API Reference

Packages

• noderesources.dpu.nvidia.com/v1alpha1
• operator.dpu.nvidia.com/v1alpha1
• provisioning.dpu.nvidia.com/v1alpha1
• storage.dpu.nvidia.com/v1alpha1
• svc.dpu.nvidia.com/v1alpha1
• vpc.dpu.nvidia.com/v1alpha1

noderesources.dpu.nvidia.com/v1alpha1

Package v1alpha1 contains API Schema definitions for the noderesources v1alpha1 API group

Resource Types

• NodeSRIOVDevicePluginConfig
• NodeSRIOVDevicePluginConfigList

DevicePluginResource

DevicePluginResource defines a single device plugin resource configuration.

Appears in:

• NodeSRIOVDevicePluginConfigSpec

Field	Description	Default	Validation
name string	Name is the endpoint resource name for the device plugin. Should contain only alphanumeric characters, underscores and hyphens. The full extended resource name will be constructed as resource-prefix/name. Example: pods_vf, ovnk_mgmt_vf		MinLength: 1 Pattern: ^[a-zA-Z0-9_-]+$ Required: {}
resourcePrefix string	ResourcePrefix is the resource prefix used by the device plugin to prefix the resource name. If not set, the default resource prefix will be used.		Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ Optional: {}
type DevicePluginResourceType	Type specifies the type of the device plugin resource.		Enum: [vf] Required: {}
options DevicePluginResourceOptions	Options contains additional options for the device plugin resource.		Optional: {}
ranges VFRange array	Ranges specifies the VF ranges on PFs to be included in this resource.		MinItems: 1 Required: {}

DevicePluginResourceOptions

DevicePluginResourceOptions contains additional options for a device plugin resource.

Appears in:

• DevicePluginResource

Field	Description	Default	Validation
isRdma boolean	IsRdma indicates whether RDMA is enabled for this resource.		Optional: {}

DevicePluginResourceType

Underlying type: string

DevicePluginResourceType specifies the type of the device plugin resource.

Validation:

• Enum: [vf]

Appears in:

• DevicePluginResource

Field	Description
vf	DevicePluginResourceTypeVF represents a Virtual Function resource.

NodeSRIOVDevicePluginConfig

NodeSRIOVDevicePluginConfig is the Schema for the nodesriovdevicepluginconfigs API

Appears in:

• NodeSRIOVDevicePluginConfigList

Field	Description	Default	Validation
apiVersion string	noderesources.dpu.nvidia.com/v1alpha1
kind string	NodeSRIOVDevicePluginConfig
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec NodeSRIOVDevicePluginConfigSpec
status NodeSRIOVDevicePluginConfigStatus

NodeSRIOVDevicePluginConfigList

NodeSRIOVDevicePluginConfigList contains a list of NodeSRIOVDevicePluginConfig

Field	Description	Default	Validation
apiVersion string	noderesources.dpu.nvidia.com/v1alpha1
kind string	NodeSRIOVDevicePluginConfigList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items NodeSRIOVDevicePluginConfig array

NodeSRIOVDevicePluginConfigSpec

NodeSRIOVDevicePluginConfigSpec defines the desired state of NodeSRIOVDevicePluginConfig

Appears in:

• NodeSRIOVDevicePluginConfig

Field	Description	Default	Validation
devicePluginResources DevicePluginResource array	DevicePluginResources is the list of device plugin resource configurations.		MinItems: 1 Required: {}

NodeSRIOVDevicePluginConfigStatus

NodeSRIOVDevicePluginConfigStatus defines the observed state of NodeSRIOVDevicePluginConfig

Appears in:

• NodeSRIOVDevicePluginConfig

Field	Description	Default	Validation
conditions Condition array	Conditions exposes the current state of the NodeSRIOVDevicePluginConfig.
observedGeneration integer	ObservedGeneration records the Generation observed on the object the last time it was patched.

VFRange

VFRange defines a range of Virtual Functions on a Physical Function.

Appears in:

• DevicePluginResource

Field	Description	Default	Validation
pfIndex integer	PFIndex is the index of the Physical Function.		Minimum: 0 Required: {}
start integer	Start is the starting VF index (inclusive). If not set, the range starts from VF 0.		Minimum: 0 Optional: {}
end integer	End is the ending VF index (inclusive). If not set, the range extends to the last VF on the PF.		Minimum: 0 Optional: {}

operator.dpu.nvidia.com/v1alpha1

Package v1alpha1 contains API Schema definitions for the operator v1alpha1 API group

Resource Types

• DPFOperatorConfig
• DPFOperatorConfigList

BFBRegistryConfiguration

Appears in:

• InstallViaRedfish

Field	Description	Default	Validation
disable boolean	Disable ensures the BFB Registry is not deployed when set to true.		Optional: {}
port integer	Port is the port on which the BFB Registry will listen		Optional: {}

BaseComponentConfig

BaseComponentConfig provides common configuration fields that can be embedded by all component configurations to reduce code duplication.

Appears in:

• CNIInstallerConfiguration
• DPUDetectorConfiguration
• DPUServiceControllerConfiguration
• FlannelConfiguration
• KamajiClusterManagerConfiguration
• KataContainersConfiguration
• KubeStateMetricsConfiguration
• MultusConfiguration
• NVIPAMConfiguration
• NodeProblemDetectorConfiguration
• NodeSRIOVDevicePluginControllerConfiguration
• OVSCNIConfiguration
• OpenTelemetryCollectorConfiguration
• ProvisioningControllerConfiguration
• SFCControllerConfiguration
• SRIOVDevicePluginConfiguration
• ServiceSetControllerConfiguration
• StaticClusterManagerConfiguration
• VaultKMSConfiguration

Field	Description	Default	Validation
disable boolean	Disable ensures the component is not deployed when set to true.		Optional: {}

BaseControllerConfig

BaseControllerConfig provides common configuration fields that can be embedded by all controller configurations to reduce code duplication.

Appears in:

• DPUServiceControllerConfiguration
• KamajiClusterManagerConfiguration
• NVIPAMConfiguration
• NodeSRIOVDevicePluginControllerConfiguration
• ProvisioningControllerConfiguration
• ServiceSetControllerConfiguration
• StaticClusterManagerConfiguration

Field	Description	Default	Validation
replicas integer	Replicas is the number of replicas for the controller deployment. Used for High Availability via leader election.	2	Maximum: 3 Minimum: 1 Optional: {}

CNIInstallerConfiguration

Appears in:

• DPFOperatorConfigSpec

Field	Description	Default	Validation
disable boolean	Disable ensures the component is not deployed when set to true.		Optional: {}
helmChart HelmChart	HelmChart overrides the helm chart used by the ServiceSet controller. The URL must begin with either 'oci://' or 'https://', ensuring it points to a valid OCI registry or a web-based repository.		Pattern: ^(oci://|https://).+$ Optional: {}
installer DefaultOverridesConfiguration	Installer contains the configuration for the CNI-Installer component. It contains the image for the controller and its resource requirements.		Optional: {}

ConfigMapKeyRef

ConfigMapKeyRef selects a single key from a ConfigMap living in the same namespace as the DPFOperatorConfig.

Appears in:

• VaultKMSTLS

Field	Description	Default	Validation
name string	Name is the name of the ConfigMap.		MinLength: 1 Required: {}
key string	Key is the key within the ConfigMap data to select.		MinLength: 1 Required: {}

DPFOperatorConfig

DPFOperatorConfig is the Schema for the dpfoperatorconfigs API

Appears in:

• DPFOperatorConfigList

Field	Description	Default	Validation
apiVersion string	operator.dpu.nvidia.com/v1alpha1
kind string	DPFOperatorConfig
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec DPFOperatorConfigSpec
status DPFOperatorConfigStatus

DPFOperatorConfigList

DPFOperatorConfigList contains a list of DPFOperatorConfig

Field	Description	Default	Validation
apiVersion string	operator.dpu.nvidia.com/v1alpha1
kind string	DPFOperatorConfigList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items DPFOperatorConfig array

DPFOperatorConfigSpec

DPFOperatorConfigSpec defines the desired state of DPFOperatorConfig

Appears in:

• DPFOperatorConfig

Field	Description	Default	Validation
overrides Overrides			Optional: {}
networking Networking		{ controlPlaneMTU:1500 }	Optional: {}
monitoring MonitoringConfiguration	Monitoring is the configuration for monitoring resources.		Optional: {}
security SecurityConfiguration	Security groups configuration for security-related components managed by the DPF Operator.		Optional: {}
imagePullSecrets string array	List of secret names which are used to pull images for DPF system components and DPUServices. These secrets must be in the same namespace as the DPF Operator Config and should be created before the config is created. System reconciliation will not proceed until these secrets are available.		Optional: {}
deploymentMode DeploymentMode	DeploymentMode selects zero-trust vs host-trusted deployment alignment. Required: operators must set this explicitly; provisioning controllers propagate this to DPU.status.deploymentMode.		Enum: [zero-trust host-trusted] Required: {}
dpuServiceController DPUServiceControllerConfiguration	DPUServiceController is the configuration for the DPUServiceController		Optional: {}
provisioningController ProvisioningControllerConfiguration	ProvisioningController is the configuration for the ProvisioningController
serviceSetController ServiceSetControllerConfiguration	ServiceSetController is the configuration for the ServiceSetController		Optional: {}
dpuDetector DPUDetectorConfiguration	DPUDetector is the configuration for the DPUDetector.		Optional: {}
multus MultusConfiguration	Multus is the configuration for Multus		Optional: {}
sriovDevicePlugin SRIOVDevicePluginConfiguration	SRIOVDevicePlugin is the configuration for the SRIOVDevicePlugin		Optional: {}
flannel FlannelConfiguration	Flannel is the configuration for Flannel		Optional: {}
ovsCNI OVSCNIConfiguration	OVSCNI is the configuration for OVSCNI Deprecated: OVS CNI is installed by CNIInstaller. Remove after 26.7 is released.		Optional: {}
nvipam NVIPAMConfiguration	NVIPAM is the configuration for NVIPAM		Optional: {}
cniInstaller CNIInstallerConfiguration	CNIInstaller is the configuration for the cni-installer		Optional: {}
sfcController SFCControllerConfiguration	SFCController is the configuration for the SFCController		Optional: {}
kamajiClusterManager KamajiClusterManagerConfiguration	KamajiClusterManager is the configuration for the kamaji-cluster-manager		Optional: {}
staticClusterManager StaticClusterManagerConfiguration	StaticClusterManager is the configuration for the static-cluster-manager		Optional: {}
nodeSRIOVDevicePluginController NodeSRIOVDevicePluginControllerConfiguration	NodeSRIOVDevicePluginController is the configuration for the NodeSRIOVDevicePlugin controller. This controller manages per-node SRIOV device plugin pods based on DPU configurations. The controller is disabled by default.		Optional: {}

DPFOperatorConfigStatus

DPFOperatorConfigStatus defines the observed state of DPFOperatorConfig

Appears in:

• DPFOperatorConfig

Field	Description	Default	Validation
conditions Condition array	Conditions exposes the current state of the OperatorConfig.
observedGeneration integer	ObservedGeneration records the Generation observed on the object the last time it was patched.
version string	Version is the version of the DPF Operator that is currently deployed.

DPUDetectorConfiguration

Appears in:

• DPFOperatorConfigSpec

Field	Description	Default	Validation
disable boolean	Disable ensures the component is not deployed when set to true.		Optional: {}
image Image	Image overrides the container image used by the DPUDetector Container. Deprecated: This field is deprecated and will be removed with v26.7.0. Use the new field daemon instead.		Pattern: ^((?:(?:(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))*|\[(?:[a-fA-F0-9:]+)\])(?::[0-9]+)?/)?[a-z0-9]+(?:(?:[._]|__|[-]+)[a-z0-9]+)*(?:/[a-z0-9]+(?:(?:[._]|__|[-]+)[a-z0-9]+)*)*)(?::([\w][\w.-]\{0,127\}))?(?:@([A-Za-z][A-Za-z0-9]*(?:[-_+.][A-Za-z][A-Za-z0-9]*)*[:][[:xdigit:]]\{32,\}))?$ Optional: {}
daemon DefaultOverridesConfiguration	Daemon contains the configuration for the DPU Detector component. It contains the image for the controller and its resource requirements.		Optional: {}

DPUServiceControllerConfiguration

Appears in:

• DPFOperatorConfigSpec

Field	Description	Default	Validation
disable boolean	Disable ensures the component is not deployed when set to true.		Optional: {}
replicas integer	Replicas is the number of replicas for the controller deployment. Used for High Availability via leader election.	2	Maximum: 3 Minimum: 1 Optional: {}
image Image	Image overrides the container image used by the DPUService controller. Deprecated: This field is deprecated and will be removed with v26.7.0. Use the new field controller instead.		Pattern: ^((?:(?:(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))*|\[(?:[a-fA-F0-9:]+)\])(?::[0-9]+)?/)?[a-z0-9]+(?:(?:[._]|__|[-]+)[a-z0-9]+)*(?:/[a-z0-9]+(?:(?:[._]|__|[-]+)[a-z0-9]+)*)*)(?::([\w][\w.-]\{0,127\}))?(?:@([A-Za-z][A-Za-z0-9]*(?:[-_+.][A-Za-z][A-Za-z0-9]*)*[:][[:xdigit:]]\{32,\}))?$ Optional: {}
controller DefaultOverridesConfiguration	Controller contains the configuration for the DPU Service controller component. It contains the image for the controller and its resource requirements.		Optional: {}
disableDPUReadyTaints boolean	DisableDPUReadyTaints disables the DPU ready taints feature in the DPU Service Controller. This feature adds taints to the worker nodes when the DPU is not ready. This is useful when the DPU is used for networking and the node should not be scheduled until the DPU is ready.		Optional: {}

DefaultOverridesConfiguration

Appears in:

• CNIInstallerConfiguration
• DPUDetectorConfiguration
• DPUServiceControllerConfiguration
• KamajiClusterManagerConfiguration
• KubeStateMetricsConfiguration
• MultusConfiguration
• NodeProblemDetectorConfiguration
• NodeSRIOVDevicePluginControllerConfiguration
• OVSCNIConfiguration
• OpenTelemetryCollectorConfiguration
• ProvisioningControllerConfiguration
• SFCControllerConfiguration
• SRIOVDevicePluginConfiguration
• ServiceSetControllerConfiguration
• StaticClusterManagerConfiguration
• VaultKMSConfiguration

Field	Description	Default	Validation
image Image			Pattern: ^((?:(?:(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))*|\[(?:[a-fA-F0-9:]+)\])(?::[0-9]+)?/)?[a-z0-9]+(?:(?:[._]|__|[-]+)[a-z0-9]+)*(?:/[a-z0-9]+(?:(?:[._]|__|[-]+)[a-z0-9]+)*)*)(?::([\w][\w.-]\{0,127\}))?(?:@([A-Za-z][A-Za-z0-9]*(?:[-_+.][A-Za-z][A-Za-z0-9]*)*[:][[:xdigit:]]\{32,\}))?$ Optional: {}
resources ResourceRequirements	Resources defines the memory and CPU resource requests and limits for the component. This field is optional, and if not set, the component will use the default resource.		Optional: {}

DeploymentMode

Underlying type: string

DeploymentMode describes the cluster deployment model for DPU provisioning (zero-trust vs host-trusted).

Validation:

• Enum: [zero-trust host-trusted]

Appears in:

• DPFOperatorConfigSpec

Field	Description
zero-trust	DeploymentModeZeroTrust requires provisioningController.installInterface.installViaRedfish
host-trusted	DeploymentModeHostTrusted allows provisioningController.installInterface.installViaHostAgent, or installViaGNOI

EtcdEncryptionAtRestConfiguration

EtcdEncryptionAtRestConfiguration is the per-cluster encryption-at-rest selector for Kamaji clusters.

Appears in:

• KamajiClusterManagerConfiguration

Field	Description	Default	Validation
provider EtcdEncryptionAtRestProvider	Provider selects the encryption-at-rest provider.		Enum: [staticKey vaultKMS] Required: {}
staticKey StaticKeyConfiguration	StaticKey configures the staticKey provider. It is required when provider is staticKey and must not be set otherwise.		Optional: {}

EtcdEncryptionAtRestProvider

Underlying type: string

EtcdEncryptionAtRestProvider selects the etcd encryption-at-rest provider.

Validation:

• Enum: [staticKey vaultKMS]

Appears in:

• EtcdEncryptionAtRestConfiguration

Field	Description
staticKey	EtcdEncryptionProviderStaticKey encrypts etcd data with an AES-GCM key rendered inline into the encryption config.
vaultKMS	EtcdEncryptionProviderVaultKMS encrypts etcd data via the KMS v2 plugin served by the vaultKMS component.

FlannelCNI

Appears in:

• FlannelConfiguration

Field	Description	Default	Validation
image Image			Pattern: ^((?:(?:(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))*|\[(?:[a-fA-F0-9:]+)\])(?::[0-9]+)?/)?[a-z0-9]+(?:(?:[._]|__|[-]+)[a-z0-9]+)*(?:/[a-z0-9]+(?:(?:[._]|__|[-]+)[a-z0-9]+)*)*)(?::([\w][\w.-]\{0,127\}))?(?:@([A-Za-z][A-Za-z0-9]*(?:[-_+.][A-Za-z][A-Za-z0-9]*)*[:][[:xdigit:]]\{32,\}))?$ Optional: {}

FlannelConfiguration

Appears in:

• DPFOperatorConfigSpec

Field	Description	Default	Validation
disable boolean	Disable ensures the component is not deployed when set to true.		Optional: {}
helmChart HelmChart	HelmChart overrides the helm chart used by the ServiceSet controller. The URL must begin with either 'oci://' or 'https://', ensuring it points to a valid OCI registry or a web-based repository.		Pattern: ^(oci://|https://).+$ Optional: {}
cni FlannelCNI	CNI is the configuration for the Flannel CNI component. It contains the image for the CNI init container. Note: The resources for the CNI container are not configurable.		Optional: {}
daemon FlannelDaemon	Daemon is the configuration for the Flannel Daemon component. It contains the image for the Flannel Daemon container and its resource requirements.		Optional: {}
image FlannelImages	Images overrides the container images used by flannel Deprecated: This field is deprecated and will be removed with v26.7.0. Use the new fields cni and daemon instead.		Optional: {}
podCIDR string	PodCIDR is the pod cidr for flannel.		Optional: {}

FlannelDaemon

Appears in:

• FlannelConfiguration

Field	Description	Default	Validation
image Image			Pattern: ^((?:(?:(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))*|\[(?:[a-fA-F0-9:]+)\])(?::[0-9]+)?/)?[a-z0-9]+(?:(?:[._]|__|[-]+)[a-z0-9]+)*(?:/[a-z0-9]+(?:(?:[._]|__|[-]+)[a-z0-9]+)*)*)(?::([\w][\w.-]\{0,127\}))?(?:@([A-Za-z][A-Za-z0-9]*(?:[-_+.][A-Za-z][A-Za-z0-9]*)*[:][[:xdigit:]]\{32,\}))?$ Optional: {}
resources ResourceRequirements	Resources defines the memory and CPU resource requests and limits for the component. This field is optional, and if not set, the component will use the default resource.		Optional: {}

FlannelImages

Appears in:

• FlannelConfiguration

Field	Description	Default	Validation
flannelCNI string	FlannelCNI must be set if FlannelImages is set.		MinLength: 1 Required: {}
kubeFlannel string	KubeFlannel must be set if FlannelImages is set.		MinLength: 1 Required: {}

HelmChart

Underlying type: string

HelmChart is a reference to a helm chart.

Validation:

• Pattern: ^(oci://|https://).+$

Appears in:

• CNIInstallerConfiguration
• FlannelConfiguration
• HelmComponentConfig
• KataContainersConfiguration
• KubeStateMetricsConfiguration
• MultusConfiguration
• NVIPAMConfiguration
• NodeProblemDetectorConfiguration
• OVSCNIConfiguration
• OpenTelemetryCollectorConfiguration
• SFCControllerConfiguration
• SRIOVDevicePluginConfiguration
• ServiceSetControllerConfiguration

HelmComponentConfig

Appears in:

• CNIInstallerConfiguration
• FlannelConfiguration
• KataContainersConfiguration
• KubeStateMetricsConfiguration
• MultusConfiguration
• NVIPAMConfiguration
• NodeProblemDetectorConfiguration
• OVSCNIConfiguration
• OpenTelemetryCollectorConfiguration
• SFCControllerConfiguration
• SRIOVDevicePluginConfiguration
• ServiceSetControllerConfiguration

Field	Description	Default	Validation
helmChart HelmChart	HelmChart overrides the helm chart used by the ServiceSet controller. The URL must begin with either 'oci://' or 'https://', ensuring it points to a valid OCI registry or a web-based repository.		Pattern: ^(oci://|https://).+$ Optional: {}

Image

Underlying type: string

Image is a reference to a container image.

Validation:

• Pattern: ^((?:(?:(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))*|\[(?:[a-fA-F0-9:]+)\])(?::[0-9]+)?/)?[a-z0-9]+(?:(?:[._]|__|[-]+)[a-z0-9]+)*(?:/[a-z0-9]+(?:(?:[._]|__|[-]+)[a-z0-9]+)*)*)(?::([\w][\w.-]{0,127}))?(?:@([A-Za-z][A-Za-z0-9]*(?:[-_+.][A-Za-z][A-Za-z0-9]*)*[:][[:xdigit:]]{32,}))?$

Appears in:

• DPUDetectorConfiguration
• DPUServiceControllerConfiguration
• DefaultOverridesConfiguration
• FlannelCNI
• FlannelDaemon
• ImageComponentConfig
• KamajiClusterManagerConfiguration
• MultusConfiguration
• NVIPAMConfiguration
• NVIPAMController
• NVIPAMNode
• NodeSRIOVDevicePluginSettings
• OVSCNIConfiguration
• ProvisioningControllerConfiguration
• SFCControllerConfiguration
• SRIOVDevicePluginConfiguration
• ServiceSetControllerConfiguration
• StaticClusterManagerConfiguration

ImageComponentConfig

ImageComponentConfig provides common configuration fields that can be embedded by all component configurations to reduce code duplication.

Appears in:

• DefaultOverridesConfiguration
• FlannelCNI
• FlannelDaemon
• KataContainersConfiguration
• NVIPAMController
• NVIPAMNode

Field	Description	Default	Validation
image Image			Pattern: ^((?:(?:(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))*|\[(?:[a-fA-F0-9:]+)\])(?::[0-9]+)?/)?[a-z0-9]+(?:(?:[._]|__|[-]+)[a-z0-9]+)*(?:/[a-z0-9]+(?:(?:[._]|__|[-]+)[a-z0-9]+)*)*)(?::([\w][\w.-]\{0,127\}))?(?:@([A-Za-z][A-Za-z0-9]*(?:[-_+.][A-Za-z][A-Za-z0-9]*)*[:][[:xdigit:]]\{32,\}))?$ Optional: {}

InstallViaGNOI

InstallViaGNOI is the interface used to install the BFB via GNOI

Appears in:

• ProvisioningInstallInterface

InstallViaHostAgent

InstallViaHostAgent is the interface used to install the BFB

Appears in:

• ProvisioningInstallInterface

InstallViaRedfish

InstallViaRedfish is the interface used to install the BFB via Redfish

Appears in:

• ProvisioningInstallInterface

Field	Description	Default	Validation
bfbRegistryAddress string	BFBRegistryAddress is the address of the BFB Registry Deprecated: Use RegistryConfiguration instead.		MinLength: 1
bfbRegistry BFBRegistryConfiguration	BFBRegistry is the configuration for the BFB Registry Deprecated: Use RegistryConfiguration instead.		Optional: {}
skipDPUNodeDiscovery boolean	SkipDPUNodeDiscovery is a flag to skip the DPU node discovery.	true	Optional: {}

KamajiClusterManagerConfiguration

Appears in:

• DPFOperatorConfigSpec

Field	Description	Default	Validation
disable boolean	Disable ensures the component is not deployed when set to true.		Optional: {}
replicas integer	Replicas is the number of replicas for the controller deployment. Used for High Availability via leader election.	2	Maximum: 3 Minimum: 1 Optional: {}
image Image	Image overrides the container image used by the Kamaji Cluster Manager. Deprecated: This field is deprecated and will be removed with v26.7.0. Use the new field controller instead.		Pattern: ^((?:(?:(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))*|\[(?:[a-fA-F0-9:]+)\])(?::[0-9]+)?/)?[a-z0-9]+(?:(?:[._]|__|[-]+)[a-z0-9]+)*(?:/[a-z0-9]+(?:(?:[._]|__|[-]+)[a-z0-9]+)*)*)(?::([\w][\w.-]\{0,127\}))?(?:@([A-Za-z][A-Za-z0-9]*(?:[-_+.][A-Za-z][A-Za-z0-9]*)*[:][[:xdigit:]]\{32,\}))?$ Optional: {}
controller DefaultOverridesConfiguration	Controller contains the configuration for the Kamaji Cluster Manager component. It contains the image for the controller and its resource requirements.		Optional: {}
etcdEncryptionAtRest EtcdEncryptionAtRestConfiguration	EtcdEncryptionAtRest configures encryption at rest for the etcd datastore of Kamaji-managed DPU clusters. The provider selection is applied only when a Kamaji cluster is first created and is not changed for existing clusters.		Optional: {}

KataContainersConfiguration

Appears in:

• SecurityConfiguration

Field	Description	Default	Validation
disable boolean	Disable ensures the component is not deployed when set to true.		Optional: {}
helmChart HelmChart	HelmChart overrides the helm chart used by the ServiceSet controller. The URL must begin with either 'oci://' or 'https://', ensuring it points to a valid OCI registry or a web-based repository.		Pattern: ^(oci://|https://).+$ Optional: {}
daemon ImageComponentConfig	Daemon contains the configuration for the kata-deploy component. It contains the image for the kata-deploy container.		Optional: {}
nodeSelector object (keys:string, values:string)	NodeSelector restricts which nodes kata-deploy runs on. This is passed as the Helm chart's nodeSelector value.		Optional: {}
shims KataShim array	Shims selects which Kata hypervisor shims to enable. Defaults to ["qemu"] if empty.		Enum: [qemu] items:Enum: [qemu] Optional: {}
containerdConfigFileName string	ContainerdConfigFileName overrides the containerd config file name on the target nodes. Defaults to "config-mlnx.toml".		Optional: {}

KataShim

Underlying type: string

KataShim identifies a Kata hypervisor shim variant. Values must match the shim keys in the kata-deploy Helm chart's shims.<name>.enabled values. Only arm64-compatible shims are supported.

Validation:

• Enum: [qemu]

Appears in:

• KataContainersConfiguration

Field	Description
qemu	KataShimQEMU is the QEMU hypervisor shim.

KubeStateMetricsConfiguration

Appears in:

• MonitoringConfiguration

Field	Description	Default	Validation
disable boolean	Disable ensures the component is not deployed when set to true.		Optional: {}
helmChart HelmChart	HelmChart overrides the helm chart used by the ServiceSet controller. The URL must begin with either 'oci://' or 'https://', ensuring it points to a valid OCI registry or a web-based repository.		Pattern: ^(oci://|https://).+$ Optional: {}
daemon DefaultOverridesConfiguration	Daemon contains the configuration for the kube-state-metrics component. It contains the image for kube-state-metrics and its resource requirements.		Optional: {}

MonitoringConfiguration

MonitoringConfiguration defines the configuration for monitoring resources.

Appears in:

• DPFOperatorConfigSpec

Field	Description	Default	Validation
disable boolean	Disable controls whether monitoring resources are installed. When enabled (default), the controller: - Creates ServiceMonitors for Kamaji clusters to scrape control-plane metrics. - Deploys kube-state-metrics as a DPUService to expose metrics for custom resources. - Deploys node-problem-detector as a DaemonSet on DPU nodes to detect and report node-level problems. - Deploys opentelemetry-collector as a DaemonSet on DPU nodes to collect and forward logs.		Optional: {}
kubeStateMetrics KubeStateMetricsConfiguration	KubeStateMetrics is the configuration for kube-state-metrics		Optional: {}
nodeProblemDetector NodeProblemDetectorConfiguration	NodeProblemDetector is the configuration for node-problem-detector		Optional: {}
openTelemetryCollector OpenTelemetryCollectorConfiguration	OpenTelemetryCollector is the configuration for opentelemetry-collector		Optional: {}

MultusConfiguration

Appears in:

• DPFOperatorConfigSpec

Field	Description	Default	Validation
disable boolean	Disable ensures the component is not deployed when set to true.		Optional: {}
helmChart HelmChart	HelmChart overrides the helm chart used by the ServiceSet controller. The URL must begin with either 'oci://' or 'https://', ensuring it points to a valid OCI registry or a web-based repository.		Pattern: ^(oci://|https://).+$ Optional: {}
image Image	Image overrides the container image used by the Multus Container. Deprecated: This field is deprecated and will be removed with v26.7.0. Use the new field cni instead.		Pattern: ^((?:(?:(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))*|\[(?:[a-fA-F0-9:]+)\])(?::[0-9]+)?/)?[a-z0-9]+(?:(?:[._]|__|[-]+)[a-z0-9]+)*(?:/[a-z0-9]+(?:(?:[._]|__|[-]+)[a-z0-9]+)*)*)(?::([\w][\w.-]\{0,127\}))?(?:@([A-Za-z][A-Za-z0-9]*(?:[-_+.][A-Za-z][A-Za-z0-9]*)*[:][[:xdigit:]]\{32,\}))?$ Optional: {}
cni DefaultOverridesConfiguration	CNI contains the configuration for the Multus CNI component. It contains the image for the controller and its resource requirements.		Optional: {}

NVIPAMConfiguration

Appears in:

• DPFOperatorConfigSpec

Field	Description	Default	Validation
disable boolean	Disable ensures the component is not deployed when set to true.		Optional: {}
helmChart HelmChart	HelmChart overrides the helm chart used by the ServiceSet controller. The URL must begin with either 'oci://' or 'https://', ensuring it points to a valid OCI registry or a web-based repository.		Pattern: ^(oci://|https://).+$ Optional: {}
replicas integer	Replicas is the number of replicas for the controller deployment. Used for High Availability via leader election.	2	Maximum: 3 Minimum: 1 Optional: {}
image Image	Image overrides the container image used by the NVIPAM controller. Deprecated: This field is deprecated and will be removed with v26.7.0. Use the new field controller instead.		Pattern: ^((?:(?:(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))*|\[(?:[a-fA-F0-9:]+)\])(?::[0-9]+)?/)?[a-z0-9]+(?:(?:[._]|__|[-]+)[a-z0-9]+)*(?:/[a-z0-9]+(?:(?:[._]|__|[-]+)[a-z0-9]+)*)*)(?::([\w][\w.-]\{0,127\}))?(?:@([A-Za-z][A-Za-z0-9]*(?:[-_+.][A-Za-z][A-Za-z0-9]*)*[:][[:xdigit:]]\{32,\}))?$ Optional: {}
controller NVIPAMController	Controller contains the configuration for the NVIPAM controller component. It contains the image for the controller and its resource requirements.		Optional: {}
node NVIPAMNode	Node contains the configuration for the NVIPAM node component. It contains the image for the node and its resource requirements.

NVIPAMController

Appears in:

• NVIPAMConfiguration

Field	Description	Default	Validation
image Image			Pattern: ^((?:(?:(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))*|\[(?:[a-fA-F0-9:]+)\])(?::[0-9]+)?/)?[a-z0-9]+(?:(?:[._]|__|[-]+)[a-z0-9]+)*(?:/[a-z0-9]+(?:(?:[._]|__|[-]+)[a-z0-9]+)*)*)(?::([\w][\w.-]\{0,127\}))?(?:@([A-Za-z][A-Za-z0-9]*(?:[-_+.][A-Za-z][A-Za-z0-9]*)*[:][[:xdigit:]]\{32,\}))?$ Optional: {}
resources ResourceRequirements	Resources defines the memory and CPU resource requests and limits for the component. This field is optional, and if not set, the component will use the default resource.		Optional: {}

NVIPAMNode

Appears in:

• NVIPAMConfiguration

Field	Description	Default	Validation
image Image			Pattern: ^((?:(?:(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))*|\[(?:[a-fA-F0-9:]+)\])(?::[0-9]+)?/)?[a-z0-9]+(?:(?:[._]|__|[-]+)[a-z0-9]+)*(?:/[a-z0-9]+(?:(?:[._]|__|[-]+)[a-z0-9]+)*)*)(?::([\w][\w.-]\{0,127\}))?(?:@([A-Za-z][A-Za-z0-9]*(?:[-_+.][A-Za-z][A-Za-z0-9]*)*[:][[:xdigit:]]\{32,\}))?$ Optional: {}
resources ResourceRequirements	Resources defines the memory and CPU resource requests and limits for the component. This field is optional, and if not set, the component will use the default resource.		Optional: {}

Networking

Networking defines the networking configuration for the system components.

Appears in:

• DPFOperatorConfigSpec

Field	Description	Default	Validation
controlPlaneMTU integer	ControlPlaneMTU is the MTU value to be set on the management network. In zero-trust mode this value is applied to the DPU OOB interface (oob_net0), which does not support jumbo frames; it must not exceed 1500 when deploymentMode is zero-trust. The default is 1500.	1500	Maximum: 9216 Minimum: 1280 Optional: {}
highSpeedMTU integer	HighSpeedMTU is the MTU value to be set on the high-speed interface. The default is 1500.	1500	Maximum: 9216 Minimum: 1280 Optional: {}
dpuNodeOOBBridgeName string	DPUNodeOOBBridgeName is the name of the Linux bridge on the host used for out-of-band DPU management traffic. If not specified, defaults to "br-dpu". This setting applies only to host-trusted deployments.	br-dpu	MaxLength: 15 MinLength: 1 Pattern: ^[a-z][a-z0-9-]*$ Optional: {}

NodeProblemDetectorConfiguration

Appears in:

• MonitoringConfiguration

Field	Description	Default	Validation
disable boolean	Disable ensures the component is not deployed when set to true.		Optional: {}
helmChart HelmChart	HelmChart overrides the helm chart used by the ServiceSet controller. The URL must begin with either 'oci://' or 'https://', ensuring it points to a valid OCI registry or a web-based repository.		Pattern: ^(oci://|https://).+$ Optional: {}
daemon DefaultOverridesConfiguration	Daemon contains the configuration for the node-problem-detector component. It contains the image for node-problem-detector and its resource requirements.		Optional: {}

NodeSRIOVDevicePluginControllerConfiguration

NodeSRIOVDevicePluginControllerConfiguration is the configuration for the NodeSRIOVDevicePlugin controller. This controller manages per-node SRIOV device plugin pods based on DPU configurations. The controller is disabled by default.

Appears in:

• DPFOperatorConfigSpec

Field	Description	Default	Validation
disable boolean	Disable ensures the component is not deployed when set to true.		Optional: {}
replicas integer	Replicas is the number of replicas for the controller deployment. Used for High Availability via leader election.	2	Maximum: 3 Minimum: 1 Optional: {}
controller DefaultOverridesConfiguration	Controller contains the configuration for the NodeSRIOVDevicePlugin controller component. It contains the image for the controller and its resource requirements.		Optional: {}
devicePlugin NodeSRIOVDevicePluginSettings	DevicePlugin contains the configuration for the SRIOV device plugin pods managed by this controller.		Optional: {}

NodeSRIOVDevicePluginSettings

NodeSRIOVDevicePluginSettings contains configuration for the SRIOV device plugin pods managed by the NodeSRIOVDevicePlugin controller.

Appears in:

• NodeSRIOVDevicePluginControllerConfiguration

Field	Description	Default	Validation
image Image	Image overrides the container image for the SRIOV device plugin.		Pattern: ^((?:(?:(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))*|\[(?:[a-fA-F0-9:]+)\])(?::[0-9]+)?/)?[a-z0-9]+(?:(?:[._]|__|[-]+)[a-z0-9]+)*(?:/[a-z0-9]+(?:(?:[._]|__|[-]+)[a-z0-9]+)*)*)(?::([\w][\w.-]\{0,127\}))?(?:@([A-Za-z][A-Za-z0-9]*(?:[-_+.][A-Za-z][A-Za-z0-9]*)*[:][[:xdigit:]]\{32,\}))?$ Optional: {}
initImage Image	InitImage overrides the container image for the init container that generates device plugin configuration.		Pattern: ^((?:(?:(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))*|\[(?:[a-fA-F0-9:]+)\])(?::[0-9]+)?/)?[a-z0-9]+(?:(?:[._]|__|[-]+)[a-z0-9]+)*(?:/[a-z0-9]+(?:(?:[._]|__|[-]+)[a-z0-9]+)*)*)(?::([\w][\w.-]\{0,127\}))?(?:@([A-Za-z][A-Za-z0-9]*(?:[-_+.][A-Za-z][A-Za-z0-9]*)*[:][[:xdigit:]]\{32,\}))?$ Optional: {}
defaultResourcePrefix string	DefaultResourcePrefix is the default resource prefix for the SRIOV device plugin resources. Defaults to "nvidia.com".		Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ Optional: {}

OVSCNIConfiguration

Appears in:

• DPFOperatorConfigSpec

Field	Description	Default	Validation
disable boolean	Disable ensures the component is not deployed when set to true.		Optional: {}
helmChart HelmChart	HelmChart overrides the helm chart used by the ServiceSet controller. The URL must begin with either 'oci://' or 'https://', ensuring it points to a valid OCI registry or a web-based repository.		Pattern: ^(oci://|https://).+$ Optional: {}
image Image	Image overrides the container image used by the OVS CNI. Deprecated: This field is deprecated and will be removed with v26.7.0. Use the new field cni instead.		Pattern: ^((?:(?:(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))*|\[(?:[a-fA-F0-9:]+)\])(?::[0-9]+)?/)?[a-z0-9]+(?:(?:[._]|__|[-]+)[a-z0-9]+)*(?:/[a-z0-9]+(?:(?:[._]|__|[-]+)[a-z0-9]+)*)*)(?::([\w][\w.-]\{0,127\}))?(?:@([A-Za-z][A-Za-z0-9]*(?:[-_+.][A-Za-z][A-Za-z0-9]*)*[:][[:xdigit:]]\{32,\}))?$ Optional: {}
cni DefaultOverridesConfiguration	CNI contains the configuration for the OVS CNI component. It contains the image for the controller and its resource requirements.		Optional: {}

OpenTelemetryCollectorConfiguration

Appears in:

• MonitoringConfiguration

Field	Description	Default	Validation
disable boolean	Disable ensures the component is not deployed when set to true.		Optional: {}
helmChart HelmChart	HelmChart overrides the helm chart used by the ServiceSet controller. The URL must begin with either 'oci://' or 'https://', ensuring it points to a valid OCI registry or a web-based repository.		Pattern: ^(oci://|https://).+$ Optional: {}
daemon DefaultOverridesConfiguration	Daemon contains the configuration for the opentelemetry-collector component. It contains the image for opentelemetry-collector and its resource requirements.		Optional: {}
logging OpenTelemetryCollectorLoggingConfiguration	Logging contains the configuration for the opentelemetry-collector logging component. If not specified, logging will not be streamed.		Optional: {}
metrics OpenTelemetryCollectorMetricsConfiguration	Metrics contains the configuration for the opentelemetry-collector metrics component. If not specified, metrics will not be streamed from DPU clusters.		Optional: {}

OpenTelemetryCollectorLoggingConfiguration

Appears in:

• OpenTelemetryCollectorConfiguration

Field	Description	Default	Validation
endpoint string	Endpoint is the OTLP endpoint where the DPU cluster opentelemetry-collector sends data to. This could be the management cluster's opentelemetry-collector endpoint. If not specified, nothing will be forwarded from DPU clusters.		Required: {}

OpenTelemetryCollectorMetricsConfiguration

Appears in:

• OpenTelemetryCollectorConfiguration

Field	Description	Default	Validation
endpoint string	Endpoint is the OTLP endpoint where the DPU cluster opentelemetry-collector sends metrics to. This could be the management cluster's opentelemetry-collector endpoint. If not specified, metrics will not be forwarded from DPU clusters.		Required: {}

Overrides

Overrides exposes a set of fields which impact the recommended behavior of the DPF Operator. These fields should only be set for advanced use cases. The fields here have no stability guarantees.

Appears in:

• DPFOperatorConfigSpec

Field	Description	Default	Validation
paused boolean	Paused disables all reconciliation of the DPFOperatorConfig when set to true.		Optional: {}
dpuCNIBinPath string	DPUCNIBinPath is the path at which the CNI binaries will be installed to on the DPU. This is /opt/cni/bin by default. This setting does not change where kubelet is configured to use the CNI from.		Optional: {}
dpuCNIPath string	DPUCNIConfigPath is the path to which the CNI config files will be installed on the DPU. This is /etc/cni/net.d by default. This setting does not change where kubelet is configured to read the CNI config from.		Optional: {}
dpuOpenvSwitchRunPath string	DPUOpenvSwitchPath is the path at which the openvSwitch run directory can be found on the DPU. This is /var/run/openvswitch by default. This setting does not change where components are installed. Installation location fixed in the BFB.		Optional: {}
dpuOpenvSwitchBinPath string	DPUOpenvSwitchBinPath is the path at which the openvSwitch bin directory can be found on the DPU node. This is /usr/bin/ by default. This setting does not change where components are installed. Installation location fixed in the BFB.		Optional: {}
dpuOpenvSwitchSystemSharedPath string	DPUOpenvSwitchSystemSharedLibPath is the path at which the system lib used by OVS components can be found on the DPU. This is /lib by default. This setting does not change where components are installed. Installation location fixed in the BFB.		Optional: {}
flannelSkipCNIConfigInstallation boolean	FlannelSkipCNIConfigInstallation controls whether Flannel should skip CNI config installation. This is true by default, meaning Flannel does not manage its own CNI configuration. Set to false if you want Flannel to install a CNI configuration.		Optional: {}
dpuOpenvSwitchSystemSharedLib64Path string	DPUOpenvSwitchSystemSharedLib64Path is the path at which the system lib64 used by OVS components can be found on the DPU. If this field is not set, no lib64 volume mount will be configured in the SFC Controller component. This setting does not change where components are installed. Installation location fixed in the BFB.		MinLength: 1 Optional: {}
dpuLinkerCachePath string	DPULinkerCachePath is the path on the DPU at which the prebuilt dynamic-linker cache file can be found. When set, this file is mounted read-only into the SFC Controller container so that host OVS binaries can resolve shared libraries using the DPU's linker configuration. If not set, no linker cache mount is added. This setting does not change where components are installed. Installation location fixed in the BFB.		MinLength: 1 Optional: {}
dpuOptLibraryPath string	DPUOptLibraryPath is the path on the DPU at which an additional library directory can be found. When set, this directory is mounted read-only into the SFC Controller container. Useful on distributions that install vendor libraries outside the standard paths (e.g. /usr/opt on RHCOS BFB). If not set, no additional library directory is mounted. This setting does not change where components are installed. Installation location fixed in the BFB.		MinLength: 1 Optional: {}
kubernetesAPIServerVIP string	KubernetesAPIServerVIP is the VIP the Kubernetes API server is accessible at. This setting enables specific underlying components deployed directly or indirectly by the DPF Operator to reach the Kubernetes API Server when the ClusterIP Kubernetes Service is not functional. If set, it should be set to an IP to ensure that components work even if DNS is not available in the cluster.		Optional: {}
kubernetesAPIServerPort integer	KubernetesAPIServerPort is the port the Kubernetes API server is accessible at. This setting is usually used together with the kubernetesAPIServerVIP setting. It enables specific underlying components deployed directly or indirectly by the DPF Operator to reach the Kubernetes API Server when the ClusterIP Kubernetes Service is not functional.		Optional: {}
argoCDNamespace string	ArgoCDNamespace is the namespace where ArgoCD is deployed. AppProjects and cluster secrets required by DPF will be created in this namespace. Defaults to the namespace of the DPFOperatorConfig.		MaxLength: 63 MinLength: 1 Optional: {}
provisioningIssuerCASecretName string	ProvisioningIssuerCASecretName overrides the CA secret used by the provisioning Issuer during controlled CA rotation workflows. When unset, the default issuer secret is used.		MinLength: 1 Optional: {}

ProvisioningControllerConfiguration

Appears in:

• DPFOperatorConfigSpec

Field	Description	Default	Validation
disable boolean	Disable ensures the component is not deployed when set to true.		Optional: {}
replicas integer	Replicas is the number of replicas for the controller deployment. Used for High Availability via leader election.	2	Maximum: 3 Minimum: 1 Optional: {}
image Image	Image overrides the container image used by the Provisioning controller. Deprecated: This field is deprecated and will be removed with v26.7.0. Use the new field controller instead.		Pattern: ^((?:(?:(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))*|\[(?:[a-fA-F0-9:]+)\])(?::[0-9]+)?/)?[a-z0-9]+(?:(?:[._]|__|[-]+)[a-z0-9]+)*(?:/[a-z0-9]+(?:(?:[._]|__|[-]+)[a-z0-9]+)*)*)(?::([\w][\w.-]\{0,127\}))?(?:@([A-Za-z][A-Za-z0-9]*(?:[-_+.][A-Za-z][A-Za-z0-9]*)*[:][[:xdigit:]]\{32,\}))?$ Optional: {}
controller DefaultOverridesConfiguration	Controller contains the configuration for the Provisioning controller component. It contains the image for the controller and its resource requirements.		Optional: {}
bfCFGTemplateConfigMap string	BFCFGTemplateConfigMap is the name of a configMap containing a template for the BF.cfg file used by the DPU controller. By default the provisioning controller use a hardcoded BF.cfg e.g. https://github.com/NVIDIA/doca-platform/blob/release-v24.10/internal/provisioning/controllers/dpu/bfcfg/bf.cfg.template Note: Replacing the bf.cfg is an advanced use case. The default bf.cfg is designed for most use cases. Deprecated: BFCFGTemplateConfigMap is deprecated and will be removed in a future release. Use enableDynamicBFCFGTemplates instead for custom bf.cfg templates.		Optional: {}
enableDynamicBFCFGTemplates boolean	EnableDynamicBFCFGTemplates enables runtime discovery of bf.cfg templates via ConfigMaps. When enabled, the provisioning controller discovers ConfigMaps by matching labels for BFB name/namespace and DPUCluster name/namespace. Mutually exclusive with bfCFGTemplateConfigMap.		Optional: {}
bfbPVCName string	BFBPersistentVolumeClaimName is the name of the PersistentVolumeClaim used by dpf-provisioning-controller If not provided, the controller will use local host storage (hostPath)		Optional: {}
dmsTimeout integer	DMSTimeout is the max time in seconds within which a DMS API must respond, 0 is unlimited		Minimum: 1 Optional: {}
customCASecretName string	CustomCASecretName indicates the name of the Kubernetes secret object which containing the custom CA certificate		Optional: {}
installInterface ProvisioningInstallInterface	InstallInterface is the interface through which the BFB is installed		Optional: {}
registry RegistryConfiguration	Registry is the configuration for the BFB Registry		Optional: {}
maxDPUParallelInstallations integer	MaxDPUParallelInstallations specifies the maximum number of DPUs that can be provisioned concurrently. A DPU is removed from the concurrent provisioning count as soon as it finishes the "OS Installing" phase and enters the "Rebooting" phase of its provisioning lifecycle.	50	Minimum: 1 Optional: {}
multiDPUOperationsSyncWaitTime Duration	MultiDPUOperationsSyncWaitTime is the wait time between DPUs sync operations on the same node. It would take effect only on DPUNode objects which contain more than one DPU.	30s	Format: duration Pattern: ^([0-9]+(h|m|s|ms|us|µs|ns))+$ Type: string Optional: {}
maxUnavailableDPUNodes integer	MaxUnavailableDPUNodes is the maximum number of DPUNodes that are unavailable during the node effect period.	50	Minimum: 1 Optional: {}
osInstallTimeout Duration	OSInstallTimeout is the maximum time allowed for OS installation in zero-trust mode. If the installation exceeds this timeout, the DPU will transition to an error state. When unset, the provisioning controller defaults to 60m.		Format: duration Pattern: ^([0-9]+(h|m|s|ms|us|µs|ns))+$ Type: string Optional: {}
firmwareUpdateTimeout Duration	FirmwareUpdateTimeout is the maximum time allowed for BF4 firmware update in zero-trust mode. If the update exceeds this timeout, the DPU will transition to an error state. When unset, the provisioning controller defaults to 45m.		Format: duration Pattern: ^([0-9]+(h|m|s|ms|us|µs|ns))+$ Type: string Optional: {}
preInstallAgentRegistrationTimeout Duration	PreInstallAgentRegistrationTimeout is how long Initializing waits for the in-band dpu-agent to set preInstall.agentReported on a recreated DPU CR (reprovision). When the timeout elapses, provisioning continues without agent-assisted pre-install for this cycle.	30s	Format: duration Pattern: ^([0-9]+(h|m|s|ms|us|µs|ns))+$ Type: string Optional: {}
nodeEffectRemovalTimeout Duration	NodeEffectRemovalTimeout is the maximum time allowed for the Node Effect Removal phase. If the DPUNodeMaintenance CR still has requestors after this timeout, the DPU will transition to an error state. When unset, the provisioning controller defaults to 0s (timeout disabled).		Format: duration Pattern: ^([0-9]+(h|m|s|ms|us|µs|ns))+$ Type: string Optional: {}
hostAgentDNSPolicy DNSPolicy	HostAgentDNSPolicy sets the DNS policy for the hostagent pod. Valid values are 'ClusterFirstWithHostNet', 'ClusterFirst', 'Default' or 'None'. Defaults to 'ClusterFirstWithHostNet'.		Enum: [ClusterFirstWithHostNet ClusterFirst Default None] Optional: {}
bmcServerCertRenewBefore Duration	BMCServerCertRenewBefore is how long before expiry DPF rotates the DPU BMC mTLS server certificate. When unset, the provisioning controller defaults to 720h (30 days).		Format: duration Pattern: ^([0-9]+(h|m|s|ms|us|µs|ns))+$ Type: string Optional: {}

ProvisioningInstallInterface

ProvisioningInstallInterface is the interface used to install the BFB

Appears in:

• ProvisioningControllerConfiguration

Field	Description	Default	Validation
installViaGNOI InstallViaGNOI	InstallViaGNOI is the interface used to install the BFB via GNOI Deprecated: Use InstallViaHostAgent instead.		Optional: {}
installViaHostAgent InstallViaHostAgent	InstallViaHostAgent is the interface used to install the BFB via HostAgent		Optional: {}
installViaRedfish InstallViaRedfish	InstallViaRedfish is the interface used to install the BFB via Redfish		Optional: {}

RegistryConfiguration

Appears in:

• ProvisioningControllerConfiguration

Field	Description	Default	Validation
address string	Address is the address used to access the BFB Registry. The address must start with "http://". By default, the BFB Registry can be accessed via its Service. For non-kubernetes environments, this must be set due to the lack of kubelet on worker nodes. For zero-trust environments, this must be set so that the BFB Registry can be accessed from DPU BMC. Deprecated: Address is deprecated and will be removed in a future release.		Pattern: ^http:// Optional: {}
port integer	Port is the port on which the registry instances will listen Deprecated: Address is deprecated and will be removed in a future release.		Maximum: 65535 Minimum: 1 Optional: {}
loadBalancerAddress string	LoadBalancerAddress is the address of the load balancer for the BFB Registry which the hostagent/redfish use to fetch the BFB and generated bf.cfg. To enable the load balancer, you need to deploy your own load balancer controller and configure the LoadBalancerAddress field. Then check the bfb-registry nodeport service and make your load balancer controller to distribute the requests to the bfb-registry nodeport.		Pattern: ^http:// Optional: {}

ResourceComponentConfig

ResourceComponentConfig defines the resource requirements for a container.

Appears in:

• DefaultOverridesConfiguration
• FlannelDaemon
• NVIPAMController
• NVIPAMNode

Field	Description	Default	Validation
resources ResourceRequirements	Resources defines the memory and CPU resource requests and limits for the component. This field is optional, and if not set, the component will use the default resource.		Optional: {}

ResourceRequirements

Appears in:

• DefaultOverridesConfiguration
• FlannelDaemon
• NVIPAMController
• NVIPAMNode
• ResourceComponentConfig

Field	Description	Default	Validation
requests Resources	Requests defines the resource requests for the component.
limits Resources	Limits defines the resource limits for the component.

Resources

Appears in:

• ResourceRequirements

Field	Description	Default	Validation
cpu Quantity	CPU is the amount of CPU requested by the component.		Optional: {}
memory Quantity	Memory is the amount of Memory requested by the component.		Optional: {}

SFCControllerConfiguration

SFCControllerConfiguration intentionally does not embed BaseControllerConfig: HA is achieved via per-node sharding (DaemonSet + node-local cache + per-node reconcilers); each pod exclusively owns its node's state, which makes leader election unnecessary.

Appears in:

• DPFOperatorConfigSpec

Field	Description	Default	Validation
disable boolean	Disable ensures the component is not deployed when set to true.		Optional: {}
helmChart HelmChart	HelmChart overrides the helm chart used by the ServiceSet controller. The URL must begin with either 'oci://' or 'https://', ensuring it points to a valid OCI registry or a web-based repository.		Pattern: ^(oci://|https://).+$ Optional: {}
image Image	Image overrides the container image used by the SFC controller. Deprecated: This field is deprecated and will be removed with v26.7.0. Use the new field controller instead.		Pattern: ^((?:(?:(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))*|\[(?:[a-fA-F0-9:]+)\])(?::[0-9]+)?/)?[a-z0-9]+(?:(?:[._]|__|[-]+)[a-z0-9]+)*(?:/[a-z0-9]+(?:(?:[._]|__|[-]+)[a-z0-9]+)*)*)(?::([\w][\w.-]\{0,127\}))?(?:@([A-Za-z][A-Za-z0-9]*(?:[-_+.][A-Za-z][A-Za-z0-9]*)*[:][[:xdigit:]]\{32,\}))?$ Optional: {}
controller DefaultOverridesConfiguration	Controller contains the configuration for the SFC controller component. It contains the image for the controller and its resource requirements.		Optional: {}
secureFlowDeletionTimeout Duration	SecureFlowDeletionTimeout controls the timeout for which the API server is unreachable after which all the flows are deleted to prevent unintended packet leaks. It has effect when is greater than zero. Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.		Optional: {}

SPIFFEConfiguration

SPIFFEConfiguration is the per-cluster SPIFFE bootstrap parameter set

Appears in:

• SecurityConfiguration

Field	Description	Default	Validation
spireServerAddress string	SPIREServerAddress is the address of the pre-installed SPIRE Server in host:port form (e.g. "spire-server.spire-system.svc:8081").		MaxLength: 263 MinLength: 1 Required: {}
spireTrustDomain string	SPIRETrustDomain is the SPIRE-internal trust domain (e.g. "cs.internal") embedded in the DPU Agent SVID URI.		MaxLength: 253 MinLength: 1 Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ Required: {}
kubeAPIAudience string	KubeAPIAudience is the audience claim the DPU Agent's JWT-SVID must carry; it must match an entry in the kube-apiserver AuthenticationConfiguration.audiences[] (owned out-of-band).		MaxLength: 512 MinLength: 1 Required: {}
spireOIDCURL string	SPIREOIDCURL is the OIDC discovery (issuer) URL of the pre-installed SPIRE Server. The matching kube-apiserver AuthenticationConfiguration.jwt[].issuer value is applied out-of-band.		MaxLength: 2048 MinLength: 1 Required: {}
spireControllerManagerClassName string	spireControllerManagerClassName selects the SPIRE controller-manager instance that renders DPF ClusterStaticEntries.		MaxLength: 253 MinLength: 1 Required: {}
trustBundle SPIFFETrustBundleConfigMapReference	trustBundle references a ConfigMap whose data["bundle.pem"] key holds the SPIRE trust bundle in PEM form.		Required: {}

SPIFFETrustBundleConfigMapReference

SPIFFETrustBundleConfigMapReference references the ConfigMap (by name and namespace) whose data["bundle.pem"] key holds the SPIRE trust bundle in PEM form.

Appears in:

• SPIFFEConfiguration

Field	Description	Default	Validation
name string	Name is the name of the ConfigMap holding the SPIRE trust bundle.		MaxLength: 253 MinLength: 1 Required: {}
namespace string	Namespace is the namespace of the ConfigMap holding the SPIRE trust bundle.		MaxLength: 63 MinLength: 1 Required: {}

SRIOVDevicePluginConfiguration

Appears in:

• DPFOperatorConfigSpec

Field	Description	Default	Validation
disable boolean	Disable ensures the component is not deployed when set to true.		Optional: {}
helmChart HelmChart	HelmChart overrides the helm chart used by the ServiceSet controller. The URL must begin with either 'oci://' or 'https://', ensuring it points to a valid OCI registry or a web-based repository.		Pattern: ^(oci://|https://).+$ Optional: {}
image Image	Image overrides the container image used by the SRIOV Device Plugin container. Deprecated: This field is deprecated and will be removed with v26.7.0. Use the new field deviceplugin instead.		Pattern: ^((?:(?:(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))*|\[(?:[a-fA-F0-9:]+)\])(?::[0-9]+)?/)?[a-z0-9]+(?:(?:[._]|__|[-]+)[a-z0-9]+)*(?:/[a-z0-9]+(?:(?:[._]|__|[-]+)[a-z0-9]+)*)*)(?::([\w][\w.-]\{0,127\}))?(?:@([A-Za-z][A-Za-z0-9]*(?:[-_+.][A-Za-z][A-Za-z0-9]*)*[:][[:xdigit:]]\{32,\}))?$ Optional: {}
deviceplugin DefaultOverridesConfiguration	DevicePlugin contains the configuration for the SRIOV Device Plugin component. It contains the image for the controller and its resource requirements.		Optional: {}

SecretKeyRef

SecretKeyRef selects a single key from a Secret living in the same namespace as the DPFOperatorConfig.

Appears in:

• StaticKeyConfiguration
• VaultKMSJWTAuth
• VaultKMSTokenAuth

Field	Description	Default	Validation
name string	Name is the name of the Secret.		MinLength: 1 Required: {}
key string	Key is the key within the Secret data to select.		MinLength: 1 Required: {}

SecurityConfiguration

SecurityConfiguration groups configuration for security-related configurations managed by the DPF Operator.

Appears in:

• DPFOperatorConfigSpec

Field	Description	Default	Validation
privilegedPodEnforcement boolean	PrivilegedPodEnforcement controls whether privileged pods are rejected unless explicitly allowed by the workload API. The DPUService controller currently implements this by applying the PrivilegedPodEnforcement ValidatingAdmissionPolicy to DPUService workloads. Setting it to false does not fully opt out of enforcement: the policy and its binding are kept, but the binding is switched from Deny to Audit, so privileged pods are no longer denied and are only recorded in the audit log. The allowlist is kept populated so the audit log only flags pods that would otherwise be denied. The objects are intentionally not deleted to avoid a Kubernetes paramRef informer bug (https://github.com/kubernetes/kubernetes/issues/133827). Defaults to true.	true	Optional: {}
kata KataContainersConfiguration	Kata is the configuration for Kata Containers. Kata Containers provides VM-based isolation for untrusted workloads on DPU nodes. This component is disabled by default; set disable to false to enable.		Optional: {}
spiffe SPIFFEConfiguration	spiffe configures the SPIFFE-based DPU Agent identity flow. Edits are accepted post-bootstrap but do NOT retro-apply to already-provisioned DPUs.		Optional: {}
vaultKMS VaultKMSConfiguration	VaultKMS is the configuration for the standalone Vault/OpenBao KMS plugin component. It is deployed as a DaemonSet on control-plane nodes and is disabled by default. The plugin is used for encryption at rest for DPUClusters.		Optional: {}

ServiceSetControllerConfiguration

Appears in:

• DPFOperatorConfigSpec

Field	Description	Default	Validation
disable boolean	Disable ensures the component is not deployed when set to true.		Optional: {}
replicas integer	Replicas is the number of replicas for the controller deployment. Used for High Availability via leader election.	2	Maximum: 3 Minimum: 1 Optional: {}
helmChart HelmChart	HelmChart overrides the helm chart used by the ServiceSet controller. The URL must begin with either 'oci://' or 'https://', ensuring it points to a valid OCI registry or a web-based repository.		Pattern: ^(oci://|https://).+$ Optional: {}
image Image	Image overrides the container image used by the ServiceChainSet Controller. Deprecated: This field is deprecated and will be removed with v26.7.0. Use the new field controller instead.		Pattern: ^((?:(?:(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))*|\[(?:[a-fA-F0-9:]+)\])(?::[0-9]+)?/)?[a-z0-9]+(?:(?:[._]|__|[-]+)[a-z0-9]+)*(?:/[a-z0-9]+(?:(?:[._]|__|[-]+)[a-z0-9]+)*)*)(?::([\w][\w.-]\{0,127\}))?(?:@([A-Za-z][A-Za-z0-9]*(?:[-_+.][A-Za-z][A-Za-z0-9]*)*[:][[:xdigit:]]\{32,\}))?$ Optional: {}
controller DefaultOverridesConfiguration	Controller contains the configuration for the ServiceChainSet controller component. It contains the image for the controller and its resource requirements.		Optional: {}

StaticClusterManagerConfiguration

Appears in:

• DPFOperatorConfigSpec

Field	Description	Default	Validation
disable boolean	Disable ensures the component is not deployed when set to true.		Optional: {}
replicas integer	Replicas is the number of replicas for the controller deployment. Used for High Availability via leader election.	2	Maximum: 3 Minimum: 1 Optional: {}
image Image	Image overrides the container image used by the Static Cluster Manager. Deprecated: This field is deprecated and will be removed with v26.7.0. Use the new field controller instead.		Pattern: ^((?:(?:(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))*|\[(?:[a-fA-F0-9:]+)\])(?::[0-9]+)?/)?[a-z0-9]+(?:(?:[._]|__|[-]+)[a-z0-9]+)*(?:/[a-z0-9]+(?:(?:[._]|__|[-]+)[a-z0-9]+)*)*)(?::([\w][\w.-]\{0,127\}))?(?:@([A-Za-z][A-Za-z0-9]*(?:[-_+.][A-Za-z][A-Za-z0-9]*)*[:][[:xdigit:]]\{32,\}))?$ Optional: {}
controller DefaultOverridesConfiguration	Controller contains the configuration for the Static Cluster Manager controller component. It contains the image for the controller and its resource requirements.		Optional: {}

StaticKeyConfiguration

StaticKeyConfiguration configures the staticKey encryption-at-rest provider.

Appears in:

• EtcdEncryptionAtRestConfiguration

Field	Description	Default	Validation
keySecretRef SecretKeyRef	KeySecretRef selects the AES-GCM key from a Secret in the DPFOperatorConfig namespace. The referenced Secret value must be base64-encoded AES key text whose decoded length is 16, 24, or 32 bytes. For Kubernetes manifests, use stringData.key with the output of openssl rand -base64 32. For External Secrets, configure the external value or template so the resulting Kubernetes Secret data decodes to that base64 text, not to raw key bytes. The referenced key is used as the desired static key source. Changing the referenced Secret value triggers automatic rotation for existing staticKey-encrypted Kamaji clusters. The per-cluster rendered encryption configuration must be backed up together with the cluster etcd backup because Kubernetes encrypted data references encryption config key names.		Required: {}
automaticRotationDisabled boolean	AutomaticRotationDisabled disables automatic staticKey rotation for existing Kamaji clusters. In-flight rotations stop at the next stable checkpoint; encryption at rest remains enabled.		Optional: {}

VaultKMSAppRoleAuth

VaultKMSAppRoleAuth configures the AppRole auth method using a single merged Secret.

Appears in:

• VaultKMSAuth

Field	Description	Default	Validation
secretName string	SecretName is the name of the Secret holding the AppRole role ID and secret ID.		MinLength: 1 Required: {}
authEngineMountPath string	AuthEngineMountPath optionally overrides the Vault auth engine mount path. It is not the transit mount.		MaxLength: 512 MinLength: 1 Optional: {}
roleIDKey string	RoleIDKey is the Secret data key holding the AppRole role ID.		MinLength: 1 Required: {}
secretIDKey string	SecretIDKey is the Secret data key holding the AppRole secret ID.		MinLength: 1 Required: {}

VaultKMSAuth

VaultKMSAuth configures the Vault/OpenBao auth method. Exactly one auth block matching method must be set.

Appears in:

• VaultKMSConfiguration

Field	Description	Default	Validation
method VaultKMSAuthMethod	Method selects the Vault auth method.		Enum: [token approle userpass kubernetes jwt] Required: {}
token VaultKMSTokenAuth	Token configures token auth.		Optional: {}
appRole VaultKMSAppRoleAuth	AppRole configures AppRole auth.		Optional: {}
userpass VaultKMSUserpassAuth	Userpass configures userpass auth.		Optional: {}
kubernetes VaultKMSKubernetesAuth	Kubernetes configures Kubernetes auth.		Optional: {}
jwt VaultKMSJWTAuth	JWT configures JWT auth.		Optional: {}

VaultKMSAuthMethod

Underlying type: string

VaultKMSAuthMethod selects the Vault/OpenBao auth method used by the KMS plugin.

Validation:

• Enum: [token approle userpass kubernetes jwt]

Appears in:

• VaultKMSAuth

Field	Description
token	VaultKMSAuthMethodToken authenticates using a Vault token.
approle	VaultKMSAuthMethodAppRole authenticates using the AppRole auth method.
userpass	VaultKMSAuthMethodUserpass authenticates using the userpass auth method.
kubernetes	VaultKMSAuthMethodKubernetes authenticates using the Kubernetes auth method.
jwt	VaultKMSAuthMethodJWT authenticates using the JWT auth method.

VaultKMSConfiguration

VaultKMSConfiguration configures the standalone Vault/OpenBao KMS plugin component. The component is deployed as a DaemonSet on control-plane nodes and is disabled by default. The plugin is used for encryption at rest for DPUClusters.

Appears in:

• SecurityConfiguration

Field	Description	Default	Validation
disable boolean	Disable ensures the component is not deployed when set to true.		Optional: {}
daemon DefaultOverridesConfiguration	Daemon contains the image and resource overrides for the KMS plugin DaemonSet.		Optional: {}
tls VaultKMSTLS	TLS configures TLS settings used to connect to Vault/OpenBao.		Optional: {}
auth VaultKMSAuth	Auth configures how the plugin authenticates to Vault/OpenBao.		Required: {}
tokenCheckIntervalSeconds integer	TokenCheckIntervalSeconds optionally overrides how often the plugin checks and renews the current Vault token, in seconds. This is an advanced setting. The plugin default should work for most environments. Must be at least 5 seconds.		Minimum: 5 Optional: {}
loginTimeoutSeconds integer	LoginTimeoutSeconds optionally overrides the maximum time for one Vault token check cycle, including authentication, in seconds. This is an advanced setting. The plugin default should work for most environments. Must be at least 1 second.		Minimum: 1 Optional: {}
address string	Address is the Vault/OpenBao server address. WARNING: Changing this field does not automatically rotate the encryption key or re-encrypt existing DPU cluster secrets. Do not change it while active DPU clusters depend on this KMS plugin unless the new endpoint provides access to the key material used by the previous endpoint. Otherwise, those clusters will be unable to decrypt their existing secrets, causing an outage.		MaxLength: 2048 MinLength: 1 Pattern: ^https://.+$ Required: {}
transit VaultKMSTransit	Transit configures the Vault Transit secrets engine used for encrypt/decrypt. WARNING: Changing this field does not automatically rotate the encryption key or re-encrypt existing DPU cluster secrets. Do not change it while active DPU clusters depend on this KMS plugin unless the new Transit configuration provides access to all key material used by the previous configuration. Otherwise, those clusters will be unable to decrypt their existing secrets, causing an outage.		Required: {}
namespace string	Namespace optionally configures the Vault/OpenBao namespace used for requests. This is a Vault/OpenBao namespace, not a Kubernetes namespace. WARNING: Changing this field does not automatically rotate the encryption key or re-encrypt existing DPU cluster secrets. Do not change it while active DPU clusters depend on this KMS plugin unless the new namespace provides access to the key material used by the previous namespace. Otherwise, those clusters will be unable to decrypt their existing secrets, causing an outage.		MaxLength: 512 MinLength: 1 Optional: {}

VaultKMSJWTAuth

VaultKMSJWTAuth configures the JWT auth method.

Appears in:

• VaultKMSAuth

Field	Description	Default	Validation
role string	Role is the Vault JWT auth role name.		MinLength: 1 Required: {}
jwtSecretRef SecretKeyRef	JWTSecretRef selects the JWT presented to Vault from a Secret in the DPFOperatorConfig namespace.		Required: {}
authEngineMountPath string	AuthEngineMountPath optionally overrides the Vault auth engine mount path. It is not the transit mount.		MaxLength: 512 MinLength: 1 Optional: {}

VaultKMSKubernetesAuth

VaultKMSKubernetesAuth configures the Kubernetes auth method.

Appears in:

• VaultKMSAuth

Field	Description	Default	Validation
role string	Role is the Vault Kubernetes auth role name (not a Kubernetes RBAC role).		MinLength: 1 Required: {}
audience string	Audience optionally sets the audience for the projected Kubernetes service account token. Use this when the Vault Kubernetes auth role is configured with bound audiences.		MaxLength: 512 MinLength: 1 Optional: {}
authEngineMountPath string	AuthEngineMountPath optionally overrides the Vault auth engine mount path. It is not the transit mount.		MaxLength: 512 MinLength: 1 Optional: {}

VaultKMSTLS

VaultKMSTLS configures TLS settings for the connection to Vault/OpenBao.

Appears in:

• VaultKMSConfiguration

Field	Description	Default	Validation
caConfigMapRef ConfigMapKeyRef	CACertConfigMapRef selects a CA bundle key from a ConfigMap used to verify the Vault/OpenBao server certificate. It is mounted as a file.		Optional: {}

VaultKMSTokenAuth

VaultKMSTokenAuth configures the token auth method.

Appears in:

• VaultKMSAuth

Field	Description	Default	Validation
tokenSecretRef SecretKeyRef	TokenSecretRef selects the Vault token from a Secret in the DPFOperatorConfig namespace.		Required: {}

VaultKMSTransit

VaultKMSTransit configures the Vault Transit secrets engine.

Appears in:

• VaultKMSConfiguration

Field	Description	Default	Validation
keyName string	KeyName is the Transit key used for encrypt and decrypt operations.		MinLength: 1 Pattern: ^\w(([\w-.]+)?\w)?$ Required: {}
mount string	Mount is the Transit secrets engine mount path. Defaults to "transit".	transit	MaxLength: 512 MinLength: 1 Pattern: ^/?[^/\s][^\s]*$ Optional: {}

VaultKMSUserpassAuth

VaultKMSUserpassAuth configures the userpass auth method using a single merged Secret.

Appears in:

• VaultKMSAuth

Field	Description	Default	Validation
secretName string	SecretName is the name of the Secret holding the username and password.		MinLength: 1 Required: {}
authEngineMountPath string	AuthEngineMountPath optionally overrides the Vault auth engine mount path. It is not the transit mount.		MaxLength: 512 MinLength: 1 Optional: {}
usernameKey string	UsernameKey is the Secret data key holding the username.		MinLength: 1 Required: {}
passwordKey string	PasswordKey is the Secret data key holding the password.		MinLength: 1 Required: {}

provisioning.dpu.nvidia.com/v1alpha1

Package v1alpha1 contains API Schema definitions for the provisioning.dpu v1alpha1 API group

Resource Types

• BFB
• BFBList
• BlueFieldSoftware
• BlueFieldSoftwareList
• DPU
• DPUCluster
• DPUClusterList
• DPUDevice
• DPUDeviceList
• DPUDiscovery
• DPUDiscoveryList
• DPUFlavor
• DPUFlavorList
• DPUFlavorTemplate
• DPUFlavorTemplateList
• DPUList
• DPUNode
• DPUNodeList
• DPUNodeMaintenance
• DPUNodeMaintenanceList
• DPUSet
• DPUSetList

Action

Action defines the mutually exclusive node effect applied during provisioning. Exactly one of taint, noEffect=true, drain=true, non-empty customLabel, non-empty customAction, or hold=true must be set.

Appears in:

• DPUs
• NodeEffect

Field	Description	Default	Validation
taint Taint	Add specify taint on the DPU node		Optional: {}
noEffect boolean	Do not do any action on the DPU node		Optional: {}
customLabel object (keys:string, values:string)	Add specify labels on the DPU node		Optional: {}
drain boolean	Drain the K8s host node by NodeMaintenance operator		Optional: {}
customAction string	Name of a config map which contains a pod yaml definition to run which will apply the nodeEffect. The pod is expected to exit when node effect is done, if pod terminates with error then DPU would move to an error phase. The DPUNode's name will be exported as an environment variable, named as DPUNODE_NAME, to each container and init container in the pod. The labels and annotations of DPUNode will be exported in /etc/dpu/dpf-pod-info/labels and /etc/dpu/dpf-pod-info/annotations accordingly; the volume name dpf-pod-info is used to mount the labels and annotations. If any name confliction for env or volume, the controller will not export the name or labels/annotations of DPUNode accordingly.		Optional: {}
hold boolean	Places annotation wait-for-external-nodeeffect and waits for it to be removed this is the default behavior in a non K8S environment		Optional: {}
force boolean	Force is the flag to indicate if the node effect should be applied immediately. If true, dpfOperatorConfig.multiDPUOperationsSyncWaitTime and dpfOperatorConfig.maxUnavailableDPUNodes will be ignored when applying node effect for DPUNodeMaintenance CR	false	Optional: {}

AgentPreInstallStatus

AgentPreInstallStatus is agent status for reprovisioning.

Appears in:

• AgentStatus

Field	Description	Default	Validation
agentReported Time	AgentReported is set with a timestamp when dpu-agent detects a new DPU CR is created for reprovisioning.		Optional: {}
conditions Condition array	Conditions contains pre-install conditions (e.g. NVConfigApplied for reprovisioning).		Optional: {}

AgentStatus

Appears in:

• DPUStatus

Field	Description	Default	Validation
lastStartupTime Time	LastStartupTime is the time when the DPU was last started		Optional: {}
initialBootID string	InitialBootID is the boot ID of the DPU OS during the first boot
rebootMethod RebootMethodType	RebootMethod is the type of reset/reboot set by the DPU agent See enum values in RebootMethodType. No default is set intentionally: nil means "check not run or not applicable" (e.g. legacy flow, or agent has not run the check yet); a non-nil value means the check ran and this is the result.		Enum: [Unknown NoAction PowerCycle SystemReboot SystemLevelReset FirmwareReset DPUWarmReboot HostlessDPUReboot] Optional: {}
lastObservedPendingNvconfig PendingNVConfigState	LastObservedPendingNVConfig stores the last pending NVConfig parameters seen during reboot-method discovery on this boot. It is used on the next boot to ignore repeated parameters that remained unchanged across boots.		Optional: {}
rebootSequenceCount integer	RebootSequenceCount is the length of the current non-NoAction RebootMethod sequence: it increments on each agent run that reports a RebootMethod other than NoAction and resets to 0 when the agent reports NoAction. Used with RebootMethod to bound host reboot loops.		Minimum: 0 Optional: {}
kubeletVersion string	KubeletVersion represents the kubelet version running on the DPU.
preInstall AgentPreInstallStatus	PreInstall holds agent-reported status for work done before OS install in the reprovisioning process.		Optional: {}
trustBundleHash string	TrustBundleHash is the bundle-hash value last applied by the DPU agent.		Optional: {}
trustBundleLastUpdateTime Time	TrustBundleLastUpdateTime is when the trust bundle was last updated by the DPU agent.		Optional: {}
conditions Condition array	Conditions contains the conditions reported from inside the DPU		Optional: {}
spiffe SpiffeStatus	Spiffe contains the SPIFFE heartbeat status reported by the DPU Agent when running in SPIFFE identity mode.		Optional: {}
hostOSInit HostOSInitStatus	hostOSInit reports terminal host OS init release status from the DPU agent. Unset while the agent is polling or has not reached ReleaseHostOSInit.		Optional: {}

BFB

BFB is the Schema for the bfbs API

Appears in:

• BFBList

Field	Description	Default	Validation
apiVersion string	provisioning.dpu.nvidia.com/v1alpha1
kind string	BFB
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec BFBSpec
status BFBStatus		{ phase:Initializing }	Optional: {}

BFBList

BFBList contains a list of BFB

Field	Description	Default	Validation
apiVersion string	provisioning.dpu.nvidia.com/v1alpha1
kind string	BFBList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items BFB array

BFBPhase

Underlying type: string

BFBPhase describes current state of BFB CR. Only one of the following state may be specified. Default is Initializing.

Validation:

• Enum: [Initializing Downloading Ready Deleting Error]

Appears in:

• BFBStatus

Field	Description
Initializing	BFB CR is created
Downloading	Downloading BFB file
Ready	Finished downloading BFB file, ready for DPU to use
Deleting	Delete BFB
Error	Error happens during BFB downloading

BFBReference

BFBReference is a reference to a specific BFB

Appears in:

• DPUTemplateSpec

Field	Description	Default	Validation
name string	Specifies name of the bfb CR to use for this DPU		MinLength: 1

BFBSpec

BFBSpec defines the content of the BFB

Appears in:

• BFB

Field	Description	Default	Validation
fileName string	Specifies the file name where the BFB is downloaded on the volume.		Pattern: ^[A-Za-z0-9\_\-\.]+\.bfb$ Optional: {}
url string	The url of the bfb image to download.		Pattern: ^(http|https)://.+$ Required: {}
versions BFBVersions	Optionally specify BFB component versions. When set, these versions are used directly in status instead of being extracted from the BFB file. If set, all four fields (BSP, DOCA, UEFI, ATF) must be provided.		Optional: {}

BFBStatus

BFBStatus defines the observed state of BFB

Appears in:

• BFB

Field	Description	Default	Validation
fileName string	Filename is the name of the file where the BFB can be accessed on its volume. This is the same as .spec.Filename if set.
phase BFBPhase	The current state of BFB.	Initializing	Enum: [Initializing Downloading Ready Deleting Error] Required: {}
versions BFBVersions	BFB versions - BSP, DOCA, UEFI and ATF Holds detailed version information for each component within the BFB		Optional: {}
observedGeneration integer	ObservedGeneration records the Generation observed on the object the last time it was patched.
conditions Condition array	Conditions represent the latest available observations of BFB state		Optional: {}

BFBVersions

BFBVersions represents the version information for BFB components.

Appears in:

• BFBSpec
• BFBStatus

Field	Description	Default	Validation
bsp string	BSP (Board Support Package) version. This field stores the version of the BSP, which provides essential support and drivers for the hardware platform.		Optional: {}
doca string	DOCA version Specifies the version of NVIDIA's Data Center-on-a-Chip Architecture (DOCA), a platform for developing applications on DPUs		Optional: {}
uefi string	UEFI (Unified Extensible Firmware Interface) version. Indicates the UEFI firmware version, which is responsible for booting the operating system and initializing hardware components		Optional: {}
atf string	ATF (Arm Trusted Firmware) version. Contains the version of ATF, which provides a secure runtime environment		Optional: {}

BlueFieldSoftware

BlueFieldSoftware is the Schema for the bluefieldsoftware API

Appears in:

• BlueFieldSoftwareList

Field	Description	Default	Validation
apiVersion string	provisioning.dpu.nvidia.com/v1alpha1
kind string	BlueFieldSoftware
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec BlueFieldSpec
status BlueFieldSoftwareStatus		{ phase:Initializing }	Optional: {}

BlueFieldSoftwareList

BlueFieldSoftwareList contains a list of BlueFieldSoftware

Field	Description	Default	Validation
apiVersion string	provisioning.dpu.nvidia.com/v1alpha1
kind string	BlueFieldSoftwareList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items BlueFieldSoftware array

BlueFieldSoftwarePhase

Underlying type: string

BlueFieldSoftwarePhase describes current state of BlueFieldSoftware CR. Only one of the following state may be specified. Default is Initializing.

Validation:

• Enum: [Initializing Downloading Extracting Ready Deleting Error]

Appears in:

• BlueFieldSoftwareStatus

Field	Description
Initializing	BlueFieldSoftware CR is created
Downloading	Downloading BlueFieldSoftware components
Extracting	Extracting BlueFieldSoftware components from downloaded bundle
Ready	Finished downloading BlueFieldSoftware components, ready for DPU to use
Deleting	Delete BlueFieldSoftware
Error	Error happens during BlueFieldSoftware downloading

BlueFieldSoftwareReference

BlueFieldSoftwareReference is a reference to a specific BlueFieldSoftware

Appears in:

• DPUTemplateSpec

Field	Description	Default	Validation
name string	Specifies name of the BlueFieldSoftware CR to use for this DPU		MinLength: 1

BlueFieldSoftwareStatus

BlueFieldSoftwareStatus defines the observed state of BlueFieldSoftware

Appears in:

• BlueFieldSoftware

Field	Description	Default	Validation
phase BlueFieldSoftwarePhase	The current state of BlueFieldSoftware.	Initializing	Enum: [Initializing Downloading Extracting Ready Deleting Error] Required: {}
versions BluefieldSoftwareVersions	Versions tracks the versions of the components		Optional: {}
downloadedComponents DownloadedComponents	DownloadedComponents tracks which components have been successfully downloaded		Optional: {}
observedGeneration integer	ObservedGeneration records the Generation observed on the object the last time it was patched.
conditions Condition array	Conditions represent the latest available observations of BlueFieldSoftware state		Optional: {}

BlueFieldSpec

BlueFieldSpec defines the desired state of BlueFieldSoftware.

Appears in:

• BlueFieldSoftware

Field	Description	Default	Validation
pldmFwBundle string	PldmFwBundle points to the BluefieldPLDM firmware bundle for baseline firmware updates.		MinLength: 1 Optional: {}
forceFwUpdate boolean	ForceFwUpdate points to the force firmware update flag.	false	Optional: {}
osIso string	OS ISO points to the OS ISO used by DPU OS installation flow.		MinLength: 1 Required: {}
platformPldmFwBundle string	PlatformPldmFwBundle points to the Vera Rubin PLDM firmware bundle used for NIC firmware updates.		MinLength: 1 Optional: {}
nicFw string	NicFw points to the NIC firmware binary used for E/W NIC firmware updates. Use this when a specific NIC firmware binary is required and is not included in the platform PLDM firmware bundle. In production, prefer using PlatformPldmFwBundle.		MinLength: 1 Optional: {}

BluefieldSoftwareVersions

BluefieldSoftwareVersions defines the versions of various software components for a Bluefield device.

Appears in:

• BlueFieldSoftwareStatus

Field	Description	Default	Validation
doca string	DOCA is the formatted, user-facing DOCA version derived from the OS ISO.		Optional: {}
fwBundleVersion string
osISOVersion string	OSISOVersion is the raw DOCA version for the OS ISO, taken from the ISO filename		Optional: {}
ewNicFwVersion string
bmcVersion string
bmcErotVersion string
sbiosVersion string
bfNicFwVersion string

CertificateStatus

CertificateStatus reports the rotation state of a DPF-managed certificate.

Appears in:

• DPUDeviceStatus

Field	Description	Default	Validation
notAfter Time	NotAfter is the expiry time of the certificate currently installed. It is taken from the issued certificate at rotation time.		Optional: {}
lastRotationTime Time	LastRotationTime is the time DPF last successfully rotated the certificate.		Optional: {}
observedManualTrigger string	ObservedManualTrigger records the value of the manual rotation annotation that was last honored, so the same trigger is not processed twice.		Optional: {}

ClusterEndpointSpec

Appears in:

• DPUClusterSpec

Field	Description	Default	Validation
keepalived KeepalivedSpec	Keepalived configures the keepalived that will be deployed for the cluster control-plane		Optional: {}

ClusterPhase

Underlying type: string

ClusterPhase describes current state of DPUCluster. Only one of the following state may be specified. Default is Pending.

Validation:

• Enum: [Pending Creating Ready NotReady Failed]

Appears in:

• DPUClusterStatus

Field	Description
Pending
Creating
Ready
NotReady
Failed

ClusterSpec

Appears in:

• DPUTemplateSpec
• K8sCluster

Field	Description	Default	Validation
nodeLabels object (keys:string, values:string)	NodeLabels specifies the labels to be added to the node.		Optional: {}
nodeAnnotations object (keys:string, values:string)	NodeAnnotations specifies the annotations to be added to the node.		Optional: {}
selector LabelSelector	Selector defines the selector of the DPUClusters the produced DPUs should join		Optional: {}

ConfigFile

ConfigFile describes a file materialized from inline raw content or external contentFrom.

Appears in:

• DPUFlavorSpec

Field	Description	Default	Validation
type ConfigFileType	Type controls when the file content is materialized. cloud-init files use raw inline content and are written during cloud-init. agent-applied files use contentFrom and are written later by dpu-agent. Defaults to cloud-init when omitted.	cloud-init	Enum: [cloud-init agent-applied] Optional: {}
path string	Path is the path of the file to be written.		Required: {}
operation DPUFlavorFileOp	Operation is the operation to be performed on the file.		Enum: [override append] Optional: {}
raw string	Raw is the inline file content. Supported only when type is cloud-init. When type is omitted, type defaults to cloud-init and raw must be set.		Optional: {}
contentFrom ConfigFileContentSource	ContentFrom references external content for the file. Supported only when type is agent-applied.		Optional: {}
permissions string	Permissions are the permissions to be set on the file.		Optional: {}

ConfigFileContentSource

Appears in:

• ConfigFile

Field	Description	Default	Validation
configMapKeyRef ConfigMapKeySelector	ConfigMapKeyRef selects a key from a ConfigMap in the DPU namespace.		Optional: {}

ConfigFileType

Underlying type: string

ConfigFileType defines when a config file is materialized.

Validation:

• Enum: [cloud-init agent-applied]

Appears in:

• ConfigFile

Field	Description
cloud-init
agent-applied

ContainerdConfig

Appears in:

• DPUFlavorSpec

Field	Description	Default	Validation
registryEndpoint string	RegistryEndpoint is the endpoint of the container registry.		Optional: {}

DMAScalableFunction

DMAScalableFunction configures the DMA SF that the dpu-agent creates on BlueField-4 socket-direct systems when Enabled is true.

Appears in:

• ScalableFunctions

Field	Description	Default	Validation
enabled boolean	Enabled controls whether the dpu-agent creates the DMA SF. The presence of the dma struct alone does not enable creation; enabled must be set explicitly. Only takes effect on BlueField-4 socket-direct systems.		Required: {}
sfNum integer	SFNum is the number of the DMA Scalable Function. Defaults to 8000 when unset. Only takes effect on BlueField-4 socket-direct systems.		Minimum: 1 Optional: {}
macAddress string	MACAddress pins the DMA SF's MAC address (canonical colon-separated 48-bit form, e.g. "02:40:51:7c:e3:0f"). Defaults to a deterministic, vendor-compatible derivation when unset.		Pattern: ^([0-9A-Fa-f]\{2\}:)\{5\}[0-9A-Fa-f]\{2\}$ Optional: {}

DMSAddress

DMSAddress represents the IP and Port configuration for DMS.

Appears in:

• DPUNodeSpec

Field	Description	Default	Validation
ip string	IP address in IPv4 format.		Format: ipv4
port integer	Port number.		Minimum: 1

DPU

DPU is the Schema for the dpus API

Appears in:

• DPUList

Field	Description	Default	Validation
apiVersion string	provisioning.dpu.nvidia.com/v1alpha1
kind string	DPU
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec DPUSpec
status DPUStatus		{ phase:Initializing }	Optional: {}

DPUCluster

DPUCluster is the Schema for the dpuclusters API

Appears in:

• DPUClusterList

Field	Description	Default	Validation
apiVersion string	provisioning.dpu.nvidia.com/v1alpha1
kind string	DPUCluster
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec DPUClusterSpec			Required: {}
status DPUClusterStatus		{ phase:Pending }	Optional: {}

DPUClusterEtcdEncryptionAtRestStatus

DPUClusterEtcdEncryptionAtRestStatus defines the observed encryption-at-rest state for a DPUCluster.

Appears in:

• DPUClusterStatus

Field	Description	Default	Validation
provider string	Provider is the committed encryption-at-rest provider for the cluster.		Enum: [staticKey vaultKMS] Required: {}
staticKey DPUClusterStaticKeyEncryptionStatus	StaticKey exposes staticKey-specific observed state.		Optional: {}

DPUClusterList

DPUClusterList contains a list of DPUCluster

Field	Description	Default	Validation
apiVersion string	provisioning.dpu.nvidia.com/v1alpha1
kind string	DPUClusterList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items DPUCluster array

DPUClusterSpec

DPUClusterSpec defines the desired state of DPUCluster

Appears in:

• DPUCluster

Field	Description	Default	Validation
type string	Type of the cluster with few supported values static - existing cluster that is deployed by user. For DPUCluster of this type, the kubeconfig field must be set. kamaji - DPF managed cluster. The kamaji-cluster-manager will create a DPU cluster on behalf of this CR. $(others) - any string defined by ISVs, such type names must start with a prefix.		Pattern: kamaji|static|[^/]+/.* Required: {}
maxNodes integer	MaxNodes is the max amount of node in the cluster	1000	Maximum: 3000 Minimum: 1 Optional: {}
kubeconfig string	Kubeconfig is the secret that contains the admin kubeconfig		Optional: {}
clusterEndpoint ClusterEndpointSpec	ClusterEndpoint contains configurations of the cluster entry point		Optional: {}

DPUClusterStaticKeyEncryptionStatus

DPUClusterStaticKeyEncryptionStatus defines observed staticKey encryption-at-rest state.

Appears in:

• DPUClusterEtcdEncryptionAtRestStatus

Field	Description	Default	Validation
activeKeyRef ObservedSecretKeyRef	ActiveKeyRef is the source Secret observed for the currently active key. This field is informational and must not be used by controllers to select desired key material.		Optional: {}

DPUClusterStatus

DPUClusterStatus defines the observed state of DPUCluster

Appears in:

• DPUCluster

Field	Description	Default	Validation
phase ClusterPhase		Pending	Enum: [Pending Creating Ready NotReady Failed]
version string	Version is the K8s control-plane version of the cluster		Optional: {}
nodesCount integer	NodesCount is the number of DPUs assigned to the cluster		Minimum: 0 Optional: {}
etcdEncryptionAtRest DPUClusterEtcdEncryptionAtRestStatus	EtcdEncryptionAtRest exposes the observed encryption-at-rest state for the cluster.		Optional: {}
conditions Condition array			Optional: {}

DPUDevice

DPUDevice is the Schema for the dpudevices API

Appears in:

• DPUDeviceList

Field	Description	Default	Validation
apiVersion string	provisioning.dpu.nvidia.com/v1alpha1
kind string	DPUDevice
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec DPUDeviceSpec
status DPUDeviceStatus

DPUDeviceClusterSpec

DPUDeviceClusterSpec holds node labels and annotations propagated from DPUDevice to the DPU and cluster node.

Appears in:

• DPUDeviceSpec

Field	Description	Default	Validation
nodeLabels object (keys:string, values:string)	NodeLabels specifies labels to be added to the DPU cluster node for this device.		Optional: {}
nodeAnnotations object (keys:string, values:string)	NodeAnnotations specifies annotations to be added to the DPU cluster node for this device.		Optional: {}

DPUDeviceList

DPUDeviceList contains a list of DPUDevices

Field	Description	Default	Validation
apiVersion string	provisioning.dpu.nvidia.com/v1alpha1
kind string	DPUDeviceList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items DPUDevice array

DPUDeviceSpec

DPUDeviceSpec defines the content of DPUDevice

Appears in:

• DPUDevice

Field	Description	Default	Validation
psid string	PSID is the Product Serial ID of the device. It's used to track the device's lifecycle and for inventory management. This value is immutable and should not be changed once set. Example: "MT_0001234567", "MT25066004C7" Deprecated: This field is deprecated and will be removed in a future version. Use status.psid instead.		Optional: {}
serialNumber string	SerialNumber is the serial number of the device. It's used to track the device's lifecycle and for inventory management. This value is immutable and should not be changed once set. Example: "MT_0001234567", "MT25066004C7"		MinLength: 1 Required: {}
opn string	OPN is the Ordering Part Number of the device. It's used to track the device's compatibility with different software versions. This value is immutable and should not be changed once set. Example: "900-9D3B4-00SV-EA0" Deprecated: This field is deprecated and will be removed in a future version. Use status.opn instead.		Optional: {}
bmcIp string	BMCIP is the IP address of the BMC (Base Management Controller) on the device. This is used for remote management and monitoring of the device. Example: "10.1.2.3"		Format: ipv4 Optional: {}
bmcPort integer	BMCPort is the port number of the BMC (Base Management Controller) on the device. This is used for remote management and monitoring of the device. This value is immutable and should not be changed once set. Example: 443	443	Minimum: 1 Optional: {}
numberOfPFs integer	NumberOfPFs is the number of PFs on the device. This value is immutable and should not be changed once set. Example: 1	1	Minimum: 1 Optional: {}
nicDeviceCount integer	NICDeviceCount is the expected number of NIC devices used by dpu-agent provisioning. Valid range is 1 to 8. When unspecified, it defaults to 8.		Maximum: 8 Minimum: 1 Optional: {}
pf0Name string	PF0Name is the name of the PF0 on the device. This value is immutable and should not be changed once set. Example: "eth0" Deprecated: This field is deprecated and will be removed in a future version. Use status.pf0Name instead.		Optional: {}
bmcCredentialSecretName string	BMCCredentialSecretName is the name of a Secret in the same namespace containing per-device BMC credentials. The secret must contain a "password" key with the BMC credential value. If specified, this password takes precedence over the shared bmc-shared-password secret.		Optional: {}
cluster DPUDeviceClusterSpec	Specifies details on the K8S cluster to join		Optional: {}
values RawExtension	Values contains free-form per-device values used to render a DPUFlavorTemplate into a concrete generated DPUFlavor for this device.		Optional: {}

DPUDeviceStatus

Appears in:

• DPUDevice

Field	Description	Default	Validation
psid string	PSID is the Product Serial ID of the device. It's used to track the device's lifecycle and for inventory management. This value is discovered and should not be changed once set. Example: "MT_0001234567", "MT25066004C7"		Optional: {}
serialNumber string	SerialNumber is the serial number of the device. It's used to track the device's lifecycle and for inventory management. This value is discovered and should not be changed once set. Example: "MT_0001234567", "MT25066004C7"		Optional: {}
opn string	OPN is the Ordering Part Number of the device. It's used to track the device's compatibility with different software versions. This value is discovered and should not be changed once set. Example: "900-9D3B4-00SV-EA0"		Optional: {}
bmcIp string	BMCIP is the IP address of the BMC (Base Management Controller) on the device. This is used for remote management and monitoring of the device. This value is discovered and should not be changed once set. Example: "10.1.2.3"		Format: ipv4 Optional: {}
bmcPort integer	BMCPort is the port number of the BMC (Base Management Controller) on the device. This is used for remote management and monitoring of the device. This value is immutable and should not be changed once set. Example: 443	443	Minimum: 1 Optional: {}
pciAddress string	PCIAddress is the PCI address of the device in the host system. Example: "0000-03-00", "03-00"		Optional: {}
pf0Name string	PF0Name is the name of the PF0 on the device. Example: "eth0"		Optional: {}
pf0Mac string	PF0MAC is the MAC address of the PF0 on the device. Example: "00:00:00:00:00:00"		Pattern: ^([0-9A-Fa-f]\{2\}[:-])\{5\}([0-9A-Fa-f]\{2\})$ Optional: {}
dpuType DPUType	DPUType is the type of the DPU.	Unknown	Enum: [Unknown BlueField2 BlueField3 BlueField4] Optional: {}
dpuMode DpuModeType	DPUMode is the mode of the DPU.	dpu	Enum: [dpu nic] Optional: {}
secureBoot SecureBootStatus	SecureBoot indicates the current UEFI Secure Boot state.		Optional: {}
bmcCredentialSecretName string	BMCCredentialSecretName is the name of the Secret last used successfully for BMC authentication.		Optional: {}
bmcServerCertificate CertificateStatus	BMCServerCertificate reports the BMC mTLS server certificate rotation state.		Optional: {}
caTrustBundle TrustBundleStatus	CATrustBundle stores trust bundle reconciliation progress for the DPUDevice.		Optional: {}
conditions Condition array			Optional: {}

DPUDiscovery

Appears in:

• DPUDiscoveryList

Field	Description	Default	Validation
apiVersion string	provisioning.dpu.nvidia.com/v1alpha1
kind string	DPUDiscovery
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec DPUDiscoverySpec
status DPUDiscoveryStatus

DPUDiscoveryList

DPUDiscoveryList contains a list of DPUDiscovery types

Field	Description	Default	Validation
apiVersion string	provisioning.dpu.nvidia.com/v1alpha1
kind string	DPUDiscoveryList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items DPUDiscovery array

DPUDiscoverySpec

DPUDiscoverySpec defines the desired state of DPUDiscovery

Appears in:

• DPUDiscovery

Field	Description	Default	Validation
ipRangeSpec IPRangeValidationSpec	IPRange defines the range of IP addresses to scan
scanInterval Duration	ScanInterval defines how often to perform the scan	1h
workers integer	Workers defines the number of workers to use for the scan (default 1 worker for each 255 IPs in the range)		Optional: {}

DPUDiscoveryStatus

DPUDiscoveryStatus defines the observed state of DPUDiscovery

Appears in:

• DPUDiscovery

Field	Description	Default	Validation
observedGeneration integer	ObservedGeneration is the generation of the spec that was last applied by a successful scan. When spec (e.g. IP range) changes, reconciliation runs a scan immediately instead of waiting for the next interval.		Optional: {}
lastScanTime Time	LastScanTime is the timestamp of the last successful scan
foundDPUs integer	FoundDPUs is the list of discovered DPU BMC IPs

DPUFLavorSysctl

Appears in:

• DPUFlavorSpec

Field	Description	Default	Validation
parameters string array	Parameters are the sysctl parameters to be set.		Optional: {}

DPUFlavor

DPUFlavor is the Schema for the dpuflavors API

Appears in:

• DPUFlavorList

Field	Description	Default	Validation
apiVersion string	provisioning.dpu.nvidia.com/v1alpha1
kind string	DPUFlavor
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec DPUFlavorSpec

DPUFlavorFileOp

Underlying type: string

DPUFlavorFileOp defines the operation to be performed on the file

Validation:

• Enum: [override append]

Appears in:

• ConfigFile

Field	Description
override
append

DPUFlavorGrub

Appears in:

• DPUFlavorSpec

Field	Description	Default	Validation
kernelParameters string array	KernelParameters are the kernel parameters to be set in the grub configuration.		Optional: {}

DPUFlavorList

DPUFlavorList contains a list of DPUFlavor

Field	Description	Default	Validation
apiVersion string	provisioning.dpu.nvidia.com/v1alpha1
kind string	DPUFlavorList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items DPUFlavor array

DPUFlavorOVS

Appears in:

• DPUFlavorSpec

Field	Description	Default	Validation
rawConfigScript string	RawConfigScript is the raw configuration script for OVS.		Optional: {}

DPUFlavorSpec

DPUFlavorSpec defines the content of DPUFlavor

Appears in:

• DPUFlavor

Field	Description	Default	Validation
grub DPUFlavorGrub	Grub contains the grub configuration for the DPUFlavor.		Optional: {}
sysctl DPUFLavorSysctl	Sysctl contains the sysctl configuration for the DPUFlavor.		Optional: {}
nvconfig NVConfig array	NVConfig contains the device-specific configuration (firmware settings, device parameters). Each entry specifies a device (wildcard '', or port identifiers 'p0'/'P0'/'p1'/'P1') and its parameters. If device is '' or unspecified (defaults to ''), it applies to all devices and must be the only entry. Each device (including unspecified as '') must be unique across all nvconfig entries (case-insensitive). Validation enforces: device enum values, parameter format (KEY=VALUE), case-insensitive uniqueness, and size limits.		MaxItems: 3 Optional: {}
ovs DPUFlavorOVS	OVS contains the OVS configuration for the DPUFlavor.		Optional: {}
bfcfgParameters string array	BFCfgParameters are the parameters to be set in the bf.cfg file.		Optional: {}
configFiles ConfigFile array	ConfigFiles are the files to be written on the DPU.		Optional: {}
packages PackageSpec array	Packages are the packages to reconcile on the node.		MaxItems: 64 Optional: {}
systemdServices SystemdServiceSpec array	SystemdServices are the systemd services to manage on the node.		MaxItems: 64 Optional: {}
containerdConfig ContainerdConfig	ContainerdConfig contains the configuration for containerd.		Optional: {}
dpuResources ResourceList	DPUResources indicates the minimum amount of resources needed for a BFB with that flavor to be installed on a DPU. Using this field, the controller can understand if that flavor can be installed on a particular DPU. It should be set to the total amount of resources the system needs + the resources that should be made available for DPUServices to consume.		Optional: {}
systemReservedResources ResourceList	SystemReservedResources indicates the resources that are consumed by the system (OS, OVS, DPF system etc) and are not made available for DPUServices to consume. DPUServices can consume the difference between DPUResources and SystemReservedResources. This field must not be specified if dpuResources are not specified.		Optional: {}
dpuMode DpuModeType	DpuMode is deprecated and no longer used by provisioning workflows. Deployment mode is sourced from DPFOperatorConfig and exposed on DPU.status.deploymentMode.		Enum: [dpu zero-trust nic] Optional: {}
hostNetworkInterfaceConfigs NetworkInterfaceConfig array	HostNetworkInterfaceConfigs contains the configuration for the host-side network interfaces.		Optional: {}
ewNicConfigurations NicConfiguration array	EWNicConfigurations lists per-NIC configuration for the E/W NICs. Only the first entry is applied in this release; additional entries are ignored until a future release adds multi-NIC support. The field is modeled as a list now so the API shape does not need to change when multiple entries are supported.		MaxItems: 16 Optional: {}
scalableFunctions ScalableFunctions	ScalableFunctions configures Scalable Functions (SFs) created on the DPU.		Optional: {}
hostOSInit HostOSInit	hostOSInit configures when the DPU agent releases host OS init after DELAY_HOST_OS_INIT=0x3 (ENABLE_USER) is set in nvconfig. Omitted releaseAfter defaults to dpuServiceCriticalPodsReady at agent runtime.		Optional: {}

DPUFlavorTemplate

DPUFlavorTemplate is the Schema for the dpuflavortemplates API

Appears in:

• DPUFlavorTemplateList

Field	Description	Default	Validation
apiVersion string	provisioning.dpu.nvidia.com/v1alpha1
kind string	DPUFlavorTemplate
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec DPUFlavorTemplateSpec

DPUFlavorTemplateList

DPUFlavorTemplateList contains a list of DPUFlavorTemplate

Field	Description	Default	Validation
apiVersion string	provisioning.dpu.nvidia.com/v1alpha1
kind string	DPUFlavorTemplateList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items DPUFlavorTemplate array

DPUFlavorTemplateSpec

DPUFlavorTemplateSpec defines the content of a DPUFlavorTemplate. The template body is rendered per-DPU against DPUDevice.spec.values to produce a concrete DPUFlavor.

Appears in:

• DPUFlavorTemplate

Field	Description	Default	Validation
template string	Template is the DPUFlavor body as a YAML/JSON string with Go template actions (delimited by double curly braces). It is rendered against DPUDevice.spec.values and the result is unmarshalled into a typed DPUFlavor and validated by DPUFlavor admission when the generated flavor is created. Referencing a key that is absent from the device values fails the render, and the "define", "block" and "template" actions are rejected. It should not contain dpuResources or systemReservedResources: the structured fields below take precedence and, when set, override anything the rendered body contains.		MaxLength: 1048576 MinLength: 1 Required: {}
dpuResources ResourceList	DPUResources is resource-fitting metadata mirrored from DPUFlavor. It is NOT templated: when set it is stamped onto every generated DPUFlavor and takes precedence over anything in the rendered body.		Optional: {}
systemReservedResources ResourceList	SystemReservedResources is resource-fitting metadata mirrored from DPUFlavor. It is NOT templated: when set it is stamped onto every generated DPUFlavor and takes precedence over anything in the rendered body.		Optional: {}

DPUList

DPUList contains a list of DPU

Field	Description	Default	Validation
apiVersion string	provisioning.dpu.nvidia.com/v1alpha1
kind string	DPUList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items DPU array

DPUNode

DPUNode is the Schema for the dpunodes API

Appears in:

• DPUNodeList

Field	Description	Default	Validation
apiVersion string	provisioning.dpu.nvidia.com/v1alpha1
kind string	DPUNode
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec DPUNodeSpec
status DPUNodeStatus

DPUNodeList

DPUNodeList contains a list of DPUNode

Field	Description	Default	Validation
apiVersion string	provisioning.dpu.nvidia.com/v1alpha1
kind string	DPUNodeList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items DPUNode array

DPUNodeMaintenance

DPUNodeMaintenance is the Schema for the dpunodemaintenances API

Appears in:

• DPUNodeMaintenanceList

Field	Description	Default	Validation
apiVersion string	provisioning.dpu.nvidia.com/v1alpha1
kind string	DPUNodeMaintenance
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec DPUNodeMaintenanceSpec
status DPUNodeMaintenanceStatus

DPUNodeMaintenanceList

DPUNodeMaintenanceList contains a list of DPUNodeMaintenance

Field	Description	Default	Validation
apiVersion string	provisioning.dpu.nvidia.com/v1alpha1
kind string	DPUNodeMaintenanceList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items DPUNodeMaintenance array

DPUNodeMaintenanceSpec

DPUNodeMaintenanceSpec is the specification of the DPUNodeMaintenance object

Appears in:

• DPUNodeMaintenance

Field	Description	Default	Validation
dpuNodeName string	DPUNodeName is the name of the DPUNode that is being maintained.		Required: {}
nodeEffect NodeEffect	NodeEffect is the effect to be applied to the node.		Optional: {}
requestor string array	Requestor is the list of consumers for the maintenance.		Optional: {}

DPUNodeMaintenanceStatus

DPUNodeMaintenanceStatus defines the observed state of DPUNodeMaintenance

Appears in:

• DPUNodeMaintenance

Field	Description	Default	Validation
conditions Condition array	Conditions reflect the status of the object		Optional: {}
nodeEffectSyncStartTime Time	NodeEffectSyncStartTime is the time when the node effect sync started.		Optional: {}
multiDPUOperationsSyncWaitTime Duration	MultiDPUOperationsSyncWaitTime is the wait time between DPUs on the same node.		Optional: {}
maxUnavailableDPUNodes integer	MaxUnavailableDPUNodes is the maximum number of DPUNodes that are unavailable during the node effect period.		Minimum: 1 Optional: {}

DPUNodeSpec

DPUNodeSpec defines the desired state of DPUNode

Appears in:

• DPUNode

Field	Description	Default	Validation
nodeRebootMethod NodeRebootMethod	Defines the method for rebooting the host. One of the following options can be chosen for this field: - "external": Reboot the host via an external means, not controlled by the DPU controller. - "script": Reboot the host by executing a custom script. - "hostAgent": Use the host agent to reboot the host. - "none": Do not reboot a host through the DPUNode. "hostAgent" is the default value.	{ hostAgent:map[] }	Optional: {}
nodeDMSAddress DMSAddress	The IP address and port where the DMS is exposed. Only applicable if dpuInstallInterface is set to gNOI. Deprecated: this field is no longer used.		Optional: {}
dpus DPURef array	A map containing names of each DPUDevice attached to the node.		Optional: {}

DPUNodeStatus

DPUNodeStatus defines the observed state of DPUNode

Appears in:

• DPUNode

Field	Description	Default	Validation
conditions Condition array	Conditions represent the latest available observations of an object's state.		Type: array Optional: {}
dpuInstallInterface string	The name of the interface which will be used to install the bfb image, can be one of hostAgent,redfish		Enum: [gNOI hostAgent redfish] Optional: {}
kubeNodeRef string	The name of the Kubernetes Node object that this DPUNode represents. This field is optional and only relevant if the x86 host is part of the DPF Kubernetes cluster.		Optional: {}
rebootInProgress boolean	RebootInProgress indicates if the node is in the process of rebooting.		Optional: {}
rebootMethod RebootMethodType	RebootMethod is the host-level reboot method recommended by child DPUs in DPURebooting phase, aggregated by priority (most disruptive wins, ties broken by ascending DPU name): PowerCycle > SystemLevelReset > SystemReboot > HostlessDPUReboot > FirmwareReset > DPUWarmReboot > NoAction > Unknown. Stamped once at least one DPU reports a method, preserved across the rebooting -> idle transition, and cleared with DPUNodeRebootInProgress when the DPUNode loses all its DPUs.		Enum: [Unknown NoAction PowerCycle SystemReboot SystemLevelReset FirmwareReset DPUWarmReboot HostlessDPUReboot] Optional: {}

DPUOutdated

DPUOutdated reports that the DPU has drifted from its owning DPUSet's DPUTemplate in a way that requires the DPU to be reprovisioned. The struct is presence-based: when the DPU matches the template, DPUStatus.Outdated is nil. The DPUSet controller is the sole writer.

Appears in:

• DPUStatus

Field	Description	Default	Validation
timeStamp Time	TimeStamp records when this drift was first observed for the current Reason. It is preserved across reconciles as long as Reason is unchanged.		Required: {}
reason string	Reason is the machine-readable drift code (e.g. OutdatedBFB). When more than one template field has drifted, Reason reports the first in fixed precedence order: BFB -> DPUFlavor -> SecureBoot -> BlueFieldSoftware.		Required: {}
message string	Message is a human-readable summary that lists every drifted field, e.g. "DPU template has changed (BFB: bfb-v1 -> bfb-v2, DPUFlavor: ...)".		Required: {}

DPUPhase

Underlying type: string

DPUPhase describes current state of DPU. Only one of the following state may be specified. Default is Initializing.

Validation:

• Enum: [Initializing Node Effect Pending Update Firmware Config FW Parameters Prepare BFB OS Installing DPU Config DPU Cluster Config Host Network Configuration Host OS Init Release Ready Error Deleting Rebooting Perform ARM Force Restart Initialize Interface Node Effect Removal Checking Host Reboot Required]

Appears in:

• DPUSetStatus
• DPUStatus

Field	Description
Initializing	DPUInitializing is the first phase after the DPU is created.
Node Effect	DPUNodeEffect means the controller will handle the node effect provided by the user.
Pending	DPUPending means the controller is waiting for the BFB to be ready.
Prepare BFB	DPUPrepareBFB means the controller is preparing the BFB and bf.cfg to be installed to DPU
Update Firmware	DPUUpdateFirmware means the controller will update the DPU firmware for BlueField4.
DPU Config	DPUConfig means the DPU agent will configure the DPU
Config FW Parameters	DPUConfigFWParameters means the controller will manipulate DPU firmware, e.g., set DPU mode, check firmware version
Initialize Interface	DPUInitializeInterface means the controller will intitialize the interface used to provision the DPUs, e.g., create the DMS pod, set up RedFish account.
OS Installing	DPUOSInstalling means the controller will provision the DPU through the DMS gNOI interface.
DPU Cluster Config	DPUClusterConfig means the node configuration and Kubernetes Node join procedure are in progress .
Host Network Configuration	DPUHostNetworkConfiguration means the host network configuration is running.
Host OS Init Release	DPUHostOSInitRelease waits for the DPU agent to release host OS init when configured.
Node Effect Removal	DPUNodeEffectRemoval means the controller will remove the node effect from the DPU.
Ready	DPUReady means the DPU is ready to use.
Error	DPUError means error occurred.
Deleting	DPUDeleting means the DPU CR will be deleted, controller will do some cleanup works.
Rebooting	DPURebooting means the host of DPU is rebooting.
Perform ARM Force Restart	DPUPerformArmForceRestart means ARM ForceRestart operations are in progress for Secure Boot configuration.

DPURef

Appears in:

• DPUNodeSpec

Field	Description	Default	Validation
name string	Name of the DPU device.		MinLength: 1 Required: {}

DPUSet

DPUSet is the Schema for the dpusets API

Appears in:

• DPUSetList

Field	Description	Default	Validation
apiVersion string	provisioning.dpu.nvidia.com/v1alpha1
kind string	DPUSet
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec DPUSetSpec
status DPUSetStatus

DPUSetList

DPUSetList contains a list of DPUSet

Field	Description	Default	Validation
apiVersion string	provisioning.dpu.nvidia.com/v1alpha1
kind string	DPUSetList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items DPUSet array

DPUSetSpec

DPUSetSpec defines the desired state of DPUSet

Appears in:

• DPUSet

Field	Description	Default	Validation
strategy DPUSetStrategy	The rolling update strategy to use to updating existing DPUs with new ones.		Required: {}
dpuNodeSelector LabelSelector	Select the DPUNodes with specific labels		Optional: {}
dpuSelector object (keys:string, values:string)	Select the DPU with specific labels Deprecated: This field is deprecated and will be removed with v26.7.0. Use DPUDeviceSelector instead.		Optional: {}
dpuDeviceSelector LabelSelector	DPUDeviceSelector defines the selector for DPUDevices that the DPUSet should target and should create a DPU for.		Optional: {}
dpuTemplate DPUTemplate	Object that describes the DPU that will be created if insufficient replicas are detected		Required: {}

DPUSetStatus

DPUSetStatus defines the observed state of DPUSet

Appears in:

• DPUSet

Field	Description	Default	Validation
dpuStatistics object (keys:DPUPhase, values:integer)	DPUStatistics is a map of DPUPhase to the number of DPUs in that phase.		Optional: {}
conditions Condition array	Conditions reflect the status of the object
observedGeneration integer	ObservedGeneration records the Generation observed on the object the last time it was patched.

DPUSetStrategy

Appears in:

• DPUSetSpec
• DPUs

Field	Description	Default	Validation
type StrategyType	Can be "OnDelete" or "RollingUpdate".		Enum: [OnDelete RollingUpdate] Required: {}
rollingUpdate RollingUpdateDPU	Rolling update config params. Present only if StrategyType = RollingUpdate.		Optional: {}

DPUSpec

DPUSpec defines the desired state of DPU

Appears in:

• DPU

Field	Description	Default	Validation
dpuNodeName string	Specifies the DPUNode this DPU belongs to		Required: {}
dpuDeviceName string	Specifies the name of the DPUDevice this DPU is associated with		MinLength: 1 Required: {}
bfb string	Specifies name of the bfb CR to use for this DPU		MaxLength: 253 MinLength: 1 Optional: {}
blueFieldSoftware string	Specifies the name of the BlueFieldSoftware CR to use for this DPU		MaxLength: 253 MinLength: 1 Optional: {}
serialNumber string	The serial number of the DPU		MinLength: 1 Required: {}
pciAddress string	The PCI device related DPU Example: "0000-03-00", "03-00"		Pattern: ^([0-9a-fA-F]\{4\}[-])?[0-9a-fA-F]\{2\}[-][0-9a-fA-F]\{2\}$ Optional: {}
nodeEffect NodeEffect	Specifies how changes to the DPU should affect the Node		Required: {}
cluster K8sCluster	Specifies details on the K8S cluster to join		Optional: {}
dpuFlavor string	DPUFlavor is the name of the DPUFlavor that will be used to deploy the DPU.		MinLength: 1 Required: {}
astraEnabled boolean	AstraEnabled indicates whether E/W NIC configuration (Astra) is enabled		Optional: {}
secureBoot boolean	SecureBoot specifies whether UEFI Secure Boot should be enabled.		Optional: {}
bmcIP string	BMCIP is the ip address of the DPU BMC Deprecated: Use BMCIP from DPUDevice instead.		Optional: {}

DPUStatus

DPUStatus defines the observed state of DPU

Appears in:

• DPU

Field	Description	Default	Validation
phase DPUPhase	The current state of DPU.	Initializing	Enum: [Initializing Node Effect Pending Update Firmware Config FW Parameters Prepare BFB OS Installing DPU Config DPU Cluster Config Host Network Configuration Host OS Init Release Ready Error Deleting Rebooting Perform ARM Force Restart Initialize Interface Node Effect Removal Checking Host Reboot Required] Required: {}
previousPhase DPUPhase	PreviousPhase is the last non-empty Phase before the current Phase, set by the controller when Phase transitions. It may be unset during early initialization (empty Phase) or until the first transition from a non-empty Phase. Internal controller tracking only.		Enum: [Initializing Node Effect Pending Update Firmware Config FW Parameters Prepare BFB OS Installing DPU Config DPU Cluster Config Host Network Configuration Host OS Init Release Ready Error Deleting Rebooting Perform ARM Force Restart Initialize Interface Node Effect Removal Checking Host Reboot Required] Optional: {}
outdated DPUOutdated	Outdated, when present, indicates the DPU has drifted from its owning DPUSet's DPUTemplate and needs to be reprovisioned. Set by the DPUSet controller; absent when the DPU matches the template.		Optional: {}
conditions Condition array	Conditions represents the provisioning lifecycle conditions.		Optional: {}
operationalConditions Condition array	OperationalConditions represents aggregated operational readiness conditions. These conditions reflect the runtime health and readiness of DPU services and node health, separate from the provisioning lifecycle represented by Conditions.		Optional: {}
bfbFile string	BFBFile is the path to the BFB file		Optional: {}
bfCFGFile string	BFCFGFile is the path to the bf.cfg		Optional: {}
bfbVersion string	bfb version of this DPU		Optional: {}
dpfVersion string	DPF version used to install this DPU		Optional: {}
pciDevice string	pci device information of this DPU		Optional: {}
requiredReset boolean	whether require reset of DPU		Optional: {}
firmware Firmware	the firmware information of DPU		Optional: {}
addresses NodeAddress array	The DPU node's IP addresses		Optional: {}
dpuInstallInterface string	the name of the interface which will be used to install the bfb image, and communicate with DPU, can be one of hostAgent,redfish		Enum: [gNOI hostAgent redfish] Optional: {}
postProvisioningNodeEffect boolean	Indicates that node effect was triggered by post-provisioning label changes		Optional: {}
observedGeneration integer	ObservedGeneration records the Generation observed on the object the last time it was patched.
dpuType DPUType	The type of the DPU	Unknown	Enum: [Unknown BlueField2 BlueField3 BlueField4] Optional: {}
agentLastStartupTime Time	AgentLastStartupTime is the time when the DPU agent was last started. This is copied from agentStatus.lastStartupTime.		Optional: {}
agentStatus AgentStatus	AgentStatus contains the information reported from inside the DPU		Optional: {}
rebootStatus RebootStatus	RebootStatus contains host reboot progress. DPU controller derives user-facing DPUCondRebooted from this status.		Optional: {}
dpuMode DpuModeType	The mode of the DPU	dpu	Enum: [dpu nic] Optional: {}
deploymentMode DeploymentMode	DeploymentMode is copied from DPFOperatorConfig.spec.deploymentMode by the controller. This field is read-only for users.		Enum: [zero-trust host-trusted] Optional: {}
hostless boolean	Hostless indicates that the DPU is attached to a system-managed synthetic DPUNode rather than a physical host.		Optional: {}
secureBoot SecureBootStatus	SecureBoot indicates the current UEFI Secure Boot state.		Optional: {}
identityMode IdentityMode	IdentityMode records which authentication mechanism the DPU Agent uses to reach the management-cluster kube-apiserver. Stamped exactly once by the DPU controller during phase Initializing (nil guard); immutable thereafter. Pre-SPIFFE legacy DPUs have IdentityMode unset (nil) which consumers MUST treat semantically as bootstrap-token.		Enum: [spiffe bootstrap-token] Optional: {}
redfishTaskId string	The task ID of the last task performed on the DPU BMC		Optional: {}

DPUTemplate

DPUTemplate is a template for DPU

Appears in:

• DPUSetSpec

Field	Description	Default	Validation
annotations object (keys:string, values:string)	Annotations specifies annotations which are added to the DPU.
spec DPUTemplateSpec	Spec specifies the DPU specification.

DPUTemplateSpec

DPUTemplateSpec defines the desired provisioning template for DPUs.

Appears in:

• DPUTemplate

Field	Description	Default	Validation
bfb BFBReference	Specifies a BFB CR		Optional: {}
blueFieldSoftware BlueFieldSoftwareReference	Specifies a BlueFieldSoftware CR		Optional: {}
nodeEffect NodeEffect	Specifies how changes to the DPU should affect the Node		Required: {}
cluster ClusterSpec	Specifies details on the K8S cluster to join		Optional: {}
dpuFlavor string	DPUFlavor is the name of the DPUFlavor that will be used to deploy the DPU. Mutually exclusive with DPUFlavorTemplate.		MinLength: 1 Optional: {}
dpuFlavorTemplate string	DPUFlavorTemplate is the name of a DPUFlavorTemplate that is rendered per-DPU (against DPUDevice.spec.values) into a generated DPUFlavor. Mutually exclusive with DPUFlavor.		MinLength: 1 Optional: {}
astraEnabled boolean	AstraEnabled indicates whether E/W NIC configuration (Astra) is enabled		Optional: {}
secureBoot boolean	SecureBoot specifies whether UEFI Secure Boot should be enabled.		Optional: {}

DPUType

Underlying type: string

Appears in:

• DPUDeviceStatus
• DPUStatus

Field	Description
Unknown
BlueField2
BlueField3
BlueField4

DeploymentMode

Underlying type: string

DeploymentMode describes the cluster deployment model for provisioning (zero-trust vs host-trusted). This type is intentionally duplicated from operator/v1alpha1.DeploymentMode: the provisioning API must not import the operator API group. Keep values and semantics aligned with DPFOperatorConfig.spec.deploymentMode.

Validation:

• Enum: [zero-trust host-trusted]

Appears in:

• DPUStatus

Field	Description
zero-trust
host-trusted

DownloadedComponents

DownloadedComponents tracks which components have been downloaded

Appears in:

• BlueFieldSoftwareStatus

Field	Description	Default	Validation
pldmFwBundle string
platformPldmFwBundle string
osIso string
nicFw string

DpuModeType

Underlying type: string

DpuModeType defines the mode of the DPU

Validation:

• Enum: [dpu zero-trust nic]

Appears in:

• DPUDeviceStatus
• DPUFlavorSpec
• DPUStatus

Field	Description
dpu
nic
zero-trust	ZeroTrustMode is deprecated and kept for backward compatibility with DPUFlavor.spec.dpuMode. Deprecated: DPUFlavor.spec.dpuMode is deprecated; use DPFOperatorConfig.spec.deploymentMode.

External

Appears in:

• NodeRebootMethod

Firmware

Appears in:

• DPUStatus

Field	Description	Default	Validation
bmc string	BMC is the used BMC firmware version
nic string	NIC is the used NIC firmware version
uefi string	UEFI is the used UEFI firmware version

GNOI

Appears in:

• NodeRebootMethod

HostAgent

Appears in:

• NodeRebootMethod

HostOSInit

HostOSInit configures the readiness gate for host OS init release.

Appears in:

• DPUFlavorSpec

Field	Description	Default	Validation
releaseAfter HostOSInitReleaseAfter	releaseAfter selects which operational readiness gate must be True before the agent calls mlxreg to release the host. When omitted, dpuServiceCriticalPodsReady is used.		Optional: {}

HostOSInitGate

Underlying type: struct{}

HostOSInitGate marks a release gate branch in a one-of union.

Appears in:

• HostOSInitReleaseAfter

HostOSInitReleaseAfter

HostOSInitReleaseAfter is a one-of selector for the host OS init release gate.

Appears in:

• HostOSInit
• HostOSInitSucceeded

Field	Description	Default	Validation
operationalReady HostOSInitGate	operationalReady waits for DPU.status.operationalConditions[OperationalReady] == True.		Optional: {}
dpuServiceCriticalPodsReady HostOSInitGate	dpuServiceCriticalPodsReady waits for DPU.status.operationalConditions[DPUServiceCriticalPodsReady] == True.		Optional: {}

HostOSInitSkipped

HostOSInitSkipped reports that host OS init release was not required.

Appears in:

• HostOSInitStatus

Field	Description	Default	Validation
reason string	reason is a stable machine-readable outcome code.		Optional: {}
message string	message is a human-readable explanation.		Optional: {}

HostOSInitStatus

HostOSInitStatus is the agent-reported terminal status for host OS init release.

Appears in:

• AgentStatus

Field	Description	Default	Validation
skipped HostOSInitSkipped	skipped indicates release was not required for this DPU.		Optional: {}
succeeded HostOSInitSucceeded	succeeded indicates host OS init was released or was already cleared.		Optional: {}

HostOSInitSucceeded

HostOSInitSucceeded reports successful host OS init release.

Appears in:

• HostOSInitStatus

Field	Description	Default	Validation
releaseAfter HostOSInitReleaseAfter	releaseAfter echoes the effective gate used for release.		Optional: {}

IPRange

IPRange represents a range of IP addresses to scan

Appears in:

• IPRangeValidationSpec

Field	Description	Default	Validation
startIP string			Pattern: ^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.)\{3\}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$ Required: {}
endIP string			Pattern: ^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.)\{3\}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$ Required: {}
port integer	Port defines the port to on which BMC is listening	443	Maximum: 65535 Minimum: 1 Optional: {}

IPRangeValidationSpec

IPRangeValidationSpec defines the desired state of IPRangeValidation IPRange defines the IP range to validate

Appears in:

• DPUDiscoverySpec

Field	Description	Default	Validation
ipRange IPRange

IdentityMode

Underlying type: string

IdentityMode records which authentication mechanism the DPU Agent uses to reach the management-cluster kube-apiserver. It is stamp-once (see DPUStatus.IdentityMode).

Appears in:

• DPUStatus

Field	Description
spiffe	IdentityModeSpiffe indicates the DPU Agent authenticates with a SPIFFE-issued JWT-SVID.
bootstrap-token	IdentityModeBootstrapToken indicates the DPU Agent authenticates with a kubeadm bootstrap token. An unset (nil) IdentityMode is treated semantically as bootstrap-token; no sentinel is declared for the unset case deliberately, to force explicit handling by consumers.

K8sCluster

Appears in:

• DPUSpec

Field	Description	Default	Validation
name string	Name is the name of the DPUs Kubernetes cluster		Optional: {}
namespace string	Namespace is the tenants namespace name where the Kubernetes cluster will be deployed		Optional: {}
nodeLabels object (keys:string, values:string)	NodeLabels specifies the labels to be added to the node.		Optional: {}
nodeAnnotations object (keys:string, values:string)	NodeAnnotations specifies the annotations to be added to the node.		Optional: {}
selector LabelSelector	Selector defines the selector of the DPUClusters the produced DPUs should join		Optional: {}

KeepalivedSpec

Appears in:

• ClusterEndpointSpec

Field	Description	Default	Validation
vip string	VIP is the virtual IP owned by the keepalived instances
virtualRouterID integer	VirtualRouterID is the virtual_router_id in keepalived.conf		Maximum: 255 Minimum: 1
interface string	Interface specifies on which interface the VIP should be assigned		MinLength: 1
nodeSelector object (keys:string, values:string)	NodeSelector is used to specify a subnet of control plane nodes to deploy keepalived instances. Note: keepalived instances are always deployed on control plane nodes		Optional: {}

NVConfig

Appears in:

• DPUFlavorSpec
• NetworkInterfaceConfig

Field	Description	Default	Validation
device string	Device is the device to which the configuration applies. If not specified, the configuration applies to all. Supported values: "*" (wildcard for all devices), "p0"/"P0" (port 0), "p1"/"P1" (port 1). Case-insensitive.		Enum: [* p0 p1 P0 P1] Optional: {}
parameters string array	Parameters are the parameters to be set for the device.		MaxItems: 32 MinItems: 1 items:MaxLength: 200 items:Pattern: ^[^=\s]+=[^\s]*$ Optional: {}

NetworkInterfaceConfig

NetworkInterfaceConfig defines the configuration for a network interface

Appears in:

• DPUFlavorSpec

Field	Description	Default	Validation
mtu integer	MTU is the MTU value to be set on the network interface.		Maximum: 9216 Minimum: 1280 Optional: {}
dhcp boolean	DHCP is the DHCP configuration for the network interface.		Optional: {}
portNumber integer	PortNumber identifies which port this configuration applies to.		Maximum: 1 Minimum: 0 Required: {}
nvconfig NVConfig	NVConfig contains port-specific configuration for this network interface. This configuration is applied in addition to the global NVConfig settings in DPUFlavorSpec. Both global and per-interface NVConfig settings can coexist without collision.		Optional: {}

NicConfiguration

NicConfiguration is a set of configurations for the NICs

Appears in:

• DPUFlavorSpec

Field	Description	Default	Validation
numVfs integer	Number of VFs to be configured		Required: {}
linkType LinkTypeEnum	LinkType to be configured, Ethernet|Infiniband. Required unless networkBay is configured; for Network Bay the link type is governed by the system configuration and must not be set.		Enum: [Ethernet Infiniband] Optional: {}
spectrumXOptimized SpectrumXOptimizedSpec	Spectrum-X optimization settings. Works only with linkType==Ethernet && numVfs==1. RawNvConfig parameters, if provided, are merged as overrides on top of Spectrum-X calculated params.
rawNvConfig NvConfigParam array	List of arbitrary nv config parameters
networkBay NetworkBaySpec	NetworkBay configures a ConnectX-9 Network Bay card (per-ASIC set_system_conf). Allowed only for ConnectX-9 (nicType 1025).		Optional: {}
force boolean	Force passes --force to mlxconfig set commands. When set, the daemon applies the nv config batch and set_system_conf with --force, letting mlxconfig accept a batch it would otherwise refuse due to implicit parameter dependencies.	false	Optional: {}

NodeEffect

NodeEffect is the effect the DPU has on Nodes during provisioning. Only one of Taint, NoEffect, CustomLabel, Drain, CustomAction, Hold can be set.

Appears in:

• DPUNodeMaintenanceSpec
• DPUSpec
• DPUTemplateSpec

Field	Description	Default	Validation
taint Taint	Add specify taint on the DPU node		Optional: {}
noEffect boolean	Do not do any action on the DPU node		Optional: {}
customLabel object (keys:string, values:string)	Add specify labels on the DPU node		Optional: {}
drain boolean	Drain the K8s host node by NodeMaintenance operator		Optional: {}
customAction string	Name of a config map which contains a pod yaml definition to run which will apply the nodeEffect. The pod is expected to exit when node effect is done, if pod terminates with error then DPU would move to an error phase. The DPUNode's name will be exported as an environment variable, named as DPUNODE_NAME, to each container and init container in the pod. The labels and annotations of DPUNode will be exported in /etc/dpu/dpf-pod-info/labels and /etc/dpu/dpf-pod-info/annotations accordingly; the volume name dpf-pod-info is used to mount the labels and annotations. If any name confliction for env or volume, the controller will not export the name or labels/annotations of DPUNode accordingly.		Optional: {}
hold boolean	Places annotation wait-for-external-nodeeffect and waits for it to be removed this is the default behavior in a non K8S environment		Optional: {}
force boolean	Force is the flag to indicate if the node effect should be applied immediately. If true, dpfOperatorConfig.multiDPUOperationsSyncWaitTime and dpfOperatorConfig.maxUnavailableDPUNodes will be ignored when applying node effect for DPUNodeMaintenance CR	false	Optional: {}
applyOnLabelChange boolean	Apply node effect when labels change on the DPU object When set to true, label changes in Ready state will trigger node effect logic	false	Optional: {}
nodeMaintenanceAdditionalRequestors string array	Additional requestors to be added to the NvidiaNodeMaintenance CR when Drain is selected		Optional: {}

NodeRebootMethod

NodeRebootMethod defines the desired reboot method

Appears in:

• DPUNodeSpec

Field	Description	Default	Validation
gNOI GNOI	Use the DPU's DMS interface to reboot the host. Deprecated: Use HostAgent instead.		Optional: {}
hostAgent HostAgent	Use the HostAgent to reboot the host.		Optional: {}
external External	Reboot the host via an external means, not controlled by the DPU controller.		Optional: {}
script Script	Reboot the host by executing a custom script. This field defined which ConfigMap store the custom script. The ConfigMap should include a pod template of Job object under the pod-template key. That pod template will be put in a Job object to be executed.		Optional: {}
none None	Do not reboot a host through the DPUNode. Used for hostless devices where DPF manages the DPU reboot directly through Redfish.		Optional: {}

None

Appears in:

• NodeRebootMethod

ObservedSecretKeyRef

ObservedSecretKeyRef identifies an observed source Secret version.

Appears in:

• DPUClusterStaticKeyEncryptionStatus

Field	Description	Default	Validation
name string	Name is the name of the Secret.		MinLength: 1 Required: {}
key string	Key is the key within the Secret data.		MinLength: 1 Required: {}
namespace string	Namespace is the namespace of the Secret.		MinLength: 1 Required: {}
uid string	UID is the UID of the Secret.		MinLength: 1 Required: {}
resourceVersion string	ResourceVersion is the resourceVersion of the Secret.		MinLength: 1 Required: {}

PackageSpec

PackageSpec defines a package to reconcile on the node.

Appears in:

• DPUFlavorSpec

Field	Description	Default	Validation
name string	Name is the package name.		MaxLength: 253 MinLength: 1
version PackageVersionSpec	Version constrains the package version. If empty, any installed version satisfies the spec.		Optional: {}
repoFileRef string	RepoFileRef constrains package resolution to a specific repository file available on the node. If empty, any configured repository may satisfy the package. If specified, only the referenced repository file may provide candidates. If that repository file does not provide the package or requested version, the dpu-agent flow does not continue.		Optional: {}

PackageVersionMatchPolicy

Underlying type: string

PackageVersionMatchPolicy defines how a package version constraint is evaluated.

Appears in:

• PackageVersionSpec

Field	Description
Exact	PackageVersionMatchExact requires the installed package version to equal Value.
AtLeast	PackageVersionMatchAtLeast requires the installed package version to be greater than or equal to Value.

PackageVersionSpec

PackageVersionSpec defines a package version constraint.

Appears in:

• PackageSpec

Field	Description	Default	Validation
value string	Value is the package version to compare against.		MinLength: 1
matchPolicy PackageVersionMatchPolicy	MatchPolicy controls how Value is matched. If omitted, AtLeast is used.	AtLeast	Enum: [Exact AtLeast] Optional: {}

PendingNVConfigDevice

Appears in:

• PendingNVConfigState

Field	Description	Default	Validation
device string
entries PendingNVConfigEntry array

PendingNVConfigEntry

Appears in:

• PendingNVConfigDevice

Field	Description	Default	Validation
name string
default string
current string
next_boot string	NextBoot uses the "next_boot" so this type can be reused for parsing mlxfwrest output

PendingNVConfigState

Appears in:

• AgentStatus

Field	Description	Default	Validation
bootID string
devices PendingNVConfigDevice array

RebootMethodType

Underlying type: string

RebootMethodType is the type of reset/reboot required after NVConfig or firmware changes. Set by the DPU agent. Most values align with NVIDIA BlueField Reset and Reboot Procedures (mlxfwreset levels).

Validation:

• Enum: [Unknown NoAction PowerCycle SystemReboot SystemLevelReset FirmwareReset DPUWarmReboot HostlessDPUReboot]

Appears in:

• AgentStatus
• DPUNodeStatus
• RebootStatus

Field	Description
Unknown	RebootMethodUnknown is the initial value set by the DPU agent on startup before HandleReboot determines the actual method. It prevents the controller from acting on a stale RebootMethod left over from a previous agent session.
NoAction	RebootMethodNoAction indicates no reset or reboot is required.
PowerCycle	RebootMethodPowerCycle indicates a full server power cycle (cold boot) is required.
SystemReboot	RebootMethodSystemReboot firmware update without full server power cycle.
SystemLevelReset	RebootMethodSystemLevelReset firmware configuration changes to take effect.
FirmwareReset	RebootMethodFirmwareReset driver restart and PCI reset.
DPUWarmReboot	RebootMethodDPUWarmReboot indicates the DPU OS is rebooting itself to apply configuration changes (e.g. grub kernel parameters) that do not originate from firmware or NVConfig. The provisioning controller should stay in the current phase and wait for the agent to come back.
HostlessDPUReboot	RebootMethodHostlessDPUReboot indicates a hostless DPU needs a DPU ARM reboot performed by the provisioning controller through Redfish.

RebootStatus

RebootStatus stores the host reboot execution status.

Appears in:

• DPUStatus

Field	Description	Default	Validation
phase RebootStatusPhase	Phase is the current host reboot progress.		Enum: [WaitForShutdown Pending Succeeded Failed Unknown]
method RebootMethodType	Method is the recommended reboot method.		Enum: [Unknown NoAction PowerCycle SystemReboot SystemLevelReset FirmwareReset DPUWarmReboot HostlessDPUReboot] Optional: {}
reason string	Reason indicates machine-readable reason for current phase.		Optional: {}
message string	Message provides human-readable details for current phase.		Optional: {}
lastTransitionTime Time	LastTransitionTime is the last update time for reboot status.		Optional: {}

RebootStatusPhase

Underlying type: string

RebootStatusPhase is the host reboot progress phase.

Validation:

• Enum: [WaitForShutdown Pending Succeeded Failed Unknown]

Appears in:

• RebootStatus

Field	Description
WaitForShutdown	RebootStatusWaitForShutdown means the host reboot is held until the DPU has completed its graceful shutdown. Used in Zero Trust mode for a System Level Reset so the External/Script host reboot is not triggered while the Arm OS is still shutting down.
Pending	RebootStatusPending means reboot is requested but execution has not started yet (for example, waiting for a manual external reboot trigger).
Succeeded	RebootStatusSucceeded means reboot completed successfully.
Failed	RebootStatusFailed means reboot execution failed.
Unknown	RebootStatusUnknown means reboot execution state cannot be determined.

RollingUpdateDPU

RollingUpdateDPU is the rolling update strategy for a DPUSet.

Appears in:

• DPUSetStrategy

Field	Description	Default	Validation
maxUnavailable IntOrString	MaxUnavailable is the maximum number of DPUs that can be unavailable during the update. Deprecated: This field is deprecated and will be removed with v26.7.0.		Optional: {}

ScalableFunctions

ScalableFunctions groups the agent-managed Scalable Function configuration.

Appears in:

• DPUFlavorSpec

Field	Description	Default	Validation
dma DMAScalableFunction	DMA configures the DMA SF that e.g. SNAP DOCA service uses to DMA host memory over the second Grace PCI link on BlueField-4 socket-direct systems.		Optional: {}

Script

Appears in:

• NodeRebootMethod

Field	Description	Default	Validation
name string			MinLength: 1 Required: {}

SecureBootStatus

SecureBootStatus represents the UEFI Secure Boot configuration status on the DPU.

Appears in:

• DPUDeviceStatus
• DPUStatus

Field	Description	Default	Validation
enabled boolean	Enabled indicates whether UEFI Secure Boot is currently enabled on the DPU.		Optional: {}

SpiffeStatus

SpiffeStatus is the DPU Agent's SPIFFE heartbeat sub-status.

Appears in:

• AgentStatus

Field	Description	Default	Validation
lastProbeTime Time	LastProbeTime is the wall-clock timestamp the DPU Agent recorded on its most recent successful status report. It is informational and subject to DPU clock skew, so it is not a precise liveness signal on its own.		Optional: {}
lastProbeMessage string	LastProbeMessage is a structured one-line diagnostic for the most recent self-probe. Unset in the steady-state happy path. Bounded to 256 chars (truncated agent-side).		MaxLength: 256 Optional: {}

StrategyType

Underlying type: string

StrategyType describes strategy to use to reprovision existing DPUs.

Validation:

• Enum: [OnDelete RollingUpdate]

Appears in:

• DPUSetStrategy

Field	Description
OnDelete	New DPU CR will only be created when you manually delete old DPU CR.
RollingUpdate	Gradually scale down the old DPUs and scale up the new one.

SystemdServiceOperation

Underlying type: string

SystemdServiceOperation defines the operation to perform on a systemd service.

Validation:

• Enum: [Start Enable EnableAndStart]

Appears in:

• SystemdServiceSpec

Field	Description
Start	SystemdServiceStart starts the service without enabling it at boot.
Enable	SystemdServiceEnable enables the service at boot without starting it immediately.
EnableAndStart	SystemdServiceEnableAndStart enables the service at boot and starts it immediately (equivalent to systemctl enable --now).

SystemdServiceSpec

SystemdServiceSpec defines a systemd service to manage on the node.

Appears in:

• DPUFlavorSpec

Field	Description	Default	Validation
name string	Name is the systemd service name.		MaxLength: 253 MinLength: 1
operation SystemdServiceOperation	Operation is the systemd operation to perform on the service.		Enum: [Start Enable EnableAndStart]

TrustBundleStatus

TrustBundleStatus reports reconciliation progress for a CA trust bundle.

Appears in:

• DPUDeviceStatus

Field	Description	Default	Validation
observedBundleHash string	ObservedBundleHash records the last successfully applied bundle hash.		Optional: {}
lastUpdateTime Time	LastUpdateTime is when the last successful reconciliation completed.		Optional: {}

UpgradePolicy

UpgradePolicy is the policy for the upgrade of the DPUSet.

Appears in:

• NodeEffect

Field	Description	Default	Validation
applyOnLabelChange boolean	Apply node effect when labels change on the DPU object When set to true, label changes in Ready state will trigger node effect logic	false	Optional: {}
nodeMaintenanceAdditionalRequestors string array	Additional requestors to be added to the NvidiaNodeMaintenance CR when Drain is selected		Optional: {}

storage.dpu.nvidia.com/v1alpha1

Package v1alpha1 contains API Schema definitions for the storage v1alpha1 API group

Resource Types

• DPUStoragePolicy
• DPUStoragePolicyList
• DPUStorageVendor
• DPUStorageVendorList
• DPUVolume
• DPUVolumeAttachment
• DPUVolumeAttachmentList
• DPUVolumeList
• SVVolumeAttachment
• SVVolumeAttachmentList
• Volume
• VolumeAttachment
• VolumeAttachmentList
• VolumeList

AttachmentStatusDPU

AttachmentStatusDPU describe the information of DPU volume

Appears in:

• DPUVolumeAttachmentStatus

Field	Description	Default	Validation
pciAddress string	PCI device address in the following format: (bus:device.function)		Optional: {}
deviceName string	The name of the device that was created by the storage vendor plugin		Optional: {}
nvmeAttrs NVMEAttrs	The attributes of the emulated NVME function		Optional: {}
virtioFSAttrs VirtioFSAttrs	The attributes of the emulated VirtioFS function		Optional: {}

BdevAttrs

BdevAttrs represents the attributes of the underlying block device

Appears in:

• VolumeAttachmentStatusDPU

Field	Description	Default	Validation
nvmeNsID integer	The namespace ID within the NVME controller
nvmeUUID string	The nvme namespace UUID

CSIReference

CSIReference reference to CSI object

Appears in:

• VolumeSpecDPU

Field	Description	Default	Validation
csiDriverName string
storageClassName string
pvcRef ObjectRef

CapacityRange

CapacityRange represents the capacity of the required storage space in bytes

Appears in:

• VolumeRequest

Field	Description	Default	Validation
request Quantity
limit Quantity

DPUStoragePolicy

DPUStoragePolicy represents a DPUStoragePolicy CR

Appears in:

• DPUStoragePolicyList

Field	Description	Default	Validation
apiVersion string	storage.dpu.nvidia.com/v1alpha1
kind string	DPUStoragePolicy
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec DPUStoragePolicySpec
status DPUStoragePolicyStatus

DPUStoragePolicyList

DPUStoragePolicyList contains a list of DPUStoragePolicy objects

Field	Description	Default	Validation
apiVersion string	storage.dpu.nvidia.com/v1alpha1
kind string	DPUStoragePolicyList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items DPUStoragePolicy array

DPUStoragePolicySpec

DPUStoragePolicySpec defines the desired state of DPUStoragePolicy

Appears in:

• DPUStoragePolicy

Field	Description	Default	Validation
dpuStorageVendors string array	List of storage vendors		MinItems: 1 Required: {}
parameters object (keys:string, values:string)	Parameters supported by the policy	{ }	Optional: {}
selectionAlgorithm SelectionAlgorithm	Selection algorithm used to select DPUStorageVendor	NumberVolumes	Enum: [Random NumberVolumes] Optional: {}

DPUStoragePolicyStatus

DPUStoragePolicyStatus defines the observed state of DPUStoragePolicy

Appears in:

• DPUStoragePolicy

Field	Description	Default	Validation
conditions Condition array	Current service state conditions
observedGeneration integer	ObservedGeneration records the Generation observed on the object the last time it was patched.

DPUStorageVendor

DPUStorageVendor represents a StorageVendor CR on the DPU cluster.

Appears in:

• DPUStorageVendorList

Field	Description	Default	Validation
apiVersion string	storage.dpu.nvidia.com/v1alpha1
kind string	DPUStorageVendor
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec DPUStorageVendorSpec
status DPUStorageVendorStatus

DPUStorageVendorList

DPUStorageVendorList contains a list of DPUStorageVendor

Field	Description	Default	Validation
apiVersion string	storage.dpu.nvidia.com/v1alpha1
kind string	DPUStorageVendorList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items DPUStorageVendor array

DPUStorageVendorSpec

DPUStorageVendorSpec defines the desired state of DPUStorageVendor

Appears in:

• DPUStorageVendor

Field	Description	Default	Validation
storageClassName string	Storage vendor class name, deployed on the DPU K8S cluster.		MinLength: 1 Required: {}
pluginName string	Storage vendor DPU plugin name		MinLength: 1 Required: {}

DPUStorageVendorStatus

DPUStorageVendorStatus defines the observed state of DPUStorageVendor

Appears in:

• DPUStorageVendor

Field	Description	Default	Validation
dpuClusters ObjectReference array	DPUClusters is the list of clusters on which the DPUStorageVendor is deployed.
conditions Condition array	Conditions defines current service state.
observedGeneration integer	ObservedGeneration records the Generation observed on the object the last time it was patched.

DPUVolume

DPUVolume represents a DPUVolume CR.

Appears in:

• DPUVolumeList

Field	Description	Default	Validation
apiVersion string	storage.dpu.nvidia.com/v1alpha1
kind string	DPUVolume
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec DPUVolumeSpec
status DPUVolumeStatus

DPUVolumeAttachment

DPUVolumeAttachment represents a Volume CR on the DPU cluster.

Appears in:

• DPUVolumeAttachmentList

Field	Description	Default	Validation
apiVersion string	storage.dpu.nvidia.com/v1alpha1
kind string	DPUVolumeAttachment
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec DPUVolumeAttachmentSpec
status DPUVolumeAttachmentStatus

DPUVolumeAttachmentList

DPUVolumeAttachmentList contains a list of DPUVolumeAttachment

Field	Description	Default	Validation
apiVersion string	storage.dpu.nvidia.com/v1alpha1
kind string	DPUVolumeAttachmentList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items DPUVolumeAttachment array

DPUVolumeAttachmentSpec

DPUVolumeAttachmentSpec defines the desired state of DPUVolumeAttachment

Appears in:

• DPUVolumeAttachment

Field	Description	Default	Validation
dpuNodeName string	DPUNodeName is the name of DPUNode object that represents the node to which the volume should be attached		MinLength: 1 Required: {}
dpuVolumeName string	DPUVolumeName is the name of DPUVolume object that represents the volume to be attached		MinLength: 1 Required: {}
functionType FunctionType	FunctionType is the type of the emulated function that should be used to attach the volume		Enum: [pf vf] Required: {}
hotplugFunction boolean	HotplugFunction is a boolean flag that indicates if the emulated function should be hotplugged		Required: {}

DPUVolumeAttachmentStatus

DPUVolumeAttachmentStatus defines the observed state of DPUVolumeAttachment

Appears in:

• DPUVolumeAttachment

Field	Description	Default	Validation
controllerAttached boolean	Indicates the volume is successfully attached to by the Vendor CSI driver
dpuAttached boolean	Indicates the volume is successfully attached to the node by DPU		Optional: {}
attachmentMetadata object (keys:string, values:string)	AttachmentMetadata contains the metadata of the volume attachment returned by the Vendor CSI driver		Optional: {}
dpu AttachmentStatusDPU	Details about the DPU attachment		Optional: {}
message string	The last error encountered during the attach operation, if any		Optional: {}
conditions Condition array	Conditions defines current service state.		Optional: {}
observedGeneration integer	ObservedGeneration records the Generation observed on the object the last time it was patched.

DPUVolumeList

DPUVolumeList contains a list of DPUVolume

Field	Description	Default	Validation
apiVersion string	storage.dpu.nvidia.com/v1alpha1
kind string	DPUVolumeList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items DPUVolume array

DPUVolumePhase

Underlying type: string

Appears in:

• DPUVolumeStatus

Field	Description
Pending	used for DPUVolume that are not yet bound to a volume in the DPU cluster
Bound	used for DPUVolume that are bound to a volume in the DPU cluster

DPUVolumeSpec

DPUVolumeSpec defines the desired state of DPUVolume

Appears in:

• DPUVolume

Field	Description	Default	Validation
dpuStoragePolicyName string	Name of the DPUStoragePolicyName object that will be used to create the volume.		MinLength: 1 Required: {}
parameters object (keys:string, values:string)	Additional parameters for the volume, these parameters are merged with the values from the DPUStoragePolicy object.	{ }	Optional: {}
accessModes PersistentVolumeAccessMode array	Access modes define how the volume can be mounted. These modes are directly passed to the PersistentVolumeClaim created for the Vendor CSI Plugin selected by the DPUStoragePolicy.		MaxItems: 3 MinItems: 1 Required: {}
resources VolumeResourceRequirements	Resources represents the storage resources requested for the volume. These resource requirements are directly passed to the PersistentVolumeClaim created for the Vendor CSI Plugin selected by the DPUStoragePolicy. Since volume resizing is not supported, modifications to the resource request are prohibited.		Required: {}
volumeMode PersistentVolumeMode	Volume mode defines how the volume should be mounted and used. This value is directly passed to the PersistentVolumeClaim created for the Vendor CSI Plugin selected by the DPUStoragePolicy.	Filesystem	Enum: [Filesystem Block] Optional: {}

DPUVolumeState

DPUVolumeState defines the state of the volume.

Appears in:

• DPUVolumeStatus

Field	Description	Default	Validation
dpuCluster ObjectReference	DPUCluster contains the reference to the DPUCluster object that was selected for volume creation.		Optional: {}
parameters object (keys:string, values:string)	Parameters contains the final set of parameters for volume creation, computed by merging the parameters from the DPUStoragePolicy object with user-provided parameters.		Optional: {}
selectedDPUStorageVendorName string	SelectedDPUStorageVendorName contains the name of the DPUStorageVendor object that was selected for volume creation.		Optional: {}
storageVendorPluginName string	StorageVendorPluginName contains the name of the storage vendor plugin deployed on the DPU cluster that was selected for volume creation.		Optional: {}
storageClassName string	StorageClassName contains the name of the storage class in the DPU cluster that was selected for volume creation.		Optional: {}
csiDriverName string	CSIDriverName contains the name of the CSI driver in the DPU cluster that was selected for volume creation.		Optional: {}
persistentVolumeClaimRef ObjectReference	PersistentVolumeClaimRef contains the reference to the PersistentVolumeClaim object in the DPU cluster that was created for the volume.		Optional: {}
volumeInfo VolumeInfo	VolumeInfo contains a subset of fields from the PersistentVolume object created in the DPU cluster		Optional: {}

DPUVolumeStatus

DPUVolumeStatus defines the observed state of DPUVolume

Appears in:

• DPUVolume

Field	Description	Default	Validation
phase DPUVolumePhase	Phase of the volume		Enum: [Pending Bound] Optional: {}
state DPUVolumeState	State of the volume. This field is managed by the controller. User usually do not need to set fields from this struct.		Optional: {}
conditions Condition array	Conditions defines current service state.
observedGeneration integer	ObservedGeneration records the Generation observed on the object the last time it was patched.

FSdevAttrs

FSdevAttrs represents the attributes of the underlying filesystem device

Appears in:

• VolumeAttachmentStatusDPU

Field	Description	Default	Validation
filesystemTag string	Filesystem tag identified by SNAP on the host (used for the mount). Relevant for volume of type filesystem

FunctionType

Underlying type: string

Appears in:

• DPUVolumeAttachmentSpec
• FunctionTypeConfig
• VolumeAttachmentSpec

Field	Description
pf	FunctionTypePF is the PF function type
vf	FunctionTypeVF is the VF function type

FunctionTypeConfig

FunctionTypeConfig is the configuration for the emulated function that should be used to attach the volume

Appears in:

• DPUVolumeAttachmentSpec
• VolumeAttachmentSpec

Field	Description	Default	Validation
functionType FunctionType	FunctionType is the type of the emulated function that should be used to attach the volume		Enum: [pf vf] Required: {}
hotplugFunction boolean	HotplugFunction is a boolean flag that indicates if the emulated function should be hotplugged		Required: {}

NVMEAttrs

NVMEAttrs represents the attributes of the NVME emulated function

Appears in:

• AttachmentStatusDPU

Field	Description	Default	Validation
namespaceID integer	The namespace ID within the NVME controller		Optional: {}
namespaceUUID string	The NVMe namespace UUID		Optional: {}

ObjectRef

ObjectRef reference to the object

Appears in:

• CSIReference
• VolumeAttachmentSpec
• VolumeSource
• VolumeSpec

Field	Description	Default	Validation
kind string
apiVersion string
name string
namespace string

ObjectReference

ObjectReference represents a reference to a Kubernetes object.

Appears in:

• DPUStorageVendorStatus
• DPUVolumeState

Field	Description	Default	Validation
name string	Name specifies the name of the referenced object		MinLength: 1 Required: {}
namespace string	Namespace specifies the namespace where the referenced object exists		MinLength: 1 Required: {}

SVVolumeAttachment

SVVolumeAttachment captures the intent to attach/detach the specified Volume to/from the specified node.

Appears in:

• SVVolumeAttachmentList

Field	Description	Default	Validation
apiVersion string	storage.dpu.nvidia.com/v1alpha1
kind string	SVVolumeAttachment
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec VolumeAttachmentSpec
status VolumeAttachmentStatus

SVVolumeAttachmentList

SVVolumeAttachmentList contains a list of SVVolumeAttachment

Field	Description	Default	Validation
apiVersion string	storage.dpu.nvidia.com/v1alpha1
kind string	SVVolumeAttachmentList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items SVVolumeAttachment array

SelectionAlgorithm

Underlying type: string

SelectionAlgorithm represents the storage selection algorithm type

Appears in:

• DPUStoragePolicySpec

Field	Description
Random	Random selection across the vendors defined in the StoragePolicy list.
NumberVolumes	Load-balancing on the number of volumes belonging to the StoragePolicy. The vendor (in the DPUStoragePolicy list) with the minimal number of volumes should be selected.

VirtioFSAttrs

VirtioFSAttrs represents the attributes of the VirtioFS emulated function

Appears in:

• AttachmentStatusDPU

Field	Description	Default	Validation
filesystemTag string	Filesystem tag identified by SNAP on the host (used for the mount). Relevant for volume of type filesystem		Optional: {}

Volume

Volume represents a persistent volume on the DPU cluster. It maps between the tenant K8S persistent volume (PV) object on the tenant cluster into the actual volume on the DPU cluster. Volume is an internal API, it is not intended to be used by users.

Appears in:

• VolumeList

Field	Description	Default	Validation
apiVersion string	storage.dpu.nvidia.com/v1alpha1
kind string	Volume
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec VolumeSpec
status VolumeStatus

VolumeAttachment

VolumeAttachment captures the intent to attach/detach the specified NV-Volume to/from the specified node. VolumeAttachment is an internal API, it is not intended to be used by users.

Appears in:

• VolumeAttachmentList

Field	Description	Default	Validation
apiVersion string	storage.dpu.nvidia.com/v1alpha1
kind string	VolumeAttachment
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec VolumeAttachmentSpec
status VolumeAttachmentStatus

VolumeAttachmentList

VolumeAttachmentList contains a list of VolumeAttachment

Field	Description	Default	Validation
apiVersion string	storage.dpu.nvidia.com/v1alpha1
kind string	VolumeAttachmentList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items VolumeAttachment array

VolumeAttachmentSpec

VolumeAttachmentSpec defines the desired state of VolumeAttachment

Appears in:

• VolumeAttachment

Field	Description	Default	Validation
nodeName string	The name of the node that the volume should be attached to
source VolumeSource	Reference to the NV-Volume object
volumeAttachmentRef ObjectRef	Reference to the SV-VolumeAttachment object
parameters object (keys:string, values:string)	Opaque static publish properties of the volume returned by the plugin
functionType FunctionType	FunctionType is the type of the emulated function that should be used to attach the volume		Enum: [pf vf] Required: {}
hotplugFunction boolean	HotplugFunction is a boolean flag that indicates if the emulated function should be hotplugged		Required: {}

VolumeAttachmentStatus

VolumeAttachmentStatus defines the observed state of VolumeAttachment

Appears in:

• VolumeAttachment

Field	Description	Default	Validation
storageAttached boolean	Indicates the volume is successfully attached to the target storage system
message string	The last error encountered during the attach operation, if any
dpu VolumeAttachmentStatusDPU	Details about the DPU attachment

VolumeAttachmentStatusDPU

VolumeAttachmentStatusDPU describe the information of DPU volume

Appears in:

• VolumeAttachmentStatus

Field	Description	Default	Validation
attached boolean	Indicates the volume is successfully attached to the DPU node
pciDeviceAddress string	PCI device address in the following format: (bus:device.function)
deviceName string	The name of the device that was created by the storage vendor plugin
bdevAttrs BdevAttrs	The attributes of the underlying block device		Optional: {}
fsdevAttrs FSdevAttrs	The attributes of the underlying filesystem device		Optional: {}

VolumeInfo

VolumeInfo represents a subset of fields from the PersistentVolume object that was created in the DPU cluster. This struct is used to track and expose key volume information without carrying the full PersistentVolume object.

Appears in:

• DPUVolumeState

Field	Description	Default	Validation
volumeName string	VolumeName contains the name of the PersistentVolume object in the DPU cluster		Optional: {}
capacity ResourceList	Actual capacity of the volume in the DPU cluster		Optional: {}
accessModes PersistentVolumeAccessMode array	Actual access modes of the volume in the DPU cluster		Optional: {}
volumeMode PersistentVolumeMode	Actual volume mode of the volume in the DPU cluster		Optional: {}
volumeAttributes object (keys:string, values:string)	VolumeAttributes from the PersistentVolume object in the DPU cluster This field usually contains parameters returned by the Vendor CSI plugin on volume creation.		Optional: {}

VolumeList

VolumeList contains a list of Volume

Field	Description	Default	Validation
apiVersion string	storage.dpu.nvidia.com/v1alpha1
kind string	VolumeList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items Volume array

VolumeRequest

VolumeRequest represents the volume's requirements

Appears in:

• VolumeSpec

Field	Description	Default	Validation
capacityRange CapacityRange	The capacity of the required storage space in bytes		Optional: {}
accessModes PersistentVolumeAccessMode array	Contains the types of access modes required		Optional: {}
volumeMode PersistentVolumeMode	volumeMode defines what type of volume is required by the claim. Value of Filesystem is implied when not included in claim spec.		Optional: {}

VolumeSource

VolumeSource references to the NV-Volume object

Appears in:

• VolumeAttachmentSpec

Field	Description	Default	Validation
volumeRef ObjectRef	Reference to the NV-Volume object

VolumeSpec

VolumeSpec defines the desired state of Volume

Appears in:

• Volume

Field	Description	Default	Validation
storageParameters object (keys:string, values:string)	List of storage parameters supported by the policy, values are string only		Optional: {}
request VolumeRequest	The capacity of the required storage space in bytes		Required: {}
storagePolicyRef ObjectRef	Reference to the StoragePolicy object		Optional: {}
storagePolicyParameters object (keys:string, values:string)	List of storage parameters supported by the policy, values are string only		Optional: {}
volume VolumeSpecDPU	Describe volume information in DPU cluster		Optional: {}

VolumeSpecDPU

VolumeSpecDPU describe volume information in DPU cluster

Appears in:

• VolumeSpec

Field	Description	Default	Validation
id string
capacity Quantity
accessModes PersistentVolumeAccessMode array
reclaimPolicy PersistentVolumeReclaimPolicy			Enum: [Delete Retain]
storageVendorName string
storageVendorPluginName string
volumeAttributes object (keys:string, values:string)
csiReference CSIReference

VolumeState

Underlying type: string

VolumeState represents the state of volume

Validation:

• Enum: [InProgress Available]

Appears in:

• VolumeStatus

Field	Description
InProgress	InProgress means the some of related resource is still in progress
Available	Available means that all related resources are created

VolumeStatus

VolumeStatus defines the observed state of Volume

Appears in:

• Volume

Field	Description	Default	Validation
state VolumeState	The state of a Volume object		Enum: [InProgress Available] Optional: {}

svc.dpu.nvidia.com/v1alpha1

Package v1alpha1 contains API Schema definitions for the svc.dpf v1alpha1 API group

Package v1alpha1 contains API Schema definitions for the sfc v1alpha1 API group

Resource Types

• DPUDeployment
• DPUDeploymentList
• DPUService
• DPUServiceChain
• DPUServiceChainList
• DPUServiceConfiguration
• DPUServiceConfigurationList
• DPUServiceCredentialRequest
• DPUServiceCredentialRequestList
• DPUServiceIPAM
• DPUServiceIPAMList
• DPUServiceInterface
• DPUServiceInterfaceList
• DPUServiceList
• DPUServiceNAD
• DPUServiceNADList
• DPUServiceTemplate
• DPUServiceTemplateList
• NodeServiceInterfaces
• NodeServiceInterfacesList
• ServiceChain
• ServiceChainList
• ServiceChainSet
• ServiceChainSetList
• ServiceInterface
• ServiceInterfaceList
• ServiceInterfaceSet
• ServiceInterfaceSetList

ApplicationSource

ApplicationSource specifies the source of the Helm chart.

Appears in:

• HelmChart

Field	Description	Default	Validation
repoURL string	RepoURL specifies the URL to the repository that contains the application Helm chart. The URL must begin with either 'oci://' or 'https://', ensuring it points to a valid OCI registry or a web-based repository.		Pattern: ^(oci://|https://).+$ Required: {}
path string	Path is the location of the chart inside the repo.		Optional: {}
version string	Version is a semver tag for the Chart's version.		MinLength: 1 Required: {}
chart string	Chart is the name of the helm chart.		Optional: {}
releaseName string	ReleaseName is the name to give to the release generate from the DPUService.		Optional: {}

CNIPlugin

CNIPlugin defines a CNI plugin to be used in a chained CNI configuration. When multiple CNI plugins are specified in ChainedCNIs, they are executed in order after the base OVS CNI plugin to provide additional network functionality.

Appears in:

• DPUServiceNADSpec

Field	Description	Default	Validation
type string	Type specifies the CNI plugin type to be used in the chain. Currently only "rdma" is supported, which enables RDMA capabilities for the network interface.		Enum: [rdma] Required: {}
config RawExtension	Config contains optional plugin-specific configuration as raw JSON. The configuration is merged into the CNI plugin configuration.		Optional: {}

ConfigPort

ConfigPort defines the configuration of a single port within a DPUService. Each port must have a unique name within the service.

Appears in:

• ConfigPorts
• DPUServiceStatus

Field	Description	Default	Validation
name string	Name is a unique identifier for the port within the DPUService. This name is used for reference inside the service.		MinLength: 1 Pattern: ^[a-z0-9-]+$ Required: {}
port integer	Port is the port number that will be exposed by the service. Must be within the valid range of TCP/UDP ports (1-65535).		Required: {}
protocol Protocol	Protocol specifies the transport protocol used by the port. Supported values: TCP, UDP		Enum: [TCP UDP] Required: {}
nodePort integer	NodePort is the external port assigned on each node in the cluster. If not set, Kubernetes will automatically allocate a NodePort. Constraints: - Can only be set when ServiceType is "NodePort". - Must be within the clusters valid NodePort range (Kubernetes default is 30000-32767).		Optional: {}

ConfigPorts

ConfigPorts defines the desired state of port configurations for a DPUService. This struct determines how ports are exposed from the DPU to the host cluster. A DPUService can only have a single ServiceType across all ports.

Validation:

• If any port has a NodePort assigned, ServiceType must be "NodePort".

Appears in:

• DPUServiceSpec
• ServiceConfiguration

Field	Description	Default	Validation
serviceType ServiceType	ServiceType specifies the type of Kubernetes Service to create. All ports within this ConfigPorts will have the same ServiceType. The value is immutable and cannot be changed after creation. Supported values: - "NodePort": Exposes ports externally on a node. - "ClusterIP": Exposes ports internally within the cluster. - "None": Internal-only service with no cluster IP. Default: "NodePort"	NodePort	Enum: [NodePort ClusterIP None] Required: {}
ports ConfigPort array	Ports defines the list of port configurations that will be exposed by the DPUService. Each port must specify a name, port number, and protocol. Constraints: - If ServiceType is "NodePort", ports may optionally specify a NodePort. - If ServiceType is "None" or "ClusterIP", ports cannot specify a NodePort.		Required: {}

DPUClusterAllocation

DPUClusterAllocation contains the IP range allocations for a specific DPUCluster.

Appears in:

• DPUServiceIPAMStatus

Field	Description	Default	Validation
dpuCluster string	DPUCluster is the NamespacedName of the DPUCluster in the format <namespace>/<name>.
ipRanges IPRange array	IPRanges contains the IP ranges allocated to this DPUCluster.		Optional: {}

DPUDeployment

DPUDeployment is an object that describes a set of DPUServices and a DPUServiceChain that run a on a set of DPUs with a given BFB or BlueFieldSoftware and DPUFlavor.

Appears in:

• DPUDeploymentList

Field	Description	Default	Validation
apiVersion string	svc.dpu.nvidia.com/v1alpha1
kind string	DPUDeployment
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec DPUDeploymentSpec
status DPUDeploymentStatus

DPUDeploymentList

DPUDeploymentList contains a list of DPUDeployment

Field	Description	Default	Validation
apiVersion string	svc.dpu.nvidia.com/v1alpha1
kind string	DPUDeploymentList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items DPUDeployment array

DPUDeploymentPort

DPUDeploymentPort defines how a port can be configured

Appears in:

• DPUDeploymentSwitch

Field	Description	Default	Validation
service DPUDeploymentService	Service holds configuration that helps configure the Service Function Chain and identify a port associated with a DPUService		Optional: {}
serviceInterface ServiceIfc	ServiceInterface holds configuration that helps configure the Service Function Chain and identify a user defined port		Optional: {}

DPUDeploymentService

DPUDeploymentService is the struct used for referencing an interface.

Appears in:

• DPUDeploymentPort

Field	Description	Default	Validation
name string	Name is the name of the service as defined in the DPUDeployment Spec		MaxLength: 28 MinLength: 1 Required: {}
interface string	Interface name is the name of the interface as defined in the DPUServiceConfiguration		MaxLength: 15 MinLength: 1 Required: {}
ipam IPAM	IPAM defines the IPAM configuration that is configured in the Service Function Chain		Optional: {}

DPUDeploymentServiceConfiguration

DPUDeploymentServiceConfiguration describes the configuration of a particular Service

Appears in:

• DPUDeploymentSpec

Field	Description	Default	Validation
serviceTemplate string	ServiceTemplate is the name of the DPUServiceTemplate object to be used for this Service. It must be in the same namespace as the DPUDeployment.
serviceConfiguration string	ServiceConfiguration is the name of the DPUServiceConfiguration object to be used for this Service. It must be in the same namespace as the DPUDeployment.
dependsOn LocalObjectDependency array	DependsOn is a list of local object dependencies that are required for this Service.		MinItems: 1 Optional: {}

DPUDeploymentSpec

DPUDeploymentSpec defines the desired state of DPUDeployment

Appears in:

• DPUDeployment

Field	Description	Default	Validation
dpus DPUs	DPUs contains the DPU related configuration		Required: {}
services object (keys:string, values:DPUDeploymentServiceConfiguration)	Services contains the DPUDeploymentService related configuration. The key is the deploymentServiceName and the value is its configuration. All underlying objects must specify the same deploymentServiceName in order to be able to be consumed by the DPUDeployment.		MaxProperties: 50 MinProperties: 1 Required: {}
serviceChains ServiceChains	ServiceChains contains the configuration related to the DPUServiceChains that the DPUDeployment creates.		Optional: {}
revisionHistoryLimit integer	The maximum number of revisions that can be retained during upgrades. Defaults to 10.	10	Minimum: 1 Optional: {}

DPUDeploymentStatus

DPUDeploymentStatus defines the observed state of DPUDeployment

Appears in:

• DPUDeployment

Field	Description	Default	Validation
conditions Condition array	Conditions reflect the status of the object
observedGeneration integer	ObservedGeneration records the Generation observed on the object the last time it was patched.

DPUDeploymentSwitch

DPUDeploymentSwitch holds the ports that are connected in switch topology

Appears in:

• ServiceChains

Field	Description	Default	Validation
ports DPUDeploymentPort array	Ports contains the ports of the switch		MaxItems: 50 MinItems: 1 Required: {}
serviceMTU integer	ServiceMTU of the switch The default is 1500.	1500	Maximum: 9216 Minimum: 1280 Optional: {}

DPUService

DPUService is the Schema for the dpuservices API

Appears in:

• DPUServiceList

Field	Description	Default	Validation
apiVersion string	svc.dpu.nvidia.com/v1alpha1
kind string	DPUService
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec DPUServiceSpec
status DPUServiceStatus

DPUServiceChain

DPUServiceChain is the Schema for the DPUServiceChain API

Appears in:

• DPUServiceChainList

Field	Description	Default	Validation
apiVersion string	svc.dpu.nvidia.com/v1alpha1
kind string	DPUServiceChain
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec DPUServiceChainSpec
status DPUServiceChainStatus

DPUServiceChainList

DPUServiceChainList contains a list of DPUServiceChain

Field	Description	Default	Validation
apiVersion string	svc.dpu.nvidia.com/v1alpha1
kind string	DPUServiceChainList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items DPUServiceChain array

DPUServiceChainSpec

DPUServiceChainSpec defines the desired state of DPUServiceChainSpec

Appears in:

• DPUServiceChain

Field	Description	Default	Validation
clusterSelector LabelSelector	Select the Clusters with specific labels, ServiceChainSet CRs will be created only for these Clusters Deprecated: This field is deprecated and will be removed with v26.7.0. Use DPUClusterSelector instead.		Optional: {}
dpuClusterSelector LabelSelector	DPUClusterSelector determines in which clusters the DPUServiceChain controller should apply the configuration.		Optional: {}
template ServiceChainSetSpecTemplate	Template describes the ServiceChainSet that will be created for each selected Cluster.

DPUServiceChainStatus

DPUServiceChainStatus defines the observed state of DPUServiceChain

Appears in:

• DPUServiceChain

Field	Description	Default	Validation
conditions Condition array	Conditions reflect the status of the object
observedGeneration integer	ObservedGeneration records the Generation observed on the object the last time it was patched.

DPUServiceConfiguration

DPUServiceConfiguration is the Schema for the dpuserviceconfigurations API. This object is intended to be used in conjunction with a DPUDeployment object. This object is the template from which the DPUService will be created. It contains all configuration options from the user to be provided to the service itself via the helm chart values. This object doesn't allow configuration of nodeSelector and resources in purpose as these are delegated to the DPUDeployment and DPUServiceTemplate accordingly.

Appears in:

• DPUServiceConfigurationList

Field	Description	Default	Validation
apiVersion string	svc.dpu.nvidia.com/v1alpha1
kind string	DPUServiceConfiguration
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec DPUServiceConfigurationSpec
status DPUServiceConfigurationStatus

DPUServiceConfigurationList

DPUServiceConfigurationList contains a list of DPUServiceConfiguration

Field	Description	Default	Validation
apiVersion string	svc.dpu.nvidia.com/v1alpha1
kind string	DPUServiceConfigurationList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items DPUServiceConfiguration array

DPUServiceConfigurationServiceDaemonSetValues

DPUServiceConfigurationServiceDaemonSetValues reflects the Helm related configuration

Appears in:

• ServiceConfiguration

Field	Description	Default	Validation
updateStrategy DaemonSetUpdateStrategy	UpdateStrategy specifies the DeaemonSet update strategy for the ServiceDaemonset.		Optional: {}
labels object (keys:string, values:string)	Labels specifies labels which are added to the ServiceDaemonSet.		MaxProperties: 50 Optional: {}
annotations object (keys:string, values:string)	Annotations specifies annotations which are added to the ServiceDaemonSet.		MaxProperties: 50 Optional: {}
resources ResourceList	Resources specifies resources which are added to the ServiceDaemonSet.		Optional: {}

DPUServiceConfigurationSpec

DPUServiceConfigurationSpec defines the desired state of DPUServiceConfiguration

Appears in:

• DPUServiceConfiguration

Field	Description	Default	Validation
deploymentServiceName string	DeploymentServiceName is the name of the DPU service this configuration refers to. It must match .spec.deploymentServiceName of a DPUServiceTemplate object and one of the keys in .spec.services of a DPUDeployment object.		MaxLength: 28 MinLength: 1 Required: {}
serviceConfiguration ServiceConfiguration	ServiceConfiguration contains fields that are configured on the generated DPUService.		Optional: {}
interfaces ServiceInterfaceTemplate array	Interfaces specifies the DPUServiceInterface to be generated for the generated DPUService.		MaxItems: 50 MinItems: 1 Optional: {}
upgradePolicy UpgradePolicy	UpgradePolicy contains the configuration for the upgrade process	{ }	Required: {}

DPUServiceConfigurationStatus

DPUServiceConfigurationStatus defines the observed state of DPUServiceConfiguration

Appears in:

• DPUServiceConfiguration

DPUServiceCredentialRequest

DPUServiceCredentialRequest is the Schema for the dpuserviceCredentialRequests API

Appears in:

• DPUServiceCredentialRequestList

Field	Description	Default	Validation
apiVersion string	svc.dpu.nvidia.com/v1alpha1
kind string	DPUServiceCredentialRequest
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec DPUServiceCredentialRequestSpec
status DPUServiceCredentialRequestStatus

DPUServiceCredentialRequestList

DPUServiceCredentialRequestList contains a list of DPUServiceCredentialRequest

Field	Description	Default	Validation
apiVersion string	svc.dpu.nvidia.com/v1alpha1
kind string	DPUServiceCredentialRequestList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items DPUServiceCredentialRequest array

DPUServiceCredentialRequestSpec

DPUServiceCredentialRequestSpec defines the desired state of DPUServiceCredentialRequest

Appears in:

• DPUServiceCredentialRequest

Field	Description	Default	Validation
serviceAccount NamespacedName	ServiceAccount defines the needed information to create the service account.		Required: {}
duration Duration	Duration is the duration for which the token will be valid. Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration. e.g. "1h", "1m", "1s", "1ms", "1.5h", "2h45m". Value duration must not be less than 10 minutes. Note: The maximum TTL for a token is 24 hours, after which the token will be rotated.		Pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ Type: string Optional: {}
targetCluster NamespacedName	TargetCluster defines the target cluster where the service account will be created, and where a token for that service account will be requested. If not provided, the token will be requested for the same cluster where the DPUServiceCredentialRequest object is created.		Optional: {}
type string	Type is the type of the secret that will be created. The supported types are kubeconfig and tokenFile. If kubeconfig is selected, the secret will contain a kubeconfig file, that can be used to access the cluster. If tokenFile is selected, the secret will contain a token file and several environment variables that can be used to access the cluster. It can be used with https://github.com/kubernetes/client-go/blob/v11.0.0/rest/config.go#L52 to create a client that will handle file rotation.		Enum: [kubeconfig tokenFile] Required: {}
secret NamespacedName	Secret defines the needed information to create the secret. The secret will be of the type specified in the spec.type field.		Required: {}
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.		Optional: {}

DPUServiceCredentialRequestStatus

DPUServiceCredentialRequestStatus defines the observed state of DPUServiceCredentialRequest

Appears in:

• DPUServiceCredentialRequest

Field	Description	Default	Validation
conditions Condition array	Conditions defines current service state.		Optional: {}
serviceAccount string	ServiceAccount is the namespaced name of the ServiceAccount resource created by the controller for the DPUServiceCredentialRequest.
targetCluster string	TargetCluster is the cluster where the service account was created. It has to be persisted in the status to be able to delete the service account when the DPUServiceCredentialRequest is updated.		Optional: {}
targetClusterUID string	TargetClusterUID is the UID of the DPUCluster the credentials were last issued against. Used to detect cluster recreation with the same name and force credential refresh.		Optional: {}
expirationTimestamp Time	ExpirationTimestamp is the time when the token will expire.		Optional: {}
issuedAt Time	IssuedAt is the time when the token was issued.		Optional: {}
secret string	Sercet is the namespaced name of the Secret resource created by the controller for the DPUServiceCredentialRequest.

DPUServiceIPAM

DPUServiceIPAM is the Schema for the dpuserviceipams API

Appears in:

• DPUServiceIPAMList

Field	Description	Default	Validation
apiVersion string	svc.dpu.nvidia.com/v1alpha1
kind string	DPUServiceIPAM
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec DPUServiceIPAMSpec
status DPUServiceIPAMStatus

DPUServiceIPAMList

DPUServiceIPAMList contains a list of DPUServiceIPAM

Field	Description	Default	Validation
apiVersion string	svc.dpu.nvidia.com/v1alpha1
kind string	DPUServiceIPAMList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items DPUServiceIPAM array

DPUServiceIPAMSpec

DPUServiceIPAMSpec defines the desired state of DPUServiceIPAM

Appears in:

• DPUServiceIPAM

Field	Description	Default	Validation
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
ipv4Network IPV4Network	IPV4Network is the configuration related to splitting a network into subnets per node, each with their own gateway.
ipv4Subnet IPV4Subnet	IPV4Subnet is the configuration related to splitting a subnet into blocks per node. In this setup, there is a single gateway.
clusterSelector LabelSelector	ClusterSelector determines in which clusters the DPUServiceIPAM controller should apply the configuration. Deprecated: This field is deprecated and will be removed with v26.7.0. Use DPUClusterSelector instead.		Optional: {}
dpuClusterSelector LabelSelector	DPUClusterSelector determines in which clusters the DPUServiceIPAM controller should apply the configuration.		Optional: {}
nodeSelector NodeSelector	NodeSelector determines in which DPU nodes the DPUServiceIPAM controller should apply the configuration.

DPUServiceIPAMStatus

DPUServiceIPAMStatus defines the observed state of DPUServiceIPAM

Appears in:

• DPUServiceIPAM

Field	Description	Default	Validation
conditions Condition array	Conditions reflect the status of the object
observedGeneration integer	ObservedGeneration records the Generation observed on the object the last time it was patched.
dpuClusterAllocations DPUClusterAllocation array	DPUClusterAllocations contains the IPV4Network/IPV4Subnet allocations per DPUCluster as calculated by the controller.		Optional: {}

DPUServiceInterface

DPUServiceInterface is the Schema for the DPUServiceInterface API

Appears in:

• DPUServiceInterfaceList

Field	Description	Default	Validation
apiVersion string	svc.dpu.nvidia.com/v1alpha1
kind string	DPUServiceInterface
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec DPUServiceInterfaceSpec
status DPUServiceInterfaceStatus

DPUServiceInterfaceList

DPUServiceInterfaceList contains a list of DPUServiceInterface

Field	Description	Default	Validation
apiVersion string	svc.dpu.nvidia.com/v1alpha1
kind string	DPUServiceInterfaceList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items DPUServiceInterface array

DPUServiceInterfaceSpec

DPUServiceInterfaceSpec defines the desired state of DPUServiceInterfaceSpec

Appears in:

• DPUServiceInterface

Field	Description	Default	Validation
clusterSelector LabelSelector	Select the Clusters with specific labels, ServiceInterfaceSet CRs will be created only for these Clusters Deprecated: This field is deprecated and will be removed with v26.7.0. Use DPUClusterSelector instead.		Optional: {}
dpuClusterSelector LabelSelector	DPUClusterSelector determines in which clusters the DPUServiceInterface controller should apply the configuration.		Optional: {}
template ServiceInterfaceSetSpecTemplate	Template describes the ServiceInterfaceSet that will be created for each selected Cluster.

DPUServiceInterfaceStatus

DPUServiceInterfaceStatus defines the observed state of DPUServiceInterface

Appears in:

• DPUServiceInterface

Field	Description	Default	Validation
conditions Condition array	Conditions defines current service state.
observedGeneration integer	ObservedGeneration records the Generation observed on the object the last time it was patched.

DPUServiceList

DPUServiceList contains a list of DPUService

Field	Description	Default	Validation
apiVersion string	svc.dpu.nvidia.com/v1alpha1
kind string	DPUServiceList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items DPUService array

DPUServiceNAD

DPUServiceNAD is the Schema for the dpuservicenads API.

Appears in:

• DPUServiceNADList

Field	Description	Default	Validation
apiVersion string	svc.dpu.nvidia.com/v1alpha1
kind string	DPUServiceNAD
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec DPUServiceNADSpec
status DPUServiceNADStatus

DPUServiceNADList

DPUServiceNADList contains a list of DPUServiceNAD.

Field	Description	Default	Validation
apiVersion string	svc.dpu.nvidia.com/v1alpha1
kind string	DPUServiceNADList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items DPUServiceNAD array

DPUServiceNADSpec

DPUServiceNADSpec defines the desired state of DPUServiceNAD.

Appears in:

• DPUServiceNAD

Field	Description	Default	Validation
dpuClusterSelector LabelSelector	DPUClusterSelector determines in which clusters the DPUServiceNAD controller should apply the configuration.		Optional: {}
resourceType string	ResourceType specifies the type of network resource to allocate for pods using this NAD. - "vf": Virtual Function (SR-IOV VF) from the DPU's physical ports - "sf": Scalable Function from the DPU (maps to nvidia.com/bf_sf or nvidia.com/bf_sf_trusted) - "veth": Virtual Ethernet pair (no device plugin resource required) The resource type determines which SR-IOV device plugin resource will be requested.		Enum: [vf sf veth] Required: {}
bridge string	Bridge specifies the name of the OVS bridge to which the network interface will be connected. This bridge name is used in the CNI configuration for the OVS plugin.		Optional: {}
serviceMTU integer	ServiceMTU specifies the MTU size in bytes for the network interface. This value is passed to the OVS CNI plugin and determines the maximum packet size. If there is a DPUServiceChain that references an interface that is part of this network, then the MTU that is defined in the DPUServiceChain takes precedence. The default is 1500.	1500	Maximum: 9216 Minimum: 1280 Optional: {}
ipam boolean	IPAM enables IP Address Management for the network interfaces attached to this network When set to true, a DPUServiceChain that references the DPUServiceInterface that has requested this network must be created and include the relevant IPAM information. See DPUServiceChain documentation for more. When set to false, the network interfaces attached to this network will not get an IP		Optional: {}
chainedCNIs CNIPlugin array	ChainedCNIs specifies additional CNI plugins to be chained after the base OVS plugin. When specified, the NAD will use the CNI chaining format with the OVS plugin as the first plugin, followed by the plugins defined in this list. This allows adding capabilities like RDMA support on top of the base network interface. If empty, the NAD uses a single OVS plugin configuration (backward compatible format).		Optional: {}

DPUServiceNADStatus

DPUServiceNADStatus defines the observed state of DPUServiceNAD.

Appears in:

• DPUServiceNAD

Field	Description	Default	Validation
conditions Condition array	Conditions reflect the status of the object

DPUServiceSecurity

DPUServiceSecurity contains security-related settings for a DPUService or DPUServiceTemplate.

Appears in:

• DPUServiceSpec
• DPUServiceTemplateSpec

Field	Description	Default	Validation
privileged boolean	Privileged, when set to true, allows workloads governed by this security setting to run containers with securityContext.privileged: true in the DPUCluster. When set to false, a ValidatingAdmissionPolicy in the DPUCluster rejects such workloads. On DPUService objects, this field must be unset when deployInCluster is true. For DPUServices that target a DPUCluster, Privileged must be set explicitly. When set on a DPUServiceTemplate, the DPUDeployment controller propagates the value to generated DPUServices that target DPUClusters. Scope of the policy enforcement: - Only securityContext.privileged: true is gated. Other privilege-escalation vectors (hostPID, hostIPC, hostNetwork, allowPrivilegeEscalation, capabilities, hostPath volumes) are NOT gated by this field. - Enforcement matches workloads via the svc.dpu.nvidia.com/service label. The controller adds this label to the resources it manages, and to pod templates of workload-controller resources (Deployment, DaemonSet, etc.). If a Helm chart strips that label from the pod template, the parent resource will be admitted but the child Pods will be denied at Pod admission time.		Optional: {}

DPUServiceSpec

DPUServiceSpec defines the desired state of DPUService

Appears in:

• DPUService

Field	Description	Default	Validation
dpuClusterSelector LabelSelector	Select the Clusters with specific labels, Applications will be created only for these Clusters		Optional: {}
helmChart HelmChart	HelmChart reflects the Helm related configuration		Required: {}
serviceID string	ServiceID is the ID of the service that the DPUService is associated with.		Optional: {}
serviceDaemonSet ServiceDaemonSetValues	ServiceDaemonSet specifies the configuration for the ServiceDaemonSet.		Optional: {}
deployInCluster boolean	DeployInCluster indicates if the DPUService Helm Chart will be deployed on the Host cluster. Default to false.		Optional: {}
interfaces string array	Interfaces specifies the DPUServiceInterface names that the DPUService uses in the same namespace.		MaxItems: 50 MinItems: 1 Optional: {}
paused boolean	Paused indicates that the DPUService is paused. Underlying resources are also paused when this is set to true. No deletion of resources will occur when this is set to true.		Optional: {}
configPorts ConfigPorts	ConfigPorts defines the desired state of port configurations for a DPUService. This struct determines how ports are exposed from the DPU to the host cluster. A DPUService can only have a single ServiceType across all ports.		Optional: {}
security DPUServiceSecurity	Security contains security-related settings for the DPUService.		Optional: {}

DPUServiceStatus

DPUServiceStatus defines the observed state of DPUService

Appears in:

• DPUService

Field	Description	Default	Validation
conditions Condition array	Conditions defines current service state.		Optional: {}
observedGeneration integer	ObservedGeneration records the Generation observed on the object the last time it was patched.		Optional: {}
configPorts object (keys:string, values:ConfigPort)	ConfigPorts defines the observed state of the config ports. It contains the actual port numbers that are exposed on the DPUService per cluster.		Optional: {}
serviceID string	ServiceID is the ID of the service that the DPUService is associated with. This is set when the DPUService is created.		Optional: {}

DPUServiceTemplate

DPUServiceTemplate is the Schema for the DPUServiceTemplate API. This object is intended to be used in conjunction with a DPUDeployment object. This object is the template from which the DPUService will be created. It contains configuration options related to resources required by the service to be deployed. The rest of the configuration options must be defined in a DPUServiceConfiguration object.

Appears in:

• DPUServiceTemplateList

Field	Description	Default	Validation
apiVersion string	svc.dpu.nvidia.com/v1alpha1
kind string	DPUServiceTemplate
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec DPUServiceTemplateSpec
status DPUServiceTemplateStatus

DPUServiceTemplateList

DPUServiceTemplateList contains a list of DPUServiceTemplate

Field	Description	Default	Validation
apiVersion string	svc.dpu.nvidia.com/v1alpha1
kind string	DPUServiceTemplateList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items DPUServiceTemplate array

DPUServiceTemplateSpec

DPUServiceTemplateSpec defines the desired state of DPUServiceTemplate

Appears in:

• DPUServiceTemplate

Field	Description	Default	Validation
deploymentServiceName string	DeploymentServiceName is the name of the DPU service this configuration refers to. It must match .spec.deploymentServiceName of a DPUServiceConfiguration object and one of the keys in .spec.services of a DPUDeployment object.		MaxLength: 28 MinLength: 1 Required: {}
helmChart HelmChart	HelmChart reflects the Helm related configuration. The user is supposed to configure the values that are static across any DPUServiceConfiguration used with this DPUServiceTemplate in a DPUDeployment. These values act as a baseline and are merged with values specified in the DPUServiceConfiguration. In case of conflict, the DPUServiceConfiguration values take precedence.		Required: {}
resourceRequirements ResourceList	ResourceRequirements contains the overall resources required by this particular service to run on a single node		Optional: {}
security DPUServiceSecurity	Security contains security-related settings for the generated DPUService. These settings are inherent to the service and apply to all deployments using this template. Specifically, Privileged should be set on charts that need privileged containers (e.g. for direct hardware access).		Optional: {}

DPUServiceTemplateStatus

DPUServiceTemplateStatus defines the observed state of DPUServiceTemplate

Appears in:

• DPUServiceTemplate

Field	Description	Default	Validation
conditions Condition array	Conditions reflect the status of the object		Optional: {}
observedGeneration integer	ObservedGeneration records the Generation observed on the object the last time it was patched.		Optional: {}
versions object (keys:string, values:string)	Versions reflects the required versions the generated DPUService needs in order to function correctly.		Optional: {}

DPUSet

DPUSet contains configuration for the DPUSet to be created by the DPUDeployment

Appears in:

• DPUs

Field	Description	Default	Validation
nameSuffix string	NameSuffix is the suffix to be added to the name of the DPUSet object created by the DPUDeployment.		MaxLength: 24 MinLength: 1 Required: {}
nodeSelector LabelSelector	NodeSelector defines the nodes that the DPUSet should target Deprecated: This field is deprecated and will be removed with v26.7.0. Use DPUNodeSelector instead.		Optional: {}
dpuSelector object (keys:string, values:string)	DPUSelector defines the DPUs that the DPUSet should target Deprecated: This field is deprecated and will be removed with v26.7.0. Use DPUDeviceSelector instead.		Optional: {}
dpuNodeSelector LabelSelector	DPUNodeSelector defines the selector for DPUNodes that the DPUSet should target and should create a DPU for.		Optional: {}
dpuDeviceSelector LabelSelector	DPUDeviceSelector defines the selector for DPUDevices that the DPUSet should target and should create a DPU for.		Optional: {}
dpuClusterSelector object (keys:string, values:string)	DPUClusterSelector defines the selector for DPUClusters that the DPUs created by the DPUSets created by the DPUDeployment should join require multiple DPUServices, DPUServiceInterfaces, and DPUServiceChains to be created so that we can mathematically cover the union of all the selectors across all the DPUSets.		Optional: {}
dpuAnnotations object (keys:string, values:string)	DPUAnnotations is the annotations to be added to the DPU object created by the DPUSet.		MaxProperties: 50 Optional: {}

DPUs

DPUs contains the DPU related configuration

Appears in:

• DPUDeploymentSpec

Field	Description	Default	Validation
bfb string	BFB is the name of the BFB object to be used in this DPUDeployment. It must be in the same namespace as the DPUDeployment.		MinLength: 1 Optional: {}
blueFieldSoftware string	BlueFieldSoftware is the name of the BlueFieldSoftware object to be used in this DPUDeployment. It must be in the same namespace as the DPUDeployment.		MinLength: 1 Optional: {}
flavor string	Flavor is the name of the DPUFlavor object to be used in this DPUDeployment. It must be in the same namespace as the DPUDeployment. Exactly one of flavor or flavorTemplate must be set (mutually exclusive).		MinLength: 1 Optional: {}
flavorTemplate string	FlavorTemplate is the name of the DPUFlavorTemplate object to be rendered per-DPU (against each DPUDevice.spec.values) into a generated DPUFlavor. It must be in the same namespace as the DPUDeployment. Exactly one of flavor or flavorTemplate must be set (mutually exclusive).		MinLength: 1 Optional: {}
astraEnabled boolean	AstraEnabled indicates whether E/W NIC configuration (Astra) is enabled		Optional: {}
dpuSets DPUSet array	DPUSets contains configuration for each DPUSet that is going to be created by the DPUDeployment		MaxItems: 50 MinItems: 1 Optional: {}
nodeEffect Action	NodeEffect is the effect the DPU has on Nodes during provisioning.		Required: {}
dpuSetStrategy DPUSetStrategy	DPUSetStrategy is the strategy to use for the DPUSets created by the DPUDeployment.		Required: {}
secureBoot boolean	SecureBoot specifies whether UEFI Secure Boot should be enabled.		Optional: {}

HelmChart

HelmChart reflects the helm related configuration

Appears in:

• DPUServiceSpec
• DPUServiceTemplateSpec

Field	Description	Default	Validation
source ApplicationSource	Source specifies information about the Helm chart		Required: {}
values RawExtension	Values specifies Helm values to be passed to Helm template, defined as a map. This takes precedence over Values.		Optional: {}

IPRange

Appears in:

• DPUClusterAllocation
• IPV4Network
• IPV4Subnet

Field	Description	Default	Validation
startIP string	StartIP is the start of the range.		Required: {}
endIP string	EndIP is the end of the range.		Required: {}

IPV4Network

IPV4Network describes the configuration relevant to splitting a network into subnet per node (i.e. different gateway and broadcast IP per node).

Appears in:

• DPUServiceIPAMSpec

Field	Description	Default	Validation
network string	Network is the CIDR from which subnets should be allocated per node.
gatewayIndex integer	GatewayIndex determines which IP in the subnet extracted from the CIDR should be the gateway IP. For point to point networks (/31), one needs to leave this empty to make use of both the IPs.
prefixSize integer	PrefixSize is the size of the subnet that should be allocated per node.
exclusions string array	Exclusions is a list of IPs that should be excluded when splitting the CIDR into subnets per node. Deprecated: This field is deprecated and will be removed with v26.10.0. Use ExcludeRanges instead.
excludeRanges IPRange array	ExcludeRanges is a list of IP ranges that should be excluded from the allocation. startIP and endIP are part of the Excluded range.
allocations object (keys:string, values:string)	Allocations describes the subnets that should be assigned in each DPU node.
defaultGateway boolean	DefaultGateway adds gateway as default gateway in the routes list if true.
routes Route array	Routes is the static routes list using the gateway specified in the spec.
subnetsPerDPUCluster integer	SubnetsPerDPUCluster is the number of PrefixSize-sized subnets each DPUCluster should receive. When specified, the controller will take care of assigning non-overlapping subnets part of the Network in each DPUCluster that the DPUServiceIPAM is targeting. Leave empty in case you want the whole Network to be consumed by a single DPUCluster.		Optional: {}

IPV4Subnet

IPV4Subnet describes the configuration relevant to splitting a subnet to a subnet block per node (i.e. same gateway and broadcast IP across all nodes).

Appears in:

• DPUServiceIPAMSpec

Field	Description	Default	Validation
subnet string	Subnet is the CIDR from which blocks should be allocated per node
gateway string	Gateway is the IP in the subnet that should be the gateway of the subnet.
perNodeIPCount integer	PerNodeIPCount is the number of IPs that should be allocated per node.
excludeRanges IPRange array	ExcludeRanges is a list of IP ranges that should be excluded from the allocation. startIP and endIP are part of the Excluded range.
defaultGateway boolean	if true, add gateway as default gateway in the routes list DefaultGateway adds gateway as default gateway in the routes list if true.
routes Route array	Routes is the static routes list using the gateway specified in the spec.
blocksPerDPUCluster integer	BlocksPerDPUCluster is the number of PerNodeIPCount-sized blocks each DPUCluster should receive. When specified, the controller will take care of assigning non-overlapping IP blocks part of the Subnet in each DPUCluster that the DPUServiceIPAM is targeting. Leave empty in case you want the whole Subnet to be consumed by a single DPUCluster.		Optional: {}

InterfaceEntry

InterfaceEntry defines a single service interface entry within a NodeServiceInterfaces object.

Appears in:

• NodeServiceInterfacesSpec

Field	Description	Default	Validation
name string	Name uniquely identifies this entry within the NodeServiceInterfaces object. Format: <namespace>_<service-interface-set-name>. The underscore separator is collision-free because Kubernetes namespace and resource names follow DNS subdomain rules and can never contain an underscore. Both components are bounded to 63 chars, so the full name is at most 127 chars.		MaxLength: 253 MinLength: 1 Required: {}
terminating boolean	Terminating indicates this entry is marked for removal. Cleanup may require one or more reconcilers. ResourceReleased=True is set only after all required cleanup conditions are satisfied in status.
labels object (keys:string, values:string)	Labels used for ServiceChain matchLabels resolution.		MaxProperties: 50 Optional: {}
annotations object (keys:string, values:string)	Annotations carry operational metadata for this entry.		MaxProperties: 50 Optional: {}
interfaceType string	InterfaceType is the type of the interface.		Enum: [vlan physical pf vf ovn patch service] Required: {}
physical Physical	Physical is the physical interface definition.		Optional: {}
vlan VLAN	Vlan is the VLAN definition.		Optional: {}
vf VF	VF is the VF definition.		Optional: {}
pf PF	PF is the PF definition.		Optional: {}
service ServiceDef	Service is the service definition.		Optional: {}
ovn OVN	OVN is the OVN definition.		Optional: {}
patch PatchDef	Patch is the patch definition.		Optional: {}

InterfaceEntryStatus

InterfaceEntryStatus records reconciliation state for a single interface entry.

Appears in:

• NodeServiceInterfacesStatus

Field	Description	Default	Validation
name string	Name matches the spec entry name.		MinLength: 1 Required: {}
params object (keys:string, values:string)	Params carries controller-specific information for handling reconcile/release of the matching InterfaceEntry in spec. Multiple reconcilers may write distinct keys safely as long as they do not share keys.		Optional: {}
conditions Condition array	Conditions may be written by multiple reconcilers for the same entry.		Optional: {}

LocalObjectDependency

LocalObjectDependency is a list of local object dependencies that are required for this Service. The object must be part of the dpuDeployment spec.services list.

Appears in:

• DPUDeploymentServiceConfiguration

Field	Description	Default	Validation
name string	Name is the name of the object		Required: {}

NICSelectorSpec

NICSelectorSpec defines how a NIC is selected

Appears in:

• PF
• VF

Field	Description	Default	Validation
type NICSelectorType	Type is the type of selector to be used to identify the NIC.		Enum: [dpu pci] Required: {}
pci PCISelector	PCI is the PCI selector. valid only for selector type pci		Optional: {}
controllerNumber integer	ControllerNumber specifies the controller number that will be used to find the matching representor on the DPU. A value of 0 targets the local controller, >=1 targets external controllers with the specified number. If unspecified controller number 1 is used. In case of a DPU/NIC with socket direct or MultiHost, the user should specify the controller number explicitly		Maximum: 255 Minimum: 0 Optional: {}

NICSelectorType

Underlying type: string

NICSelectorType is the type of NIC selector

Appears in:

• NICSelectorSpec

Field	Description
dpu	NICSelectorTypeDPU selects the DPU NIC
pci	NICSelectorTypePCI selects NIC according to the provided PCI address of one of the NIC's Embedded CPU PFs (ECPFs)

NamespacedName

NamespacedName contains enough information to locate the referenced Kubernetes resource object in any namespace.

Appears in:

• DPUServiceCredentialRequestSpec

Field	Description	Default	Validation
name string	Name of the object.		Required: {}
namespace string	Namespace of the object, if not provided the object will be looked up in the same namespace as the referring object		Optional: {}

NodeServiceInterfaces

NodeServiceInterfaces is the Schema for the nodeserviceinterfaces API.

Appears in:

• NodeServiceInterfacesList

Field	Description	Default	Validation
apiVersion string	svc.dpu.nvidia.com/v1alpha1
kind string	NodeServiceInterfaces
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec NodeServiceInterfacesSpec
status NodeServiceInterfacesStatus

NodeServiceInterfacesList

NodeServiceInterfacesList contains a list of NodeServiceInterfaces

Field	Description	Default	Validation
apiVersion string	svc.dpu.nvidia.com/v1alpha1
kind string	NodeServiceInterfacesList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items NodeServiceInterfaces array

NodeServiceInterfacesSpec

NodeServiceInterfacesSpec defines the desired state of NodeServiceInterfaces.

Appears in:

• NodeServiceInterfaces

Field	Description	Default	Validation
node string	Node is the name of the DPU node this object represents.		MaxLength: 253 MinLength: 1 Required: {}
type string	Type identifies which controller domain owns this NSI shard. Examples: "sfc", "vpc-my-provisioner".		MaxLength: 253 MinLength: 1 Required: {}
interfaces InterfaceEntry array	Interfaces is the list of service interface entries for this node.		MaxItems: 256 Optional: {}

NodeServiceInterfacesStatus

NodeServiceInterfacesStatus defines the observed state of NodeServiceInterfaces.

Appears in:

• NodeServiceInterfaces

Field	Description	Default	Validation
conditions Condition array	Conditions reflect aggregate status.		Optional: {}
observedGeneration integer	ObservedGeneration is the last observed generation of the NodeServiceInterfaces object.		Optional: {}
interfaceStatuses InterfaceEntryStatus array	InterfaceStatuses tracks per-entry reconciliation state. Written by the managing controller. The params map carries controller-specific release information needed during terminating/release handling.		Optional: {}

OVN

OVN defines the configuration for OVN interface type

Appears in:

• InterfaceEntry
• ServiceInterfaceSpec

Field	Description	Default	Validation
externalBridge string	ExternalBridge is the name of the OVN bridge	br-ovn	Optional: {}

ObjectMeta

ObjectMeta holds metadata like labels and annotations.

Appears in:

• DPUServiceCredentialRequestSpec
• DPUServiceIPAMSpec
• ServiceChainSetSpecTemplate
• ServiceChainSpecTemplate
• ServiceInterfaceSetSpecTemplate
• ServiceInterfaceSpecTemplate

Field	Description	Default	Validation
labels object (keys:string, values:string)	Labels is a map of string keys and values.		Optional: {}
annotations object (keys:string, values:string)	Annotations is a map of string keys and values.		Optional: {}

PCISelector

Underlying type: struct{Address string "json:"address,omitzero""}

PCISelector selects NIC by PCI address

Appears in:

• NICSelectorSpec

PF

PF defines the PF configuration

Appears in:

• InterfaceEntry
• ServiceInterfaceSpec

Field	Description	Default	Validation
nicSelector NICSelectorSpec	NICSelector defines the NIC selected for the PF interface		Optional: {}
pfID integer	The PF ID		Maximum: 255 Minimum: 0 Required: {}
virtualNetwork string	VirtualNetwork is the VirtualNetwork name in the same namespace		Optional: {}

PatchDef

PatchDef defines the configuration for Patch interface type

Appears in:

• InterfaceEntry
• ServiceInterfaceSpec

Field	Description	Default	Validation
peerBridge string	PeerBridge is the name of the bridge to which the patch port is connected. This bridge must be created before the ServiceInterface is created.		Required: {}
peerPatchName string	PeerPatchName is the name of the patch port on the peer bridge. If not set, it is auto-generated in the format: p_<bridgeA>_to_<bridgeB>_<hash> where bridge names have hyphens removed and <hash> is an 8-character FNV-1a hash derived from the ServiceInterface's namespace/name. Example: p_brovn_to_brsfc_7aea60f7 (for bridges br-ovn and br-sfc).		Optional: {}
peerExternalIDs object (keys:string, values:string)	PeerExternalIDs are the external IDs used to identify the peer patch port.		Optional: {}

Physical

Physical Identifies a physical interface

Appears in:

• InterfaceEntry
• ServiceInterfaceSpec

Field	Description	Default	Validation
interfaceName string	The interface name		Required: {}

Port

Port defines the port configuration

Appears in:

• Switch

Field	Description	Default	Validation
serviceInterface ServiceIfc			Required: {}

Route

Route contains static route parameters

Appears in:

• IPV4Network
• IPV4Subnet

Field	Description	Default	Validation
dst string	The destination of the route, in CIDR notation

ServiceChain

ServiceChain is the Schema for the servicechains API

Appears in:

• ServiceChainList

Field	Description	Default	Validation
apiVersion string	svc.dpu.nvidia.com/v1alpha1
kind string	ServiceChain
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec ServiceChainSpec
status ServiceChainStatus

ServiceChainList

ServiceChainList contains a list of ServiceChain

Field	Description	Default	Validation
apiVersion string	svc.dpu.nvidia.com/v1alpha1
kind string	ServiceChainList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items ServiceChain array

ServiceChainSet

ServiceChainSet is the Schema for the servicechainsets API

Appears in:

• ServiceChainSetList

Field	Description	Default	Validation
apiVersion string	svc.dpu.nvidia.com/v1alpha1
kind string	ServiceChainSet
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec ServiceChainSetSpec
status ServiceChainSetStatus

ServiceChainSetList

ServiceChainSetList contains a list of ServiceChainSet

Field	Description	Default	Validation
apiVersion string	svc.dpu.nvidia.com/v1alpha1
kind string	ServiceChainSetList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items ServiceChainSet array

ServiceChainSetSpec

ServiceChainSetSpec defines the desired state of ServiceChainSet

Appears in:

• ServiceChainSet
• ServiceChainSetSpecTemplate

Field	Description	Default	Validation
nodeSelector LabelSelector	Select the Nodes with specific labels, ServiceChain CRs will be created only for these Nodes		Optional: {}
template ServiceChainSpecTemplate	ServiceChainSpecTemplate holds the template for the ServiceChainSpec		Required: {}

ServiceChainSetSpecTemplate

ServiceChainSetSpecTemplate describes the data a ServiceChainSet should have when created from a template.

Appears in:

• DPUServiceChainSpec

Field	Description	Default	Validation
spec ServiceChainSetSpec
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.

ServiceChainSetStatus

ServiceChainSetStatus defines the observed state of ServiceChainSet

Appears in:

• ServiceChainSet

Field	Description	Default	Validation
conditions Condition array	Conditions reflect the status of the object
observedGeneration integer	ObservedGeneration records the Generation observed on the object the last time it was patched.
numberApplied integer	The number of nodes where the service chain is applied and is supposed to be applied.
numberReady integer	The number of nodes where the service chain is applied and ready.

ServiceChainSpec

ServiceChainSpec defines the desired state of ServiceChain

Appears in:

• ServiceChain
• ServiceChainSpecTemplate

Field	Description	Default	Validation
node string	Node where this ServiceChain applies to		Optional: {}
switches Switch array	The switches of the ServiceChain, order is significant		MaxItems: 50 MinItems: 1 Required: {}

ServiceChainSpecTemplate

ServiceChainSpecTemplate defines the template from which ServiceChainSpecs are created

Appears in:

• ServiceChainSetSpec

Field	Description	Default	Validation
spec ServiceChainSpec	ServiceChainSpec is the spec for the ServiceChainSpec		Required: {}
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.		Optional: {}

ServiceChainStatus

ServiceChainStatus defines the observed state of ServiceChain

Appears in:

• ServiceChain

Field	Description	Default	Validation
conditions Condition array	Conditions reflect the status of the object
observedGeneration integer	ObservedGeneration records the Generation observed on the object the last time it was patched.

ServiceChains

Appears in:

• DPUDeploymentSpec

Field	Description	Default	Validation
upgradePolicy UpgradePolicy	UpgradePolicy contains the configuration for the upgrade process	{ }	Required: {}
switches DPUDeploymentSwitch array	Switches is the list of switches that form the service chain		MaxItems: 50 MinItems: 1 Required: {}

ServiceConfiguration

ServiceConfiguration contains fields that are configured on the generated DPUService.

Appears in:

• DPUServiceConfigurationSpec

Field	Description	Default	Validation
helmChart ServiceConfigurationHelmChart	HelmChart reflects the Helm related configuration. The user is supposed to configure values specific to that DPUServiceConfiguration used in a DPUDeployment and should not specify values that could be shared across multiple DPUDeployments using different DPUServiceConfigurations. These values are merged with values specified in the DPUServiceTemplate. In case of conflict, the DPUServiceConfiguration values take precedence.		Optional: {}
serviceDaemonSet DPUServiceConfigurationServiceDaemonSetValues	ServiceDaemonSet contains settings related to the underlying DaemonSet that is part of the Helm chart		Optional: {}
deployInCluster boolean	DeployInCluster indicates if the DPUService Helm Chart will be deployed on the Host cluster. Default to false.		Optional: {}
configPorts ConfigPorts	ConfigPorts defines the desired state of port configurations for a DPUService. This struct determines how ports are exposed from the DPU to the host cluster. A DPUService can only have a single ServiceType across all ports.		Optional: {}

ServiceConfigurationHelmChart

ServiceConfigurationHelmChart reflects the helm related configuration

Appears in:

• ServiceConfiguration

Field	Description	Default	Validation
values RawExtension	Values specifies Helm values to be passed to Helm template, defined as a map. This takes precedence over Values.		Optional: {}

ServiceDaemonSetValues

ServiceDaemonSetValues specifies the configuration for the ServiceDaemonSet.

Appears in:

• DPUServiceSpec

Field	Description	Default	Validation
nodeSelector NodeSelector	NodeSelector specifies which Nodes to deploy the ServiceDaemonSet to.		Optional: {}
updateStrategy DaemonSetUpdateStrategy	UpdateStrategy specifies the DeaemonSet update strategy for the ServiceDaemonset.		Optional: {}
labels object (keys:string, values:string)	Labels specifies labels which are added to the ServiceDaemonSet.		Optional: {}
annotations object (keys:string, values:string)	Annotations specifies annotations which are added to the ServiceDaemonSet.		Optional: {}
resources ResourceList	Resources specifies resources which are added to the ServiceDaemonSet.		Optional: {}

ServiceDef

ServiceDef Identifies the service and network for the ServiceInterface

Appears in:

• InterfaceEntry
• ServiceInterfaceSpec

Field	Description	Default	Validation
serviceID string	ServiceID is the DPU Service Identifier		Required: {}
network string	Network is the Network Attachment Definition in the form of "namespace/name" or just "name" if the namespace is the same as the ServiceInterface.		Required: {}
interfaceName string	The interface name		MaxLength: 15 MinLength: 1 Required: {}
virtualNetwork string	VirtualNetwork is the VirtualNetwork name in the same namespace		Optional: {}

ServiceIfc

ServiceIfc defines the service interface configuration

Appears in:

• DPUDeploymentPort
• Port

Field	Description	Default	Validation
matchLabels object (keys:string, values:string)	Labels matching service interface		MaxProperties: 50 MinProperties: 1 Required: {}
ipam IPAM	IPAM defines the IPAM configuration when referencing a serviceInterface of type 'service'		Optional: {}

ServiceInterface

ServiceInterface is the Schema for the serviceinterfaces API

Appears in:

• ServiceInterfaceList

Field	Description	Default	Validation
apiVersion string	svc.dpu.nvidia.com/v1alpha1
kind string	ServiceInterface
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec ServiceInterfaceSpec
status ServiceInterfaceStatus

ServiceInterfaceList

ServiceInterfaceList contains a list of ServiceInterface

Field	Description	Default	Validation
apiVersion string	svc.dpu.nvidia.com/v1alpha1
kind string	ServiceInterfaceList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items ServiceInterface array

ServiceInterfaceSet

ServiceInterfaceSet is the Schema for the serviceinterfacesets API

Appears in:

• ServiceInterfaceSetList

Field	Description	Default	Validation
apiVersion string	svc.dpu.nvidia.com/v1alpha1
kind string	ServiceInterfaceSet
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec ServiceInterfaceSetSpec
status ServiceInterfaceSetStatus

ServiceInterfaceSetList

ServiceInterfaceSetList contains a list of ServiceInterfaceSet

Field	Description	Default	Validation
apiVersion string	svc.dpu.nvidia.com/v1alpha1
kind string	ServiceInterfaceSetList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items ServiceInterfaceSet array

ServiceInterfaceSetSpec

ServiceInterfaceSetSpec defines the desired state of ServiceInterfaceSet

Appears in:

• ServiceInterfaceSet
• ServiceInterfaceSetSpecTemplate

Field	Description	Default	Validation
nodeSelector LabelSelector	Select the Nodes with specific labels, ServiceInterface CRs will be created only for these Nodes		Optional: {}
template ServiceInterfaceSpecTemplate	Template holds the template for the serviceInterfaceSpec		Required: {}

ServiceInterfaceSetSpecTemplate

ServiceInterfaceSetSpecTemplate describes the data a ServiceInterfaceSet should have when created from a template.

Appears in:

• DPUServiceInterfaceSpec

Field	Description	Default	Validation
spec ServiceInterfaceSetSpec
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.

ServiceInterfaceSetStatus

ServiceInterfaceSetStatus defines the observed state of ServiceInterfaceSet

Appears in:

• ServiceInterfaceSet

Field	Description	Default	Validation
conditions Condition array	Conditions reflect the status of the object
observedGeneration integer	ObservedGeneration records the Generation observed on the object the last time it was patched.
numberApplied integer	The number of nodes where the service chain is applied and is supposed to be applied.
numberReady integer	The number of nodes where the service chain is applied and ready.

ServiceInterfaceSpec

ServiceInterfaceSpec defines the desired state of ServiceInterface

Appears in:

• ServiceInterface
• ServiceInterfaceSpecTemplate

Field	Description	Default	Validation
node string	Node where this interface exists		Optional: {}
interfaceType string	The interface type ("vlan", "physical", "pf", "vf", "ovn", "patch", "service")		Enum: [vlan physical pf vf ovn patch service] Required: {}
physical Physical	The physical interface definition		Optional: {}
vlan VLAN	The VLAN definition		Optional: {}
vf VF	The VF definition		Optional: {}
pf PF	The PF definition		Optional: {}
service ServiceDef	The Service definition		Optional: {}
ovn OVN	The OVN definition Deprecated: This field is deprecated and will be removed with v26.10.0. Migrate to interfaceType="patch" with spec.patch.peerBridge and spec.patch.peerPatchName instead.		Optional: {}
patch PatchDef	The Patch definition		Optional: {}

ServiceInterfaceSpecTemplate

ServiceInterfaceSpecTemplate defines the template from which ServiceInterfaceSpecs are created

Appears in:

• ServiceInterfaceSetSpec

Field	Description	Default	Validation
spec ServiceInterfaceSpec	ServiceInterfaceSpec is the spec for the ServiceInterfaceSpec		Required: {}
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.		Optional: {}

ServiceInterfaceStatus

ServiceInterfaceStatus defines the observed state of ServiceInterface

Appears in:

• ServiceInterface

Field	Description	Default	Validation
conditions Condition array	Conditions reflect the status of the object
observedGeneration integer	ObservedGeneration records the Generation observed on the object the last time it was patched.

ServiceInterfaceTemplate

ServiceInterfaceTemplate contains the information related to an interface of the DPUService

Appears in:

• DPUServiceConfigurationSpec

Field	Description	Default	Validation
name string	Name is the name of the interface		MaxLength: 15 MinLength: 1 Required: {}
network string	Network is the Network Attachment Definition in the form of "namespace/name" or just "name" if the namespace is the same as the namespace the pod is running.		Required: {}
virtualNetwork string	VirtualNetwork is the VirtualNetwork name in the same namespace		Optional: {}

Switch

Switch defines the switch configuration

Appears in:

• ServiceChainSpec

Field	Description	Default	Validation
ports Port array	Ports of the switch		MaxItems: 50 MinItems: 1 Required: {}
serviceMTU integer	ServiceMTU of the switch The default is 1500.	1500	Maximum: 9216 Minimum: 1280 Optional: {}

UpgradePolicy

Appears in:

• DPUServiceConfigurationSpec
• ServiceChains

Field	Description	Default	Validation
applyNodeEffect boolean	ApplyNodeEffect specifies if the node effect should be applied during the upgrade. It signals the reconciler that this object upgrade is disruptive. Hence a new revision of the object should be created and node effect should be applied.	true	Optional: {}

VF

VF defines the VF configuration

Appears in:

• InterfaceEntry
• ServiceInterfaceSpec

Field	Description	Default	Validation
nicSelector NICSelectorSpec	NICSelector defines the NIC selected for the VF interface		Optional: {}
vfID integer	The VF ID		Maximum: 255 Minimum: 0 Required: {}
pfID integer	The PF ID		Maximum: 255 Minimum: 0 Required: {}
parentInterfaceRef string	The parent interface reference		Optional: {}
virtualNetwork string	VirtualNetwork is the VirtualNetwork name in the same namespace		Optional: {}

VLAN

VLAN defines the VLAN configuration

Appears in:

• InterfaceEntry
• ServiceInterfaceSpec

Field	Description	Default	Validation
vlanID integer	The VLAN ID		Required: {}
parentInterfaceRef string	The parent interface reference		Required: {}

vpc.dpu.nvidia.com/v1alpha1

Package v1alpha1 contains API Schema definitions for the storage v1alpha1 API group

Resource Types

• DPUVPC
• DPUVPCList
• DPUVirtualNetwork
• DPUVirtualNetworkList
• IsolationClass
• IsolationClassList

BridgedNetworkIPAMIPv4Spec

BridgedNetworkIPAMIPv4Spec contains IPv4 IPAM configuration for bridged network

Appears in:

• BridgedNetworkIPAMSpec

Field	Description	Default	Validation
dhcp boolean	DHCP if set, enables DHCP for the network		Required: {}
subnet string	Subnet is the network subnet in CIDR format to use for DHCP. the first IP in the subnet is the gateway.		Required: {}
excludeIPs ExcludeIPsEntry array	ExcludeIPs are the IPs to exclude from DHCP allocation.		Optional: {}

BridgedNetworkIPAMSpec

BridgedNetworkIPAMSpec contains IPAM configuration for bridged network

Appears in:

• BridgedNetworkSpec

Field	Description	Default	Validation
ipv4 BridgedNetworkIPAMIPv4Spec	IPv4 contains the IPv4 IPAM configuration		Optional: {}

BridgedNetworkSpec

BridgedNetworkSpec contains configuration for bridged network

Appears in:

• DPUVirtualNetworkSpec

Field	Description	Default	Validation
ipam BridgedNetworkIPAMSpec	IPAM contains the IPAM configuration for the bridged network		Optional: {}

DPUVPC

DPUVPC is the Schema for the dpuvpc API

Appears in:

• DPUVPCList

Field	Description	Default	Validation
apiVersion string	vpc.dpu.nvidia.com/v1alpha1
kind string	DPUVPC
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec DPUVPCSpec
status DPUVPCStatus

DPUVPCList

DPUVPCList contains a list of DPUVPC

Field	Description	Default	Validation
apiVersion string	vpc.dpu.nvidia.com/v1alpha1
kind string	DPUVPCList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items DPUVPC array

DPUVPCSpec

DPUVPCSpec defines the desired state of DPUVPCSpec

Appears in:

• DPUVPC

Field	Description	Default	Validation
tenant string	Tenant which owns the VPC.		MinLength: 1 Required: {}
nodeSelector LabelSelector	NodeSelector Selects the DPU Nodes with specific labels which belong to this VPC.		Optional: {}
isolationClassName string	IsolationClassName is the name of the isolation class to use for the VPC		MinLength: 1 Required: {}
interNetworkAccess boolean	InterNetworkAccess defines if virtual networks within the VPC are routed or not. if set to false, communication between virtual networks is not allowed.		Required: {}

DPUVPCStatus

DPUVPCStatus defines the observed state of DPUVPC

Appears in:

• DPUVPC

Field	Description	Default	Validation
virtualNetworks VirtualNetworkStatus array	VirtualNetworks contains the virtual networks that belong to this VPC		Optional: {}
conditions Condition array	Conditions reflect the status of the object		Optional: {}
observedGeneration integer	ObservedGeneration records the Generation observed on the object the last time it was patched.		Optional: {}

DPUVirtualNetwork

DPUVirtualNetwork is the Schema for the dpuvirtualnetwork API

Appears in:

• DPUVirtualNetworkList

Field	Description	Default	Validation
apiVersion string	vpc.dpu.nvidia.com/v1alpha1
kind string	DPUVirtualNetwork
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec DPUVirtualNetworkSpec
status DPUVirtualNetworkStatus

DPUVirtualNetworkList

DPUVirtualNetworkList contains a list of DPUVirtualNetwork

Field	Description	Default	Validation
apiVersion string	vpc.dpu.nvidia.com/v1alpha1
kind string	DPUVirtualNetworkList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items DPUVirtualNetwork array

DPUVirtualNetworkSpec

DPUVirtualNetworkSpec defines the desired state of DPUVirtualNetworkSpec

Appears in:

• DPUVirtualNetwork

Field	Description	Default	Validation
nodeSelector LabelSelector	NodeSelector Selects the DPU Nodes with specific labels which can belong to the virtual network.		Optional: {}
vpcName string	vpcName is the name of the DPUVPC the virtual network belongs within the same namespace.		Required: {}
type NetworkType	Type of the virtual network		Enum: [Bridged] Required: {}
externallyRouted boolean	ExternallyRouted defines if the virtual network can be routed externally		Required: {}
masquerade boolean	Masquerade defines if the virtual network should masquerade the traffic before egressing to external networks. valid only if ExternallyRouted is true	true	Optional: {}
bridgedNetwork BridgedNetworkSpec	BridgedNetwork contains the bridged network configuration		Optional: {}

DPUVirtualNetworkStatus

DPUVirtualNetworkStatus defines the observed state of DPUVirtualNetwork

Appears in:

• DPUVirtualNetwork

Field	Description	Default	Validation
conditions Condition array	Conditions reflect the status of the object		Optional: {}
observedGeneration integer	ObservedGeneration records the Generation observed on the object the last time it was patched.		Optional: {}

ExcludeIPsEntry

Appears in:

• BridgedNetworkIPAMIPv4Spec

Field	Description	Default	Validation
ip string	IP is the IP address to exclude from DHCP allocation. must be part for the virtual network subnet.		Optional: {}
range RangeEntry	Range is the range of IP addresses to exclude from DHCP allocation. must be part for the virtual network subnet.		Optional: {}

IsolationClass

IsolationClass is the Schema for the isolationclass API

Appears in:

• IsolationClassList

Field	Description	Default	Validation
apiVersion string	vpc.dpu.nvidia.com/v1alpha1
kind string	IsolationClass
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec IsolationClassSpec
status IsolationClassStatus

IsolationClassList

IsolationClassList contains a list of IsolationClass

Field	Description	Default	Validation
apiVersion string	vpc.dpu.nvidia.com/v1alpha1
kind string	IsolationClassList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items IsolationClass array

IsolationClassSpec

IsolationClassSpec defines the configuration of IsolationClass

Appears in:

• IsolationClass

Field	Description	Default	Validation
provisioner string	Provisioner indicates the type of the provisioner.		Required: {}
parameters object (keys:string, values:string)	Parameters holds the parameters for the provisioner		Optional: {}

IsolationClassStatus

IsolationClassStatus defines the status of IsolationClass

Appears in:

• IsolationClass

NetworkType

Underlying type: string

NetworkType represents the type of the virtual network

Validation:

• Enum: [Bridged]

Appears in:

• DPUVirtualNetworkSpec

Field	Description
Bridged	BridgedVirtualNetworkType represents a bridged virtual network

RangeEntry

Underlying type: struct{Start string "json:"start""; End string "json:"end""}

RangeEntry contains a range of IP addresses

Appears in:

• ExcludeIPsEntry

VirtualNetworkStatus

VirtualNetworkStatus is the status of a virtual network

Appears in:

• DPUVPCStatus

Field	Description	Default	Validation
name string	the name of the virtual network		Required: {}