node-feature-discovery

Helm chart

Last changed

Request a free trial

Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.

Tag:

image:

repository: cgr.dev/chainguard-private/node-feature-discovery-fips

# This should be set to 'IfNotPresent' for released version

pullPolicy: IfNotPresent

# tag, if defined will use the given image tag, else Chart.AppVersion will be used

# tag

tag: 0.18@sha256:ebd88e7cd5d862ae38c968c07133829700fe672d1af9b2452dab1e8e6ec01839

imagePullSecrets: []

nameOverride: ""

fullnameOverride: ""

namespaceOverride: ""

featureGates:

NodeFeatureGroupAPI: false

priorityClassName: ""

postDeleteCleanup: true

master:

enable: true

extraArgs: []

extraEnvs: []

hostNetwork: false

dnsPolicy: ClusterFirstWithHostNet

config: ### <NFD-MASTER-CONF-START-DO-NOT-REMOVE>

# noPublish: false

# extraLabelNs: ["added.ns.io","added.kubernets.io"]

# denyLabelNs: ["denied.ns.io","denied.kubernetes.io"]

# enableTaints: false

# informerPageSize: 200

# labelWhiteList: "foo"

# resyncPeriod: "2h"

# restrictions:

# disableLabels: true

# disableTaints: true

# disableExtendedResources: true

# disableAnnotations: true

# allowOverwrite: false

# denyNodeFeatureLabels: true

# nodeFeatureNamespaceSelector:

# matchLabels:

# kubernetes.io/metadata.name: "node-feature-discovery"

# matchExpressions:

# - key: "kubernetes.io/metadata.name"

# operator: "In"

# values:

# - "node-feature-discovery"

# klog:

# addDirHeader: false

# alsologtostderr: false

# logBacktraceAt:

# logtostderr: true

# skipHeaders: false

# stderrthreshold: 2

# v: 0

# vmodule:

## NOTE: the following options are not dynamically run-time configurable

## and require a nfd-master restart to take effect after being changed

# logDir:

# logFile:

# logFileMaxSize: 1800

# skipLogHeaders: false

# leaderElection:

# leaseDuration: 15s

# # this value has to be lower than leaseDuration and greater than retryPeriod*1.2

# renewDeadline: 10s

# # this value has to be greater than 0

# retryPeriod: 2s

# nfdApiParallelism: 10

### <NFD-MASTER-CONF-END-DO-NOT-REMOVE>

port: 8080

instance:

resyncPeriod:

denyLabelNs: []

extraLabelNs: []

enableTaints: false

nfdApiParallelism: null

deploymentAnnotations: {}

replicaCount: 1

podSecurityContext: {}

# fsGroup: 2000

securityContext:

allowPrivilegeEscalation: false

capabilities:

drop: ["ALL"]

readOnlyRootFilesystem: true

runAsNonRoot: true

# runAsUser: 1000

serviceAccount:

# Specifies whether a service account should be created

create: true

# Annotations to add to the service account

annotations: {}

# The name of the service account to use.

# If not set and create is true, a name is generated using the fullname template

name:

# specify how many old ReplicaSets for the Deployment to retain.

revisionHistoryLimit:

rbac:

create: true

100

resources:

101

limits:

102

memory: 4Gi

103

requests:

104

cpu: 100m

105

# You may want to use the same value for `requests.memory` and `limits.memory`. The “requests” value affects scheduling to accommodate pods on nodes.

106

# If there is a large difference between “requests” and “limits” and nodes experience memory pressure, the kernel may invoke

107

# the OOM Killer, even if the memory does not exceed the “limits” threshold. This can cause unexpected pod evictions. Memory

108

# cannot be compressed and once allocated to a pod, it can only be reclaimed by killing the pod.

109

# Natan Yellin 22/09/2022 https://home.robusta.dev/blog/kubernetes-memory-limit

110

memory: 128Mi

111

nodeSelector: {}

112

tolerations:

113

- key: "node-role.kubernetes.io/control-plane"

114

operator: "Equal"

115

value: ""

116

effect: "NoSchedule"

117

podDisruptionBudget:

118

enable: false

119

minAvailable: 1

120

unhealthyPodEvictionPolicy: AlwaysAllow

121

annotations: {}

122

affinity:

123

nodeAffinity:

124

preferredDuringSchedulingIgnoredDuringExecution:

125

- weight: 1

126

preference:

127

matchExpressions:

128

- key: "node-role.kubernetes.io/control-plane"

129

operator: In

130

values: [""]

131

startupProbe:

132

failureThreshold: 30

133

# periodSeconds: 10

134

livenessProbe: {}

135

# failureThreshold: 3

136

# initialDelaySeconds: 0

137

# periodSeconds: 10

138

# timeoutSeconds: 1

139

readinessProbe:

140

failureThreshold: 10

141

# initialDelaySeconds: 0

142

# periodSeconds: 10

143

# timeoutSeconds: 1

144

# successThreshold: 1

145

worker:

146

enable: true

147

extraArgs: []

148

extraEnvs: []

149

hostNetwork: false

150

dnsPolicy: ClusterFirstWithHostNet

151

config: ### <NFD-WORKER-CONF-START-DO-NOT-REMOVE>

152

#core:

153

# labelWhiteList:

154

# noPublish: false

155

# noOwnerRefs: false

156

# sleepInterval: 60s

157

# featureSources: [all]

158

# labelSources: [all]

159

# klog:

160

# addDirHeader: false

161

# alsologtostderr: false

162

# logBacktraceAt:

163

# logtostderr: true

164

# skipHeaders: false

165

# stderrthreshold: 2

166

# v: 0

167

# vmodule:

168

## NOTE: the following options are not dynamically run-time configurable

169

## and require a nfd-worker restart to take effect after being changed

170

# logDir:

171

# logFile:

172

# logFileMaxSize: 1800

173

# skipLogHeaders: false

174

#sources:

175

# cpu:

176

# cpuid:

177

## NOTE: whitelist has priority over blacklist

178

# attributeBlacklist:

179

# - "AVX10"

180

# - "BMI1"

181

# - "BMI2"

182

# - "CLMUL"

183

# - "CMOV"

184

# - "CX16"

185

# - "ERMS"

186

# - "F16C"

187

# - "HTT"

188

# - "LZCNT"

189

# - "MMX"

190

# - "MMXEXT"

191

# - "NX"

192

# - "POPCNT"

193

# - "RDRAND"

194

# - "RDSEED"

195

# - "RDTSCP"

196

# - "SGX"

197

# - "SSE"

198

# - "SSE2"

199

# - "SSE3"

200

# - "SSE4"

201

# - "SSE42"

202

# - "SSSE3"

203

# - "TDX_GUEST"

204

# attributeWhitelist:

205

# kernel:

206

# kconfigFile: "/path/to/kconfig"

207

# configOpts:

208

# - "NO_HZ"

209

# - "X86"

210

# - "DMI"

211

# pci:

212

# deviceClassWhitelist:

213

# - "0200"

214

# - "03"

215

# - "12"

216

# deviceLabelFields:

217

# - "class"

218

# - "vendor"

219

# - "device"

220

# - "subsystem_vendor"

221

# - "subsystem_device"

222

# usb:

223

# deviceClassWhitelist:

224

# - "0e"

225

# - "ef"

226

# - "fe"

227

# - "ff"

228

# deviceLabelFields:

229

# - "class"

230

# - "vendor"

231

# - "device"

232

# custom:

233

# # The following feature demonstrates the capabilities of the matchFeatures

234

# - name: "my custom rule"

235

# labels:

236

# "vendor.io/my-ng-feature": "true"

237

# # matchFeatures implements a logical AND over all matcher terms in the

238

# # list (i.e. all of the terms, or per-feature matchers, must match)

239

# matchFeatures:

240

# - feature: cpu.cpuid

241

# matchExpressions:

242

# AVX512F: {op: Exists}

243

# - feature: cpu.cstate

244

# matchExpressions:

245

# enabled: {op: IsTrue}

246

# - feature: cpu.pstate

247

# matchExpressions:

248

# no_turbo: {op: IsFalse}

249

# scaling_governor: {op: In, value: ["performance"]}

250

# - feature: cpu.rdt

251

# matchExpressions:

252

# RDTL3CA: {op: Exists}

253

# - feature: cpu.sst

254

# matchExpressions:

255

# bf.enabled: {op: IsTrue}

256

# - feature: cpu.topology

257

# matchExpressions:

258

# hardware_multithreading: {op: IsFalse}

259

260

# - feature: kernel.config

261

# matchExpressions:

262

# X86: {op: Exists}

263

# LSM: {op: InRegexp, value: ["apparmor"]}

264

# - feature: kernel.loadedmodule

265

# matchExpressions:

266

# e1000e: {op: Exists}

267

# - feature: kernel.selinux

268

# matchExpressions:

269

# enabled: {op: IsFalse}

270

# - feature: kernel.version

271

# matchExpressions:

272

# major: {op: In, value: ["5"]}

273

# minor: {op: Gt, value: ["10"]}

274

275

# - feature: storage.block

276

# matchExpressions:

277

# rotational: {op: In, value: ["0"]}

278

# dax: {op: In, value: ["0"]}

279

280

# - feature: network.device

281

# matchExpressions:

282

# operstate: {op: In, value: ["up"]}

283

# speed: {op: Gt, value: ["100"]}

284

285

# - feature: memory.numa

286

# matchExpressions:

287

# node_count: {op: Gt, value: ["2"]}

288

# - feature: memory.nv

289

# matchExpressions:

290

# devtype: {op: In, value: ["nd_dax"]}

291

# mode: {op: In, value: ["memory"]}

292

293

# - feature: system.osrelease

294

# matchExpressions:

295

# ID: {op: In, value: ["fedora", "centos"]}

296

# - feature: system.name

297

# matchExpressions:

298

# nodename: {op: InRegexp, value: ["^worker-X"]}

299

300

# - feature: local.label

301

# matchExpressions:

302

# custom-feature-knob: {op: Gt, value: ["100"]}

303

304

# # The following feature demonstrates the capabilities of the matchAny

305

# - name: "my matchAny rule"

306

# labels:

307

# "vendor.io/my-ng-feature-2": "my-value"

308

# # matchAny implements a logical IF over all elements (sub-matchers) in

309

# # the list (i.e. at least one feature matcher must match)

310

# matchAny:

311

# - matchFeatures:

312

# - feature: kernel.loadedmodule

313

# matchExpressions:

314

# driver-module-X: {op: Exists}

315

# - feature: pci.device

316

# matchExpressions:

317

# vendor: {op: In, value: ["8086"]}

318

# class: {op: In, value: ["0200"]}

319

# - matchFeatures:

320

# - feature: kernel.loadedmodule

321

# matchExpressions:

322

# driver-module-Y: {op: Exists}

323

# - feature: usb.device

324

# matchExpressions:

325

# vendor: {op: In, value: ["8086"]}

326

# class: {op: In, value: ["02"]}

327

328

# - name: "avx wildcard rule"

329

# labels:

330

# "my-avx-feature": "true"

331

# matchFeatures:

332

# - feature: cpu.cpuid

333

# matchName: {op: InRegexp, value: ["^AVX512"]}

334

335

# # The following features demonstreate label templating capabilities

336

# - name: "my template rule"

337

# labelsTemplate: |

338

# {{ range .system.osrelease }}vendor.io/my-system-feature.{{ .Name }}={{ .Value }}

339

# {{ end }}

340

# matchFeatures:

341

# - feature: system.osrelease

342

# matchExpressions:

343

# ID: {op: InRegexp, value: ["^open.*"]}

344

# VERSION_ID.major: {op: In, value: ["13", "15"]}

345

346

# - name: "my template rule 2"

347

# labelsTemplate: |

348

# {{ range .pci.device }}vendor.io/my-pci-device.{{ .class }}-{{ .device }}=with-cpuid

349

# {{ end }}

350

# matchFeatures:

351

# - feature: pci.device

352

# matchExpressions:

353

# class: {op: InRegexp, value: ["^06"]}

354

# vendor: ["8086"]

355

# - feature: cpu.cpuid

356

# matchExpressions:

357

# AVX: {op: Exists}

358

359

# # The following examples demonstrate vars field and back-referencing

360

# # previous labels and vars

361

# - name: "my dummy kernel rule"

362

# labels:

363

# "vendor.io/my.kernel.feature": "true"

364

# matchFeatures:

365

# - feature: kernel.version

366

# matchExpressions:

367

# major: {op: Gt, value: ["2"]}

368

369

# - name: "my dummy rule with no labels"

370

# vars:

371

# "my.dummy.var": "1"

372

# matchFeatures:

373

# - feature: cpu.cpuid

374

# matchExpressions: {}

375

376

# - name: "my rule using backrefs"

377

# labels:

378

# "vendor.io/my.backref.feature": "true"

379

# matchFeatures:

380

# - feature: rule.matched

381

# matchExpressions:

382

# vendor.io/my.kernel.feature: {op: IsTrue}

383

# my.dummy.var: {op: Gt, value: ["0"]}

384

385

# - name: "kconfig template rule"

386

# labelsTemplate: |

387

# {{ range .kernel.config }}kconfig-{{ .Name }}={{ .Value }}

388

# {{ end }}

389

# matchFeatures:

390

# - feature: kernel.config

391

# matchName: {op: In, value: ["SWAP", "X86", "ARM"]}

392

### <NFD-WORKER-CONF-END-DO-NOT-REMOVE>

393

port: 8080

394

daemonsetAnnotations: {}

395

podSecurityContext: {}

396

# fsGroup: 2000

397

398

securityContext:

399

allowPrivilegeEscalation: false

400

capabilities:

401

drop: ["ALL"]

402

readOnlyRootFilesystem: true

403

runAsNonRoot: true

404

# runAsUser: 1000

405

livenessProbe:

406

initialDelaySeconds: 10

407

# failureThreshold: 3

408

# periodSeconds: 10

409

# timeoutSeconds: 1

410

readinessProbe:

411

initialDelaySeconds: 5

412

failureThreshold: 10

413

# periodSeconds: 10

414

# timeoutSeconds: 1

415

# successThreshold: 1

416

serviceAccount:

417

# Specifies whether a service account should be created.

418

# We create this by default to make it easier for downstream users to apply PodSecurityPolicies.

419

create: true

420

# Annotations to add to the service account

421

annotations: {}

422

# The name of the service account to use.

423

# If not set and create is true, a name is generated using the fullname template

424

name:

425

# specify how many old ControllerRevisions for the DaemonSet to retain.

426

revisionHistoryLimit:

427

rbac:

428

create: true

429

# Allow users to mount the hostPath /usr/src, useful for RHCOS on s390x

430

# Does not work on systems without /usr/src AND a read-only /usr, such as Talos

431

mountUsrSrc: false

432

resources:

433

limits:

434

memory: 512Mi

435

requests:

436

cpu: 5m

437

memory: 64Mi

438

nodeSelector: {}

439

tolerations: []

440

annotations: {}

441

affinity: {}

442

priorityClassName: ""

443

updateStrategy: {}

444

# type: RollingUpdate

445

# rollingUpdate:

446

# maxSurge: 0

447

# maxUnavailable: "10%"

448

topologyUpdater:

449

config: ### <NFD-TOPOLOGY-UPDATER-CONF-START-DO-NOT-REMOVE>

450

## key = node name, value = list of resources to be excluded.

451

## use * to exclude from all nodes.

452

## an example for how the exclude list should looks like

453

#excludeList:

454

# node1: [cpu]

455

# node2: [memory, example/deviceA]

456

# *: [hugepages-2Mi]

457

### <NFD-TOPOLOGY-UPDATER-CONF-END-DO-NOT-REMOVE>

458

enable: false

459

createCRDs: false

460

extraArgs: []

461

extraEnvs: []

462

hostNetwork: false

463

dnsPolicy: ClusterFirstWithHostNet

464

serviceAccount:

465

create: true

466

annotations: {}

467

name:

468

# specify how many old ControllerRevisions for the DaemonSet to retain.

469

revisionHistoryLimit:

470

rbac:

471

create: true

472

port: 8080

473

kubeletConfigPath:

474

kubeletPodResourcesSockPath:

475

updateInterval: 60s

476

watchNamespace: "*"

477

kubeletStateDir: /var/lib/kubelet

478

podSecurityContext: {}

479

securityContext:

480

allowPrivilegeEscalation: false

481

capabilities:

482

drop: ["ALL"]

483

readOnlyRootFilesystem: true

484

runAsUser: 0

485

livenessProbe:

486

initialDelaySeconds: 10

487

# failureThreshold: 3

488

# periodSeconds: 10

489

# timeoutSeconds: 1

490

readinessProbe:

491

initialDelaySeconds: 5

492

failureThreshold: 10

493

# periodSeconds: 10

494

# timeoutSeconds: 1

495

# successThreshold: 1

496

resources:

497

limits:

498

memory: 60Mi

499

requests:

500

cpu: 50m

501

memory: 40Mi

502

nodeSelector: {}

503

tolerations: []

504

annotations: {}

505

daemonsetAnnotations: {}

506

affinity: {}

507

podSetFingerprint: true

508

gc:

509

enable: true

510

extraArgs: []

511

extraEnvs: []

512

hostNetwork: false

513

replicaCount: 1

514

dnsPolicy: ClusterFirstWithHostNet

515

serviceAccount:

516

create: true

517

annotations: {}

518

name:

519

rbac:

520

create: true

521

interval: 1h

522

podSecurityContext: {}

523

livenessProbe:

524

initialDelaySeconds: 10

525

# failureThreshold: 3

526

# periodSeconds: 10

527

# timeoutSeconds: 1

528

readinessProbe:

529

initialDelaySeconds: 5

530

# failureThreshold: 3

531

# periodSeconds: 10

532

# timeoutSeconds: 1

533

# successThreshold: 1

534

resources:

535

limits:

536

memory: 1Gi

537

requests:

538

cpu: 10m

539

memory: 128Mi

540

port: 8080

541

nodeSelector: {}

542

tolerations: []

543

annotations: {}

544

deploymentAnnotations: {}

545

affinity: {}

546

podDisruptionBudget:

547

enable: false

548

minAvailable: 1

549

unhealthyPodEvictionPolicy: AlwaysAllow

550

# specify how many old ReplicaSets for the Deployment to retain.

551

revisionHistoryLimit:

552

prometheus:

553

enable: false

554

scrapeInterval: 10s

555

labels: {}

556

The trusted source for open source

Talk to an expert

Privacy

Terms

© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.

node-feature-discovery

The trusted source for open source

Product

Solutions

Customers

Resources

Company