DOCA Platform Framework (DPF)

NVIDIA DOCA Platform Framework (DPF) enables platform teams to provision and operate BlueField DPUs and their infrastructure services consistently at fleet scale. It is a cloud-native infrastructure orchestration platform and implementation blueprint within NVIDIA DOCA that extends cloud infrastructure control-plane operations to BlueField, turning each DPU into a programmable infrastructure services plane for networking, storage, security, and operations.

DPF provides an orchestration layer with declarative APIs for provisioning BlueField DPUs and deploying, chaining, and operating NVIDIA DOCA microservices and compatible third-party DPU services at cluster scale. DPF is intended for cloud and AI factory providers, telecommunications operators, enterprises, and infrastructure software vendors that need a consistent way to operate BlueField-enabled systems. Detailed installation, API, architecture, and operations information is available in the standalone DPF documentation.

Getting Started with DPF

This page provides a high-level overview of DPF. Detailed prerequisites and installation procedures are maintained in the standalone DPF documentation.

For an end-to-end validated configuration, select one of the DPF Validated Reference Deployment Guides later on this page.

Why DPF

BlueField offloads, accelerates, and isolates infrastructure processing from the host CPU. Operating BlueField at fleet scale requires platform teams to coordinate device provisioning, software and firmware lifecycle, service deployment, connectivity, upgrades, and health monitoring. Fragmented tools and device-by-device workflows make it difficult to keep software, configuration, and services consistent across the fleet. DPF provides a common orchestration layer for these operations.

DPF organizes these capabilities into two primary workflows:

• DPU provisioning and lifecycle management – Discovers and provisions BlueField DPUs, applies the BlueField bundle (BFB) and device configuration, integrates DPUs into a Kubernetes-managed environment, and coordinates upgrades and operational health.

• DPU service management and orchestration – Deploys, configures, updates, monitors, and removes NVIDIA DOCA microservices and compatible third-party services on BlueField DPUs.

DPF provides the following capabilities:

• Kubernetes APIs and Custom Resource Definitions (CRDs) for declarative DPU and service management

• Fleet-wide lifecycle management for BlueField software and services

• One or more dedicated DPU clusters for running infrastructure services separately from host workloads

• Coordinated deployment of multiple services through DPUDeployment

• Service function chaining for steering traffic through ordered NVIDIA and compatible third-party network services

• Host Trusted and Zero Trust deployment models

• Operational status, health conditions, observability integration, and troubleshooting tools

• An open-source framework and DPUService development model for ecosystem integration

Architecture

DPF's Kubernetes-based DPU control plane uses two cooperating cluster roles: a DPF management cluster (also called the host cluster in the standalone DPF documentation) and one or more DPU clusters. A complete DPF deployment requires both roles to provide the control and execution environments for BlueField lifecycle and DPU-service orchestration.

• The DPF management cluster runs the DPF Operator and controllers that manage BlueField provisioning, DPUService deployment, and service chains. In the default architecture, it also hosts the Kubernetes control-plane components for the DPU clusters.

• Each DPU cluster groups BlueField DPUs as Kubernetes nodes and provides the Kubernetes environment in which DPF-managed system components, NVIDIA DOCA microservices, and compatible third-party services operate.

DPF's native control interface is the DPF management cluster's Kubernetes API. Platform administrators can use it directly, or a higher-level infrastructure platform can translate infrastructure intent into DPF resources and consume their reported status. DPF continuously checks and adjusts DPU clusters, BlueField DPUs, and DPU services so their actual state matches the declared state, reducing the need to manage individual DPUs during normal operations.

Figure 1. DPF high-level architecture showing infrastructure orchestration, the DPF control plane, and the BlueField DPU fleet.

DPF extends Kubernetes orchestration to one or more DPU clusters, coordinating BlueField lifecycle, DPU-service deployment and chaining, and fleet health. The services shown are representative; verify release-specific support in the standalone DPF documentation.

Where DPF Fits

For component-level details, refer to the standalone DPF documentation.

Deployment Models

DPF provides two deployment models so infrastructure operators can align BlueField DPU management with both their trust boundary and cloud operating model. In both models, the DPF control plane runs on Kubernetes and exposes DPF provisioning and service APIs through DPF custom resource definitions (CRDs). The models differ in where the DPF management cluster runs, whether the host is trusted, and how DPF reaches the DPU.

• Host Trusted – The DPF control plane runs on the infrastructure Kubernetes cluster that also manages the hosts, workloads, and infrastructure services. The host is a trusted worker in that cluster, and its BlueField DPU is provisioned and managed in-band through the host. This model uses one infrastructure administration domain and software isolation.

• Zero Trust – The DPF control plane runs on a DPF management cluster separate from tenant hosts. The cloud infrastructure platform manages host lifecycle and declares the desired DPU and service state through DPF APIs. DPF provisions BlueField DPUs through the BMC using Redfish over a dedicated out-of-band (OOB) network and operates DPU services through each DPU cluster's Kubernetes control plane. Tenant hosts remain outside the DPF management plane, supporting separated infrastructure and tenant administration.

For an NVIDIA example of a higher-level cloud infrastructure integration, see NVIDIA Platform Integrations later on this page.

Figure 2. DPF Trusted and Zero Trust deployment models.

Both models run the DPF control plane on Kubernetes and expose the same provisioning and service APIs. In Host Trusted deployments, DPF shares the infrastructure Kubernetes cluster and manages the DPU in-band through the trusted host. In Zero Trust deployments, the cloud infrastructure platform manages host lifecycle and declares DPU and service state through DPF APIs; DPF provisions BlueField through the BMC over a dedicated OOB network and operates services through each DPU cluster's Kubernetes control plane.

For deployment workflows and security considerations, refer to the standalone DPF documentation.

Platform Support

DPU Services Supported by DPF

DPF can orchestrate NVIDIA DOCA, upstream, and compatible third-party services. The following table highlights representative services. Service availability, quality level, and compatibility are release-specific; verify them in the current DPF documentation and NVIDIA DOCA documentation.

DPF can also orchestrate compatible third-party applications packaged as DPUService resources. A DPUService typically includes one or more Arm64 container images, a Helm chart, and the configuration required to deploy the application to one or more DPU clusters. A compatible third-party network service can also participate in a service chain when it exposes the required DPUServiceInterface endpoints.

Service Function Chaining

Service function chaining steers traffic through an ordered set of network services on BlueField. DPF uses declarative APIs to describe the service interfaces and the connections between them:

• DPUServiceInterface declares a physical uplink, host-facing PF or VF, OVS patch interface, or interface exposed by a service.

• DPUServiceChain selects interfaces and defines how they are connected. A chain can reference interfaces exposed by NVIDIA services and compatible third-party DPUService resources.

• DPF service-chain controllers reconcile the configuration to the selected DPU clusters and program the required OVS ports and flows.

• OVS-DOCA is a DPF dependency included in the DOCA BFB image that DPF deploys on BlueField. It provides the accelerated data path and is not an optional chained DPUService.

The following conceptual host-to-fabric egress example offloads Kubernetes networking to OVN-Kubernetes, inserts an optional compatible third-party inline network function, such as a packet-inspection service, and adds DOCA HBN for BGP routing, EVPN, L4 firewall, NAT, and ECMP across two physical uplinks before traffic reaches the data-center fabric.

Figure 3. Conceptual DPF host-to-fabric service-chain example.

DPF reconciles the declared services, interfaces, and chain connectivity; OVS-DOCA provides the accelerated data path. The optional third-party network function represents a compatible service exposing the required DPUServiceInterface endpoints. DOCA HBN provides BGP/EVPN routing, L4 firewall and NAT, and ECMP across two physical uplinks. Actual service composition and order depend on the deployment.

Not every service deployed by DPF is an inline network function. Compatible third-party network services can participate in the packet path when they expose the required interfaces. Endpoint and supporting services can instead be lifecycle-managed alongside a chain. For example, DOCA SNAP presents accelerated block storage through SNAP Block (NVMe) and file storage through SNAP Virtio-fs over PCIe, DOCA Argus observes host activity from the DPU, and DOCA Firefly provides precision time synchronization. These services are not inserted into the network packet path shown in Figure 3.

DPF Validated Reference Deployment Guides

NVIDIA Networking Solutions publishes step-by-step Reference Deployment Guides (RDGs) for validated DPF configurations. Each RDG is a point-in-time validated deployment; follow the software versions, prerequisites, and bill of materials specified in that guide.

Choose an RDG first by deployment model, then by the service combination in its title. Refer to DPU Services Supported by DPF above for a summary of each service's role.

Host Trusted

Zero Trust

Operations and Monitoring

For the current catalog, refer to DPF – DOCA Platform Framework in NVIDIA Networking Solutions. For product architecture, supported configurations, and other deployment procedures, refer to the standalone DPF documentation.

NVIDIA Platform Integrations

DPF integrates with NVIDIA infrastructure platforms to extend BlueField lifecycle and DPU-service orchestration into broader AI infrastructure workflows.

• NVIDIA AI Enterprise – In supported NVIDIA AI Enterprise deployments, DPF provides BlueField lifecycle and DPU-service orchestration.

• NVIDIA DSX OS – In a DPF-integrated Zero Trust deployment, NVIDIA Infra Controller (NICo) orchestrates site, rack, and host lifecycle and can use DPF as the DPU provisioning strategy for selected hosts. NICo declares the required DPU and service state through DPF Kubernetes APIs; DPF orchestrates BlueField provisioning, DPU-cluster operations, and DPU-service deployments. For deployment details, refer to DPF Setup for NICo Integration.

Next Steps

Additional resources: NVIDIA DOCA Software Platform · DPF product introduction · NVIDIA DSX OS overview

Last updated: September 01, 2026