Install Components to Enable Accelerated CNI Nodes

OVN Kubernetes accelerates traffic by attaching a VF to each pod using the primary CNI. This VF is used to offload flows to the DPU. This section details the components needed to connect pods to the offloaded OVN Kubernetes CNI.

1. Add the NVIDIA Network Operator Helm repository:

   Jump Node Console

   Collapse Source

   Copy

   Copied!

               
   
               
   $ helm repo add nvidia https://helm.ngc.nvidia.com/nvidia --force-update
           

2. The following network-operator.yaml values file will be applied:

   manifests/04-enable-accelerated-cni/helm-values/network-operator.yml

   Collapse Source

   Copy

   Copied!

               
   
               
   nfd:
     enabled: false
     deployNodeFeatureRules: false
   sriovNetworkOperator:
     enabled: true
   sriov-network-operator:
     operator:
       affinity:
         nodeAffinity:
           requiredDuringSchedulingIgnoredDuringExecution:
             nodeSelectorTerms:
               - matchExpressions:
                   - key: node-role.kubernetes.io/master
                     operator: Exists
               - matchExpressions:
                   - key: node-role.kubernetes.io/control-plane
                     operator: Exists
     crds:
       enabled: true
     sriovOperatorConfig:
       deploy: true
       configDaemonNodeSelector: null
   operator:
     affinity:
       nodeAffinity:
         requiredDuringSchedulingIgnoredDuringExecution:
           nodeSelectorTerms:
             - matchExpressions:
                 - key: node-role.kubernetes.io/master
                   operator: Exists
             - matchExpressions:
                 - key: node-role.kubernetes.io/control-plane
                   operator: Exists
           

   Deploy the operator:

   Jump Node Console

   Collapse Source

   Copy

   Copied!

               
   
               
   $ helm upgrade --no-hooks --install --create-namespace --namespace nvidia-network-operator network-operator nvidia/network-operator --version 24.7.0 -f ./manifests/04-enable-accelerated-cni/helm-values/network-operator.yml
    
   Release "network-operator" does not exist. Installing it now.
   NAME: network-operator
   LAST DEPLOYED: Tue May 20 13:36:57 2025
   NAMESPACE: nvidia-network-operator
   STATUS: deployed
   REVISION: 1
   TEST SUITE: None
   NOTES:
   ...
           

3. Ensure all the pods in nvidia-network-operator namespace are ready:

   Jump Node Console

   Collapse Source

   Copy

   Copied!

               
   
               
   $ kubectl wait --for=condition=ready --namespace nvidia-network-operator pods --all
   pod/network-operator-7bc7b45d67-6qpps condition met
   pod/network-operator-sriov-network-operator-86c9cd4899-pdsbf condition met
           

The OVN Kubernetes resource injection webhook is injected into each pod scheduled to a worker node with a request for a VF and a Network Attachment Definition. This webhook is part of the same helm chart as the other components of the OVN Kubernetes CNI. Here it is installed by adjusting the existing helm installation to add the webhook component to the installation.

1. The following ovn-kubernetes.yaml values file will be applied:

   manifests/04-enable-accelerated-cni/helm-values/ovn-kubernetes.yml

   Collapse Source

   Copy

   Copied!

               
   
               
   ovn-kubernetes-resource-injector:
     ## Enable the ovn-kubernetes-resource-injector
     enabled: true
           

2. Run the following command:

   Jump Node Console

   Collapse Source

   Copy

   Copied!

               
   
               
   $ envsubst < manifests/04-enable-accelerated-cni/helm-values/ovn-kubernetes.yml | helm upgrade --install -n ovn-kubernetes ovn-kubernetes-resource-injector ${OVN_KUBERNETES_REPO_URL}/ovn-kubernetes-chart --version $TAG --values -
    
   Release "ovn-kubernetes-resource-injector" does not exist. Installing it now.
   Pulled: ghcr.io/nvidia/ovn-kubernetes-chart:v25.4.0
   Digest: sha256:bce61b35ab485f06924681c5c906bfc0ab0065ac94830c6c036418e1edf995b3
   NAME: ovn-kubernetes-resource-injector
   LAST DEPLOYED: Tue May 20 13:41:38 2025
   NAMESPACE: ovn-kubernetes
   STATUS: deployed
   REVISION: 1
   TEST SUITE: None
           

3. Verify that the resource injector deployment has been successfully rolled out.

   Jump Node Console

   Collapse Source

   Copy

   Copied!

               
   
               
   $ kubectl rollout status deployment --namespace ovn-kubernetes ovn-kubernetes-resource-injector
   deployment "ovn-kubernetes-resource-injector" successfully rolled out
           

1. The following NicClusterPolicy and SriovNetworkNodePolicy configuration files should be applied.

   Note

   Note that to achieve high performance you need to remove spec.mtu: 1500 line from sriov_network_operator_policy.yaml.

   manifests/04-enable-accelerated-cni/nic_cluster_policy.yaml

   Collapse Source

   Copy

   Copied!

               
   
               
   ---
   apiVersion: mellanox.com/v1alpha1
   kind: NicClusterPolicy
   metadata:
     name: nic-cluster-policy
   spec:
     secondaryNetwork:
       multus:
         image: multus-cni
         imagePullSecrets: []
         repository: ghcr.io/k8snetworkplumbingwg
         version: v3.9.3
           

   manifests/04-enable-accelerated-cni/sriov_network_operator_policy.yaml

   Collapse Source

   Copy

   Copied!

               
   
               
   ---
   apiVersion: sriovnetwork.openshift.io/v1
   kind: SriovNetworkNodePolicy
   metadata:
     name: bf3-p0-vfs
     namespace: nvidia-network-operator
   spec:
     nicSelector:
       deviceID: "a2dc"
       vendor: "15b3"
       pfNames:
       - $DPU_P0#2-45
     nodeSelector:
       node-role.kubernetes.io/worker: ""
     numVfs: 46
     resourceName: bf3-p0-vfs
     isRdma: true
     externallyManaged: true
     deviceType: netdevice
     linkType: eth
           

   Apply those configuration files:

   Jump Node Console

   Collapse Source

   Copy

   Copied!

               
   
               
   $ cat manifests/04-enable-accelerated-cni/*.yaml | envsubst | kubectl apply -f -
           

2. Verify the DPF system by ensuring that the following DaemonSets were successfully rolled out:

   Jump Node Console

   Collapse Source

   Copy

   Copied!

               
   
               
   $ kubectl rollout status daemonset --namespace nvidia-network-operator kube-multus-ds sriov-network-config-daemon sriov-device-plugin
   daemon set "kube-multus-ds" successfully rolled out
   daemon set "sriov-network-config-daemon" successfully rolled out
   daemon set "sriov-device-plugin" successfully rolled out