regulated-environments-white-paper/latest/index.html>`_.
29+
30+
=====================================
31+
Supported Network Operator Components
32+
=====================================
33+
The government-ready NVIDIA Network Operator includes the following components:
34+
35+
.. _fn1: #base-image
36+
.. |fn1| replace:: :sup:`1`
37+
38+
.. list-table::
39+
:header-rows: 1
40+
41+
* - Component
42+
- Version
43+
* - NVIDIA Network Operator
44+
- |network-operator-version|
45+
* - NVIDIA Network Operator Init Container
46+
- |doca-init-container-version|
47+
* - DOCA-OFED Driver Container
48+
- |doca-driver-version-stig|
49+
* - RDMA Shared Device Plugin
50+
- |k8s-rdma-shared-dev-plugin-version|
51+
* - IP Over Infiniband (IPoIB) CNI plugin
52+
- |ipoib-cni-version|
53+
* - SRIOV Network Operator Config
54+
- |sriovnetop-version|
55+
* - SRIOV Network Operator Config Config Daemon
56+
- |sriovnetop-config-daemon-stig-version|
57+
* - SR-IOV Network Device Plugin
58+
- |sriovnetop-sriov-device-plugin-version|
59+
* - SR-IOV CNI plugin
60+
- |sriovnetop-sriov-cni-version|
61+
* - InfiniBand SR-IOV CNI plugin
62+
- |sriovnetop-ib-sriov-cni-version|
63+
* - K8s CNI network plugins
64+
- |cni-plugins-version|
65+
* - Multus CNI
66+
- |multus-version|
67+
* - RDMA CNI plugin
68+
- |rdma-cni-repository|
69+
70+
:sup:`1`
71+
Hardened for STIG/FIPS compliance
72+
73+
Artifacts for these components are available from the `NVIDIA NGC Catalog <https://registry.ngc.nvidia.com/orgs/nvidia/teams/mellanox/containers/doca-driver-stig-fips>`_.
74+
75+
.. note::
76+
77+
Not all Network Operator components and features are available as government-ready containers in the v25.10.0 release.
78+
79+
80+
Validated Kubernetes Distributions
81+
===================================
82+
83+
The government-ready NVIDIA Network Operator has been validated on the following Kubernetes distributions:
84+
85+
- Canonical Kubernetes 1.34 with Ubuntu Pro 24.04 and FIPS-compliant kernel
86+
87+
Install Government-Ready NVIDIA Network Operator
88+
=============================================
89+
90+
Once you have your :ref:`gov-ready-prerequisites` configured, use the following steps to install the NVIDIA Network Operator on Canonical Kubernetes distributions:
91+
92+
#. :ref:`install-nfd`
93+
#. :ref:`create-ngc-api-pull-secret`
94+
#. :ref:`create-ubuntu-pro-token-secret`
95+
#. :ref:`deploy-nvidia-network-operator-gov-ready`
96+
97+
.. _gov-ready-prerequisites:
98+
99+
Prerequisites
100+
-------------
101+
102+
- An active NVIDIA AI Enterprise subscription and NGC API token to access Network Operator government-ready containers.
103+
Refer to `Generating Your NGC API Key <https://docs.nvidia.com/ngc/gpu-cloud/ngc-user-guide/index.html#generating-api-key>`_ in the NVIDIA NGC User Guide for more information on NGC API tokens.
104+
105+
- An Ubuntu Pro token for Canonical Kubernetes deployments.
106+
This token is required for the driver container to download kernel headers and other necessary packages from the Canonical repository when using the FIPS-enabled kernel on Ubuntu 24.04.
107+
Refer to the `Ubuntu Pro documentation <https://documentation.ubuntu.com/pro-client/en/v30/howtoguides/get_token_and_attach/>`_ for more information on accessing Ubuntu Pro tokens.
108+
109+
- The ``helm`` CLI installed on a client machine.
110+
111+
You can run the following commands to install the Helm CLI:
112+
113+
.. code-block:: console
114+
115+
$ curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3 \
116+
&& chmod 700 get_helm.sh \
117+
&& ./get_helm.sh
118+
119+
- A namespace to deploy the NVIDIA Network Operator.
120+
The example install commands below use ``nvidia-network-operator`` as the namespace.
121+
122+
- Optionally, Service Mesh for intra-cluster traffic encryption.
123+
By default, the NVIDIA Network Operator does not encrypt traffic between its controller (and operands) and the Kubernetes API server.
124+
If you wish to encrypt this communication, you should deploy and maintain a service mesh application within the Kubernetes cluster to enable secure traffic.
125+
126+
.. _install-nfd:
127+
128+
Install Node Feature Discovery (NFD)
129+
-------------------------------------
130+
131+
NFD is an open-source project that is a dependency for the Operator on each node in your cluster.
132+
It must be deployed before installing the NVIDIA Network Operator.
133+
134+
Network Operator does not maintain a government ready version of NFD, it is recommended that you install the upstream NFD version that aligns with the :ref:`operator-component-matrix`.
135+
The NFD container is built on top of a scratch image, providing a highly secure container environment.
136+
For information on NFD CVEs and security updates, refer to the `NFD GitHub repository <https://github.com/kubernetes-sigs/node-feature-discovery/security>`_.
137+
138+
Refer to the NFD documentation for `installation instructions <https://kubernetes-sigs.github.io/node-feature-discovery/stable/get-started/index.html>`_.
139+
140+
141+
.. _create-ngc-api-pull-secret:
142+
143+
Create NGC API Pull Secret
144+
---------------------------
145+
146+
Add a Docker registry secret for downloading the Network Operator artifacts from NVIDIA NGC in the same namespace where you are planning to deploy the NVIDIA Network Operator.
147+
Update ``ngc-api-key`` in the command below with your NGC API key.
148+
149+
.. code-block:: console
150+
151+
$ kubectl create secret -n nvidia-network-operator docker-registry ngc-secret \
152+
--docker-server=nvcr.io \
153+
--docker-username='$oauthtoken' \
154+
--docker-password=<ngc-api-key>
155+
156+
.. _create-ubuntu-pro-token-secret:
157+
158+
Create Ubuntu Pro Token Secret
159+
-------------------------------
160+
161+
Create a Kubernetes secret to hold the value of your Ubuntu Pro token secret.
162+
This secret will be used in the install command in the next step.
163+
164+
The Ubuntu Pro Token is required for the driver container to download kernel headers and other necessary packages from the Canonical repository when using the FIPS-enabled kernel on Ubuntu 24.04.
165+
166+
.. _deploy-nvidia-network-operator-gov-ready:
167+
168+
Install NVIDIA Network Operator Government-Ready Components
169+
--------------------------------------------------------
170+
171+
#. Label your ``nvidia-network-operator`` namespace for the Operator to set the enforcement policy to privilege.
172+
173+
.. code-block:: console
174+
175+
$ kubectl label --overwrite ns nvidia-network-operator pod-security.kubernetes.io/enforce=privileged
176+
177+
#. Add the NVIDIA Helm repository:
178+
179+
.. code-block:: console
180+
181+
$ helm repo add nvidia https://helm.ngc.nvidia.com/nvidia \
182+
&& helm repo update
183+
184+
#. Install the NVIDIA Network Operator with SR-IOV Network Operator.
185+
186+
.. code-block:: console
187+
188+
$ helm install network-operator nvidia/network-operator \
189+
--namespace nvidia-network-operator \
190+
--set sriov-network-operator.images.sriovConfigDaemon=doca-driver-stig-fips \
191+
--set sriov-network-operator.imagePullSecrets={ngc-secret} \
192+
--set sriovNetworkOperator.enabled=true
193+
--set nfd.enabled=true
194+
195+
.. _update-ubuntu-pro-token-in-nicclusterpolicy:
196+
197+
Update Ubuntu Pro Token in NicClusterPolicy
198+
=========================================
199+
200+
``UBUNTU_PRO_TOKEN`` environment variable of the Network Operator NicClusterPolicy should be configured.
201+
202+
.. code-block:: console
203+
204+
$ kubectl edit nicclusterpolicy nic-cluster-policy
205+
206+
Then update the secret with your new Ubuntu Pro Token.
207+
This token is required for the driver container to download kernel headers and other necessary packages from the Canonical repository when using the FIPS-enabled kernel on Ubuntu 24.04.
208+

‎hack/release/templates/vars/vars.template‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
.. |doca-driver-version| replace:: {{ .Mofed.Version }}
55
.. |doca-driver-repository| replace:: {{ .Mofed.Repository }}
66
.. |doca-driver-version-lts| replace:: 24.10-0.7.0.0-0
7+
.. |doca-driver-version-stig| replace:: {{ .MofedStigFips.Version }}
78
.. |doca-init-container-version| replace:: {{ .NetworkOperatorInitContainer.Version }}
89
.. |doca-init-container-repository| replace:: {{ .NetworkOperatorInitContainer.Repository }}
910
.. |sriov-device-plugin-version| replace:: {{ .SriovDevicePlugin.Version }}
@@ -24,6 +25,8 @@
2425
.. |nic-feature-discovery-repository| replace:: {{ .NicFeatureDiscovery.Repository }}
2526
.. |sriovnetop-version| replace:: {{ .SriovNetworkOperator.Version }}
2627
.. |sriovnetop-repository| replace:: {{ .SriovNetworkOperator.Repository }}
28+
.. |sriovnetop-config-daemon-stig-version| replace:: {{ .SriovConfigDaemonStigFips.Version }}
29+
.. |sriovnetop-config-daemon-stig-repository| replace:: {{ .SriovConfigDaemonStigFips.Repository }}
2730
.. |sriovnetop-sriov-cni-version| replace:: {{ .SriovCni.Version }}
2831
.. |sriovnetop-sriov-cni-repository| replace:: {{ .SriovCni.Repository }}
2932
.. |sriovnetop-ib-sriov-cni-version| replace:: {{ .SriovIbCni.Version }}

0 commit comments

Comments
 (0)