NodeWright Operator

NodeWright (formerly Skyhook) is a Kubernetes-aware package manager for cluster administrators to safely modify and maintain the underlying hosts declaratively, at scale. It updates hosts without re-imaging them, layers workload-specific changes over a common base OS image, and protects workloads that cannot easily be moved.

A NodeWright custom resource declares a set of packages and the nodes they apply to. The operator rolls them out under an interruption budget, cordoning and draining each node before any service restart or reboot a package needs, and leaves pods matching your non-interrupt labels alone.

This image is the NodeWright controller manager: it watches NodeWright and DeploymentPolicy resources and coordinates the cordon, drain, apply, interrupt and uncordon sequence on each node.

Usage

Install it with the NodeWright Helm chart from NGC. The chart pins images by digest, and because the NGC copy has the same digest, pointing the chart at NGC images only needs the repository changed:

helm repo add nvidia https://helm.ngc.nvidia.com/nvidia
helm repo update
helm install nodewright nvidia/nodewright \
  --version <chart-version> \
  --namespace nodewright --create-namespace \
  --set controllerManager.manager.image.repository=nvcr.io/nvidia/nodewright/operator \
  --set controllerManager.manager.agent.repository=nvcr.io/nvidia/nodewright/agent

Then apply a NodeWright resource; see the Quickstart for a first package on one node.

Documentation

• Documentation and Quickstart: https://docs.nvidia.com/nodewright
• Source, issues and release notes: https://github.com/NVIDIA/nodewright
• Pre-built packages: https://github.com/NVIDIA/nodewright-packages

Supply chain

Every release is signed with a keyless Sigstore signature from the GitHub Actions workflow that built it, and carries SLSA v1 build provenance plus a CycloneDX SBOM and an OpenVEX document for each platform. Images on NGC are byte-identical copies of the GitHub Container Registry releases (ghcr.io/nvidia/nodewright/operator), with the same digests and the same evidence, so you can verify them with cosign before you deploy.

See Verify release signatures and attestations for the commands.

License

NodeWright is licensed under the Apache License 2.0. See the LICENSE file for the full terms.

Security

Report vulnerabilities through NVIDIA's Security Vulnerability Form: https://www.nvidia.com/object/submit-security-vulnerability.html