WIP: DNM: per-nodegroup SCC toggle

api/numaresourcesoperator/v1/numaresourcesoperator_types.go

@@ -111,6 +111,10 @@ type NodeGroupConfig struct {
 	Tolerations []corev1.Toleration `json:"tolerations,omitempty"`
 }
 
+const (
+	NodeGroupMaxAnnotations = 8
+)
+
 // NodeGroup defines group of nodes that will run resource topology exporter daemon set
 // You can choose the group of node by MachineConfigPoolSelector or by PoolName
 type NodeGroup struct {
@@ -123,6 +127,11 @@ type NodeGroup struct {
 	// PoolName defines the pool name to which the nodes belong that the config of this node group will be applied to
 	// +optional
 	PoolName *string `json:"poolName,omitempty"`
+	// Annotations is the per-nodegroup equivalent of the per-object annotations.
+	// Unlike the regular annotations, there is a hard limit of supported annotations, dependent on the operator version.
+	// In general, prefer to use per-object standard annotations.
+	// +optional
+	Annotations map[string]string `json:"annotations,omitempty"`
 }
 
 // NodeGroupStatus reports the status of a NodeGroup once matches an actual set of nodes and it is correctly processed

bundle/manifests/nodetopology.openshift.io_numaresourcesoperators.yaml

@@ -64,6 +64,14 @@ spec:
                     NodeGroup defines group of nodes that will run resource topology exporter daemon set
                     You can choose the group of node by MachineConfigPoolSelector or by PoolName
                   properties:
+                    annotations:
+                      additionalProperties:
+                        type: string
+                      description: |-
+                        Annotations is the per-nodegroup equivalent of the per-object annotations.
+                        Unlike the regular annotations, there is a hard limit of supported annotations, dependent on the operator version.
+                        In general, prefer to use per-object standard annotations.
+                      type: object
                     config:
                       description: Config defines the RTE behavior for this NodeGroup
                       properties:

config/crd/bases/nodetopology.openshift.io_numaresourcesoperators.yaml

@@ -64,6 +64,14 @@ spec:
                     NodeGroup defines group of nodes that will run resource topology exporter daemon set
                     You can choose the group of node by MachineConfigPoolSelector or by PoolName
                   properties:
+                    annotations:
+                      additionalProperties:
+                        type: string
+                      description: |-
+                        Annotations is the per-nodegroup equivalent of the per-object annotations.
+                        Unlike the regular annotations, there is a hard limit of supported annotations, dependent on the operator version.
+                        In general, prefer to use per-object standard annotations.
+                      type: object
                     config:
                       description: Config defines the RTE behavior for this NodeGroup
                       properties:

controllers/numaresourcesoperator_controller.go

@@ -546,7 +546,9 @@ func (r *NUMAResourcesOperatorReconciler) syncNUMAResourcesOperatorResources(ctx
 		}
 		rteupdate.DaemonSetHashAnnotation(r.RTEManifests.Core.DaemonSet, cmHash)
 	}
-	rteupdate.SecurityContextConstraint(r.RTEManifests.Core.SecurityContextConstraint, annotations.IsCustomPolicyEnabled(instance.Annotations))
+
+	rteupdate.SecurityContextConstraint(r.RTEManifests.Core.SecurityContextConstraint, true) // force to legacy context
+	// SCC v2 needs no updates
 
 	existing = existing.WithManifestsUpdater(func(poolName string, gdm *rtestate.GeneratedDesiredManifest) error {
 		err := daemonsetUpdater(poolName, gdm)