operator: add support for npu plugin

Co-authored-by: Eero Tamminen <eero.t.tamminen@intel.com>
Signed-off-by: Tuomas Katila <tuomas.katila@intel.com>

Author: tkatila

README.md

@@ -22,6 +22,7 @@ Table of Contents
     * [DSA device plugin](#dsa-device-plugin)
     * [DLB device plugin](#dlb-device-plugin)
     * [IAA device plugin](#iaa-device-plugin)
+    * [NPU device plugin](#npu-device-plugin)
 * [Device Plugins Operator](#device-plugins-operator)
 * [XeLink XPU Manager sidecar](#xelink-xpu-manager-sidecar)
 * [Intel GPU Level-Zero sidecar](#intel-gpu-levelzero)
@@ -182,12 +183,17 @@ Balancer accelerator(DLB).
 The [IAA device plugin](cmd/iaa_plugin/README.md) supports acceleration using
 the Intel Analytics accelerator(IAA).
 
+### NPU Device Plugin
+
+The [NPU device plugin](cmd/npu_plugin/README.md) supports acceleration using
+the Intel Neural Processing Unit(NPU).
+
 ## Device Plugins Operator
 
 To simplify the deployment of the device plugins, a unified device plugins
 operator is implemented.
 
-Currently the operator has support for the DSA, DLB, FPGA, GPU, IAA, QAT, and
+Currently the operator has support for the DSA, DLB, FPGA, GPU, IAA, QAT, NPU, and
 Intel SGX device plugins. Each device plugin has its own custom resource
 definition (CRD) and the corresponding controller that watches CRUD operations
 to those custom resources.
@@ -247,6 +253,8 @@ The summary of resources available via plugins in this repository is given in th
    * [crypto-perf-dpdk-pod-requesting-qat-cy.yaml](deployments/qat_dpdk_app/crypto-perf/crypto-perf-dpdk-pod-requesting-qat-cy.yaml)
  * `sgx.intel.com`  : `epc`
    * [intelsgx-job.yaml](deployments/sgx_enclave_apps/base/intelsgx-job.yaml)
+ * `npu.intel.com`  : `npu`
+   * TODO
 
 ## Developers
 

cmd/operator/main.go

@@ -39,6 +39,7 @@ import (
 	"github.com/intel/intel-device-plugins-for-kubernetes/pkg/controllers/fpga"
 	"github.com/intel/intel-device-plugins-for-kubernetes/pkg/controllers/gpu"
 	"github.com/intel/intel-device-plugins-for-kubernetes/pkg/controllers/iaa"
+	"github.com/intel/intel-device-plugins-for-kubernetes/pkg/controllers/npu"
 	"github.com/intel/intel-device-plugins-for-kubernetes/pkg/controllers/qat"
 	"github.com/intel/intel-device-plugins-for-kubernetes/pkg/controllers/sgx"
 	"github.com/intel/intel-device-plugins-for-kubernetes/pkg/fpgacontroller"
@@ -65,7 +66,7 @@ type devicePluginControllerAndWebhook map[string](func(ctrl.Manager, string, boo
 
 type flagList []string
 
-var supportedDevices = flagList{"dsa", "dlb", "fpga", "gpu", "iaa", "qat", "sgx"}
+var supportedDevices = flagList{"dsa", "dlb", "fpga", "gpu", "iaa", "qat", "sgx", "npu"}
 var devices flagList
 
 func (flag *flagList) String() string {
@@ -170,6 +171,7 @@ func main() {
 		"iaa":  iaa.SetupReconciler,
 		"qat":  qat.SetupReconciler,
 		"sgx":  sgx.SetupReconciler,
+		"npu":  npu.SetupReconciler,
 	}
 
 	tlsCfgFuncs := createTLSCfgs(enableHTTP2)

deployments/daemonsets.go

@@ -71,6 +71,13 @@ func SGXPluginDaemonSet() *apps.DaemonSet {
 	return getDaemonset(contentSGX).DeepCopy()
 }
 
+//go:embed npu_plugin/base/*plugin*.yaml
+var contentNPU []byte
+
+func NPUPluginDaemonSet() *apps.DaemonSet {
+	return getDaemonset(contentNPU).DeepCopy()
+}
+
 // getDaemonset unmarshalls yaml content into a DaemonSet object.
 func getDaemonset(content []byte) *apps.DaemonSet {
 	var result apps.DaemonSet

deployments/operator/crd/bases/deviceplugin.intel.com_npudeviceplugins.yaml

@@ -0,0 +1,191 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.17.0
+  name: npudeviceplugins.deviceplugin.intel.com
+spec:
+  group: deviceplugin.intel.com
+  names:
+    kind: NpuDevicePlugin
+    listKind: NpuDevicePluginList
+    plural: npudeviceplugins
+    singular: npudeviceplugin
+  scope: Cluster
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .status.desiredNumberScheduled
+      name: Desired
+      type: integer
+    - jsonPath: .status.numberReady
+      name: Ready
+      type: integer
+    - jsonPath: .spec.nodeSelector
+      name: Node Selector
+      type: string
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1
+    schema:
+      openAPIV3Schema:
+        description: |-
+          NpuDevicePlugin is the Schema for the npudeviceplugins API. It represents
+          the NPU device plugin responsible for advertising Intel NPU hardware resources to
+          the kubelet.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: NpuDevicePluginSpec defines the desired state of NpuDevicePlugin.
+            properties:
+              image:
+                description: Image is a container image with NPU device plugin executable.
+                type: string
+              logLevel:
+                description: LogLevel sets the plugin's log level.
+                minimum: 0
+                type: integer
+              nodeSelector:
+                additionalProperties:
+                  type: string
+                description: NodeSelector provides a simple way to constrain device
+                  plugin pods to nodes with particular labels.
+                type: object
+              sharedDevNum:
+                description: SharedDevNum is a number of containers that can share
+                  the same NPU device.
+                minimum: 1
+                type: integer
+              tolerations:
+                description: Specialized nodes (e.g., with accelerators) can be Tainted
+                  to make sure unwanted pods are not scheduled on them. Tolerations
+                  can be set for the plugin pod to neutralize the Taint.
+                items:
+                  description: |-
+                    The pod this Toleration is attached to tolerates any taint that matches
+                    the triple <key,value,effect> using the matching operator <operator>.
+                  properties:
+                    effect:
+                      description: |-
+                        Effect indicates the taint effect to match. Empty means match all taint effects.
+                        When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
+                      type: string
+                    key:
+                      description: |-
+                        Key is the taint key that the toleration applies to. Empty means match all taint keys.
+                        If the key is empty, operator must be Exists; this combination means to match all values and all keys.
+                      type: string
+                    operator:
+                      description: |-
+                        Operator represents a key's relationship to the value.
+                        Valid operators are Exists and Equal. Defaults to Equal.
+                        Exists is equivalent to wildcard for value, so that a pod can
+                        tolerate all taints of a particular category.
+                      type: string
+                    tolerationSeconds:
+                      description: |-
+                        TolerationSeconds represents the period of time the toleration (which must be
+                        of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
+                        it is not set, which means tolerate the taint forever (do not evict). Zero and
+                        negative values will be treated as 0 (evict immediately) by the system.
+                      format: int64
+                      type: integer
+                    value:
+                      description: |-
+                        Value is the taint value the toleration matches to.
+                        If the operator is Exists, the value should be empty, otherwise just a regular string.
+                      type: string
+                  type: object
+                type: array
+            type: object
+          status:
+            description: NpuDevicePluginStatus defines the observed state of NpuDevicePlugin.
+            properties:
+              controlledDaemonSet:
+                description: ControlledDaemoSet references the DaemonSet controlled
+                  by the operator.
+                properties:
+                  apiVersion:
+                    description: API version of the referent.
+                    type: string
+                  fieldPath:
+                    description: |-
+                      If referring to a piece of an object instead of an entire object, this string
+                      should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2].
+                      For example, if the object reference is to a container within a pod, this would take on a value like:
+                      "spec.containers{name}" (where "name" refers to the name of the container that triggered
+                      the event) or if no container name is specified "spec.containers[2]" (container with
+                      index 2 in this pod). This syntax is chosen only to have some well-defined way of
+                      referencing a part of an object.
+                    type: string
+                  kind:
+                    description: |-
+                      Kind of the referent.
+                      More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+                    type: string
+                  name:
+                    description: |-
+                      Name of the referent.
+                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                    type: string
+                  namespace:
+                    description: |-
+                      Namespace of the referent.
+                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
+                    type: string
+                  resourceVersion:
+                    description: |-
+                      Specific resourceVersion to which this reference is made, if any.
+                      More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
+                    type: string
+                  uid:
+                    description: |-
+                      UID of the referent.
+                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids
+                    type: string
+                type: object
+                x-kubernetes-map-type: atomic
+              desiredNumberScheduled:
+                description: |-
+                  The total number of nodes that should be running the device plugin
+                  pod (including nodes correctly running the device plugin pod).
+                format: int32
+                type: integer
+              nodeNames:
+                description: The list of Node names where the device plugin pods are
+                  running.
+                items:
+                  type: string
+                type: array
+              numberReady:
+                description: |-
+                  The number of nodes that should be running the device plugin pod and have one
+                  or more of the device plugin pod running and ready.
+                format: int32
+                type: integer
+            required:
+            - desiredNumberScheduled
+            - numberReady
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}

deployments/operator/crd/kustomization.yaml

@@ -9,6 +9,7 @@ resources:
 - bases/deviceplugin.intel.com_dsadeviceplugins.yaml
 - bases/deviceplugin.intel.com_iaadeviceplugins.yaml
 - bases/deviceplugin.intel.com_dlbdeviceplugins.yaml
+- bases/deviceplugin.intel.com_npudeviceplugins.yaml
 - bases/fpga.intel.com_acceleratorfunctions.yaml
 - bases/fpga.intel.com_fpgaregions.yaml
 # +kubebuilder:scaffold:crdkustomizeresource

deployments/operator/device/npu/kustomization.yaml

@@ -0,0 +1,7 @@
+resources:
+ - ../../default
+
+patches:
+- path: npu.yaml
+  target:
+    kind: Deployment

deployments/operator/device/npu/npu.yaml

@@ -0,0 +1,14 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: intel-deviceplugins-controller-manager
+  namespace: inteldeviceplugins-system
+spec:
+  template:
+    spec:
+      containers:
+      - args:
+        - --metrics-bind-address=127.0.0.1:8080
+        - --leader-elect
+        - --devices=npu
+        name: manager

deployments/operator/rbac/role.yaml

@@ -64,6 +64,7 @@ rules:
   - fpgadeviceplugins
   - gpudeviceplugins
   - iaadeviceplugins
+  - npudeviceplugins
   - qatdeviceplugins
   - sgxdeviceplugins
   verbs:
@@ -82,6 +83,7 @@ rules:
   - fpgadeviceplugins/finalizers
   - gpudeviceplugins/finalizers
   - iaadeviceplugins/finalizers
+  - npudeviceplugins/finalizers
   - qatdeviceplugins/finalizers
   - sgxdeviceplugins/finalizers
   verbs:
@@ -94,6 +96,7 @@ rules:
   - fpgadeviceplugins/status
   - gpudeviceplugins/status
   - iaadeviceplugins/status
+  - npudeviceplugins/status
   - qatdeviceplugins/status
   - sgxdeviceplugins/status
   verbs:

deployments/operator/samples/deviceplugin_v1_npudeviceplugin.yaml

@@ -0,0 +1,10 @@
+apiVersion: deviceplugin.intel.com/v1
+kind: NpuDevicePlugin
+metadata:
+  name: npudeviceplugin-sample
+spec:
+  image: intel/intel-npu-plugin:0.32.0
+  sharedDevNum: 1
+  logLevel: 4
+  nodeSelector:
+    intel.feature.node.kubernetes.io/npu: "true"

deployments/operator/webhook/manifests.yaml

@@ -104,6 +104,26 @@ webhooks:
     resources:
     - iaadeviceplugins
   sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: webhook-service
+      namespace: system
+      path: /mutate-deviceplugin-intel-com-v1-npudeviceplugin
+  failurePolicy: Fail
+  name: mnpudeviceplugin.kb.io
+  rules:
+  - apiGroups:
+    - deviceplugin.intel.com
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - npudeviceplugins
+  sideEffects: None
 - admissionReviewVersions:
   - v1
   clientConfig:
@@ -290,6 +310,26 @@ webhooks:
     resources:
     - iaadeviceplugins
   sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: webhook-service
+      namespace: system
+      path: /validate-deviceplugin-intel-com-v1-npudeviceplugin
+  failurePolicy: Fail
+  name: vnpudeviceplugin.kb.io
+  rules:
+  - apiGroups:
+    - deviceplugin.intel.com
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - npudeviceplugins
+  sideEffects: None
 - admissionReviewVersions:
   - v1
   clientConfig: