kubernetes-sigs / kubernetes-sigs/node-feature-discovery
nfd-master: NodeFeatureGroups outside nfd-master's namespace are listed and enqueued but silently never updated
- Dominant language
- Go
- Stars
- 1.1k
- Forks
- 317
- Avg merge
- 21h 39m
- Merged PRs (30d)
- 5
Description
### What happened
`nfdAPIUpdateAllNodeFeatureGroups` lists NodeFeatureGroups across all namespaces, but the update pipeline resolves and writes them only in nfd-master's own namespace:
- [`pkg/nfd-master/nfd-master.go#L816`](https://github.com/kubernetes-sigs/node-feature-discovery/blob/d50636b383452f04be58da034d5cfd2b001d48f7/pkg/nfd-master/nfd-master.go#L816) — cluster-wide list (`List(k8slabels.Everything())`)
- [`pkg/nfd-master/nfd-master.go#L823`](https://github.com/kubernetes-sigs/node-feature-discovery/blob/d50636b383452f04be58da034d5cfd2b001d48f7/pkg/nfd-master/nfd-master.go#L823) — enqueued by name only, namespace dropped
- [`pkg/nfd-master/updater-pool.go#L108`](https://github.com/kubernetes-sigs/node-feature-discovery/blob/d50636b383452f04be58da034d5cfd2b001d48f7/pkg/nfd-master/updater-pool.go#L108) — consumer re-resolves with `getNodeFeatureGroup(cli, u.nfdMaster.namespace, nfgName)`
- [`pkg/nfd-master/nfd-master.go#L887`](https://github.com/kubernetes-sigs/node-feature-discovery/blob/d50636b383452f04be58da034d5cfd2b001d48f7/pkg/nfd-master/nfd-master.go#L887) — status write likewise pinned to `m.namespace`
Net effect:
1. An NFG created in any other namespace is watched and enqueued, but the lookup NotFounds in nfd-master's namespace and the update is skipped with an info-level log — its `status.nodes` never populates.
2. Two NFGs with the same name in different namespaces collide in the queue: events for either trigger processing of whichever lives in nfd-master's namespace.
### What did you expect to happen
Either (a) NFGs namespace-scoped end-to-end — namespace/name key through the queue, `Get`/`UpdateStatus` against the object's own namespace — or (b) nfd-master explicitly watches only its own namespace (as the NodeFeature path does via `isNamespaceSelected`) so out-of-scope NFGs aren't silently half-processed. Today's behavior is an inconsistent middle: cluster-wide watch, own-namespace processing, silent skip.
### How to reproduce
1. Deploy NFD with `NodeFeatureGroupAPI` enabled (nfd-master in the `node-feature-discovery` namespace).
2. `kubectl create ns team-a && kubectl apply -n team-a -f examples/nodefeaturegroup.yaml`
3. The NFG in `team-a` never gets `status.nodes`; nfd-master logs "NodeFeatureGroup not found, skip update".
### Anything else we need to know
Found while reviewing #2403, whose pre-grouping design assumes admin-created NFGs work; related to the namespace-scoping discussion in #2540. Happy to send a fix — leaning (a): thread namespace/name through the queue, use the object's namespace at resolution and `UpdateStatus`, and add a regression test with same-name NFGs in two namespaces. Note (a) makes cross-namespace NFGs work, which touches the multi-tenancy scoping debate in #2540 — if we'd rather not pre-empt that, (b) namespace-filter plus a loud event is the conservative alternative.
**Version:** master (`d50636b`)
Contributor guide
Research direction
Start in pkg/nfd-master/nfd-master.go at nfdAPIUpdateAllNodeFeatureGroups and the status update path, then trace the queue consumer in pkg/nfd-master/updater-pool.go. Compare the namespace handling at each step and review #2540 before choosing a scope. Done means namespace handling is consistent and a regression test covers same-name NodeFeatureGroups in different namespaces.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100