feat(helm): Allow control of hostUsers #2411

jcpunk · 2026-01-13T17:45:51Z

By default this will render nothing, so folks without the feature gate should see no changes.

k8s-ci-robot · 2026-01-13T17:46:02Z

Hi @jcpunk. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

k8s-ci-robot · 2026-01-13T17:46:06Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: jcpunk
Once this PR has been reviewed and has the lgtm label, please assign marquiz for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

netlify · 2026-01-13T17:46:14Z

✅ Deploy Preview for kubernetes-sigs-nfd ready!

Name	Link
🔨 Latest commit	`6ccee5c`
🔍 Latest deploy log	https://app.netlify.com/projects/kubernetes-sigs-nfd/deploys/6967bfce5881760008ebb19a
😎 Deploy Preview	https://deploy-preview-2411--kubernetes-sigs-nfd.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

Copilot

Pull request overview

This pull request adds support for controlling the hostUsers field in Kubernetes pod specifications across all NFD components (master, worker, topology updater, and garbage collector). The hostUsers field is a Kubernetes feature that allows users to control whether containers should use host user IDs, and is particularly important when hostNetwork is enabled.

Changes:

Added hostUsers configuration option to master, worker, topologyUpdater, and gc components
Updated Helm templates to conditionally render the hostUsers field when set to a boolean value
Updated JSON schema validation and documentation

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
deployment/helm/node-feature-discovery/values.yaml	Added `hostUsers` configuration field with default NULL value for all four components
deployment/helm/node-feature-discovery/templates/master.yaml	Added conditional rendering of `hostUsers` field in pod spec
deployment/helm/node-feature-discovery/templates/worker.yaml	Added conditional rendering of `hostUsers` field in pod spec
deployment/helm/node-feature-discovery/templates/topologyupdater.yaml	Added conditional rendering of `hostUsers` field in pod spec
deployment/helm/node-feature-discovery/templates/nfd-gc.yaml	Added conditional rendering of `hostUsers` field in pod spec
deployment/helm/node-feature-discovery/values.schema.json	Added schema validation for `hostUsers` as boolean or null type
deployment/helm/node-feature-discovery/README.md	Auto-generated documentation update for new `hostUsers` parameter
docs/deployment/helm.md	Auto-generated documentation update for new `hostUsers` parameter

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-01-13T17:51:01Z

deployment/helm/node-feature-discovery/values.yaml

+  # @schema type: [boolean, null]
+  # -- Run the container with host user ids. NOTE: if hostNetwork is true, hostUsers should be true.
+  # @section -- NFD-Topology-Updater
+  hostUsers: NULL


The value NULL is not a valid YAML null value. In YAML, null values should be represented either by omitting the value entirely (e.g., hostUsers:) or using lowercase null. The uppercase NULL will be treated as a string literal, not a null value. This should be changed to an empty value like other similar fields in this file (e.g., tag:, instance:, resyncPeriod:, nfdApiParallelism:).

Suggested change

hostUsers: NULL

hostUsers:

Copilot · 2026-01-13T17:51:01Z

deployment/helm/node-feature-discovery/values.yaml

+  # @schema type: [boolean, null]
+  # -- Run the container with host user ids. NOTE: if hostNetwork is true, hostUsers should be true.
+  # @section -- NFD-GC
+  hostUsers: NULL


The value NULL is not a valid YAML null value. In YAML, null values should be represented either by omitting the value entirely (e.g., hostUsers:) or using lowercase null. The uppercase NULL will be treated as a string literal, not a null value. This should be changed to an empty value like other similar fields in this file (e.g., tag:, instance:, resyncPeriod:, nfdApiParallelism:).

Suggested change

hostUsers: NULL

hostUsers:

Copilot · 2026-01-13T17:51:02Z

deployment/helm/node-feature-discovery/values.yaml

+  # @schema type: [boolean, null]
+  # -- Run the container with host user ids. NOTE: if hostNetwork is true, hostUsers should be true.
+  # @section -- NFD-Master
+  hostUsers: NULL


The value NULL is not a valid YAML null value. In YAML, null values should be represented either by omitting the value entirely (e.g., hostUsers:) or using lowercase null. The uppercase NULL will be treated as a string literal, not a null value. This should be changed to an empty value like other similar fields in this file (e.g., tag:, instance:, resyncPeriod:, nfdApiParallelism:).

Suggested change

hostUsers: NULL

hostUsers:

Copilot · 2026-01-13T17:51:02Z

deployment/helm/node-feature-discovery/values.yaml

+  # @schema type: [boolean, null]
+  # -- Run the container with host user ids. NOTE: if hostNetwork is true, hostUsers should be true.
+  # @section -- NFD-Worker
+  hostUsers: NULL


The value NULL is not a valid YAML null value. In YAML, null values should be represented either by omitting the value entirely (e.g., hostUsers:) or using lowercase null. The uppercase NULL will be treated as a string literal, not a null value. This should be changed to an empty value like other similar fields in this file (e.g., tag:, instance:, resyncPeriod:, nfdApiParallelism:).

Suggested change

hostUsers: NULL

hostUsers:

ArangoGutierrez · 2026-01-13T17:51:30Z

deployment/helm/node-feature-discovery/README.md

 | master.extraArgs | list | `[]` | Additional [command line arguments](https://kubernetes-sigs.github.io/node-feature-discovery/master/reference/master-commandline-reference) to pass to nfd-master. |
 | master.extraEnvs | list | `[]` | Additional environment variables to set in the nfd-master container. |
 | master.hostNetwork | bool | `false` | Run the container in the host's network namespace. |
+| master.hostUsers | string | `nil` | Run the container with host user ids. NOTE: if hostNetwork is true, hostUsers should be true. |


Here you say string but declare the var as a bool

I think that is a byproduct of me using NULL instead of null... I'll see about fixing.

hmmm, not sure why this is getting picked up as string by the helm schema but not the doc generation...

@marquiz any advice here?

ArangoGutierrez · 2026-01-13T17:51:43Z

deployment/helm/node-feature-discovery/values.yaml

+  # @schema type: [boolean, null]
+  # -- Run the container with host user ids. NOTE: if hostNetwork is true, hostUsers should be true.
+  # @section -- NFD-Master
+  hostUsers: NULL


Shouldn't it be false instead of NULL?

The string false will opt into user namespaces. For folks on kubernetes 1.32 and earlier, if they don't have the right feature flags enabled, having hostUsers set could cause scheduling issues.

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 8 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-01-14T12:55:23Z

docs/deployment/helm.md

 | master.extraArgs | list | `[]` | Additional [command line arguments](https://kubernetes-sigs.github.io/node-feature-discovery/master/reference/master-commandline-reference) to pass to nfd-master. |
 | master.extraEnvs | list | `[]` | Additional environment variables to set in the nfd-master container. |
 | master.hostNetwork | bool | `false` | Run the container in the host's network namespace. |
+| master.hostUsers | string | `nil` | Run the container with host user ids. NOTE: if hostNetwork is true, hostUsers should be true. |


The Type column shows "string" but the actual type according to the schema (values.schema.json) is boolean or null. This is misleading to users. The Type should be "bool" to match the actual Kubernetes API field type for hostUsers, which is a boolean field in PodSpec.

Suggested change

| master.hostUsers | string | `nil` | Run the container with host user ids. NOTE: if hostNetwork is true, hostUsers should be true. |

| master.hostUsers | bool | `nil` | Run the container with host user ids. NOTE: if hostNetwork is true, hostUsers should be true. |

Copilot · 2026-01-14T12:55:24Z

docs/deployment/helm.md

 | worker.extraArgs | list | `[]` | Additional [command line arguments](https://kubernetes-sigs.github.io/node-feature-discovery/master/reference/worker-commandline-reference) to pass to nfd-worker. |
 | worker.extraEnvs | list | `[]` | Additional environment variables to set in the nfd-worker container. |
 | worker.hostNetwork | bool | `false` | Run the container in the host's network namespace. |
+| worker.hostUsers | string | `nil` | Run the container with host user ids. NOTE: if hostNetwork is true, hostUsers should be true. |


The Type column shows "string" but the actual type according to the schema (values.schema.json) is boolean or null. This is misleading to users. The Type should be "bool" to match the actual Kubernetes API field type for hostUsers, which is a boolean field in PodSpec.

Suggested change

| worker.hostUsers | string | `nil` | Run the container with host user ids. NOTE: if hostNetwork is true, hostUsers should be true. |

| worker.hostUsers | bool | `nil` | Run the container with host user ids. NOTE: if hostNetwork is true, hostUsers should be true. |

Copilot · 2026-01-14T12:55:24Z

docs/deployment/helm.md

 | topologyUpdater.extraArgs | list | `[]` | Additional [command line arguments](https://kubernetes-sigs.github.io/node-feature-discovery/master/reference/topology-updater-commandline-reference) to pass to nfd-topology-updater. |
 | topologyUpdater.extraEnvs | list | `[]` | Additional environment variables to set in the nfd-topology-updater container. |
 | topologyUpdater.hostNetwork | bool | `false` | Run the container in the host's network namespace. |
+| topologyUpdater.hostUsers | string | `nil` | Run the container with host user ids. NOTE: if hostNetwork is true, hostUsers should be true. |


The Type column shows "string" but the actual type according to the schema (values.schema.json) is boolean or null. This is misleading to users. The Type should be "bool" to match the actual Kubernetes API field type for hostUsers, which is a boolean field in PodSpec.

Suggested change

| topologyUpdater.hostUsers | string | `nil` | Run the container with host user ids. NOTE: if hostNetwork is true, hostUsers should be true. |

| topologyUpdater.hostUsers | bool | `nil` | Run the container with host user ids. NOTE: if hostNetwork is true, hostUsers should be true. |

Copilot · 2026-01-14T12:55:25Z

docs/deployment/helm.md

 | gc.extraArgs | list | `[]` | Additional [command line arguments](https://kubernetes-sigs.github.io/node-feature-discovery/master/reference/gc-commandline-reference) to pass to nfd-gc. |
 | gc.extraEnvs | list | `[]` | Additional environment variables to set in the nfd-gc container. |
 | gc.hostNetwork | bool | `false` | Run the container in the host's network namespace. |
+| gc.hostUsers | string | `nil` | Run the container with host user ids. NOTE: if hostNetwork is true, hostUsers should be true. |


The Type column shows "string" but the actual type according to the schema (values.schema.json) is boolean or null. This is misleading to users. The Type should be "bool" to match the actual Kubernetes API field type for hostUsers, which is a boolean field in PodSpec.

Suggested change

| gc.hostUsers | string | `nil` | Run the container with host user ids. NOTE: if hostNetwork is true, hostUsers should be true. |

| gc.hostUsers | bool | `nil` | Run the container with host user ids. NOTE: if hostNetwork is true, hostUsers should be true. |

Copilot · 2026-01-14T12:55:25Z

deployment/helm/node-feature-discovery/README.md

 | master.extraArgs | list | `[]` | Additional [command line arguments](https://kubernetes-sigs.github.io/node-feature-discovery/master/reference/master-commandline-reference) to pass to nfd-master. |
 | master.extraEnvs | list | `[]` | Additional environment variables to set in the nfd-master container. |
 | master.hostNetwork | bool | `false` | Run the container in the host's network namespace. |
+| master.hostUsers | string | `nil` | Run the container with host user ids. NOTE: if hostNetwork is true, hostUsers should be true. |


The Type column shows "string" but the actual type according to the schema (values.schema.json) is boolean or null. This is misleading to users. The Type should be "bool" to match the actual Kubernetes API field type for hostUsers, which is a boolean field in PodSpec.

Suggested change

| master.hostUsers | string | `nil` | Run the container with host user ids. NOTE: if hostNetwork is true, hostUsers should be true. |

| master.hostUsers | bool | `nil` | Run the container with host user ids. NOTE: if hostNetwork is true, hostUsers should be true. |

Copilot · 2026-01-14T12:55:25Z

deployment/helm/node-feature-discovery/README.md

 | worker.extraArgs | list | `[]` | Additional [command line arguments](https://kubernetes-sigs.github.io/node-feature-discovery/master/reference/worker-commandline-reference) to pass to nfd-worker. |
 | worker.extraEnvs | list | `[]` | Additional environment variables to set in the nfd-worker container. |
 | worker.hostNetwork | bool | `false` | Run the container in the host's network namespace. |
+| worker.hostUsers | string | `nil` | Run the container with host user ids. NOTE: if hostNetwork is true, hostUsers should be true. |


The Type column shows "string" but the actual type according to the schema (values.schema.json) is boolean or null. This is misleading to users. The Type should be "bool" to match the actual Kubernetes API field type for hostUsers, which is a boolean field in PodSpec.

Suggested change

| worker.hostUsers | string | `nil` | Run the container with host user ids. NOTE: if hostNetwork is true, hostUsers should be true. |

| worker.hostUsers | bool | `nil` | Run the container with host user ids. NOTE: if hostNetwork is true, hostUsers should be true. |

Copilot · 2026-01-14T12:55:25Z

deployment/helm/node-feature-discovery/README.md

 | topologyUpdater.extraArgs | list | `[]` | Additional [command line arguments](https://kubernetes-sigs.github.io/node-feature-discovery/master/reference/topology-updater-commandline-reference) to pass to nfd-topology-updater. |
 | topologyUpdater.extraEnvs | list | `[]` | Additional environment variables to set in the nfd-topology-updater container. |
 | topologyUpdater.hostNetwork | bool | `false` | Run the container in the host's network namespace. |
+| topologyUpdater.hostUsers | string | `nil` | Run the container with host user ids. NOTE: if hostNetwork is true, hostUsers should be true. |


The Type column shows "string" but the actual type according to the schema (values.schema.json) is boolean or null. This is misleading to users. The Type should be "bool" to match the actual Kubernetes API field type for hostUsers, which is a boolean field in PodSpec.

Suggested change

| topologyUpdater.hostUsers | string | `nil` | Run the container with host user ids. NOTE: if hostNetwork is true, hostUsers should be true. |

| topologyUpdater.hostUsers | bool | `nil` | Run the container with host user ids. NOTE: if hostNetwork is true, hostUsers should be true. |

Copilot · 2026-01-14T12:55:26Z

deployment/helm/node-feature-discovery/README.md

 | gc.extraArgs | list | `[]` | Additional [command line arguments](https://kubernetes-sigs.github.io/node-feature-discovery/master/reference/gc-commandline-reference) to pass to nfd-gc. |
 | gc.extraEnvs | list | `[]` | Additional environment variables to set in the nfd-gc container. |
 | gc.hostNetwork | bool | `false` | Run the container in the host's network namespace. |
+| gc.hostUsers | string | `nil` | Run the container with host user ids. NOTE: if hostNetwork is true, hostUsers should be true. |


The Type column shows "string" but the actual type according to the schema (values.schema.json) is boolean or null. This is misleading to users. The Type should be "bool" to match the actual Kubernetes API field type for hostUsers, which is a boolean field in PodSpec.

Suggested change

| gc.hostUsers | string | `nil` | Run the container with host user ids. NOTE: if hostNetwork is true, hostUsers should be true. |

| gc.hostUsers | bool | `nil` | Run the container with host user ids. NOTE: if hostNetwork is true, hostUsers should be true. |

Fixes: kubernetes-sigs#2397 Signed-off-by: Pat Riehecky <[email protected]>

k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Jan 13, 2026

k8s-ci-robot requested review from PiotrProkop and zvonkok January 13, 2026 17:46

k8s-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Jan 13, 2026

ArangoGutierrez removed the request for review from zvonkok January 13, 2026 17:46

jcpunk force-pushed the hostUsers branch from 3d05af7 to a179212 Compare January 13, 2026 17:46

ArangoGutierrez requested review from ArangoGutierrez, Copilot and marquiz January 13, 2026 17:46

Copilot started reviewing on behalf of ArangoGutierrez January 13, 2026 17:47 View session

Copilot AI reviewed Jan 13, 2026

View reviewed changes

ArangoGutierrez requested changes Jan 13, 2026

View reviewed changes

jcpunk force-pushed the hostUsers branch from a179212 to 2c52a26 Compare January 13, 2026 18:02

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Jan 13, 2026

ArangoGutierrez requested review from ArangoGutierrez and Copilot January 14, 2026 12:49

Copilot started reviewing on behalf of ArangoGutierrez January 14, 2026 12:50 View session

Copilot AI reviewed Jan 14, 2026

View reviewed changes

feat(helm): Allow control of hostUsers

6ccee5c

Fixes: kubernetes-sigs#2397 Signed-off-by: Pat Riehecky <[email protected]>

jcpunk force-pushed the hostUsers branch from 2c52a26 to 6ccee5c Compare January 14, 2026 16:09

	\| master.hostUsers \| string \| `nil` \| Run the container with host user ids. NOTE: if hostNetwork is true, hostUsers should be true. \|
	\| master.hostUsers \| bool \| `nil` \| Run the container with host user ids. NOTE: if hostNetwork is true, hostUsers should be true. \|

	\| worker.hostUsers \| string \| `nil` \| Run the container with host user ids. NOTE: if hostNetwork is true, hostUsers should be true. \|
	\| worker.hostUsers \| bool \| `nil` \| Run the container with host user ids. NOTE: if hostNetwork is true, hostUsers should be true. \|

	\| topologyUpdater.hostUsers \| string \| `nil` \| Run the container with host user ids. NOTE: if hostNetwork is true, hostUsers should be true. \|
	\| topologyUpdater.hostUsers \| bool \| `nil` \| Run the container with host user ids. NOTE: if hostNetwork is true, hostUsers should be true. \|

	\| gc.hostUsers \| string \| `nil` \| Run the container with host user ids. NOTE: if hostNetwork is true, hostUsers should be true. \|
	\| gc.hostUsers \| bool \| `nil` \| Run the container with host user ids. NOTE: if hostNetwork is true, hostUsers should be true. \|

feat(helm): Allow control of hostUsers #2411

Are you sure you want to change the base?

feat(helm): Allow control of hostUsers #2411

Uh oh!

Conversation

jcpunk commented Jan 13, 2026

Uh oh!

k8s-ci-robot commented Jan 13, 2026

Uh oh!

k8s-ci-robot commented Jan 13, 2026

Uh oh!

netlify bot commented Jan 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for kubernetes-sigs-nfd ready!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Jan 13, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 13, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 13, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 13, 2026

Choose a reason for hiding this comment

Uh oh!

ArangoGutierrez Jan 13, 2026

Choose a reason for hiding this comment

Uh oh!

jcpunk Jan 13, 2026

Choose a reason for hiding this comment

Uh oh!

jcpunk Jan 13, 2026

Choose a reason for hiding this comment

Uh oh!

ArangoGutierrez Jan 14, 2026

Choose a reason for hiding this comment

Uh oh!

ArangoGutierrez Jan 13, 2026

Choose a reason for hiding this comment

Uh oh!

jcpunk Jan 13, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Jan 14, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 14, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 14, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 14, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 14, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 14, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 14, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 14, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

netlify bot commented Jan 13, 2026 •

edited

Loading