Create NFD rule from the AIC controller

Create NFD rule from the AIC controller, to cut down a manual pre-requisite step.
Update Qualcomm license markings.

Change-Id: Idf89460c7dde6320301e216a1f850540f72338ec

Author: quic-vmellemp

Dockerfile

@@ -15,6 +15,7 @@ COPY cmd/main.go cmd/main.go
 COPY api/ api/
 COPY internal/controller/ internal/controller/
 COPY internal/kmmmodule/ internal/kmmmodule/
+COPY internal/nfdrule/ internal/nfdrule/
 
 # Build
 # the GOARCH has not a default value to allow the binary be built according to the host where the command
@@ -28,6 +29,8 @@ ARG VERSION=none
 RUN microdnf -y update
 WORKDIR /
 COPY --from=builder /opt/app-root/src/manager .
+RUN mkdir -p /opt/aic-manifests
+COPY --from=builder /opt/app-root/src/internal/nfdrule/qcom-aic-nfr.yaml /opt/aic-manifests/
 LABEL name="cloud_ai_openshift_operator" \
       maintainer="Qualcomm Innovation Center, Inc." \
       vendor="Qualcomm Innovation Center, Inc." \

README.md

@@ -8,14 +8,9 @@ This Operator relies on the Node Feature Discovery (NFD) and Kernel Module Manag
 (KMM) Operators. Be sure to install them from the OperatorHub (provided by Red Hat, not
 the Community).
 
-NFD and KMM both require addition configuration after they're installed. NFD requires the
-CRD located in [./manual_install/qcom-aic-rule-nfd.yaml](./manual_install/qcom-aic-rule-nfd.yaml) to be added to the cluster.
+NFD operator needs the default NodeFeatureDiscovery Custom Resource(CR) to be created after it's installed.
 
-```sh
-oc apply -f ./manual_install/qcom-aic-rule-nfd.yaml
-```
-
-KMM also requires configuration so that firmware can be located correctly. The following
+KMM requires configuration so that firmware can be located correctly. The following
 command should work for most clusters, but make sure to check that the
 'controler_config.yaml' section matches the existing configuration (note: ordering of the
 elements shouldn't matter (so long as they're under the correct heading (e.g. 'webhook',

aic-operator-deploy.yaml

@@ -295,6 +295,26 @@ rules:
   - get
   - patch
   - update
+- apiGroups:
+  - nfd.openshift.io
+  resources:
+  - nodefeaturerules
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - nfd.openshift.io
+  resources:
+  - nodefeaturerules/status
+  verbs:
+  - get
+  - patch
+  - update
 - apiGroups:
   - rbac.authorization.k8s.io
   resources:
@@ -519,7 +539,7 @@ spec:
         - --leader-elect
         command:
         - /manager
-        image: ##Replace with aic-operator image URL
+        image: ghcr.io/quic/cloud_ai_openshift_operator:0.1.1 ##Replace the image tag to use a different version of Operator
         imagePullPolicy: Always
         livenessProbe:
           httpGet:

cmd/main.go

@@ -15,7 +15,7 @@ limitations under the License.
 
 Based on code from https://github.com/yevgeny-shnaidman/amd-gpu-operator
 
-Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+Copyright (c) 2024-2025 Qualcomm Innovation Center, Inc. All rights reserved.
 SPDX-License-Identifier: BSD-3-Clause-Clear
 Not a contribution.
 */
@@ -43,7 +43,9 @@ import (
 	aicv1 "github.com/quic/aic-operator/api/v1"
 	"github.com/quic/aic-operator/internal/controller"
 	"github.com/quic/aic-operator/internal/kmmmodule"
+	"github.com/quic/aic-operator/internal/nfdrule"
 	kmmv1beta1 "github.com/rh-ecosystem-edge/kernel-module-management/api/v1beta1"
+	nfr "github.com/openshift/cluster-nfd-operator/api/v1alpha1"
 	//+kubebuilder:scaffold:imports
 )
 
@@ -56,6 +58,7 @@ func init() {
 	utilruntime.Must(clientgoscheme.AddToScheme(scheme))
 	utilruntime.Must(aicv1.AddToScheme(scheme))
 	utilruntime.Must(kmmv1beta1.AddToScheme(scheme))
+	utilruntime.Must(nfr.AddToScheme(scheme))
 	//+kubebuilder:scaffold:scheme
 }
 
@@ -132,10 +135,11 @@ func main() {
 
 	client := mgr.GetClient()
 	kmmHandler := kmmmodule.NewKMMModule(client, scheme)
+	nfdHandler := nfdrule.NewNFDRule(client, scheme)
 	aicr := controller.NewAICReconciler(
 		client,
 		mgr.GetScheme(),
-		kmmHandler)
+		kmmHandler, nfdHandler)
 
 	if err = aicr.SetupWithManager(mgr); err != nil {
 		setupLog.Error(err, "unable to create controller", "controller", "AIC")

go.mod

@@ -8,6 +8,7 @@ require (
 	github.com/a8m/envsubst v1.4.2
 	github.com/onsi/ginkgo/v2 v2.17.1
 	github.com/onsi/gomega v1.32.0
+	github.com/openshift/cluster-nfd-operator v0.0.0-20250423093037-ad5de3ee96a7
 	github.com/rh-ecosystem-edge/kernel-module-management v0.0.0-20240412150217-30de2c7d4ede
 	k8s.io/api v0.29.3
 	k8s.io/apimachinery v0.29.3

go.sum

@@ -82,6 +82,8 @@ github.com/onsi/ginkgo/v2 v2.17.1 h1:V++EzdbhI4ZV4ev0UTIj0PzhzOcReJFyJaLjtSF55M8
 github.com/onsi/ginkgo/v2 v2.17.1/go.mod h1:llBI3WDLL9Z6taip6f33H76YcWtJv+7R3HigUjbIBOs=
 github.com/onsi/gomega v1.32.0 h1:JRYU78fJ1LPxlckP6Txi/EYqJvjtMrDC04/MM5XRHPk=
 github.com/onsi/gomega v1.32.0/go.mod h1:a4x4gW6Pz2yK1MAmvluYme5lvYTn61afQ2ETw/8n4Lg=
+github.com/openshift/cluster-nfd-operator v0.0.0-20250423093037-ad5de3ee96a7 h1:ljGD4OXMcSGzksUQ4WHjpM9IZ48AhwucvrtZiLUVHmk=
+github.com/openshift/cluster-nfd-operator v0.0.0-20250423093037-ad5de3ee96a7/go.mod h1:oXNRM0qmbuFinGmQpC8xh0eLIMx8Z/1R9d/5HPjVCRM=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=

internal/controller/aic_controller.go

@@ -15,7 +15,7 @@ limitations under the License.
 
 Based on code from https://github.com/yevgeny-shnaidman/amd-gpu-operator
 
-Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+Copyright (c) 2024-2025 Qualcomm Innovation Center, Inc. All rights reserved.
 SPDX-License-Identifier: BSD-3-Clause-Clear
 Not a contribution.
 */
@@ -28,6 +28,7 @@ import (
 	"fmt"
 
 	kmmv1beta1 "github.com/rh-ecosystem-edge/kernel-module-management/api/v1beta1"
+	nfr "github.com/openshift/cluster-nfd-operator/api/v1alpha1"
 	v1 "k8s.io/api/core/v1"
 	k8serrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -40,6 +41,7 @@ import (
 
 	aicv1 "github.com/quic/aic-operator/api/v1"
 	"github.com/quic/aic-operator/internal/kmmmodule"
+	"github.com/quic/aic-operator/internal/nfdrule"
 )
 
 // AICReconciler reconciles an AIC object
@@ -54,6 +56,8 @@ type AICReconciler struct {
 //+kubebuilder:rbac:groups=aic.quicinc.com,resources=aics/finalizers,verbs=update
 //+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=modules,verbs=get;list;watch;create;patch;update;delete
 //+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=modules/status,verbs=get;update;patch
+//+kubebuilder:rbac:groups=nfd.openshift.io,resources=nodefeaturerules,verbs=get;list;watch;create;update;patch;delete
+//+kubebuilder:rbac:groups=nfd.openshift.io,resources=nodefeaturerules/status,verbs=get;update;patch
 //+kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterroles;clusterrolebindings;roles;rolebindings,verbs=get;list;watch;create;update;patch;delete
 //+kubebuilder:rbac:groups=core,resources=namespaces;serviceaccounts;pods;pods/exec;pods/attach;services;services/finalizers;endpoints,verbs=get;list;watch;create;update;patch;delete
 //+kubebuilder:rbac:groups=core,resources=configmaps;secrets;nodes,verbs=get;list;watch;create;update;patch;delete
@@ -63,8 +67,9 @@ type AICReconciler struct {
 func NewAICReconciler(
 	client client.Client,
 	scheme *runtime.Scheme,
-	kmmHandler kmmmodule.KMMModuleAPI) *AICReconciler {
-	helper := newAICReconcilerHelper(client, kmmHandler)
+	kmmHandler kmmmodule.KMMModuleAPI,
+        nfdHandler nfdrule.NFDRuleAPI) *AICReconciler {
+	helper := newAICReconcilerHelper(client, kmmHandler, nfdHandler)
 	return &AICReconciler{
 		Client: client,
 		Scheme: scheme,
@@ -114,6 +119,12 @@ func (r *AICReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.R
 		return res, fmt.Errorf("failed to set finalizer for AIC %s: %v", req.NamespacedName, err)
 	}
 
+	logger.Info("start NFR reconciliation")
+        err = r.helper.handleAICNFDRule(ctx, aic)
+        if err != nil {
+                return res, fmt.Errorf("failed to handle NFR creation %s: %v", req.NamespacedName, err)
+        }
+
 	logger.Info("start build configmap reconciliation")
 	// Always want to have the ConfigMap that can build module images
 	err = r.helper.handleBuildConfigMap(ctx, aic, false)
@@ -156,18 +167,21 @@ type AICReconcilerHelperAPI interface {
 	setFinalizer(ctx context.Context, aic *aicv1.AIC) error
 	handleBuildConfigMap(ctx context.Context, devConfig *aicv1.AIC, useInTree bool) error
 	handleKMMModule(ctx context.Context, devConfig *aicv1.AIC, loadedMods aicv1.LoadedModules) error
+	handleAICNFDRule(ctx context.Context, aic *aicv1.AIC) error
 }
 
 type AICReconcilerHelper struct {
 	client     client.Client
 	kmmHandler kmmmodule.KMMModuleAPI
+	nfdHandler nfdrule.NFDRuleAPI
 }
 
 func newAICReconcilerHelper(client client.Client,
-	kmmHandler kmmmodule.KMMModuleAPI) AICReconcilerHelperAPI {
+	kmmHandler kmmmodule.KMMModuleAPI, nfdHandler nfdrule.NFDRuleAPI) AICReconcilerHelperAPI {
 	return &AICReconcilerHelper{
 		client:     client,
 		kmmHandler: kmmHandler,
+		nfdHandler: nfdHandler,
 	}
 }
 func (aicrh *AICReconcilerHelper) getRequestedAIC(ctx context.Context, namespacedName types.NamespacedName) (*aicv1.AIC, error) {
@@ -215,12 +229,31 @@ func (aicrh *AICReconcilerHelper) finalizeAIC(ctx context.Context, aic *aicv1.AI
 			faults = append(faults, err)
 		}
 	}
+        //Delete NFR owned by AIC.
+	nfrObj := nfr.NodeFeatureRule{}
+	nsName := types.NamespacedName{
+		Namespace: aic.Namespace,
+		Name: "qcom-aic-nfr",
+	}
+	err = aicrh.client.Get(ctx, nsName, &nfrObj)
+	if err != nil {
+		if k8serrors.IsNotFound(err) {
+			deleted = append(deleted, err)
+		} else {
+			faults = append(faults, fmt.Errorf("failed to get the requested NFR %s: %w", nsName, err))
+		}
+	} else {
+		logger.Info("deleting NFR CR", "NFR", nsName)
+		if err = aicrh.client.Delete(ctx, &nfrObj); client.IgnoreNotFound(err) != nil {
+			faults = append(faults, err)
+		}
+	}
 
 	err = errors.Join(faults...)
 
 	//remove finalizer only if no faults occurred during removal
-	if len(deleted) == int(aicv1.None_loaded)+1 && err == nil {
-		logger.Info("modules already deleted, removing finalizer", "module", aic.Name)
+	if len(deleted) == int(aicv1.None_loaded)+2 && err == nil {
+		logger.Info("modules & NFR already deleted, removing finalizer", "module, NFR", aic.Name)
 		aicCopy := aic.DeepCopy()
 		controllerutil.RemoveFinalizer(aic, aicFinalizer)
 		return aicrh.client.Patch(ctx, aic, client.MergeFrom(aicCopy))
@@ -271,6 +304,25 @@ func (aicrh *AICReconcilerHelper) handleKMMModule(ctx context.Context, aic *aicv
 	return err
 }
 
+func (aicrh *AICReconcilerHelper) handleAICNFDRule(ctx context.Context, aic *aicv1.AIC) error {
+
+	nfrObj := &nfr.NodeFeatureRule{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: aic.Namespace,
+			Name:      "qcom-aic-nfr",
+		},
+	}
+        logger := log.FromContext(ctx)
+         opRes, err := controllerutil.CreateOrPatch(ctx, aicrh.client, nfrObj, func() error {
+                return aicrh.nfdHandler.SetNFRasDesired(nfrObj, aic)
+        })
+         if err != nil {
+                logger.Info("Reconciled NFR", "name", nfrObj.Name, "result", opRes)
+                 return err
+         }
+        return nil
+
+}
 func getDockerfileCMName(aic *aicv1.AIC, useInTree bool) string {
 	if useInTree {
 		return "dockerfile-intree-" + aic.Name

internal/nfdrule/qcom-aic-nfr.go

@@ -0,0 +1,68 @@
+/*
+Copyright (c) 2025 Qualcomm Innovation Center, Inc. All rights reserved.
+SPDX-License-Identifier: BSD-3-Clause-Clear.
+*/
+
+package nfdrule
+
+import (
+	_ "embed"
+	"fmt"
+	"io/ioutil"
+	"regexp"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"k8s.io/client-go/kubernetes/scheme"
+	"k8s.io/apimachinery/pkg/runtime/serializer/json"
+	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+
+	aicv1 "github.com/quic/aic-operator/api/v1"
+	nfr "github.com/openshift/cluster-nfd-operator/api/v1alpha1"
+)
+
+const (
+	qcom_aic_nfrmanifest = "/opt/aic-manifests/qcom-aic-nfr.yaml"
+)
+
+type NFDRuleAPI interface {
+	SetNFRasDesired(nfrObj *nfr.NodeFeatureRule, aic *aicv1.AIC) error
+}
+
+type nfdRule struct {
+	client client.Client
+	scheme *runtime.Scheme
+}
+
+func NewNFDRule(client client.Client, scheme *runtime.Scheme) NFDRuleAPI {
+	return &nfdRule{
+		client: client,
+		scheme: scheme,
+	}
+}
+
+func (nfrstruct *nfdRule) SetNFRasDesired(nfrObj *nfr.NodeFeatureRule, aic *aicv1.AIC) error {
+	err := parseNFR_Manifest(nfrObj, aic)
+	if err != nil {
+		return fmt.Errorf("failed to set NodeFeatureRule: %v", err)
+	}
+	return controllerutil.SetControllerReference(aic, nfrObj, nfrstruct.scheme)
+}
+
+func parseNFR_Manifest(nfrObj *nfr.NodeFeatureRule, aic *aicv1.AIC) error {
+	raw_manifest, err := ioutil.ReadFile(qcom_aic_nfrmanifest)
+        if err != nil {
+                return fmt.Errorf("Error encountered while reading NFR manifest %s : %v", qcom_aic_nfrmanifest, err)
+        }
+	s := json.NewYAMLSerializer(json.DefaultMetaFactory, scheme.Scheme, scheme.Scheme)
+	regex, _ := regexp.Compile(`\b(\w*kind:\w*)\B.*\b`)
+	kind := strings.TrimSpace(strings.Split(regex.FindString(string(raw_manifest)), ":")[1])
+	fmt.Println("Resource identified kind:", kind)
+	_, _, err = s.Decode(raw_manifest, nil, nfrObj)
+	if err != nil {
+		return fmt.Errorf("Error encountered while decoding %s resource in manifest %s: %v", "NodeFeatureRule", qcom_aic_nfrmanifest, err)
+	}
+	nfrObj.ObjectMeta.Namespace = aic.Namespace
+	return nil
+}

internal/nfdrule/qcom-aic-nfr.yaml

@@ -0,0 +1,47 @@
+apiVersion: nfd.openshift.io/v1alpha1
+kind: NodeFeatureRule
+metadata:
+  name: qcom-aic-nfr
+  namespace: aic-operator-system
+spec:
+  rules:
+    - name: "node.has_qaic_hw"
+      labels:
+        "qualcomm.com/qaic": "true"
+      matchFeatures:
+        - feature: pci.device
+          matchExpressions:
+            class:  {op: In, value: ["1200", "ff00"]}
+            vendor: {op: In, value: ["17cb"]}
+            device: {op: In, value: ["a100"]}
+    - name: "kernel.mhi_avail"
+      labels:
+        "qualcomm.com/mhi_in_kernel": "true"
+      matchFeatures:
+      - feature: rule.matched
+        matchExpressions:
+          "qualcomm.com/qaic": {op: IsTrue}
+      - feature: kernel.config
+        matchExpressions:
+          MHI_BUS: {op: In, value: ["y","m"]}
+    - name: "kernel.qaic_avail"
+      labels:
+        "qualcomm.com/qaic_in_kernel": "true"
+      matchFeatures:
+      - feature: rule.matched
+        matchExpressions:
+          "qualcomm.com/qaic": {op: IsTrue}
+      - feature: kernel.config
+        matchExpressions:
+          DRM_ACCEL_QAIC: {op: In, value: ["y","m"]}
+    - name: "kernel.not_mhi_qaic"
+      labels:
+        "qualcomm.com/not_mhi_qaic": "true"
+      matchFeatures:
+      - feature: rule.matched
+        matchExpressions:
+          "qualcomm.com/qaic": {op: IsTrue}
+      - feature: kernel:loadedmodule
+        matchExpressions:
+          qaic: {op: DoesNotExist}
+          mhi: {op: DoesNotExist}