DPF: DPUs at Kubernetes scale

1What DPF is, and which version you are talking about

The DOCA Platform Framework (DPF, GA in 3.5.0) is the Kubernetes-native way to provision DPUs and run DOCA services on them across a fleet. The DOCA 3.5.0 service page pairs with DPF v26.4.0; the GitHub project NVIDIA/doca-platform has since published v26.4.1 (2026-08-31), which is the newest tag. The full tag list is v26.4.1, v26.4.0, v25.10.1, v25.10.0, v25.7.1, v25.7.0, v25.4.0, v25.1.1, v25.1.0, v24.10.0; the release and tree URLs for v26.8.0 and v26.10.0 return 404.^{[1][23][24][25]}

The v26.4.1 support matrix is the number sheet for any qualification: Kubernetes 1.33 to 1.36; Helm v3.5 or newer; DPU firmware 32.38.1002 or newer; MFT 4.33.0-169; BFB 3.4 fully supported and 3.2 LTS allowed, while “Non-LTS BFB versions (3.3, 3.5) are only supported with their corresponding DPF release”; Ubuntu 24.04 with containerd; DPUs B3240, B3220 and B3210; Kamaji v1.36.0-26.6.4, ArgoCD v3.3.0, cert-manager v1.19.3, Multus v3.9.3, SR-IOV device plugin v3.11.0, Network Operator v26.1.0; Socket Direct unsupported.^[2]

2Two trust models, two provisioning paths

Host-trusted: “The host is considered a trusted entity”; “DPUs are managed through in-band communication over the host”; the host is a Kubernetes worker of the target cluster.^[3] Provisioning talks to DMS on the DPU (M5.3), bounded by DPFOperatorConfig.spec.provisioningController.dmsTimeout (900 s in the reference), and v26.4.1 completes the host-agent install phase as soon as DMS returns.^[14][5]

Zero-trust: the host is untrusted; “DPUs are managed through their Baseboard Management Controller (BMC) via Redfish”; all management runs over the DPU OOB network; “The host sees the DPU as a standard NIC”. Zero-trust requires kubernetesAPIServerVIP and kubernetesAPIServerPort in DPFOperatorConfig (v26.4.0), and v26.4.0 added Secure Boot for zero-trust DPUs.^[4][6]

Both start the same way:^[3][4]

helm repo add --force-update dpf-repository https://helm.ngc.nvidia.com/nvidia/doca && helm repo update
helm upgrade --install -n dpf-operator-system dpf-operator dpf-repository/dpf-operator --version=v26.4.1
kubectl rollout status deployment --namespace dpf-operator-system dpf-operator-controller-manager

3The custom resources and the DPU lifecycle

Three API groups (from the v26.4.1 Go types):^{[7][8][9][10][11][12][26]}

A DPU reports its progress through phases: Initializing → Node Effect → Pending → Prepare BFB → DPU Config → Config FW Parameters → Initialize Interface → OS Installing → DPU Cluster Config → Host Network Configuration → Node Effect Removal → Ready, with Error, Deleting, Rebooting and Perform ARM Force Restart as side states; its status also carries firmware{bmc,nic,uefi}, dpuMode, redfishTaskId and kubeletVersion.^[8] Node effect options in the template are taint, noEffect, customLabel or drain.^[9]

The reference use case’s first three objects, verbatim from the v26.4.1 manifests:^[14][15][16]

apiVersion: operator.dpu.nvidia.com/v1alpha1
kind: DPFOperatorConfig
metadata: {name: dpfoperatorconfig, namespace: dpf-operator-system}
spec:
  overrides: {kubernetesAPIServerVIP: $TARGETCLUSTER_API_SERVER_HOST, kubernetesAPIServerPort: $TARGETCLUSTER_API_SERVER_PORT}
  provisioningController: {dmsTimeout: 900}
  kamajiClusterManager: {disable: false}
  nodeSRIOVDevicePluginController: {disable: false}
---
apiVersion: provisioning.dpu.nvidia.com/v1alpha1
kind: DPUCluster
metadata: {name: dpu-cplane-tenant1, namespace: dpu-cplane-tenant1}
spec:
  type: kamaji
  maxNodes: 1000
  clusterEndpoint:
    keepalived: {interface: $DPUCLUSTER_INTERFACE, vip: $DPUCLUSTER_VIP, virtualRouterID: 126, nodeSelector: {node-role.kubernetes.io/control-plane: ""}}
---
apiVersion: provisioning.dpu.nvidia.com/v1alpha1
kind: BFB
metadata: {name: bf-bundle-$TAG, namespace: dpf-operator-system}
spec: {url: $BFB_URL}   # e.g. https://content.mellanox.com/BlueField/BFBs/Ubuntu24.04/bf-bundle-3.4.0-92_26.04_ubuntu-24.04_64k_prod.bfb

4Reading the reference use case: flavor, deployment, chain

The hbn-ovnk-snap-nvme-$TAG DPUFlavor is the hardware recipe. Its grub.kernelParameters include hugepagesz=2048kB hugepages=2298 iommu.passthrough=1; its nvconfig sets PF_BAR2_ENABLE=0 PER_PF_NUM_SF=1 PF_TOTAL_SF=20 PF_SF_BAR_SIZE=10 NUM_PF_MSIX_VALID=0 PF_NUM_PF_MSIX_VALID=1 PF_NUM_PF_MSIX=228 INTERNAL_CPU_MODEL=1 INTERNAL_CPU_OFFLOAD_ENGINE=0 SRIOV_EN=1 NUM_OF_VFS=46 LAG_RESOURCE_ALLOCATION=1 NVME_EMULATION_ENABLE=1 NVME_EMULATION_NUM_PF=1 NVME_EMULATION_NUM_VF=125 NVME_EMULATION_NUM_MSIX=2 LINK_TYPE_P1=ETH LINK_TYPE_P2=ETH; its ovs.rawConfigScript is the production OVS-DOCA sequence from M4 (doca-init=true, hw-offload=true, br-sfc with p0 as type=dpdk mtu_request=9216, br-dpu with pf0hpf); bfcfgParameters are UPDATE_ATF_UEFI=yes, UPDATE_DPU_OS=yes, WITH_NIC_FW_UPDATE=yes; hostNetworkInterfaceConfigs sets portNumber: 0, dhcp: true, mtu: 1500; and configFiles override /etc/mellanox/mlnx-bf.conf (ENABLE_ESWITCH_MULTIPORT="yes"), /etc/mellanox/mlnx-ovs.conf (CREATE_OVS_BRIDGES="no", OVS_DOCA="yes") and an empty /etc/mellanox/mlnx-sf.conf.^[17]

The DPUDeployment hbn-ovnk-snap-nvme binds it all: dpus{bfb: bf-bundle-$TAG, flavor: hbn-ovnk-snap-nvme-$TAG, nodeEffect{drain: true}, dpuSets[{nameSuffix: dpuset1, dpuNodeSelector{matchLabels{feature.node.kubernetes.io/dpu-enabled: "true"}}}], dpuSetStrategy{type: RollingUpdate}}; services ovn, hbn, dts, blueman, snap-node-driver, doca-snap, block-storage-dpu-plugin, spdk-csi-controller-dpu, snap-csi-plugin; and serviceChains.switches wiring {uplink: p0} to hbn/p0_if, {uplink: p1} to hbn/p1_if, {port: ovn} to hbn/pf2dpu2_if, and doca-snap/app_sf (IPAM pool storage-pool) to hbn/snap_if.^[18] Each service is a DPUServiceTemplate (helmChart.source{repoURL, version, chart} plus values) and a DPUServiceConfiguration (serviceConfiguration.helmChart.values, interfaces[{name, network}]). For HBN the template pins chart doca-hbn 3.4.0, image tag 3.4.0-doca3.4.0, resources{memory: 6Gi, nvidia.com/bf_sf: 4}; the configuration lists p0_if, p1_if, pf2dpu2_if, snap_if on network mybrhbn with the rule “Interfaces inside the HBN pod must have the _if suffix”, and Multus iprequest annotations for ip_lo (pool loopback) and ip_pf2dpu2 (pool pool1).^[19][20] DPUServiceInterface objects declare the uplinks (interfaceType: physical, physical.interfaceName: p0), and a DPUServiceIPAM named loopback allocates ipv4Network{network: 11.0.0.0/24, prefixSize: 32}.^[21][22] The DPF page defines the two chain objects: a DPUServiceInterface “declares a physical uplink, host-facing PF or VF, OVS patch interface” and a DPUServiceChain “selects interfaces and defines how they are connected”.^[1]

Use-case prerequisites: BlueField-3 with 32 GB; a top-of-rack that supports BGP and EVPN; worker host PF0 on DHCP with MTU 1500; the control-plane OOB port as an OVS bridge with bridge-uplink; VF roles vf0 provisioning, vf1 ovn-kubernetes, the rest via the SR-IOV device plugin; OVN-Kubernetes chart from oci://ghcr.io/mellanox/charts at tag v26.4.1.^[13]

apiVersion: provisioning.dpu.nvidia.com/v1alpha1
kind: BFB
metadata: {name: bf-bundle-3.4.0, namespace: dpf-operator-system}
spec: {url: https://content.mellanox.com/BlueField/BFBs/Ubuntu24.04/bf-bundle-3.4.0-92_26.04_ubuntu-24.04_64k_prod.bfb}
---
apiVersion: provisioning.dpu.nvidia.com/v1alpha1
kind: DPUFlavor
metadata: {name: hbn-basic, namespace: dpf-operator-system}
spec:
  grub: {kernelParameters: ["hugepagesz=2048kB", "hugepages=2298", "iommu.passthrough=1"]}
  nvconfig:
    - device: "*"
      parameters: ["INTERNAL_CPU_MODEL=1", "INTERNAL_CPU_OFFLOAD_ENGINE=0", "SRIOV_EN=1", "NUM_OF_VFS=16", "PF_TOTAL_SF=20", "PF_SF_BAR_SIZE=10", "LINK_TYPE_P1=ETH", "LINK_TYPE_P2=ETH"]
  ovs: {rawConfigScript: "ovs-vsctl set Open_vSwitch . other_config:doca-init=true\novs-vsctl set Open_vSwitch . other_config:hw-offload=true\nsystemctl restart openvswitch-switch"}
  bfcfgParameters: ["UPDATE_ATF_UEFI=yes", "UPDATE_DPU_OS=yes", "WITH_NIC_FW_UPDATE=yes"]
  hostNetworkInterfaceConfigs: [{portNumber: 0, dhcp: true, mtu: 1500}]
---
apiVersion: provisioning.dpu.nvidia.com/v1alpha1
kind: DPUSet
metadata: {name: dpuset-hbn, namespace: dpf-operator-system}
spec:
  strategy: {type: RollingUpdate, rollingUpdate: {maxUnavailable: 1}}
  dpuNodeSelector: {matchLabels: {dpu: "true"}}
  dpuTemplate:
    spec:
      bfb: {name: bf-bundle-3.4.0}
      dpuFlavor: hbn-basic
      cluster: {name: dpu-cplane-tenant1, namespace: dpu-cplane-tenant1}
      nodeEffect: {drain: true}
---
apiVersion: svc.dpu.nvidia.com/v1alpha1
kind: DPUService
metadata: {name: hbn, namespace: dpf-operator-system}
spec:
  interfaces: [p0_if, p1_if, pf2dpu2_if]   # DPUServiceInterface names, not Helm values
  helmChart:
    source: {repoURL: https://helm.ngc.nvidia.com/nvidia/doca, version: "3.4.0", chart: doca-hbn}
    values:
      image: {repository: nvcr.io/nvidia/doca/doca_hbn, tag: 3.4.0-doca3.4.0}
      resources: {memory: 6Gi, nvidia.com/bf_sf: 4}

apiVersion: ____/v1alpha1
kind: BFB
spec: {url: ____}
---
kind: DPUFlavor
spec:
  nvconfig:
    - device: "*"
      parameters: ["INTERNAL_CPU_MODEL=1", "INTERNAL_CPU_OFFLOAD_ENGINE=____", ...]
  bfcfgParameters: ["UPDATE_ATF_UEFI=yes", "____", "____"]
---
kind: DPUSet
spec:
  strategy: {type: ____}
  dpuTemplate:
    spec:
      bfb: {name: ____}
      dpuFlavor: ____
      nodeEffect: {____: true}
---
apiVersion: ____/v1alpha1
kind: DPUService
spec:
  interfaces: [____, ____]
  helmChart:
    source: {chart: ____, version: "3.4.0"}

apiVersion: provisioning.dpu.nvidia.com/v1alpha1
kind: BFB
metadata: {name: bf-bundle-3.4.0, namespace: dpf-operator-system}
spec: {url: https://content.mellanox.com/BlueField/BFBs/Ubuntu24.04/bf-bundle-3.4.0-92_26.04_ubuntu-24.04_64k_prod.bfb}
---
apiVersion: provisioning.dpu.nvidia.com/v1alpha1
kind: DPUFlavor
metadata: {name: hbn-ovnk-snap-nvme, namespace: dpf-operator-system}
spec:
  nvconfig:
    - device: "*"
      parameters: ["INTERNAL_CPU_MODEL=1", "INTERNAL_CPU_OFFLOAD_ENGINE=1", "SRIOV_EN=1", "NUM_OF_VFS=46"]
  bfcfgParameters: ["UPDATE_ATF_UEFI=yes", "UPDATE_DPU_OS=yes", "WITH_NIC_FW_UPDATE=yes"]
---
apiVersion: svc.dpu.nvidia.com/v1alpha1
kind: DPUSet
metadata: {name: dpuset1, namespace: dpf-operator-system}
spec:
  strategy: {type: RollingUpdate}
  dpuNodeSelector: {matchLabels: {feature.node.kubernetes.io/dpu-enabled: "true"}}
  dpuTemplate:
    spec:
      bfb: {name: bf-bundle-3.4.0}
      dpuFlavor: hbn-flavor
      nodeEffect: {drain: true}
---
apiVersion: svc.dpu.nvidia.com/v1alpha1
kind: DPUServiceIPAM
metadata: {name: loopback, namespace: dpf-operator-system}
spec:
  ipv4Network: {network: 11.0.0.0/24, prefixSize: 24}
---
apiVersion: svc.dpu.nvidia.com/v1alpha1
kind: DPUServiceConfiguration
metadata: {name: hbn, namespace: dpf-operator-system}
spec:
  deploymentServiceName: hbn
  interfaces:
    - {name: p0, network: mybrhbn}
    - {name: p1_if, network: mybrhbn}

5What changed recently, and the Dell view

v26.4.0 (2026-06-29) introduced DPU operational health conditions, DPU-agent-based provisioning, BFB LTS-to-LTS upgrade, an optional BFB PVC, multi-DPUCluster support, a DPF-managed SR-IOV device plugin, Secure Boot for zero-trust, operator-managed observability with Grafana dashboards, a dpfctl SOS report, and the ArgoCD v2 to v3 move.^[6][24] v26.4.1 (2026-08-31, GA) added dpuNodeOOBBridgeName (default br-dpu), a host-agent driver-rebind endpoint, faster host-trusted installs (the install phase completes once DMS returns), an opt-in NoExecute taint (disableHostNetworkReadyNoExecuteTaints: false), a hugepage reduction (“OVS only requires 500 MB”), and nginx 1.30.3 for CVE-2026-42055.^[5][24]