kubernetes-sigs / kubernetes-sigs/node-feature-discovery

nfd-master: NodeFeatureGroups outside nfd-master's namespace are listed and enqueued but silently never updated

Open
#2,558 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
1.1k
Forks
317
Avg merge
21h 39m
Merged PRs (30d)
5

Description

### What happened

`nfdAPIUpdateAllNodeFeatureGroups` lists NodeFeatureGroups across all namespaces, but the update pipeline resolves and writes them only in nfd-master's own namespace:

- [`pkg/nfd-master/nfd-master.go#L816`](https://github.com/kubernetes-sigs/node-feature-discovery/blob/d50636b383452f04be58da034d5cfd2b001d48f7/pkg/nfd-master/nfd-master.go#L816) — cluster-wide list (`List(k8slabels.Everything())`)
- [`pkg/nfd-master/nfd-master.go#L823`](https://github.com/kubernetes-sigs/node-feature-discovery/blob/d50636b383452f04be58da034d5cfd2b001d48f7/pkg/nfd-master/nfd-master.go#L823) — enqueued by name only, namespace dropped
- [`pkg/nfd-master/updater-pool.go#L108`](https://github.com/kubernetes-sigs/node-feature-discovery/blob/d50636b383452f04be58da034d5cfd2b001d48f7/pkg/nfd-master/updater-pool.go#L108) — consumer re-resolves with `getNodeFeatureGroup(cli, u.nfdMaster.namespace, nfgName)`
- [`pkg/nfd-master/nfd-master.go#L887`](https://github.com/kubernetes-sigs/node-feature-discovery/blob/d50636b383452f04be58da034d5cfd2b001d48f7/pkg/nfd-master/nfd-master.go#L887) — status write likewise pinned to `m.namespace`

Net effect:

1. An NFG created in any other namespace is watched and enqueued, but the lookup NotFounds in nfd-master's namespace and the update is skipped with an info-level log — its `status.nodes` never populates.
2. Two NFGs with the same name in different namespaces collide in the queue: events for either trigger processing of whichever lives in nfd-master's namespace.

### What did you expect to happen

Either (a) NFGs namespace-scoped end-to-end — namespace/name key through the queue, `Get`/`UpdateStatus` against the object's own namespace — or (b) nfd-master explicitly watches only its own namespace (as the NodeFeature path does via `isNamespaceSelected`) so out-of-scope NFGs aren't silently half-processed. Today's behavior is an inconsistent middle: cluster-wide watch, own-namespace processing, silent skip.

### How to reproduce

1. Deploy NFD with `NodeFeatureGroupAPI` enabled (nfd-master in the `node-feature-discovery` namespace).
2. `kubectl create ns team-a && kubectl apply -n team-a -f examples/nodefeaturegroup.yaml`
3. The NFG in `team-a` never gets `status.nodes`; nfd-master logs "NodeFeatureGroup not found, skip update".

### Anything else we need to know

Found while reviewing #2403, whose pre-grouping design assumes admin-created NFGs work; related to the namespace-scoping discussion in #2540. Happy to send a fix — leaning (a): thread namespace/name through the queue, use the object's namespace at resolution and `UpdateStatus`, and add a regression test with same-name NFGs in two namespaces. Note (a) makes cross-namespace NFGs work, which touches the multi-tenancy scoping debate in #2540 — if we'd rather not pre-empt that, (b) namespace-filter plus a loud event is the conservative alternative.

**Version:** master (`d50636b`)

Contributor guide

Open the contributing guide

Research direction

Start in pkg/nfd-master/nfd-master.go at nfdAPIUpdateAllNodeFeatureGroups and the status update path, then trace the queue consumer in pkg/nfd-master/updater-pool.go. Compare the namespace handling at each step and review #2540 before choosing a scope. Done means namespace handling is consistent and a regression test covers same-name NodeFeatureGroups in different namespaces.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, kubernetes
Domain
api, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.