<commit_before>// Module included in the following assemblies:
//
// * networking/multiple_networks/configuring-sr-iov.adoc

[id="configuring-sr-iov-operator_{context}"]
= Configuring the SR-IOV Network Operator

[IMPORTANT]
====
Modifying the SR-IOV Network Operator configuration is not normally necessary.
The default configuration is recommended for most use cases.
Complete the steps to modify the relevant configuration only if the default behavior of the Operator is not compatible with your use case.
====

The SR-IOV Network Operator adds the `SriovOperatorConfig.sriovnetwork.openshift.io` Custom Resource Definition (CRD) to {product-title}.
You can configure the SR-IOV software compoenents by modifying the default 
SriovOperatorConfig Custom Resource (CR). The Operator supports the following optional behavioral changes:

- Disabling the Network Resources Injector
- Disabling the Operator admission web controller
- Configuring a custom node selector for the SR-IOV Network Config daemon. The daemon runs on all the worker nodes by default.

[NOTE]
=====
There is one Custom Resource of SriovOperatorConfig being created when
the operator is up. Change the operator configuration by modifying this
pre-created Custom Resource. The `default` Custom Resource is created in
`openshift-sriov-network-operator` namespace.
=====

`SriovOperatorConfig` provides three options for configuring operator:
* `enableInjector` allows project administrators to enable or disable Network
Resources Injector DaemonSet.
* `enableOperatorWebhook` allows project adminstrators to enable or disable
Operator Admission Controller Webhook DaemonSet.
* `configDaemonNodeSelector` allows project adminstrators to schedule SR-IOV
Network Config Daemon on selected nodes.


[id="disabling-network-resource-injector_{context}"]
== Disabling Network Resources Injector

The Network Resources Injector is a Kubernetes Dynamic Admission Controller 
application that:

* Mutates resource requests and limits in pod specifiction to add SR-IOV
resource name according to SR-IOV network attachment definition annotation.
* Mutates pod specifications with downward API volume to expose pod annotations
and labels to the running container as files under `/etc/podnetinfo`.

By default the Network Resources Injector will be enabled by SR-IOV operator
and runs as a Kubernetes DaemonSet on all master nodes. Below is an example
of Network Resources Injector pods running in a cluster with three master
nodes:

----
$ oc get pods -n openshift-sriov-network-operator
NAME                                      READY   STATUS    RESTARTS   AGE
network-resources-injector-5cz5p          1/1     Running   0          10m
network-resources-injector-dwqpx          1/1     Running   0          10m
network-resources-injector-lktz5          1/1     Running   0          10m
----

Follow this procedure to disable it.

.Prerequisites

* Install the OpenShift Command-line Interface (CLI), commonly known as `oc`.
* Log in as a user with `cluster-admin` privileges.
* You must have installed the SR-IOV Operator.

.Procedure
. Update the default SriovOperatorConfig Custom Resource
+
----
$ oc patch sriovoperatorconfig default --patch '{ "spec": { "enableInjector": false}}' --type=merge -n openshift-sriov-network-operator
----

. To re-enable Network Resources Injector
+
----
$ oc patch sriovoperatorconfig default --patch '{ "spec": { "enableInjector": true}}' --type=merge -n openshift-sriov-network-operator
----

[id="disabling-sr-iov-operator-admission-control-webhook_{context}"]
== Disabling SR-IOV Operator admission controller webhook
The SRIOV Operator Admission Controller Webhook is a Kubernetes Dynamic
Admission Controller application that:

* Validating the `SriovNetworkNodePolicy` Custom Resource when it being created
or updated.
* Mutating the `SriovNetworkNodePolicy` Custom Resource by setting the default
value to `priority` and `deviceType` when it being created or updated.

By default the SR-IOV Operator Admission Controller Webhook will be enabled by
the operator and runs as a Kubernetes DaemonSet on all master nodes. Below is
an example of Operator Admission Controller Webhook pods running in a cluster
with three master nodes:

----
$ oc get pods -n openshift-sriov-network-operator
NAME                                      READY   STATUS    RESTARTS   AGE
operator-webhook-9jkw6                    1/1     Running   0          16m
operator-webhook-kbr5p                    1/1     Running   0          16m
operator-webhook-rpfrl                    1/1     Running   0          16m
----

Follow this procedure to disable it.

.Prerequisites

* Install the OpenShift Command-line Interface (CLI), commonly known as `oc`.
* Log in as a user with `cluster-admin` privileges.
* You must have installed the SR-IOV Operator.

.Procedure
. Update the default SriovOperatorConfig Custom Resource
+
----
$ oc patch sriovoperatorconfig default --patch '{ "spec": { "enableOperatorWebhook": false}}' --type=merge -n openshift-sriov-network-operator
----

. To re-enable Operator Admission Controller Webhook
+
----
$ oc patch sriovoperatorconfig default --patch '{ "spec": { "enableOperatorWebhook": true}}' --type=merge -n openshift-sriov-network-operator
----

[id="configuring-custom-nodeselector_{context}"]
== Configuring Custom NodeSelector for SRIOV Network Config Daemon

The SR-IOV Network Config Daemon is in charge of discovering and configuring
SRIOV network devices on the nodes.

By default, it will be deployed to all the `worker` nodes in the cluster. You
can follow this procedure to select the nodes, where the SR-IOV Network Config
Daemon shall be deployed to, with node labels.

.Procedure
. Update the default SriovOperatorConfig Custom Resource
+
----
$ oc patch sriovoperatorconfig default --patch '[{"op": "replace", "path": "/spec/configDaemonNodeSelector", "value": {<node-label>}}]' --type=json -n openshift-sriov-network-operator
----

[NOTE]
=====
Replace `<node-label>` with label to apply.
For example: `node-role.kubernetes.io/worker: ""`.
=====

[NOTE]
=====
Updating of `configDaemonNodeSelector` will cause `SR-IOV Network Config Daemon`
be recreated on all the nodes that have `SR-IOV Network Config Daemon` deployed.
This will block user from applying new SR-IOV Network Node Policy and creating
new SR-IOV pods until `SR-IOV Network Config Daemon` is recreated on target nodes.
=====<commit_msg>Fix-up commit for SR-IOV Operator config<commit_after>// Module included in the following assemblies:
//
// * networking/hardware_networks/configuring-sriov-operator.adoc

[id="nw-sriov-configuring-operator_{context}"]
= Configuring the SR-IOV Network Operator

[IMPORTANT]
====
Modifying the SR-IOV Network Operator configuration is not normally necessary.
The default configuration is recommended for most use cases.
Complete the steps to modify the relevant configuration only if the default behavior of the Operator is not compatible with your use case.
====

The SR-IOV Network Operator adds the `SriovOperatorConfig.sriovnetwork.openshift.io` CustomResourceDefinition resource.
The operator automatically creates a SriovOperatorConfig custom resource (CR) named `default` in the `openshift-sriov-network-operator` namespace.

[NOTE]
=====
The `default` CR contains the SR-IOV Network Operator configuration for your cluster.
To change the operator configuration, you must modify this CR.
=====

The SriovOperatorConfig CR provides several fields for configuring the operator:

* `enableInjector` allows project administrators to enable or disable the Network Resources Injector DaemonSet.
* `enableOperatorWebhook` allows project administrators to enable or disable the Operator Admission Controller webook DaemonSet.
* `configDaemonNodeSelector` allows project administrators to schedule the SR-IOV Network Config Daemon on selected nodes.

[id="about-network-resource-injector_{context}"]
== About the Network Resources Injector

The Network Resources Injector is a Kubernetes Dynamic Admission Controller 
application. It provides the following capabilities:

* Mutation of resource requests and limits in Pod specification to add an SR-IOV resource name according to an SR-IOV network attachment definition annotation.
* Mutation of Pod specifications with downward API volume to expose pod annotations and labels to the running container as files under the `/etc/podnetinfo` path.

By default the Network Resources Injector is enabled by the SR-IOV operator and runs as a DaemonSet on all master nodes. The following is an example of Network Resources Injector Pods running in a cluster with three master nodes:

----
$ oc get pods -n openshift-sriov-network-operator
NAME                                      READY   STATUS    RESTARTS   AGE
network-resources-injector-5cz5p          1/1     Running   0          10m
network-resources-injector-dwqpx          1/1     Running   0          10m
network-resources-injector-lktz5          1/1     Running   0          10m
----

[id="about-sr-iov-operator-admission-control-webhook_{context}"]
== About the SR-IOV Operator admission controller webhook

The SR-IOV Operator Admission Controller webook is a Kubernetes Dynamic
Admission Controller application. It provides the following capabilities:

* Validation of the `SriovNetworkNodePolicy` CR when it is created or updated.
* Mutation of the `SriovNetworkNodePolicy` CR by setting the default value for the `priority` and `deviceType` fields when the CR is created or updated.

By default the SR-IOV Operator Admission Controller webook is enabled by the operator and runs as a DaemonSet on all master nodes.
The following is an example of the Operator Admission Controller webook Pods running in a cluster with three master nodes:

----
$ oc get pods -n openshift-sriov-network-operator
NAME                                      READY   STATUS    RESTARTS   AGE
operator-webhook-9jkw6                    1/1     Running   0          16m
operator-webhook-kbr5p                    1/1     Running   0          16m
operator-webhook-rpfrl                    1/1     Running   0          16m
----

[id="about-custom-node-selectors_{context}"]
== About custom node selectors

The SR-IOV Network Config daemon discovers and configures the SR-IOV network devices on cluster nodes.
By default, it is deployed to all the `worker` nodes in the cluster.
You can use node labels to specify on which nodes the SR-IOV Network Config daemon runs.

[id="disable-enable-network-resource-injector_{context}"]
== Disabling or enabling the Network Resources Injector

To disable or enable the Network Resources Injector, which is enabled by default, complete the following procedure.

.Prerequisites

* Install the OpenShift Command-line Interface (CLI), commonly known as `oc`.
* Log in as a user with `cluster-admin` privileges.
* You must have installed the SR-IOV Operator.

.Procedure

- Set the `enableInjector` field. Replace `<value>` with `false` to disable the feature or `true` to enable the feature.
+
----
$ oc patch sriovoperatorconfig default \
  --type=merge -n openshift-sriov-network-operator \
  --patch '{ "spec": { "enableInjector": <value> } }'
----

[id="disable-enable-sr-iov-operator-admission-control-webhook_{context}"]
== Disabling or enabling the SR-IOV Operator admission controller webhook

To disable or enable the admission controller webhook, which is enabled by default, complete the following procedure.

.Prerequisites

* Install the OpenShift Command-line Interface (CLI), commonly known as `oc`.
* Log in as a user with `cluster-admin` privileges.
* You must have installed the SR-IOV Operator.

.Procedure

- Set the `enableOperatorWebhook` field. Replace `<value>` with `false` to disable the feature or `true` to enable it:
+
----
$ oc patch sriovoperatorconfig default --type=merge \
  -n openshift-sriov-network-operator \
  --patch '{ "spec": { "enableOperatorWebhook": <value> } }'
----

[id="configuring-custom-nodeselector_{context}"]
== Configuring a custom NodeSelector for the SR-IOV Network Config daemon

The SR-IOV Network Config daemon discovers and configures the SR-IOV network devices on cluster nodes. By default, it is deployed to all the `worker` nodes in the cluster. You can use node labels to specify on which nodes the SR-IOV Network Config daemon runs.

To specify the nodes where the SR-IOV Network Config daemon is deployed, complete the following procedure.

[IMPORTANT]
=====
When you update the `configDaemonNodeSelector` field, the SR-IOV Network Config daemon is recreated on each selected node.
While the daemon is recreated, cluster users are unable to apply any new SR-IOV Network node policy or create new SR-IOV pods.
=====

.Procedure

- To update the node selector for the operator, enter the following command:
+
----
$ oc patch sriovoperatorconfig default --type=json \
  -n openshift-sriov-network-operator \
  --patch '[{
      "op": "replace",
      "path": "/spec/configDaemonNodeSelector",
      "value": {<node-label>}
    }]'
----
+
Replace `<node-label>` with a label to apply as in the following example:
`"node-role.kubernetes.io/worker": ""`.
{'fraction_non_alphanumeric': 0.07678856534630883, 'fraction_numerical': 0.0054740363415190455, 'mean_word_length': 3.793731778425656, 'pattern_counts': {'":': 19, '<': 11, '<?xml version=': 0, '>': 11, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 4, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6259936', 'n_tokens_mistral': 3578, 'n_tokens_neox': 3432, 'n_words': 1504}