feat: Provisioning for fw binaries

Dockerfile

@@ -23,9 +23,10 @@ COPY ./ ./
 #RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -a -o manager cmd/maintenance-manager/main.go
 RUN --mount=type=cache,target=/go/pkg/mod/ GO_GCFLAGS=${GCFLAGS} make build-manager
 
-# Use distroless as minimal base image to package the manager binary
-# Refer to https://github.com/GoogleContainerTools/distroless for more details
-FROM gcr.io/distroless/static:nonroot
+FROM quay.io/centos/centos:stream9
+
+RUN yum -y install mstflint && yum clean all
+
 WORKDIR /
 COPY --from=builder /workspace/build/manager .
 COPY bindata /bindata

PROJECT

@@ -28,4 +28,20 @@ resources:
   kind: NicDevice
   path: github.com/Mellanox/nic-configuration-operator/api/v1alpha1
   version: v1alpha1
+- api:
+    crdVersion: v1
+    namespaced: true
+  domain: nvidia.com
+  group: configuration.net
+  kind: NicFirmwareSource
+  path: github.com/Mellanox/nic-configuration-operator/api/v1alpha1
+  version: v1alpha1
+- api:
+    crdVersion: v1
+    namespaced: true
+  domain: nvidia.com
+  group: configuration.net
+  kind: NicFirmwareTemplate
+  path: github.com/Mellanox/nic-configuration-operator/api/v1alpha1
+  version: v1alpha1
 version: "3"

api/v1alpha1/nicfirmwaresource_types.go

@@ -0,0 +1,60 @@
+/*
+2025 NVIDIA CORPORATION & AFFILIATES
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha1
+
+import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+// NicFirmwareSourceSpec represents a list of url sources for FW
+type NicFirmwareSourceSpec struct {
+	// BinUrlSource represents a list of url sources for FW
+	BinUrlSource []string `json:"binUrlSource"`
+}
+
+// NicFirmwareSourceStatus represents the status of the FW from given sources, e.g. version available for PSIDs
+type NicFirmwareSourceStatus struct {
+	// State represents the firmware processing state, e.g. Downloading|Processing|Success|ProcessingFailed|DownloadFailed
+	State string `json:"state"`
+	// Reason shows an error message if occurred
+	Reason string `json:"reason,omitempty"`
+	// Versions is a map of available FW versions to PSIDs
+	// a PSID should have only a single FW version available for it
+	Versions map[string][]string `json:"versions,omitempty"`
+}
+
+//+kubebuilder:object:root=true
+//+kubebuilder:subresource:status
+
+// NicFirmwareSource is the Schema for the nicfirmwaresources API
+type NicFirmwareSource struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec   NicFirmwareSourceSpec   `json:"spec,omitempty"`
+	Status NicFirmwareSourceStatus `json:"status,omitempty"`
+}
+
+//+kubebuilder:object:root=true
+
+// NicFirmwareSourceList contains a list of NicFirmwareSource
+type NicFirmwareSourceList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []NicFirmwareSource `json:"items"`
+}
+
+func init() {
+	SchemeBuilder.Register(&NicFirmwareSource{}, &NicFirmwareSourceList{})
+}

api/v1alpha1/nicfirmwaretemplate_types.go

@@ -0,0 +1,72 @@
+/*
+2025 NVIDIA CORPORATION & AFFILIATES
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha1
+
+import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+// FirmwareTemplateSpec specifies a FW update policy for a given FW source ref
+type FirmwareTemplateSpec struct {
+	// NicFirmwareSourceRef refers to existing NicFirmwareSource CR on where to get the FW from
+	// +required
+	NicFirmwareSourceRef string `json:"nicFirmwareSourceRef"`
+	// UpdatePolicy indicates whether the operator needs to validate installed FW or upgrade it
+	// +kubebuilder:validation:Enum=Validate;Update
+	// +required
+	UpdatePolicy string `json:"updatePolicy"`
+}
+
+// NicFirmwareTemplateSpec defines the FW templates and node/nic selectors for it
+type NicFirmwareTemplateSpec struct {
+	// NodeSelector contains labels required on the node
+	NodeSelector map[string]string `json:"nodeSelector,omitempty"`
+	// NIC selector configuration
+	// +required
+	NicSelector *NicSelectorSpec `json:"nicSelector"`
+	// Firmware update template
+	// +required
+	Template *FirmwareTemplateSpec `json:"template"`
+}
+
+// NicFirmwareTemplateStatus lists the NicDevice CRs matching the FW template
+type NicFirmwareTemplateStatus struct {
+	// NicDevice CRs matching this firmware template
+	NicDevices []string `json:"nicDevices"`
+}
+
+//+kubebuilder:object:root=true
+//+kubebuilder:subresource:status
+
+// NicFirmwareTemplate is the Schema for the nicfirmwaretemplates API
+type NicFirmwareTemplate struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec   NicFirmwareTemplateSpec   `json:"spec,omitempty"`
+	Status NicFirmwareTemplateStatus `json:"status,omitempty"`
+}
+
+//+kubebuilder:object:root=true
+
+// NicFirmwareTemplateList contains a list of NicFirmwareTemplate
+type NicFirmwareTemplateList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []NicFirmwareTemplate `json:"items"`
+}
+
+func init() {
+	SchemeBuilder.Register(&NicFirmwareTemplate{}, &NicFirmwareTemplateList{})
+}