DOCA Platform Framework v26.4.1

This is a patch release on top of the 26.4.0 release of the DOCA Platform Framework (DPF). It includes bug fixes and improvements to enhance the provisioning and orchestration of NVIDIA BlueField DPUs in Kubernetes environments.

The release notes for 26.4.0 still apply for this release and information presented in this documentation is an amendment to the previous release notes.

Revision History

Features

• Configurable host OOB management bridge name

  • The out-of-band DPU management bridge on host-trusted worker nodes is now configurable via DPFOperatorConfig.spec.networking.dpuNodeOOBBridgeName (default: br-dpu).

• Host agent driver rebind endpoint

  • The host agent exposes an HTTP endpoint to rebind the host-side driver after a DPU reboot, supporting recovery of host networking after DPU reset.

• Faster host-trusted host agent install phase

  • In Host Trusted mode, the host agent install phase now completes once DMS returns, without waiting for the DPU agent.

• SR-IOV device plugin devinfo volume

  • The DPF-managed SR-IOV device plugin pod now mounts a devinfo volume, aligning with upstream device plugin contributions for improved device discovery.

• Opt-in NoExecute taint for host network readiness

  • Description: DPF can now apply a NoExecute taint to a host worker node when its Ready-phase DPU reports HostNetworkReady != True (for example, after the DPU reboots or host VFs disappear), evicting workloads that depend on host networking instead of merely blocking new scheduling. The feature is opt-in and disabled by default; enable it by setting DPFOperatorConfig.spec.dpuServiceController.disableHostNetworkReadyNoExecuteTaints to false. It is independent from, and can be combined with, the existing critical DPUService NoSchedule taint. DPF system hostNetwork DaemonSets already tolerate the new taint; customer-managed hostNetwork workloads that must stay on the node need to add the matching toleration.

  • For details, see Host Network Readiness NoExecute Taints.

Improvements

• Kamaji prerequisite bumped to v1.36.0-26.6.4

  • The Kamaji image and Helm chart used in DPF prerequisites are updated, including a longer Helm install timeout to accommodate long image pulls, and kubelet compatibility patches for current BFB kubelet versions.

• Reduced hugepage reservation in DPU flavor examples

  • Example and fixture DPU flavors reserve fewer hugepages now that OVS only requires 500 MB.

Fixed Issues from Previous Release

• NetworkManager failures for bridge-member VFs and MTU flapping

  • Fixed NetworkManager backend handling that could fail when configuring bridge-member VFs or when MTU changes caused flapping.

• Host VF configuration reliability

  • Bind mlx5_core to DPU PFs before configuring VFs.

  • Persist a udev rule so VFs remain unmanaged by NetworkManager across reboots.

  • Pass VF count on the host agent configure-host-vfs route.

  • Add a reset-capable trigger-reboot POST route on the host agent.

• DPU agent done marker written too early

  • The DPU agent now writes the done marker file only after all provisioning operations complete.

• BFB registry nginx updated for CVE-2026-42055

  • The bundled bfb-registry image now uses NGINX 1.30.3.

• BFB registry service AlreadyExists during startup

  • Treat AlreadyExists as success when ensuring the bfb-registry Service so manager startup does not fail on cache/write timing races.

• osInstallTimeout default mismatch

  • Align the provisioning controller fallback with the CRD default of 60m when osInstallTimeout is omitted.

• RHCOS / OpenShift DOCA library resolution for SFC

  • Mount host linker config and /usr/opt so containers can resolve DOCA libraries installed under RHCOS paths. Configurable via operator overrides (mountHostLinkerConfig).

  • Internal Ref #5091025

• OpenShift SecurityContextConstraints

  • Bind the privileged SCC to the DPF namespace so additional ServiceAccounts (including DPUService and metrics components) receive the required permissions.

• DPUServiceCredentialRequest credentials after DPUCluster recreation

  • Watch DPUCluster identity (UID) and refresh credentials when a DPUCluster is recreated.

• Argo CD Helm release names and DNS-1035

  • Generate DNS-1035-compliant Helm release names for Argo CD Applications so dependent Kubernetes Services can be created successfully.

• OpenShift kubelet version reporting

  • Read kubelet version from Node status.nodeInfo when the DPU agent does not advertise it (OpenShift).

• Stale custom labels on DPUNode

  • Remove custom labels from DPUNode during DPU node maintenance cleanup.

Last updated: August 31, 2026